diff --git a/common.gypi b/common.gypi
index 162faabcefc3bc..4dd65c9f011bc9 100644
--- a/common.gypi
+++ b/common.gypi
@@ -38,7 +38,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.16',
+    'v8_embedder_string': '-node.12',
 
     ##### V8 defaults for Node.js #####
 
@@ -78,8 +78,6 @@
     'v8_win64_unwinding_info': 1,
 
     # Variables controlling external defines exposed in public headers.
-    'v8_enable_conservative_stack_scanning%': 0,
-    'v8_enable_direct_local%': 0,
     'v8_enable_map_packing%': 0,
     'v8_enable_pointer_compression_shared_cage%': 0,
     'v8_enable_sandbox%': 0,
@@ -473,12 +471,6 @@
       ['tsan == 1', {
         'defines': ['V8_IS_TSAN',],
       }],
-      ['v8_enable_conservative_stack_scanning == 1', {
-        'defines': ['V8_ENABLE_CONSERVATIVE_STACK_SCANNING',],
-      }],
-      ['v8_enable_direct_local == 1', {
-        'defines': ['V8_ENABLE_DIRECT_LOCAL',],
-      }],
       ['OS == "win"', {
         'defines': [
           'WIN32',
diff --git a/deps/v8/.git-blame-ignore-revs b/deps/v8/.git-blame-ignore-revs
index 29372f34c1813d..0b12c1ac601857 100644
--- a/deps/v8/.git-blame-ignore-revs
+++ b/deps/v8/.git-blame-ignore-revs
@@ -85,6 +85,9 @@ e50b49a0e38b34e2b28e026f4d1c7e0da0c7bb1a
 # Rewrite code base to use "." instead of "->" to access Object members.
 878ccb33bd3cf0e6dc018ff8d15843f585ac07be
 
+# Rewrite code base to use "->" instead of "." to access Object members.
+95532da70de14206e64060647082766a293f81cb
+
 # Splitting src/ into subfolders
 632239011db501e76475d82ff6492f37fa8c1edc
 f455f86d899716df3b9550950ce172f5b867619a
diff --git a/deps/v8/.gn b/deps/v8/.gn
index b9b11d589b582a..d83c69db63f963 100644
--- a/deps/v8/.gn
+++ b/deps/v8/.gn
@@ -30,10 +30,13 @@ default_args = {
 
   # Disable rust dependencies.
   enable_rust = true
+
+  # Needed only for std::atomic_ref<T> for large Ts http://crbug.com/402171653
+  use_llvm_libatomic = false
 }
 
 # These are the list of GN files that run exec_script. This whitelist exists
 # to force additional review for new uses of exec_script, which is strongly
 # discouraged except for gypi_to_gn calls.
-exec_script_whitelist = build_dotfile_settings.exec_script_whitelist +
+exec_script_allowlist = build_dotfile_settings.exec_script_allowlist +
                         [ "//build_overrides/build.gni" ]
diff --git a/deps/v8/.vpython3 b/deps/v8/.vpython3
index 6afd6e51890055..0d30d688efa997 100644
--- a/deps/v8/.vpython3
+++ b/deps/v8/.vpython3
@@ -22,7 +22,7 @@
 # Read more about `vpython` and how to modify this file here:
 #   https://chromium.googlesource.com/infra/infra/+/main/doc/users/vpython.md
 
-python_version: "3.8"
+python_version: "3.11"
 
 # The default set of platforms vpython checks does not yet include mac-arm64.
 # Setting `verify_pep425_tag` to the list of platforms we explicitly must support
@@ -47,7 +47,7 @@ wheel: <
 
 wheel: <
   name: "infra/python/wheels/coverage/${vpython_platform}"
-  version: "version:5.5.chromium.3"
+  version: "version:7.3.1"
 >
 
 wheel: <
@@ -55,6 +55,11 @@ wheel: <
  version: "version:3.0.0"
 >
 
+wheel: <
+ name: "infra/python/wheels/filecheck-py2_py3"
+ version: "version:1.0.1"
+>
+
 wheel: <
  name: "infra/python/wheels/funcsigs-py2_py3"
  version: "version:1.0.2"
@@ -67,7 +72,7 @@ wheel: <
 
 wheel: <
   name: "infra/python/wheels/numpy/${vpython_platform}"
-  version: "version:1.2x.supported.1"
+  version: "version:1.23.5.chromium.4"
 >
 
 wheel: <
@@ -97,6 +102,6 @@ wheel: <
   version: "version:2.0.4"
 >
 wheel: <
-  name: "infra/python/wheels/pyfakefs-py2_py3"
-  version: "version:3.7.2"
->
\ No newline at end of file
+  name: "infra/python/wheels/pyfakefs-py3"
+  version: "version:5.7.3"
+>
diff --git a/deps/v8/AUTHORS b/deps/v8/AUTHORS
index e5a0957b3a928e..280e33e6841cc1 100644
--- a/deps/v8/AUTHORS
+++ b/deps/v8/AUTHORS
@@ -334,3 +334,4 @@ Kotaro Ohsugi <dec4m4rk@gmail.com>
 Jing Peiyang <jingpeiyang@eswincomputing.com>
 magic-akari <akari.ccino@gmail.com>
 Ryuhei Shima <shimaryuhei@gmail.com>
+Domagoj Stolfa <domagoj.stolfa@gmail.com>
diff --git a/deps/v8/BUILD.bazel b/deps/v8/BUILD.bazel
index 54be2b945d4d23..920ed94829fdb8 100644
--- a/deps/v8/BUILD.bazel
+++ b/deps/v8/BUILD.bazel
@@ -41,7 +41,6 @@ load(":bazel/v8-non-pointer-compression.bzl", "v8_binary_non_pointer_compression
 # v8_enable_trace_feedback_updates
 # v8_enable_atomic_object_field_writes
 # v8_enable_concurrent_marking
-# v8_enable_conservative_stack_scanning
 # v8_enable_direct_handle
 # v8_enable_local_off_stack_check
 # v8_enable_ignition_dispatch_counting
@@ -671,6 +670,7 @@ filegroup(
         "include/cppgc/process-heap-statistics.h",
         "include/cppgc/sentinel-pointer.h",
         "include/cppgc/source-location.h",
+        "include/cppgc/tagged-member.h",
         "include/cppgc/trace-trait.h",
         "include/cppgc/type-traits.h",
         "include/cppgc/visitor.h",
@@ -685,6 +685,7 @@ filegroup(
         "include/v8-callbacks.h",
         "include/v8-container.h",
         "include/v8-context.h",
+        "include/v8-cpp-heap-external.h",
         "include/v8-cppgc.h",
         "include/v8-data.h",
         "include/v8-date.h",
@@ -831,6 +832,25 @@ filegroup(
         "src/base/numbers/fixed-dtoa.h",
         "src/base/numbers/strtod.cc",
         "src/base/numbers/strtod.h",
+        "src/base/numerics/angle_conversions.h",
+        "src/base/numerics/basic_ops_impl.h",
+        "src/base/numerics/byte_conversions.h",
+        "src/base/numerics/checked_math.h",
+        "src/base/numerics/checked_math_impl.h",
+        "src/base/numerics/clamped_math.h",
+        "src/base/numerics/clamped_math_impl.h",
+        "src/base/numerics/integral_constant_like.h",
+        "src/base/numerics/math_constants.h",
+        "src/base/numerics/ostream_operators.h",
+        "src/base/numerics/ranges.h",
+        "src/base/numerics/safe_conversions.h",
+        "src/base/numerics/safe_conversions_arm_impl.h",
+        "src/base/numerics/safe_conversions_impl.h",
+        "src/base/numerics/safe_math.h",
+        "src/base/numerics/safe_math_arm_impl.h",
+        "src/base/numerics/safe_math_clang_gcc_impl.h",
+        "src/base/numerics/safe_math_shared_impl.h",
+        "src/base/numerics/wrapping_math.h",
         "src/base/once.cc",
         "src/base/once.h",
         "src/base/overflowing-math.h",
@@ -857,9 +877,6 @@ filegroup(
         "src/base/region-allocator.cc",
         "src/base/region-allocator.h",
         "src/base/ring-buffer.h",
-        "src/base/safe_conversions.h",
-        "src/base/safe_conversions_arm_impl.h",
-        "src/base/safe_conversions_impl.h",
         "src/base/small-map.h",
         "src/base/small-vector.h",
         "src/base/string-format.h",
@@ -1129,6 +1146,7 @@ filegroup(
         "src/objects/call-site-info.tq",
         "src/objects/cell.tq",
         "src/objects/contexts.tq",
+        "src/objects/cpp-heap-external-object.tq",
         "src/objects/data-handler.tq",
         "src/objects/debug-objects.tq",
         "src/objects/descriptor-array.tq",
@@ -1430,6 +1448,8 @@ filegroup(
         "src/codegen/interface-descriptors.cc",
         "src/codegen/interface-descriptors.h",
         "src/codegen/interface-descriptors-inl.h",
+        "src/codegen/jump-table-info.cc",
+        "src/codegen/jump-table-info.h",
         "src/codegen/label.h",
         "src/codegen/linkage-location.h",
         "src/codegen/machine-type.cc",
@@ -1723,7 +1743,6 @@ filegroup(
         "src/heap/heap-write-barrier-inl.h",
         "src/heap/incremental-marking.cc",
         "src/heap/incremental-marking.h",
-        "src/heap/incremental-marking-inl.h",
         "src/heap/incremental-marking-job.cc",
         "src/heap/incremental-marking-job.h",
         "src/heap/index-generator.cc",
@@ -1982,6 +2001,10 @@ filegroup(
         "src/objects/contexts.cc",
         "src/objects/contexts.h",
         "src/objects/contexts-inl.h",
+        "src/objects/cpp-heap-external-object.h",
+        "src/objects/cpp-heap-external-object-inl.h",
+        "src/objects/cpp-heap-object-wrapper.h",
+        "src/objects/cpp-heap-object-wrapper-inl.h",
         "src/objects/data-handler.h",
         "src/objects/data-handler-inl.h",
         "src/objects/debug-objects.cc",
@@ -2604,8 +2627,6 @@ filegroup(
             "src/codegen/x64/assembler-x64.cc",
             "src/codegen/x64/assembler-x64.h",
             "src/codegen/x64/assembler-x64-inl.h",
-            "src/codegen/x64/builtin-jump-table-info-x64.cc",
-            "src/codegen/x64/builtin-jump-table-info-x64.h",
             "src/codegen/x64/constants-x64.h",
             "src/codegen/x64/cpu-x64.cc",
             "src/codegen/x64/fma-instr.h",
diff --git a/deps/v8/BUILD.gn b/deps/v8/BUILD.gn
index 9a2b2cdd94f9b9..818f13802c6660 100644
--- a/deps/v8/BUILD.gn
+++ b/deps/v8/BUILD.gn
@@ -25,12 +25,6 @@ if (is_ios) {
   import("//build/config/apple/mobile_config.gni")  # For `target_platform`.
 }
 
-# Specifies if the target build is a simulator build. Comparing target cpu
-# with v8 target cpu to not affect simulator builds for making cross-compile
-# snapshots.
-target_is_simulator = (target_cpu != v8_target_cpu && !v8_multi_arch_build) ||
-                      (current_cpu != v8_current_cpu && v8_multi_arch_build)
-
 # For faster Windows builds. See https://crbug.com/v8/8475.
 emit_builtins_as_inline_asm = is_win && is_clang
 
@@ -323,10 +317,11 @@ declare_args() {
 
   # Enable control-flow integrity features, such as pointer authentication for
   # ARM64. Enable it by default for simulator builds and when native code
-  # supports it as well.
-  v8_control_flow_integrity =
-      v8_current_cpu == "arm64" &&
-      (target_is_simulator || arm_control_flow_integrity != "none")
+  # supports it as well. On Mac, control-flow integrity does not work so we
+  # avoid enabling it when using the simulator.
+  v8_control_flow_integrity = v8_current_cpu == "arm64" &&
+                              ((v8_target_is_simulator && target_os != "mac") ||
+                               arm_control_flow_integrity != "none")
 
   # Enable heap reservation of size 4GB. Only possible for 64bit archs.
   cppgc_enable_caged_heap =
@@ -361,6 +356,10 @@ declare_args() {
   # Requires use_rtti = true
   v8_enable_precise_zone_stats = false
 
+  # Set this if V8 monolithic static library is going to be linked into
+  # another shared library.
+  v8_monolithic_for_shared_library = false
+
   # Experimental feature that uses SwissNameDictionary instead of NameDictionary
   # as the backing store for all dictionary mode objects.
   v8_enable_swiss_name_dictionary = false
@@ -739,7 +738,8 @@ if (v8_builtins_profiling_log_file == "default") {
   }
 }
 
-if (v8_enable_webassembly && !target_is_simulator && v8_current_cpu == "x64") {
+if (v8_enable_webassembly && !v8_target_is_simulator &&
+    v8_current_cpu == "x64") {
   v8_enable_wasm_simd256_revec = true
 }
 
@@ -989,7 +989,6 @@ external_v8_defines = [
   "V8_USE_PERFETTO",
   "V8_MAP_PACKING",
   "V8_IS_TSAN",
-  "V8_ENABLE_CONSERVATIVE_STACK_SCANNING",
   "V8_ENABLE_DIRECT_HANDLE",
   "V8_MINORMS_STRING_SHORTCUTTING",
   "V8_HAVE_TARGET_OS",
@@ -1044,9 +1043,6 @@ if (v8_enable_map_packing) {
 if (is_tsan) {
   enabled_external_v8_defines += [ "V8_IS_TSAN" ]
 }
-if (v8_enable_conservative_stack_scanning) {
-  enabled_external_v8_defines += [ "V8_ENABLE_CONSERVATIVE_STACK_SCANNING" ]
-}
 if (v8_enable_direct_handle) {
   enabled_external_v8_defines += [ "V8_ENABLE_DIRECT_HANDLE" ]
 }
@@ -1184,6 +1180,10 @@ config("features") {
     defines += [ "CPPGC_ALLOW_ALLOCATIONS_IN_PREFINALIZERS" ]
   }
 
+  if (v8_monolithic && v8_monolithic_for_shared_library) {
+    defines += [ "V8_TLS_USED_IN_LIBRARY" ]
+  }
+
   if (v8_enable_pointer_compression &&
       !v8_enable_pointer_compression_shared_cage) {
     defines += [ "V8_COMPRESS_POINTERS_IN_MULTIPLE_CAGES" ]
@@ -1447,6 +1447,9 @@ config("features") {
   if (v8_lower_limits_mode) {
     defines += [ "V8_LOWER_LIMITS_MODE" ]
   }
+  if (v8_target_is_simulator) {
+    defines += [ "USE_SIMULATOR" ]
+  }
 }
 
 config("toolchain") {
@@ -1497,7 +1500,7 @@ config("toolchain") {
   }
 
   # Mips64el simulators.
-  if (target_is_simulator && v8_current_cpu == "mips64el") {
+  if (v8_target_is_simulator && v8_current_cpu == "mips64el") {
     defines += [ "_MIPS_TARGET_SIMULATOR" ]
   }
 
@@ -1530,7 +1533,7 @@ config("toolchain") {
   }
 
   # loong64 simulators.
-  if (target_is_simulator && v8_current_cpu == "loong64") {
+  if (v8_target_is_simulator && v8_current_cpu == "loong64") {
     defines += [ "_LOONG64_TARGET_SIMULATOR" ]
   }
   if (v8_current_cpu == "loong64") {
@@ -1563,10 +1566,10 @@ config("toolchain") {
 
   # Under simulator build, compiler will not provide __riscv_xlen. Define here
   if (v8_current_cpu == "riscv64" || v8_current_cpu == "riscv32") {
-    if (target_is_simulator) {
+    if (v8_target_is_simulator) {
       defines += [ "_RISCV_TARGET_SIMULATOR" ]
     }
-    if (riscv_use_rvv || target_is_simulator) {
+    if (riscv_use_rvv || v8_target_is_simulator) {
       defines += [ "CAN_USE_RVV_INSTRUCTIONS" ]
       defines += [ "RVV_VLEN=${riscv_rvv_vlen}" ]
     }
@@ -1823,6 +1826,10 @@ if (v8_postmortem_support) {
       "src/objects/casting-inl.h",
       "src/objects/code.h",
       "src/objects/code-inl.h",
+      "src/objects/cpp-heap-external-object.h",
+      "src/objects/cpp-heap-external-object-inl.h",
+      "src/objects/cpp-heap-object-wrapper.h",
+      "src/objects/cpp-heap-object-wrapper-inl.h",
       "src/objects/data-handler.h",
       "src/objects/data-handler-inl.h",
       "src/objects/deoptimization-data.h",
@@ -2061,6 +2068,7 @@ torque_files = [
   "src/objects/cell.tq",
   "src/objects/bytecode-array.tq",
   "src/objects/contexts.tq",
+  "src/objects/cpp-heap-external-object.tq",
   "src/objects/data-handler.tq",
   "src/objects/debug-objects.tq",
   "src/objects/descriptor-array.tq",
@@ -2546,7 +2554,7 @@ template("run_mksnapshot") {
     # This is needed to distinguish between generating code for the simulator
     # and cross-compiling. The latter may need to run code on the host with the
     # simulator but cannot use simulator-specific instructions.
-    if (target_is_simulator) {
+    if (v8_target_is_simulator) {
       args += [ "--target_is_simulator" ]
     }
 
@@ -2788,7 +2796,6 @@ action("v8_dump_build_config") {
     "code_comments=$v8_code_comments",
     "component_build=$is_component_build",
     "concurrent_marking=$v8_enable_concurrent_marking",
-    "conservative_stack_scanning=$v8_enable_conservative_stack_scanning",
     "current_cpu=\"$current_cpu\"",
     "dcheck_always_on=$v8_dcheck_always_on",
     "debug_code=$v8_enable_debug_code",
@@ -2854,8 +2861,6 @@ generated_file("v8_generate_features_json") {
   contents = {
     v8_deprecation_warnings = v8_deprecation_warnings
     v8_enable_31bit_smis_on_64bit_arch = v8_enable_31bit_smis_on_64bit_arch
-    v8_enable_conservative_stack_scanning =
-        v8_enable_conservative_stack_scanning
     v8_enable_direct_handle = v8_enable_direct_handle
     v8_enable_extensible_ro_snapshot = v8_enable_extensible_ro_snapshot
     v8_enable_gdbjit = v8_enable_gdbjit
@@ -3176,6 +3181,7 @@ v8_header_set("v8_headers") {
     "include/v8-callbacks.h",
     "include/v8-container.h",
     "include/v8-context.h",
+    "include/v8-cpp-heap-external.h",
     "include/v8-cppgc.h",
     "include/v8-data.h",
     "include/v8-date.h",
@@ -3380,6 +3386,7 @@ v8_header_set("v8_internal_headers") {
     "src/codegen/handler-table.h",
     "src/codegen/interface-descriptors-inl.h",
     "src/codegen/interface-descriptors.h",
+    "src/codegen/jump-table-info.h",
     "src/codegen/label.h",
     "src/codegen/linkage-location.h",
     "src/codegen/machine-type.h",
@@ -3773,7 +3780,6 @@ v8_header_set("v8_internal_headers") {
     "src/heap/heap-write-barrier-inl.h",
     "src/heap/heap-write-barrier.h",
     "src/heap/heap.h",
-    "src/heap/incremental-marking-inl.h",
     "src/heap/incremental-marking-job.h",
     "src/heap/incremental-marking.h",
     "src/heap/index-generator.h",
@@ -3937,6 +3943,10 @@ v8_header_set("v8_internal_headers") {
     "src/objects/compressed-slots.h",
     "src/objects/contexts-inl.h",
     "src/objects/contexts.h",
+    "src/objects/cpp-heap-external-object-inl.h",
+    "src/objects/cpp-heap-external-object.h",
+    "src/objects/cpp-heap-object-wrapper-inl.h",
+    "src/objects/cpp-heap-object-wrapper.h",
     "src/objects/data-handler-inl.h",
     "src/objects/data-handler.h",
     "src/objects/debug-objects-inl.h",
@@ -4610,7 +4620,6 @@ v8_header_set("v8_internal_headers") {
       "src/codegen/shared-ia32-x64/macro-assembler-shared-ia32-x64.h",
       "src/codegen/x64/assembler-x64-inl.h",
       "src/codegen/x64/assembler-x64.h",
-      "src/codegen/x64/builtin-jump-table-info-x64.h",
       "src/codegen/x64/constants-x64.h",
       "src/codegen/x64/fma-instr.h",
       "src/codegen/x64/interface-descriptors-x64-inl.h",
@@ -4711,8 +4720,10 @@ v8_header_set("v8_internal_headers") {
           (current_cpu == "x64" && (is_linux || is_chromeos || is_mac))) {
         sources += [ "src/trap-handler/handler-inside-posix.h" ]
       }
-      if (current_cpu == "x64" &&
-          (is_linux || is_chromeos || is_mac || is_win)) {
+      if ((current_cpu == "x64" &&
+           (is_linux || is_chromeos || is_mac || is_win)) ||
+          (current_cpu == "arm64" && v8_target_is_simulator &&
+           (is_linux || is_mac))) {
         sources += [ "src/trap-handler/trap-handler-simulator.h" ]
       }
     }
@@ -5401,6 +5412,7 @@ v8_source_set("v8_base_without_compiler") {
     "src/codegen/flush-instruction-cache.cc",
     "src/codegen/handler-table.cc",
     "src/codegen/interface-descriptors.cc",
+    "src/codegen/jump-table-info.cc",
     "src/codegen/machine-type.cc",
     "src/codegen/macro-assembler-base.cc",
     "src/codegen/maglev-safepoint-table.cc",
@@ -5984,7 +5996,6 @@ v8_source_set("v8_base_without_compiler") {
       ### gcmole(x64) ###
       "src/codegen/shared-ia32-x64/macro-assembler-shared-ia32-x64.cc",
       "src/codegen/x64/assembler-x64.cc",
-      "src/codegen/x64/builtin-jump-table-info-x64.cc",
       "src/codegen/x64/cpu-x64.cc",
       "src/codegen/x64/macro-assembler-x64.cc",
       "src/deoptimizer/x64/deoptimizer-x64.cc",
@@ -6065,7 +6076,7 @@ v8_source_set("v8_base_without_compiler") {
           "src/trap-handler/handler-outside-win.cc",
         ]
       }
-      if (current_cpu == "x64" &&
+      if ((current_cpu == "x64" || current_cpu == "arm64") &&
           (is_linux || is_chromeos || is_mac || is_win)) {
         sources += [ "src/trap-handler/handler-outside-simulator.cc" ]
       }
@@ -6529,6 +6540,25 @@ v8_component("v8_libbase") {
     "src/base/numbers/fixed-dtoa.h",
     "src/base/numbers/strtod.cc",
     "src/base/numbers/strtod.h",
+    "src/base/numerics/angle_conversions.h",
+    "src/base/numerics/basic_ops_impl.h",
+    "src/base/numerics/byte_conversions.h",
+    "src/base/numerics/checked_math.h",
+    "src/base/numerics/checked_math_impl.h",
+    "src/base/numerics/clamped_math.h",
+    "src/base/numerics/clamped_math_impl.h",
+    "src/base/numerics/integral_constant_like.h",
+    "src/base/numerics/math_constants.h",
+    "src/base/numerics/ostream_operators.h",
+    "src/base/numerics/ranges.h",
+    "src/base/numerics/safe_conversions.h",
+    "src/base/numerics/safe_conversions_arm_impl.h",
+    "src/base/numerics/safe_conversions_impl.h",
+    "src/base/numerics/safe_math.h",
+    "src/base/numerics/safe_math_arm_impl.h",
+    "src/base/numerics/safe_math_clang_gcc_impl.h",
+    "src/base/numerics/safe_math_shared_impl.h",
+    "src/base/numerics/wrapping_math.h",
     "src/base/once.cc",
     "src/base/once.h",
     "src/base/overflowing-math.h",
@@ -6554,9 +6584,6 @@ v8_component("v8_libbase") {
     "src/base/region-allocator.cc",
     "src/base/region-allocator.h",
     "src/base/ring-buffer.h",
-    "src/base/safe_conversions.h",
-    "src/base/safe_conversions_arm_impl.h",
-    "src/base/safe_conversions_impl.h",
     "src/base/sanitizer/asan.h",
     "src/base/sanitizer/lsan-page-allocator.cc",
     "src/base/sanitizer/lsan-page-allocator.h",
@@ -7010,6 +7037,7 @@ v8_header_set("cppgc_headers") {
     "include/cppgc/process-heap-statistics.h",
     "include/cppgc/sentinel-pointer.h",
     "include/cppgc/source-location.h",
+    "include/cppgc/tagged-member.h",
 
     # TODO(v8:11952): Remove the testing header here once depending on both,
     # //v8:v8 and //v8:v8_for_testing does not result in ODR violations.
diff --git a/deps/v8/DEPS b/deps/v8/DEPS
index 36fb1fc0f2624d..9d240951e47b47 100644
--- a/deps/v8/DEPS
+++ b/deps/v8/DEPS
@@ -74,24 +74,24 @@ vars = {
   'build_with_chromium': False,
 
   # GN CIPD package version.
-  'gn_version': 'git_revision:6e8e0d6d4a151ab2ed9b4a35366e630c55888444',
+  'gn_version': 'git_revision:90478db6b59b9bebf7ca4cf912d860cf868e724c',
 
   # ninja CIPD package version
   # https://chrome-infra-packages.appspot.com/p/infra/3pp/tools/ninja
   'ninja_version': 'version:3@1.12.1.chromium.4',
 
   # siso CIPD package version
-  'siso_version': 'git_revision:68bdc49e4e23aef066fc652cbdb1b4973aab1a31',
+  'siso_version': 'git_revision:70e1167e0e6dad10c8388cace8fd9d9376c43316',
 
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Fuchsia sdk
   # and whatever else without interference from each other.
-  'fuchsia_version': 'version:27.20250326.5.1',
+  'fuchsia_version': 'version:27.20250424.2.1',
 
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling partition_alloc_version
   # and whatever else without interference from each other.
-  'partition_alloc_version': 'ab56923a27b2793f21994589b0c39bc3324ff49f',
+  'partition_alloc_version': '862506deb382f3f8a8fa9689c8d5136a48e9b778',
 
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling android_sdk_build-tools_version
@@ -129,9 +129,9 @@ vars = {
 
 deps = {
   'build':
-    Var('chromium_url') + '/chromium/src/build.git' + '@' + '451ef881d77fff0b7a8bbfa61934f5e4a35b4c96',
+    Var('chromium_url') + '/chromium/src/build.git' + '@' + '88030b320338e0706b6b93336c4b35e6bbaf467e',
   'buildtools':
-    Var('chromium_url') + '/chromium/src/buildtools.git' + '@' + '6f359296daa889aa726f3d05046b9f37be241169',
+    Var('chromium_url') + '/chromium/src/buildtools.git' + '@' + '0f32cb9025766951122d4ed19aba87a94ded3f43',
   'buildtools/linux64': {
     'packages': [
       {
@@ -177,7 +177,7 @@ deps = {
   'test/mozilla/data':
     Var('chromium_url') + '/v8/deps/third_party/mozilla-tests.git' + '@' + 'f6c578a10ea707b1a8ab0b88943fe5115ce2b9be',
   'test/test262/data':
-    Var('chromium_url') + '/external/github.com/tc39/test262.git' + '@' + 'ce7e72d2107f99d165f4259571f10aa75753d997',
+    Var('chromium_url') + '/external/github.com/tc39/test262.git' + '@' + 'c5257e6119f83f856602f2ccbc46547a8fef0960',
   'third_party/android_platform': {
     'url': Var('chromium_url') + '/chromium/src/third_party/android_platform.git' + '@' + '98aee46efb1cc4e09fa0e3ecaa6b19dc258645fa',
     'condition': 'checkout_android',
@@ -224,14 +224,14 @@ deps = {
     'packages': [
       {
         'package': 'chromium/third_party/android_toolchain/android_toolchain',
-        'version': 'Idl-vYnWGnM8K3XJhM3h6zjYVDXlnljVz3FE00V9IM8C',
+        'version': 'KXOia11cm9lVdUdPlbGLu8sCz6Y4ey_HV2s8_8qeqhgC',
       },
     ],
     'condition': 'checkout_android',
     'dep_type': 'cipd',
   },
   'third_party/catapult': {
-    'url': Var('chromium_url') + '/catapult.git' + '@' + '5bda0fdab9d93ec9963e2cd858c7b49ad7fec7d4',
+    'url': Var('chromium_url') + '/catapult.git' + '@' + '000f47cfa393d7f9557025a252862e2a61a60d44',
     'condition': 'checkout_android',
   },
   'third_party/clang-format/script':
@@ -245,17 +245,17 @@ deps = {
     'condition': 'checkout_android',
   },
   'third_party/depot_tools':
-    Var('chromium_url') + '/chromium/tools/depot_tools.git' + '@' + 'f40ddcd8d51626fb7be3ab3c418b3f3be801623f',
+    Var('chromium_url') + '/chromium/tools/depot_tools.git' + '@' + '1fcc527019d786502b02f71b8b764ee674a40953',
   'third_party/fp16/src':
     Var('chromium_url') + '/external/github.com/Maratyszcza/FP16.git' + '@' + '0a92994d729ff76a58f692d3028ca1b64b145d91',
   'third_party/fast_float/src':
     Var('chromium_url') + '/external/github.com/fastfloat/fast_float.git' + '@' + 'cb1d42aaa1e14b09e1452cfdef373d051b8c02a4',
   'third_party/fuchsia-gn-sdk': {
-    'url': Var('chromium_url') + '/chromium/src/third_party/fuchsia-gn-sdk.git' + '@' + '3845a68eb4421e64fbdf9f4805b5ac6d73742e08',
+    'url': Var('chromium_url') + '/chromium/src/third_party/fuchsia-gn-sdk.git' + '@' + 'e678aca1bad7a1c9a38620b2e328281bc68f6357',
     'condition': 'checkout_fuchsia',
   },
   'third_party/simdutf':
-    Var('chromium_url') + '/chromium/src/third_party/simdutf' + '@' + '40d1fa26cd5ca221605c974e22c001ca2fb12fde',
+    Var('chromium_url') + '/chromium/src/third_party/simdutf' + '@' + '62d1cfb62967c0076c997a10d54d50f9571fb8e9',
   # Exists for rolling the Fuchsia SDK. Check out of the SDK should always
   # rely on the hook running |update_sdk.py| script below.
   'third_party/fuchsia-sdk/sdk': {
@@ -269,21 +269,21 @@ deps = {
       'dep_type': 'cipd',
   },
   'third_party/google_benchmark_chrome': {
-    'url': Var('chromium_url') + '/chromium/src/third_party/google_benchmark.git' + '@' + '917e1208b42fdce63511e401067677ffee3a5c7d',
+    'url': Var('chromium_url') + '/chromium/src/third_party/google_benchmark.git' + '@' + '29e4389fdc1eeb9137eb464b7f34e07c01c2731e',
   },
   'third_party/google_benchmark_chrome/src': {
     'url': Var('chromium_url') + '/external/github.com/google/benchmark.git' + '@' + '761305ec3b33abf30e08d50eb829e19a802581cc',
   },
   'third_party/fuzztest':
-    Var('chromium_url') + '/chromium/src/third_party/fuzztest.git' + '@' + 'df29ed1355d06c486e17fc421767ff01af050ca4',
+    Var('chromium_url') + '/chromium/src/third_party/fuzztest.git' + '@' + '4a7e9c055e63f4d67e04229ab491eaefe409addf',
   'third_party/fuzztest/src':
-    Var('chromium_url') + '/external/github.com/google/fuzztest.git' + '@' + '3c7bc855a4938c5d0d1d07303aa0697c88d33e6c',
+    Var('chromium_url') + '/external/github.com/google/fuzztest.git' + '@' + 'b10387fdbbca18192f85eaa5323a59f44bf9c468',
   'third_party/googletest/src':
-    Var('chromium_url') + '/external/github.com/google/googletest.git' + '@' + '52204f78f94d7512df1f0f3bea1d47437a2c3a58',
+    Var('chromium_url') + '/external/github.com/google/googletest.git' + '@' + 'cd430b47a54841ec45d64d2377d7cabaf0eba610',
   'third_party/highway/src':
     Var('chromium_url') + '/external/github.com/google/highway.git' + '@' + '00fe003dac355b979f36157f9407c7c46448958e',
   'third_party/icu':
-    Var('chromium_url') + '/chromium/deps/icu.git' + '@' + 'c9fb4b3a6fb54aa8c20a03bbcaa0a4a985ffd34b',
+    Var('chromium_url') + '/chromium/deps/icu.git' + '@' + '4c8cc4b365a505ce35be1e0bd488476c5f79805d',
   'third_party/instrumented_libs': {
     'url': Var('chromium_url') + '/chromium/third_party/instrumented_libraries.git' + '@' + '69015643b3f68dbd438c010439c59adc52cac808',
     'condition': 'checkout_instrumented_libraries',
@@ -299,155 +299,155 @@ deps = {
   'third_party/jsoncpp/source':
     Var('chromium_url') + '/external/github.com/open-source-parsers/jsoncpp.git'+ '@' + '42e892d96e47b1f6e29844cc705e148ec4856448',
   'third_party/libc++/src':
-    Var('chromium_url') + '/external/github.com/llvm/llvm-project/libcxx.git' + '@' + '449310fe2e37834a7e62972d2a690cade2ef596b',
+    Var('chromium_url') + '/external/github.com/llvm/llvm-project/libcxx.git' + '@' + '917609c669e43edc850eeb192a342434a54e1dfd',
   'third_party/libc++abi/src':
-    Var('chromium_url') + '/external/github.com/llvm/llvm-project/libcxxabi.git' + '@' + '94c5d7a8edc09f0680aee57548c0b5d400c2840d',
+    Var('chromium_url') + '/external/github.com/llvm/llvm-project/libcxxabi.git' + '@' + 'f2a7f2987f9dcdf8b04c2d8cd4dcb186641a7c3e',
   'third_party/libunwind/src':
-    Var('chromium_url') + '/external/github.com/llvm/llvm-project/libunwind.git' + '@' + 'e2e6f2a67e9420e770b014ce9bba476fa2ab9874',
+    Var('chromium_url') + '/external/github.com/llvm/llvm-project/libunwind.git' + '@' + '81e2cb40a70de2b6978e6d8658891ded9a77f7e3',
   'third_party/llvm-libc/src':
-    Var('chromium_url') + '/external/github.com/llvm/llvm-project/libc.git' + '@' + '188329a7f2118a957efbb3e6219c255e7dba997c',
+    Var('chromium_url') + '/external/github.com/llvm/llvm-project/libc.git' + '@' + '912274164f0877ca917c06e8484ad3be1784833a',
   'third_party/llvm-build/Release+Asserts': {
     'dep_type': 'gcs',
     'bucket': 'chromium-browser-clang',
     'objects': [
       {
-        'object_name': 'Linux_x64/clang-llvmorg-21-init-5118-g52cd27e6-5.tar.xz',
-        'sha256sum': '790fcc5b04e96882e8227ba7994161ab945c0e096057fc165a0f71e32a7cb061',
-        'size_bytes': 54517328,
-        'generation': 1742541959624765,
+        'object_name': 'Linux_x64/clang-llvmorg-21-init-9266-g09006611-1.tar.xz',
+        'sha256sum': '2cccd3a5b04461f17a2e78d2f8bd18b448443a9dd4d6dfac50e8e84b4d5176f1',
+        'size_bytes': 54914604,
+        'generation': 1745271343199398,
         'condition': 'host_os == "linux"',
       },
       {
-        'object_name': 'Linux_x64/clang-tidy-llvmorg-21-init-5118-g52cd27e6-5.tar.xz',
-        'sha256sum': '6e325d9f62e831bfbae23413a75535a851fd2cdf2f7cf06a5b724e86f72b2df0',
-        'size_bytes': 13206280,
-        'generation': 1742541959572183,
+        'object_name': 'Linux_x64/clang-tidy-llvmorg-21-init-9266-g09006611-1.tar.xz',
+        'sha256sum': 'f0e7dae567266055c9cfa2fba5b3dafa311dc86955f5a3f7a4047ce3096e7b27',
+        'size_bytes': 13559360,
+        'generation': 1745271343282399,
         'condition': 'host_os == "linux" and checkout_clang_tidy',
       },
       {
-        'object_name': 'Linux_x64/clangd-llvmorg-21-init-5118-g52cd27e6-5.tar.xz',
-        'sha256sum': '95d4146cb0b892db68c55bbb523b30301e538d0f4dc71517612fdee62664b81a',
-        'size_bytes': 13566616,
-        'generation': 1742541959718102,
+        'object_name': 'Linux_x64/clangd-llvmorg-21-init-9266-g09006611-1.tar.xz',
+        'sha256sum': 'd87ec8e9cd959cf5d12e0de2970f4a88a67f9884467dac5285813d02bbe50bcb',
+        'size_bytes': 13767836,
+        'generation': 1745271343386108,
         'condition': 'host_os == "linux" and checkout_clangd',
       },
       {
-        'object_name': 'Linux_x64/llvm-code-coverage-llvmorg-21-init-5118-g52cd27e6-5.tar.xz',
-        'sha256sum': 'a10c2831ad30275a72f2955e65e62f6af78542f380661443dab4d20c65f203a4',
-        'size_bytes': 2299292,
-        'generation': 1742541960157221,
+        'object_name': 'Linux_x64/llvm-code-coverage-llvmorg-21-init-9266-g09006611-1.tar.xz',
+        'sha256sum': '08f9cdbdc1e3f78dfb11aa9815727e8af0cf8f2b9c9a0e3749ceb4d3584fc900',
+        'size_bytes': 2293720,
+        'generation': 1745271343569971,
         'condition': 'host_os == "linux" and checkout_clang_coverage_tools',
       },
       {
-        'object_name': 'Linux_x64/llvmobjdump-llvmorg-21-init-5118-g52cd27e6-5.tar.xz',
-        'sha256sum': '56a5bb654a4550d332f86a23e38a0495c6187092868af817ecb999bd9de9c8a0',
-        'size_bytes': 5429676,
-        'generation': 1742541959869492,
+        'object_name': 'Linux_x64/llvmobjdump-llvmorg-21-init-9266-g09006611-1.tar.xz',
+        'sha256sum': '4b9c20478c015a03a44842d0bc24a9bd01a87890c76c4496577843ea31a21ed1',
+        'size_bytes': 5702536,
+        'generation': 1745271343407073,
         'condition': '(checkout_linux or checkout_mac or checkout_android and host_os != "mac")',
       },
       {
-        'object_name': 'Mac/clang-llvmorg-21-init-5118-g52cd27e6-5.tar.xz',
-        'sha256sum': '330f8c4cdde3095ac54aff772dbf9bbd96a753df58525546931cbd9bb615f793',
-        'size_bytes': 51652432,
-        'generation': 1742541961981004,
+        'object_name': 'Mac/clang-llvmorg-21-init-9266-g09006611-1.tar.xz',
+        'sha256sum': '159cc811ee2882098086a426e83cb6744ff59d422d005a54630bc519e782d154',
+        'size_bytes': 51986012,
+        'generation': 1745271345031799,
         'condition': 'host_os == "mac" and host_cpu == "x64"',
       },
       {
-        'object_name': 'Mac/clang-mac-runtime-library-llvmorg-21-init-5118-g52cd27e6-5.tar.xz',
-        'sha256sum': '013f468c65fae6f736cd380791fef892a0fc9fc107516fcae34d1f998eeb081f',
-        'size_bytes': 978248,
-        'generation': 1742541983231339,
+        'object_name': 'Mac/clang-mac-runtime-library-llvmorg-21-init-9266-g09006611-1.tar.xz',
+        'sha256sum': 'ef380bc751dc8b137e294ac1aca295f3e49eb57b938ab011c38c70271d8582fc',
+        'size_bytes': 988872,
+        'generation': 1745271352425938,
         'condition': 'checkout_mac and not host_os == "mac"',
       },
       {
-        'object_name': 'Mac/clang-tidy-llvmorg-21-init-5118-g52cd27e6-5.tar.xz',
-        'sha256sum': 'f29391d18e9fa40774e0386224235890933a8b9eddb9b7eb93d2a4a0867241a1',
-        'size_bytes': 13468608,
-        'generation': 1742541962672221,
+        'object_name': 'Mac/clang-tidy-llvmorg-21-init-9266-g09006611-1.tar.xz',
+        'sha256sum': '75907ac8d2ab310fd7272715c5d98cd4382dbd0b867872aa9216cede48c274d5',
+        'size_bytes': 13609872,
+        'generation': 1745271345094426,
         'condition': 'host_os == "mac" and host_cpu == "x64" and checkout_clang_tidy',
       },
       {
-        'object_name': 'Mac/clangd-llvmorg-21-init-5118-g52cd27e6-5.tar.xz',
-        'sha256sum': '06c48661d55a7b465d8fb02be56f8550c34d3962a9d0f8ce19b17bdd37127691',
-        'size_bytes': 15012228,
-        'generation': 1742541962463652,
+        'object_name': 'Mac/clangd-llvmorg-21-init-9266-g09006611-1.tar.xz',
+        'sha256sum': 'e2bcab0b3961fdc7a63286cf7a98397026ff1b5143d34c8a50844b26a7b023c6',
+        'size_bytes': 14998604,
+        'generation': 1745271345196743,
         'condition': 'host_os == "mac" and host_cpu == "x64" and checkout_clangd',
       },
       {
-        'object_name': 'Mac/llvm-code-coverage-llvmorg-21-init-5118-g52cd27e6-5.tar.xz',
-        'sha256sum': '12f3accae43fa9591bbf28a8e0785b99ff75ed2c84f89518bd5ef5119a2525f0',
-        'size_bytes': 2255296,
-        'generation': 1742541963013464,
+        'object_name': 'Mac/llvm-code-coverage-llvmorg-21-init-9266-g09006611-1.tar.xz',
+        'sha256sum': '6e4c8ed691948981d799f4af747288cdd5e90ae873dc36ada66726ad3e6caef1',
+        'size_bytes': 2262400,
+        'generation': 1745271345385127,
         'condition': 'host_os == "mac" and host_cpu == "x64" and checkout_clang_coverage_tools',
       },
       {
-        'object_name': 'Mac_arm64/clang-llvmorg-21-init-5118-g52cd27e6-5.tar.xz',
-        'sha256sum': '49967dab3fa4c5f1ff1fe235059be71727c190ff4ccc80f08d39e1bba4dfed58',
-        'size_bytes': 43810156,
-        'generation': 1742541984650930,
+        'object_name': 'Mac_arm64/clang-llvmorg-21-init-9266-g09006611-1.tar.xz',
+        'sha256sum': '3d437a643cc5838963254a39ab0528f49f2b65cd4dba2c80e628ad88eb419536',
+        'size_bytes': 43999512,
+        'generation': 1745271353863965,
         'condition': 'host_os == "mac" and host_cpu == "arm64"',
       },
       {
-        'object_name': 'Mac_arm64/clang-tidy-llvmorg-21-init-5118-g52cd27e6-5.tar.xz',
-        'sha256sum': '4f5326253ed3736ec262e8e69d93befadf9473419865240673a2ec883c3614b6',
-        'size_bytes': 11607236,
-        'generation': 1742541984970894,
+        'object_name': 'Mac_arm64/clang-tidy-llvmorg-21-init-9266-g09006611-1.tar.xz',
+        'sha256sum': '0b4150c9e699e1e904495807aff48d2e5396527bf775d6597818dd4f73a9c38f',
+        'size_bytes': 11776260,
+        'generation': 1745271353927359,
         'condition': 'host_os == "mac" and host_cpu == "arm64" and checkout_clang_tidy',
       },
       {
-        'object_name': 'Mac_arm64/clangd-llvmorg-21-init-5118-g52cd27e6-5.tar.xz',
-        'sha256sum': 'b3da417d27ba5afe6c9f612d5808c416a17ed1b28f2acd745e0cd2962a5eeac1',
-        'size_bytes': 12000852,
-        'generation': 1742541985144552,
+        'object_name': 'Mac_arm64/clangd-llvmorg-21-init-9266-g09006611-1.tar.xz',
+        'sha256sum': '9fcd151cfffa01e6befe3760b9bc91d645135c79449dc378af4cb2fe0187150c',
+        'size_bytes': 12041956,
+        'generation': 1745271354010497,
         'condition': 'host_os == "mac" and host_cpu == "arm64" and checkout_clangd',
       },
       {
-        'object_name': 'Mac_arm64/llvm-code-coverage-llvmorg-21-init-5118-g52cd27e6-5.tar.xz',
-        'sha256sum': '78139b473cdf4d43da880b573661a5d28d94a8bcb4dea41607d324301745f28c',
-        'size_bytes': 1976480,
-        'generation': 1742541985608174,
+        'object_name': 'Mac_arm64/llvm-code-coverage-llvmorg-21-init-9266-g09006611-1.tar.xz',
+        'sha256sum': '1e62752ef5fd9d425699ed44098d5a0eec3be3f827990470aa9f9199d34a2fb8',
+        'size_bytes': 1975116,
+        'generation': 1745271354276821,
         'condition': 'host_os == "mac" and host_cpu == "arm64" and checkout_clang_coverage_tools',
       },
       {
-        'object_name': 'Win/clang-llvmorg-21-init-5118-g52cd27e6-5.tar.xz',
-        'sha256sum': 'b46fb4a5cbf9c52d0b345fc2d77ad4ac15dfbb45aa494fb49261786c679af44a',
-        'size_bytes': 46813332,
-        'generation': 1742542010902044,
+        'object_name': 'Win/clang-llvmorg-21-init-9266-g09006611-1.tar.xz',
+        'sha256sum': 'd53230dbb7db57ddcda5a8377b5dd8388deee9ff2766617d54c6159c51e806be',
+        'size_bytes': 47036964,
+        'generation': 1745271363166454,
         'condition': 'host_os == "win"',
       },
       {
-        'object_name': 'Win/clang-tidy-llvmorg-21-init-5118-g52cd27e6-5.tar.xz',
-        'sha256sum': '50d527e811ae8543effa2bb5734a1d424d9c497fbf1d96c76d44b6b5ee7f240b',
-        'size_bytes': 13233236,
-        'generation': 1742542011983982,
+        'object_name': 'Win/clang-tidy-llvmorg-21-init-9266-g09006611-1.tar.xz',
+        'sha256sum': 'c6022f5923be5afc1685723a2383fcd8f9334cc6ee097ce3c71963de6ded0764',
+        'size_bytes': 13415856,
+        'generation': 1745271363272778,
         'condition': 'host_os == "win" and checkout_clang_tidy',
       },
       {
-        'object_name': 'Win/clang-win-runtime-library-llvmorg-21-init-5118-g52cd27e6-5.tar.xz',
-        'sha256sum': 'bd2ad1930c0ba7d00364dd344886fd57e16aa070ff1b6a1aade72b58d28e8275',
-        'size_bytes': 2474048,
-        'generation': 1742542035740788,
+        'object_name': 'Win/clang-win-runtime-library-llvmorg-21-init-9266-g09006611-1.tar.xz',
+        'sha256sum': '555a34dd110a5fe3f7578745e9f0074cc341e550bed4ec5888accffb0200a7bb',
+        'size_bytes': 2483656,
+        'generation': 1745271370423782,
         'condition': 'checkout_win and not host_os == "win"',
       },
       {
-        'object_name': 'Win/clangd-llvmorg-21-init-5118-g52cd27e6-5.tar.xz',
-        'sha256sum': '06563cfcb24d7196717551dfcda13ed0b97fb9e795dba06007c55ae563e824b0',
-        'size_bytes': 13759668,
-        'generation': 1742542011820938,
+        'object_name': 'Win/clangd-llvmorg-21-init-9266-g09006611-1.tar.xz',
+        'sha256sum': '66aafde760608c4c0de94a3947a179db8c8f93c8e474e3081b4401287abe4ee4',
+        'size_bytes': 13838692,
+        'generation': 1745271363368641,
        'condition': 'host_os == "win" and checkout_clangd',
       },
       {
-        'object_name': 'Win/llvm-code-coverage-llvmorg-21-init-5118-g52cd27e6-5.tar.xz',
-        'sha256sum': '7c2fe8784910dc05445cd7f16742e0b2a09a45fb2ba96ddd5f1d8c895ac65d44',
-        'size_bytes': 2365956,
-        'generation': 1742542013491786,
+        'object_name': 'Win/llvm-code-coverage-llvmorg-21-init-9266-g09006611-1.tar.xz',
+        'sha256sum': '6944dc39b33dca3bb8f219ffb221e3f345fe56a5fa0447c60ea6a2894ae72687',
+        'size_bytes': 2373032,
+        'generation': 1745271363562596,
         'condition': 'host_os == "win" and checkout_clang_coverage_tools',
       },
       {
-        'object_name': 'Win/llvmobjdump-llvmorg-21-init-5118-g52cd27e6-5.tar.xz',
-        'sha256sum': 'a07be25cb4d565422b10001ca3595111d40bd42c47b37b41e2fff5708fe82302',
-        'size_bytes': 5527784,
-        'generation': 1742542012678160,
+        'object_name': 'Win/llvmobjdump-llvmorg-21-init-9266-g09006611-1.tar.xz',
+        'sha256sum': 'e8b3e9f7cd7512edc7c05a12e818386cdb8d43bea9affbf0bf4db83a553092a5',
+        'size_bytes': 5684140,
+        'generation': 1745271363450942,
         'condition': 'checkout_linux or checkout_mac or checkout_android and host_os == "win"',
       },
     ],
@@ -473,7 +473,7 @@ deps = {
   'third_party/perfetto':
     Var('android_url') + '/platform/external/perfetto.git' + '@' + '40b529923598b739b2892a536a7692eedbed5685',
   'third_party/protobuf':
-    Var('chromium_url') + '/chromium/src/third_party/protobuf.git' + '@' + 'b714f7890b8b6ad3ff3471d3148b28c2c7bbff90',
+    Var('chromium_url') + '/chromium/src/third_party/protobuf.git' + '@' + '56b98941c7a305f54fc6c1c0a082fcb232f92954',
   'third_party/re2/src':
     Var('chromium_url') + '/external/github.com/google/re2.git' + '@' + 'c84a140c93352cdabbfb547c531be34515b12228',
   'third_party/requests': {
@@ -481,39 +481,39 @@ deps = {
       'condition': 'checkout_android',
   },
   'tools/rust':
-    Var('chromium_url') + '/chromium/src/tools/rust' + '@' + '7cdd3d9540f3ab428dbcc9ab83c2896c100bcdc5',
+    Var('chromium_url') + '/chromium/src/tools/rust' + '@' + 'fa679ed68ee49fb99a7e924f57e4d2b6444103d6',
   'third_party/rust':
-    Var('chromium_url') + '/chromium/src/third_party/rust' + '@' + 'ed577320339cd175171e9c96d3d73452ddbcbd98',
+    Var('chromium_url') + '/chromium/src/third_party/rust' + '@' + '926ec544992cad0ac638f3594fe6195ed493ebff',
   'third_party/rust-toolchain': {
     'dep_type': 'gcs',
     'bucket': 'chromium-browser-clang',
     'objects': [
       {
-        'object_name': 'Linux_x64/rust-toolchain-f7b43542838f0a4a6cfdb17fbeadf45002042a77-1-llvmorg-21-init-5118-g52cd27e6.tar.xz',
-        'sha256sum': '213ffcc751ba5f5a4e15fc0dbcbdb94aa7dbc4b6cddd3605121cd26ff8a8b359',
-        'size_bytes': 118223072,
-        'generation': 1741985831167267,
+        'object_name': 'Linux_x64/rust-toolchain-c8f94230282a8e8c1148f3e657f0199aad909228-1-llvmorg-21-init-9266-g09006611.tar.xz',
+        'sha256sum': '378c432f7739bb5da11aad7b3a2687f8252565eae5f0dcfc55c39a15382c519c',
+        'size_bytes': 118598336,
+        'generation': 1745271335898717,
         'condition': 'host_os == "linux"',
       },
       {
-        'object_name': 'Mac/rust-toolchain-f7b43542838f0a4a6cfdb17fbeadf45002042a77-1-llvmorg-21-init-5118-g52cd27e6.tar.xz',
-        'sha256sum': 'f5ad2fe26336a87713ffcad9e06ae4c1ecb4773ae496a33450a7091c5eec560c',
-        'size_bytes': 111168208,
-        'generation': 1741985832885972,
+        'object_name': 'Mac/rust-toolchain-c8f94230282a8e8c1148f3e657f0199aad909228-1-llvmorg-21-init-9266-g09006611.tar.xz',
+        'sha256sum': 'bf05c8b5e90d6904de02dca9b3e4cb5e45a1a56207e7af1fbb3a10707704a26a',
+        'size_bytes': 111932536,
+        'generation': 1745271337336068,
         'condition': 'host_os == "mac" and host_cpu == "x64"',
       },
       {
-        'object_name': 'Mac_arm64/rust-toolchain-f7b43542838f0a4a6cfdb17fbeadf45002042a77-1-llvmorg-21-init-5118-g52cd27e6.tar.xz',
-        'sha256sum': 'fac3586c08239bbb8fd192a7ba5deaa9ae62f6fde2c1d665953f87176467a156',
-        'size_bytes': 100534232,
-        'generation': 1741985834191792,
+        'object_name': 'Mac_arm64/rust-toolchain-c8f94230282a8e8c1148f3e657f0199aad909228-1-llvmorg-21-init-9266-g09006611.tar.xz',
+        'sha256sum': '1aec99f479ff28cefe44ed739844833e016a1da255cf3c17d79e59a273246615',
+        'size_bytes': 101605468,
+        'generation': 1745271339727037,
         'condition': 'host_os == "mac" and host_cpu == "arm64"',
       },
       {
-        'object_name': 'Win/rust-toolchain-f7b43542838f0a4a6cfdb17fbeadf45002042a77-1-llvmorg-21-init-5118-g52cd27e6.tar.xz',
-        'sha256sum': '7b41e74c9b45ca97ca65279c605e6af878de5682fe574d1f1860d9da9b3a5909',
-        'size_bytes': 180896336,
-        'generation': 1741985835535129,
+        'object_name': 'Win/rust-toolchain-c8f94230282a8e8c1148f3e657f0199aad909228-1-llvmorg-21-init-9266-g09006611.tar.xz',
+        'sha256sum': 'b291520613a3ebc415e4576a7fa31d840a5ebf4ab9be6e9dc5d90062dc001c1e',
+        'size_bytes': 193280372,
+        'generation': 1745271341223097,
         'condition': 'host_os == "win"',
       },
     ],
@@ -529,13 +529,13 @@ deps = {
     'condition': 'not build_with_chromium and host_cpu != "s390" and host_os != "zos" and host_cpu != "ppc"',
   },
   'third_party/zlib':
-    Var('chromium_url') + '/chromium/src/third_party/zlib.git'+ '@' + '788cb3c270e8700b425c7bdca1f9ce6b0c1400a9',
+    Var('chromium_url') + '/chromium/src/third_party/zlib.git'+ '@' + '1e85c01b15363d11fab81c46fe2b5c2179113f70',
   'tools/clang':
-    Var('chromium_url') + '/chromium/src/tools/clang.git' + '@' + '0078c27c43cae91e96bb28d8a4407045966e0542',
+    Var('chromium_url') + '/chromium/src/tools/clang.git' + '@' + '6c4f037a983abf14a4c8bf00e44db73cdf330a97',
   'tools/protoc_wrapper':
-    Var('chromium_url') + '/chromium/src/tools/protoc_wrapper.git' + '@' + 'dbcbea90c20ae1ece442d8ef64e61c7b10e2b013',
+    Var('chromium_url') + '/chromium/src/tools/protoc_wrapper.git' + '@' + '8ad6d21544b14c7f753852328d71861b363cc512',
   'third_party/abseil-cpp': {
-    'url': Var('chromium_url') + '/chromium/src/third_party/abseil-cpp.git' + '@' + '3fbb10e80d80e3430224b75add53c47c7a711612',
+    'url': Var('chromium_url') + '/chromium/src/third_party/abseil-cpp.git' + '@' + '91f1a3775e4c509c3eadd4870fc9929c0021e6e3',
     'condition': 'not build_with_chromium',
   },
   'third_party/zoslib': {
diff --git a/deps/v8/PRESUBMIT.py b/deps/v8/PRESUBMIT.py
index 8ec4e97bf0dbfc..0c821c628e610e 100644
--- a/deps/v8/PRESUBMIT.py
+++ b/deps/v8/PRESUBMIT.py
@@ -136,6 +136,7 @@ def FilterJSFile(affected_file):
       input_api, output_api, bot_allowlist=[
         'v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com',
         'v8-ci-test262-import-export@chops-service-accounts.iam.gserviceaccount.com',
+        'chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com',
       ]))
   return results
 
@@ -385,7 +386,7 @@ def FilterFile(affected_file):
   for f in input_api.AffectedSourceFiles(FilterFile):
     if not os.path.isfile(to_non_inl(f.AbsoluteLocalPath())):
       continue
-    non_inl_header = to_non_inl(f.LocalPath())
+    non_inl_header = to_non_inl(f.LocalPath()).replace(os.sep, '/')
     first_include = None
     for line in f.NewContents():
       if line.startswith('#include '):
diff --git a/deps/v8/build_overrides/protobuf.gni b/deps/v8/build_overrides/protobuf.gni
new file mode 100644
index 00000000000000..e69de29bb2d1d6
diff --git a/deps/v8/gni/snapshot_toolchain.gni b/deps/v8/gni/snapshot_toolchain.gni
index c7faa8ca5897a6..37ed262640d048 100644
--- a/deps/v8/gni/snapshot_toolchain.gni
+++ b/deps/v8/gni/snapshot_toolchain.gni
@@ -104,9 +104,10 @@ if (v8_snapshot_toolchain == "") {
       # cross compile Windows arm64 with host toolchain.
       v8_snapshot_toolchain = host_toolchain
     }
-  } else if (host_cpu == "arm64" && current_cpu == "arm64" &&
+  } else if (host_cpu == "arm64" &&
+             (current_cpu == "arm64" || current_cpu == "arm64e") &&
              host_os == "mac") {
-    # cross compile iOS arm64 with host_toolchain
+    # cross compile iOS arm64/arm64e with host_toolchain
     v8_snapshot_toolchain = host_toolchain
   }
 }
diff --git a/deps/v8/gni/v8.gni b/deps/v8/gni/v8.gni
index bf265b293d8147..e137c84b00b5d5 100644
--- a/deps/v8/gni/v8.gni
+++ b/deps/v8/gni/v8.gni
@@ -83,9 +83,9 @@ declare_args() {
   # (is_ios is based on host_os).
   if (target_os == "ios") {
     if (target_platform == "iphoneos") {
-      # iOS executable code pages is in 17.4 SDK.
+      # iOS executable code pages is in 18.4 SDK.
       # TODO(dtapuska): Change this to an assert.
-      v8_enable_lite_mode = ios_deployment_target != "17.4"
+      v8_enable_lite_mode = ios_deployment_target != "18.4"
     } else if (target_platform == "tvos") {
       # tvOS runs in single process mode and is not allowed to use JIT.
       # TODO(crbug.com/394710095): Enable the v8 lite mode to run v8 with the
@@ -123,11 +123,8 @@ declare_args() {
                        !(defined(build_with_node) && build_with_node) &&
                        !(is_win && is_component_build) && is_clang
 
-  # Scan the call stack conservatively during garbage collection.
-  v8_enable_conservative_stack_scanning = false
-
   # Use direct pointers in handles (v8::internal::Handle and v8::Local).
-  v8_enable_direct_handle = ""
+  v8_enable_direct_handle = false
 
   # Check for off-stack allocated local handles.
   v8_enable_local_off_stack_check = false
@@ -193,6 +190,10 @@ declare_args() {
 
   # Sets -DV8_ENABLE_ETW_STACK_WALKING. Enables ETW Stack Walking
   v8_enable_etw_stack_walking = is_win
+
+  # Specifies if the target build is a simulator build. By default it is set to
+  # true if the host and target do not match and we are not cross-compiling.
+  v8_target_is_simulator = ""
 }
 
 if (v8_use_external_startup_data == "") {
@@ -250,10 +251,12 @@ if (v8_enable_turbofan == "") {
 assert(v8_enable_turbofan || !v8_enable_webassembly,
        "Webassembly is not available when Turbofan is disabled.")
 
-# Direct internal handles and direct locals are enabled by default if
-# conservative stack scanning is enabled.
-if (v8_enable_direct_handle == "") {
-  v8_enable_direct_handle = v8_enable_conservative_stack_scanning
+if (v8_target_is_simulator == "") {
+  # We compare target cpu with v8 target cpu to not affect simulator builds for
+  # making cross-compile snapshots.
+  v8_target_is_simulator =
+      (target_cpu != v8_target_cpu && !v8_multi_arch_build) ||
+      (current_cpu != v8_current_cpu && v8_multi_arch_build)
 }
 
 # Points to // in v8 stand-alone or to //v8/ in chromium. We need absolute
diff --git a/deps/v8/include/DEPS b/deps/v8/include/DEPS
index cf5c54a1f3407f..c6d10cd4d7b01d 100644
--- a/deps/v8/include/DEPS
+++ b/deps/v8/include/DEPS
@@ -7,6 +7,7 @@ include_rules = [
   "+cppgc/heap-statistics.h",
   "+cppgc/internal/conditional-stack-allocated.h",
   "+cppgc/internal/write-barrier.h",
+  "+cppgc/type-traits.h",
   "+cppgc/visitor.h",
   "+perfetto",
 ]
diff --git a/deps/v8/include/cppgc/tagged-member.h b/deps/v8/include/cppgc/tagged-member.h
new file mode 100644
index 00000000000000..7a2dfbb4c790c0
--- /dev/null
+++ b/deps/v8/include/cppgc/tagged-member.h
@@ -0,0 +1,111 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef INCLUDE_CPPGC_TAGGED_MEMBER_H_
+#define INCLUDE_CPPGC_TAGGED_MEMBER_H_
+
+#include <atomic>
+#include <cstddef>
+#include <type_traits>
+
+#include "cppgc/internal/api-constants.h"
+#include "cppgc/macros.h"
+#include "cppgc/member.h"
+#include "cppgc/visitor.h"
+
+namespace cppgc::subtle {
+
+// The class allows to store a Member along with a single bit tag. It uses
+// distinct tag types, Tag1 and Tag2, to represent the two states of the tag.
+// The tag is stored in the least significant bit of the pointer.
+//
+// Example usage:
+//   struct ParentTag {};
+//   struct ShadowHostTag {};
+//
+//   /* Constructs a member with the pointer to parent tag: */
+//   TaggedUncompressedMember<Node, ParentTag, ShadowHostTag>
+//       m(ParentTag{}, parent);
+template <typename Pointee, typename Tag1, typename Tag2>
+struct TaggedUncompressedMember final {
+  CPPGC_DISALLOW_NEW();
+  static constexpr uintptr_t kTagBit = 0b1;
+  static_assert(kTagBit < internal::api_constants::kAllocationGranularity,
+                "The tag must live in the alignment bits of the pointer.");
+
+ public:
+  TaggedUncompressedMember(Tag1, Pointee* ptr) : ptr_(ptr) {}
+  TaggedUncompressedMember(Tag2, Pointee* ptr)
+      : ptr_(reinterpret_cast<Pointee*>(reinterpret_cast<uintptr_t>(ptr) |
+                                        kTagBit)) {}
+
+  template <typename Tag>
+  Pointee* GetAs() const {
+    auto* raw = ptr_.Get();
+    if constexpr (std::same_as<Tag, Tag1>) {
+      CPPGC_DCHECK(Is<Tag1>());
+      return raw;
+    } else {
+      static_assert(std::same_as<Tag, Tag2>);
+      CPPGC_DCHECK(Is<Tag2>());
+      return GetUntagged();
+    }
+  }
+
+  template <typename Tag>
+  Pointee* TryGetAs() const {
+    auto* raw = ptr_.Get();
+    if constexpr (std::same_as<Tag, Tag1>) {
+      return (reinterpret_cast<uintptr_t>(raw) & kTagBit) ? nullptr : raw;
+    } else {
+      static_assert(std::same_as<Tag, Tag2>);
+      return (reinterpret_cast<uintptr_t>(raw) & kTagBit)
+                 ? reinterpret_cast<Pointee*>(reinterpret_cast<uintptr_t>(raw) &
+                                              ~kTagBit)
+                 : nullptr;
+    }
+  }
+
+  Pointee* GetUntagged() const {
+    return reinterpret_cast<Pointee*>(reinterpret_cast<uintptr_t>(ptr_.Get()) &
+                                      ~kTagBit);
+  }
+
+  template <typename Tag>
+  void SetAs(Pointee* pointee) {
+    if constexpr (std::same_as<Tag, Tag1>) {
+      ptr_ = pointee;
+    } else {
+      static_assert(std::same_as<Tag, Tag2>);
+      ptr_ = reinterpret_cast<Pointee*>(reinterpret_cast<uintptr_t>(pointee) |
+                                        kTagBit);
+    }
+  }
+
+  template <typename Tag>
+  bool Is() const {
+    const bool tag_set = reinterpret_cast<uintptr_t>(ptr_.Get()) & kTagBit;
+    if constexpr (std::same_as<Tag, Tag1>) {
+      return !tag_set;
+    } else {
+      static_assert(std::same_as<Tag, Tag2>);
+      return tag_set;
+    }
+  }
+
+  void Trace(Visitor* v) const {
+    // Construct an untagged pointer and pass it to Visitor::Trace(). The plugin
+    // would warn that ptr_ is untraced, which is why CPPGC_PLUGIN_IGNORE is
+    // used.
+    UncompressedMember<Pointee> temp(GetUntagged());
+    v->Trace(temp);
+  }
+
+ private:
+  CPPGC_PLUGIN_IGNORE("See Trace()") UncompressedMember<Pointee> ptr_;
+};
+
+}  // namespace cppgc::subtle
+
+#endif  // INCLUDE_CPPGC_TAGGED_MEMBER_H_
diff --git a/deps/v8/include/js_protocol.pdl b/deps/v8/include/js_protocol.pdl
index e33cdae701a128..73da9149b5d8bc 100644
--- a/deps/v8/include/js_protocol.pdl
+++ b/deps/v8/include/js_protocol.pdl
@@ -649,7 +649,7 @@ domain Debugger
       Runtime.ExecutionContextId executionContextId
       # Content hash of the script, SHA-256.
       string hash
-      # For Wasm modules, the content of the `build_id` custom section.
+      # For Wasm modules, the content of the `build_id` custom section. For JavaScript the `debugId` magic comment.
       string buildId
       # Embedder-specific auxiliary data likely matching {isDefault: boolean, type: 'default'|'isolated'|'worker', frameId: string}
       optional object executionContextAuxData
@@ -690,7 +690,7 @@ domain Debugger
       Runtime.ExecutionContextId executionContextId
       # Content hash of the script, SHA-256.
       string hash
-      # For Wasm modules, the content of the `build_id` custom section.
+      # For Wasm modules, the content of the `build_id` custom section. For JavaScript the `debugId` magic comment.
       string buildId
       # Embedder-specific auxiliary data likely matching {isDefault: boolean, type: 'default'|'isolated'|'worker', frameId: string}
       optional object executionContextAuxData
diff --git a/deps/v8/include/v8-callbacks.h b/deps/v8/include/v8-callbacks.h
index db5ec8304092b6..a9f380e38abdde 100644
--- a/deps/v8/include/v8-callbacks.h
+++ b/deps/v8/include/v8-callbacks.h
@@ -328,10 +328,6 @@ using WasmImportedStringsEnabledCallback = bool (*)(Local<Context> context);
 using SharedArrayBufferConstructorEnabledCallback =
     bool (*)(Local<Context> context);
 
-// --- Callback for checking if the compile hints magic comments are enabled ---
-using JavaScriptCompileHintsMagicEnabledCallback =
-    bool (*)(Local<Context> context);
-
 // --- Callback for checking if WebAssembly JSPI is enabled ---
 using WasmJSPIEnabledCallback = bool (*)(Local<Context> context);
 
diff --git a/deps/v8/include/v8-cpp-heap-external.h b/deps/v8/include/v8-cpp-heap-external.h
new file mode 100644
index 00000000000000..92a89c45546378
--- /dev/null
+++ b/deps/v8/include/v8-cpp-heap-external.h
@@ -0,0 +1,56 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef INCLUDE_V8_HEAP_EXTERNAL_H_
+#define INCLUDE_V8_HEAP_EXTERNAL_H_
+
+#include "cppgc/type-traits.h"  // NOLINT(build/include_directory)
+#include "v8-sandbox.h"         // NOLINT(build/include_directory)
+#include "v8-value.h"           // NOLINT(build/include_directory)
+#include "v8config.h"           // NOLINT(build/include_directory)
+
+namespace v8 {
+
+class Isolate;
+
+/**
+ * A JavaScript value that wraps a `cppgc::GarbageCollected<T>` object allocated
+ * on the managed C++ heap (CppHeap). This type of value is mainly used to
+ * associate C++ data structures which aren't exposed to JavaScript with
+ * JavaScript objects.
+ */
+class V8_EXPORT CppHeapExternal : public Data {
+ public:
+  template <typename T>
+  static Local<CppHeapExternal> New(Isolate* isolate, T* value,
+                                    CppHeapPointerTag tag) {
+    static_assert(cppgc::IsGarbageCollectedTypeV<T>,
+                  "Object must be of type GarbageCollected.");
+    return NewImpl(isolate, value, tag);
+  }
+
+  V8_INLINE static CppHeapExternal* Cast(Data* data) {
+#ifdef V8_ENABLE_CHECKS
+    CheckCast(data);
+#endif
+    return static_cast<CppHeapExternal*>(data);
+  }
+
+  template <typename T>
+  T* Value(Isolate* isolate, CppHeapPointerTagRange tag_range) const {
+    static_assert(cppgc::IsGarbageCollectedTypeV<T>,
+                  "Object must be of type GarbageCollected.");
+    return static_cast<T*>(ValueImpl(isolate, tag_range));
+  }
+
+ private:
+  static void CheckCast(v8::Data* obj);
+  static Local<CppHeapExternal> NewImpl(Isolate* isolate, void* value,
+                                        CppHeapPointerTag tag);
+  void* ValueImpl(Isolate*, CppHeapPointerTagRange tag_range) const;
+};
+
+}  // namespace v8
+
+#endif  // INCLUDE_V8_HEAP_EXTERNAL_H_
diff --git a/deps/v8/include/v8-data.h b/deps/v8/include/v8-data.h
index 3093d7f34d146d..f9c60f4dc6068b 100644
--- a/deps/v8/include/v8-data.h
+++ b/deps/v8/include/v8-data.h
@@ -57,6 +57,11 @@ class V8_EXPORT Data {
    */
   bool IsContext() const;
 
+  /**
+   * Returns true if this value is a `CppHeapExternal` object.
+   */
+  bool IsCppHeapExternal() const;
+
  private:
   Data() = delete;
 };
diff --git a/deps/v8/include/v8-inspector.h b/deps/v8/include/v8-inspector.h
index 7236a372342c04..0992cb1c3cb599 100644
--- a/deps/v8/include/v8-inspector.h
+++ b/deps/v8/include/v8-inspector.h
@@ -408,12 +408,20 @@ class V8_EXPORT V8Inspector {
   enum ClientTrustLevel { kUntrusted, kFullyTrusted };
   enum SessionPauseState { kWaitingForDebugger, kNotWaitingForDebugger };
   // TODO(chromium:1352175): remove default value once downstream change lands.
+  // Deprecated: Use `connectShared` instead.
   virtual std::unique_ptr<V8InspectorSession> connect(
       int contextGroupId, Channel*, StringView state,
       ClientTrustLevel client_trust_level,
-      SessionPauseState = kNotWaitingForDebugger) {
-    return nullptr;
-  }
+      SessionPauseState = kNotWaitingForDebugger) = 0;
+
+  // Same as `connect` but returns a std::shared_ptr instead.
+  // Embedders should not deconstruct V8 sessions while the nested run loop
+  // (V8InspectorClient::runMessageLoopOnPause) is running. To partially ensure
+  // this, we defer session deconstruction until no "dispatchProtocolMessages"
+  // remains on the stack.
+  virtual std::shared_ptr<V8InspectorSession> connectShared(
+      int contextGroupId, Channel* channel, StringView state,
+      ClientTrustLevel clientTrustLevel, SessionPauseState pauseState) = 0;
 
   // API methods.
   virtual std::unique_ptr<V8StackTrace> createStackTrace(
diff --git a/deps/v8/include/v8-internal.h b/deps/v8/include/v8-internal.h
index 5ff16cdabf9f42..66bb4b7d233cc2 100644
--- a/deps/v8/include/v8-internal.h
+++ b/deps/v8/include/v8-internal.h
@@ -560,22 +560,16 @@ enum ExternalPointerTag : uint16_t {
   kFunctionTemplateInfoCallbackTag = kFirstMaybeReadOnlyExternalPointerTag,
   kAccessorInfoGetterTag,
   kAccessorInfoSetterTag,
-  kLastMaybeReadOnlyExternalPointerTag = kAccessorInfoSetterTag,
-  kWasmInternalFunctionCallTargetTag,
-  kWasmTypeInfoNativeTypeTag,
-  kWasmExportedFunctionDataSignatureTag,
-  kWasmStackMemoryTag,
-  kWasmIndirectFunctionTargetTag,
 
-  // Foreigns
-  kFirstForeignExternalPointerTag,
-  kGenericForeignTag = kFirstForeignExternalPointerTag,
-  kApiNamedPropertyQueryCallbackTag,
+  // InterceptorInfo external pointers.
+  kFirstInterceptorInfoExternalPointerTag,
+  kApiNamedPropertyQueryCallbackTag = kFirstInterceptorInfoExternalPointerTag,
   kApiNamedPropertyGetterCallbackTag,
   kApiNamedPropertySetterCallbackTag,
   kApiNamedPropertyDescriptorCallbackTag,
   kApiNamedPropertyDefinerCallbackTag,
   kApiNamedPropertyDeleterCallbackTag,
+  kApiNamedPropertyEnumeratorCallbackTag,
   kApiIndexedPropertyQueryCallbackTag,
   kApiIndexedPropertyGetterCallbackTag,
   kApiIndexedPropertySetterCallbackTag,
@@ -583,6 +577,21 @@ enum ExternalPointerTag : uint16_t {
   kApiIndexedPropertyDefinerCallbackTag,
   kApiIndexedPropertyDeleterCallbackTag,
   kApiIndexedPropertyEnumeratorCallbackTag,
+  kLastInterceptorInfoExternalPointerTag =
+      kApiIndexedPropertyEnumeratorCallbackTag,
+
+  kLastMaybeReadOnlyExternalPointerTag = kLastInterceptorInfoExternalPointerTag,
+
+  kWasmInternalFunctionCallTargetTag,
+  kWasmTypeInfoNativeTypeTag,
+  kWasmExportedFunctionDataSignatureTag,
+  kWasmStackMemoryTag,
+  kWasmIndirectFunctionTargetTag,
+
+  // Foreigns
+  kFirstForeignExternalPointerTag,
+  kGenericForeignTag = kFirstForeignExternalPointerTag,
+
   kApiAccessCheckCallbackTag,
   kApiAbortScriptExecutionCallbackTag,
   kSyntheticModuleTag,
@@ -636,6 +645,9 @@ constexpr ExternalPointerTagRange kAnySharedExternalPointerTagRange(
     kFirstSharedExternalPointerTag, kLastSharedExternalPointerTag);
 constexpr ExternalPointerTagRange kAnyForeignExternalPointerTagRange(
     kFirstForeignExternalPointerTag, kLastForeignExternalPointerTag);
+constexpr ExternalPointerTagRange kAnyInterceptorInfoExternalPointerTagRange(
+    kFirstInterceptorInfoExternalPointerTag,
+    kLastInterceptorInfoExternalPointerTag);
 constexpr ExternalPointerTagRange kAnyManagedExternalPointerTagRange(
     kFirstManagedExternalPointerTag, kLastManagedExternalPointerTag);
 constexpr ExternalPointerTagRange kAnyMaybeReadOnlyExternalPointerTagRange(
@@ -678,7 +690,8 @@ V8_INLINE static constexpr bool IsManagedExternalPointerType(
 V8_INLINE static constexpr bool ExternalPointerCanBeEmpty(
     ExternalPointerTagRange tag_range) {
   return tag_range.Contains(kArrayBufferExtensionTag) ||
-         tag_range.Contains(kEmbedderDataSlotPayloadTag);
+         tag_range.Contains(kEmbedderDataSlotPayloadTag) ||
+         kAnyInterceptorInfoExternalPointerTagRange.Contains(tag_range);
 }
 
 // Indirect Pointers.
@@ -1331,7 +1344,7 @@ class BackingStoreBase {};
 
 // The maximum value in enum GarbageCollectionReason, defined in heap.h.
 // This is needed for histograms sampling garbage collection reasons.
-constexpr int kGarbageCollectionReasonMaxValue = 29;
+constexpr int kGarbageCollectionReasonMaxValue = 30;
 
 // Base class for the address block allocator compatible with standard
 // containers, which registers its allocated range as strong roots.
diff --git a/deps/v8/include/v8-isolate.h b/deps/v8/include/v8-isolate.h
index 332688e77b48e6..280c09729f8cb4 100644
--- a/deps/v8/include/v8-isolate.h
+++ b/deps/v8/include/v8-isolate.h
@@ -1665,16 +1665,6 @@ class V8_EXPORT Isolate {
 
   void SetWasmJSPIEnabledCallback(WasmJSPIEnabledCallback callback);
 
-  /**
-   * Register callback to control whether compile hints magic comments are
-   * enabled.
-   */
-  V8_DEPRECATED(
-      "Will be removed, use ScriptCompiler::CompileOptions for enabling the "
-      "compile hints magic comments")
-  void SetJavaScriptCompileHintsMagicEnabledCallback(
-      JavaScriptCompileHintsMagicEnabledCallback callback);
-
   /**
    * This function can be called by the embedder to signal V8 that the dynamic
    * enabling of features has finished. V8 can now set up dynamically added
@@ -1697,7 +1687,7 @@ class V8_EXPORT Isolate {
    * If data is specified, it will be passed to the callback when it is called.
    * Otherwise, the exception object will be passed to the callback instead.
    */
-  bool AddMessageListener(MessageCallback that,
+  bool AddMessageListener(MessageCallback callback,
                           Local<Value> data = Local<Value>());
 
   /**
@@ -1711,14 +1701,14 @@ class V8_EXPORT Isolate {
    *
    * A listener can listen for particular error levels by providing a mask.
    */
-  bool AddMessageListenerWithErrorLevel(MessageCallback that,
+  bool AddMessageListenerWithErrorLevel(MessageCallback callback,
                                         int message_levels,
                                         Local<Value> data = Local<Value>());
 
   /**
    * Remove all message listeners from the specified callback function.
    */
-  void RemoveMessageListeners(MessageCallback that);
+  void RemoveMessageListeners(MessageCallback callback);
 
   /** Callback function for reporting failed access checks.*/
   void SetFailedAccessCheckCallbackFunction(FailedAccessCheckCallback);
@@ -1789,6 +1779,21 @@ class V8_EXPORT Isolate {
    */
   std::string GetDefaultLocale();
 
+  /**
+   * Returns a canonical and case-regularized form of locale if Intl support is
+   * enabled. If the locale is not syntactically well-formed, throws a
+   * RangeError.
+   *
+   * If Intl support is not enabled, returns Nothing<std::string>().
+   *
+   * Corresponds to the combination of the abstract operations
+   * IsStructurallyValidLanguageTag and CanonicalizeUnicodeLocaleId. See:
+   * https://tc39.es/ecma402/#sec-isstructurallyvalidlanguagetag
+   * https://tc39.es/ecma402/#sec-canonicalizeunicodelocaleid
+   */
+  V8_WARN_UNUSED_RESULT Maybe<std::string>
+  ValidateAndCanonicalizeUnicodeLocaleId(std::string_view locale);
+
   /**
    * Returns the hash seed for that isolate, for testing purposes.
    */
diff --git a/deps/v8/include/v8-platform.h b/deps/v8/include/v8-platform.h
index cecc217a62bbdb..43ffeb57d708d3 100644
--- a/deps/v8/include/v8-platform.h
+++ b/deps/v8/include/v8-platform.h
@@ -505,6 +505,16 @@ class PageAllocator {
   virtual void* AllocatePages(void* address, size_t length, size_t alignment,
                               Permission permissions) = 0;
 
+  /**
+   * Resizes the previously allocated memory at the given address. Returns true
+   * if the allocation could be resized. Returns false if this operation is
+   * either not supported or the object could not be resized in-place.
+   */
+  virtual bool ResizeAllocationAt(void* address, size_t old_length,
+                                  size_t new_length, Permission permissions) {
+    return false;
+  }
+
   /**
    * Frees memory in a range that was allocated by a call to AllocatePages.
    */
diff --git a/deps/v8/include/v8-primitive.h b/deps/v8/include/v8-primitive.h
index f966ed55674841..50b07d9c10a7bb 100644
--- a/deps/v8/include/v8-primitive.h
+++ b/deps/v8/include/v8-primitive.h
@@ -819,6 +819,8 @@ class V8_EXPORT Symbol : public Name {
   static Local<Symbol> GetToPrimitive(Isolate* isolate);
   static Local<Symbol> GetToStringTag(Isolate* isolate);
   static Local<Symbol> GetUnscopables(Isolate* isolate);
+  static Local<Symbol> GetDispose(Isolate* isolate);
+  static Local<Symbol> GetAsyncDispose(Isolate* isolate);
 
   V8_INLINE static Symbol* Cast(Data* data) {
 #ifdef V8_ENABLE_CHECKS
diff --git a/deps/v8/include/v8-template.h b/deps/v8/include/v8-template.h
index 297a45d1fe64c7..3ae4a957ed21df 100644
--- a/deps/v8/include/v8-template.h
+++ b/deps/v8/include/v8-template.h
@@ -188,7 +188,8 @@ using NamedPropertyGetterCallback = Intercepted (*)(
 // Use `info.GetReturnValue().Set()` to set the return value of the
 // intercepted get request. If the property does not exist the callback should
 // not set the result and must not produce side effects.
-using GenericNamedPropertyGetterCallback =
+using GenericNamedPropertyGetterCallback V8_DEPRECATE_SOON(
+    "Use NamedPropertyGetterCallback instead") =
     void (*)(Local<Name> property, const PropertyCallbackInfo<Value>& info);
 
 /**
@@ -221,7 +222,8 @@ using NamedPropertySetterCallback =
 // `info.GetReturnValue().Set(value)`. If the setter did not intercept the
 // request, i.e., if the request should be handled as if no interceptor is
 // present, do not not call `Set()` and do not produce side effects.
-using GenericNamedPropertySetterCallback =
+using GenericNamedPropertySetterCallback V8_DEPRECATE_SOON(
+    "Use NamedPropertySetterCallback instead") =
     void (*)(Local<Name> property, Local<Value> value,
              const PropertyCallbackInfo<Value>& info);
 
@@ -259,7 +261,8 @@ using NamedPropertyQueryCallback = Intercepted (*)(
 // value is an integer encoding a `v8::PropertyAttribute`. If the property does
 // not exist the callback should not set the result and must not produce side
 // effects.
-using GenericNamedPropertyQueryCallback =
+using GenericNamedPropertyQueryCallback V8_DEPRECATE_SOON(
+    "Use NamedPropertyQueryCallback instead") =
     void (*)(Local<Name> property, const PropertyCallbackInfo<Integer>& info);
 
 /**
@@ -296,7 +299,8 @@ using NamedPropertyDeleterCallback = Intercepted (*)(
 // `info.GetReturnValue().Set(value)` with a boolean `value`. The `value` is
 // used as the return value of `delete`. If the deleter does not intercept the
 // request then it should not set the result and must not produce side effects.
-using GenericNamedPropertyDeleterCallback =
+using GenericNamedPropertyDeleterCallback V8_DEPRECATE_SOON(
+    "Use NamedPropertyDeleterCallback instead") =
     void (*)(Local<Name> property, const PropertyCallbackInfo<Boolean>& info);
 
 /**
@@ -309,7 +313,9 @@ using NamedPropertyEnumeratorCallback =
     void (*)(const PropertyCallbackInfo<Array>& info);
 // This variant will be deprecated soon.
 // This is just a renaming of the typedef.
-using GenericNamedPropertyEnumeratorCallback = NamedPropertyEnumeratorCallback;
+using GenericNamedPropertyEnumeratorCallback V8_DEPRECATE_SOON(
+    "Use NamedPropertyEnumeratorCallback instead") =
+    NamedPropertyEnumeratorCallback;
 
 /**
  * Interceptor for defineProperty requests on an object.
@@ -341,7 +347,8 @@ using NamedPropertyDefinerCallback =
 // `info.GetReturnValue().Set(value)`. If the definer did not intercept the
 // request, i.e., if the request should be handled as if no interceptor is
 // present, do not not call `Set()` and do not produce side effects.
-using GenericNamedPropertyDefinerCallback =
+using GenericNamedPropertyDefinerCallback V8_DEPRECATE_SOON(
+    "Use NamedPropertyDefinerCallback instead") =
     void (*)(Local<Name> property, const PropertyDescriptor& desc,
              const PropertyCallbackInfo<Value>& info);
 
@@ -377,7 +384,8 @@ using NamedPropertyDescriptorCallback = Intercepted (*)(
 // intercepted request. The return value must be an object that
 // can be converted to a PropertyDescriptor, e.g., a `v8::Value` returned from
 // `v8::Object::getOwnPropertyDescriptor`.
-using GenericNamedPropertyDescriptorCallback =
+using GenericNamedPropertyDescriptorCallback V8_DEPRECATE_SOON(
+    "Use NamedPropertyDescriptorCallback instead") =
     void (*)(Local<Name> property, const PropertyCallbackInfo<Value>& info);
 
 // TODO(ishell): Rename IndexedPropertyXxxCallbackV2 back to
@@ -390,7 +398,8 @@ using GenericNamedPropertyDescriptorCallback =
 using IndexedPropertyGetterCallbackV2 =
     Intercepted (*)(uint32_t index, const PropertyCallbackInfo<Value>& info);
 // This variant will be deprecated soon.
-using IndexedPropertyGetterCallback =
+using IndexedPropertyGetterCallback V8_DEPRECATE_SOON(
+    "Use IndexedPropertyGetterCallbackV2 instead") =
     void (*)(uint32_t index, const PropertyCallbackInfo<Value>& info);
 
 /**
@@ -399,7 +408,8 @@ using IndexedPropertyGetterCallback =
 using IndexedPropertySetterCallbackV2 = Intercepted (*)(
     uint32_t index, Local<Value> value, const PropertyCallbackInfo<void>& info);
 // This variant will be deprecated soon.
-using IndexedPropertySetterCallback =
+using IndexedPropertySetterCallback V8_DEPRECATE_SOON(
+    "Use IndexedPropertySetterCallbackV2 instead") =
     void (*)(uint32_t index, Local<Value> value,
              const PropertyCallbackInfo<Value>& info);
 
@@ -409,7 +419,8 @@ using IndexedPropertySetterCallback =
 using IndexedPropertyQueryCallbackV2 =
     Intercepted (*)(uint32_t index, const PropertyCallbackInfo<Integer>& info);
 // This variant will be deprecated soon.
-using IndexedPropertyQueryCallback =
+using IndexedPropertyQueryCallback V8_DEPRECATE_SOON(
+    "Use IndexedPropertyQueryCallbackV2 instead") =
     void (*)(uint32_t index, const PropertyCallbackInfo<Integer>& info);
 
 /**
@@ -418,7 +429,8 @@ using IndexedPropertyQueryCallback =
 using IndexedPropertyDeleterCallbackV2 =
     Intercepted (*)(uint32_t index, const PropertyCallbackInfo<Boolean>& info);
 // This variant will be deprecated soon.
-using IndexedPropertyDeleterCallback =
+using IndexedPropertyDeleterCallback V8_DEPRECATE_SOON(
+    "Use IndexedPropertyDeleterCallbackV2 instead") =
     void (*)(uint32_t index, const PropertyCallbackInfo<Boolean>& info);
 
 /**
@@ -437,7 +449,8 @@ using IndexedPropertyDefinerCallbackV2 =
     Intercepted (*)(uint32_t index, const PropertyDescriptor& desc,
                     const PropertyCallbackInfo<void>& info);
 // This variant will be deprecated soon.
-using IndexedPropertyDefinerCallback =
+using IndexedPropertyDefinerCallback V8_DEPRECATE_SOON(
+    "Use IndexedPropertyDefinerCallbackV2 instead") =
     void (*)(uint32_t index, const PropertyDescriptor& desc,
              const PropertyCallbackInfo<Value>& info);
 
@@ -447,7 +460,8 @@ using IndexedPropertyDefinerCallback =
 using IndexedPropertyDescriptorCallbackV2 =
     Intercepted (*)(uint32_t index, const PropertyCallbackInfo<Value>& info);
 // This variant will be deprecated soon.
-using IndexedPropertyDescriptorCallback =
+using IndexedPropertyDescriptorCallback V8_DEPRECATE_SOON(
+    "Use IndexedPropertyDescriptorCallbackV2 instead") =
     void (*)(uint32_t index, const PropertyCallbackInfo<Value>& info);
 
 /**
@@ -702,8 +716,8 @@ class V8_EXPORT FunctionTemplate : public Template {
   bool IsLeafTemplateForApiObject(v8::Local<v8::Value> value) const;
 
   /**
-   * Checks if the object can be promoted to read only space, seals it and
-   * prepares for promotion.
+   * Seal the object and mark it for promotion to read only space during
+   * context snapshot creation.
    *
    * This is an experimental feature and may still change significantly.
    */
@@ -1037,6 +1051,14 @@ class V8_EXPORT ObjectTemplate : public Template {
   void SetCodeLike();
   bool IsCodeLike() const;
 
+  /**
+   * Seal the object and mark it for promotion to read only space during
+   * context snapshot creation.
+   *
+   * This is an experimental feature and may still change significantly.
+   */
+  void SealAndPrepareForPromotionToReadOnly();
+
   V8_INLINE static ObjectTemplate* Cast(Data* data);
 
  private:
diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h
index ef65881ed91063..aaa9c389178051 100644
--- a/deps/v8/include/v8-version.h
+++ b/deps/v8/include/v8-version.h
@@ -9,9 +9,9 @@
 // NOTE these macros are used by some of the tool scripts and the build
 // system so their names cannot be changed without changing the scripts.
 #define V8_MAJOR_VERSION 13
-#define V8_MINOR_VERSION 6
-#define V8_BUILD_NUMBER 233
-#define V8_PATCH_LEVEL 10
+#define V8_MINOR_VERSION 7
+#define V8_BUILD_NUMBER 152
+#define V8_PATCH_LEVEL 9
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
diff --git a/deps/v8/infra/mb/mb_config.pyl b/deps/v8/infra/mb/mb_config.pyl
index c80bacd91c586e..f787dd9a0751d0 100644
--- a/deps/v8/infra/mb/mb_config.pyl
+++ b/deps/v8/infra/mb/mb_config.pyl
@@ -853,7 +853,7 @@
     },
 
     'conservative_stack_scanning': {
-      'gn_args': 'v8_enable_conservative_stack_scanning=true',
+      'gn_args': 'v8_enable_direct_handle=true',
     },
 
     'dcheck_always_on': {
diff --git a/deps/v8/infra/testing/builders.pyl b/deps/v8/infra/testing/builders.pyl
index 21d290d8b1f2d1..787c43b1d5f95b 100644
--- a/deps/v8/infra/testing/builders.pyl
+++ b/deps/v8/infra/testing/builders.pyl
@@ -109,7 +109,7 @@
       'os': 'Ubuntu-22.04',
     },
     'tests': [
-      {'name': 'v8testing', 'variant': 'default', 'shards': 6},
+      {'name': 'v8testing', 'variant': 'default', 'shards': 8},
     ],
   },
   'v8_linux_gc_stress_dbg': {
@@ -1375,7 +1375,7 @@
       'os': 'Ubuntu-22.04',
     },
     'tests': [
-      {'name': 'v8testing', 'variant': 'default', 'shards': 7},
+      {'name': 'v8testing', 'variant': 'default', 'shards': 8},
     ],
   },
   'V8 Linux - gc stress': {
diff --git a/deps/v8/infra/whitespace.txt b/deps/v8/infra/whitespace.txt
new file mode 100644
index 00000000000000..7692b0d582ff77
--- /dev/null
+++ b/deps/v8/infra/whitespace.txt
@@ -0,0 +1 @@
+Some infra-owned whitespace to test the cherry-picker.
\ No newline at end of file
diff --git a/deps/v8/src/api/api-arguments-inl.h b/deps/v8/src/api/api-arguments-inl.h
index 86b1c75d15612d..2f9c0faab2ee33 100644
--- a/deps/v8/src/api/api-arguments-inl.h
+++ b/deps/v8/src/api/api-arguments-inl.h
@@ -163,9 +163,8 @@ DirectHandle<Object> PropertyCallbackArguments::CallNamedQuery(
   RCS_SCOPE(isolate, RuntimeCallCounterId::kNamedQueryCallback);
   slot_at(kPropertyKeyIndex).store(*name);
   slot_at(kReturnValueIndex).store(Smi::FromInt(v8::None));
-  NamedPropertyQueryCallback f =
-      ToCData<NamedPropertyQueryCallback, kApiNamedPropertyQueryCallbackTag>(
-          isolate, interceptor->query());
+  NamedPropertyQueryCallback f = reinterpret_cast<NamedPropertyQueryCallback>(
+      interceptor->named_query(isolate));
   PREPARE_CALLBACK_INFO_INTERCEPTOR(isolate, f, v8::Integer, interceptor,
                                     ExceptionContext::kNamedQuery);
   v8::Intercepted intercepted = f(v8::Utils::ToLocal(name), callback_info);
@@ -180,9 +179,8 @@ DirectHandle<JSAny> PropertyCallbackArguments::CallNamedGetter(
   RCS_SCOPE(isolate, RuntimeCallCounterId::kNamedGetterCallback);
   slot_at(kPropertyKeyIndex).store(*name);
   slot_at(kReturnValueIndex).store(ReadOnlyRoots(isolate).undefined_value());
-  NamedPropertyGetterCallback f =
-      ToCData<NamedPropertyGetterCallback, kApiNamedPropertyGetterCallbackTag>(
-          isolate, interceptor->getter());
+  NamedPropertyGetterCallback f = reinterpret_cast<NamedPropertyGetterCallback>(
+      interceptor->named_getter(isolate));
   PREPARE_CALLBACK_INFO_INTERCEPTOR(isolate, f, v8::Value, interceptor,
                                     ExceptionContext::kNamedGetter);
   v8::Intercepted intercepted = f(v8::Utils::ToLocal(name), callback_info);
@@ -198,9 +196,8 @@ Handle<JSAny> PropertyCallbackArguments::CallNamedDescriptor(
   slot_at(kPropertyKeyIndex).store(*name);
   slot_at(kReturnValueIndex).store(ReadOnlyRoots(isolate).undefined_value());
   NamedPropertyDescriptorCallback f =
-      ToCData<NamedPropertyDescriptorCallback,
-              kApiNamedPropertyDescriptorCallbackTag>(
-          isolate, interceptor->descriptor());
+      reinterpret_cast<NamedPropertyDescriptorCallback>(
+          interceptor->named_descriptor(isolate));
   PREPARE_CALLBACK_INFO_INTERCEPTOR(isolate, f, v8::Value, interceptor,
                                     ExceptionContext::kNamedDescriptor);
   v8::Intercepted intercepted = f(v8::Utils::ToLocal(name), callback_info);
@@ -216,9 +213,8 @@ v8::Intercepted PropertyCallbackArguments::CallNamedSetter(
   RCS_SCOPE(isolate, RuntimeCallCounterId::kNamedSetterCallback);
   slot_at(kPropertyKeyIndex).store(*name);
   slot_at(kReturnValueIndex).store(ReadOnlyRoots(isolate).true_value());
-  NamedPropertySetterCallback f =
-      ToCData<NamedPropertySetterCallback, kApiNamedPropertySetterCallbackTag>(
-          isolate, interceptor->setter());
+  NamedPropertySetterCallback f = reinterpret_cast<NamedPropertySetterCallback>(
+      interceptor->named_setter(isolate));
   DirectHandle<InterceptorInfo> has_side_effects;
   PREPARE_CALLBACK_INFO_INTERCEPTOR(isolate, f, void, has_side_effects,
                                     ExceptionContext::kNamedSetter);
@@ -235,9 +231,9 @@ v8::Intercepted PropertyCallbackArguments::CallNamedDefiner(
   RCS_SCOPE(isolate, RuntimeCallCounterId::kNamedDefinerCallback);
   slot_at(kPropertyKeyIndex).store(*name);
   slot_at(kReturnValueIndex).store(ReadOnlyRoots(isolate).true_value());
-  NamedPropertyDefinerCallback f = ToCData<NamedPropertyDefinerCallback,
-                                           kApiNamedPropertyDefinerCallbackTag>(
-      isolate, interceptor->definer());
+  NamedPropertyDefinerCallback f =
+      reinterpret_cast<NamedPropertyDefinerCallback>(
+          interceptor->named_definer(isolate));
   DirectHandle<InterceptorInfo> has_side_effects;
   PREPARE_CALLBACK_INFO_INTERCEPTOR(isolate, f, void, has_side_effects,
                                     ExceptionContext::kNamedDefiner);
@@ -253,9 +249,9 @@ v8::Intercepted PropertyCallbackArguments::CallNamedDeleter(
   RCS_SCOPE(isolate, RuntimeCallCounterId::kNamedDeleterCallback);
   slot_at(kPropertyKeyIndex).store(*name);
   slot_at(kReturnValueIndex).store(ReadOnlyRoots(isolate).true_value());
-  NamedPropertyDeleterCallback f = ToCData<NamedPropertyDeleterCallback,
-                                           kApiNamedPropertyDeleterCallbackTag>(
-      isolate, interceptor->deleter());
+  NamedPropertyDeleterCallback f =
+      reinterpret_cast<NamedPropertyDeleterCallback>(
+          interceptor->named_deleter(isolate));
   DirectHandle<InterceptorInfo> has_side_effects;
   PREPARE_CALLBACK_INFO_INTERCEPTOR(isolate, f, v8::Boolean, has_side_effects,
                                     ExceptionContext::kNamedDeleter);
@@ -284,9 +280,8 @@ DirectHandle<Object> PropertyCallbackArguments::CallIndexedQuery(
   slot_at(kPropertyKeyIndex).store(Smi::zero());  // indexed callback marker
   slot_at(kReturnValueIndex).store(Smi::FromInt(v8::None));
   IndexedPropertyQueryCallbackV2 f =
-      ToCData<IndexedPropertyQueryCallbackV2,
-              kApiIndexedPropertyQueryCallbackTag>(isolate,
-                                                   interceptor->query());
+      reinterpret_cast<IndexedPropertyQueryCallbackV2>(
+          interceptor->indexed_query(isolate));
   PREPARE_CALLBACK_INFO_INTERCEPTOR(isolate, f, v8::Integer, interceptor,
                                     ExceptionContext::kIndexedQuery);
   v8::Intercepted intercepted = f(index, callback_info);
@@ -303,9 +298,8 @@ DirectHandle<JSAny> PropertyCallbackArguments::CallIndexedGetter(
   slot_at(kPropertyKeyIndex).store(Smi::zero());  // indexed callback marker
   slot_at(kReturnValueIndex).store(ReadOnlyRoots(isolate).undefined_value());
   IndexedPropertyGetterCallbackV2 f =
-      ToCData<IndexedPropertyGetterCallbackV2,
-              kApiIndexedPropertyGetterCallbackTag>(isolate,
-                                                    interceptor->getter());
+      reinterpret_cast<IndexedPropertyGetterCallbackV2>(
+          interceptor->indexed_getter(isolate));
   PREPARE_CALLBACK_INFO_INTERCEPTOR(isolate, f, v8::Value, interceptor,
                                     ExceptionContext::kIndexedGetter);
   v8::Intercepted intercepted = f(index, callback_info);
@@ -322,9 +316,8 @@ Handle<JSAny> PropertyCallbackArguments::CallIndexedDescriptor(
   slot_at(kPropertyKeyIndex).store(Smi::zero());  // indexed callback marker
   slot_at(kReturnValueIndex).store(ReadOnlyRoots(isolate).undefined_value());
   IndexedPropertyDescriptorCallbackV2 f =
-      ToCData<IndexedPropertyDescriptorCallbackV2,
-              kApiIndexedPropertyDescriptorCallbackTag>(
-          isolate, interceptor->descriptor());
+      reinterpret_cast<IndexedPropertyDescriptorCallbackV2>(
+          interceptor->indexed_descriptor(isolate));
   PREPARE_CALLBACK_INFO_INTERCEPTOR(isolate, f, v8::Value, interceptor,
                                     ExceptionContext::kIndexedDescriptor);
   v8::Intercepted intercepted = f(index, callback_info);
@@ -342,9 +335,8 @@ v8::Intercepted PropertyCallbackArguments::CallIndexedSetter(
   slot_at(kPropertyKeyIndex).store(Smi::zero());  // indexed callback marker
   slot_at(kReturnValueIndex).store(ReadOnlyRoots(isolate).true_value());
   IndexedPropertySetterCallbackV2 f =
-      ToCData<IndexedPropertySetterCallbackV2,
-              kApiIndexedPropertySetterCallbackTag>(isolate,
-                                                    interceptor->setter());
+      reinterpret_cast<IndexedPropertySetterCallbackV2>(
+          interceptor->indexed_setter(isolate));
   DirectHandle<InterceptorInfo> has_side_effects;
   PREPARE_CALLBACK_INFO_INTERCEPTOR(isolate, f, void, has_side_effects,
                                     ExceptionContext::kIndexedSetter);
@@ -363,9 +355,8 @@ v8::Intercepted PropertyCallbackArguments::CallIndexedDefiner(
   slot_at(kPropertyKeyIndex).store(Smi::zero());  // indexed callback marker
   slot_at(kReturnValueIndex).store(ReadOnlyRoots(isolate).true_value());
   IndexedPropertyDefinerCallbackV2 f =
-      ToCData<IndexedPropertyDefinerCallbackV2,
-              kApiIndexedPropertyDefinerCallbackTag>(isolate,
-                                                     interceptor->definer());
+      reinterpret_cast<IndexedPropertyDefinerCallbackV2>(
+          interceptor->indexed_definer(isolate));
   DirectHandle<InterceptorInfo> has_side_effects;
   PREPARE_CALLBACK_INFO_INTERCEPTOR(isolate, f, void, has_side_effects,
                                     ExceptionContext::kIndexedDefiner);
@@ -382,9 +373,8 @@ v8::Intercepted PropertyCallbackArguments::CallIndexedDeleter(
   slot_at(kPropertyKeyIndex).store(Smi::zero());  // indexed callback marker
   slot_at(kReturnValueIndex).store(ReadOnlyRoots(isolate).true_value());
   IndexedPropertyDeleterCallbackV2 f =
-      ToCData<IndexedPropertyDeleterCallbackV2,
-              kApiIndexedPropertyDeleterCallbackTag>(isolate,
-                                                     interceptor->deleter());
+      reinterpret_cast<IndexedPropertyDeleterCallbackV2>(
+          interceptor->indexed_deleter(isolate));
   PREPARE_CALLBACK_INFO_INTERCEPTOR(isolate, f, v8::Boolean, interceptor,
                                     ExceptionContext::kIndexedDeleter);
   v8::Intercepted intercepted = f(index, callback_info);
@@ -395,8 +385,8 @@ DirectHandle<JSObjectOrUndefined>
 PropertyCallbackArguments::CallPropertyEnumerator(
     DirectHandle<InterceptorInfo> interceptor) {
   // Named and indexed enumerator callbacks have same signatures.
-  static_assert(std::is_same<NamedPropertyEnumeratorCallback,
-                             IndexedPropertyEnumeratorCallback>::value);
+  static_assert(std::is_same_v<NamedPropertyEnumeratorCallback,
+                               IndexedPropertyEnumeratorCallback>);
   Isolate* isolate = this->isolate();
   slot_at(kPropertyKeyIndex).store(Smi::zero());  // not relevant
   // Enumerator callback's return value is initialized with undefined even
@@ -404,10 +394,14 @@ PropertyCallbackArguments::CallPropertyEnumerator(
   slot_at(kReturnValueIndex).store(ReadOnlyRoots(isolate).undefined_value());
   // TODO(ishell): consider making it return v8::Intercepted to indicate
   // whether the result was set or not.
-  IndexedPropertyEnumeratorCallback f =
-      v8::ToCData<IndexedPropertyEnumeratorCallback,
-                  kApiIndexedPropertyEnumeratorCallbackTag>(
-          isolate, interceptor->enumerator());
+  IndexedPropertyEnumeratorCallback f;
+  if (interceptor->is_named()) {
+    f = reinterpret_cast<NamedPropertyEnumeratorCallback>(
+        interceptor->named_enumerator(isolate));
+  } else {
+    f = reinterpret_cast<IndexedPropertyEnumeratorCallback>(
+        interceptor->indexed_enumerator(isolate));
+  }
   PREPARE_CALLBACK_INFO_INTERCEPTOR(isolate, f, v8::Array, interceptor,
                                     ExceptionContext::kNamedEnumerator);
   f(callback_info);
diff --git a/deps/v8/src/api/api-natives.cc b/deps/v8/src/api/api-natives.cc
index 33eab94465d2f5..06fee8ec4cf69b 100644
--- a/deps/v8/src/api/api-natives.cc
+++ b/deps/v8/src/api/api-natives.cc
@@ -83,7 +83,7 @@ MaybeDirectHandle<Object> DefineAccessorProperty(
         isolate, getter,
         InstantiateFunction(isolate, Cast<FunctionTemplateInfo>(getter)));
     DirectHandle<Code> trampoline = BUILTIN_CODE(isolate, DebugBreakTrampoline);
-    Cast<JSFunction>(getter)->UpdateCode(*trampoline);
+    Cast<JSFunction>(getter)->UpdateCode(isolate, *trampoline);
   }
   if (IsFunctionTemplateInfo(*setter) &&
       Cast<FunctionTemplateInfo>(*setter)->BreakAtEntry(isolate)) {
@@ -91,7 +91,7 @@ MaybeDirectHandle<Object> DefineAccessorProperty(
         isolate, setter,
         InstantiateFunction(isolate, Cast<FunctionTemplateInfo>(setter)));
     DirectHandle<Code> trampoline = BUILTIN_CODE(isolate, DebugBreakTrampoline);
-    Cast<JSFunction>(setter)->UpdateCode(*trampoline);
+    Cast<JSFunction>(setter)->UpdateCode(isolate, *trampoline);
   }
   RETURN_ON_EXCEPTION(isolate, JSObject::DefineOwnAccessorIgnoreAttributes(
                                    object, name, getter, setter, attributes));
@@ -330,7 +330,7 @@ MaybeHandle<JSObject> InstantiateObject(Isolate* isolate,
 
   const auto new_js_object_type =
       constructor->has_initial_map() &&
-              IsJSApiWrapperObject(constructor->initial_map())
+              IsJSApiWrapperObjectMap(constructor->initial_map())
           ? NewJSObjectType::kAPIWrapper
           : NewJSObjectType::kNoAPIWrapper;
   Handle<JSObject> object;
diff --git a/deps/v8/src/api/api.cc b/deps/v8/src/api/api.cc
index 0f2a526b2b3453..43e9000bf15dee 100644
--- a/deps/v8/src/api/api.cc
+++ b/deps/v8/src/api/api.cc
@@ -36,10 +36,10 @@
 #include "src/api/api-natives.h"
 #include "src/base/hashing.h"
 #include "src/base/logging.h"
+#include "src/base/numerics/safe_conversions.h"
 #include "src/base/platform/memory.h"
 #include "src/base/platform/platform.h"
 #include "src/base/platform/time.h"
-#include "src/base/safe_conversions.h"
 #include "src/base/utils/random-number-generator.h"
 #include "src/base/vector.h"
 #include "src/builtins/accessors.h"
@@ -86,6 +86,7 @@
 #include "src/objects/api-callbacks.h"
 #include "src/objects/backing-store.h"
 #include "src/objects/contexts.h"
+#include "src/objects/cpp-heap-object-wrapper-inl.h"
 #include "src/objects/embedder-data-array-inl.h"
 #include "src/objects/embedder-data-slot-inl.h"
 #include "src/objects/hash-table-inl.h"
@@ -153,6 +154,10 @@
 #include "src/wasm/wasm-serialization.h"
 #endif  // V8_ENABLE_WEBASSEMBLY
 
+#ifdef V8_INTL_SUPPORT
+#include "src/objects/intl-objects.h"
+#endif  // V8_INTL_SUPPORT
+
 #if V8_OS_LINUX || V8_OS_DARWIN || V8_OS_FREEBSD
 #include <signal.h>
 #include <unistd.h>
@@ -815,6 +820,10 @@ bool Data::IsContext() const {
   return i::IsContext(*Utils::OpenDirectHandle(this));
 }
 
+bool Data::IsCppHeapExternal() const {
+  return IsCppHeapExternalObject(*Utils::OpenDirectHandle(this));
+}
+
 void Context::Enter() {
   i::DisallowGarbageCollection no_gc;
   i::Tagged<i::NativeContext> env = *Utils::OpenDirectHandle(this);
@@ -1470,52 +1479,26 @@ template <PropertyType property_type, typename Getter, typename Setter,
           typename Enumerator, typename Definer>
 i::DirectHandle<i::InterceptorInfo> CreateInterceptorInfo(
     i::Isolate* i_isolate, Getter getter, Setter setter, Query query,
-    Descriptor descriptor, Deleter remover, Enumerator enumerator,
+    Descriptor descriptor, Deleter deleter, Enumerator enumerator,
     Definer definer, Local<Value> data,
     base::Flags<PropertyHandlerFlags> flags) {
   // TODO(saelo): instead of an in-sandbox struct with a lot of external
   // pointers (with different tags), consider creating an object in trusted
   // space instead. That way, only a single reference going out of the sandbox
   // would be required.
-  auto obj = i::Cast<i::InterceptorInfo>(i_isolate->factory()->NewStruct(
-      i::INTERCEPTOR_INFO_TYPE, i::AllocationType::kOld));
-  obj->set_flags(0);
-
-#define CALLBACK_TAG(NAME)                             \
-  property_type == PropertyType::kNamed                \
-      ? internal::kApiNamedProperty##NAME##CallbackTag \
-      : internal::kApiIndexedProperty##NAME##CallbackTag;
-
-  if (getter != nullptr) {
-    constexpr internal::ExternalPointerTag tag = CALLBACK_TAG(Getter);
-    SET_FIELD_WRAPPED(i_isolate, obj, set_getter, getter, tag);
-  }
-  if (setter != nullptr) {
-    constexpr internal::ExternalPointerTag tag = CALLBACK_TAG(Setter);
-    SET_FIELD_WRAPPED(i_isolate, obj, set_setter, setter, tag);
-  }
-  if (query != nullptr) {
-    constexpr internal::ExternalPointerTag tag = CALLBACK_TAG(Query);
-    SET_FIELD_WRAPPED(i_isolate, obj, set_query, query, tag);
-  }
-  if (descriptor != nullptr) {
-    constexpr internal::ExternalPointerTag tag = CALLBACK_TAG(Descriptor);
-    SET_FIELD_WRAPPED(i_isolate, obj, set_descriptor, descriptor, tag);
-  }
-  if (remover != nullptr) {
-    constexpr internal::ExternalPointerTag tag = CALLBACK_TAG(Deleter);
-    SET_FIELD_WRAPPED(i_isolate, obj, set_deleter, remover, tag);
-  }
-  if (enumerator != nullptr) {
-    SET_FIELD_WRAPPED(i_isolate, obj, set_enumerator, enumerator,
-                      internal::kApiIndexedPropertyEnumeratorCallbackTag);
-  }
-  if (definer != nullptr) {
-    constexpr internal::ExternalPointerTag tag = CALLBACK_TAG(Definer);
-    SET_FIELD_WRAPPED(i_isolate, obj, set_definer, definer, tag);
+  auto obj = i_isolate->factory()->NewInterceptorInfo();
+  obj->set_is_named(property_type == PropertyType::kNamed);
+
+#define SET_CALLBACK_FIELD(Name, name)                                        \
+  if (name != nullptr) {                                                      \
+    if constexpr (property_type == PropertyType::kNamed) {                    \
+      obj->set_named_##name(i_isolate, reinterpret_cast<i::Address>(name));   \
+    } else {                                                                  \
+      obj->set_indexed_##name(i_isolate, reinterpret_cast<i::Address>(name)); \
+    }                                                                         \
   }
-
-#undef CALLBACK_TAG
+  INTERCEPTOR_INFO_CALLBACK_LIST(SET_CALLBACK_FIELD)
+#undef SET_CALLBACK_FIELD
 
   obj->set_can_intercept_symbols(
       !(flags & PropertyHandlerFlags::kOnlyInterceptStrings));
@@ -1539,7 +1522,6 @@ i::DirectHandle<i::InterceptorInfo> CreateNamedInterceptorInfo(
   auto interceptor = CreateInterceptorInfo<PropertyType::kNamed>(
       i_isolate, getter, setter, query, descriptor, remover, enumerator,
       definer, data, flags);
-  interceptor->set_is_named(true);
   return interceptor;
 }
 
@@ -1553,7 +1535,6 @@ i::DirectHandle<i::InterceptorInfo> CreateIndexedInterceptorInfo(
   auto interceptor = CreateInterceptorInfo<PropertyType::kIndexed>(
       i_isolate, getter, setter, query, descriptor, remover, enumerator,
       definer, data, flags);
-  interceptor->set_is_named(false);
   return interceptor;
 }
 
@@ -2553,8 +2534,8 @@ V8_WARN_UNUSED_RESULT MaybeLocal<Function> ScriptCompiler::CompileFunction(
   i::DirectHandle<i::JSFunction> result;
   has_exception =
       !i::Compiler::GetWrappedFunction(
-           Utils::OpenHandle(*source->source_string), context, script_details,
-           cached_data.get(), options, no_cache_reason)
+           i_isolate, Utils::OpenHandle(*source->source_string), context,
+           script_details, cached_data.get(), options, no_cache_reason)
            .ToHandle(&result);
   if (options & kConsumeCodeCache) {
     source->cached_data->rejected = cached_data->rejected();
@@ -2649,8 +2630,10 @@ i::MaybeDirectHandle<i::SharedFunctionInfo> CompileStreamedSource(
                        origin.ColumnOffset(), origin.SourceMapUrl(),
                        origin.GetHostDefinedOptions(), origin.Options());
   i::ScriptStreamingData* data = v8_source->impl();
+  i::IsCompiledScope is_compiled_scope;
   return i::Compiler::GetSharedFunctionInfoForStreamedScript(
-      i_isolate, str, script_details, data, &v8_source->compilation_details());
+      i_isolate, str, script_details, data, &is_compiled_scope,
+      &v8_source->compilation_details());
 }
 
 }  // namespace
@@ -4022,6 +4005,11 @@ void v8::WasmModuleObject::CheckCast(Value* that) {
                   "Value is not a WasmModuleObject");
 }
 
+void v8::CppHeapExternal::CheckCast(v8::Data* that) {
+  Utils::ApiCheck(that->IsCppHeapExternal(), "v8::CppHeapExternal::Cast",
+                  "Value is not a CppHeapExternal");
+}
+
 v8::BackingStore::~BackingStore() {
   auto i_this = reinterpret_cast<const i::BackingStore*>(this);
   i_this->~BackingStore();  // manually call internal destructor
@@ -5498,7 +5486,8 @@ Local<Value> Function::GetDebugName() const {
     return ToApiHandle<Primitive>(i_isolate->factory()->undefined_value());
   }
   auto func = i::Cast<i::JSFunction>(self);
-  i::DirectHandle<i::String> name = i::JSFunction::GetDebugName(func);
+  i::DirectHandle<i::String> name =
+      i::JSFunction::GetDebugName(i_isolate, func);
   return Utils::ToLocal(i::direct_handle(*name, i_isolate));
 }
 
@@ -6394,7 +6383,7 @@ void v8::Object::SetAlignedPointerInInternalFields(int argc, int indices[],
 void* v8::Object::Unwrap(v8::Isolate* isolate, i::Address wrapper_obj,
                          CppHeapPointerTagRange tag_range) {
   DCHECK_LE(tag_range.lower_bound, tag_range.upper_bound);
-  return i::JSApiWrapper(
+  return i::CppHeapObjectWrapper(
              i::Cast<i::JSObject>(i::Tagged<i::Object>(wrapper_obj)))
       .GetCppHeapWrappable(reinterpret_cast<i::Isolate*>(isolate), tag_range);
 }
@@ -6402,7 +6391,7 @@ void* v8::Object::Unwrap(v8::Isolate* isolate, i::Address wrapper_obj,
 // static
 void v8::Object::Wrap(v8::Isolate* isolate, i::Address wrapper_obj,
                       CppHeapPointerTag tag, void* wrappable) {
-  return i::JSApiWrapper(
+  return i::CppHeapObjectWrapper(
              i::Cast<i::JSObject>(i::Tagged<i::Object>(wrapper_obj)))
       .SetCppHeapWrappable(reinterpret_cast<i::Isolate*>(isolate), wrappable,
                            tag);
@@ -6904,7 +6893,8 @@ bool RequiresEmbedderSupportToFreeze(i::InstanceType obj_type) {
 
   return (i::InstanceTypeChecker::IsJSApiObject(obj_type) ||
           i::InstanceTypeChecker::IsJSExternalObject(obj_type) ||
-          i::InstanceTypeChecker::IsJSAPIObjectWithEmbedderSlots(obj_type));
+          i::InstanceTypeChecker::IsJSAPIObjectWithEmbedderSlots(obj_type) ||
+          i::InstanceTypeChecker::IsCppHeapExternalObject(obj_type));
 }
 
 bool IsJSReceiverSafeToFreeze(i::InstanceType obj_type) {
@@ -7501,6 +7491,12 @@ bool FunctionTemplate::IsLeafTemplateForApiObject(
   return self->IsLeafTemplateForApiObject(object);
 }
 
+void ObjectTemplate::SealAndPrepareForPromotionToReadOnly() {
+  auto self = Utils::OpenDirectHandle(this);
+  i::Isolate* i_isolate = self->GetIsolateChecked();
+  i::ObjectTemplateInfo::SealAndPrepareForPromotionToReadOnly(i_isolate, self);
+}
+
 void FunctionTemplate::SealAndPrepareForPromotionToReadOnly() {
   auto self = Utils::OpenDirectHandle(this);
   i::Isolate* i_isolate = self->GetIsolateChecked();
@@ -7529,6 +7525,26 @@ void* External::Value() const {
       ->value(isolate);
 }
 
+Local<CppHeapExternal> v8::CppHeapExternal::NewImpl(Isolate* v8_isolate,
+                                                    void* value,
+                                                    CppHeapPointerTag tag) {
+  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(v8_isolate);
+  API_RCS_SCOPE(i_isolate, CppHeapExternal, New);
+  ENTER_V8_NO_SCRIPT_NO_EXCEPTION(i_isolate);
+  i::DirectHandle<i::CppHeapExternalObject> external =
+      i_isolate->factory()->NewCppHeapExternal();
+  i::CppHeapObjectWrapper(*external).SetCppHeapWrappable(i_isolate, value, tag);
+  return Utils::CppHeapExternalToLocal(external);
+}
+
+void* CppHeapExternal::ValueImpl(v8::Isolate* isolate,
+                                 CppHeapPointerTagRange tag_range) const {
+  DCHECK_LE(tag_range.lower_bound, tag_range.upper_bound);
+  auto self = Utils::OpenDirectHandle(this);
+  return i::CppHeapObjectWrapper(*self).GetCppHeapWrappable(
+      reinterpret_cast<i::Isolate*>(isolate), tag_range);
+}
+
 // anonymous namespace for string creation helper functions
 namespace {
 
@@ -8906,9 +8922,9 @@ MaybeLocal<WasmModuleObject> WasmModuleObject::Compile(
 #if V8_ENABLE_WEBASSEMBLY
   base::OwnedVector<const uint8_t> bytes = base::OwnedCopyOf(wire_bytes);
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(v8_isolate);
-  if (!i::wasm::IsWasmCodegenAllowed(i_isolate, i_isolate->native_context())) {
-    return MaybeLocal<WasmModuleObject>();
-  }
+  // We don't check for `IsWasmCodegenAllowed` here, because this function is
+  // used for ESM integration, which in terms of security is equivalent to
+  // <script> tags rather than to {eval}.
   i::MaybeDirectHandle<i::WasmModuleObject> maybe_compiled;
   {
     i::wasm::ErrorThrower thrower(i_isolate, "WasmModuleObject::Compile()");
@@ -9231,7 +9247,7 @@ v8::MemorySpan<uint8_t> v8::ArrayBufferView::GetContents(
     v8::MemorySpan<uint8_t> storage) {
   internal::DisallowGarbageCollection no_gc;
   auto self = Utils::OpenDirectHandle(this);
-  if (self->WasDetached()) {
+  if (self->IsDetachedOrOutOfBounds()) {
     return {};
   }
   if (internal::IsJSTypedArray(*self)) {
@@ -9272,13 +9288,13 @@ bool v8::ArrayBufferView::HasBuffer() const {
 
 size_t v8::ArrayBufferView::ByteOffset() {
   auto obj = Utils::OpenDirectHandle(this);
-  return obj->WasDetached() ? 0 : obj->byte_offset();
+  return obj->IsDetachedOrOutOfBounds() ? 0 : obj->byte_offset();
 }
 
 size_t v8::ArrayBufferView::ByteLength() {
   i::DisallowGarbageCollection no_gc;
   i::Tagged<i::JSArrayBufferView> obj = *Utils::OpenDirectHandle(this);
-  if (obj->WasDetached()) {
+  if (obj->IsDetachedOrOutOfBounds()) {
     return 0;
   }
   if (i::IsJSTypedArray(obj)) {
@@ -9293,7 +9309,7 @@ size_t v8::ArrayBufferView::ByteLength() {
 size_t v8::TypedArray::Length() {
   i::DisallowGarbageCollection no_gc;
   i::Tagged<i::JSTypedArray> obj = *Utils::OpenDirectHandle(this);
-  return obj->WasDetached() ? 0 : obj->GetLength();
+  return obj->IsDetachedOrOutOfBounds() ? 0 : obj->GetLength();
 }
 
 static_assert(v8::TypedArray::kMaxByteLength == i::JSTypedArray::kMaxByteLength,
@@ -9548,7 +9564,9 @@ Local<Symbol> v8::Symbol::ForApi(Isolate* v8_isolate, Local<String> name) {
   V(Split, split)                             \
   V(ToPrimitive, to_primitive)                \
   V(ToStringTag, to_string_tag)               \
-  V(Unscopables, unscopables)
+  V(Unscopables, unscopables)                 \
+  V(Dispose, dispose)                         \
+  V(AsyncDispose, async_dispose)
 
 #define SYMBOL_GETTER(Name, name)                                      \
   Local<Symbol> v8::Symbol::Get##Name(Isolate* v8_isolate) {           \
@@ -10821,12 +10839,6 @@ CALLBACK_SETTER(SharedArrayBufferConstructorEnabledCallback,
                 SharedArrayBufferConstructorEnabledCallback,
                 sharedarraybuffer_constructor_enabled_callback)
 
-// TODO(42203853): Remove this after the deprecated API is removed. Right now,
-// the embedder can still set the callback, but it's never called.
-CALLBACK_SETTER(JavaScriptCompileHintsMagicEnabledCallback,
-                JavaScriptCompileHintsMagicEnabledCallback,
-                compile_hints_magic_enabled_callback)
-
 CALLBACK_SETTER(IsJSApiWrapperNativeErrorCallback,
                 IsJSApiWrapperNativeErrorCallback,
                 is_js_api_wrapper_native_error_callback)
@@ -10868,11 +10880,11 @@ bool Isolate::IsDead() {
   return i_isolate->IsDead();
 }
 
-bool Isolate::AddMessageListener(MessageCallback that, Local<Value> data) {
-  return AddMessageListenerWithErrorLevel(that, kMessageError, data);
+bool Isolate::AddMessageListener(MessageCallback callback, Local<Value> data) {
+  return AddMessageListenerWithErrorLevel(callback, kMessageError, data);
 }
 
-bool Isolate::AddMessageListenerWithErrorLevel(MessageCallback that,
+bool Isolate::AddMessageListenerWithErrorLevel(MessageCallback callback,
                                                int message_levels,
                                                Local<Value> data) {
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(this);
@@ -10882,10 +10894,11 @@ bool Isolate::AddMessageListenerWithErrorLevel(MessageCallback that,
       i_isolate->factory()->message_listeners();
   i::DirectHandle<i::FixedArray> listener =
       i_isolate->factory()->NewFixedArray(3);
-  i::DirectHandle<i::Foreign> foreign =
-      i_isolate->factory()->NewForeign<internal::kMessageListenerTag>(
-          FUNCTION_ADDR(that));
-  listener->set(0, *foreign);
+
+  i::DirectHandle<i::Object> callback_obj =
+      FromCData<internal::kMessageListenerTag>(i_isolate, callback);
+
+  listener->set(0, *callback_obj);
   listener->set(1, data.IsEmpty()
                        ? i::ReadOnlyRoots(i_isolate).undefined_value()
                        : *Utils::OpenDirectHandle(*data));
@@ -10895,22 +10908,24 @@ bool Isolate::AddMessageListenerWithErrorLevel(MessageCallback that,
   return true;
 }
 
-void Isolate::RemoveMessageListeners(MessageCallback that) {
+void Isolate::RemoveMessageListeners(MessageCallback callback) {
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(this);
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(i_isolate);
   i::HandleScope scope(i_isolate);
   i::DisallowGarbageCollection no_gc;
   i::Tagged<i::ArrayList> listeners = i_isolate->heap()->message_listeners();
+  i::ReadOnlyRoots roots(i_isolate);
   for (int i = 0; i < listeners->length(); i++) {
-    if (i::IsUndefined(listeners->get(i), i_isolate)) {
+    if (i::IsUndefined(listeners->get(i), roots)) {
       continue;  // skip deleted ones
     }
     i::Tagged<i::FixedArray> listener =
         i::Cast<i::FixedArray>(listeners->get(i));
-    i::Tagged<i::Foreign> callback_obj = i::Cast<i::Foreign>(listener->get(0));
-    if (callback_obj->foreign_address<internal::kMessageListenerTag>() ==
-        FUNCTION_ADDR(that)) {
-      listeners->set(i, i::ReadOnlyRoots(i_isolate).undefined_value());
+    v8::MessageCallback cur_callback =
+        v8::ToCData<v8::MessageCallback, i::kMessageListenerTag>(
+            i_isolate, listener->get(0));
+    if (cur_callback == callback) {
+      listeners->set(i, roots.undefined_value());
     }
   }
 }
@@ -10976,6 +10991,27 @@ std::string Isolate::GetDefaultLocale() {
 #endif
 }
 
+Maybe<std::string> Isolate::ValidateAndCanonicalizeUnicodeLocaleId(
+    std::string_view tag) {
+  i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(this);
+  ENTER_V8_NO_SCRIPT(i_isolate, this->GetCurrentContext(), Isolate,
+                     ValidateAndCanonicalizeUnicodeLocaleId, i::HandleScope);
+  // has_exception is unused here because when Intl support is enabled, all work
+  // is forwarded to i::Intl::ValidateAndCanonicalizeUnicodeLocaleId, which
+  // encapsulates all exception handling, and when Intl support is disabled,
+  // this method unconditionally throws.
+  USE(has_exception);
+#ifdef V8_INTL_SUPPORT
+  return i::Intl::ValidateAndCanonicalizeUnicodeLocaleId(i_isolate, tag);
+#else
+  THROW_NEW_ERROR_RETURN_VALUE(
+      i_isolate,
+      NewRangeError(i::MessageTemplate::kInvalidLanguageTag,
+                    i_isolate->factory()->NewStringFromAsciiChecked(tag)),
+      Nothing<std::string>());
+#endif
+}
+
 uint64_t Isolate::GetHashSeed() {
   i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(this);
   return HashSeed(i_isolate);
diff --git a/deps/v8/src/api/api.h b/deps/v8/src/api/api.h
index b9b9b65e0470a6..c748086d87138a 100644
--- a/deps/v8/src/api/api.h
+++ b/deps/v8/src/api/api.h
@@ -8,6 +8,7 @@
 #include <memory>
 
 #include "include/v8-container.h"
+#include "include/v8-cpp-heap-external.h"
 #include "include/v8-external.h"
 #include "include/v8-function-callback.h"
 #include "include/v8-proxy.h"
@@ -131,6 +132,7 @@ class RegisteredExtension {
   V(FixedArrayToLocal, FixedArray, FixedArray)                          \
   V(PrimitiveArrayToLocal, FixedArray, PrimitiveArray)                  \
   V(ToLocal, ScriptOrModule, ScriptOrModule)                            \
+  V(CppHeapExternalToLocal, CppHeapExternalObject, CppHeapExternal)     \
   IF_WASM(V, ToLocal, WasmMemoryMapDescriptor, WasmMemoryMapDescriptor) \
   IF_WASM(V, ToLocal, WasmModuleObject, WasmModuleObject)
 
@@ -149,7 +151,8 @@ class RegisteredExtension {
   V(CallableToLocal)          \
   V(ToLocalPrimitive)         \
   V(FixedArrayToLocal)        \
-  V(PrimitiveArrayToLocal)
+  V(PrimitiveArrayToLocal)    \
+  V(CppHeapExternalToLocal)
 
 #define OPEN_HANDLE_LIST(V)                                    \
   V(Template, TemplateInfoWithProperties)                      \
@@ -206,6 +209,7 @@ class RegisteredExtension {
   V(ScriptOrModule, ScriptOrModule)                            \
   V(FixedArray, FixedArray)                                    \
   V(ModuleRequest, ModuleRequest)                              \
+  V(CppHeapExternal, CppHeapExternalObject)                    \
   IF_WASM(V, WasmMemoryMapDescriptor, WasmMemoryMapDescriptor) \
   IF_WASM(V, WasmMemoryObject, WasmMemoryObject)
 
diff --git a/deps/v8/src/ast/ast.h b/deps/v8/src/ast/ast.h
index 0464047913a272..0e3e491d8d191a 100644
--- a/deps/v8/src/ast/ast.h
+++ b/deps/v8/src/ast/ast.h
@@ -193,18 +193,6 @@ class Statement : public AstNode {
 
 class Expression : public AstNode {
  public:
-  enum Context {
-    // Not assigned a context yet, or else will not be visited during
-    // code generation.
-    kUninitialized,
-    // Evaluated for its side effects.
-    kEffect,
-    // Evaluated for its value (and side effects).
-    kValue,
-    // Evaluated for control flow (and side effects).
-    kTest
-  };
-
   // True iff the expression is a valid reference expression.
   bool IsValidReferenceExpression() const;
 
@@ -1917,6 +1905,8 @@ class BinaryOperation final : public Expression {
   Expression* left() const { return left_; }
   Expression* right() const { return right_; }
 
+  void UpdateRight(Expression* expr) { right_ = expr; }
+
   // Returns true if one side is a Smi literal, returning the other side's
   // sub-expression in |subexpr| and the literal Smi in |literal|.
   bool IsSmiLiteralOperation(Expression** subexpr, Tagged<Smi>* literal);
@@ -1954,6 +1944,13 @@ class NaryOperation final : public Expression {
     subsequent_.emplace_back(expr, pos);
   }
 
+  Expression* last() const {
+    return subsequent_[subsequent_.size() - 1].expression;
+  }
+  void UpdateLast(Expression* expr) {
+    subsequent_[subsequent_.size() - 1].expression = expr;
+  }
+
  private:
   friend class AstNodeFactory;
   friend Zone;
diff --git a/deps/v8/src/ast/scopes.cc b/deps/v8/src/ast/scopes.cc
index 972016be929350..877568fc953221 100644
--- a/deps/v8/src/ast/scopes.cc
+++ b/deps/v8/src/ast/scopes.cc
@@ -256,7 +256,7 @@ Scope::Scope(Zone* zone, ScopeType scope_type,
     // object variable (we don't store it explicitly).
     DCHECK_NOT_NULL(ast_value_factory);
     int home_object_index = scope_info->ContextSlotIndex(
-        ast_value_factory->dot_home_object_string()->string());
+        *ast_value_factory->dot_home_object_string()->string());
     DCHECK_IMPLIES(home_object_index >= 0,
                    scope_type == CLASS_SCOPE || scope_type == BLOCK_SCOPE);
     if (home_object_index >= 0) {
@@ -974,7 +974,7 @@ Variable* Scope::LookupInScopeInfo(const AstRawString* name, Scope* cache) {
 
   {
     location = VariableLocation::CONTEXT;
-    index = scope_info->ContextSlotIndex(name->string(), &lookup_result);
+    index = scope_info->ContextSlotIndex(name_handle, &lookup_result);
     found = index >= 0;
   }
 
@@ -2003,9 +2003,8 @@ void Scope::Print(int n) {
       Indent(n1, "// class var");
       PrintF("%s%s:\n",
              class_scope->class_variable()->is_used() ? ", used" : ", unused",
-             class_scope->should_save_class_variable_index()
-                 ? ", index saved"
-                 : ", index not saved");
+             class_scope->should_save_class_variable() ? ", saved"
+                                                       : ", not saved");
       PrintVar(n1, class_scope->class_variable());
     }
   }
@@ -2815,6 +2814,13 @@ void DeclarationScope::AllocateScopeInfos(ParseInfo* parse_info,
                 it->second->Equals(scope_info, parse_info_sfi->live_edited(),
                                    &last_checked_field_index);
 
+            std::unique_ptr<char[]> script_name_or_url;
+            size_t script_name_or_url_length = 0;
+            if (IsString(script->GetNameOrSourceURL())) {
+              script_name_or_url = Cast<String>(script->GetNameOrSourceURL())
+                                       ->ToCString(&script_name_or_url_length);
+            }
+
             std::unique_ptr<char[]> script_source;
             size_t script_source_length = 0;
             std::unique_ptr<char[]> function_source;
@@ -2875,7 +2881,11 @@ void DeclarationScope::AllocateScopeInfos(ParseInfo* parse_info,
                 function_source_length,
                 reinterpret_cast<Address>(function_source.get() +
                                           function_source_length),
-
+                0xcafe0006,
+                script_name_or_url_length,
+                reinterpret_cast<Address>(script_name_or_url.get()),
+                reinterpret_cast<Address>(script_name_or_url.get() +
+                                          script_name_or_url_length),
                 0xcafeffff,
             };
 
@@ -3043,7 +3053,7 @@ Variable* ClassScope::LookupPrivateNameInScopeInfo(const AstRawString* name) {
   DisallowGarbageCollection no_gc;
 
   VariableLookupResult lookup_result;
-  int index = scope_info_->ContextSlotIndex(name->string(), &lookup_result);
+  int index = scope_info_->ContextSlotIndex(*name->string(), &lookup_result);
   if (index < 0) {
     return nullptr;
   }
diff --git a/deps/v8/src/ast/scopes.h b/deps/v8/src/ast/scopes.h
index e62f6077d175df..821dca13db3c68 100644
--- a/deps/v8/src/ast/scopes.h
+++ b/deps/v8/src/ast/scopes.h
@@ -394,6 +394,10 @@ class V8_EXPORT_PRIVATE Scope : public NON_EXPORTED_BASE(ZoneObject) {
     return has_await_using_declaration_;
   }
 
+  bool has_context_cells() const {
+    return v8_flags.script_context_cells && is_script_scope();
+  }
+
   bool is_wrapped_function() const {
     DCHECK_IMPLIES(is_wrapped_function_, is_function_scope());
     return is_wrapped_function_;
@@ -506,8 +510,6 @@ class V8_EXPORT_PRIVATE Scope : public NON_EXPORTED_BASE(ZoneObject) {
     switch (scope_type_) {
       case MODULE_SCOPE:
       case WITH_SCOPE:  // DebugEvaluateContext as well
-      case SCRIPT_SCOPE:  // Side data for const tracking let.
-      case REPL_MODE_SCOPE:
         return true;
       default:
         DCHECK_IMPLIES(sloppy_eval_can_extend_vars_,
@@ -1469,8 +1471,8 @@ class V8_EXPORT_PRIVATE ClassScope : public Scope {
   // The inner scope may also calls eval which may results in access to
   // static private names.
   // Only maintained when the scope is parsed.
-  bool should_save_class_variable_index() const {
-    return should_save_class_variable_index_ ||
+  bool should_save_class_variable() const {
+    return should_save_class_variable_ ||
            has_explicit_static_private_methods_access_ ||
            (has_static_private_methods_ && inner_scope_calls_eval_);
   }
@@ -1479,9 +1481,7 @@ class V8_EXPORT_PRIVATE ClassScope : public Scope {
   bool is_anonymous_class() const { return is_anonymous_class_; }
 
   // Overriden during reparsing
-  void set_should_save_class_variable_index() {
-    should_save_class_variable_index_ = true;
-  }
+  void set_should_save_class_variable() { should_save_class_variable_ = true; }
 
  private:
   friend class Scope;
@@ -1528,7 +1528,7 @@ class V8_EXPORT_PRIVATE ClassScope : public Scope {
   bool is_anonymous_class_ : 1 = false;
   // This is only maintained during reparsing, restored from the
   // preparsed data.
-  bool should_save_class_variable_index_ : 1 = false;
+  bool should_save_class_variable_ : 1 = false;
 };
 
 // Iterate over the private name scope chain. The iteration proceeds from the
diff --git a/deps/v8/src/base/address-region.h b/deps/v8/src/base/address-region.h
index 517f5935e0fb0c..9923681dfa8ab4 100644
--- a/deps/v8/src/base/address-region.h
+++ b/deps/v8/src/base/address-region.h
@@ -64,10 +64,6 @@ class AddressRegion {
     return address_ == other.address_ && size_ == other.size_;
   }
 
-  bool operator!=(AddressRegion other) const {
-    return address_ != other.address_ || size_ != other.size_;
-  }
-
  private:
   Address address_ = 0;
   size_t size_ = 0;
diff --git a/deps/v8/src/base/bits-iterator.h b/deps/v8/src/base/bits-iterator.h
index 9056ae4da1ff6f..bcd503ae862e96 100644
--- a/deps/v8/src/base/bits-iterator.h
+++ b/deps/v8/src/base/bits-iterator.h
@@ -32,7 +32,6 @@ class BitsIterator : public iterator<std::forward_iterator_tag, int> {
   }
 
   bool operator==(BitsIterator other) { return bits_ == other.bits_; }
-  bool operator!=(BitsIterator other) { return bits_ != other.bits_; }
 
  private:
   T bits_;
diff --git a/deps/v8/src/base/bounded-page-allocator.cc b/deps/v8/src/base/bounded-page-allocator.cc
index c5f3f855d1c825..c07d0a1a2a68fd 100644
--- a/deps/v8/src/base/bounded-page-allocator.cc
+++ b/deps/v8/src/base/bounded-page-allocator.cc
@@ -112,6 +112,52 @@ bool BoundedPageAllocator::AllocatePagesAt(Address address, size_t size,
   return true;
 }
 
+bool BoundedPageAllocator::ResizeAllocationAt(
+    void* address, size_t old_size, size_t new_size,
+    PageAllocator::Permission access) {
+  MutexGuard guard(&mutex_);
+
+  const Address address_at = reinterpret_cast<Address>(address);
+  DCHECK(IsAligned(old_size, commit_page_size_));
+  DCHECK(IsAligned(new_size, commit_page_size_));
+
+  if (new_size < old_size) {
+    // Shrinking is not supported at the moment.
+    return false;
+  } else if (new_size == old_size) {
+    // Nothing to do in this case.
+    return true;
+  }
+
+  DCHECK_LT(old_size, new_size);
+
+  const Address allocated_old_size = RoundUp(old_size, allocate_page_size_);
+  const Address allocated_new_size = RoundUp(new_size, allocate_page_size_);
+
+  if (allocated_old_size < allocated_new_size) {
+    if (!region_allocator_.TryGrowRegion(address_at, allocated_new_size)) {
+      allocation_status_ = AllocationStatus::kHintedAddressTakenOrNotFound;
+      return false;
+    }
+  }
+
+  if (!page_allocator_->SetPermissions(
+          reinterpret_cast<void*>(address_at + old_size), new_size - old_size,
+          access)) {
+    if (allocated_old_size < allocated_new_size) {
+      // This most likely means that we ran out of memory.
+      CHECK_EQ(region_allocator_.TrimRegion(address_at, allocated_old_size),
+               allocated_new_size - allocated_old_size);
+    }
+
+    allocation_status_ = AllocationStatus::kFailedToCommit;
+    return false;
+  }
+
+  allocation_status_ = AllocationStatus::kSuccess;
+  return true;
+}
+
 bool BoundedPageAllocator::ReserveForSharedMemoryMapping(void* ptr,
                                                          size_t size) {
   MutexGuard guard(&mutex_);
diff --git a/deps/v8/src/base/bounded-page-allocator.h b/deps/v8/src/base/bounded-page-allocator.h
index d2f5bc3b80482a..3cfe3d44a0676a 100644
--- a/deps/v8/src/base/bounded-page-allocator.h
+++ b/deps/v8/src/base/bounded-page-allocator.h
@@ -106,6 +106,9 @@ class V8_BASE_EXPORT BoundedPageAllocator : public v8::PageAllocator {
   // Allocates pages at given address, returns true on success.
   bool AllocatePagesAt(Address address, size_t size, Permission access);
 
+  bool ResizeAllocationAt(void* address, size_t old_size, size_t new_size,
+                          Permission access) override;
+
   bool FreePages(void* address, size_t size) override;
 
   bool ReleasePages(void* address, size_t size, size_t new_size) override;
diff --git a/deps/v8/src/base/cpu.cc b/deps/v8/src/base/cpu.cc
index 8d868aa4cf6aa8..49d41a2fba5d41 100644
--- a/deps/v8/src/base/cpu.cc
+++ b/deps/v8/src/base/cpu.cc
@@ -190,17 +190,19 @@ static V8_INLINE void __cpuidex(int cpu_info[4], int info_type,
  * HWCAP2 flags - for elf_hwcap2 (in kernel) and AT_HWCAP2
  */
 #define HWCAP2_MTE (1 << 18)
+#define HWCAP2_CSSC (1UL << 34)
+#define HWCAP2_HBC (1UL << 44)
 #endif  // V8_HOST_ARCH_ARM64
 
 #if V8_HOST_ARCH_ARM || V8_HOST_ARCH_ARM64
 
-static std::tuple<uint32_t, uint32_t> ReadELFHWCaps() {
-  uint32_t hwcap = 0;
-  uint32_t hwcap2 = 0;
+static std::tuple<uint64_t, uint64_t> ReadELFHWCaps() {
+  uint64_t hwcap = 0;
+  uint64_t hwcap2 = 0;
 #if (V8_GLIBC_PREREQ(2, 16) || V8_OS_ANDROID) && defined(AT_HWCAP)
-  hwcap = static_cast<uint32_t>(getauxval(AT_HWCAP));
+  hwcap = static_cast<uint64_t>(getauxval(AT_HWCAP));
 #if defined(AT_HWCAP2)
-  hwcap2 = static_cast<uint32_t>(getauxval(AT_HWCAP2));
+  hwcap2 = static_cast<uint64_t>(getauxval(AT_HWCAP2));
 #endif  // AT_HWCAP2
 #else
   // Read the ELF HWCAP flags by parsing /proc/self/auxv.
@@ -445,8 +447,11 @@ CPU::CPU()
       has_dot_prod_(false),
       has_lse_(false),
       has_mte_(false),
+      has_sha3_(false),
       has_pmull1q_(false),
       has_fp16_(false),
+      has_hbc_(false),
+      has_cssc_(false),
       is_fp64_mode_(false),
       has_non_stop_time_stamp_counter_(false),
       is_running_in_vm_(false),
@@ -708,7 +713,8 @@ CPU::CPU()
   }
 
   // Try to extract the list of CPU features from ELF hwcaps.
-  uint32_t hwcaps, hwcaps2;
+  uint64_t hwcaps = 0;
+  uint64_t hwcaps2 = 0;
   std::tie(hwcaps, hwcaps2) = ReadELFHWCaps();
   if (hwcaps != 0) {
     has_idiva_ = (hwcaps & HWCAP_IDIVA) != 0;
@@ -831,15 +837,18 @@ CPU::CPU()
 
 #elif V8_OS_LINUX
   // Try to extract the list of CPU features from ELF hwcaps.
-  uint32_t hwcaps, hwcaps2;
+  uint64_t hwcaps, hwcaps2;
   std::tie(hwcaps, hwcaps2) = ReadELFHWCaps();
+  has_cssc_ = (hwcaps2 & HWCAP2_CSSC) != 0;
   has_mte_ = (hwcaps2 & HWCAP2_MTE) != 0;
+  has_hbc_ = (hwcaps2 & HWCAP2_HBC) != 0;
   if (hwcaps != 0) {
     has_jscvt_ = (hwcaps & HWCAP_JSCVT) != 0;
     has_dot_prod_ = (hwcaps & HWCAP_ASIMDDP) != 0;
     has_lse_ = (hwcaps & HWCAP_ATOMICS) != 0;
     has_pmull1q_ = (hwcaps & HWCAP_PMULL) != 0;
     has_fp16_ = (hwcaps & HWCAP_FPHP) != 0;
+    has_sha3_ = (hwcaps & HWCAP_SHA3) != 0;
   } else {
     // Try to fallback to "Features" CPUInfo field
     CPUInfo cpu_info;
@@ -849,6 +858,7 @@ CPU::CPU()
     has_lse_ = HasListItem(features, "atomics");
     has_pmull1q_ = HasListItem(features, "pmull");
     has_fp16_ = HasListItem(features, "half");
+    has_sha3_ = HasListItem(features, "sha3");
     delete[] features;
   }
 #elif V8_OS_DARWIN
@@ -893,6 +903,14 @@ CPU::CPU()
   } else {
     has_fp16_ = fp16;
   }
+  int64_t feat_sha3 = 0;
+  size_t feat_sha3_size = sizeof(feat_sha3);
+  if (sysctlbyname("hw.optional.arm.FEAT_SHA3", &feat_sha3, &feat_sha3_size,
+                   nullptr, 0) == -1) {
+    has_sha3_ = false;
+  } else {
+    has_sha3_ = feat_sha3;
+  }
 #else
   // ARM64 Macs always have JSCVT, ASIMDDP, FP16 and LSE.
   has_jscvt_ = true;
@@ -900,6 +918,7 @@ CPU::CPU()
   has_lse_ = true;
   has_pmull1q_ = true;
   has_fp16_ = true;
+  has_sha3_ = true;
 #endif  // V8_OS_IOS
 #endif  // V8_OS_WIN
 
diff --git a/deps/v8/src/base/cpu.h b/deps/v8/src/base/cpu.h
index 82909f0b74ff62..701efe871a0578 100644
--- a/deps/v8/src/base/cpu.h
+++ b/deps/v8/src/base/cpu.h
@@ -120,8 +120,11 @@ class V8_BASE_EXPORT CPU final {
   bool has_dot_prod() const { return has_dot_prod_; }
   bool has_lse() const { return has_lse_; }
   bool has_mte() const { return has_mte_; }
+  bool has_sha3() const { return has_sha3_; }
   bool has_pmull1q() const { return has_pmull1q_; }
   bool has_fp16() const { return has_fp16_; }
+  bool has_hbc() const { return has_hbc_; }
+  bool has_cssc() const { return has_cssc_; }
 
   // mips features
   bool is_fp64_mode() const { return is_fp64_mode_; }
@@ -191,8 +194,11 @@ class V8_BASE_EXPORT CPU final {
   bool has_dot_prod_;
   bool has_lse_;
   bool has_mte_;
+  bool has_sha3_;
   bool has_pmull1q_;
   bool has_fp16_;
+  bool has_hbc_;
+  bool has_cssc_;
   bool is_fp64_mode_;
   bool has_non_stop_time_stamp_counter_;
   bool is_running_in_vm_;
diff --git a/deps/v8/src/base/doubly-threaded-list.h b/deps/v8/src/base/doubly-threaded-list.h
index db0368d2a28c13..b247586cb73187 100644
--- a/deps/v8/src/base/doubly-threaded-list.h
+++ b/deps/v8/src/base/doubly-threaded-list.h
@@ -53,7 +53,6 @@ class DoublyThreadedList {
     }
 
     bool operator==(end_iterator) { return !DTLTraits::non_empty(curr_); }
-    bool operator!=(end_iterator) { return DTLTraits::non_empty(curr_); }
 
    private:
     friend DoublyThreadedList;
diff --git a/deps/v8/src/base/enum-set.h b/deps/v8/src/base/enum-set.h
index ccd564ace61df4..be23f2e9b9b39b 100644
--- a/deps/v8/src/base/enum-set.h
+++ b/deps/v8/src/base/enum-set.h
@@ -58,7 +58,6 @@ class EnumSet {
   constexpr EnumSet operator~() const { return EnumSet(~bits_); }
 
   constexpr bool operator==(EnumSet set) const { return bits_ == set.bits_; }
-  constexpr bool operator!=(EnumSet set) const { return bits_ != set.bits_; }
 
   constexpr EnumSet operator|(EnumSet set) const {
     return EnumSet(bits_ | set.bits_);
diff --git a/deps/v8/src/base/flags.h b/deps/v8/src/base/flags.h
index ab36d617cfc182..358c713887e0b8 100644
--- a/deps/v8/src/base/flags.h
+++ b/deps/v8/src/base/flags.h
@@ -37,9 +37,6 @@ class Flags final {
   constexpr bool operator==(flag_type flag) const {
     return mask_ == static_cast<mask_type>(flag);
   }
-  constexpr bool operator!=(flag_type flag) const {
-    return mask_ != static_cast<mask_type>(flag);
-  }
 
   Flags& operator&=(const Flags& flags) {
     mask_ &= flags.mask_;
diff --git a/deps/v8/src/base/hashmap-entry.h b/deps/v8/src/base/hashmap-entry.h
index f9bc6e69dd1c3c..366891d8f42640 100644
--- a/deps/v8/src/base/hashmap-entry.h
+++ b/deps/v8/src/base/hashmap-entry.h
@@ -27,7 +27,7 @@ struct TemplateHashMapEntry {
 
   Key key;
   Value value;
-  uint32_t hash;  // The full hash value for key
+  uint32_t hash : 31;  // The full hash value for key
 
   TemplateHashMapEntry(Key key, Value value, uint32_t hash)
       : key(key), value(value), hash(hash), exists_(true) {}
@@ -37,41 +37,7 @@ struct TemplateHashMapEntry {
   void clear() { exists_ = false; }
 
  private:
-  bool exists_;
-};
-
-// Specialization for pointer-valued keys
-template <typename Key, typename Value>
-struct TemplateHashMapEntry<Key*, Value> {
-  static_assert((!std::is_same<Value, NoHashMapValue>::value));
-
-  Key* key;
-  Value value;
-  uint32_t hash;  // The full hash value for key
-
-  TemplateHashMapEntry(Key* key, Value value, uint32_t hash)
-      : key(key), value(value), hash(hash) {}
-
-  bool exists() const { return key != nullptr; }
-
-  void clear() { key = nullptr; }
-};
-
-// Specialization for Address-valued keys
-template <typename Value>
-struct TemplateHashMapEntry<Address, Value> {
-  static_assert((!std::is_same<Value, NoHashMapValue>::value));
-
-  Address key;
-  Value value;
-  uint32_t hash;  // The full hash value for key
-
-  TemplateHashMapEntry(Address key, Value value, uint32_t hash)
-      : key(key), value(value), hash(hash) {}
-
-  bool exists() const { return key != -1u; }
-
-  void clear() { key = -1u; }
+  bool exists_ : 1;
 };
 
 // Specialization for no value.
@@ -81,7 +47,7 @@ struct TemplateHashMapEntry<Key, NoHashMapValue> {
     Key key;
     NoHashMapValue value;  // Value in union with key to not take up space.
   };
-  uint32_t hash;  // The full hash value for key
+  uint32_t hash : 31;  // The full hash value for key
 
   TemplateHashMapEntry(Key key, NoHashMapValue value, uint32_t hash)
       : key(key), hash(hash), exists_(true) {}
@@ -91,24 +57,7 @@ struct TemplateHashMapEntry<Key, NoHashMapValue> {
   void clear() { exists_ = false; }
 
  private:
-  bool exists_;
-};
-
-// Specialization for pointer-valued keys and no value.
-template <typename Key>
-struct TemplateHashMapEntry<Key*, NoHashMapValue> {
-  union {
-    Key* key;
-    NoHashMapValue value;  // Value in union with key to not take up space.
-  };
-  uint32_t hash;  // The full hash value for key
-
-  TemplateHashMapEntry(Key* key, NoHashMapValue value, uint32_t hash)
-      : key(key), hash(hash) {}
-
-  bool exists() const { return key != nullptr; }
-
-  void clear() { key = nullptr; }
+  bool exists_ : 1;
 };
 
 }  // namespace base
diff --git a/deps/v8/src/base/hashmap.h b/deps/v8/src/base/hashmap.h
index 5f2fbd5b0ad422..3c27cb6c48259f 100644
--- a/deps/v8/src/base/hashmap.h
+++ b/deps/v8/src/base/hashmap.h
@@ -326,9 +326,7 @@ template <typename Key, typename Value, typename MatchFun,
           class AllocationPolicy>
 void TemplateHashMapImpl<Key, Value, MatchFun, AllocationPolicy>::Clear() {
   // Mark all entries as empty.
-  for (size_t i = 0; i < capacity(); ++i) {
-    impl_.map_[i].clear();
-  }
+  memset(impl_.map_, 0, capacity() * sizeof(Entry));
   impl_.occupancy_ = 0;
 }
 
@@ -360,6 +358,7 @@ template <typename LookupKey>
 typename TemplateHashMapImpl<Key, Value, MatchFun, AllocationPolicy>::Entry*
 TemplateHashMapImpl<Key, Value, MatchFun, AllocationPolicy>::Probe(
     const LookupKey& key, uint32_t hash) const {
+  hash &= 0x7FFFFFFF;
   DCHECK(base::bits::IsPowerOfTwo(capacity()));
   size_t i = hash & (capacity() - 1);
   DCHECK(i < capacity());
@@ -545,7 +544,7 @@ class TemplateHashMap
     }
 
     value_type* operator->() { return reinterpret_cast<value_type*>(entry_); }
-    bool operator!=(const Iterator& other) { return entry_ != other.entry_; }
+    bool operator==(const Iterator& other) { return entry_ == other.entry_; }
 
    private:
     Iterator(const Base* map, typename Base::Entry* entry)
diff --git a/deps/v8/src/base/iterator.h b/deps/v8/src/base/iterator.h
index 164b55eb58a3f4..2d8cbc4fcab0c6 100644
--- a/deps/v8/src/base/iterator.h
+++ b/deps/v8/src/base/iterator.h
@@ -81,9 +81,6 @@ struct DerefPtrIterator : base::iterator<std::bidirectional_iterator_tag, T> {
     --ptr;
     return *this;
   }
-  bool operator!=(const DerefPtrIterator& other) const {
-    return ptr != other.ptr;
-  }
   bool operator==(const DerefPtrIterator& other) const {
     return ptr == other.ptr;
   }
diff --git a/deps/v8/src/base/numerics/.clang-tidy b/deps/v8/src/base/numerics/.clang-tidy
new file mode 100644
index 00000000000000..f4038948541dc2
--- /dev/null
+++ b/deps/v8/src/base/numerics/.clang-tidy
@@ -0,0 +1,2 @@
+InheritParentConfig: true
+Checks: misc-include-cleaner
diff --git a/deps/v8/src/base/numerics/DEPS b/deps/v8/src/base/numerics/DEPS
new file mode 100644
index 00000000000000..e15ea675f18459
--- /dev/null
+++ b/deps/v8/src/base/numerics/DEPS
@@ -0,0 +1,14 @@
+# This is a dependency-free, header-only, library, and it needs to stay that
+# way to facilitate pulling it into various third-party projects. So, this
+# file is here to protect against accidentally introducing dependencies.
+include_rules = [
+  "-src",
+  "+src/base/numerics",
+  "+build/build_config.h",
+]
+
+specific_include_rules = {
+  "byte_conversions_unittest.cc": [
+    "+testing/gtest/include/gtest/gtest.h",
+  ],
+}
diff --git a/deps/v8/src/base/numerics/DIR_METADATA b/deps/v8/src/base/numerics/DIR_METADATA
new file mode 100644
index 00000000000000..45f7798a6860a5
--- /dev/null
+++ b/deps/v8/src/base/numerics/DIR_METADATA
@@ -0,0 +1,6 @@
+monorail: {
+  component: "Internals"
+}
+buganizer_public: {
+  component_id: 1456292
+}
diff --git a/deps/v8/src/base/numerics/README.md b/deps/v8/src/base/numerics/README.md
new file mode 100644
index 00000000000000..d2d375f4fc2241
--- /dev/null
+++ b/deps/v8/src/base/numerics/README.md
@@ -0,0 +1,451 @@
+# `base/numerics`
+
+This directory contains a dependency-free, header-only library of templates
+providing well-defined semantics for safely and performantly handling a variety
+of numeric operations, including most common arithmetic operations and
+conversions.
+
+The public API is broken out into the following header files:
+
+*   `checked_math.h` contains the `CheckedNumeric` template class and helper
+    functions for performing arithmetic and conversion operations that detect
+    errors and boundary conditions (e.g. overflow, truncation, etc.).
+*   `clamped_math.h` contains the `ClampedNumeric` template class and
+    helper functions for performing fast, clamped (i.e. [non-sticky](#notsticky)
+    saturating) arithmetic operations and conversions.
+*   `safe_conversions.h` contains the `StrictNumeric` template class and
+    a collection of custom casting templates and helper functions for safely
+    converting between a range of numeric types.
+*   `safe_math.h` includes all of the previously mentioned headers.
+
+*** aside
+**Note:** The `Numeric` template types implicitly convert from C numeric types
+and `Numeric` templates that are convertible to an underlying C numeric type.
+The conversion priority for `Numeric` type coercions is:
+
+*   `StrictNumeric` coerces to `ClampedNumeric` and `CheckedNumeric`
+*   `ClampedNumeric` coerces to `CheckedNumeric`
+***
+
+[TOC]
+
+## Common patterns and use-cases
+
+The following covers the preferred style for the most common uses of this
+library. Please don't cargo-cult from anywhere else. 😉
+
+### Performing checked arithmetic type conversions
+
+The `checked_cast` template converts between arbitrary arithmetic types, and is
+used for cases where a conversion failure should result in program termination:
+
+```cpp
+// Crash if signed_value is out of range for buff_size.
+size_t buff_size = checked_cast<size_t>(signed_value);
+```
+
+### Performing saturated (clamped) arithmetic type conversions
+
+The `saturated_cast` template converts between arbitrary arithmetic types, and
+is used in cases where an out-of-bounds source value should be saturated to the
+corresponding maximum or minimum of the destination type:
+
+```cpp
+// Cast to a smaller type, saturating as needed.
+int8_t eight_bit_value = saturated_cast<int8_t>(int_value);
+
+// Convert from float with saturation to INT_MAX, INT_MIN, or 0 for NaN.
+int int_value = saturated_cast<int>(floating_point_value);
+```
+
+`ClampCeil`, `ClampFloor`, and `ClampRound` provide similar functionality to the
+versions in `std::`, but saturate and return an integral type.  An optional
+template parameter specifies the desired destination type (`int` if
+unspecified).  These should be used for most floating-to-integral conversions.
+
+```cpp
+// Basically saturated_cast<int>(std::round(floating_point_value)).
+int int_value = ClampRound(floating_point_value);
+
+// A destination type can be explicitly specified.
+uint8_t byte_value = ClampFloor<uint8_t>(floating_point_value);
+```
+
+### Enforcing arithmetic type conversions at compile-time
+
+The `strict_cast` emits code that is identical to `static_cast`. However,
+provides static checks that will cause a compilation failure if the
+destination type cannot represent the full range of the source type:
+
+```cpp
+// Throw a compiler error if byte_value is changed to an out-of-range-type.
+int int_value = strict_cast<int>(byte_value);
+```
+
+You can also enforce these compile-time restrictions on function parameters by
+using the `StrictNumeric` template:
+
+```cpp
+// Throw a compiler error if the size argument cannot be represented by a
+// size_t (e.g. passing an int will fail to compile).
+bool AllocateBuffer(void** buffer, StrictNumeric<size_t> size);
+```
+
+### Comparing values between arbitrary arithmetic types
+
+Both the `StrictNumeric` and `ClampedNumeric` types provide well defined
+comparisons between arbitrary arithmetic types. This allows you to perform
+comparisons that are not legal or would trigger compiler warnings or errors
+under the normal arithmetic promotion rules:
+
+```cpp
+bool foo(unsigned value, int upper_bound) {
+  // Converting to StrictNumeric allows this comparison to work correctly.
+  if (MakeStrictNum(value) >= upper_bound)
+    return false;
+```
+
+*** note
+**Warning:** Do not perform manual conversions using the comparison operators.
+Instead, use the cast templates described in the previous sections, or the
+constexpr template functions `IsValueInRangeForNumericType` and
+`IsTypeInRangeForNumericType`, as these templates properly handle the full range
+of corner cases and employ various optimizations.
+***
+
+### Calculating a buffer size (checked arithmetic)
+
+When making exact calculations—such as for buffer lengths—it's often necessary
+to know when those calculations trigger an overflow, undefined behavior, or
+other boundary conditions. The `CheckedNumeric` template does this by storing
+a bit determining whether or not some arithmetic operation has occurred that
+would put the variable in an "invalid" state. Attempting to extract the value
+from a variable in an invalid state will trigger a check/trap condition, that
+by default will result in process termination.
+
+Here's an example of a buffer calculation using a `CheckedNumeric` type (note:
+the AssignIfValid method will trigger a compile error if the result is ignored).
+
+```cpp
+// Calculate the buffer size and detect if an overflow occurs.
+size_t size;
+if (!CheckAdd(kHeaderSize, CheckMul(count, kItemSize)).AssignIfValid(&size)) {
+  // Handle an overflow error...
+}
+```
+
+### Calculating clamped coordinates (non-sticky saturating arithmetic)
+
+Certain classes of calculations—such as coordinate calculations—require
+well-defined semantics that always produce a valid result on boundary
+conditions. The `ClampedNumeric` template addresses this by providing
+performant, non-sticky saturating arithmetic operations.
+
+Here's an example of using a `ClampedNumeric` to calculate an operation
+insetting a rectangle.
+
+```cpp
+// Use clamped arithmetic since inset calculations might overflow.
+void Rect::Inset(int left, int top, int right, int bottom) {
+  origin_ += Vector2d(left, top);
+  set_width(ClampSub(width(), ClampAdd(left, right)));
+  set_height(ClampSub(height(), ClampAdd(top, bottom)));
+}
+```
+
+*** note
+<a name="notsticky"></a>
+The `ClampedNumeric` type is not "sticky", which means the saturation is not
+retained across individual operations. As such, one arithmetic operation may
+result in a saturated value, while the next operation may then "desaturate"
+the value. Here's an example:
+
+```cpp
+ClampedNumeric<int> value = INT_MAX;
+++value;  // value is still INT_MAX, due to saturation.
+--value;  // value is now (INT_MAX - 1), because saturation is not sticky.
+```
+
+***
+
+## Conversion functions and StrictNumeric<> in safe_conversions.h
+
+This header includes a collection of helper `constexpr` templates for safely
+performing a range of conversions, assignments, and tests.
+
+### Safe casting templates
+
+*   `as_signed()` - Returns the supplied integral value as a signed type of
+    the same width.
+*   `as_unsigned()` - Returns the supplied integral value as an unsigned type
+    of the same width.
+*   `checked_cast<>()` - Analogous to `static_cast<>` for numeric types, except
+    that by default it will trigger a crash on an out-of-bounds conversion (e.g.
+    overflow, underflow, NaN to integral) or a compile error if the conversion
+    error can be detected at compile time. The crash handler can be overridden
+    to perform a behavior other than crashing.
+*   `saturated_cast<>()` - Analogous to `static_cast` for numeric types, except
+    that it returns a saturated result when the specified numeric conversion
+    would otherwise overflow or underflow. An NaN source returns 0 by
+    default, but can be overridden to return a different result.
+*   `strict_cast<>()` - Analogous to `static_cast` for numeric types, except
+    this causes a compile failure if the destination type is not large
+    enough to contain any value in the source type. It performs no runtime
+    checking and thus introduces no runtime overhead.
+
+### Other helper and conversion functions
+
+*   `ClampCeil<>()` - A convenience function that computes the ceil of its floating-
+    point arg, then saturates to the destination type (template parameter,
+    defaults to `int`).
+*   `ClampFloor<>()` - A convenience function that computes the floor of its
+    floating-point arg, then saturates to the destination type (template
+    parameter, defaults to `int`).
+*   `IsTypeInRangeForNumericType<>()` - A convenience function that evaluates
+    entirely at compile-time and returns true if the destination type (first
+    template parameter) can represent the full range of the source type
+    (second template parameter).
+*   `IsValueInRangeForNumericType<>()` - A convenience function that returns
+    true if the type supplied as the template parameter can represent the value
+    passed as an argument to the function.
+*   `IsValueNegative()` - A convenience function that will accept any
+    arithmetic type as an argument and will return whether the value is less
+    than zero. Unsigned types always return false.
+*   `ClampRound<>()` - A convenience function that rounds its floating-point arg,
+    then saturates to the destination type (template parameter, defaults to
+    `int`).
+*   `SafeUnsignedAbs()` - Returns the absolute value of the supplied integer
+    parameter as an unsigned result (thus avoiding an overflow if the value
+    is the signed, two's complement minimum).
+
+### StrictNumeric<>
+
+`StrictNumeric<>` is a wrapper type that performs assignments and copies via
+the `strict_cast` template, and can perform valid arithmetic comparisons
+across any range of arithmetic types. `StrictNumeric` is the return type for
+values extracted from a `CheckedNumeric` class instance. The raw numeric value
+is extracted via `static_cast` to the underlying type or any type with
+sufficient range to represent the underlying type.
+
+*   `MakeStrictNum()` - Creates a new `StrictNumeric` from the underlying type
+    of the supplied arithmetic or StrictNumeric type.
+*   `SizeT` - Alias for `StrictNumeric<size_t>`.
+
+## CheckedNumeric<> in checked_math.h
+
+`CheckedNumeric<>` implements all the logic and operators for detecting integer
+boundary conditions such as overflow, underflow, and invalid conversions.
+The `CheckedNumeric` type implicitly converts from floating point and integer
+data types, and contains overloads for basic arithmetic operations (i.e.: `+`,
+`-`, `*`, `/` for all types and `%`, `<<`, `>>`, `&`, `|`, `^` for integers).
+However, *the [variadic template functions
+](#CheckedNumeric_in-checked_math_h-Non_member-helper-functions)
+are the preferred API,* as they remove type ambiguities and help prevent a number
+of common errors. The variadic functions can also be more performant, as they
+eliminate redundant expressions that are unavoidable with the with the operator
+overloads. (Ideally the compiler should optimize those away, but better to avoid
+them in the first place.)
+
+Type promotions are a slightly modified version of the [standard C/C++ numeric
+promotions
+](http://en.cppreference.com/w/cpp/language/implicit_conversion#Numeric_promotions)
+with the two differences being that *there is no default promotion to int*
+and *bitwise logical operations always return an unsigned of the wider type.*
+
+### Example
+
+```
+#include "src/base/numerics/checked_math.h"
+...
+CheckedNumeric<uint32_t> variable = 0;
+variable++;
+variable--;
+if (variable.ValueOrDie() == 0)
+  // Fine, |variable| still within valid range.
+
+variable--;
+variable++;
+if (variable.ValueOrDie() == 0)  // Breakpoint or configured CheckHandler
+  // Does not happen as variable underflowed.
+```
+
+### Members
+
+The unary negation, increment, and decrement operators are supported, along
+with the following unary arithmetic methods, which return a new
+`CheckedNumeric` as a result of the operation:
+
+*   `Abs()` - Absolute value.
+*   `UnsignedAbs()` - Absolute value as an equal-width unsigned underlying type
+    (valid for only integral types).
+*   `Max()` - Returns whichever is greater of the current instance or argument.
+    The underlying return type is whichever has the greatest magnitude.
+*   `Min()` - Returns whichever is lowest of the current instance or argument.
+    The underlying return type is whichever has can represent the lowest
+    number in the smallest width (e.g. int8_t over unsigned, int over
+    int8_t, and float over int).
+
+The following are for converting `CheckedNumeric` instances:
+
+*   `type` - The underlying numeric type.
+*   `AssignIfValid()` - Assigns the underlying value to the supplied
+    destination pointer if the value is currently valid and within the
+    range supported by the destination type. Returns true on success.
+*   `Cast<>()` - Instance method returning a `CheckedNumeric` derived from
+    casting the current instance to a `CheckedNumeric` of the supplied
+    destination type.
+
+*** aside
+The following member functions return a `StrictNumeric`, which is valid for
+comparison and assignment operations, but will trigger a compile failure on
+attempts to assign to a type of insufficient range. The underlying value can
+be extracted by an explicit `static_cast` to the underlying type or any type
+with sufficient range to represent the underlying type.
+***
+
+*   `IsValid()` - Returns true if the underlying numeric value is valid (i.e.
+    has not wrapped or saturated and is not the result of an invalid
+    conversion).
+*   `ValueOrDie()` - Returns the underlying value. If the state is not valid
+    this call will trigger a crash by default (but may be overridden by
+    supplying an alternate handler to the template).
+*   `ValueOrDefault()` - Returns the current value, or the supplied default if
+    the state is not valid (but will not crash).
+
+**Comparison operators are explicitly not provided** for `CheckedNumeric`
+types because they could result in a crash if the type is not in a valid state.
+Patterns like the following should be used instead:
+
+```cpp
+// Either input or padding (or both) may be arbitrary sizes.
+size_t buff_size;
+if (!CheckAdd(input, padding, kHeaderLength).AssignIfValid(&buff_size) ||
+     buff_size >= kMaxBuffer) {
+  // Handle an error...
+} else {
+  // Do stuff on success...
+}
+```
+
+### Non-member helper functions
+
+The following variadic convenience functions, which accept standard arithmetic
+or `CheckedNumeric` types, perform arithmetic operations, and return a
+`CheckedNumeric` result. The supported functions are:
+
+*   `CheckAdd()` - Addition.
+*   `CheckSub()` - Subtraction.
+*   `CheckMul()` - Multiplication.
+*   `CheckDiv()` - Division.
+*   `CheckMod()` - Modulus (integer only).
+*   `CheckLsh()` - Left integer shift (integer only).
+*   `CheckRsh()` - Right integer shift (integer only).
+*   `CheckAnd()` - Bitwise AND (integer only with unsigned result).
+*   `CheckOr()`  - Bitwise OR (integer only with unsigned result).
+*   `CheckXor()` - Bitwise XOR (integer only with unsigned result).
+*   `CheckMax()` - Maximum of supplied arguments.
+*   `CheckMin()` - Minimum of supplied arguments.
+
+The following wrapper functions can be used to avoid the template
+disambiguator syntax when converting a destination type.
+
+*   `IsValidForType<>()` in place of: `a.template IsValid<>()`
+*   `ValueOrDieForType<>()` in place of: `a.template ValueOrDie<>()`
+*   `ValueOrDefaultForType<>()` in place of: `a.template ValueOrDefault<>()`
+
+The following general utility methods is are useful for converting from
+arithmetic types to `CheckedNumeric` types:
+
+*   `MakeCheckedNum()` - Creates a new `CheckedNumeric` from the underlying type
+    of the supplied arithmetic or directly convertible type.
+
+## ClampedNumeric<> in clamped_math.h
+
+`ClampedNumeric<>` implements all the logic and operators for clamped
+(non-sticky saturating) arithmetic operations and conversions. The
+`ClampedNumeric` type implicitly converts back and forth between floating point
+and integer data types, saturating on assignment as appropriate. It contains
+overloads for basic arithmetic operations (i.e.: `+`, `-`, `*`, `/` for
+all types and `%`, `<<`, `>>`, `&`, `|`, `^` for integers) along with comparison
+operators for arithmetic types of any size. However, *the [variadic template
+functions
+](#ClampedNumeric_in-clamped_math_h-Non_member-helper-functions)
+are the preferred API,* as they remove type ambiguities and help prevent
+a number of common errors. The variadic functions can also be more performant,
+as they eliminate redundant expressions that are unavoidable with the operator
+overloads. (Ideally the compiler should optimize those away, but better to avoid
+them in the first place.)
+
+Type promotions are a slightly modified version of the [standard C/C++ numeric
+promotions
+](http://en.cppreference.com/w/cpp/language/implicit_conversion#Numeric_promotions)
+with the two differences being that *there is no default promotion to int*
+and *bitwise logical operations always return an unsigned of the wider type.*
+
+*** aside
+Most arithmetic operations saturate normally, to the numeric limit in the
+direction of the sign. The potentially unusual cases are:
+
+*   **Division:** Division by zero returns the saturated limit in the direction
+    of sign of the dividend (first argument). The one exception is 0/0, which
+	returns zero (although logically is NaN).
+*   **Modulus:** Division by zero returns the dividend (first argument).
+*   **Left shift:** Non-zero values saturate in the direction of the signed
+    limit (max/min), even for shifts larger than the bit width. 0 shifted any
+    amount results in 0.
+*   **Right shift:** Negative values saturate to -1. Positive or 0 saturates
+    to 0. (Effectively just an unbounded arithmetic-right-shift.)
+*   **Bitwise operations:** No saturation; bit pattern is identical to
+    non-saturated bitwise operations.
+***
+
+### Members
+
+The unary negation, increment, and decrement operators are supported, along
+with the following unary arithmetic methods, which return a new
+`ClampedNumeric` as a result of the operation:
+
+*   `Abs()` - Absolute value.
+*   `UnsignedAbs()` - Absolute value as an equal-width unsigned underlying type
+    (valid for only integral types).
+*   `Max()` - Returns whichever is greater of the current instance or argument.
+    The underlying return type is whichever has the greatest magnitude.
+*   `Min()` - Returns whichever is lowest of the current instance or argument.
+    The underlying return type is whichever has can represent the lowest
+    number in the smallest width (e.g. int8_t over unsigned, int over
+    int8_t, and float over int).
+
+The following are for converting `ClampedNumeric` instances:
+
+*   `type` - The underlying numeric type.
+*   `RawValue()` - Returns the raw value as the underlying arithmetic type. This
+    is useful when e.g. assigning to an auto type or passing as a deduced
+    template parameter.
+*   `Cast<>()` - Instance method returning a `ClampedNumeric` derived from
+    casting the current instance to a `ClampedNumeric` of the supplied
+    destination type.
+
+### Non-member helper functions
+
+The following variadic convenience functions, which accept standard arithmetic
+or `ClampedNumeric` types, perform arithmetic operations, and return a
+`ClampedNumeric` result. The supported functions are:
+
+*   `ClampAdd()` - Addition.
+*   `ClampSub()` - Subtraction.
+*   `ClampMul()` - Multiplication.
+*   `ClampDiv()` - Division.
+*   `ClampMod()` - Modulus (integer only).
+*   `ClampLsh()` - Left integer shift (integer only).
+*   `ClampRsh()` - Right integer shift (integer only).
+*   `ClampAnd()` - Bitwise AND (integer only with unsigned result).
+*   `ClampOr()`  - Bitwise OR (integer only with unsigned result).
+*   `ClampXor()` - Bitwise XOR (integer only with unsigned result).
+*   `ClampMax()` - Maximum of supplied arguments.
+*   `ClampMin()` - Minimum of supplied arguments.
+
+The following is a general utility method that is useful for converting
+to a `ClampedNumeric` type:
+
+*   `MakeClampedNum()` - Creates a new `ClampedNumeric` from the underlying type
+    of the supplied arithmetic or directly convertible type.
diff --git a/deps/v8/src/base/numerics/angle_conversions.h b/deps/v8/src/base/numerics/angle_conversions.h
new file mode 100644
index 00000000000000..7172f25e179566
--- /dev/null
+++ b/deps/v8/src/base/numerics/angle_conversions.h
@@ -0,0 +1,30 @@
+// Copyright 2024 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Slightly adapted for inclusion in V8.
+// Copyright 2025 the V8 project authors. All rights reserved.
+
+#ifndef V8_BASE_NUMERICS_ANGLE_CONVERSIONS_H_
+#define V8_BASE_NUMERICS_ANGLE_CONVERSIONS_H_
+
+#include <concepts>
+#include <numbers>
+
+namespace v8::base {
+
+template <typename T>
+  requires std::floating_point<T>
+constexpr T DegToRad(T deg) {
+  return deg * std::numbers::pi_v<T> / 180;
+}
+
+template <typename T>
+  requires std::floating_point<T>
+constexpr T RadToDeg(T rad) {
+  return rad * 180 / std::numbers::pi_v<T>;
+}
+
+}  // namespace v8::base
+
+#endif  // V8_BASE_NUMERICS_ANGLE_CONVERSIONS_H_
diff --git a/deps/v8/src/base/numerics/basic_ops_impl.h b/deps/v8/src/base/numerics/basic_ops_impl.h
new file mode 100644
index 00000000000000..8df445c6f70824
--- /dev/null
+++ b/deps/v8/src/base/numerics/basic_ops_impl.h
@@ -0,0 +1,162 @@
+// Copyright 2024 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Slightly adapted for inclusion in V8.
+// Copyright 2025 the V8 project authors. All rights reserved.
+
+#ifdef UNSAFE_BUFFERS_BUILD
+// TODO(crbug.com/390223051): Remove C-library calls to fix the errors.
+#pragma allow_unsafe_libc_calls
+#endif
+
+#ifndef V8_BASE_NUMERICS_BASIC_OPS_IMPL_H_
+#define V8_BASE_NUMERICS_BASIC_OPS_IMPL_H_
+
+#include <array>
+#include <cstdint>
+#include <cstdlib>
+#include <cstring>
+#include <span>
+#include <type_traits>
+
+namespace v8::base::internal {
+
+// The correct type to perform math operations on given values of type `T`. This
+// may be a larger type than `T` to avoid promotion to `int` which involves sign
+// conversion!
+template <class T>
+  requires(std::is_integral_v<T>)
+using MathType = std::conditional_t<
+    sizeof(T) >= sizeof(int), T,
+    std::conditional_t<std::is_signed_v<T>, int, unsigned int>>;
+
+// Reverses the byte order of the integer.
+template <class T>
+  requires(std::is_unsigned_v<T> && std::is_integral_v<T>)
+inline constexpr T SwapBytes(T value) {
+  // MSVC intrinsics are not constexpr, so we provide our own constexpr
+  // implementation. We provide it unconditionally so we can test it on all
+  // platforms for correctness.
+  if (std::is_constant_evaluated()) {
+    if constexpr (sizeof(T) == 1u) {
+      return value;
+    } else if constexpr (sizeof(T) == 2u) {
+      MathType<T> a = (MathType<T>(value) >> 0) & MathType<T>{0xff};
+      MathType<T> b = (MathType<T>(value) >> 8) & MathType<T>{0xff};
+      return static_cast<T>((a << 8) | (b << 0));
+    } else if constexpr (sizeof(T) == 4u) {
+      T a = (value >> 0) & T{0xff};
+      T b = (value >> 8) & T{0xff};
+      T c = (value >> 16) & T{0xff};
+      T d = (value >> 24) & T{0xff};
+      return (a << 24) | (b << 16) | (c << 8) | (d << 0);
+    } else {
+      static_assert(sizeof(T) == 8u);
+      T a = (value >> 0) & T{0xff};
+      T b = (value >> 8) & T{0xff};
+      T c = (value >> 16) & T{0xff};
+      T d = (value >> 24) & T{0xff};
+      T e = (value >> 32) & T{0xff};
+      T f = (value >> 40) & T{0xff};
+      T g = (value >> 48) & T{0xff};
+      T h = (value >> 56) & T{0xff};
+      return (a << 56) | (b << 48) | (c << 40) | (d << 32) |  //
+             (e << 24) | (f << 16) | (g << 8) | (h << 0);
+    }
+  }
+
+#if _MSC_VER
+  if constexpr (sizeof(T) == 1u) {
+    return value;
+    // NOLINTNEXTLINE(runtime/int)
+  } else if constexpr (sizeof(T) == sizeof(unsigned short)) {
+    using U = unsigned short;  // NOLINT(runtime/int)
+    return _byteswap_ushort(U{value});
+    // NOLINTNEXTLINE(runtime/int)
+  } else if constexpr (sizeof(T) == sizeof(unsigned long)) {
+    using U = unsigned long;  // NOLINT(runtime/int)
+    return _byteswap_ulong(U{value});
+  } else {
+    static_assert(sizeof(T) == 8u);
+    return _byteswap_uint64(value);
+  }
+#else
+  if constexpr (sizeof(T) == 1u) {
+    return value;
+  } else if constexpr (sizeof(T) == 2u) {
+    return __builtin_bswap16(uint16_t{value});
+  } else if constexpr (sizeof(T) == 4u) {
+    return __builtin_bswap32(value);
+  } else {
+    static_assert(sizeof(T) == 8u);
+    return __builtin_bswap64(value);
+  }
+#endif
+}
+
+// Signed values are byte-swapped as unsigned values.
+template <class T>
+  requires(std::is_signed_v<T> && std::is_integral_v<T>)
+inline constexpr T SwapBytes(T value) {
+  return static_cast<T>(SwapBytes(static_cast<std::make_unsigned_t<T>>(value)));
+}
+
+// Converts from a byte array to an integer.
+template <class T>
+  requires(std::is_unsigned_v<T> && std::is_integral_v<T>)
+inline constexpr T FromLittleEndian(std::span<const uint8_t, sizeof(T)> bytes) {
+  T val;
+  if (std::is_constant_evaluated()) {
+    val = T{0};
+    for (size_t i = 0u; i < sizeof(T); i += 1u) {
+      // SAFETY: `i < sizeof(T)` (the number of bytes in T), so `(8 * i)` is
+      // less than the number of bits in T.
+      val |= MathType<T>(bytes[i]) << (8u * i);
+    }
+  } else {
+    // SAFETY: `bytes` has sizeof(T) bytes, and `val` is of type `T` so has
+    // sizeof(T) bytes, and the two can not alias as `val` is a stack variable.
+    memcpy(&val, bytes.data(), sizeof(T));
+  }
+  return val;
+}
+
+template <class T>
+  requires(std::is_signed_v<T> && std::is_integral_v<T>)
+inline constexpr T FromLittleEndian(std::span<const uint8_t, sizeof(T)> bytes) {
+  return static_cast<T>(FromLittleEndian<std::make_unsigned_t<T>>(bytes));
+}
+
+// Converts to a byte array from an integer.
+template <class T>
+  requires(std::is_unsigned_v<T> && std::is_integral_v<T>)
+inline constexpr std::array<uint8_t, sizeof(T)> ToLittleEndian(T val) {
+  auto bytes = std::array<uint8_t, sizeof(T)>();
+  if (std::is_constant_evaluated()) {
+    for (size_t i = 0u; i < sizeof(T); i += 1u) {
+      const auto last_byte = static_cast<uint8_t>(val & 0xff);
+      // The low bytes go to the front of the array in little endian.
+      bytes[i] = last_byte;
+      // If `val` is one byte, this shift would be UB. But it's also not needed
+      // since the loop will not run again.
+      if constexpr (sizeof(T) > 1u) {
+        val >>= 8u;
+      }
+    }
+  } else {
+    // SAFETY: `bytes` has sizeof(T) bytes, and `val` is of type `T` so has
+    // sizeof(T) bytes, and the two can not alias as `val` is a stack variable.
+    memcpy(bytes.data(), &val, sizeof(T));
+  }
+  return bytes;
+}
+
+template <class T>
+  requires(std::is_signed_v<T> && std::is_integral_v<T>)
+inline constexpr std::array<uint8_t, sizeof(T)> ToLittleEndian(T val) {
+  return ToLittleEndian(static_cast<std::make_unsigned_t<T>>(val));
+}
+}  // namespace v8::base::internal
+
+#endif  // V8_BASE_NUMERICS_BASIC_OPS_IMPL_H_
diff --git a/deps/v8/src/base/numerics/byte_conversions.h b/deps/v8/src/base/numerics/byte_conversions.h
new file mode 100644
index 00000000000000..7f04c6da3c7951
--- /dev/null
+++ b/deps/v8/src/base/numerics/byte_conversions.h
@@ -0,0 +1,716 @@
+// Copyright 2024 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Slightly adapted for inclusion in V8.
+// Copyright 2025 the V8 project authors. All rights reserved.
+
+#ifndef V8_BASE_NUMERICS_BYTE_CONVERSIONS_H_
+#define V8_BASE_NUMERICS_BYTE_CONVERSIONS_H_
+
+#include <array>
+#include <bit>
+#include <cstdint>
+#include <cstring>
+#include <span>
+#include <type_traits>
+
+#include "build/build_config.h"
+#include "src/base/numerics/basic_ops_impl.h"
+
+// Chromium only builds and runs on Little Endian machines.
+static_assert(ARCH_CPU_LITTLE_ENDIAN);
+
+namespace v8::base {
+
+// Returns a value with all bytes in |x| swapped, i.e. reverses the endianness.
+// TODO(pkasting): Once C++23 is available, replace with std::byteswap.
+template <class T>
+  requires(std::is_integral_v<T>)
+inline constexpr T ByteSwap(T value) {
+  return internal::SwapBytes(value);
+}
+
+// Returns a uint8_t with the value in `bytes` interpreted as the native endian
+// encoding of the integer for the machine.
+//
+// This is suitable for decoding integers that were always kept in native
+// encoding, such as when stored in shared-memory (or through IPC) as a byte
+// buffer. Prefer an explicit little endian when storing and reading data from
+// storage, and explicit big endian for network order.
+//
+// Note that since a single byte can have only one ordering, this just copies
+// the byte out of the span. This provides a consistent function for the
+// operation nonetheless.
+inline constexpr uint8_t U8FromNativeEndian(
+    std::span<const uint8_t, 1u> bytes) {
+  return bytes[0];
+}
+// Returns a uint16_t with the value in `bytes` interpreted as the native endian
+// encoding of the integer for the machine.
+//
+// This is suitable for decoding integers that were always kept in native
+// encoding, such as when stored in shared-memory (or through IPC) as a byte
+// buffer. Prefer an explicit little endian when storing and reading data from
+// storage, and explicit big endian for network order.
+inline constexpr uint16_t U16FromNativeEndian(
+    std::span<const uint8_t, 2u> bytes) {
+  return internal::FromLittleEndian<uint16_t>(bytes);
+}
+// Returns a uint32_t with the value in `bytes` interpreted as the native endian
+// encoding of the integer for the machine.
+//
+// This is suitable for decoding integers that were always kept in native
+// encoding, such as when stored in shared-memory (or through IPC) as a byte
+// buffer. Prefer an explicit little endian when storing and reading data from
+// storage, and explicit big endian for network order.
+inline constexpr uint32_t U32FromNativeEndian(
+    std::span<const uint8_t, 4u> bytes) {
+  return internal::FromLittleEndian<uint32_t>(bytes);
+}
+// Returns a uint64_t with the value in `bytes` interpreted as the native endian
+// encoding of the integer for the machine.
+//
+// This is suitable for decoding integers that were always kept in native
+// encoding, such as when stored in shared-memory (or through IPC) as a byte
+// buffer. Prefer an explicit little endian when storing and reading data from
+// storage, and explicit big endian for network order.
+inline constexpr uint64_t U64FromNativeEndian(
+    std::span<const uint8_t, 8u> bytes) {
+  return internal::FromLittleEndian<uint64_t>(bytes);
+}
+// Returns a int8_t with the value in `bytes` interpreted as the native endian
+// encoding of the integer for the machine.
+//
+// This is suitable for decoding integers that were always kept in native
+// encoding, such as when stored in shared-memory (or through IPC) as a byte
+// buffer. Prefer an explicit little endian when storing and reading data from
+// storage, and explicit big endian for network order.
+//
+// Note that since a single byte can have only one ordering, this just copies
+// the byte out of the span. This provides a consistent function for the
+// operation nonetheless.
+inline constexpr int8_t I8FromNativeEndian(std::span<const uint8_t, 1u> bytes) {
+  return static_cast<int8_t>(bytes[0]);
+}
+// Returns a int16_t with the value in `bytes` interpreted as the native endian
+// encoding of the integer for the machine.
+//
+// This is suitable for decoding integers that were always kept in native
+// encoding, such as when stored in shared-memory (or through IPC) as a byte
+// buffer. Prefer an explicit little endian when storing and reading data from
+// storage, and explicit big endian for network order.
+inline constexpr int16_t I16FromNativeEndian(
+    std::span<const uint8_t, 2u> bytes) {
+  return internal::FromLittleEndian<int16_t>(bytes);
+}
+// Returns a int32_t with the value in `bytes` interpreted as the native endian
+// encoding of the integer for the machine.
+//
+// This is suitable for decoding integers that were always kept in native
+// encoding, such as when stored in shared-memory (or through IPC) as a byte
+// buffer. Prefer an explicit little endian when storing and reading data from
+// storage, and explicit big endian for network order.
+inline constexpr int32_t I32FromNativeEndian(
+    std::span<const uint8_t, 4u> bytes) {
+  return internal::FromLittleEndian<int32_t>(bytes);
+}
+// Returns a int64_t with the value in `bytes` interpreted as the native endian
+// encoding of the integer for the machine.
+//
+// This is suitable for decoding integers that were always kept in native
+// encoding, such as when stored in shared-memory (or through IPC) as a byte
+// buffer. Prefer an explicit little endian when storing and reading data from
+// storage, and explicit big endian for network order.
+inline constexpr int64_t I64FromNativeEndian(
+    std::span<const uint8_t, 8u> bytes) {
+  return internal::FromLittleEndian<int64_t>(bytes);
+}
+
+// Returns a float with the value in `bytes` interpreted as the native endian
+// encoding of the number for the machine.
+//
+// This is suitable for decoding numbers that were always kept in native
+// encoding, such as when stored in shared-memory (or through IPC) as a byte
+// buffer. Prefer an explicit little endian when storing and reading data from
+// storage, and explicit big endian for network order.
+inline constexpr float FloatFromNativeEndian(
+    std::span<const uint8_t, 4u> bytes) {
+  return std::bit_cast<float>(U32FromNativeEndian(bytes));
+}
+// Returns a double with the value in `bytes` interpreted as the native endian
+// encoding of the number for the machine.
+//
+// This is suitable for decoding numbers that were always kept in native
+// encoding, such as when stored in shared-memory (or through IPC) as a byte
+// buffer. Prefer an explicit little endian when storing and reading data from
+// storage, and explicit big endian for network order.
+inline constexpr double DoubleFromNativeEndian(
+    std::span<const uint8_t, 8u> bytes) {
+  return std::bit_cast<double>(U64FromNativeEndian(bytes));
+}
+
+// Returns a uint8_t with the value in `bytes` interpreted as a little-endian
+// encoding of the integer.
+//
+// This is suitable for decoding integers encoded explicitly in little endian,
+// which is a good practice with storing and reading data from storage. Use
+// the native-endian versions when working with values that were always in
+// memory, such as when stored in shared-memory (or through IPC) as a byte
+// buffer.
+//
+// Note that since a single byte can have only one ordering, this just copies
+// the byte out of the span. This provides a consistent function for the
+// operation nonetheless.
+inline constexpr uint8_t U8FromLittleEndian(
+    std::span<const uint8_t, 1u> bytes) {
+  return bytes[0];
+}
+// Returns a uint16_t with the value in `bytes` interpreted as a little-endian
+// encoding of the integer.
+//
+// This is suitable for decoding integers encoded explicitly in little endian,
+// which is a good practice with storing and reading data from storage. Use
+// the native-endian versions when working with values that were always in
+// memory, such as when stored in shared-memory (or through IPC) as a byte
+// buffer.
+inline constexpr uint16_t U16FromLittleEndian(
+    std::span<const uint8_t, 2u> bytes) {
+  return internal::FromLittleEndian<uint16_t>(bytes);
+}
+// Returns a uint32_t with the value in `bytes` interpreted as a little-endian
+// encoding of the integer.
+//
+// This is suitable for decoding integers encoded explicitly in little endian,
+// which is a good practice with storing and reading data from storage. Use
+// the native-endian versions when working with values that were always in
+// memory, such as when stored in shared-memory (or through IPC) as a byte
+// buffer.
+inline constexpr uint32_t U32FromLittleEndian(
+    std::span<const uint8_t, 4u> bytes) {
+  return internal::FromLittleEndian<uint32_t>(bytes);
+}
+// Returns a uint64_t with the value in `bytes` interpreted as a little-endian
+// encoding of the integer.
+//
+// This is suitable for decoding integers encoded explicitly in little endian,
+// which is a good practice with storing and reading data from storage. Use
+// the native-endian versions when working with values that were always in
+// memory, such as when stored in shared-memory (or through IPC) as a byte
+// buffer.
+inline constexpr uint64_t U64FromLittleEndian(
+    std::span<const uint8_t, 8u> bytes) {
+  return internal::FromLittleEndian<uint64_t>(bytes);
+}
+// Returns a int8_t with the value in `bytes` interpreted as a little-endian
+// encoding of the integer.
+//
+// This is suitable for decoding integers encoded explicitly in little endian,
+// which is a good practice with storing and reading data from storage. Use
+// the native-endian versions when working with values that were always in
+// memory, such as when stored in shared-memory (or through IPC) as a byte
+// buffer.
+//
+// Note that since a single byte can have only one ordering, this just copies
+// the byte out of the span. This provides a consistent function for the
+// operation nonetheless.
+inline constexpr int8_t I8FromLittleEndian(std::span<const uint8_t, 1u> bytes) {
+  return static_cast<int8_t>(bytes[0]);
+}
+// Returns a int16_t with the value in `bytes` interpreted as a little-endian
+// encoding of the integer.
+//
+// This is suitable for decoding integers encoded explicitly in little endian,
+// which is a good practice with storing and reading data from storage. Use
+// the native-endian versions when working with values that were always in
+// memory, such as when stored in shared-memory (or through IPC) as a byte
+// buffer.
+inline constexpr int16_t I16FromLittleEndian(
+    std::span<const uint8_t, 2u> bytes) {
+  return internal::FromLittleEndian<int16_t>(bytes);
+}
+// Returns a int32_t with the value in `bytes` interpreted as a little-endian
+// encoding of the integer.
+//
+// This is suitable for decoding integers encoded explicitly in little endian,
+// which is a good practice with storing and reading data from storage. Use
+// the native-endian versions when working with values that were always in
+// memory, such as when stored in shared-memory (or through IPC) as a byte
+// buffer.
+inline constexpr int32_t I32FromLittleEndian(
+    std::span<const uint8_t, 4u> bytes) {
+  return internal::FromLittleEndian<int32_t>(bytes);
+}
+// Returns a int64_t with the value in `bytes` interpreted as a little-endian
+// encoding of the integer.
+//
+// This is suitable for decoding integers encoded explicitly in little endian,
+// which is a good practice with storing and reading data from storage. Use
+// the native-endian versions when working with values that were always in
+// memory, such as when stored in shared-memory (or through IPC) as a byte
+// buffer.
+inline constexpr int64_t I64FromLittleEndian(
+    std::span<const uint8_t, 8u> bytes) {
+  return internal::FromLittleEndian<int64_t>(bytes);
+}
+// Returns a float with the value in `bytes` interpreted as a little-endian
+// encoding of the integer.
+//
+// This is suitable for decoding numbers encoded explicitly in little endian,
+// which is a good practice with storing and reading data from storage. Use
+// the native-endian versions when working with values that were always in
+// memory, such as when stored in shared-memory (or through IPC) as a byte
+// buffer.
+inline constexpr float FloatFromLittleEndian(
+    std::span<const uint8_t, 4u> bytes) {
+  return std::bit_cast<float>(U32FromLittleEndian(bytes));
+}
+// Returns a double with the value in `bytes` interpreted as a little-endian
+// encoding of the integer.
+//
+// This is suitable for decoding numbers encoded explicitly in little endian,
+// which is a good practice with storing and reading data from storage. Use
+// the native-endian versions when working with values that were always in
+// memory, such as when stored in shared-memory (or through IPC) as a byte
+// buffer.
+inline constexpr double DoubleFromLittleEndian(
+    std::span<const uint8_t, 8u> bytes) {
+  return std::bit_cast<double>(U64FromLittleEndian(bytes));
+}
+
+// Returns a uint8_t with the value in `bytes` interpreted as a big-endian
+// encoding of the integer.
+//
+// This is suitable for decoding integers encoded explicitly in big endian, such
+// as for network order. Use the native-endian versions when working with values
+// that were always in memory, such as when stored in shared-memory (or through
+// IPC) as a byte buffer.
+//
+// Note that since a single byte can have only one ordering, this just copies
+// the byte out of the span. This provides a consistent function for the
+// operation nonetheless.
+inline constexpr uint8_t U8FromBigEndian(std::span<const uint8_t, 1u> bytes) {
+  return bytes[0];
+}
+// Returns a uint16_t with the value in `bytes` interpreted as a big-endian
+// encoding of the integer.
+//
+// This is suitable for decoding integers encoded explicitly in big endian, such
+// as for network order. Use the native-endian versions when working with values
+// that were always in memory, such as when stored in shared-memory (or through
+// IPC) as a byte buffer.
+inline constexpr uint16_t U16FromBigEndian(std::span<const uint8_t, 2u> bytes) {
+  return ByteSwap(internal::FromLittleEndian<uint16_t>(bytes));
+}
+// Returns a uint32_t with the value in `bytes` interpreted as a big-endian
+// encoding of the integer.
+//
+// This is suitable for decoding integers encoded explicitly in big endian, such
+// as for network order. Use the native-endian versions when working with values
+// that were always in memory, such as when stored in shared-memory (or through
+// IPC) as a byte buffer.
+inline constexpr uint32_t U32FromBigEndian(std::span<const uint8_t, 4u> bytes) {
+  return ByteSwap(internal::FromLittleEndian<uint32_t>(bytes));
+}
+// Returns a uint64_t with the value in `bytes` interpreted as a big-endian
+// encoding of the integer.
+//
+// This is suitable for decoding integers encoded explicitly in big endian, such
+// as for network order. Use the native-endian versions when working with values
+// that were always in memory, such as when stored in shared-memory (or through
+// IPC) as a byte buffer.
+inline constexpr uint64_t U64FromBigEndian(std::span<const uint8_t, 8u> bytes) {
+  return ByteSwap(internal::FromLittleEndian<uint64_t>(bytes));
+}
+// Returns a int8_t with the value in `bytes` interpreted as a big-endian
+// encoding of the integer.
+//
+// This is suitable for decoding integers encoded explicitly in big endian, such
+// as for network order. Use the native-endian versions when working with values
+// that were always in memory, such as when stored in shared-memory (or through
+// IPC) as a byte buffer.
+//
+// Note that since a single byte can have only one ordering, this just copies
+// the byte out of the span. This provides a consistent function for the
+// operation nonetheless.
+inline constexpr int8_t I8FromBigEndian(std::span<const uint8_t, 1u> bytes) {
+  return static_cast<int8_t>(bytes[0]);
+}
+// Returns a int16_t with the value in `bytes` interpreted as a big-endian
+// encoding of the integer.
+//
+// This is suitable for decoding integers encoded explicitly in big endian, such
+// as for network order. Use the native-endian versions when working with values
+// that were always in memory, such as when stored in shared-memory (or through
+// IPC) as a byte buffer.
+inline constexpr int16_t I16FromBigEndian(std::span<const uint8_t, 2u> bytes) {
+  return ByteSwap(internal::FromLittleEndian<int16_t>(bytes));
+}
+// Returns a int32_t with the value in `bytes` interpreted as a big-endian
+// encoding of the integer.
+//
+// This is suitable for decoding integers encoded explicitly in big endian, such
+// as for network order. Use the native-endian versions when working with values
+// that were always in memory, such as when stored in shared-memory (or through
+// IPC) as a byte buffer.
+inline constexpr int32_t I32FromBigEndian(std::span<const uint8_t, 4u> bytes) {
+  return ByteSwap(internal::FromLittleEndian<int32_t>(bytes));
+}
+// Returns a int64_t with the value in `bytes` interpreted as a big-endian
+// encoding of the integer.
+//
+// This is suitable for decoding integers encoded explicitly in big endian, such
+// as for network order. Use the native-endian versions when working with values
+// that were always in memory, such as when stored in shared-memory (or through
+// IPC) as a byte buffer.
+inline constexpr int64_t I64FromBigEndian(std::span<const uint8_t, 8u> bytes) {
+  return ByteSwap(internal::FromLittleEndian<int64_t>(bytes));
+}
+// Returns a float with the value in `bytes` interpreted as a big-endian
+// encoding of the integer.
+//
+// This is suitable for decoding numbers encoded explicitly in big endian, such
+// as for network order. Use the native-endian versions when working with values
+// that were always in memory, such as when stored in shared-memory (or through
+// IPC) as a byte buffer.
+inline constexpr float FloatFromBigEndian(std::span<const uint8_t, 4u> bytes) {
+  return std::bit_cast<float>(U32FromBigEndian(bytes));
+}
+// Returns a double with the value in `bytes` interpreted as a big-endian
+// encoding of the integer.
+//
+// This is suitable for decoding numbers encoded explicitly in big endian, such
+// as for network order. Use the native-endian versions when working with values
+// that were always in memory, such as when stored in shared-memory (or through
+// IPC) as a byte buffer.
+inline constexpr double DoubleFromBigEndian(
+    std::span<const uint8_t, 8u> bytes) {
+  return std::bit_cast<double>(U64FromBigEndian(bytes));
+}
+
+// Returns a byte array holding the value of a uint8_t encoded as the native
+// endian encoding of the integer for the machine.
+//
+// This is suitable for encoding integers that will always be kept in native
+// encoding, such as for storing in shared-memory (or sending through IPC) as a
+// byte buffer. Prefer an explicit little endian when storing data into external
+// storage, and explicit big endian for network order.
+inline constexpr std::array<uint8_t, 1u> U8ToNativeEndian(uint8_t val) {
+  return {val};
+}
+// Returns a byte array holding the value of a uint16_t encoded as the native
+// endian encoding of the integer for the machine.
+//
+// This is suitable for encoding integers that will always be kept in native
+// encoding, such as for storing in shared-memory (or sending through IPC) as a
+// byte buffer. Prefer an explicit little endian when storing data into external
+// storage, and explicit big endian for network order.
+inline constexpr std::array<uint8_t, 2u> U16ToNativeEndian(uint16_t val) {
+  return internal::ToLittleEndian(val);
+}
+// Returns a byte array holding the value of a uint32_t encoded as the native
+// endian encoding of the integer for the machine.
+//
+// This is suitable for encoding integers that will always be kept in native
+// encoding, such as for storing in shared-memory (or sending through IPC) as a
+// byte buffer. Prefer an explicit little endian when storing data into external
+// storage, and explicit big endian for network order.
+inline constexpr std::array<uint8_t, 4u> U32ToNativeEndian(uint32_t val) {
+  return internal::ToLittleEndian(val);
+}
+// Returns a byte array holding the value of a uint64_t encoded as the native
+// endian encoding of the integer for the machine.
+//
+// This is suitable for encoding integers that will always be kept in native
+// encoding, such as for storing in shared-memory (or sending through IPC) as a
+// byte buffer. Prefer an explicit little endian when storing data into external
+// storage, and explicit big endian for network order.
+inline constexpr std::array<uint8_t, 8u> U64ToNativeEndian(uint64_t val) {
+  return internal::ToLittleEndian(val);
+}
+// Returns a byte array holding the value of a int8_t encoded as the native
+// endian encoding of the integer for the machine.
+//
+// This is suitable for encoding integers that will always be kept in native
+// encoding, such as for storing in shared-memory (or sending through IPC) as a
+// byte buffer. Prefer an explicit little endian when storing data into external
+// storage, and explicit big endian for network order.
+inline constexpr std::array<uint8_t, 1u> I8ToNativeEndian(int8_t val) {
+  return {static_cast<uint8_t>(val)};
+}
+// Returns a byte array holding the value of a int16_t encoded as the native
+// endian encoding of the integer for the machine.
+//
+// This is suitable for encoding integers that will always be kept in native
+// encoding, such as for storing in shared-memory (or sending through IPC) as a
+// byte buffer. Prefer an explicit little endian when storing data into external
+// storage, and explicit big endian for network order.
+inline constexpr std::array<uint8_t, 2u> I16ToNativeEndian(int16_t val) {
+  return internal::ToLittleEndian(val);
+}
+// Returns a byte array holding the value of a int32_t encoded as the native
+// endian encoding of the integer for the machine.
+//
+// This is suitable for encoding integers that will always be kept in native
+// encoding, such as for storing in shared-memory (or sending through IPC) as a
+// byte buffer. Prefer an explicit little endian when storing data into external
+// storage, and explicit big endian for network order.
+inline constexpr std::array<uint8_t, 4u> I32ToNativeEndian(int32_t val) {
+  return internal::ToLittleEndian(val);
+}
+// Returns a byte array holding the value of a int64_t encoded as the native
+// endian encoding of the integer for the machine.
+//
+// This is suitable for encoding integers that will always be kept in native
+// encoding, such as for storing in shared-memory (or sending through IPC) as a
+// byte buffer. Prefer an explicit little endian when storing data into external
+// storage, and explicit big endian for network order.
+inline constexpr std::array<uint8_t, 8u> I64ToNativeEndian(int64_t val) {
+  return internal::ToLittleEndian(val);
+}
+// Returns a byte array holding the value of a float encoded as the native
+// endian encoding of the number for the machine.
+//
+// This is suitable for encoding numbers that will always be kept in native
+// encoding, such as for storing in shared-memory (or sending through IPC) as a
+// byte buffer. Prefer an explicit little endian when storing data into external
+// storage, and explicit big endian for network order.
+inline constexpr std::array<uint8_t, 4u> FloatToNativeEndian(float val) {
+  return U32ToNativeEndian(std::bit_cast<uint32_t>(val));
+}
+// Returns a byte array holding the value of a double encoded as the native
+// endian encoding of the number for the machine.
+//
+// This is suitable for encoding numbers that will always be kept in native
+// encoding, such as for storing in shared-memory (or sending through IPC) as a
+// byte buffer. Prefer an explicit little endian when storing data into external
+// storage, and explicit big endian for network order.
+inline constexpr std::array<uint8_t, 8u> DoubleToNativeEndian(double val) {
+  return U64ToNativeEndian(std::bit_cast<uint64_t>(val));
+}
+
+// Returns a byte array holding the value of a uint8_t encoded as the
+// little-endian encoding of the integer.
+//
+// This is suitable for encoding integers explicitly in little endian, which is
+// a good practice with storing and reading data from storage. Use the
+// native-endian versions when working with values that will always be in
+// memory, such as when stored in shared-memory (or passed through IPC) as a
+// byte buffer.
+inline constexpr std::array<uint8_t, 1u> U8ToLittleEndian(uint8_t val) {
+  return {val};
+}
+// Returns a byte array holding the value of a uint16_t encoded as the
+// little-endian encoding of the integer.
+//
+// This is suitable for encoding integers explicitly in little endian, which is
+// a good practice with storing and reading data from storage. Use the
+// native-endian versions when working with values that will always be in
+// memory, such as when stored in shared-memory (or passed through IPC) as a
+// byte buffer.
+inline constexpr std::array<uint8_t, 2u> U16ToLittleEndian(uint16_t val) {
+  return internal::ToLittleEndian(val);
+}
+// Returns a byte array holding the value of a uint32_t encoded as the
+// little-endian encoding of the integer.
+//
+// This is suitable for encoding integers explicitly in little endian, which is
+// a good practice with storing and reading data from storage. Use the
+// native-endian versions when working with values that will always be in
+// memory, such as when stored in shared-memory (or passed through IPC) as a
+// byte buffer.
+inline constexpr std::array<uint8_t, 4u> U32ToLittleEndian(uint32_t val) {
+  return internal::ToLittleEndian(val);
+}
+// Returns a byte array holding the value of a uint64_t encoded as the
+// little-endian encoding of the integer.
+//
+// This is suitable for encoding integers explicitly in little endian, which is
+// a good practice with storing and reading data from storage. Use the
+// native-endian versions when working with values that will always be in
+// memory, such as when stored in shared-memory (or passed through IPC) as a
+// byte buffer.
+inline constexpr std::array<uint8_t, 8u> U64ToLittleEndian(uint64_t val) {
+  return internal::ToLittleEndian(val);
+}
+// Returns a byte array holding the value of a int8_t encoded as the
+// little-endian encoding of the integer.
+//
+// This is suitable for encoding integers explicitly in little endian, which is
+// a good practice with storing and reading data from storage. Use the
+// native-endian versions when working with values that will always be in
+// memory, such as when stored in shared-memory (or passed through IPC) as a
+// byte buffer.
+inline constexpr std::array<uint8_t, 1u> I8ToLittleEndian(int8_t val) {
+  return {static_cast<uint8_t>(val)};
+}
+// Returns a byte array holding the value of a int16_t encoded as the
+// little-endian encoding of the integer.
+//
+// This is suitable for encoding integers explicitly in little endian, which is
+// a good practice with storing and reading data from storage. Use the
+// native-endian versions when working with values that will always be in
+// memory, such as when stored in shared-memory (or passed through IPC) as a
+// byte buffer.
+inline constexpr std::array<uint8_t, 2u> I16ToLittleEndian(int16_t val) {
+  return internal::ToLittleEndian(val);
+}
+// Returns a byte array holding the value of a int32_t encoded as the
+// little-endian encoding of the integer.
+//
+// This is suitable for encoding integers explicitly in little endian, which is
+// a good practice with storing and reading data from storage. Use the
+// native-endian versions when working with values that will always be in
+// memory, such as when stored in shared-memory (or passed through IPC) as a
+// byte buffer.
+inline constexpr std::array<uint8_t, 4u> I32ToLittleEndian(int32_t val) {
+  return internal::ToLittleEndian(val);
+}
+// Returns a byte array holding the value of a int64_t encoded as the
+// little-endian encoding of the integer.
+//
+// This is suitable for encoding integers explicitly in little endian, which is
+// a good practice with storing and reading data from storage. Use the
+// native-endian versions when working with values that will always be in
+// memory, such as when stored in shared-memory (or passed through IPC) as a
+// byte buffer.
+inline constexpr std::array<uint8_t, 8u> I64ToLittleEndian(int64_t val) {
+  return internal::ToLittleEndian(val);
+}
+// Returns a byte array holding the value of a float encoded as the
+// little-endian encoding of the number.
+//
+// This is suitable for encoding numbers explicitly in little endian, which is
+// a good practice with storing and reading data from storage. Use the
+// native-endian versions when working with values that will always be in
+// memory, such as when stored in shared-memory (or passed through IPC) as a
+// byte buffer.
+inline constexpr std::array<uint8_t, 4u> FloatToLittleEndian(float val) {
+  return internal::ToLittleEndian(std::bit_cast<uint32_t>(val));
+}
+// Returns a byte array holding the value of a double encoded as the
+// little-endian encoding of the number.
+//
+// This is suitable for encoding numbers explicitly in little endian, which is
+// a good practice with storing and reading data from storage. Use the
+// native-endian versions when working with values that will always be in
+// memory, such as when stored in shared-memory (or passed through IPC) as a
+// byte buffer.
+inline constexpr std::array<uint8_t, 8u> DoubleToLittleEndian(double val) {
+  return internal::ToLittleEndian(std::bit_cast<uint64_t>(val));
+}
+
+// Returns a byte array holding the value of a uint8_t encoded as the big-endian
+// encoding of the integer.
+//
+// This is suitable for encoding integers explicitly in big endian, such as for
+// network order. Use the native-endian versions when working with values that
+// are always in memory, such as when stored in shared-memory (or passed through
+// IPC) as a byte buffer. Use the little-endian encoding for storing and reading
+// from storage.
+inline constexpr std::array<uint8_t, 1u> U8ToBigEndian(uint8_t val) {
+  return {val};
+}
+// Returns a byte array holding the value of a uint16_t encoded as the
+// big-endian encoding of the integer.
+//
+// This is suitable for encoding integers explicitly in big endian, such as for
+// network order. Use the native-endian versions when working with values that
+// are always in memory, such as when stored in shared-memory (or passed through
+// IPC) as a byte buffer. Use the little-endian encoding for storing and reading
+// from storage.
+inline constexpr std::array<uint8_t, 2u> U16ToBigEndian(uint16_t val) {
+  return internal::ToLittleEndian(ByteSwap(val));
+}
+// Returns a byte array holding the value of a uint32_t encoded as the
+// big-endian encoding of the integer.
+//
+// This is suitable for encoding integers explicitly in big endian, such as for
+// network order. Use the native-endian versions when working with values that
+// are always in memory, such as when stored in shared-memory (or passed through
+// IPC) as a byte buffer. Use the little-endian encoding for storing and reading
+// from storage.
+inline constexpr std::array<uint8_t, 4u> U32ToBigEndian(uint32_t val) {
+  return internal::ToLittleEndian(ByteSwap(val));
+}
+// Returns a byte array holding the value of a uint64_t encoded as the
+// big-endian encoding of the integer.
+//
+// This is suitable for encoding integers explicitly in big endian, such as for
+// network order. Use the native-endian versions when working with values that
+// are always in memory, such as when stored in shared-memory (or passed through
+// IPC) as a byte buffer. Use the little-endian encoding for storing and reading
+// from storage.
+inline constexpr std::array<uint8_t, 8u> U64ToBigEndian(uint64_t val) {
+  return internal::ToLittleEndian(ByteSwap(val));
+}
+// Returns a byte array holding the value of a int8_t encoded as the big-endian
+// encoding of the integer.
+//
+// This is suitable for encoding integers explicitly in big endian, such as for
+// network order. Use the native-endian versions when working with values that
+// are always in memory, such as when stored in shared-memory (or passed through
+// IPC) as a byte buffer. Use the little-endian encoding for storing and reading
+// from storage.
+inline constexpr std::array<uint8_t, 1u> I8ToBigEndian(int8_t val) {
+  return {static_cast<uint8_t>(val)};
+}
+// Returns a byte array holding the value of a int16_t encoded as the
+// big-endian encoding of the integer.
+//
+// This is suitable for encoding integers explicitly in big endian, such as for
+// network order. Use the native-endian versions when working with values that
+// are always in memory, such as when stored in shared-memory (or passed through
+// IPC) as a byte buffer. Use the little-endian encoding for storing and reading
+// from storage.
+inline constexpr std::array<uint8_t, 2u> I16ToBigEndian(int16_t val) {
+  return internal::ToLittleEndian(ByteSwap(val));
+}
+// Returns a byte array holding the value of a int32_t encoded as the
+// big-endian encoding of the integer.
+//
+// This is suitable for encoding integers explicitly in big endian, such as for
+// network order. Use the native-endian versions when working with values that
+// are always in memory, such as when stored in shared-memory (or passed through
+// IPC) as a byte buffer. Use the little-endian encoding for storing and reading
+// from storage.
+inline constexpr std::array<uint8_t, 4u> I32ToBigEndian(int32_t val) {
+  return internal::ToLittleEndian(ByteSwap(val));
+}
+// Returns a byte array holding the value of a int64_t encoded as the
+// big-endian encoding of the integer.
+//
+// This is suitable for encoding integers explicitly in big endian, such as for
+// network order. Use the native-endian versions when working with values that
+// are always in memory, such as when stored in shared-memory (or passed through
+// IPC) as a byte buffer. Use the little-endian encoding for storing and reading
+// from storage.
+inline constexpr std::array<uint8_t, 8u> I64ToBigEndian(int64_t val) {
+  return internal::ToLittleEndian(ByteSwap(val));
+}
+// Returns a byte array holding the value of a float encoded as the big-endian
+// encoding of the number.
+//
+// This is suitable for encoding numbers explicitly in big endian, such as for
+// network order. Use the native-endian versions when working with values that
+// are always in memory, such as when stored in shared-memory (or passed through
+// IPC) as a byte buffer. Use the little-endian encoding for storing and reading
+// from storage.
+inline constexpr std::array<uint8_t, 4u> FloatToBigEndian(float val) {
+  return internal::ToLittleEndian(ByteSwap(std::bit_cast<uint32_t>(val)));
+}
+// Returns a byte array holding the value of a double encoded as the big-endian
+// encoding of the number.
+//
+// This is suitable for encoding numbers explicitly in big endian, such as for
+// network order. Use the native-endian versions when working with values that
+// are always in memory, such as when stored in shared-memory (or passed through
+// IPC) as a byte buffer. Use the little-endian encoding for storing and reading
+// from storage.
+inline constexpr std::array<uint8_t, 8u> DoubleToBigEndian(double val) {
+  return internal::ToLittleEndian(ByteSwap(std::bit_cast<uint64_t>(val)));
+}
+
+}  // namespace v8::base
+
+#endif  // V8_BASE_NUMERICS_BYTE_CONVERSIONS_H_
diff --git a/deps/v8/src/base/numerics/byte_conversions_unittest.cc b/deps/v8/src/base/numerics/byte_conversions_unittest.cc
new file mode 100644
index 00000000000000..85798d9fc668a8
--- /dev/null
+++ b/deps/v8/src/base/numerics/byte_conversions_unittest.cc
@@ -0,0 +1,553 @@
+// Copyright 2024 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Slightly adapted for inclusion in V8.
+// Copyright 2025 the V8 project authors. All rights reserved.
+
+#include "src/base/numerics/byte_conversions.h"
+
+#include <array>
+#include <bit>
+#include <concepts>
+#include <cstdint>
+
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace v8::base::numerics {
+
+TEST(NumericsTest, FromNativeEndian) {
+  // The implementation of FromNativeEndian and FromLittleEndian assumes the
+  // native endian is little. If support of big endian is desired, compile-time
+  // branches will need to be added to the implementation, and the test results
+  // will differ there (they would match FromBigEndian in this test).
+  static_assert(std::endian::native == std::endian::little);
+  {
+    constexpr uint8_t bytes[] = {0x12u};
+    EXPECT_EQ(U8FromNativeEndian(bytes), 0x12u);
+    static_assert(std::same_as<uint8_t, decltype(U8FromNativeEndian(bytes))>);
+    static_assert(U8FromNativeEndian(bytes) == 0x12u);
+  }
+  {
+    constexpr uint8_t bytes[] = {0x12u, 0x34u};
+    EXPECT_EQ(U16FromNativeEndian(bytes), 0x34'12u);
+    static_assert(std::same_as<uint16_t, decltype(U16FromNativeEndian(bytes))>);
+    static_assert(U16FromNativeEndian(bytes) == 0x34'12u);
+  }
+  {
+    constexpr uint8_t bytes[] = {0x12u, 0x34u, 0x56u, 0x78u};
+    EXPECT_EQ(U32FromNativeEndian(bytes), 0x78'56'34'12u);
+    static_assert(std::same_as<uint32_t, decltype(U32FromNativeEndian(bytes))>);
+    static_assert(U32FromNativeEndian(bytes) == 0x78'56'34'12u);
+  }
+  {
+    constexpr uint8_t bytes[] = {0x12u, 0x34u, 0x56u, 0x78u,
+                                 0x90u, 0x12u, 0x34u, 0x56u};
+    EXPECT_EQ(U64FromNativeEndian(bytes), 0x56'34'12'90'78'56'34'12u);
+    static_assert(std::same_as<uint64_t, decltype(U64FromNativeEndian(bytes))>);
+    static_assert(U64FromNativeEndian(bytes) == 0x56'34'12'90'78'56'34'12u);
+  }
+
+  {
+    constexpr uint8_t bytes[] = {0x12u};
+    EXPECT_EQ(I8FromNativeEndian(bytes), 0x12);
+    static_assert(std::same_as<int8_t, decltype(I8FromNativeEndian(bytes))>);
+    static_assert(U8FromNativeEndian(bytes) == 0x12);
+  }
+  {
+    constexpr uint8_t bytes[] = {0x12u, 0x34u};
+    EXPECT_EQ(I16FromNativeEndian(bytes), 0x34'12);
+    static_assert(std::same_as<int16_t, decltype(I16FromNativeEndian(bytes))>);
+    static_assert(U16FromNativeEndian(bytes) == 0x34'12);
+  }
+  {
+    constexpr uint8_t bytes[] = {0x12u, 0x34u, 0x56u, 0x78u};
+    EXPECT_EQ(I32FromNativeEndian(bytes), 0x78'56'34'12);
+    static_assert(std::same_as<int32_t, decltype(I32FromNativeEndian(bytes))>);
+    static_assert(U32FromNativeEndian(bytes) == 0x78'56'34'12);
+  }
+  {
+    constexpr uint8_t bytes[] = {0x12u, 0x34u, 0x56u, 0x78u,
+                                 0x90u, 0x12u, 0x34u, 0x56u};
+    EXPECT_EQ(I64FromNativeEndian(bytes), 0x56'34'12'90'78'56'34'12);
+    static_assert(std::same_as<int64_t, decltype(I64FromNativeEndian(bytes))>);
+    static_assert(I64FromNativeEndian(bytes) == 0x56'34'12'90'78'56'34'12);
+  }
+
+  {
+    constexpr uint8_t bytes[] = {0x12u, 0x34u, 0x56u, 0x78u};
+    EXPECT_EQ(FloatFromNativeEndian(bytes), 1.73782443614e+34f);
+    EXPECT_EQ(std::bit_cast<uint32_t>(FloatFromNativeEndian(bytes)),
+              0x78'56'34'12u);
+    static_assert(std::same_as<float, decltype(FloatFromNativeEndian(bytes))>);
+    static_assert(FloatFromNativeEndian(bytes) == 1.73782443614e+34f);
+    static_assert(std::bit_cast<uint32_t>(FloatFromNativeEndian(bytes)) ==
+                  0x78'56'34'12u);
+  }
+
+  {
+    constexpr uint8_t bytes[] = {0x12u, 0x34u, 0x56u, 0x78u,
+                                 0x90u, 0x12u, 0x34u, 0x56u};
+    EXPECT_EQ(DoubleFromNativeEndian(bytes),
+              1.84145159269283616391989849435e107);
+    EXPECT_EQ(std::bit_cast<uint64_t>(DoubleFromNativeEndian(bytes)),
+              0x56'34'12'90'78'56'34'12u);
+    static_assert(
+        std::same_as<double, decltype(DoubleFromNativeEndian(bytes))>);
+    static_assert(DoubleFromNativeEndian(bytes) ==
+                  1.84145159269283616391989849435e107);
+    static_assert(std::bit_cast<uint64_t>(DoubleFromNativeEndian(bytes)) ==
+                  0x56'34'12'90'78'56'34'12u);
+  }
+}
+
+TEST(NumericsTest, FromLittleEndian) {
+  // The implementation of FromNativeEndian and FromLittleEndian assumes the
+  // native endian is little. If support of big endian is desired, compile-time
+  // branches will need to be added to the implementation, and the test results
+  // will differ there (they would match FromBigEndian in this test).
+  static_assert(std::endian::native == std::endian::little);
+  {
+    constexpr uint8_t bytes[] = {0x12u};
+    EXPECT_EQ(U8FromLittleEndian(bytes), 0x12u);
+    static_assert(std::same_as<uint8_t, decltype(U8FromLittleEndian(bytes))>);
+    static_assert(U8FromLittleEndian(bytes) == 0x12u);
+  }
+  {
+    constexpr uint8_t bytes[] = {0x12u, 0x34u};
+    EXPECT_EQ(U16FromLittleEndian(bytes), 0x34'12u);
+    static_assert(std::same_as<uint16_t, decltype(U16FromLittleEndian(bytes))>);
+    static_assert(U16FromLittleEndian(bytes) == 0x34'12u);
+  }
+  {
+    constexpr uint8_t bytes[] = {0x12u, 0x34u, 0x56u, 0x78u};
+    EXPECT_EQ(U32FromLittleEndian(bytes), 0x78'56'34'12u);
+    static_assert(std::same_as<uint32_t, decltype(U32FromLittleEndian(bytes))>);
+    static_assert(U32FromLittleEndian(bytes) == 0x78'56'34'12u);
+  }
+  {
+    constexpr uint8_t bytes[] = {0x12u, 0x34u, 0x56u, 0x78u,
+                                 0x90u, 0x12u, 0x34u, 0x56u};
+    EXPECT_EQ(U64FromLittleEndian(bytes), 0x56'34'12'90'78'56'34'12u);
+    static_assert(std::same_as<uint64_t, decltype(U64FromLittleEndian(bytes))>);
+    static_assert(U64FromLittleEndian(bytes) == 0x56'34'12'90'78'56'34'12u);
+  }
+
+  {
+    constexpr uint8_t bytes[] = {0x12u};
+    EXPECT_EQ(I8FromLittleEndian(bytes), 0x12);
+    static_assert(std::same_as<int8_t, decltype(I8FromLittleEndian(bytes))>);
+    static_assert(I8FromLittleEndian(bytes) == 0x12);
+  }
+  {
+    constexpr uint8_t bytes[] = {0x12u, 0x34u};
+    EXPECT_EQ(I16FromLittleEndian(bytes), 0x34'12);
+    static_assert(std::same_as<int16_t, decltype(I16FromLittleEndian(bytes))>);
+    static_assert(I16FromLittleEndian(bytes) == 0x34'12);
+  }
+  {
+    constexpr uint8_t bytes[] = {0x12u, 0x34u, 0x56u, 0x78u};
+    EXPECT_EQ(I32FromLittleEndian(bytes), 0x78'56'34'12);
+    static_assert(std::same_as<int32_t, decltype(I32FromLittleEndian(bytes))>);
+    static_assert(I32FromLittleEndian(bytes) == 0x78'56'34'12);
+  }
+  {
+    constexpr uint8_t bytes[] = {0x12u, 0x34u, 0x56u, 0x78u,
+                                 0x90u, 0x12u, 0x34u, 0x56u};
+    EXPECT_EQ(I64FromLittleEndian(bytes), 0x56'34'12'90'78'56'34'12);
+    static_assert(std::same_as<int64_t, decltype(I64FromLittleEndian(bytes))>);
+    static_assert(I64FromLittleEndian(bytes) == 0x56'34'12'90'78'56'34'12);
+  }
+
+  {
+    constexpr uint8_t bytes[] = {0x12u, 0x34u, 0x56u, 0x78u};
+    EXPECT_EQ(FloatFromLittleEndian(bytes), 1.73782443614e+34f);
+    EXPECT_EQ(std::bit_cast<uint32_t>(FloatFromLittleEndian(bytes)),
+              0x78'56'34'12u);
+    static_assert(std::same_as<float, decltype(FloatFromLittleEndian(bytes))>);
+    static_assert(FloatFromLittleEndian(bytes) == 1.73782443614e+34f);
+    static_assert(std::bit_cast<uint32_t>(FloatFromLittleEndian(bytes)) ==
+                  0x78'56'34'12u);
+  }
+
+  {
+    constexpr uint8_t bytes[] = {0x12u, 0x34u, 0x56u, 0x78u,
+                                 0x90u, 0x12u, 0x34u, 0x56u};
+    EXPECT_EQ(DoubleFromLittleEndian(bytes),
+              1.84145159269283616391989849435e107);
+    EXPECT_EQ(std::bit_cast<uint64_t>(DoubleFromLittleEndian(bytes)),
+              0x56'34'12'90'78'56'34'12u);
+    static_assert(
+        std::same_as<double, decltype(DoubleFromLittleEndian(bytes))>);
+    static_assert(DoubleFromLittleEndian(bytes) ==
+                  1.84145159269283616391989849435e107);
+    static_assert(std::bit_cast<uint64_t>(DoubleFromLittleEndian(bytes)) ==
+                  0x56'34'12'90'78'56'34'12u);
+  }
+}
+
+TEST(NumericsTest, FromBigEndian) {
+  // The implementation of FromNativeEndian and FromLittleEndian assumes the
+  // native endian is little. If support of big endian is desired, compile-time
+  // branches will need to be added to the implementation, and the test results
+  // will differ there (they would match FromLittleEndian in this test).
+  static_assert(std::endian::native == std::endian::little);
+  {
+    constexpr uint8_t bytes[] = {0x12u};
+    EXPECT_EQ(U8FromBigEndian(bytes), 0x12u);
+    static_assert(U8FromBigEndian(bytes) == 0x12u);
+    static_assert(std::same_as<uint8_t, decltype(U8FromBigEndian(bytes))>);
+  }
+  {
+    constexpr uint8_t bytes[] = {0x12u, 0x34u};
+    EXPECT_EQ(U16FromBigEndian(bytes), 0x12'34u);
+    static_assert(U16FromBigEndian(bytes) == 0x12'34u);
+    static_assert(std::same_as<uint16_t, decltype(U16FromBigEndian(bytes))>);
+  }
+  {
+    constexpr uint8_t bytes[] = {0x12u, 0x34u, 0x56u, 0x78u};
+    EXPECT_EQ(U32FromBigEndian(bytes), 0x12'34'56'78u);
+    static_assert(U32FromBigEndian(bytes) == 0x12'34'56'78u);
+    static_assert(std::same_as<uint32_t, decltype(U32FromBigEndian(bytes))>);
+  }
+  {
+    constexpr uint8_t bytes[] = {0x12u, 0x34u, 0x56u, 0x78u,
+                                 0x90u, 0x12u, 0x34u, 0x56u};
+    EXPECT_EQ(U64FromBigEndian(bytes), 0x12'34'56'78'90'12'34'56u);
+    static_assert(U64FromBigEndian(bytes) == 0x12'34'56'78'90'12'34'56u);
+    static_assert(std::same_as<uint64_t, decltype(U64FromBigEndian(bytes))>);
+  }
+
+  {
+    constexpr uint8_t bytes[] = {0x12u};
+    EXPECT_EQ(I8FromBigEndian(bytes), 0x12);
+    static_assert(I8FromBigEndian(bytes) == 0x12);
+    static_assert(std::same_as<int8_t, decltype(I8FromBigEndian(bytes))>);
+  }
+  {
+    constexpr uint8_t bytes[] = {0x12u, 0x34u};
+    EXPECT_EQ(I16FromBigEndian(bytes), 0x12'34);
+    static_assert(I16FromBigEndian(bytes) == 0x12'34);
+    static_assert(std::same_as<int16_t, decltype(I16FromBigEndian(bytes))>);
+  }
+  {
+    constexpr uint8_t bytes[] = {0x12u, 0x34u, 0x56u, 0x78u};
+    EXPECT_EQ(I32FromBigEndian(bytes), 0x12'34'56'78);
+    static_assert(I32FromBigEndian(bytes) == 0x12'34'56'78);
+    static_assert(std::same_as<int32_t, decltype(I32FromBigEndian(bytes))>);
+  }
+  {
+    constexpr uint8_t bytes[] = {0x12u, 0x34u, 0x56u, 0x78u,
+                                 0x90u, 0x12u, 0x34u, 0x56u};
+    EXPECT_EQ(I64FromBigEndian(bytes), 0x12'34'56'78'90'12'34'56);
+    static_assert(I64FromBigEndian(bytes) == 0x12'34'56'78'90'12'34'56);
+    static_assert(std::same_as<int64_t, decltype(I64FromBigEndian(bytes))>);
+  }
+
+  {
+    constexpr uint8_t bytes[] = {0x12u, 0x34u, 0x56u, 0x78u};
+    EXPECT_EQ(FloatFromBigEndian(bytes), 5.6904566139e-28f);
+    EXPECT_EQ(std::bit_cast<uint32_t>(FloatFromBigEndian(bytes)),
+              0x12'34'56'78u);
+    static_assert(std::same_as<float, decltype(FloatFromBigEndian(bytes))>);
+    static_assert(FloatFromBigEndian(bytes) == 5.6904566139e-28f);
+    static_assert(std::bit_cast<uint32_t>(FloatFromBigEndian(bytes)) ==
+                  0x12'34'56'78u);
+  }
+  {
+    constexpr uint8_t bytes[] = {0x12u, 0x34u, 0x56u, 0x78u,
+                                 0x90u, 0x12u, 0x34u, 0x56u};
+    EXPECT_EQ(DoubleFromBigEndian(bytes), 5.62634909901491201382066931077e-221);
+    EXPECT_EQ(std::bit_cast<uint64_t>(DoubleFromBigEndian(bytes)),
+              0x12'34'56'78'90'12'34'56u);
+    static_assert(std::same_as<double, decltype(DoubleFromBigEndian(bytes))>);
+    static_assert(DoubleFromBigEndian(bytes) ==
+                  5.62634909901491201382066931077e-221);
+    static_assert(std::bit_cast<uint64_t>(DoubleFromBigEndian(bytes)) ==
+                  0x12'34'56'78'90'12'34'56u);
+  }
+}
+
+TEST(NumericsTest, ToNativeEndian) {
+  // The implementation of ToNativeEndian and ToLittleEndian assumes the native
+  // endian is little. If support of big endian is desired, compile-time
+  // branches will need to be added to the implementation, and the test results
+  // will differ there (they would match ToBigEndian in this test).
+  static_assert(std::endian::native == std::endian::little);
+  {
+    constexpr std::array<uint8_t, 1u> bytes = {0x12u};
+    constexpr auto val = uint8_t{0x12u};
+    EXPECT_EQ(U8ToNativeEndian(val), bytes);
+    static_assert(
+        std::same_as<std::array<uint8_t, 1u>, decltype(U8ToNativeEndian(val))>);
+    static_assert(U8ToNativeEndian(val) == bytes);
+  }
+  {
+    constexpr std::array<uint8_t, 2u> bytes = {0x12u, 0x34u};
+    constexpr auto val = uint16_t{0x34'12u};
+    EXPECT_EQ(U16ToNativeEndian(val), bytes);
+    static_assert(std::same_as<std::array<uint8_t, 2u>,
+                               decltype(U16ToNativeEndian(val))>);
+    static_assert(U16ToNativeEndian(val) == bytes);
+  }
+  {
+    constexpr std::array<uint8_t, 4u> bytes = {0x12u, 0x34u, 0x56u, 0x78u};
+    constexpr auto val = uint32_t{0x78'56'34'12u};
+    EXPECT_EQ(U32ToNativeEndian(val), bytes);
+    static_assert(std::same_as<std::array<uint8_t, 4u>,
+                               decltype(U32ToNativeEndian(val))>);
+    static_assert(U32ToNativeEndian(val) == bytes);
+  }
+  {
+    constexpr std::array<uint8_t, 8u> bytes = {0x12u, 0x34u, 0x56u, 0x78u,
+                                               0x90u, 0x12u, 0x34u, 0x56u};
+    constexpr auto val = uint64_t{0x56'34'12'90'78'56'34'12u};
+    EXPECT_EQ(U64ToNativeEndian(val), bytes);
+    static_assert(std::same_as<std::array<uint8_t, 8u>,
+                               decltype(U64ToNativeEndian(val))>);
+    static_assert(U64ToNativeEndian(val) == bytes);
+  }
+
+  {
+    constexpr std::array<uint8_t, 1u> bytes = {0x12u};
+    constexpr auto val = int8_t{0x12};
+    EXPECT_EQ(I8ToNativeEndian(val), bytes);
+    static_assert(
+        std::same_as<std::array<uint8_t, 1u>, decltype(I8ToNativeEndian(val))>);
+    static_assert(I8ToNativeEndian(val) == bytes);
+  }
+  {
+    constexpr std::array<uint8_t, 2u> bytes = {0x12u, 0x34u};
+    constexpr auto val = int16_t{0x34'12};
+    EXPECT_EQ(I16ToNativeEndian(val), bytes);
+    static_assert(std::same_as<std::array<uint8_t, 2u>,
+                               decltype(I16ToNativeEndian(val))>);
+    static_assert(I16ToNativeEndian(val) == bytes);
+  }
+  {
+    constexpr std::array<uint8_t, 4u> bytes = {0x12u, 0x34u, 0x56u, 0x78u};
+    constexpr auto val = int32_t{0x78'56'34'12};
+    EXPECT_EQ(I32ToNativeEndian(val), bytes);
+    static_assert(std::same_as<std::array<uint8_t, 4u>,
+                               decltype(I32ToNativeEndian(val))>);
+    static_assert(I32ToNativeEndian(val) == bytes);
+  }
+  {
+    constexpr std::array<uint8_t, 8u> bytes = {0x12u, 0x34u, 0x56u, 0x78u,
+                                               0x90u, 0x12u, 0x34u, 0x56u};
+    constexpr auto val = int64_t{0x56'34'12'90'78'56'34'12};
+    EXPECT_EQ(I64ToNativeEndian(val), bytes);
+    static_assert(std::same_as<std::array<uint8_t, 8u>,
+                               decltype(I64ToNativeEndian(val))>);
+    static_assert(I64ToNativeEndian(val) == bytes);
+  }
+
+  {
+    constexpr std::array<uint8_t, 4u> bytes = {0x12u, 0x34u, 0x56u, 0x78u};
+    constexpr float val = 1.73782443614e+34f;
+    EXPECT_EQ(FloatToNativeEndian(val), bytes);
+    static_assert(std::same_as<std::array<uint8_t, 4u>,
+                               decltype(FloatToNativeEndian(val))>);
+    static_assert(FloatToNativeEndian(val) == bytes);
+  }
+
+  {
+    constexpr std::array<uint8_t, 8u> bytes = {0x12u, 0x34u, 0x56u, 0x78u,
+                                               0x90u, 0x12u, 0x34u, 0x56u};
+    constexpr double val = 1.84145159269283616391989849435e107;
+    EXPECT_EQ(DoubleToNativeEndian(val), bytes);
+    static_assert(std::same_as<std::array<uint8_t, 8u>,
+                               decltype(DoubleToNativeEndian(val))>);
+    static_assert(DoubleToNativeEndian(val) == bytes);
+  }
+}
+
+TEST(NumericsTest, ToLittleEndian) {
+  // The implementation of ToNativeEndian and ToLittleEndian assumes the native
+  // endian is little. If support of big endian is desired, compile-time
+  // branches will need to be added to the implementation, and the test results
+  // will differ there (they would match ToBigEndian in this test).
+  static_assert(std::endian::native == std::endian::little);
+  {
+    constexpr std::array<uint8_t, 1u> bytes = {0x12u};
+    constexpr auto val = uint8_t{0x12u};
+    EXPECT_EQ(U8ToLittleEndian(val), bytes);
+    static_assert(
+        std::same_as<std::array<uint8_t, 1u>, decltype(U8ToLittleEndian(val))>);
+    static_assert(U8ToLittleEndian(val) == bytes);
+  }
+  {
+    constexpr std::array<uint8_t, 2u> bytes = {0x12u, 0x34u};
+    constexpr auto val = uint16_t{0x34'12u};
+    EXPECT_EQ(U16ToLittleEndian(val), bytes);
+    static_assert(std::same_as<std::array<uint8_t, 2u>,
+                               decltype(U16ToLittleEndian(val))>);
+    static_assert(U16ToLittleEndian(val) == bytes);
+  }
+  {
+    constexpr std::array<uint8_t, 4u> bytes = {0x12u, 0x34u, 0x56u, 0x78u};
+    constexpr auto val = uint32_t{0x78'56'34'12u};
+    EXPECT_EQ(U32ToLittleEndian(val), bytes);
+    static_assert(std::same_as<std::array<uint8_t, 4u>,
+                               decltype(U32ToLittleEndian(val))>);
+    static_assert(U32ToLittleEndian(val) == bytes);
+  }
+  {
+    constexpr std::array<uint8_t, 8u> bytes = {0x12u, 0x34u, 0x56u, 0x78u,
+                                               0x90u, 0x12u, 0x34u, 0x56u};
+    constexpr auto val = uint64_t{0x56'34'12'90'78'56'34'12u};
+    EXPECT_EQ(U64ToLittleEndian(val), bytes);
+    static_assert(std::same_as<std::array<uint8_t, 8u>,
+                               decltype(U64ToLittleEndian(val))>);
+    static_assert(U64ToLittleEndian(val) == bytes);
+  }
+
+  {
+    constexpr std::array<uint8_t, 1u> bytes = {0x12u};
+    constexpr auto val = int8_t{0x12};
+    EXPECT_EQ(I8ToLittleEndian(val), bytes);
+    static_assert(
+        std::same_as<std::array<uint8_t, 1u>, decltype(I8ToLittleEndian(val))>);
+    static_assert(I8ToLittleEndian(val) == bytes);
+  }
+  {
+    constexpr std::array<uint8_t, 2u> bytes = {0x12u, 0x34u};
+    constexpr auto val = int16_t{0x34'12};
+    EXPECT_EQ(I16ToLittleEndian(val), bytes);
+    static_assert(std::same_as<std::array<uint8_t, 2u>,
+                               decltype(I16ToLittleEndian(val))>);
+    static_assert(I16ToLittleEndian(val) == bytes);
+  }
+  {
+    constexpr std::array<uint8_t, 4u> bytes = {0x12u, 0x34u, 0x56u, 0x78u};
+    constexpr auto val = int32_t{0x78'56'34'12};
+    EXPECT_EQ(I32ToLittleEndian(val), bytes);
+    static_assert(std::same_as<std::array<uint8_t, 4u>,
+                               decltype(I32ToLittleEndian(val))>);
+    static_assert(I32ToLittleEndian(val) == bytes);
+  }
+  {
+    constexpr std::array<uint8_t, 8u> bytes = {0x12u, 0x34u, 0x56u, 0x78u,
+                                               0x90u, 0x12u, 0x34u, 0x56u};
+    constexpr auto val = int64_t{0x56'34'12'90'78'56'34'12};
+    EXPECT_EQ(I64ToLittleEndian(val), bytes);
+    static_assert(std::same_as<std::array<uint8_t, 8u>,
+                               decltype(I64ToLittleEndian(val))>);
+    static_assert(I64ToLittleEndian(val) == bytes);
+  }
+
+  {
+    constexpr std::array<uint8_t, 4u> bytes = {0x12u, 0x34u, 0x56u, 0x78u};
+    constexpr float val = 1.73782443614e+34f;
+    EXPECT_EQ(FloatToLittleEndian(val), bytes);
+    static_assert(std::same_as<std::array<uint8_t, 4u>,
+                               decltype(FloatToLittleEndian(val))>);
+    static_assert(FloatToLittleEndian(val) == bytes);
+  }
+
+  {
+    constexpr std::array<uint8_t, 8u> bytes = {0x12u, 0x34u, 0x56u, 0x78u,
+                                               0x90u, 0x12u, 0x34u, 0x56u};
+    constexpr double val = 1.84145159269283616391989849435e107;
+    EXPECT_EQ(DoubleToLittleEndian(val), bytes);
+    static_assert(std::same_as<std::array<uint8_t, 8u>,
+                               decltype(DoubleToLittleEndian(val))>);
+    static_assert(DoubleToLittleEndian(val) == bytes);
+  }
+}
+
+TEST(NumericsTest, ToBigEndian) {
+  // The implementation of ToBigEndian assumes the native endian is little. If
+  // support of big endian is desired, compile-time branches will need to be
+  // added to the implementation, and the test results will differ there (they
+  // would match ToLittleEndian in this test).
+  static_assert(std::endian::native == std::endian::little);
+  {
+    constexpr std::array<uint8_t, 1u> bytes = {0x12u};
+    constexpr auto val = uint8_t{0x12u};
+    EXPECT_EQ(U8ToBigEndian(val), bytes);
+    static_assert(
+        std::same_as<std::array<uint8_t, 1u>, decltype(U8ToBigEndian(val))>);
+    static_assert(U8ToBigEndian(val) == bytes);
+  }
+  {
+    constexpr std::array<uint8_t, 2u> bytes = {0x12u, 0x34u};
+    constexpr auto val = uint16_t{0x12'34u};
+    EXPECT_EQ(U16ToBigEndian(val), bytes);
+    static_assert(
+        std::same_as<std::array<uint8_t, 2u>, decltype(U16ToBigEndian(val))>);
+    static_assert(U16ToBigEndian(val) == bytes);
+  }
+  {
+    constexpr std::array<uint8_t, 4u> bytes = {0x12u, 0x34u, 0x56u, 0x78u};
+    constexpr auto val = uint32_t{0x12'34'56'78u};
+    EXPECT_EQ(U32ToBigEndian(val), bytes);
+    static_assert(
+        std::same_as<std::array<uint8_t, 4u>, decltype(U32ToBigEndian(val))>);
+    static_assert(U32ToBigEndian(val) == bytes);
+  }
+  {
+    constexpr std::array<uint8_t, 8u> bytes = {0x12u, 0x34u, 0x56u, 0x78u,
+                                               0x90u, 0x12u, 0x34u, 0x56u};
+    constexpr auto val = uint64_t{0x12'34'56'78'90'12'34'56u};
+    EXPECT_EQ(U64ToBigEndian(val), bytes);
+    static_assert(
+        std::same_as<std::array<uint8_t, 8u>, decltype(U64ToBigEndian(val))>);
+    static_assert(U64ToBigEndian(val) == bytes);
+  }
+
+  {
+    constexpr std::array<uint8_t, 1u> bytes = {0x12u};
+    constexpr auto val = int8_t{0x12u};
+    EXPECT_EQ(I8ToBigEndian(val), bytes);
+    static_assert(
+        std::same_as<std::array<uint8_t, 1u>, decltype(I8ToBigEndian(val))>);
+    static_assert(I8ToBigEndian(val) == bytes);
+  }
+  {
+    constexpr std::array<uint8_t, 2u> bytes = {0x12u, 0x34u};
+    constexpr auto val = int16_t{0x12'34u};
+    EXPECT_EQ(I16ToBigEndian(val), bytes);
+    static_assert(
+        std::same_as<std::array<uint8_t, 2u>, decltype(I16ToBigEndian(val))>);
+    static_assert(I16ToBigEndian(val) == bytes);
+  }
+  {
+    constexpr std::array<uint8_t, 4u> bytes = {0x12u, 0x34u, 0x56u, 0x78u};
+    constexpr auto val = int32_t{0x12'34'56'78u};
+    EXPECT_EQ(I32ToBigEndian(val), bytes);
+    static_assert(
+        std::same_as<std::array<uint8_t, 4u>, decltype(I32ToBigEndian(val))>);
+    static_assert(I32ToBigEndian(val) == bytes);
+  }
+  {
+    constexpr std::array<uint8_t, 8u> bytes = {0x12u, 0x34u, 0x56u, 0x78u,
+                                               0x90u, 0x12u, 0x34u, 0x56u};
+    constexpr auto val = int64_t{0x12'34'56'78'90'12'34'56u};
+    EXPECT_EQ(I64ToBigEndian(val), bytes);
+    static_assert(
+        std::same_as<std::array<uint8_t, 8u>, decltype(I64ToBigEndian(val))>);
+    static_assert(I64ToBigEndian(val) == bytes);
+  }
+
+  {
+    constexpr std::array<uint8_t, 4u> bytes = {0x12u, 0x34u, 0x56u, 0x78u};
+    constexpr float val = 5.6904566139e-28f;
+    EXPECT_EQ(FloatToBigEndian(val), bytes);
+    static_assert(
+        std::same_as<std::array<uint8_t, 4u>, decltype(FloatToBigEndian(val))>);
+    static_assert(FloatToBigEndian(val) == bytes);
+  }
+
+  {
+    constexpr std::array<uint8_t, 8u> bytes = {0x12u, 0x34u, 0x56u, 0x78u,
+                                               0x90u, 0x12u, 0x34u, 0x56u};
+    constexpr double val = 5.62634909901491201382066931077e-221;
+    EXPECT_EQ(DoubleToBigEndian(val), bytes);
+    static_assert(std::same_as<std::array<uint8_t, 8u>,
+                               decltype(DoubleToBigEndian(val))>);
+    static_assert(DoubleToBigEndian(val) == bytes);
+  }
+}
+
+}  // namespace v8::base::numerics
diff --git a/deps/v8/src/base/numerics/checked_math.h b/deps/v8/src/base/numerics/checked_math.h
new file mode 100644
index 00000000000000..e72e6633869371
--- /dev/null
+++ b/deps/v8/src/base/numerics/checked_math.h
@@ -0,0 +1,375 @@
+// Copyright 2017 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Slightly adapted for inclusion in V8.
+// Copyright 2025 the V8 project authors. All rights reserved.
+
+#ifndef V8_BASE_NUMERICS_CHECKED_MATH_H_
+#define V8_BASE_NUMERICS_CHECKED_MATH_H_
+
+#include <stdint.h>
+
+#include <limits>
+#include <type_traits>
+
+#include "src/base/numerics/checked_math_impl.h"  // IWYU pragma: export
+#include "src/base/numerics/safe_conversions.h"
+#include "src/base/numerics/safe_math_shared_impl.h"  // IWYU pragma: export
+
+namespace v8::base {
+namespace internal {
+
+template <typename T>
+  requires std::is_arithmetic_v<T>
+class CheckedNumeric {
+ public:
+  using type = T;
+
+  constexpr CheckedNumeric() = default;
+
+  // Copy constructor.
+  template <typename Src>
+  constexpr CheckedNumeric(const CheckedNumeric<Src>& rhs)
+      : state_(rhs.state_.value(), rhs.IsValid()) {}
+
+  // This is not an explicit constructor because we implicitly upgrade regular
+  // numerics to CheckedNumerics to make them easier to use.
+  template <typename Src>
+    requires(std::is_arithmetic_v<Src>)
+  // NOLINTNEXTLINE(runtime/explicit)
+  constexpr CheckedNumeric(Src value) : state_(value) {}
+
+  // This is not an explicit constructor because we want a seamless conversion
+  // from StrictNumeric types.
+  template <typename Src>
+  // NOLINTNEXTLINE(runtime/explicit)
+  constexpr CheckedNumeric(StrictNumeric<Src> value)
+      : state_(static_cast<Src>(value)) {}
+
+  // IsValid() - The public API to test if a CheckedNumeric is currently valid.
+  // A range checked destination type can be supplied using the Dst template
+  // parameter.
+  template <typename Dst = T>
+  constexpr bool IsValid() const {
+    return state_.is_valid() &&
+           IsValueInRangeForNumericType<Dst>(state_.value());
+  }
+
+  // AssignIfValid(Dst) - Assigns the underlying value if it is currently valid
+  // and is within the range supported by the destination type. Returns true if
+  // successful and false otherwise.
+  template <typename Dst>
+#if defined(__clang__) || defined(__GNUC__)
+  __attribute__((warn_unused_result))
+#elif defined(_MSC_VER)
+  _Check_return_
+#endif
+  constexpr bool
+  AssignIfValid(Dst* result) const {
+    if (IsValid<Dst>()) [[likely]] {
+      *result = static_cast<Dst>(state_.value());
+      return true;
+    }
+    return false;
+  }
+
+  // ValueOrDie() - The primary accessor for the underlying value. If the
+  // current state is not valid it will CHECK and crash.
+  // A range checked destination type can be supplied using the Dst template
+  // parameter, which will trigger a CHECK if the value is not in bounds for
+  // the destination.
+  // The CHECK behavior can be overridden by supplying a handler as a
+  // template parameter, for test code, etc. However, the handler cannot access
+  // the underlying value, and it is not available through other means.
+  template <typename Dst = T, class CheckHandler = CheckOnFailure>
+  constexpr StrictNumeric<Dst> ValueOrDie() const {
+    if (IsValid<Dst>()) [[likely]] {
+      return static_cast<Dst>(state_.value());
+    }
+    return CheckHandler::template HandleFailure<Dst>();
+  }
+
+  // ValueOrDefault(T default_value) - A convenience method that returns the
+  // current value if the state is valid, and the supplied default_value for
+  // any other state.
+  // A range checked destination type can be supplied using the Dst template
+  // parameter. WARNING: This function may fail to compile or CHECK at runtime
+  // if the supplied default_value is not within range of the destination type.
+  template <typename Dst = T, typename Src>
+  constexpr StrictNumeric<Dst> ValueOrDefault(Src default_value) const {
+    if (IsValid<Dst>()) [[likely]] {
+      return static_cast<Dst>(state_.value());
+    }
+    return checked_cast<Dst>(default_value);
+  }
+
+  // Returns a checked numeric of the specified type, cast from the current
+  // CheckedNumeric. If the current state is invalid or the destination cannot
+  // represent the result then the returned CheckedNumeric will be invalid.
+  template <typename Dst>
+  constexpr CheckedNumeric<UnderlyingType<Dst>> Cast() const {
+    return *this;
+  }
+
+  // This friend method is available solely for providing more detailed logging
+  // in the tests. Do not implement it in production code, because the
+  // underlying values may change at any time.
+  template <typename U>
+  friend U GetNumericValueForTest(const CheckedNumeric<U>& src);
+
+  // Prototypes for the supported arithmetic operator overloads.
+  template <typename Src>
+  constexpr CheckedNumeric& operator+=(const Src rhs);
+  template <typename Src>
+  constexpr CheckedNumeric& operator-=(const Src rhs);
+  template <typename Src>
+  constexpr CheckedNumeric& operator*=(const Src rhs);
+  template <typename Src>
+  constexpr CheckedNumeric& operator/=(const Src rhs);
+  template <typename Src>
+  constexpr CheckedNumeric& operator%=(const Src rhs);
+  template <typename Src>
+  constexpr CheckedNumeric& operator<<=(const Src rhs);
+  template <typename Src>
+  constexpr CheckedNumeric& operator>>=(const Src rhs);
+  template <typename Src>
+  constexpr CheckedNumeric& operator&=(const Src rhs);
+  template <typename Src>
+  constexpr CheckedNumeric& operator|=(const Src rhs);
+  template <typename Src>
+  constexpr CheckedNumeric& operator^=(const Src rhs);
+
+  constexpr CheckedNumeric operator-() const {
+    // Use an optimized code path for a known run-time variable.
+    if (!std::is_constant_evaluated() && std::is_signed_v<T> &&
+        std::is_floating_point_v<T>) {
+      return FastRuntimeNegate();
+    }
+    // The negation of two's complement int min is int min.
+    const bool is_valid =
+        IsValid() &&
+        (!std::is_signed_v<T> || std::is_floating_point_v<T> ||
+         NegateWrapper(state_.value()) != std::numeric_limits<T>::lowest());
+    return CheckedNumeric<T>(NegateWrapper(state_.value()), is_valid);
+  }
+
+  constexpr CheckedNumeric operator~() const {
+    return CheckedNumeric<decltype(InvertWrapper(T()))>(
+        InvertWrapper(state_.value()), IsValid());
+  }
+
+  constexpr CheckedNumeric Abs() const {
+    return !IsValueNegative(state_.value()) ? *this : -*this;
+  }
+
+  template <typename U>
+  constexpr CheckedNumeric<typename MathWrapper<CheckedMaxOp, T, U>::type> Max(
+      U rhs) const {
+    return CheckMax(*this, rhs);
+  }
+
+  template <typename U>
+  constexpr CheckedNumeric<typename MathWrapper<CheckedMinOp, T, U>::type> Min(
+      U rhs) const {
+    return CheckMin(*this, rhs);
+  }
+
+  // This function is available only for integral types. It returns an unsigned
+  // integer of the same width as the source type, containing the absolute value
+  // of the source, and properly handling signed min.
+  constexpr CheckedNumeric<typename UnsignedOrFloatForSize<T>::type>
+  UnsignedAbs() const {
+    return CheckedNumeric<typename UnsignedOrFloatForSize<T>::type>(
+        SafeUnsignedAbs(state_.value()), state_.is_valid());
+  }
+
+  constexpr CheckedNumeric& operator++() {
+    *this += 1;
+    return *this;
+  }
+
+  constexpr CheckedNumeric operator++(int) {
+    const CheckedNumeric value = *this;
+    ++*this;
+    return value;
+  }
+
+  constexpr CheckedNumeric& operator--() {
+    *this -= 1;
+    return *this;
+  }
+
+  constexpr CheckedNumeric operator--(int) {
+    const CheckedNumeric value = *this;
+    --*this;
+    return value;
+  }
+
+  // These perform the actual math operations on the CheckedNumerics.
+  // Binary arithmetic operations.
+  template <template <typename, typename> class M, typename L, typename R>
+  static constexpr CheckedNumeric MathOp(L lhs, R rhs) {
+    using Math = typename MathWrapper<M, L, R>::math;
+    T result = 0;
+    const bool is_valid =
+        Wrapper<L>::is_valid(lhs) && Wrapper<R>::is_valid(rhs) &&
+        Math::Do(Wrapper<L>::value(lhs), Wrapper<R>::value(rhs), &result);
+    return CheckedNumeric<T>(result, is_valid);
+  }
+
+  // Assignment arithmetic operations.
+  template <template <typename, typename> class M, typename R>
+  constexpr CheckedNumeric& MathOp(R rhs) {
+    using Math = typename MathWrapper<M, T, R>::math;
+    T result = 0;  // Using T as the destination saves a range check.
+    const bool is_valid =
+        state_.is_valid() && Wrapper<R>::is_valid(rhs) &&
+        Math::Do(state_.value(), Wrapper<R>::value(rhs), &result);
+    *this = CheckedNumeric<T>(result, is_valid);
+    return *this;
+  }
+
+ private:
+  template <typename U>
+    requires std::is_arithmetic_v<U>
+  friend class CheckedNumeric;
+
+  CheckedNumericState<T> state_;
+
+  CheckedNumeric FastRuntimeNegate() const {
+    T result;
+    const bool success = CheckedSubOp<T, T>::Do(T(0), state_.value(), &result);
+    return CheckedNumeric<T>(result, IsValid() && success);
+  }
+
+  template <typename Src>
+  constexpr CheckedNumeric(Src value, bool is_valid)
+      : state_(value, is_valid) {}
+
+  // These wrappers allow us to handle state the same way for both
+  // CheckedNumeric and POD arithmetic types.
+  template <typename Src>
+  struct Wrapper {
+    static constexpr bool is_valid(Src) { return true; }
+    static constexpr Src value(Src value) { return value; }
+  };
+
+  template <typename Src>
+  struct Wrapper<CheckedNumeric<Src>> {
+    static constexpr bool is_valid(CheckedNumeric<Src> v) {
+      return v.IsValid();
+    }
+    static constexpr Src value(CheckedNumeric<Src> v) {
+      return v.state_.value();
+    }
+  };
+
+  template <typename Src>
+  struct Wrapper<StrictNumeric<Src>> {
+    static constexpr bool is_valid(StrictNumeric<Src>) { return true; }
+    static constexpr Src value(StrictNumeric<Src> v) {
+      return static_cast<Src>(v);
+    }
+  };
+};
+
+template <typename T>
+CheckedNumeric(T) -> CheckedNumeric<T>;
+
+// Convenience functions to avoid the ugly template disambiguator syntax.
+template <typename Dst, typename Src>
+constexpr bool IsValidForType(const CheckedNumeric<Src> value) {
+  return value.template IsValid<Dst>();
+}
+
+template <typename Dst, typename Src>
+constexpr StrictNumeric<Dst> ValueOrDieForType(
+    const CheckedNumeric<Src> value) {
+  return value.template ValueOrDie<Dst>();
+}
+
+template <typename Dst, typename Src, typename Default>
+constexpr StrictNumeric<Dst> ValueOrDefaultForType(CheckedNumeric<Src> value,
+                                                   Default default_value) {
+  return value.template ValueOrDefault<Dst>(default_value);
+}
+
+// Convenience wrapper to return a new CheckedNumeric from the provided
+// arithmetic or CheckedNumericType.
+template <typename T>
+constexpr CheckedNumeric<UnderlyingType<T>> MakeCheckedNum(T value) {
+  return value;
+}
+
+// These implement the variadic wrapper for the math operations.
+template <template <typename, typename> class M, typename L, typename R>
+constexpr CheckedNumeric<typename MathWrapper<M, L, R>::type> CheckMathOp(
+    L lhs, R rhs) {
+  using Math = typename MathWrapper<M, L, R>::math;
+  return CheckedNumeric<typename Math::result_type>::template MathOp<M>(lhs,
+                                                                        rhs);
+}
+
+// General purpose wrapper template for arithmetic operations.
+template <template <typename, typename> class M, typename L, typename R,
+          typename... Args>
+constexpr auto CheckMathOp(L lhs, R rhs, Args... args) {
+  return CheckMathOp<M>(CheckMathOp<M>(lhs, rhs), args...);
+}
+
+BASE_NUMERIC_ARITHMETIC_OPERATORS(Checked, Check, Add, +, +=)
+BASE_NUMERIC_ARITHMETIC_OPERATORS(Checked, Check, Sub, -, -=)
+BASE_NUMERIC_ARITHMETIC_OPERATORS(Checked, Check, Mul, *, *=)
+BASE_NUMERIC_ARITHMETIC_OPERATORS(Checked, Check, Div, /, /=)
+BASE_NUMERIC_ARITHMETIC_OPERATORS(Checked, Check, Mod, %, %=)
+BASE_NUMERIC_ARITHMETIC_OPERATORS(Checked, Check, Lsh, <<, <<=)
+BASE_NUMERIC_ARITHMETIC_OPERATORS(Checked, Check, Rsh, >>, >>=)
+BASE_NUMERIC_ARITHMETIC_OPERATORS(Checked, Check, And, &, &=)
+BASE_NUMERIC_ARITHMETIC_OPERATORS(Checked, Check, Or, |, |=)
+BASE_NUMERIC_ARITHMETIC_OPERATORS(Checked, Check, Xor, ^, ^=)
+BASE_NUMERIC_ARITHMETIC_VARIADIC(Checked, Check, Max)
+BASE_NUMERIC_ARITHMETIC_VARIADIC(Checked, Check, Min)
+
+// These are some extra StrictNumeric operators to support simple pointer
+// arithmetic with our result types. Since wrapping on a pointer is always
+// bad, we trigger the CHECK condition here.
+template <typename L, typename R>
+L* operator+(L* lhs, StrictNumeric<R> rhs) {
+  const uintptr_t result = CheckAdd(reinterpret_cast<uintptr_t>(lhs),
+                                    CheckMul(sizeof(L), static_cast<R>(rhs)))
+                               .template ValueOrDie<uintptr_t>();
+  return reinterpret_cast<L*>(result);
+}
+
+template <typename L, typename R>
+L* operator-(L* lhs, StrictNumeric<R> rhs) {
+  const uintptr_t result = CheckSub(reinterpret_cast<uintptr_t>(lhs),
+                                    CheckMul(sizeof(L), static_cast<R>(rhs)))
+                               .template ValueOrDie<uintptr_t>();
+  return reinterpret_cast<L*>(result);
+}
+
+}  // namespace internal
+
+using internal::CheckAdd;
+using internal::CheckAnd;
+using internal::CheckDiv;
+using internal::CheckedNumeric;
+using internal::CheckLsh;
+using internal::CheckMax;
+using internal::CheckMin;
+using internal::CheckMod;
+using internal::CheckMul;
+using internal::CheckOr;
+using internal::CheckRsh;
+using internal::CheckSub;
+using internal::CheckXor;
+using internal::IsValidForType;
+using internal::MakeCheckedNum;
+using internal::ValueOrDefaultForType;
+using internal::ValueOrDieForType;
+
+}  // namespace v8::base
+
+#endif  // V8_BASE_NUMERICS_CHECKED_MATH_H_
diff --git a/deps/v8/src/base/numerics/checked_math_impl.h b/deps/v8/src/base/numerics/checked_math_impl.h
new file mode 100644
index 00000000000000..fec8fdc4df20fc
--- /dev/null
+++ b/deps/v8/src/base/numerics/checked_math_impl.h
@@ -0,0 +1,574 @@
+// Copyright 2017 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Slightly adapted for inclusion in V8.
+// Copyright 2025 the V8 project authors. All rights reserved.
+
+#ifndef V8_BASE_NUMERICS_CHECKED_MATH_IMPL_H_
+#define V8_BASE_NUMERICS_CHECKED_MATH_IMPL_H_
+
+// IWYU pragma: private, include "src/base/numerics/checked_math.h"
+
+#include <stdint.h>
+
+#include <cmath>
+#include <concepts>
+#include <limits>
+#include <type_traits>
+
+#include "src/base/numerics/safe_conversions.h"
+#include "src/base/numerics/safe_math_shared_impl.h"  // IWYU pragma: export
+
+namespace v8::base {
+namespace internal {
+
+template <typename T>
+constexpr bool CheckedAddImpl(T x, T y, T* result) {
+  static_assert(std::integral<T>, "Type must be integral");
+  // Since the value of x+y is undefined if we have a signed type, we compute
+  // it using the unsigned type of the same size.
+  using UnsignedDst = typename std::make_unsigned<T>::type;
+  using SignedDst = typename std::make_signed<T>::type;
+  const UnsignedDst ux = static_cast<UnsignedDst>(x);
+  const UnsignedDst uy = static_cast<UnsignedDst>(y);
+  const UnsignedDst uresult = static_cast<UnsignedDst>(ux + uy);
+  // Addition is valid if the sign of (x + y) is equal to either that of x or
+  // that of y.
+  if (std::is_signed_v<T>
+          ? static_cast<SignedDst>((uresult ^ ux) & (uresult ^ uy)) < 0
+          : uresult < uy) {  // Unsigned is either valid or underflow.
+    return false;
+  }
+  *result = static_cast<T>(uresult);
+  return true;
+}
+
+template <typename T, typename U>
+struct CheckedAddOp {};
+
+template <typename T, typename U>
+  requires(std::integral<T> && std::integral<U>)
+struct CheckedAddOp<T, U> {
+  using result_type = MaxExponentPromotion<T, U>;
+  template <typename V>
+  static constexpr bool Do(T x, U y, V* result) {
+    if constexpr (CheckedAddFastOp<T, U>::is_supported) {
+      return CheckedAddFastOp<T, U>::Do(x, y, result);
+    }
+
+    // Double the underlying type up to a full machine word.
+    using FastPromotion = FastIntegerArithmeticPromotion<T, U>;
+    using Promotion =
+        std::conditional_t<(kIntegerBitsPlusSign<FastPromotion> >
+                            kIntegerBitsPlusSign<intptr_t>),
+                           BigEnoughPromotion<T, U>, FastPromotion>;
+    // Fail if either operand is out of range for the promoted type.
+    // TODO(jschuh): This could be made to work for a broader range of values.
+    if (!IsValueInRangeForNumericType<Promotion>(x) ||
+        !IsValueInRangeForNumericType<Promotion>(y)) [[unlikely]] {
+      return false;
+    }
+
+    Promotion presult = {};
+    bool is_valid = true;
+    if constexpr (kIsIntegerArithmeticSafe<Promotion, T, U>) {
+      presult = static_cast<Promotion>(x) + static_cast<Promotion>(y);
+    } else {
+      is_valid = CheckedAddImpl(static_cast<Promotion>(x),
+                                static_cast<Promotion>(y), &presult);
+    }
+    if (!is_valid || !IsValueInRangeForNumericType<V>(presult)) {
+      return false;
+    }
+    *result = static_cast<V>(presult);
+    return true;
+  }
+};
+
+template <typename T>
+constexpr bool CheckedSubImpl(T x, T y, T* result) {
+  static_assert(std::integral<T>, "Type must be integral");
+  // Since the value of x+y is undefined if we have a signed type, we compute
+  // it using the unsigned type of the same size.
+  using UnsignedDst = typename std::make_unsigned<T>::type;
+  using SignedDst = typename std::make_signed<T>::type;
+  const UnsignedDst ux = static_cast<UnsignedDst>(x);
+  const UnsignedDst uy = static_cast<UnsignedDst>(y);
+  const UnsignedDst uresult = static_cast<UnsignedDst>(ux - uy);
+  // Subtraction is valid if either x and y have same sign, or (x-y) and x have
+  // the same sign.
+  if (std::is_signed_v<T>
+          ? static_cast<SignedDst>((uresult ^ ux) & (ux ^ uy)) < 0
+          : x < y) {
+    return false;
+  }
+  *result = static_cast<T>(uresult);
+  return true;
+}
+
+template <typename T, typename U>
+struct CheckedSubOp {};
+
+template <typename T, typename U>
+  requires(std::integral<T> && std::integral<U>)
+struct CheckedSubOp<T, U> {
+  using result_type = MaxExponentPromotion<T, U>;
+  template <typename V>
+  static constexpr bool Do(T x, U y, V* result) {
+    if constexpr (CheckedSubFastOp<T, U>::is_supported) {
+      return CheckedSubFastOp<T, U>::Do(x, y, result);
+    }
+
+    // Double the underlying type up to a full machine word.
+    using FastPromotion = FastIntegerArithmeticPromotion<T, U>;
+    using Promotion =
+        std::conditional_t<(kIntegerBitsPlusSign<FastPromotion> >
+                            kIntegerBitsPlusSign<intptr_t>),
+                           BigEnoughPromotion<T, U>, FastPromotion>;
+    // Fail if either operand is out of range for the promoted type.
+    // TODO(jschuh): This could be made to work for a broader range of values.
+    if (!IsValueInRangeForNumericType<Promotion>(x) ||
+        !IsValueInRangeForNumericType<Promotion>(y)) [[unlikely]] {
+      return false;
+    }
+
+    Promotion presult = {};
+    bool is_valid = true;
+    if constexpr (kIsIntegerArithmeticSafe<Promotion, T, U>) {
+      presult = static_cast<Promotion>(x) - static_cast<Promotion>(y);
+    } else {
+      is_valid = CheckedSubImpl(static_cast<Promotion>(x),
+                                static_cast<Promotion>(y), &presult);
+    }
+    if (!is_valid || !IsValueInRangeForNumericType<V>(presult)) {
+      return false;
+    }
+    *result = static_cast<V>(presult);
+    return true;
+  }
+};
+
+template <typename T>
+constexpr bool CheckedMulImpl(T x, T y, T* result) {
+  static_assert(std::integral<T>, "Type must be integral");
+  // Since the value of x*y is potentially undefined if we have a signed type,
+  // we compute it using the unsigned type of the same size.
+  using UnsignedDst = typename std::make_unsigned<T>::type;
+  using SignedDst = typename std::make_signed<T>::type;
+  const UnsignedDst ux = SafeUnsignedAbs(x);
+  const UnsignedDst uy = SafeUnsignedAbs(y);
+  const UnsignedDst uresult = static_cast<UnsignedDst>(ux * uy);
+  const bool is_negative =
+      std::is_signed_v<T> && static_cast<SignedDst>(x ^ y) < 0;
+  // We have a fast out for unsigned identity or zero on the second operand.
+  // After that it's an unsigned overflow check on the absolute value, with
+  // a +1 bound for a negative result.
+  if (uy > UnsignedDst(!std::is_signed_v<T> || is_negative) &&
+      ux > (std::numeric_limits<T>::max() + UnsignedDst(is_negative)) / uy) {
+    return false;
+  }
+  *result = static_cast<T>(is_negative ? 0 - uresult : uresult);
+  return true;
+}
+
+template <typename T, typename U>
+struct CheckedMulOp {};
+
+template <typename T, typename U>
+  requires(std::integral<T> && std::integral<U>)
+struct CheckedMulOp<T, U> {
+  using result_type = MaxExponentPromotion<T, U>;
+  template <typename V>
+  static constexpr bool Do(T x, U y, V* result) {
+    if constexpr (CheckedMulFastOp<T, U>::is_supported) {
+      return CheckedMulFastOp<T, U>::Do(x, y, result);
+    }
+
+    using Promotion = FastIntegerArithmeticPromotion<T, U>;
+    // Verify the destination type can hold the result (always true for 0).
+    if ((!IsValueInRangeForNumericType<Promotion>(x) ||
+         !IsValueInRangeForNumericType<Promotion>(y)) &&
+        x && y) [[unlikely]] {
+      return false;
+    }
+
+    Promotion presult = {};
+    bool is_valid = true;
+    if constexpr (CheckedMulFastOp<Promotion, Promotion>::is_supported) {
+      // The fast op may be available with the promoted type.
+      // The casts here are safe because of the "value in range" conditional
+      // above.
+      is_valid = CheckedMulFastOp<Promotion, Promotion>::Do(
+          static_cast<Promotion>(x), static_cast<Promotion>(y), &presult);
+    } else if constexpr (kIsIntegerArithmeticSafe<Promotion, T, U>) {
+      presult = static_cast<Promotion>(x) * static_cast<Promotion>(y);
+    } else {
+      is_valid = CheckedMulImpl(static_cast<Promotion>(x),
+                                static_cast<Promotion>(y), &presult);
+    }
+    if (!is_valid || !IsValueInRangeForNumericType<V>(presult)) {
+      return false;
+    }
+    *result = static_cast<V>(presult);
+    return true;
+  }
+};
+
+// Division just requires a check for a zero denominator or an invalid negation
+// on signed min/-1.
+template <typename T, typename U>
+struct CheckedDivOp {};
+
+template <typename T, typename U>
+  requires(std::integral<T> && std::integral<U>)
+struct CheckedDivOp<T, U> {
+  using result_type = MaxExponentPromotion<T, U>;
+  template <typename V>
+  static constexpr bool Do(T x, U y, V* result) {
+    if (!y) [[unlikely]] {
+      return false;
+    }
+
+    // The overflow check can be compiled away if we don't have the exact
+    // combination of types needed to trigger this case.
+    using Promotion = BigEnoughPromotion<T, U>;
+    if (std::is_signed_v<T> && std::is_signed_v<U> &&
+        kIsTypeInRangeForNumericType<T, Promotion> &&
+        static_cast<Promotion>(x) == std::numeric_limits<Promotion>::lowest() &&
+        y == static_cast<U>(-1)) [[unlikely]] {
+      return false;
+    }
+
+    // This branch always compiles away if the above branch wasn't removed.
+    if ((!IsValueInRangeForNumericType<Promotion>(x) ||
+         !IsValueInRangeForNumericType<Promotion>(y)) &&
+        x) [[unlikely]] {
+      return false;
+    }
+
+    const Promotion presult = Promotion(x) / Promotion(y);
+    if (!IsValueInRangeForNumericType<V>(presult)) {
+      return false;
+    }
+    *result = static_cast<V>(presult);
+    return true;
+  }
+};
+
+template <typename T, typename U>
+struct CheckedModOp {};
+
+template <typename T, typename U>
+  requires(std::integral<T> && std::integral<U>)
+struct CheckedModOp<T, U> {
+  using result_type = MaxExponentPromotion<T, U>;
+  template <typename V>
+  static constexpr bool Do(T x, U y, V* result) {
+    if (!y) [[unlikely]] {
+      return false;
+    }
+
+    using Promotion = BigEnoughPromotion<T, U>;
+    if (std::is_signed_v<T> && std::is_signed_v<U> &&
+        kIsTypeInRangeForNumericType<T, Promotion> &&
+        static_cast<Promotion>(x) == std::numeric_limits<Promotion>::lowest() &&
+        y == static_cast<U>(-1)) [[unlikely]] {
+      *result = 0;
+      return true;
+    }
+
+    const Promotion presult =
+        static_cast<Promotion>(x) % static_cast<Promotion>(y);
+    if (!IsValueInRangeForNumericType<V>(presult)) {
+      return false;
+    }
+    *result = static_cast<Promotion>(presult);
+    return true;
+  }
+};
+
+template <typename T, typename U>
+struct CheckedLshOp {};
+
+// Left shift. Shifts less than 0 or greater than or equal to the number
+// of bits in the promoted type are undefined. Shifts of negative values
+// are undefined. Otherwise it is defined when the result fits.
+template <typename T, typename U>
+  requires(std::integral<T> && std::integral<U>)
+struct CheckedLshOp<T, U> {
+  using result_type = T;
+  template <typename V>
+  static constexpr bool Do(T x, U shift, V* result) {
+    // Disallow negative numbers and verify the shift is in bounds.
+    if (!IsValueNegative(x) &&
+        as_unsigned(shift) < as_unsigned(std::numeric_limits<T>::digits))
+        [[likely]] {
+      // Shift as unsigned to avoid undefined behavior.
+      *result = static_cast<V>(as_unsigned(x) << shift);
+      // If the shift can be reversed, we know it was valid.
+      return *result >> shift == x;
+    }
+
+    // Handle the legal corner-case of a full-width signed shift of zero.
+    if (!std::is_signed_v<T> || x ||
+        as_unsigned(shift) != as_unsigned(std::numeric_limits<T>::digits)) {
+      return false;
+    }
+    *result = 0;
+    return true;
+  }
+};
+
+template <typename T, typename U>
+struct CheckedRshOp {};
+
+// Right shift. Shifts less than 0 or greater than or equal to the number
+// of bits in the promoted type are undefined. Otherwise, it is always defined,
+// but a right shift of a negative value is implementation-dependent.
+template <typename T, typename U>
+  requires(std::integral<T> && std::integral<U>)
+struct CheckedRshOp<T, U> {
+  using result_type = T;
+  template <typename V>
+  static constexpr bool Do(T x, U shift, V* result) {
+    // Use sign conversion to push negative values out of range.
+    if (as_unsigned(shift) >= kIntegerBitsPlusSign<T>) [[unlikely]] {
+      return false;
+    }
+
+    const T tmp = x >> shift;
+    if (!IsValueInRangeForNumericType<V>(tmp)) {
+      return false;
+    }
+    *result = static_cast<V>(tmp);
+    return true;
+  }
+};
+
+template <typename T, typename U>
+struct CheckedAndOp {};
+
+// For simplicity we support only unsigned integer results.
+template <typename T, typename U>
+  requires(std::integral<T> && std::integral<U>)
+struct CheckedAndOp<T, U> {
+  using result_type = std::make_unsigned_t<MaxExponentPromotion<T, U>>;
+  template <typename V>
+  static constexpr bool Do(T x, U y, V* result) {
+    const result_type tmp =
+        static_cast<result_type>(x) & static_cast<result_type>(y);
+    if (!IsValueInRangeForNumericType<V>(tmp)) {
+      return false;
+    }
+    *result = static_cast<V>(tmp);
+    return true;
+  }
+};
+
+template <typename T, typename U>
+struct CheckedOrOp {};
+
+// For simplicity we support only unsigned integers.
+template <typename T, typename U>
+  requires(std::integral<T> && std::integral<U>)
+struct CheckedOrOp<T, U> {
+  using result_type = std::make_unsigned_t<MaxExponentPromotion<T, U>>;
+  template <typename V>
+  static constexpr bool Do(T x, U y, V* result) {
+    const result_type tmp =
+        static_cast<result_type>(x) | static_cast<result_type>(y);
+    if (!IsValueInRangeForNumericType<V>(tmp)) {
+      return false;
+    }
+    *result = static_cast<V>(tmp);
+    return true;
+  }
+};
+
+template <typename T, typename U>
+struct CheckedXorOp {};
+
+// For simplicity we support only unsigned integers.
+template <typename T, typename U>
+  requires(std::integral<T> && std::integral<U>)
+struct CheckedXorOp<T, U> {
+  using result_type = std::make_unsigned_t<MaxExponentPromotion<T, U>>;
+  template <typename V>
+  static constexpr bool Do(T x, U y, V* result) {
+    const result_type tmp =
+        static_cast<result_type>(x) ^ static_cast<result_type>(y);
+    if (!IsValueInRangeForNumericType<V>(tmp)) {
+      return false;
+    }
+    *result = static_cast<V>(tmp);
+    return true;
+  }
+};
+
+// Max doesn't really need to be implemented this way because it can't fail,
+// but it makes the code much cleaner to use the MathOp wrappers.
+template <typename T, typename U>
+struct CheckedMaxOp {};
+
+template <typename T, typename U>
+  requires(std::is_arithmetic_v<T> && std::is_arithmetic_v<U>)
+struct CheckedMaxOp<T, U> {
+  using result_type = MaxExponentPromotion<T, U>;
+  template <typename V>
+  static constexpr bool Do(T x, U y, V* result) {
+    const result_type tmp = IsGreater<T, U>::Test(x, y)
+                                ? static_cast<result_type>(x)
+                                : static_cast<result_type>(y);
+    if (!IsValueInRangeForNumericType<V>(tmp)) {
+      return false;
+    }
+    *result = static_cast<V>(tmp);
+    return true;
+  }
+};
+
+// Min doesn't really need to be implemented this way because it can't fail,
+// but it makes the code much cleaner to use the MathOp wrappers.
+template <typename T, typename U>
+struct CheckedMinOp {};
+
+template <typename T, typename U>
+  requires(std::is_arithmetic_v<T> && std::is_arithmetic_v<U>)
+struct CheckedMinOp<T, U> {
+  using result_type = LowestValuePromotion<T, U>;
+  template <typename V>
+  static constexpr bool Do(T x, U y, V* result) {
+    const result_type tmp = IsLess<T, U>::Test(x, y)
+                                ? static_cast<result_type>(x)
+                                : static_cast<result_type>(y);
+    if (!IsValueInRangeForNumericType<V>(tmp)) {
+      return false;
+    }
+    *result = static_cast<V>(tmp);
+    return true;
+  }
+};
+
+// This is just boilerplate that wraps the standard floating point arithmetic.
+// A macro isn't the nicest solution, but it beats rewriting these repeatedly.
+#define BASE_FLOAT_ARITHMETIC_OPS(NAME, OP)                        \
+  template <typename T, typename U>                                \
+    requires(std::floating_point<T> || std::floating_point<U>)     \
+  struct Checked##NAME##Op<T, U> {                                 \
+    using result_type = MaxExponentPromotion<T, U>;                \
+    template <typename V>                                          \
+    static constexpr bool Do(T x, U y, V* result) {                \
+      const result_type presult = x OP y;                          \
+      if (!IsValueInRangeForNumericType<V>(presult)) return false; \
+      *result = static_cast<V>(presult);                           \
+      return true;                                                 \
+    }                                                              \
+  };
+
+BASE_FLOAT_ARITHMETIC_OPS(Add, +)
+BASE_FLOAT_ARITHMETIC_OPS(Sub, -)
+BASE_FLOAT_ARITHMETIC_OPS(Mul, *)
+BASE_FLOAT_ARITHMETIC_OPS(Div, /)
+
+#undef BASE_FLOAT_ARITHMETIC_OPS
+
+// Floats carry around their validity state with them, but integers do not. So,
+// we wrap the underlying value in a specialization in order to hide that detail
+// and expose an interface via accessors.
+enum NumericRepresentation {
+  NUMERIC_INTEGER,
+  NUMERIC_FLOATING,
+  NUMERIC_UNKNOWN
+};
+
+template <typename NumericType>
+struct GetNumericRepresentation {
+  static const NumericRepresentation value =
+      std::integral<NumericType>
+          ? NUMERIC_INTEGER
+          : (std::floating_point<NumericType> ? NUMERIC_FLOATING
+                                              : NUMERIC_UNKNOWN);
+};
+
+template <typename T,
+          NumericRepresentation type = GetNumericRepresentation<T>::value>
+class CheckedNumericState {};
+
+// Integrals require quite a bit of additional housekeeping to manage state.
+template <typename T>
+class CheckedNumericState<T, NUMERIC_INTEGER> {
+ public:
+  template <typename Src = int>
+  constexpr explicit CheckedNumericState(Src value = 0, bool is_valid = true)
+      : is_valid_(is_valid && IsValueInRangeForNumericType<T>(value)),
+        value_(WellDefinedConversionOrZero(value, is_valid_)) {
+    static_assert(std::is_arithmetic_v<Src>, "Argument must be numeric.");
+  }
+
+  template <typename Src>
+  constexpr CheckedNumericState(const CheckedNumericState<Src>& rhs)
+      : CheckedNumericState(rhs.value(), rhs.is_valid()) {}
+
+  constexpr bool is_valid() const { return is_valid_; }
+
+  constexpr T value() const { return value_; }
+
+ private:
+  // Ensures that a type conversion does not trigger undefined behavior.
+  template <typename Src>
+  static constexpr T WellDefinedConversionOrZero(Src value, bool is_valid) {
+    return (std::integral<UnderlyingType<Src>> || is_valid)
+               ? static_cast<T>(value)
+               : 0;
+  }
+
+  // is_valid_ precedes value_ because member initializers in the constructors
+  // are evaluated in field order, and is_valid_ must be read when initializing
+  // value_.
+  bool is_valid_;
+  T value_;
+};
+
+// Floating points maintain their own validity, but need translation wrappers.
+template <typename T>
+class CheckedNumericState<T, NUMERIC_FLOATING> {
+ public:
+  template <typename Src = double>
+  constexpr explicit CheckedNumericState(Src value = 0.0, bool is_valid = true)
+      : value_(WellDefinedConversionOrNaN(
+            value, is_valid && IsValueInRangeForNumericType<T>(value))) {}
+
+  template <typename Src>
+  constexpr CheckedNumericState(const CheckedNumericState<Src>& rhs)
+      : CheckedNumericState(rhs.value(), rhs.is_valid()) {}
+
+  constexpr bool is_valid() const {
+    // Written this way because std::isfinite is not constexpr before C++23.
+    // TODO(C++23): Use `std::isfinite()` unconditionally.
+    return std::is_constant_evaluated()
+               ? value_ <= std::numeric_limits<T>::max() &&
+                     value_ >= std::numeric_limits<T>::lowest()
+               : std::isfinite(value_);
+  }
+
+  constexpr T value() const { return value_; }
+
+ private:
+  // Ensures that a type conversion does not trigger undefined behavior.
+  template <typename Src>
+  static constexpr T WellDefinedConversionOrNaN(Src value, bool is_valid) {
+    return (kStaticDstRangeRelationToSrcRange<T, UnderlyingType<Src>> ==
+                NumericRangeRepresentation::kContained ||
+            is_valid)
+               ? static_cast<T>(value)
+               : std::numeric_limits<T>::quiet_NaN();
+  }
+
+  T value_;
+};
+
+}  // namespace internal
+}  // namespace v8::base
+
+#endif  // V8_BASE_NUMERICS_CHECKED_MATH_IMPL_H_
diff --git a/deps/v8/src/base/numerics/clamped_math.h b/deps/v8/src/base/numerics/clamped_math.h
new file mode 100644
index 00000000000000..e7bd468c0e9c88
--- /dev/null
+++ b/deps/v8/src/base/numerics/clamped_math.h
@@ -0,0 +1,247 @@
+// Copyright 2017 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Slightly adapted for inclusion in V8.
+// Copyright 2025 the V8 project authors. All rights reserved.
+
+#ifndef V8_BASE_NUMERICS_CLAMPED_MATH_H_
+#define V8_BASE_NUMERICS_CLAMPED_MATH_H_
+
+#include <type_traits>
+
+#include "src/base/numerics/clamped_math_impl.h"  // IWYU pragma: export
+#include "src/base/numerics/safe_conversions.h"
+#include "src/base/numerics/safe_math_shared_impl.h"  // IWYU pragma: export
+
+namespace v8::base {
+namespace internal {
+
+template <typename T>
+  requires std::is_arithmetic_v<T>
+class ClampedNumeric {
+ public:
+  using type = T;
+
+  constexpr ClampedNumeric() = default;
+
+  // Copy constructor.
+  template <typename Src>
+  constexpr ClampedNumeric(const ClampedNumeric<Src>& rhs)
+      : value_(saturated_cast<T>(rhs.value_)) {}
+
+  // This is not an explicit constructor because we implicitly upgrade regular
+  // numerics to ClampedNumerics to make them easier to use.
+  template <typename Src>
+    requires(IsNumeric<Src>)
+  // NOLINTNEXTLINE(runtime/explicit)
+  constexpr ClampedNumeric(Src value) : value_(saturated_cast<T>(value)) {}
+
+  // This is not an explicit constructor because we want a seamless conversion
+  // from StrictNumeric types.
+  template <typename Src>
+  // NOLINTNEXTLINE(runtime/explicit)
+  constexpr ClampedNumeric(StrictNumeric<Src> value)
+      : value_(saturated_cast<T>(static_cast<Src>(value))) {}
+
+  // Returns a ClampedNumeric of the specified type, cast from the current
+  // ClampedNumeric, and saturated to the destination type.
+  template <typename Dst>
+  constexpr ClampedNumeric<UnderlyingType<Dst>> Cast() const {
+    return *this;
+  }
+
+  // Prototypes for the supported arithmetic operator overloads.
+  template <typename Src>
+  constexpr ClampedNumeric& operator+=(const Src rhs);
+  template <typename Src>
+  constexpr ClampedNumeric& operator-=(const Src rhs);
+  template <typename Src>
+  constexpr ClampedNumeric& operator*=(const Src rhs);
+  template <typename Src>
+  constexpr ClampedNumeric& operator/=(const Src rhs);
+  template <typename Src>
+  constexpr ClampedNumeric& operator%=(const Src rhs);
+  template <typename Src>
+  constexpr ClampedNumeric& operator<<=(const Src rhs);
+  template <typename Src>
+  constexpr ClampedNumeric& operator>>=(const Src rhs);
+  template <typename Src>
+  constexpr ClampedNumeric& operator&=(const Src rhs);
+  template <typename Src>
+  constexpr ClampedNumeric& operator|=(const Src rhs);
+  template <typename Src>
+  constexpr ClampedNumeric& operator^=(const Src rhs);
+
+  constexpr ClampedNumeric operator-() const {
+    // The negation of two's complement int min is int min, so that's the
+    // only overflow case where we will saturate.
+    return ClampedNumeric<T>(SaturatedNegWrapper(value_));
+  }
+
+  constexpr ClampedNumeric operator~() const {
+    return ClampedNumeric<decltype(InvertWrapper(T()))>(InvertWrapper(value_));
+  }
+
+  constexpr ClampedNumeric Abs() const {
+    // The negation of two's complement int min is int min, so that's the
+    // only overflow case where we will saturate.
+    return ClampedNumeric<T>(SaturatedAbsWrapper(value_));
+  }
+
+  template <typename U>
+  constexpr ClampedNumeric<typename MathWrapper<ClampedMaxOp, T, U>::type> Max(
+      U rhs) const {
+    using result_type = typename MathWrapper<ClampedMaxOp, T, U>::type;
+    return ClampedNumeric<result_type>(
+        ClampedMaxOp<T, U>::Do(value_, Wrapper<U>::value(rhs)));
+  }
+
+  template <typename U>
+  constexpr ClampedNumeric<typename MathWrapper<ClampedMinOp, T, U>::type> Min(
+      U rhs) const {
+    using result_type = typename MathWrapper<ClampedMinOp, T, U>::type;
+    return ClampedNumeric<result_type>(
+        ClampedMinOp<T, U>::Do(value_, Wrapper<U>::value(rhs)));
+  }
+
+  // This function is available only for integral types. It returns an unsigned
+  // integer of the same width as the source type, containing the absolute value
+  // of the source, and properly handling signed min.
+  constexpr ClampedNumeric<typename UnsignedOrFloatForSize<T>::type>
+  UnsignedAbs() const {
+    return ClampedNumeric<typename UnsignedOrFloatForSize<T>::type>(
+        SafeUnsignedAbs(value_));
+  }
+
+  constexpr ClampedNumeric& operator++() {
+    *this += 1;
+    return *this;
+  }
+
+  constexpr ClampedNumeric operator++(int) {
+    ClampedNumeric value = *this;
+    *this += 1;
+    return value;
+  }
+
+  constexpr ClampedNumeric& operator--() {
+    *this -= 1;
+    return *this;
+  }
+
+  constexpr ClampedNumeric operator--(int) {
+    ClampedNumeric value = *this;
+    *this -= 1;
+    return value;
+  }
+
+  // These perform the actual math operations on the ClampedNumerics.
+  // Binary arithmetic operations.
+  template <template <typename, typename> class M, typename L, typename R>
+  static constexpr ClampedNumeric MathOp(L lhs, R rhs) {
+    using Math = typename MathWrapper<M, L, R>::math;
+    return ClampedNumeric<T>(
+        Math::template Do<T>(Wrapper<L>::value(lhs), Wrapper<R>::value(rhs)));
+  }
+
+  // Assignment arithmetic operations.
+  template <template <typename, typename> class M, typename R>
+  constexpr ClampedNumeric& MathOp(R rhs) {
+    using Math = typename MathWrapper<M, T, R>::math;
+    *this =
+        ClampedNumeric<T>(Math::template Do<T>(value_, Wrapper<R>::value(rhs)));
+    return *this;
+  }
+
+  template <typename Dst>
+    requires std::is_arithmetic_v<ArithmeticOrUnderlyingEnum<Dst>>
+  constexpr operator Dst() const {  // NOLINT(runtime/explicit)
+    return saturated_cast<ArithmeticOrUnderlyingEnum<Dst>>(value_);
+  }
+
+  // This method extracts the raw integer value without saturating it to the
+  // destination type as the conversion operator does. This is useful when
+  // e.g. assigning to an auto type or passing as a deduced template parameter.
+  constexpr T RawValue() const { return value_; }
+
+ private:
+  template <typename U>
+    requires std::is_arithmetic_v<U>
+  friend class ClampedNumeric;
+
+  T value_ = 0;
+
+  // These wrappers allow us to handle state the same way for both
+  // ClampedNumeric and POD arithmetic types.
+  template <typename Src>
+  struct Wrapper {
+    static constexpr UnderlyingType<Src> value(Src value) { return value; }
+  };
+};
+
+template <typename T>
+ClampedNumeric(T) -> ClampedNumeric<T>;
+
+// Convenience wrapper to return a new ClampedNumeric from the provided
+// arithmetic or ClampedNumericType.
+template <typename T>
+constexpr ClampedNumeric<UnderlyingType<T>> MakeClampedNum(T value) {
+  return value;
+}
+
+// These implement the variadic wrapper for the math operations.
+template <template <typename, typename> class M, typename L, typename R>
+constexpr ClampedNumeric<typename MathWrapper<M, L, R>::type> ClampMathOp(
+    L lhs, R rhs) {
+  using Math = typename MathWrapper<M, L, R>::math;
+  return ClampedNumeric<typename Math::result_type>::template MathOp<M>(lhs,
+                                                                        rhs);
+}
+
+// General purpose wrapper template for arithmetic operations.
+template <template <typename, typename> class M, typename L, typename R,
+          typename... Args>
+constexpr auto ClampMathOp(L lhs, R rhs, Args... args) {
+  return ClampMathOp<M>(ClampMathOp<M>(lhs, rhs), args...);
+}
+
+BASE_NUMERIC_ARITHMETIC_OPERATORS(Clamped, Clamp, Add, +, +=)
+BASE_NUMERIC_ARITHMETIC_OPERATORS(Clamped, Clamp, Sub, -, -=)
+BASE_NUMERIC_ARITHMETIC_OPERATORS(Clamped, Clamp, Mul, *, *=)
+BASE_NUMERIC_ARITHMETIC_OPERATORS(Clamped, Clamp, Div, /, /=)
+BASE_NUMERIC_ARITHMETIC_OPERATORS(Clamped, Clamp, Mod, %, %=)
+BASE_NUMERIC_ARITHMETIC_OPERATORS(Clamped, Clamp, Lsh, <<, <<=)
+BASE_NUMERIC_ARITHMETIC_OPERATORS(Clamped, Clamp, Rsh, >>, >>=)
+BASE_NUMERIC_ARITHMETIC_OPERATORS(Clamped, Clamp, And, &, &=)
+BASE_NUMERIC_ARITHMETIC_OPERATORS(Clamped, Clamp, Or, |, |=)
+BASE_NUMERIC_ARITHMETIC_OPERATORS(Clamped, Clamp, Xor, ^, ^=)
+BASE_NUMERIC_ARITHMETIC_VARIADIC(Clamped, Clamp, Max)
+BASE_NUMERIC_ARITHMETIC_VARIADIC(Clamped, Clamp, Min)
+BASE_NUMERIC_COMPARISON_OPERATORS(Clamped, IsLess, <)
+BASE_NUMERIC_COMPARISON_OPERATORS(Clamped, IsLessOrEqual, <=)
+BASE_NUMERIC_COMPARISON_OPERATORS(Clamped, IsGreater, >)
+BASE_NUMERIC_COMPARISON_OPERATORS(Clamped, IsGreaterOrEqual, >=)
+BASE_NUMERIC_COMPARISON_OPERATORS(Clamped, IsEqual, ==)
+BASE_NUMERIC_COMPARISON_OPERATORS(Clamped, IsNotEqual, !=)
+
+}  // namespace internal
+
+using internal::ClampAdd;
+using internal::ClampAnd;
+using internal::ClampDiv;
+using internal::ClampedNumeric;
+using internal::ClampLsh;
+using internal::ClampMax;
+using internal::ClampMin;
+using internal::ClampMod;
+using internal::ClampMul;
+using internal::ClampOr;
+using internal::ClampRsh;
+using internal::ClampSub;
+using internal::ClampXor;
+using internal::MakeClampedNum;
+
+}  // namespace v8::base
+
+#endif  // V8_BASE_NUMERICS_CLAMPED_MATH_H_
diff --git a/deps/v8/src/base/numerics/clamped_math_impl.h b/deps/v8/src/base/numerics/clamped_math_impl.h
new file mode 100644
index 00000000000000..6f7cf1731cf7ab
--- /dev/null
+++ b/deps/v8/src/base/numerics/clamped_math_impl.h
@@ -0,0 +1,304 @@
+// Copyright 2017 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Slightly adapted for inclusion in V8.
+// Copyright 2025 the V8 project authors. All rights reserved.
+
+#ifndef V8_BASE_NUMERICS_CLAMPED_MATH_IMPL_H_
+#define V8_BASE_NUMERICS_CLAMPED_MATH_IMPL_H_
+
+// IWYU pragma: private, include "src/base/numerics/clamped_math.h"
+
+#include <concepts>
+#include <limits>
+#include <type_traits>
+
+#include "src/base/numerics/checked_math.h"
+#include "src/base/numerics/safe_conversions.h"
+#include "src/base/numerics/safe_math_shared_impl.h"  // IWYU pragma: export
+
+namespace v8::base {
+namespace internal {
+
+template <typename T>
+  requires(std::signed_integral<T>)
+constexpr T SaturatedNegWrapper(T value) {
+  return std::is_constant_evaluated() || !ClampedNegFastOp<T>::is_supported
+             ? (NegateWrapper(value) != std::numeric_limits<T>::lowest()
+                    ? NegateWrapper(value)
+                    : std::numeric_limits<T>::max())
+             : ClampedNegFastOp<T>::Do(value);
+}
+
+template <typename T>
+  requires(std::unsigned_integral<T>)
+constexpr T SaturatedNegWrapper(T value) {
+  return T(0);
+}
+
+template <typename T>
+  requires(std::floating_point<T>)
+constexpr T SaturatedNegWrapper(T value) {
+  return -value;
+}
+
+template <typename T>
+  requires(std::integral<T>)
+constexpr T SaturatedAbsWrapper(T value) {
+  // The calculation below is a static identity for unsigned types, but for
+  // signed integer types it provides a non-branching, saturated absolute value.
+  // This works because SafeUnsignedAbs() returns an unsigned type, which can
+  // represent the absolute value of all negative numbers of an equal-width
+  // integer type. The call to IsValueNegative() then detects overflow in the
+  // special case of numeric_limits<T>::min(), by evaluating the bit pattern as
+  // a signed integer value. If it is the overflow case, we end up subtracting
+  // one from the unsigned result, thus saturating to numeric_limits<T>::max().
+  return static_cast<T>(
+      SafeUnsignedAbs(value) -
+      IsValueNegative<T>(static_cast<T>(SafeUnsignedAbs(value))));
+}
+
+template <typename T>
+  requires(std::floating_point<T>)
+constexpr T SaturatedAbsWrapper(T value) {
+  return value < 0 ? -value : value;
+}
+
+template <typename T, typename U>
+struct ClampedAddOp {};
+
+template <typename T, typename U>
+  requires(std::integral<T> && std::integral<U>)
+struct ClampedAddOp<T, U> {
+  using result_type = MaxExponentPromotion<T, U>;
+  template <typename V = result_type>
+    requires(std::same_as<V, result_type> || kIsTypeInRangeForNumericType<U, V>)
+  static constexpr V Do(T x, U y) {
+    if (!std::is_constant_evaluated() && ClampedAddFastOp<T, U>::is_supported) {
+      return ClampedAddFastOp<T, U>::template Do<V>(x, y);
+    }
+    const V saturated = CommonMaxOrMin<V>(IsValueNegative(y));
+    V result = {};
+    if (CheckedAddOp<T, U>::Do(x, y, &result)) [[likely]] {
+      return result;
+    }
+    return saturated;
+  }
+};
+
+template <typename T, typename U>
+struct ClampedSubOp {};
+
+template <typename T, typename U>
+  requires(std::integral<T> && std::integral<U>)
+struct ClampedSubOp<T, U> {
+  using result_type = MaxExponentPromotion<T, U>;
+  template <typename V = result_type>
+    requires(std::same_as<V, result_type> || kIsTypeInRangeForNumericType<U, V>)
+  static constexpr V Do(T x, U y) {
+    if (!std::is_constant_evaluated() && ClampedSubFastOp<T, U>::is_supported) {
+      return ClampedSubFastOp<T, U>::template Do<V>(x, y);
+    }
+    const V saturated = CommonMaxOrMin<V>(!IsValueNegative(y));
+    V result = {};
+    if (CheckedSubOp<T, U>::Do(x, y, &result)) [[likely]] {
+      return result;
+    }
+    return saturated;
+  }
+};
+
+template <typename T, typename U>
+struct ClampedMulOp {};
+
+template <typename T, typename U>
+  requires(std::integral<T> && std::integral<U>)
+struct ClampedMulOp<T, U> {
+  using result_type = MaxExponentPromotion<T, U>;
+  template <typename V = result_type>
+  static constexpr V Do(T x, U y) {
+    if (!std::is_constant_evaluated() && ClampedMulFastOp<T, U>::is_supported) {
+      return ClampedMulFastOp<T, U>::template Do<V>(x, y);
+    }
+    V result = {};
+    const V saturated =
+        CommonMaxOrMin<V>(IsValueNegative(x) ^ IsValueNegative(y));
+    if (CheckedMulOp<T, U>::Do(x, y, &result)) [[likely]] {
+      return result;
+    }
+    return saturated;
+  }
+};
+
+template <typename T, typename U>
+struct ClampedDivOp {};
+
+template <typename T, typename U>
+  requires(std::integral<T> && std::integral<U>)
+struct ClampedDivOp<T, U> {
+  using result_type = MaxExponentPromotion<T, U>;
+  template <typename V = result_type>
+  static constexpr V Do(T x, U y) {
+    V result = {};
+    if ((CheckedDivOp<T, U>::Do(x, y, &result))) [[likely]] {
+      return result;
+    }
+    // Saturation goes to max, min, or NaN (if x is zero).
+    return x ? CommonMaxOrMin<V>(IsValueNegative(x) ^ IsValueNegative(y))
+             : SaturationDefaultLimits<V>::NaN();
+  }
+};
+
+template <typename T, typename U>
+struct ClampedModOp {};
+
+template <typename T, typename U>
+  requires(std::integral<T> && std::integral<U>)
+struct ClampedModOp<T, U> {
+  using result_type = MaxExponentPromotion<T, U>;
+  template <typename V = result_type>
+  static constexpr V Do(T x, U y) {
+    V result = {};
+    if (CheckedModOp<T, U>::Do(x, y, &result)) [[likely]] {
+      return result;
+    }
+    return x;
+  }
+};
+
+template <typename T, typename U>
+struct ClampedLshOp {};
+
+// Left shift. Non-zero values saturate in the direction of the sign. A zero
+// shifted by any value always results in zero.
+template <typename T, typename U>
+  requires(std::integral<T> && std::unsigned_integral<U>)
+struct ClampedLshOp<T, U> {
+  using result_type = T;
+  template <typename V = result_type>
+  static constexpr V Do(T x, U shift) {
+    if (shift < std::numeric_limits<T>::digits) [[likely]] {
+      // Shift as unsigned to avoid undefined behavior.
+      V result = static_cast<V>(as_unsigned(x) << shift);
+      // If the shift can be reversed, we know it was valid.
+      if (result >> shift == x) [[likely]] {
+        return result;
+      }
+    }
+    return x ? CommonMaxOrMin<V>(IsValueNegative(x)) : 0;
+  }
+};
+
+template <typename T, typename U>
+struct ClampedRshOp {};
+
+// Right shift. Negative values saturate to -1. Positive or 0 saturates to 0.
+template <typename T, typename U>
+  requires(std::integral<T> && std::unsigned_integral<U>)
+struct ClampedRshOp<T, U> {
+  using result_type = T;
+  template <typename V = result_type>
+  static constexpr V Do(T x, U shift) {
+    // Signed right shift is odd, because it saturates to -1 or 0.
+    const V saturated = as_unsigned(V(0)) - IsValueNegative(x);
+    if (shift < kIntegerBitsPlusSign<T>) [[likely]] {
+      return saturated_cast<V>(x >> shift);
+    }
+    return saturated;
+  }
+};
+
+template <typename T, typename U>
+struct ClampedAndOp {};
+
+template <typename T, typename U>
+  requires(std::integral<T> && std::integral<U>)
+struct ClampedAndOp<T, U> {
+  using result_type = std::make_unsigned_t<MaxExponentPromotion<T, U>>;
+  template <typename V>
+  static constexpr V Do(T x, U y) {
+    return static_cast<result_type>(x) & static_cast<result_type>(y);
+  }
+};
+
+template <typename T, typename U>
+struct ClampedOrOp {};
+
+// For simplicity we promote to unsigned integers.
+template <typename T, typename U>
+  requires(std::integral<T> && std::integral<U>)
+struct ClampedOrOp<T, U> {
+  using result_type = std::make_unsigned_t<MaxExponentPromotion<T, U>>;
+  template <typename V>
+  static constexpr V Do(T x, U y) {
+    return static_cast<result_type>(x) | static_cast<result_type>(y);
+  }
+};
+
+template <typename T, typename U>
+struct ClampedXorOp {};
+
+// For simplicity we support only unsigned integers.
+template <typename T, typename U>
+  requires(std::integral<T> && std::integral<U>)
+struct ClampedXorOp<T, U> {
+  using result_type = std::make_unsigned_t<MaxExponentPromotion<T, U>>;
+  template <typename V>
+  static constexpr V Do(T x, U y) {
+    return static_cast<result_type>(x) ^ static_cast<result_type>(y);
+  }
+};
+
+template <typename T, typename U>
+struct ClampedMaxOp {};
+
+template <typename T, typename U>
+  requires(std::is_arithmetic_v<T> && std::is_arithmetic_v<U>)
+struct ClampedMaxOp<T, U> {
+  using result_type = MaxExponentPromotion<T, U>;
+  template <typename V = result_type>
+  static constexpr V Do(T x, U y) {
+    return IsGreater<T, U>::Test(x, y) ? saturated_cast<V>(x)
+                                       : saturated_cast<V>(y);
+  }
+};
+
+template <typename T, typename U>
+struct ClampedMinOp {};
+
+template <typename T, typename U>
+  requires(std::is_arithmetic_v<T> && std::is_arithmetic_v<U>)
+struct ClampedMinOp<T, U> {
+  using result_type = LowestValuePromotion<T, U>;
+  template <typename V = result_type>
+  static constexpr V Do(T x, U y) {
+    return IsLess<T, U>::Test(x, y) ? saturated_cast<V>(x)
+                                    : saturated_cast<V>(y);
+  }
+};
+
+// This is just boilerplate that wraps the standard floating point arithmetic.
+// A macro isn't the nicest solution, but it beats rewriting these repeatedly.
+#define BASE_FLOAT_ARITHMETIC_OPS(NAME, OP)                    \
+  template <typename T, typename U>                            \
+    requires(std::floating_point<T> || std::floating_point<U>) \
+  struct Clamped##NAME##Op<T, U> {                             \
+    using result_type = MaxExponentPromotion<T, U>;            \
+    template <typename V = result_type>                        \
+    static constexpr V Do(T x, U y) {                          \
+      return saturated_cast<V>(x OP y);                        \
+    }                                                          \
+  };
+
+BASE_FLOAT_ARITHMETIC_OPS(Add, +)
+BASE_FLOAT_ARITHMETIC_OPS(Sub, -)
+BASE_FLOAT_ARITHMETIC_OPS(Mul, *)
+BASE_FLOAT_ARITHMETIC_OPS(Div, /)
+
+#undef BASE_FLOAT_ARITHMETIC_OPS
+
+}  // namespace internal
+}  // namespace v8::base
+
+#endif  // V8_BASE_NUMERICS_CLAMPED_MATH_IMPL_H_
diff --git a/deps/v8/src/base/numerics/integral_constant_like.h b/deps/v8/src/base/numerics/integral_constant_like.h
new file mode 100644
index 00000000000000..072cfea36b3350
--- /dev/null
+++ b/deps/v8/src/base/numerics/integral_constant_like.h
@@ -0,0 +1,28 @@
+// Copyright 2024 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Slightly adapted for inclusion in V8.
+// Copyright 2025 the V8 project authors. All rights reserved.
+
+#ifndef V8_BASE_NUMERICS_INTEGRAL_CONSTANT_LIKE_H_
+#define V8_BASE_NUMERICS_INTEGRAL_CONSTANT_LIKE_H_
+
+#include <concepts>
+#include <type_traits>
+
+namespace v8::base {
+
+// Exposition-only concept from [span.syn]
+template <typename T>
+concept IntegralConstantLike =
+    std::is_integral_v<decltype(T::value)> &&
+    !std::is_same_v<bool, std::remove_const_t<decltype(T::value)>> &&
+    std::convertible_to<T, decltype(T::value)> &&
+    std::equality_comparable_with<T, decltype(T::value)> &&
+    std::bool_constant<T() == T::value>::value &&
+    std::bool_constant<static_cast<decltype(T::value)>(T()) == T::value>::value;
+
+}  // namespace v8::base
+
+#endif  // V8_BASE_NUMERICS_INTEGRAL_CONSTANT_LIKE_H_
diff --git a/deps/v8/src/base/numerics/math_constants.h b/deps/v8/src/base/numerics/math_constants.h
new file mode 100644
index 00000000000000..2931ecde09588a
--- /dev/null
+++ b/deps/v8/src/base/numerics/math_constants.h
@@ -0,0 +1,18 @@
+// Copyright 2017 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Slightly adapted for inclusion in V8.
+// Copyright 2025 the V8 project authors. All rights reserved.
+
+#ifndef V8_BASE_NUMERICS_MATH_CONSTANTS_H_
+#define V8_BASE_NUMERICS_MATH_CONSTANTS_H_
+
+namespace v8::base {
+// The mean acceleration due to gravity on Earth in m/s^2.
+constexpr double kMeanGravityDouble = 9.80665;
+constexpr float kMeanGravityFloat = 9.80665f;
+
+}  // namespace v8::base
+
+#endif  // V8_BASE_NUMERICS_MATH_CONSTANTS_H_
diff --git a/deps/v8/src/base/numerics/ostream_operators.h b/deps/v8/src/base/numerics/ostream_operators.h
new file mode 100644
index 00000000000000..3b2acc92eb2b9e
--- /dev/null
+++ b/deps/v8/src/base/numerics/ostream_operators.h
@@ -0,0 +1,41 @@
+// Copyright 2021 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Slightly adapted for inclusion in V8.
+// Copyright 2025 the V8 project authors. All rights reserved.
+
+#ifndef V8_BASE_NUMERICS_OSTREAM_OPERATORS_H_
+#define V8_BASE_NUMERICS_OSTREAM_OPERATORS_H_
+
+#include <ostream>
+#include <type_traits>
+
+namespace v8::base {
+namespace internal {
+
+template <typename T>
+  requires std::is_arithmetic_v<T>
+class ClampedNumeric;
+template <typename T>
+  requires std::is_arithmetic_v<T>
+class StrictNumeric;
+
+// Overload the ostream output operator to make logging work nicely.
+template <typename T>
+std::ostream& operator<<(std::ostream& os, const StrictNumeric<T>& value) {
+  os << static_cast<T>(value);
+  return os;
+}
+
+// Overload the ostream output operator to make logging work nicely.
+template <typename T>
+std::ostream& operator<<(std::ostream& os, const ClampedNumeric<T>& value) {
+  os << static_cast<T>(value);
+  return os;
+}
+
+}  // namespace internal
+}  // namespace v8::base
+
+#endif  // V8_BASE_NUMERICS_OSTREAM_OPERATORS_H_
diff --git a/deps/v8/src/base/numerics/ranges.h b/deps/v8/src/base/numerics/ranges.h
new file mode 100644
index 00000000000000..5fa8b45d11ed6a
--- /dev/null
+++ b/deps/v8/src/base/numerics/ranges.h
@@ -0,0 +1,24 @@
+// Copyright 2017 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Slightly adapted for inclusion in V8.
+// Copyright 2025 the V8 project authors. All rights reserved.
+
+#ifndef V8_BASE_NUMERICS_RANGES_H_
+#define V8_BASE_NUMERICS_RANGES_H_
+
+#include <cmath>
+#include <type_traits>
+
+namespace v8::base {
+
+template <typename T>
+constexpr bool IsApproximatelyEqual(T lhs, T rhs, T tolerance) {
+  static_assert(std::is_arithmetic_v<T>, "Argument must be arithmetic");
+  return std::abs(rhs - lhs) <= tolerance;
+}
+
+}  // namespace v8::base
+
+#endif  // V8_BASE_NUMERICS_RANGES_H_
diff --git a/deps/v8/src/base/safe_conversions.h b/deps/v8/src/base/numerics/safe_conversions.h
similarity index 77%
rename from deps/v8/src/base/safe_conversions.h
rename to deps/v8/src/base/numerics/safe_conversions.h
index e47df8bc3a6084..e680cc2db5f1a5 100644
--- a/deps/v8/src/base/safe_conversions.h
+++ b/deps/v8/src/base/numerics/safe_conversions.h
@@ -1,17 +1,12 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
+// Copyright 2014 The Chromium Authors
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Slightly adapted for inclusion in V8.
-// Copyright 2014 the V8 project authors. All rights reserved.
-// List of adaptations:
-// - include guard names
-// - wrap in v8 namespace
-// - formatting (git cl format)
-// - include paths
+// Copyright 2025 the V8 project authors. All rights reserved.
 
-#ifndef V8_BASE_SAFE_CONVERSIONS_H_
-#define V8_BASE_SAFE_CONVERSIONS_H_
+#ifndef V8_BASE_NUMERICS_SAFE_CONVERSIONS_H_
+#define V8_BASE_NUMERICS_SAFE_CONVERSIONS_H_
 
 #include <stddef.h>
 
@@ -20,10 +15,10 @@
 #include <limits>
 #include <type_traits>
 
-#include "src/base/safe_conversions_impl.h"
+#include "src/base/numerics/safe_conversions_impl.h"  // IWYU pragma: export
 
 #if defined(__ARMEL__) && !defined(__native_client__)
-#include "src/base/safe_conversions_arm_impl.h"
+#include "src/base/numerics/safe_conversions_arm_impl.h"  // IWYU pragma: export
 #define BASE_HAS_OPTIMIZED_SAFE_CONVERSIONS (1)
 #else
 #define BASE_HAS_OPTIMIZED_SAFE_CONVERSIONS (0)
@@ -49,7 +44,7 @@ struct SaturateFastAsmOp {
 template <typename Dst, typename Src>
 struct IsValueInRangeFastOp {
   static constexpr bool is_supported = false;
-  static constexpr bool Do(Src value) {
+  static constexpr bool Do(Src) {
     // Force a compile failure if instantiated.
     return CheckOnFailure::template HandleFailure<bool>();
   }
@@ -58,7 +53,7 @@ struct IsValueInRangeFastOp {
 // Signed to signed range comparison.
 template <typename Dst, typename Src>
   requires(std::signed_integral<Dst> && std::signed_integral<Src> &&
-           !IsTypeInRangeForNumericType<Dst, Src>::value)
+           !kIsTypeInRangeForNumericType<Dst, Src>)
 struct IsValueInRangeFastOp<Dst, Src> {
   static constexpr bool is_supported = true;
 
@@ -72,27 +67,29 @@ struct IsValueInRangeFastOp<Dst, Src> {
 // Signed to unsigned range comparison.
 template <typename Dst, typename Src>
   requires(std::unsigned_integral<Dst> && std::signed_integral<Src> &&
-           !IsTypeInRangeForNumericType<Dst, Src>::value)
+           !kIsTypeInRangeForNumericType<Dst, Src>)
 struct IsValueInRangeFastOp<Dst, Src> {
   static constexpr bool is_supported = true;
 
   static constexpr bool Do(Src value) {
     // We cast a signed as unsigned to overflow negative values to the top,
     // then compare against whichever maximum is smaller, as our upper bound.
-    return as_unsigned(value) <= as_unsigned(CommonMax<Src, Dst>());
+    return as_unsigned(value) <= as_unsigned(kCommonMax<Src, Dst>);
   }
 };
 
 // Convenience function that returns true if the supplied value is in range
 // for the destination type.
 template <typename Dst, typename Src>
+  requires(IsNumeric<Src> && std::is_arithmetic_v<Dst> &&
+           std::numeric_limits<Dst>::lowest() < std::numeric_limits<Dst>::max())
 constexpr bool IsValueInRangeForNumericType(Src value) {
-  using SrcType = typename internal::UnderlyingType<Src>::type;
+  using SrcType = UnderlyingType<Src>;
+  const auto underlying_value = static_cast<SrcType>(value);
   return internal::IsValueInRangeFastOp<Dst, SrcType>::is_supported
              ? internal::IsValueInRangeFastOp<Dst, SrcType>::Do(
-                   static_cast<SrcType>(value))
-             : internal::DstRangeRelationToSrcRange<Dst>(
-                   static_cast<SrcType>(value))
+                   underlying_value)
+             : internal::DstRangeRelationToSrcRange<Dst>(underlying_value)
                    .IsValid();
 }
 
@@ -101,12 +98,13 @@ constexpr bool IsValueInRangeForNumericType(Src value) {
 // overflow or underflow. NaN source will always trigger a CHECK.
 template <typename Dst, class CheckHandler = internal::CheckOnFailure,
           typename Src>
+  requires(IsNumeric<Src> && std::is_arithmetic_v<Dst> &&
+           std::numeric_limits<Dst>::lowest() < std::numeric_limits<Dst>::max())
 constexpr Dst checked_cast(Src value) {
   // This throws a compile-time error on evaluating the constexpr if it can be
   // determined at compile-time as failing, otherwise it will CHECK at runtime.
-  using SrcType = typename internal::UnderlyingType<Src>::type;
   if (IsValueInRangeForNumericType<Dst>(value)) [[likely]] {
-    return static_cast<Dst>(static_cast<SrcType>(value));
+    return static_cast<Dst>(static_cast<UnderlyingType<Src>>(value));
   }
   return CheckHandler::template HandleFailure<Dst>();
 }
@@ -160,7 +158,7 @@ constexpr Dst saturated_cast_impl(Src value, RangeCheck constraint) {
 template <typename Dst, typename Src>
 struct SaturateFastOp {
   static constexpr bool is_supported = false;
-  static constexpr Dst Do(Src value) {
+  static constexpr Dst Do(Src) {
     // Force a compile failure if instantiated.
     return CheckOnFailure::template HandleFailure<Dst>();
   }
@@ -186,8 +184,8 @@ struct SaturateFastOp<Dst, Src> {
     // optimization heuristics across compilers. Do not change without
     // checking the emitted code.
     const Dst saturated = CommonMaxOrMin<Dst, Src>(
-        IsMaxInRangeForNumericType<Dst, Src>() ||
-        (!IsMinInRangeForNumericType<Dst, Src>() && IsValueNegative(value)));
+        kIsMaxInRangeForNumericType<Dst, Src> ||
+        (!kIsMinInRangeForNumericType<Dst, Src> && IsValueNegative(value)));
     if (IsValueInRangeForNumericType<Dst>(value)) [[likely]] {
       return static_cast<Dst>(value);
     }
@@ -203,54 +201,47 @@ template <typename Dst,
           template <typename> class SaturationHandler = SaturationDefaultLimits,
           typename Src>
 constexpr Dst saturated_cast(Src value) {
-  using SrcType = typename UnderlyingType<Src>::type;
-  return !IsConstantEvaluated() && SaturateFastOp<Dst, SrcType>::is_supported &&
+  using SrcType = UnderlyingType<Src>;
+  const auto underlying_value = static_cast<SrcType>(value);
+  return !std::is_constant_evaluated() &&
+                 SaturateFastOp<Dst, SrcType>::is_supported &&
                  std::is_same_v<SaturationHandler<Dst>,
                                 SaturationDefaultLimits<Dst>>
-             ? SaturateFastOp<Dst, SrcType>::Do(static_cast<SrcType>(value))
+             ? SaturateFastOp<Dst, SrcType>::Do(underlying_value)
              : saturated_cast_impl<Dst, SaturationHandler, SrcType>(
-                   static_cast<SrcType>(value),
+                   underlying_value,
                    DstRangeRelationToSrcRange<Dst, SaturationHandler, SrcType>(
-                       static_cast<SrcType>(value)));
+                       underlying_value));
 }
 
 // strict_cast<> is analogous to static_cast<> for numeric types, except that
 // it will cause a compile failure if the destination type is not large enough
 // to contain any value in the source type. It performs no runtime checking.
-template <typename Dst, typename Src>
+template <typename Dst, typename Src, typename SrcType = UnderlyingType<Src>>
+  requires(
+      IsNumeric<Src> && std::is_arithmetic_v<Dst> &&
+      // If you got here from a compiler error, it's because you tried to assign
+      // from a source type to a destination type that has insufficient range.
+      // The solution may be to change the destination type you're assigning to,
+      // and use one large enough to represent the source.
+      // Alternatively, you may be better served with the checked_cast<> or
+      // saturated_cast<> template functions for your particular use case.
+      kStaticDstRangeRelationToSrcRange<Dst, SrcType> ==
+          NumericRangeRepresentation::kContained)
 constexpr Dst strict_cast(Src value) {
-  using SrcType = typename UnderlyingType<Src>::type;
-  static_assert(UnderlyingType<Src>::is_numeric, "Argument must be numeric.");
-  static_assert(std::is_arithmetic_v<Dst>, "Result must be numeric.");
-
-  // If you got here from a compiler error, it's because you tried to assign
-  // from a source type to a destination type that has insufficient range.
-  // The solution may be to change the destination type you're assigning to,
-  // and use one large enough to represent the source.
-  // Alternatively, you may be better served with the checked_cast<> or
-  // saturated_cast<> template functions for your particular use case.
-  static_assert(StaticDstRangeRelationToSrcRange<Dst, SrcType>::value ==
-                    NUMERIC_RANGE_CONTAINED,
-                "The source type is out of range for the destination type. "
-                "Please see strict_cast<> comments for more information.");
-
   return static_cast<Dst>(static_cast<SrcType>(value));
 }
 
 // Some wrappers to statically check that a type is in range.
 template <typename Dst, typename Src>
-struct IsNumericRangeContained {
-  static constexpr bool value = false;
-};
+inline constexpr bool kIsNumericRangeContained = false;
 
 template <typename Dst, typename Src>
-  requires(ArithmeticOrUnderlyingEnum<Dst>::value &&
-           ArithmeticOrUnderlyingEnum<Src>::value)
-struct IsNumericRangeContained<Dst, Src> {
-  static constexpr bool value =
-      StaticDstRangeRelationToSrcRange<Dst, Src>::value ==
-      NUMERIC_RANGE_CONTAINED;
-};
+  requires(std::is_arithmetic_v<ArithmeticOrUnderlyingEnum<Dst>> &&
+           std::is_arithmetic_v<ArithmeticOrUnderlyingEnum<Src>>)
+inline constexpr bool kIsNumericRangeContained<Dst, Src> =
+    kStaticDstRangeRelationToSrcRange<Dst, Src> ==
+    NumericRangeRepresentation::kContained;
 
 // StrictNumeric implements compile time range checking between numeric types by
 // wrapping assignment operations in a strict_cast. This class is intended to be
@@ -263,6 +254,7 @@ struct IsNumericRangeContained<Dst, Src> {
 // runtime checking of any of the associated mathematical operations. Use
 // CheckedNumeric for runtime range checks of the actual value being assigned.
 template <typename T>
+  requires std::is_arithmetic_v<T>
 class StrictNumeric {
  public:
   using type = T;
@@ -274,12 +266,6 @@ class StrictNumeric {
   constexpr StrictNumeric(const StrictNumeric<Src>& rhs)
       : value_(strict_cast<T>(rhs.value_)) {}
 
-  // Strictly speaking, this is not necessary, but declaring this allows class
-  // template argument deduction to be used so that it is possible to simply
-  // write `StrictNumeric(777)` instead of `StrictNumeric<int>(777)`.
-  // NOLINTNEXTLINE(runtime/explicit)
-  constexpr StrictNumeric(T value) : value_(value) {}
-
   // This is not an explicit constructor because we implicitly upgrade regular
   // numerics to StrictNumerics to make them easier to use.
   template <typename Src>
@@ -299,32 +285,37 @@ class StrictNumeric {
   // If none of that works, you may be better served with the checked_cast<> or
   // saturated_cast<> template functions for your particular use case.
   template <typename Dst>
-    requires(IsNumericRangeContained<Dst, T>::value)
-  constexpr operator Dst() const {
-    return static_cast<typename ArithmeticOrUnderlyingEnum<Dst>::type>(value_);
+    requires(kIsNumericRangeContained<Dst, T>)
+  constexpr operator Dst() const {  // NOLINT(runtime/explicit)
+    return static_cast<ArithmeticOrUnderlyingEnum<Dst>>(value_);
   }
 
+  // Unary negation does not require any conversions.
+  constexpr bool operator!() const { return !value_; }
+
  private:
-  template <typename>
+  template <typename U>
+    requires std::is_arithmetic_v<U>
   friend class StrictNumeric;
 
   T value_;
 };
 
+template <typename T>
+StrictNumeric(T) -> StrictNumeric<T>;
+
 // Convenience wrapper returns a StrictNumeric from the provided arithmetic
 // type.
 template <typename T>
-constexpr StrictNumeric<typename UnderlyingType<T>::type> MakeStrictNum(
-    const T value) {
+constexpr StrictNumeric<UnderlyingType<T>> MakeStrictNum(const T value) {
   return value;
 }
 
-#define BASE_NUMERIC_COMPARISON_OPERATORS(CLASS, NAME, OP)          \
-  template <typename L, typename R>                                 \
-    requires(internal::Is##CLASS##Op<L, R>::value)                  \
-  constexpr bool operator OP(const L lhs, const R rhs) {            \
-    return SafeCompare<NAME, typename UnderlyingType<L>::type,      \
-                       typename UnderlyingType<R>::type>(lhs, rhs); \
+#define BASE_NUMERIC_COMPARISON_OPERATORS(CLASS, NAME, OP)                    \
+  template <typename L, typename R>                                           \
+    requires(internal::Is##CLASS##Op<L, R>)                                   \
+  constexpr bool operator OP(L lhs, R rhs) {                                  \
+    return SafeCompare<NAME, UnderlyingType<L>, UnderlyingType<R>>(lhs, rhs); \
   }
 
 BASE_NUMERIC_COMPARISON_OPERATORS(Strict, IsLess, <)
@@ -339,9 +330,9 @@ BASE_NUMERIC_COMPARISON_OPERATORS(Strict, IsNotEqual, !=)
 using internal::as_signed;
 using internal::as_unsigned;
 using internal::checked_cast;
-using internal::IsTypeInRangeForNumericType;
 using internal::IsValueInRangeForNumericType;
 using internal::IsValueNegative;
+using internal::kIsTypeInRangeForNumericType;
 using internal::MakeStrictNum;
 using internal::SafeUnsignedAbs;
 using internal::saturated_cast;
@@ -395,4 +386,4 @@ Dst ClampRound(Src value) {
 
 }  // namespace v8::base
 
-#endif  // V8_BASE_SAFE_CONVERSIONS_H_
+#endif  // V8_BASE_NUMERICS_SAFE_CONVERSIONS_H_
diff --git a/deps/v8/src/base/numerics/safe_conversions_arm_impl.h b/deps/v8/src/base/numerics/safe_conversions_arm_impl.h
new file mode 100644
index 00000000000000..8cf1e5ba517eb5
--- /dev/null
+++ b/deps/v8/src/base/numerics/safe_conversions_arm_impl.h
@@ -0,0 +1,56 @@
+// Copyright 2017 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Slightly adapted for inclusion in V8.
+// Copyright 2025 the V8 project authors. All rights reserved.
+
+#ifndef V8_BASE_NUMERICS_SAFE_CONVERSIONS_ARM_IMPL_H_
+#define V8_BASE_NUMERICS_SAFE_CONVERSIONS_ARM_IMPL_H_
+
+// IWYU pragma: private, include "src/base/numerics/safe_conversions.h"
+
+#include <stdint.h>
+
+#include <algorithm>
+#include <concepts>
+#include <type_traits>
+
+#include "src/base/numerics/safe_conversions_impl.h"
+
+namespace v8::base {
+namespace internal {
+
+// Fast saturation to a destination type.
+template <typename Dst, typename Src>
+struct SaturateFastAsmOp {
+  static constexpr bool is_supported =
+      kEnableAsmCode && std::signed_integral<Src> && std::integral<Dst> &&
+      kIntegerBitsPlusSign<Src> <= kIntegerBitsPlusSign<int32_t> &&
+      kIntegerBitsPlusSign<Dst> <= kIntegerBitsPlusSign<int32_t> &&
+      !kIsTypeInRangeForNumericType<Dst, Src>;
+
+  __attribute__((always_inline)) static Dst Do(Src value) {
+    int32_t src = value;
+    if constexpr (std::is_signed_v<Dst>) {
+      int32_t result;
+      asm("ssat %[dst], %[shift], %[src]"
+          : [dst] "=r"(result)
+          : [src] "r"(src), [shift] "n"(
+                                std::min(kIntegerBitsPlusSign<Dst>, 32)));
+      return static_cast<Dst>(result);
+    } else {
+      uint32_t result;
+      asm("usat %[dst], %[shift], %[src]"
+          : [dst] "=r"(result)
+          : [src] "r"(src), [shift] "n"(
+                                std::min(kIntegerBitsPlusSign<Dst>, 31)));
+      return static_cast<Dst>(result);
+    }
+  }
+};
+
+}  // namespace internal
+}  // namespace v8::base
+
+#endif  // V8_BASE_NUMERICS_SAFE_CONVERSIONS_ARM_IMPL_H_
diff --git a/deps/v8/src/base/numerics/safe_conversions_impl.h b/deps/v8/src/base/numerics/safe_conversions_impl.h
new file mode 100644
index 00000000000000..ad8621eddcfd36
--- /dev/null
+++ b/deps/v8/src/base/numerics/safe_conversions_impl.h
@@ -0,0 +1,697 @@
+// Copyright 2014 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Slightly adapted for inclusion in V8.
+// Copyright 2025 the V8 project authors. All rights reserved.
+
+#ifndef V8_BASE_NUMERICS_SAFE_CONVERSIONS_IMPL_H_
+#define V8_BASE_NUMERICS_SAFE_CONVERSIONS_IMPL_H_
+
+// IWYU pragma: private, include "src/base/numerics/safe_conversions.h"
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <concepts>
+#include <limits>
+#include <type_traits>
+#include <utility>
+
+#include "src/base/numerics/integral_constant_like.h"
+
+namespace v8::base::internal {
+
+// The std library doesn't provide a binary max_exponent for integers, however
+// we can compute an analog using std::numeric_limits<>::digits.
+template <typename NumericType>
+inline constexpr int kMaxExponent =
+    std::is_floating_point_v<NumericType>
+        ? std::numeric_limits<NumericType>::max_exponent
+        : std::numeric_limits<NumericType>::digits + 1;
+
+// The number of bits (including the sign) in an integer. Eliminates sizeof
+// hacks.
+template <typename NumericType>
+inline constexpr int kIntegerBitsPlusSign =
+    std::numeric_limits<NumericType>::digits + std::is_signed_v<NumericType>;
+
+// Determines if a numeric value is negative without throwing compiler
+// warnings on: unsigned(value) < 0.
+template <typename T>
+  requires(std::is_arithmetic_v<T>)
+constexpr bool IsValueNegative(T value) {
+  if constexpr (std::is_signed_v<T>) {
+    return value < 0;
+  } else {
+    return false;
+  }
+}
+
+// This performs a fast negation, returning a signed value. It works on unsigned
+// arguments, but probably doesn't do what you want for any unsigned value
+// larger than max / 2 + 1 (i.e. signed min cast to unsigned).
+template <typename T>
+  requires std::is_integral_v<T>
+constexpr auto ConditionalNegate(T x, bool is_negative) {
+  using SignedT = std::make_signed_t<T>;
+  using UnsignedT = std::make_unsigned_t<T>;
+  return static_cast<SignedT>((static_cast<UnsignedT>(x) ^
+                               static_cast<UnsignedT>(-SignedT(is_negative))) +
+                              is_negative);
+}
+
+// This performs a safe, absolute value via unsigned overflow.
+template <typename T>
+  requires std::is_integral_v<T>
+constexpr auto SafeUnsignedAbs(T value) {
+  using UnsignedT = std::make_unsigned_t<T>;
+  return IsValueNegative(value)
+             ? static_cast<UnsignedT>(0u - static_cast<UnsignedT>(value))
+             : static_cast<UnsignedT>(value);
+}
+
+// TODO(jschuh): Debug builds don't reliably propagate constants, so we restrict
+// some accelerated runtime paths to release builds until this can be forced
+// with consteval support in C++20 or C++23.
+#if defined(NDEBUG)
+inline constexpr bool kEnableAsmCode = true;
+#else
+inline constexpr bool kEnableAsmCode = false;
+#endif
+
+// Forces a crash, like a NOTREACHED(). Used for numeric boundary errors.
+// Also used in a constexpr template to trigger a compilation failure on
+// an error condition.
+struct CheckOnFailure {
+  template <typename T>
+  static T HandleFailure() {
+#if defined(_MSC_VER)
+    __debugbreak();
+#elif defined(__GNUC__) || defined(__clang__)
+    __builtin_trap();
+#else
+    ((void)(*(volatile char*)0 = 0));
+#endif
+    return T();
+  }
+};
+
+enum class IntegerRepresentation { kUnsigned, kSigned };
+
+// A range for a given nunmeric Src type is contained for a given numeric Dst
+// type if both numeric_limits<Src>::max() <= numeric_limits<Dst>::max() and
+// numeric_limits<Src>::lowest() >= numeric_limits<Dst>::lowest() are true.
+// We implement this as template specializations rather than simple static
+// comparisons to ensure type correctness in our comparisons.
+enum class NumericRangeRepresentation { kNotContained, kContained };
+
+// Helper templates to statically determine if our destination type can contain
+// maximum and minimum values represented by the source type.
+
+// Default case, used for same sign: Dst is guaranteed to contain Src only if
+// its range is equal or larger.
+template <typename Dst, typename Src,
+          IntegerRepresentation DstSign =
+              std::is_signed_v<Dst> ? IntegerRepresentation::kSigned
+                                    : IntegerRepresentation::kUnsigned,
+          IntegerRepresentation SrcSign =
+              std::is_signed_v<Src> ? IntegerRepresentation::kSigned
+                                    : IntegerRepresentation::kUnsigned>
+inline constexpr auto kStaticDstRangeRelationToSrcRange =
+    kMaxExponent<Dst> >= kMaxExponent<Src>
+        ? NumericRangeRepresentation::kContained
+        : NumericRangeRepresentation::kNotContained;
+
+// Unsigned to signed: Dst is guaranteed to contain source only if its range is
+// larger.
+template <typename Dst, typename Src>
+inline constexpr auto
+    kStaticDstRangeRelationToSrcRange<Dst, Src, IntegerRepresentation::kSigned,
+                                      IntegerRepresentation::kUnsigned> =
+        kMaxExponent<Dst> > kMaxExponent<Src>
+            ? NumericRangeRepresentation::kContained
+            : NumericRangeRepresentation::kNotContained;
+
+// Signed to unsigned: Dst cannot be statically determined to contain Src.
+template <typename Dst, typename Src>
+inline constexpr auto kStaticDstRangeRelationToSrcRange<
+    Dst, Src, IntegerRepresentation::kUnsigned,
+    IntegerRepresentation::kSigned> = NumericRangeRepresentation::kNotContained;
+
+// This class wraps the range constraints as separate booleans so the compiler
+// can identify constants and eliminate unused code paths.
+class RangeCheck {
+ public:
+  constexpr RangeCheck() = default;
+  constexpr RangeCheck(bool is_in_lower_bound, bool is_in_upper_bound)
+      : is_underflow_(!is_in_lower_bound), is_overflow_(!is_in_upper_bound) {}
+
+  constexpr bool operator==(const RangeCheck& rhs) const = default;
+
+  constexpr bool IsValid() const { return !is_overflow_ && !is_underflow_; }
+  constexpr bool IsInvalid() const { return is_overflow_ && is_underflow_; }
+  constexpr bool IsOverflow() const { return is_overflow_ && !is_underflow_; }
+  constexpr bool IsUnderflow() const { return !is_overflow_ && is_underflow_; }
+  constexpr bool IsOverflowFlagSet() const { return is_overflow_; }
+  constexpr bool IsUnderflowFlagSet() const { return is_underflow_; }
+
+ private:
+  // Do not change the order of these member variables. The integral conversion
+  // optimization depends on this exact order.
+  const bool is_underflow_ = false;
+  const bool is_overflow_ = false;
+};
+
+// The following helper template addresses a corner case in range checks for
+// conversion from a floating-point type to an integral type of smaller range
+// but larger precision (e.g. float -> unsigned). The problem is as follows:
+//   1. Integral maximum is always one less than a power of two, so it must be
+//      truncated to fit the mantissa of the floating point. The direction of
+//      rounding is implementation defined, but by default it's always IEEE
+//      floats, which round to nearest and thus result in a value of larger
+//      magnitude than the integral value.
+//      Example: float f = UINT_MAX; // f is 4294967296f but UINT_MAX
+//                                   // is 4294967295u.
+//   2. If the floating point value is equal to the promoted integral maximum
+//      value, a range check will erroneously pass.
+//      Example: (4294967296f <= 4294967295u) // This is true due to a precision
+//                                            // loss in rounding up to float.
+//   3. When the floating point value is then converted to an integral, the
+//      resulting value is out of range for the target integral type and
+//      thus is implementation defined.
+//      Example: unsigned u = (float)INT_MAX; // u will typically overflow to 0.
+// To fix this bug we manually truncate the maximum value when the destination
+// type is an integral of larger precision than the source floating-point type,
+// such that the resulting maximum is represented exactly as a floating point.
+template <typename Dst, typename Src, template <typename> class Bounds>
+struct NarrowingRange {
+  using SrcLimits = std::numeric_limits<Src>;
+  using DstLimits = std::numeric_limits<Dst>;
+
+  // Computes the mask required to make an accurate comparison between types.
+  static constexpr int kShift = (kMaxExponent<Src> > kMaxExponent<Dst> &&
+                                 SrcLimits::digits < DstLimits::digits)
+                                    ? (DstLimits::digits - SrcLimits::digits)
+                                    : 0;
+
+  template <typename T>
+    requires(std::same_as<T, Dst> &&
+             ((std::integral<T> && kShift < DstLimits::digits) ||
+              (std::floating_point<T> && kShift == 0)))
+  // Masks out the integer bits that are beyond the precision of the
+  // intermediate type used for comparison.
+  static constexpr T Adjust(T value) {
+    if constexpr (std::integral<T>) {
+      using UnsignedDst = typename std::make_unsigned_t<T>;
+      return static_cast<T>(
+          ConditionalNegate(SafeUnsignedAbs(value) &
+                                ~((UnsignedDst{1} << kShift) - UnsignedDst{1}),
+                            IsValueNegative(value)));
+    } else {
+      return value;
+    }
+  }
+
+  static constexpr Dst max() { return Adjust(Bounds<Dst>::max()); }
+  static constexpr Dst lowest() { return Adjust(Bounds<Dst>::lowest()); }
+};
+
+// The following templates are for ranges that must be verified at runtime. We
+// split it into checks based on signedness to avoid confusing casts and
+// compiler warnings on signed an unsigned comparisons.
+
+// Default case, used for same sign narrowing: The range is contained for normal
+// limits.
+template <typename Dst, typename Src, template <typename> class Bounds,
+          IntegerRepresentation DstSign =
+              std::is_signed_v<Dst> ? IntegerRepresentation::kSigned
+                                    : IntegerRepresentation::kUnsigned,
+          IntegerRepresentation SrcSign =
+              std::is_signed_v<Src> ? IntegerRepresentation::kSigned
+                                    : IntegerRepresentation::kUnsigned,
+          NumericRangeRepresentation DstRange =
+              kStaticDstRangeRelationToSrcRange<Dst, Src>>
+struct DstRangeRelationToSrcRangeImpl {
+  static constexpr RangeCheck Check(Src value) {
+    using SrcLimits = std::numeric_limits<Src>;
+    using DstLimits = NarrowingRange<Dst, Src, Bounds>;
+    return RangeCheck(
+        static_cast<Dst>(SrcLimits::lowest()) >= DstLimits::lowest() ||
+            static_cast<Dst>(value) >= DstLimits::lowest(),
+        static_cast<Dst>(SrcLimits::max()) <= DstLimits::max() ||
+            static_cast<Dst>(value) <= DstLimits::max());
+  }
+};
+
+// Signed to signed narrowing: Both the upper and lower boundaries may be
+// exceeded for standard limits.
+template <typename Dst, typename Src, template <typename> class Bounds>
+struct DstRangeRelationToSrcRangeImpl<
+    Dst, Src, Bounds, IntegerRepresentation::kSigned,
+    IntegerRepresentation::kSigned, NumericRangeRepresentation::kNotContained> {
+  static constexpr RangeCheck Check(Src value) {
+    using DstLimits = NarrowingRange<Dst, Src, Bounds>;
+    return RangeCheck(value >= DstLimits::lowest(), value <= DstLimits::max());
+  }
+};
+
+// Unsigned to unsigned narrowing: Only the upper bound can be exceeded for
+// standard limits.
+template <typename Dst, typename Src, template <typename> class Bounds>
+struct DstRangeRelationToSrcRangeImpl<
+    Dst, Src, Bounds, IntegerRepresentation::kUnsigned,
+    IntegerRepresentation::kUnsigned,
+    NumericRangeRepresentation::kNotContained> {
+  static constexpr RangeCheck Check(Src value) {
+    using DstLimits = NarrowingRange<Dst, Src, Bounds>;
+    return RangeCheck(
+        DstLimits::lowest() == Dst{0} || value >= DstLimits::lowest(),
+        value <= DstLimits::max());
+  }
+};
+
+// Unsigned to signed: Only the upper bound can be exceeded for standard limits.
+template <typename Dst, typename Src, template <typename> class Bounds>
+struct DstRangeRelationToSrcRangeImpl<
+    Dst, Src, Bounds, IntegerRepresentation::kSigned,
+    IntegerRepresentation::kUnsigned,
+    NumericRangeRepresentation::kNotContained> {
+  static constexpr RangeCheck Check(Src value) {
+    using DstLimits = NarrowingRange<Dst, Src, Bounds>;
+    using Promotion = decltype(Src() + Dst());
+    return RangeCheck(DstLimits::lowest() <= Dst{0} ||
+                          static_cast<Promotion>(value) >=
+                              static_cast<Promotion>(DstLimits::lowest()),
+                      static_cast<Promotion>(value) <=
+                          static_cast<Promotion>(DstLimits::max()));
+  }
+};
+
+// Signed to unsigned: The upper boundary may be exceeded for a narrower Dst,
+// and any negative value exceeds the lower boundary for standard limits.
+template <typename Dst, typename Src, template <typename> class Bounds>
+struct DstRangeRelationToSrcRangeImpl<
+    Dst, Src, Bounds, IntegerRepresentation::kUnsigned,
+    IntegerRepresentation::kSigned, NumericRangeRepresentation::kNotContained> {
+  static constexpr RangeCheck Check(Src value) {
+    using SrcLimits = std::numeric_limits<Src>;
+    using DstLimits = NarrowingRange<Dst, Src, Bounds>;
+    using Promotion = decltype(Src() + Dst());
+    bool ge_zero;
+    // Converting floating-point to integer will discard fractional part, so
+    // values in (-1.0, -0.0) will truncate to 0 and fit in Dst.
+    if constexpr (std::is_floating_point_v<Src>) {
+      ge_zero = value > Src{-1};
+    } else {
+      ge_zero = value >= Src{0};
+    }
+    return RangeCheck(
+        ge_zero && (DstLimits::lowest() == 0 ||
+                    static_cast<Dst>(value) >= DstLimits::lowest()),
+        static_cast<Promotion>(SrcLimits::max()) <=
+                static_cast<Promotion>(DstLimits::max()) ||
+            static_cast<Promotion>(value) <=
+                static_cast<Promotion>(DstLimits::max()));
+  }
+};
+
+// Simple wrapper for statically checking if a type's range is contained.
+template <typename Dst, typename Src>
+inline constexpr bool kIsTypeInRangeForNumericType =
+    kStaticDstRangeRelationToSrcRange<Dst, Src> ==
+    NumericRangeRepresentation::kContained;
+
+template <typename Dst, template <typename> class Bounds = std::numeric_limits,
+          typename Src>
+  requires(std::is_arithmetic_v<Src> && std::is_arithmetic_v<Dst> &&
+           Bounds<Dst>::lowest() < Bounds<Dst>::max())
+constexpr RangeCheck DstRangeRelationToSrcRange(Src value) {
+  return DstRangeRelationToSrcRangeImpl<Dst, Src, Bounds>::Check(value);
+}
+
+// Integer promotion templates used by the portable checked integer arithmetic.
+template <size_t Size, bool IsSigned>
+struct IntegerForDigitsAndSignImpl;
+
+#define INTEGER_FOR_DIGITS_AND_SIGN(I)                        \
+  template <>                                                 \
+  struct IntegerForDigitsAndSignImpl<kIntegerBitsPlusSign<I>, \
+                                     std::is_signed_v<I>> {   \
+    using type = I;                                           \
+  }
+
+INTEGER_FOR_DIGITS_AND_SIGN(int8_t);
+INTEGER_FOR_DIGITS_AND_SIGN(uint8_t);
+INTEGER_FOR_DIGITS_AND_SIGN(int16_t);
+INTEGER_FOR_DIGITS_AND_SIGN(uint16_t);
+INTEGER_FOR_DIGITS_AND_SIGN(int32_t);
+INTEGER_FOR_DIGITS_AND_SIGN(uint32_t);
+INTEGER_FOR_DIGITS_AND_SIGN(int64_t);
+INTEGER_FOR_DIGITS_AND_SIGN(uint64_t);
+#undef INTEGER_FOR_DIGITS_AND_SIGN
+
+template <size_t Size, bool IsSigned>
+using IntegerForDigitsAndSign =
+    IntegerForDigitsAndSignImpl<Size, IsSigned>::type;
+
+// WARNING: We have no IntegerForSizeAndSign<16, *>. If we ever add one to
+// support 128-bit math, then the ArithmeticPromotion template below will need
+// to be updated (or more likely replaced with a decltype expression).
+static_assert(kIntegerBitsPlusSign<intmax_t> == 64,
+              "Max integer size not supported for this toolchain.");
+
+template <typename Integer, bool IsSigned = std::is_signed_v<Integer>>
+using TwiceWiderInteger =
+    IntegerForDigitsAndSign<kIntegerBitsPlusSign<Integer> * 2, IsSigned>;
+
+// Determines the type that can represent the largest positive value.
+template <typename Lhs, typename Rhs>
+using MaxExponentPromotion =
+    std::conditional_t<(kMaxExponent<Lhs> > kMaxExponent<Rhs>), Lhs, Rhs>;
+
+// Determines the type that can represent the lowest arithmetic value.
+template <typename Lhs, typename Rhs>
+using LowestValuePromotion = std::conditional_t<
+    std::is_signed_v<Lhs>
+        ? (!std::is_signed_v<Rhs> || kMaxExponent<Lhs> > kMaxExponent<Rhs>)
+        : (!std::is_signed_v<Rhs> && kMaxExponent<Lhs> < kMaxExponent<Rhs>),
+    Lhs, Rhs>;
+
+// Determines the type that is best able to represent an arithmetic result.
+
+// Default case, used when the side with the max exponent is big enough.
+template <typename Lhs, typename Rhs = Lhs,
+          bool is_intmax_type =
+              std::is_integral_v<MaxExponentPromotion<Lhs, Rhs>> &&
+              kIntegerBitsPlusSign<MaxExponentPromotion<Lhs, Rhs>> ==
+                  kIntegerBitsPlusSign<intmax_t>,
+          bool is_max_exponent = kStaticDstRangeRelationToSrcRange<
+                                     MaxExponentPromotion<Lhs, Rhs>, Lhs> ==
+                                     NumericRangeRepresentation::kContained &&
+                                 kStaticDstRangeRelationToSrcRange<
+                                     MaxExponentPromotion<Lhs, Rhs>, Rhs> ==
+                                     NumericRangeRepresentation::kContained>
+struct BigEnoughPromotionImpl {
+  using type = MaxExponentPromotion<Lhs, Rhs>;
+  static constexpr bool kContained = true;
+};
+
+// We can use a twice wider type to fit.
+template <typename Lhs, typename Rhs>
+struct BigEnoughPromotionImpl<Lhs, Rhs, false, false> {
+  using type =
+      TwiceWiderInteger<MaxExponentPromotion<Lhs, Rhs>,
+                        std::is_signed_v<Lhs> || std::is_signed_v<Rhs>>;
+  static constexpr bool kContained = true;
+};
+
+// No type is large enough.
+template <typename Lhs, typename Rhs>
+struct BigEnoughPromotionImpl<Lhs, Rhs, true, false> {
+  using type = MaxExponentPromotion<Lhs, Rhs>;
+  static constexpr bool kContained = false;
+};
+
+template <typename Lhs, typename Rhs>
+using BigEnoughPromotion = BigEnoughPromotionImpl<Lhs, Rhs>::type;
+
+template <typename Lhs, typename Rhs>
+inline constexpr bool kIsBigEnoughPromotionContained =
+    BigEnoughPromotionImpl<Lhs, Rhs>::kContained;
+
+// We can statically check if operations on the provided types can wrap, so we
+// can skip the checked operations if they're not needed. So, for an integer we
+// care if the destination type preserves the sign and is twice the width of
+// the source.
+template <typename T, typename Lhs, typename Rhs = Lhs>
+inline constexpr bool kIsIntegerArithmeticSafe =
+    !std::is_floating_point_v<T> && !std::is_floating_point_v<Lhs> &&
+    !std::is_floating_point_v<Rhs> &&
+    std::is_signed_v<T> >= std::is_signed_v<Lhs> &&
+    kIntegerBitsPlusSign<T> >= (2 * kIntegerBitsPlusSign<Lhs>) &&
+    std::is_signed_v<T> >= std::is_signed_v<Rhs> &&
+    kIntegerBitsPlusSign<T> >= (2 * kIntegerBitsPlusSign<Rhs>);
+
+// Promotes to a type that can represent any possible result of a binary
+// arithmetic operation with the source types.
+template <typename Lhs, typename Rhs>
+struct FastIntegerArithmeticPromotionImpl {
+  using type = BigEnoughPromotion<Lhs, Rhs>;
+  static constexpr bool kContained = false;
+};
+
+template <typename Lhs, typename Rhs>
+  requires(kIsIntegerArithmeticSafe<
+           std::conditional_t<std::is_signed_v<Lhs> || std::is_signed_v<Rhs>,
+                              intmax_t, uintmax_t>,
+           MaxExponentPromotion<Lhs, Rhs>>)
+struct FastIntegerArithmeticPromotionImpl<Lhs, Rhs> {
+  using type =
+      TwiceWiderInteger<MaxExponentPromotion<Lhs, Rhs>,
+                        std::is_signed_v<Lhs> || std::is_signed_v<Rhs>>;
+  static_assert(kIsIntegerArithmeticSafe<type, Lhs, Rhs>);
+  static constexpr bool kContained = true;
+};
+
+template <typename Lhs, typename Rhs>
+using FastIntegerArithmeticPromotion =
+    FastIntegerArithmeticPromotionImpl<Lhs, Rhs>::type;
+
+template <typename Lhs, typename Rhs>
+inline constexpr bool kIsFastIntegerArithmeticPromotionContained =
+    FastIntegerArithmeticPromotionImpl<Lhs, Rhs>::kContained;
+
+template <typename T>
+struct ArithmeticOrIntegralConstant {
+  using type = T;
+};
+
+template <typename T>
+  requires IntegralConstantLike<T>
+struct ArithmeticOrIntegralConstant<T> {
+  using type = T::value_type;
+};
+
+// Extracts the underlying type from an enum.
+template <typename T>
+using ArithmeticOrUnderlyingEnum =
+    typename std::conditional_t<std::is_enum_v<T>, std::underlying_type<T>,
+                                ArithmeticOrIntegralConstant<T>>::type;
+
+// The following are helper templates used in the CheckedNumeric class.
+template <typename T>
+  requires std::is_arithmetic_v<T>
+class CheckedNumeric;
+
+template <typename T>
+  requires std::is_arithmetic_v<T>
+class ClampedNumeric;
+
+template <typename T>
+  requires std::is_arithmetic_v<T>
+class StrictNumeric;
+
+// Used to treat CheckedNumeric and arithmetic underlying types the same.
+template <typename T>
+inline constexpr bool kIsCheckedNumeric = false;
+template <typename T>
+inline constexpr bool kIsCheckedNumeric<CheckedNumeric<T>> = true;
+template <typename T>
+concept IsCheckedNumeric = kIsCheckedNumeric<T>;
+
+template <typename T>
+inline constexpr bool kIsClampedNumeric = false;
+template <typename T>
+inline constexpr bool kIsClampedNumeric<ClampedNumeric<T>> = true;
+template <typename T>
+concept IsClampedNumeric = kIsClampedNumeric<T>;
+
+template <typename T>
+inline constexpr bool kIsStrictNumeric = false;
+template <typename T>
+inline constexpr bool kIsStrictNumeric<StrictNumeric<T>> = true;
+template <typename T>
+concept IsStrictNumeric = kIsStrictNumeric<T>;
+
+template <typename T>
+struct UnderlyingTypeImpl {
+  using type = ArithmeticOrUnderlyingEnum<T>;
+};
+template <typename T>
+struct UnderlyingTypeImpl<CheckedNumeric<T>> {
+  using type = T;
+};
+template <typename T>
+struct UnderlyingTypeImpl<ClampedNumeric<T>> {
+  using type = T;
+};
+template <typename T>
+struct UnderlyingTypeImpl<StrictNumeric<T>> {
+  using type = T;
+};
+template <typename T>
+using UnderlyingType = UnderlyingTypeImpl<T>::type;
+
+template <typename T>
+inline constexpr bool kIsNumeric = std::is_arithmetic_v<UnderlyingType<T>>;
+template <typename T>
+  requires(IsCheckedNumeric<T> || IsClampedNumeric<T> || IsStrictNumeric<T>)
+inline constexpr bool kIsNumeric<T> = true;
+template <typename T>
+concept IsNumeric = kIsNumeric<T>;
+
+template <typename L, typename R>
+concept IsCheckedOp = (IsCheckedNumeric<L> && IsNumeric<R>) ||
+                      (IsCheckedNumeric<R> && IsNumeric<L>);
+
+template <typename L, typename R>
+concept IsClampedOp =
+    !IsCheckedOp<L, R> && ((IsClampedNumeric<L> && IsNumeric<R>) ||
+                           (IsClampedNumeric<R> && IsNumeric<L>));
+
+template <typename L, typename R>
+concept IsStrictOp = !IsCheckedOp<L, R> && !IsClampedOp<L, R> &&
+                     ((IsStrictNumeric<L> && IsNumeric<R>) ||
+                      (IsStrictNumeric<R> && IsNumeric<L>));
+
+// as_signed<> returns the supplied integral value (or integral castable
+// Numeric template) cast as a signed integral of equivalent precision.
+// I.e. it's mostly an alias for: static_cast<std::make_signed<T>::type>(t)
+template <typename Src, typename Dst = std::make_signed_t<UnderlyingType<Src>>>
+  requires std::integral<Dst>
+constexpr auto as_signed(Src value) {
+  return static_cast<Dst>(value);
+}
+
+// as_unsigned<> returns the supplied integral value (or integral castable
+// Numeric template) cast as an unsigned integral of equivalent precision.
+// I.e. it's mostly an alias for: static_cast<std::make_unsigned<T>::type>(t)
+template <typename Src,
+          typename Dst = std::make_unsigned_t<UnderlyingType<Src>>>
+  requires std::integral<Dst>
+constexpr auto as_unsigned(Src value) {
+  return static_cast<Dst>(value);
+}
+
+template <typename L, typename R>
+  requires std::is_arithmetic_v<L> && std::is_arithmetic_v<R>
+struct IsLess {
+  using SumT = decltype(std::declval<L>() + std::declval<R>());
+  static constexpr bool Test(L lhs, R rhs) {
+    const RangeCheck l_range = DstRangeRelationToSrcRange<R>(lhs);
+    const RangeCheck r_range = DstRangeRelationToSrcRange<L>(rhs);
+    return l_range.IsUnderflow() || r_range.IsOverflow() ||
+           (l_range == r_range &&
+            static_cast<SumT>(lhs) < static_cast<SumT>(rhs));
+  }
+};
+
+template <typename L, typename R>
+  requires std::is_arithmetic_v<L> && std::is_arithmetic_v<R>
+struct IsLessOrEqual {
+  using SumT = decltype(std::declval<L>() + std::declval<R>());
+  static constexpr bool Test(L lhs, R rhs) {
+    const RangeCheck l_range = DstRangeRelationToSrcRange<R>(lhs);
+    const RangeCheck r_range = DstRangeRelationToSrcRange<L>(rhs);
+    return l_range.IsUnderflow() || r_range.IsOverflow() ||
+           (l_range == r_range &&
+            static_cast<SumT>(lhs) <= static_cast<SumT>(rhs));
+  }
+};
+
+template <typename L, typename R>
+  requires std::is_arithmetic_v<L> && std::is_arithmetic_v<R>
+struct IsGreater {
+  using SumT = decltype(std::declval<L>() + std::declval<R>());
+  static constexpr bool Test(L lhs, R rhs) {
+    const RangeCheck l_range = DstRangeRelationToSrcRange<R>(lhs);
+    const RangeCheck r_range = DstRangeRelationToSrcRange<L>(rhs);
+    return l_range.IsOverflow() || r_range.IsUnderflow() ||
+           (l_range == r_range &&
+            static_cast<SumT>(lhs) > static_cast<SumT>(rhs));
+  }
+};
+
+template <typename L, typename R>
+  requires std::is_arithmetic_v<L> && std::is_arithmetic_v<R>
+struct IsGreaterOrEqual {
+  using SumT = decltype(std::declval<L>() + std::declval<R>());
+  static constexpr bool Test(L lhs, R rhs) {
+    const RangeCheck l_range = DstRangeRelationToSrcRange<R>(lhs);
+    const RangeCheck r_range = DstRangeRelationToSrcRange<L>(rhs);
+    return l_range.IsOverflow() || r_range.IsUnderflow() ||
+           (l_range == r_range &&
+            static_cast<SumT>(lhs) >= static_cast<SumT>(rhs));
+  }
+};
+
+template <typename L, typename R>
+  requires std::is_arithmetic_v<L> && std::is_arithmetic_v<R>
+struct IsEqual {
+  using SumT = decltype(std::declval<L>() + std::declval<R>());
+  static constexpr bool Test(L lhs, R rhs) {
+    return DstRangeRelationToSrcRange<R>(lhs) ==
+               DstRangeRelationToSrcRange<L>(rhs) &&
+           static_cast<SumT>(lhs) == static_cast<SumT>(rhs);
+  }
+};
+
+template <typename L, typename R>
+  requires std::is_arithmetic_v<L> && std::is_arithmetic_v<R>
+struct IsNotEqual {
+  using SumT = decltype(std::declval<L>() + std::declval<R>());
+  static constexpr bool Test(L lhs, R rhs) {
+    return DstRangeRelationToSrcRange<R>(lhs) !=
+               DstRangeRelationToSrcRange<L>(rhs) ||
+           static_cast<SumT>(lhs) != static_cast<SumT>(rhs);
+  }
+};
+
+// These perform the actual math operations on the CheckedNumerics.
+// Binary arithmetic operations.
+template <template <typename, typename> typename C, typename L, typename R>
+  requires std::is_arithmetic_v<L> && std::is_arithmetic_v<R>
+constexpr bool SafeCompare(L lhs, R rhs) {
+  using BigType = BigEnoughPromotion<L, R>;
+  return kIsBigEnoughPromotionContained<L, R>
+             // Force to a larger type for speed if both are contained.
+             ? C<BigType, BigType>::Test(static_cast<BigType>(lhs),
+                                         static_cast<BigType>(rhs))
+             // Let the template functions figure it out for mixed types.
+             : C<L, R>::Test(lhs, rhs);
+}
+
+template <typename Dst, typename Src>
+inline constexpr bool kIsMaxInRangeForNumericType =
+    IsGreaterOrEqual<Dst, Src>::Test(std::numeric_limits<Dst>::max(),
+                                     std::numeric_limits<Src>::max());
+
+template <typename Dst, typename Src>
+inline constexpr bool kIsMinInRangeForNumericType =
+    IsLessOrEqual<Dst, Src>::Test(std::numeric_limits<Dst>::lowest(),
+                                  std::numeric_limits<Src>::lowest());
+
+template <typename Dst, typename Src>
+inline constexpr Dst kCommonMax =
+    kIsMaxInRangeForNumericType<Dst, Src>
+        ? static_cast<Dst>(std::numeric_limits<Src>::max())
+        : std::numeric_limits<Dst>::max();
+
+template <typename Dst, typename Src>
+inline constexpr Dst kCommonMin =
+    kIsMinInRangeForNumericType<Dst, Src>
+        ? static_cast<Dst>(std::numeric_limits<Src>::lowest())
+        : std::numeric_limits<Dst>::lowest();
+
+// This is a wrapper to generate return the max or min for a supplied type.
+// If the argument is false, the returned value is the maximum. If true the
+// returned value is the minimum.
+template <typename Dst, typename Src = Dst>
+constexpr Dst CommonMaxOrMin(bool is_min) {
+  return is_min ? kCommonMin<Dst, Src> : kCommonMax<Dst, Src>;
+}
+
+}  // namespace v8::base::internal
+
+#endif  // V8_BASE_NUMERICS_SAFE_CONVERSIONS_IMPL_H_
diff --git a/deps/v8/src/base/numerics/safe_math.h b/deps/v8/src/base/numerics/safe_math.h
new file mode 100644
index 00000000000000..89015549a3d629
--- /dev/null
+++ b/deps/v8/src/base/numerics/safe_math.h
@@ -0,0 +1,15 @@
+// Copyright 2017 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Slightly adapted for inclusion in V8.
+// Copyright 2025 the V8 project authors. All rights reserved.
+
+#ifndef V8_BASE_NUMERICS_SAFE_MATH_H_
+#define V8_BASE_NUMERICS_SAFE_MATH_H_
+
+#include "src/base/numerics/checked_math.h"      // IWYU pragma: export
+#include "src/base/numerics/clamped_math.h"      // IWYU pragma: export
+#include "src/base/numerics/safe_conversions.h"  // IWYU pragma: export
+
+#endif  // V8_BASE_NUMERICS_SAFE_MATH_H_
diff --git a/deps/v8/src/base/numerics/safe_math_arm_impl.h b/deps/v8/src/base/numerics/safe_math_arm_impl.h
new file mode 100644
index 00000000000000..13c26cf87e163b
--- /dev/null
+++ b/deps/v8/src/base/numerics/safe_math_arm_impl.h
@@ -0,0 +1,128 @@
+// Copyright 2017 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Slightly adapted for inclusion in V8.
+// Copyright 2025 the V8 project authors. All rights reserved.
+
+#ifndef V8_BASE_NUMERICS_SAFE_MATH_ARM_IMPL_H_
+#define V8_BASE_NUMERICS_SAFE_MATH_ARM_IMPL_H_
+
+// IWYU pragma: private
+
+#include <stdint.h>
+
+#include <cassert>
+
+#include "src/base/numerics/safe_conversions.h"
+
+namespace v8::base::internal {
+
+template <typename T, typename U>
+struct CheckedMulFastAsmOp {
+  static constexpr bool is_supported =
+      kEnableAsmCode && kIsFastIntegerArithmeticPromotionContained<T, U>;
+
+  // The following is not an assembler routine and is thus constexpr safe, it
+  // just emits much more efficient code than the Clang and GCC builtins for
+  // performing overflow-checked multiplication when a twice wider type is
+  // available. The below compiles down to 2-3 instructions, depending on the
+  // width of the types in use.
+  // As an example, an int32_t multiply compiles to:
+  //    smull   r0, r1, r0, r1
+  //    cmp     r1, r1, asr #31
+  // And an int16_t multiply compiles to:
+  //    smulbb  r1, r1, r0
+  //    asr     r2, r1, #16
+  //    cmp     r2, r1, asr #15
+  template <typename V>
+  static constexpr bool Do(T x, U y, V* result) {
+    using Promotion = FastIntegerArithmeticPromotion<T, U>;
+    Promotion presult;
+
+    presult = static_cast<Promotion>(x) * static_cast<Promotion>(y);
+    if (!IsValueInRangeForNumericType<V>(presult)) {
+      return false;
+    }
+    *result = static_cast<V>(presult);
+    return true;
+  }
+};
+
+template <typename T, typename U>
+struct ClampedAddFastAsmOp {
+  static constexpr bool is_supported =
+      kEnableAsmCode && kIsBigEnoughPromotionContained<T, U> &&
+      kIsTypeInRangeForNumericType<int32_t, BigEnoughPromotion<T, U>>;
+
+  template <typename V>
+  __attribute__((always_inline)) static V Do(T x, U y) {
+    // This will get promoted to an int, so let the compiler do whatever is
+    // clever and rely on the saturated cast to bounds check.
+    if constexpr (kIsIntegerArithmeticSafe<int, T, U>) {
+      return saturated_cast<V>(static_cast<int>(x) + static_cast<int>(y));
+    } else {
+      int32_t result;
+      int32_t x_i32 = checked_cast<int32_t>(x);
+      int32_t y_i32 = checked_cast<int32_t>(y);
+
+      asm("qadd %[result], %[first], %[second]"
+          : [result] "=r"(result)
+          : [first] "r"(x_i32), [second] "r"(y_i32));
+      return saturated_cast<V>(result);
+    }
+  }
+};
+
+template <typename T, typename U>
+struct ClampedSubFastAsmOp {
+  static constexpr bool is_supported =
+      kEnableAsmCode && kIsBigEnoughPromotionContained<T, U> &&
+      kIsTypeInRangeForNumericType<int32_t, BigEnoughPromotion<T, U>>;
+
+  template <typename V>
+  __attribute__((always_inline)) static V Do(T x, U y) {
+    // This will get promoted to an int, so let the compiler do whatever is
+    // clever and rely on the saturated cast to bounds check.
+    if constexpr (kIsIntegerArithmeticSafe<int, T, U>) {
+      return saturated_cast<V>(static_cast<int>(x) - static_cast<int>(y));
+    } else {
+      int32_t result;
+      int32_t x_i32 = checked_cast<int32_t>(x);
+      int32_t y_i32 = checked_cast<int32_t>(y);
+
+      asm("qsub %[result], %[first], %[second]"
+          : [result] "=r"(result)
+          : [first] "r"(x_i32), [second] "r"(y_i32));
+      return saturated_cast<V>(result);
+    }
+  }
+};
+
+template <typename T, typename U>
+struct ClampedMulFastAsmOp {
+  static constexpr bool is_supported =
+      kEnableAsmCode && CheckedMulFastAsmOp<T, U>::is_supported;
+
+  template <typename V>
+  __attribute__((always_inline)) static V Do(T x, U y) {
+    // Use the CheckedMulFastAsmOp for full-width 32-bit values, because
+    // it's fewer instructions than promoting and then saturating.
+    if constexpr (!kIsIntegerArithmeticSafe<int32_t, T, U> &&
+                  !kIsIntegerArithmeticSafe<uint32_t, T, U>) {
+      V result;
+      return CheckedMulFastAsmOp<T, U>::Do(x, y, &result)
+                 ? result
+                 : CommonMaxOrMin<V>(IsValueNegative(x) ^ IsValueNegative(y));
+    } else {
+      static_assert(kIsFastIntegerArithmeticPromotionContained<T, U>);
+      using Promotion = FastIntegerArithmeticPromotion<T, U>;
+      return saturated_cast<V>(static_cast<Promotion>(x) *
+                               static_cast<Promotion>(y));
+    }
+  }
+};
+
+}  // namespace v8::base::internal
+
+#endif  // V8_BASE_NUMERICS_SAFE_MATH_ARM_IMPL_H_
diff --git a/deps/v8/src/base/numerics/safe_math_clang_gcc_impl.h b/deps/v8/src/base/numerics/safe_math_clang_gcc_impl.h
new file mode 100644
index 00000000000000..5255aa82bc5812
--- /dev/null
+++ b/deps/v8/src/base/numerics/safe_math_clang_gcc_impl.h
@@ -0,0 +1,163 @@
+// Copyright 2017 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Slightly adapted for inclusion in V8.
+// Copyright 2025 the V8 project authors. All rights reserved.
+
+#ifndef V8_BASE_NUMERICS_SAFE_MATH_CLANG_GCC_IMPL_H_
+#define V8_BASE_NUMERICS_SAFE_MATH_CLANG_GCC_IMPL_H_
+
+// IWYU pragma: private
+
+#include <stdint.h>
+
+#include <limits>
+#include <type_traits>
+
+#include "src/base/numerics/safe_conversions.h"
+
+#if !defined(__native_client__) && (defined(__ARMEL__) || defined(__arch64__))
+#include "src/base/numerics/safe_math_arm_impl.h"  // IWYU pragma: export
+#define BASE_HAS_ASSEMBLER_SAFE_MATH (1)
+#else
+#define BASE_HAS_ASSEMBLER_SAFE_MATH (0)
+#endif
+
+namespace v8::base {
+namespace internal {
+
+// These are the non-functioning boilerplate implementations of the optimized
+// safe math routines.
+#if !BASE_HAS_ASSEMBLER_SAFE_MATH
+template <typename T, typename U>
+struct CheckedMulFastAsmOp {
+  static const bool is_supported = false;
+  template <typename V>
+  static constexpr bool Do(T, U, V*) {
+    // Force a compile failure if instantiated.
+    return CheckOnFailure::template HandleFailure<bool>();
+  }
+};
+
+template <typename T, typename U>
+struct ClampedAddFastAsmOp {
+  static const bool is_supported = false;
+  template <typename V>
+  static constexpr V Do(T, U) {
+    // Force a compile failure if instantiated.
+    return CheckOnFailure::template HandleFailure<V>();
+  }
+};
+
+template <typename T, typename U>
+struct ClampedSubFastAsmOp {
+  static const bool is_supported = false;
+  template <typename V>
+  static constexpr V Do(T, U) {
+    // Force a compile failure if instantiated.
+    return CheckOnFailure::template HandleFailure<V>();
+  }
+};
+
+template <typename T, typename U>
+struct ClampedMulFastAsmOp {
+  static const bool is_supported = false;
+  template <typename V>
+  static constexpr V Do(T, U) {
+    // Force a compile failure if instantiated.
+    return CheckOnFailure::template HandleFailure<V>();
+  }
+};
+#endif  // BASE_HAS_ASSEMBLER_SAFE_MATH
+#undef BASE_HAS_ASSEMBLER_SAFE_MATH
+
+template <typename T, typename U>
+struct CheckedAddFastOp {
+  static const bool is_supported = true;
+  template <typename V>
+  __attribute__((always_inline)) static constexpr bool Do(T x, U y, V* result) {
+    return !__builtin_add_overflow(x, y, result);
+  }
+};
+
+template <typename T, typename U>
+struct CheckedSubFastOp {
+  static const bool is_supported = true;
+  template <typename V>
+  __attribute__((always_inline)) static constexpr bool Do(T x, U y, V* result) {
+    return !__builtin_sub_overflow(x, y, result);
+  }
+};
+
+template <typename T, typename U>
+struct CheckedMulFastOp {
+#if defined(__clang__)
+  // TODO(jschuh): Get the Clang runtime library issues sorted out so we can
+  // support full-width, mixed-sign multiply builtins.
+  // https://crbug.com/613003
+  // We can support intptr_t, uintptr_t, or a smaller common type.
+  static const bool is_supported =
+      (kIsTypeInRangeForNumericType<intptr_t, T> &&
+       kIsTypeInRangeForNumericType<intptr_t, U>) ||
+      (kIsTypeInRangeForNumericType<uintptr_t, T> &&
+       kIsTypeInRangeForNumericType<uintptr_t, U>);
+#else
+  static const bool is_supported = true;
+#endif
+  template <typename V>
+  __attribute__((always_inline)) static constexpr bool Do(T x, U y, V* result) {
+    return CheckedMulFastAsmOp<T, U>::is_supported
+               ? CheckedMulFastAsmOp<T, U>::Do(x, y, result)
+               : !__builtin_mul_overflow(x, y, result);
+  }
+};
+
+template <typename T, typename U>
+struct ClampedAddFastOp {
+  static const bool is_supported = ClampedAddFastAsmOp<T, U>::is_supported;
+  template <typename V>
+  __attribute__((always_inline)) static V Do(T x, U y) {
+    return ClampedAddFastAsmOp<T, U>::template Do<V>(x, y);
+  }
+};
+
+template <typename T, typename U>
+struct ClampedSubFastOp {
+  static const bool is_supported = ClampedSubFastAsmOp<T, U>::is_supported;
+  template <typename V>
+  __attribute__((always_inline)) static V Do(T x, U y) {
+    return ClampedSubFastAsmOp<T, U>::template Do<V>(x, y);
+  }
+};
+
+template <typename T, typename U>
+struct ClampedMulFastOp {
+  static const bool is_supported = ClampedMulFastAsmOp<T, U>::is_supported;
+  template <typename V>
+  __attribute__((always_inline)) static V Do(T x, U y) {
+    return ClampedMulFastAsmOp<T, U>::template Do<V>(x, y);
+  }
+};
+
+template <typename T>
+struct ClampedNegFastOp {
+  static const bool is_supported = std::is_signed_v<T>;
+  __attribute__((always_inline)) static T Do(T value) {
+    // Use this when there is no assembler path available.
+    if (!ClampedSubFastAsmOp<T, T>::is_supported) {
+      T result;
+      return !__builtin_sub_overflow(T(0), value, &result)
+                 ? result
+                 : std::numeric_limits<T>::max();
+    }
+
+    // Fallback to the normal subtraction path.
+    return ClampedSubFastOp<T, T>::template Do<T>(T(0), value);
+  }
+};
+
+}  // namespace internal
+}  // namespace v8::base
+
+#endif  // V8_BASE_NUMERICS_SAFE_MATH_CLANG_GCC_IMPL_H_
diff --git a/deps/v8/src/base/numerics/safe_math_shared_impl.h b/deps/v8/src/base/numerics/safe_math_shared_impl.h
new file mode 100644
index 00000000000000..6af6ce2474fa6e
--- /dev/null
+++ b/deps/v8/src/base/numerics/safe_math_shared_impl.h
@@ -0,0 +1,208 @@
+// Copyright 2017 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Slightly adapted for inclusion in V8.
+// Copyright 2025 the V8 project authors. All rights reserved.
+
+#ifndef V8_BASE_NUMERICS_SAFE_MATH_SHARED_IMPL_H_
+#define V8_BASE_NUMERICS_SAFE_MATH_SHARED_IMPL_H_
+
+// IWYU pragma: private
+
+#include <concepts>
+#include <type_traits>
+
+#include "build/build_config.h"
+#include "src/base/numerics/safe_conversions.h"
+
+#if defined(__asmjs__) || defined(__wasm__)
+// Optimized safe math instructions are incompatible with asmjs.
+#define BASE_HAS_OPTIMIZED_SAFE_MATH (0)
+// Where available use builtin math overflow support on Clang and GCC.
+#elif !defined(__native_client__) &&                       \
+    ((defined(__clang__) &&                                \
+      ((__clang_major__ > 3) ||                            \
+       (__clang_major__ == 3 && __clang_minor__ >= 4))) || \
+     (defined(__GNUC__) && __GNUC__ >= 5))
+#include "src/base/numerics/safe_math_clang_gcc_impl.h"  // IWYU pragma: export
+#define BASE_HAS_OPTIMIZED_SAFE_MATH (1)
+#else
+#define BASE_HAS_OPTIMIZED_SAFE_MATH (0)
+#endif
+
+namespace v8::base {
+namespace internal {
+
+// These are the non-functioning boilerplate implementations of the optimized
+// safe math routines.
+#if !BASE_HAS_OPTIMIZED_SAFE_MATH
+template <typename T, typename U>
+struct CheckedAddFastOp {
+  static const bool is_supported = false;
+  template <typename V>
+  static constexpr bool Do(T, U, V*) {
+    // Force a compile failure if instantiated.
+    return CheckOnFailure::template HandleFailure<bool>();
+  }
+};
+
+template <typename T, typename U>
+struct CheckedSubFastOp {
+  static const bool is_supported = false;
+  template <typename V>
+  static constexpr bool Do(T, U, V*) {
+    // Force a compile failure if instantiated.
+    return CheckOnFailure::template HandleFailure<bool>();
+  }
+};
+
+template <typename T, typename U>
+struct CheckedMulFastOp {
+  static const bool is_supported = false;
+  template <typename V>
+  static constexpr bool Do(T, U, V*) {
+    // Force a compile failure if instantiated.
+    return CheckOnFailure::template HandleFailure<bool>();
+  }
+};
+
+template <typename T, typename U>
+struct ClampedAddFastOp {
+  static const bool is_supported = false;
+  template <typename V>
+  static constexpr V Do(T, U) {
+    // Force a compile failure if instantiated.
+    return CheckOnFailure::template HandleFailure<V>();
+  }
+};
+
+template <typename T, typename U>
+struct ClampedSubFastOp {
+  static const bool is_supported = false;
+  template <typename V>
+  static constexpr V Do(T, U) {
+    // Force a compile failure if instantiated.
+    return CheckOnFailure::template HandleFailure<V>();
+  }
+};
+
+template <typename T, typename U>
+struct ClampedMulFastOp {
+  static const bool is_supported = false;
+  template <typename V>
+  static constexpr V Do(T, U) {
+    // Force a compile failure if instantiated.
+    return CheckOnFailure::template HandleFailure<V>();
+  }
+};
+
+template <typename T>
+struct ClampedNegFastOp {
+  static const bool is_supported = false;
+  static constexpr T Do(T) {
+    // Force a compile failure if instantiated.
+    return CheckOnFailure::template HandleFailure<T>();
+  }
+};
+#endif  // BASE_HAS_OPTIMIZED_SAFE_MATH
+#undef BASE_HAS_OPTIMIZED_SAFE_MATH
+
+// This is used for UnsignedAbs, where we need to support floating-point
+// template instantiations even though we don't actually support the operations.
+// However, there is no corresponding implementation of e.g. SafeUnsignedAbs,
+// so the float versions will not compile.
+template <typename Numeric>
+struct UnsignedOrFloatForSize;
+
+template <typename Numeric>
+  requires(std::integral<Numeric>)
+struct UnsignedOrFloatForSize<Numeric> {
+  using type = typename std::make_unsigned<Numeric>::type;
+};
+
+template <typename Numeric>
+  requires(std::floating_point<Numeric>)
+struct UnsignedOrFloatForSize<Numeric> {
+  using type = Numeric;
+};
+
+// Wrap the unary operations to allow SFINAE when instantiating integrals versus
+// floating points. These don't perform any overflow checking. Rather, they
+// exhibit well-defined overflow semantics and rely on the caller to detect
+// if an overflow occurred.
+
+template <typename T>
+  requires(std::integral<T>)
+constexpr T NegateWrapper(T value) {
+  using UnsignedT = typename std::make_unsigned<T>::type;
+  // This will compile to a NEG on Intel, and is normal negation on ARM.
+  return static_cast<T>(UnsignedT(0) - static_cast<UnsignedT>(value));
+}
+
+template <typename T>
+  requires(std::floating_point<T>)
+constexpr T NegateWrapper(T value) {
+  return -value;
+}
+
+template <typename T>
+  requires(std::integral<T>)
+constexpr typename std::make_unsigned<T>::type InvertWrapper(T value) {
+  return ~value;
+}
+
+template <typename T>
+  requires(std::integral<T>)
+constexpr T AbsWrapper(T value) {
+  return static_cast<T>(SafeUnsignedAbs(value));
+}
+
+template <typename T>
+  requires(std::floating_point<T>)
+constexpr T AbsWrapper(T value) {
+  return value < 0 ? -value : value;
+}
+
+template <template <typename, typename> class M, typename L, typename R,
+          typename Math = M<UnderlyingType<L>, UnderlyingType<R>>>
+  requires requires { typename Math::result_type; }
+struct MathWrapper {
+  using math = Math;
+  using type = typename math::result_type;
+};
+
+// The following macros are just boilerplate for the standard arithmetic
+// operator overloads and variadic function templates. A macro isn't the nicest
+// solution, but it beats rewriting these over and over again.
+#define BASE_NUMERIC_ARITHMETIC_VARIADIC(CLASS, CL_ABBR, OP_NAME)       \
+  template <typename L, typename R, typename... Args>                   \
+  constexpr auto CL_ABBR##OP_NAME(L lhs, R rhs, Args... args) {         \
+    return CL_ABBR##MathOp<CLASS##OP_NAME##Op, L, R, Args...>(lhs, rhs, \
+                                                              args...); \
+  }
+
+#define BASE_NUMERIC_ARITHMETIC_OPERATORS(CLASS, CL_ABBR, OP_NAME, OP, CMP_OP) \
+  /* Binary arithmetic operator for all CLASS##Numeric operations. */          \
+  template <typename L, typename R>                                            \
+    requires(Is##CLASS##Op<L, R>)                                              \
+  constexpr CLASS##Numeric<typename MathWrapper<CLASS##OP_NAME##Op, L,         \
+                                                R>::type> operator OP(L lhs,   \
+                                                                      R rhs) { \
+    return decltype(lhs OP rhs)::template MathOp<CLASS##OP_NAME##Op>(lhs,      \
+                                                                     rhs);     \
+  }                                                                            \
+  /* Assignment arithmetic operator implementation from CLASS##Numeric. */     \
+  template <typename L>                                                        \
+    requires std::is_arithmetic_v<L>                                           \
+  template <typename R>                                                        \
+  constexpr CLASS##Numeric<L>& CLASS##Numeric<L>::operator CMP_OP(R rhs) {     \
+    return MathOp<CLASS##OP_NAME##Op>(rhs);                                    \
+  }                                                                            \
+  /* Variadic arithmetic functions that return CLASS##Numeric. */              \
+  BASE_NUMERIC_ARITHMETIC_VARIADIC(CLASS, CL_ABBR, OP_NAME)
+
+}  // namespace internal
+}  // namespace v8::base
+
+#endif  // V8_BASE_NUMERICS_SAFE_MATH_SHARED_IMPL_H_
diff --git a/deps/v8/src/base/numerics/wrapping_math.h b/deps/v8/src/base/numerics/wrapping_math.h
new file mode 100644
index 00000000000000..e82da6fb00a9ed
--- /dev/null
+++ b/deps/v8/src/base/numerics/wrapping_math.h
@@ -0,0 +1,45 @@
+// Copyright 2023 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Slightly adapted for inclusion in V8.
+// Copyright 2025 the V8 project authors. All rights reserved.
+
+#ifndef V8_BASE_NUMERICS_WRAPPING_MATH_H_
+#define V8_BASE_NUMERICS_WRAPPING_MATH_H_
+
+#include <type_traits>
+
+namespace v8::base {
+
+// Returns `a + b` with overflow defined to wrap around, i.e. modulo 2^N where N
+// is the bit width of `T`.
+template <typename T>
+inline constexpr T WrappingAdd(T a, T b) {
+  static_assert(std::is_integral_v<T>);
+  // Unsigned arithmetic wraps, so convert to the corresponding unsigned type.
+  // Note that, if `T` is smaller than `int`, e.g. `int16_t`, the values are
+  // promoted to `int`, which brings us back to undefined overflow. This is fine
+  // here because the sum of any two `int16_t`s fits in `int`, but `WrappingMul`
+  // will need a more complex implementation.
+  using Unsigned = std::make_unsigned_t<T>;
+  return static_cast<T>(static_cast<Unsigned>(a) + static_cast<Unsigned>(b));
+}
+
+// Returns `a - b` with overflow defined to wrap around, i.e. modulo 2^N where N
+// is the bit width of `T`.
+template <typename T>
+inline constexpr T WrappingSub(T a, T b) {
+  static_assert(std::is_integral_v<T>);
+  // Unsigned arithmetic wraps, so convert to the corresponding unsigned type.
+  // Note that, if `T` is smaller than `int`, e.g. `int16_t`, the values are
+  // promoted to `int`, which brings us back to undefined overflow. This is fine
+  // here because the difference of any two `int16_t`s fits in `int`, but
+  // `WrappingMul` will need a more complex implementation.
+  using Unsigned = std::make_unsigned_t<T>;
+  return static_cast<T>(static_cast<Unsigned>(a) - static_cast<Unsigned>(b));
+}
+
+}  // namespace v8::base
+
+#endif  // V8_BASE_NUMERICS_WRAPPING_MATH_H_
diff --git a/deps/v8/src/base/platform/time.h b/deps/v8/src/base/platform/time.h
index 808e0776ddac49..db62c0c21e5444 100644
--- a/deps/v8/src/base/platform/time.h
+++ b/deps/v8/src/base/platform/time.h
@@ -14,7 +14,7 @@
 #include "src/base/base-export.h"
 #include "src/base/bits.h"
 #include "src/base/macros.h"
-#include "src/base/safe_conversions.h"
+#include "src/base/numerics/safe_conversions.h"
 #if V8_OS_WIN
 #include "src/base/win32-headers.h"
 #endif
@@ -56,6 +56,9 @@ class TimeConstants {
   static constexpr int64_t kNanosecondsPerMicrosecond = 1000;
   static constexpr int64_t kNanosecondsPerSecond =
       kNanosecondsPerMicrosecond * kMicrosecondsPerSecond;
+
+  // Support defaulted comparison of subclasses.
+  constexpr auto operator<=>(const TimeConstants&) const = default;
 };
 
 // -----------------------------------------------------------------------------
@@ -189,25 +192,7 @@ class V8_BASE_EXPORT TimeDelta final {
     return delta_ / other.delta_;
   }
 
-  // Comparison operators.
-  constexpr bool operator==(const TimeDelta& other) const {
-    return delta_ == other.delta_;
-  }
-  constexpr bool operator!=(const TimeDelta& other) const {
-    return delta_ != other.delta_;
-  }
-  constexpr bool operator<(const TimeDelta& other) const {
-    return delta_ < other.delta_;
-  }
-  constexpr bool operator<=(const TimeDelta& other) const {
-    return delta_ <= other.delta_;
-  }
-  constexpr bool operator>(const TimeDelta& other) const {
-    return delta_ > other.delta_;
-  }
-  constexpr bool operator>=(const TimeDelta& other) const {
-    return delta_ >= other.delta_;
-  }
+  constexpr auto operator<=>(const TimeDelta&) const = default;
 
   friend void swap(TimeDelta a, TimeDelta b) { std::swap(a.delta_, b.delta_); }
 
@@ -322,25 +307,7 @@ class TimeBase : public TimeConstants {
     return static_cast<TimeClass&>(*this = (*this - delta));
   }
 
-  // Comparison operators
-  bool operator==(const TimeBase<TimeClass>& other) const {
-    return us_ == other.us_;
-  }
-  bool operator!=(const TimeBase<TimeClass>& other) const {
-    return us_ != other.us_;
-  }
-  bool operator<(const TimeBase<TimeClass>& other) const {
-    return us_ < other.us_;
-  }
-  bool operator<=(const TimeBase<TimeClass>& other) const {
-    return us_ <= other.us_;
-  }
-  bool operator>(const TimeBase<TimeClass>& other) const {
-    return us_ > other.us_;
-  }
-  bool operator>=(const TimeBase<TimeClass>& other) const {
-    return us_ >= other.us_;
-  }
+  constexpr auto operator<=>(const TimeBase&) const = default;
 
   // Converts an integer value representing TimeClass to a class. This is used
   // when deserializing a |TimeClass| structure, using a value known to be
diff --git a/deps/v8/src/base/region-allocator.cc b/deps/v8/src/base/region-allocator.cc
index 487362d3de0e80..6cfee970914394 100644
--- a/deps/v8/src/base/region-allocator.cc
+++ b/deps/v8/src/base/region-allocator.cc
@@ -176,8 +176,14 @@ bool RegionAllocator::AllocateRegionAt(Address requested_address, size_t size,
   DCHECK_NE(region_state, RegionState::kFree);
 
   Address requested_end = requested_address + size;
-  DCHECK_LE(requested_end, end());
 
+  // Fail if the region would outgrow the total reservation or the addition
+  // overflows.
+  if (requested_end > end() || requested_end < requested_address) {
+    return false;
+  }
+
+  DCHECK_LE(requested_end, end());
   Region* region;
   {
     AllRegionsSet::iterator region_iter = FindRegion(requested_address);
@@ -321,6 +327,33 @@ size_t RegionAllocator::TrimRegion(Address address, size_t new_size) {
   return size;
 }
 
+bool RegionAllocator::TryGrowRegion(Address address, size_t new_size) {
+  DCHECK(IsAligned(new_size, page_size_));
+
+  AllRegionsSet::iterator region_iter = FindRegion(address);
+  if (region_iter == all_regions_.end()) {
+    return false;
+  }
+  Region* region = *region_iter;
+  if (region->begin() != address || !region->is_allocated()) {
+    return false;
+  }
+
+  // The region must not be in the free list.
+  DCHECK_EQ(free_regions_.find(*region_iter), free_regions_.end());
+  DCHECK_LT(region->size(), new_size);
+
+  if (!AllocateRegionAt(region->end(), new_size - region->size())) {
+    return false;
+  }
+
+  AllRegionsSet::iterator new_region_iter = std::next(region_iter);
+  DCHECK_NE(new_region_iter, all_regions_.end());
+
+  Merge(region_iter, new_region_iter);
+  return true;
+}
+
 size_t RegionAllocator::CheckRegion(Address address) {
   AllRegionsSet::iterator region_iter = FindRegion(address);
   if (region_iter == all_regions_.end()) {
diff --git a/deps/v8/src/base/region-allocator.h b/deps/v8/src/base/region-allocator.h
index 5a81a2eec821df..cc997d3268a41e 100644
--- a/deps/v8/src/base/region-allocator.h
+++ b/deps/v8/src/base/region-allocator.h
@@ -105,6 +105,10 @@ class V8_BASE_EXPORT RegionAllocator final {
   // frees the region.
   size_t TrimRegion(Address address, size_t new_size);
 
+  // Tries to grow the region at |address| to the size |new_size|. Returns true
+  // on success.
+  bool TryGrowRegion(Address address, size_t new_size);
+
   // If there is a used region starting at given address returns its size
   // otherwise 0.
   size_t CheckRegion(Address address);
diff --git a/deps/v8/src/base/safe_conversions_arm_impl.h b/deps/v8/src/base/safe_conversions_arm_impl.h
deleted file mode 100644
index fdcc2cb667db56..00000000000000
--- a/deps/v8/src/base/safe_conversions_arm_impl.h
+++ /dev/null
@@ -1,56 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Slightly adapted for inclusion in V8.
-// Copyright 2014 the V8 project authors. All rights reserved.
-// List of adaptations:
-// - include guard names
-// - wrap in v8 namespace
-// - include paths
-
-#ifndef V8_BASE_SAFE_CONVERSIONS_ARM_IMPL_H_
-#define V8_BASE_SAFE_CONVERSIONS_ARM_IMPL_H_
-
-#include <stdint.h>
-
-#include <type_traits>
-
-#include "src/base/safe_conversions_impl.h"
-
-namespace v8::base::internal {
-
-// Fast saturation to a destination type.
-template <typename Dst, typename Src>
-struct SaturateFastAsmOp {
-  static constexpr bool is_supported =
-      kEnableAsmCode && std::is_signed_v<Src> && std::is_integral_v<Dst> &&
-      std::is_integral_v<Src> &&
-      IntegerBitsPlusSign<Src>::value <= IntegerBitsPlusSign<int32_t>::value &&
-      IntegerBitsPlusSign<Dst>::value <= IntegerBitsPlusSign<int32_t>::value &&
-      !IsTypeInRangeForNumericType<Dst, Src>::value;
-
-  __attribute__((always_inline)) static Dst Do(Src value) {
-    int32_t src = value;
-    typename std::conditional<std::is_signed_v<Dst>, int32_t, uint32_t>::type
-        result;
-    if (std::is_signed_v<Dst>) {
-      asm("ssat %[dst], %[shift], %[src]"
-          : [dst] "=r"(result)
-          : [src] "r"(src), [shift] "n"(IntegerBitsPlusSign<Dst>::value <= 32
-                                            ? IntegerBitsPlusSign<Dst>::value
-                                            : 32));
-    } else {
-      asm("usat %[dst], %[shift], %[src]"
-          : [dst] "=r"(result)
-          : [src] "r"(src), [shift] "n"(IntegerBitsPlusSign<Dst>::value < 32
-                                            ? IntegerBitsPlusSign<Dst>::value
-                                            : 31));
-    }
-    return static_cast<Dst>(result);
-  }
-};
-
-}  // namespace v8::base::internal
-
-#endif  // V8_BASE_SAFE_CONVERSIONS_ARM_IMPL_H_
diff --git a/deps/v8/src/base/safe_conversions_impl.h b/deps/v8/src/base/safe_conversions_impl.h
deleted file mode 100644
index e3d5d86c544d61..00000000000000
--- a/deps/v8/src/base/safe_conversions_impl.h
+++ /dev/null
@@ -1,798 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Slightly adapted for inclusion in V8.
-// Copyright 2014 the V8 project authors. All rights reserved.
-// List of adaptations:
-// - include guard names
-// - wrap in v8 namespace
-// - formatting (git cl format)
-
-#ifndef V8_BASE_SAFE_CONVERSIONS_IMPL_H_
-#define V8_BASE_SAFE_CONVERSIONS_IMPL_H_
-
-#include <stddef.h>
-#include <stdint.h>
-
-#include <concepts>
-#include <limits>
-#include <type_traits>
-
-namespace v8::base::internal {
-
-// The std library doesn't provide a binary max_exponent for integers, however
-// we can compute an analog using std::numeric_limits<>::digits.
-template <typename NumericType>
-struct MaxExponent {
-  static const int value = std::is_floating_point_v<NumericType>
-                               ? std::numeric_limits<NumericType>::max_exponent
-                               : std::numeric_limits<NumericType>::digits + 1;
-};
-
-// The number of bits (including the sign) in an integer. Eliminates sizeof
-// hacks.
-template <typename NumericType>
-struct IntegerBitsPlusSign {
-  static const int value =
-      std::numeric_limits<NumericType>::digits + std::is_signed_v<NumericType>;
-};
-
-// Helper templates for integer manipulations.
-
-template <typename Integer>
-struct PositionOfSignBit {
-  static const size_t value = IntegerBitsPlusSign<Integer>::value - 1;
-};
-
-// Determines if a numeric value is negative without throwing compiler
-// warnings on: unsigned(value) < 0.
-template <typename T>
-  requires(std::is_arithmetic_v<T> && std::is_signed_v<T>)
-constexpr bool IsValueNegative(T value) {
-  return value < 0;
-}
-
-template <typename T>
-  requires(std::is_arithmetic_v<T> && std::is_unsigned_v<T>)
-constexpr bool IsValueNegative(T) {
-  return false;
-}
-
-// This performs a fast negation, returning a signed value. It works on unsigned
-// arguments, but probably doesn't do what you want for any unsigned value
-// larger than max / 2 + 1 (i.e. signed min cast to unsigned).
-template <typename T>
-constexpr typename std::make_signed<T>::type ConditionalNegate(
-    T x, bool is_negative) {
-  static_assert(std::is_integral_v<T>, "Type must be integral");
-  using SignedT = typename std::make_signed<T>::type;
-  using UnsignedT = typename std::make_unsigned<T>::type;
-  return static_cast<SignedT>((static_cast<UnsignedT>(x) ^
-                               static_cast<UnsignedT>(-SignedT(is_negative))) +
-                              is_negative);
-}
-
-// This performs a safe, absolute value via unsigned overflow.
-template <typename T>
-constexpr typename std::make_unsigned<T>::type SafeUnsignedAbs(T value) {
-  static_assert(std::is_integral_v<T>, "Type must be integral");
-  using UnsignedT = typename std::make_unsigned<T>::type;
-  return IsValueNegative(value)
-             ? static_cast<UnsignedT>(0u - static_cast<UnsignedT>(value))
-             : static_cast<UnsignedT>(value);
-}
-
-// TODO(jschuh): Switch to std::is_constant_evaluated() once C++20 is supported.
-// Alternately, the usage could be restructured for "consteval if" in C++23.
-#define IsConstantEvaluated() (__builtin_is_constant_evaluated())
-
-// TODO(jschuh): Debug builds don't reliably propagate constants, so we restrict
-// some accelerated runtime paths to release builds until this can be forced
-// with consteval support in C++20 or C++23.
-#if defined(NDEBUG)
-constexpr bool kEnableAsmCode = true;
-#else
-constexpr bool kEnableAsmCode = false;
-#endif
-
-// Forces a crash, like a CHECK(false). Used for numeric boundary errors.
-// Also used in a constexpr template to trigger a compilation failure on
-// an error condition.
-struct CheckOnFailure {
-  template <typename T>
-  static T HandleFailure() {
-#if defined(_MSC_VER)
-    __debugbreak();
-#elif defined(__GNUC__) || defined(__clang__)
-    __builtin_trap();
-#else
-    ((void)(*(volatile char*)0 = 0));
-#endif
-    return T();
-  }
-};
-
-enum IntegerRepresentation {
-  INTEGER_REPRESENTATION_UNSIGNED,
-  INTEGER_REPRESENTATION_SIGNED
-};
-
-// A range for a given nunmeric Src type is contained for a given numeric Dst
-// type if both numeric_limits<Src>::max() <= numeric_limits<Dst>::max() and
-// numeric_limits<Src>::lowest() >= numeric_limits<Dst>::lowest() are true.
-// We implement this as template specializations rather than simple static
-// comparisons to ensure type correctness in our comparisons.
-enum NumericRangeRepresentation {
-  NUMERIC_RANGE_NOT_CONTAINED,
-  NUMERIC_RANGE_CONTAINED
-};
-
-// Helper templates to statically determine if our destination type can contain
-// maximum and minimum values represented by the source type.
-
-template <typename Dst, typename Src,
-          IntegerRepresentation DstSign = std::is_signed_v<Dst>
-                                              ? INTEGER_REPRESENTATION_SIGNED
-                                              : INTEGER_REPRESENTATION_UNSIGNED,
-          IntegerRepresentation SrcSign = std::is_signed_v<Src>
-                                              ? INTEGER_REPRESENTATION_SIGNED
-                                              : INTEGER_REPRESENTATION_UNSIGNED>
-struct StaticDstRangeRelationToSrcRange;
-
-// Same sign: Dst is guaranteed to contain Src only if its range is equal or
-// larger.
-template <typename Dst, typename Src, IntegerRepresentation Sign>
-struct StaticDstRangeRelationToSrcRange<Dst, Src, Sign, Sign> {
-  static const NumericRangeRepresentation value =
-      MaxExponent<Dst>::value >= MaxExponent<Src>::value
-          ? NUMERIC_RANGE_CONTAINED
-          : NUMERIC_RANGE_NOT_CONTAINED;
-};
-
-// Unsigned to signed: Dst is guaranteed to contain source only if its range is
-// larger.
-template <typename Dst, typename Src>
-struct StaticDstRangeRelationToSrcRange<Dst,
-                                        Src,
-                                        INTEGER_REPRESENTATION_SIGNED,
-                                        INTEGER_REPRESENTATION_UNSIGNED> {
-  static const NumericRangeRepresentation value =
-      MaxExponent<Dst>::value > MaxExponent<Src>::value
-          ? NUMERIC_RANGE_CONTAINED
-          : NUMERIC_RANGE_NOT_CONTAINED;
-};
-
-// Signed to unsigned: Dst cannot be statically determined to contain Src.
-template <typename Dst, typename Src>
-struct StaticDstRangeRelationToSrcRange<Dst,
-                                        Src,
-                                        INTEGER_REPRESENTATION_UNSIGNED,
-                                        INTEGER_REPRESENTATION_SIGNED> {
-  static const NumericRangeRepresentation value = NUMERIC_RANGE_NOT_CONTAINED;
-};
-
-// This class wraps the range constraints as separate booleans so the compiler
-// can identify constants and eliminate unused code paths.
-class RangeCheck {
- public:
-  constexpr RangeCheck(bool is_in_lower_bound, bool is_in_upper_bound)
-      : is_underflow_(!is_in_lower_bound), is_overflow_(!is_in_upper_bound) {}
-  constexpr RangeCheck() : is_underflow_(false), is_overflow_(false) {}
-  constexpr bool IsValid() const { return !is_overflow_ && !is_underflow_; }
-  constexpr bool IsInvalid() const { return is_overflow_ && is_underflow_; }
-  constexpr bool IsOverflow() const { return is_overflow_ && !is_underflow_; }
-  constexpr bool IsUnderflow() const { return !is_overflow_ && is_underflow_; }
-  constexpr bool IsOverflowFlagSet() const { return is_overflow_; }
-  constexpr bool IsUnderflowFlagSet() const { return is_underflow_; }
-  constexpr bool operator==(const RangeCheck rhs) const {
-    return is_underflow_ == rhs.is_underflow_ &&
-           is_overflow_ == rhs.is_overflow_;
-  }
-  constexpr bool operator!=(const RangeCheck rhs) const {
-    return !(*this == rhs);
-  }
-
- private:
-  // Do not change the order of these member variables. The integral conversion
-  // optimization depends on this exact order.
-  const bool is_underflow_;
-  const bool is_overflow_;
-};
-
-// The following helper template addresses a corner case in range checks for
-// conversion from a floating-point type to an integral type of smaller range
-// but larger precision (e.g. float -> unsigned). The problem is as follows:
-//   1. Integral maximum is always one less than a power of two, so it must be
-//      truncated to fit the mantissa of the floating point. The direction of
-//      rounding is implementation defined, but by default it's always IEEE
-//      floats, which round to nearest and thus result in a value of larger
-//      magnitude than the integral value.
-//      Example: float f = UINT_MAX; // f is 4294967296f but UINT_MAX
-//                                   // is 4294967295u.
-//   2. If the floating point value is equal to the promoted integral maximum
-//      value, a range check will erroneously pass.
-//      Example: (4294967296f <= 4294967295u) // This is true due to a precision
-//                                            // loss in rounding up to float.
-//   3. When the floating point value is then converted to an integral, the
-//      resulting value is out of range for the target integral type and
-//      thus is implementation defined.
-//      Example: unsigned u = (float)INT_MAX; // u will typically overflow to 0.
-// To fix this bug we manually truncate the maximum value when the destination
-// type is an integral of larger precision than the source floating-point type,
-// such that the resulting maximum is represented exactly as a floating point.
-template <typename Dst, typename Src, template <typename> class Bounds>
-struct NarrowingRange {
-  using SrcLimits = std::numeric_limits<Src>;
-  using DstLimits = typename std::numeric_limits<Dst>;
-
-  // Computes the mask required to make an accurate comparison between types.
-  static const int kShift =
-      (MaxExponent<Src>::value > MaxExponent<Dst>::value &&
-       SrcLimits::digits < DstLimits::digits)
-          ? (DstLimits::digits - SrcLimits::digits)
-          : 0;
-
-  template <typename T>
-    requires(std::integral<T>)
-  // Masks out the integer bits that are beyond the precision of the
-  // intermediate type used for comparison.
-  static constexpr T Adjust(T value) {
-    static_assert(std::is_same_v<T, Dst>, "");
-    static_assert(kShift < DstLimits::digits, "");
-    using UnsignedDst = typename std::make_unsigned_t<T>;
-    return static_cast<T>(ConditionalNegate(
-        SafeUnsignedAbs(value) & ~((UnsignedDst{1} << kShift) - UnsignedDst{1}),
-        IsValueNegative(value)));
-  }
-
-  template <typename T>
-    requires(std::floating_point<T>)
-  static constexpr T Adjust(T value) {
-    static_assert(std::is_same_v<T, Dst>, "");
-    static_assert(kShift == 0, "");
-    return value;
-  }
-
-  static constexpr Dst max() { return Adjust(Bounds<Dst>::max()); }
-  static constexpr Dst lowest() { return Adjust(Bounds<Dst>::lowest()); }
-};
-
-template <typename Dst, typename Src, template <typename> class Bounds,
-          IntegerRepresentation DstSign = std::is_signed_v<Dst>
-                                              ? INTEGER_REPRESENTATION_SIGNED
-                                              : INTEGER_REPRESENTATION_UNSIGNED,
-          IntegerRepresentation SrcSign = std::is_signed_v<Src>
-                                              ? INTEGER_REPRESENTATION_SIGNED
-                                              : INTEGER_REPRESENTATION_UNSIGNED,
-          NumericRangeRepresentation DstRange =
-              StaticDstRangeRelationToSrcRange<Dst, Src>::value>
-struct DstRangeRelationToSrcRangeImpl;
-
-// The following templates are for ranges that must be verified at runtime. We
-// split it into checks based on signedness to avoid confusing casts and
-// compiler warnings on signed an unsigned comparisons.
-
-// Same sign narrowing: The range is contained for normal limits.
-template <typename Dst, typename Src, template <typename> class Bounds,
-          IntegerRepresentation DstSign, IntegerRepresentation SrcSign>
-struct DstRangeRelationToSrcRangeImpl<Dst, Src, Bounds, DstSign, SrcSign,
-                                      NUMERIC_RANGE_CONTAINED> {
-  static constexpr RangeCheck Check(Src value) {
-    using SrcLimits = std::numeric_limits<Src>;
-    using DstLimits = NarrowingRange<Dst, Src, Bounds>;
-    return RangeCheck(
-        static_cast<Dst>(SrcLimits::lowest()) >= DstLimits::lowest() ||
-            static_cast<Dst>(value) >= DstLimits::lowest(),
-        static_cast<Dst>(SrcLimits::max()) <= DstLimits::max() ||
-            static_cast<Dst>(value) <= DstLimits::max());
-  }
-};
-
-// Signed to signed narrowing: Both the upper and lower boundaries may be
-// exceeded for standard limits.
-template <typename Dst, typename Src, template <typename> class Bounds>
-struct DstRangeRelationToSrcRangeImpl<
-    Dst, Src, Bounds, INTEGER_REPRESENTATION_SIGNED,
-    INTEGER_REPRESENTATION_SIGNED, NUMERIC_RANGE_NOT_CONTAINED> {
-  static constexpr RangeCheck Check(Src value) {
-    using DstLimits = NarrowingRange<Dst, Src, Bounds>;
-    return RangeCheck(value >= DstLimits::lowest(), value <= DstLimits::max());
-  }
-};
-
-// Unsigned to unsigned narrowing: Only the upper bound can be exceeded for
-// standard limits.
-template <typename Dst, typename Src, template <typename> class Bounds>
-struct DstRangeRelationToSrcRangeImpl<
-    Dst, Src, Bounds, INTEGER_REPRESENTATION_UNSIGNED,
-    INTEGER_REPRESENTATION_UNSIGNED, NUMERIC_RANGE_NOT_CONTAINED> {
-  static constexpr RangeCheck Check(Src value) {
-    using DstLimits = NarrowingRange<Dst, Src, Bounds>;
-    return RangeCheck(
-        DstLimits::lowest() == Dst(0) || value >= DstLimits::lowest(),
-        value <= DstLimits::max());
-  }
-};
-
-// Unsigned to signed: Only the upper bound can be exceeded for standard limits.
-template <typename Dst, typename Src, template <typename> class Bounds>
-struct DstRangeRelationToSrcRangeImpl<
-    Dst, Src, Bounds, INTEGER_REPRESENTATION_SIGNED,
-    INTEGER_REPRESENTATION_UNSIGNED, NUMERIC_RANGE_NOT_CONTAINED> {
-  static constexpr RangeCheck Check(Src value) {
-    using DstLimits = NarrowingRange<Dst, Src, Bounds>;
-    using Promotion = decltype(Src() + Dst());
-    return RangeCheck(DstLimits::lowest() <= Dst(0) ||
-                          static_cast<Promotion>(value) >=
-                              static_cast<Promotion>(DstLimits::lowest()),
-                      static_cast<Promotion>(value) <=
-                          static_cast<Promotion>(DstLimits::max()));
-  }
-};
-
-// Signed to unsigned: The upper boundary may be exceeded for a narrower Dst,
-// and any negative value exceeds the lower boundary for standard limits.
-template <typename Dst, typename Src, template <typename> class Bounds>
-struct DstRangeRelationToSrcRangeImpl<
-    Dst, Src, Bounds, INTEGER_REPRESENTATION_UNSIGNED,
-    INTEGER_REPRESENTATION_SIGNED, NUMERIC_RANGE_NOT_CONTAINED> {
-  static constexpr RangeCheck Check(Src value) {
-    using SrcLimits = std::numeric_limits<Src>;
-    using DstLimits = NarrowingRange<Dst, Src, Bounds>;
-    using Promotion = decltype(Src() + Dst());
-    bool ge_zero = false;
-    // Converting floating-point to integer will discard fractional part, so
-    // values in (-1.0, -0.0) will truncate to 0 and fit in Dst.
-    if (std::is_floating_point_v<Src>) {
-      ge_zero = value > Src(-1);
-    } else {
-      ge_zero = value >= Src(0);
-    }
-    return RangeCheck(
-        ge_zero && (DstLimits::lowest() == 0 ||
-                    static_cast<Dst>(value) >= DstLimits::lowest()),
-        static_cast<Promotion>(SrcLimits::max()) <=
-                static_cast<Promotion>(DstLimits::max()) ||
-            static_cast<Promotion>(value) <=
-                static_cast<Promotion>(DstLimits::max()));
-  }
-};
-
-// Simple wrapper for statically checking if a type's range is contained.
-template <typename Dst, typename Src>
-struct IsTypeInRangeForNumericType {
-  static const bool value = StaticDstRangeRelationToSrcRange<Dst, Src>::value ==
-                            NUMERIC_RANGE_CONTAINED;
-};
-
-template <typename Dst, template <typename> class Bounds = std::numeric_limits,
-          typename Src>
-constexpr RangeCheck DstRangeRelationToSrcRange(Src value) {
-  static_assert(std::is_arithmetic_v<Src>, "Argument must be numeric.");
-  static_assert(std::is_arithmetic_v<Dst>, "Result must be numeric.");
-  static_assert(Bounds<Dst>::lowest() < Bounds<Dst>::max(), "");
-  return DstRangeRelationToSrcRangeImpl<Dst, Src, Bounds>::Check(value);
-}
-
-// Integer promotion templates used by the portable checked integer arithmetic.
-template <size_t Size, bool IsSigned>
-struct IntegerForDigitsAndSign;
-
-#define INTEGER_FOR_DIGITS_AND_SIGN(I)                          \
-  template <>                                                   \
-  struct IntegerForDigitsAndSign<IntegerBitsPlusSign<I>::value, \
-                                 std::is_signed_v<I>> {         \
-    using type = I;                                             \
-  }
-
-INTEGER_FOR_DIGITS_AND_SIGN(int8_t);
-INTEGER_FOR_DIGITS_AND_SIGN(uint8_t);
-INTEGER_FOR_DIGITS_AND_SIGN(int16_t);
-INTEGER_FOR_DIGITS_AND_SIGN(uint16_t);
-INTEGER_FOR_DIGITS_AND_SIGN(int32_t);
-INTEGER_FOR_DIGITS_AND_SIGN(uint32_t);
-INTEGER_FOR_DIGITS_AND_SIGN(int64_t);
-INTEGER_FOR_DIGITS_AND_SIGN(uint64_t);
-#undef INTEGER_FOR_DIGITS_AND_SIGN
-
-// WARNING: We have no IntegerForSizeAndSign<16, *>. If we ever add one to
-// support 128-bit math, then the ArithmeticPromotion template below will need
-// to be updated (or more likely replaced with a decltype expression).
-static_assert(IntegerBitsPlusSign<intmax_t>::value == 64,
-              "Max integer size not supported for this toolchain.");
-
-template <typename Integer, bool IsSigned = std::is_signed_v<Integer>>
-struct TwiceWiderInteger {
-  using type =
-      typename IntegerForDigitsAndSign<IntegerBitsPlusSign<Integer>::value * 2,
-                                       IsSigned>::type;
-};
-
-enum ArithmeticPromotionCategory {
-  LEFT_PROMOTION,  // Use the type of the left-hand argument.
-  RIGHT_PROMOTION  // Use the type of the right-hand argument.
-};
-
-// Determines the type that can represent the largest positive value.
-template <typename Lhs, typename Rhs,
-          ArithmeticPromotionCategory Promotion =
-              (MaxExponent<Lhs>::value > MaxExponent<Rhs>::value)
-                  ? LEFT_PROMOTION
-                  : RIGHT_PROMOTION>
-struct MaxExponentPromotion;
-
-template <typename Lhs, typename Rhs>
-struct MaxExponentPromotion<Lhs, Rhs, LEFT_PROMOTION> {
-  using type = Lhs;
-};
-
-template <typename Lhs, typename Rhs>
-struct MaxExponentPromotion<Lhs, Rhs, RIGHT_PROMOTION> {
-  using type = Rhs;
-};
-
-// Determines the type that can represent the lowest arithmetic value.
-template <typename Lhs, typename Rhs,
-          ArithmeticPromotionCategory Promotion =
-              std::is_signed_v<Lhs>
-                  ? (std::is_signed_v<Rhs>
-                         ? (MaxExponent<Lhs>::value > MaxExponent<Rhs>::value
-                                ? LEFT_PROMOTION
-                                : RIGHT_PROMOTION)
-                         : LEFT_PROMOTION)
-                  : (std::is_signed_v<Rhs>
-                         ? RIGHT_PROMOTION
-                         : (MaxExponent<Lhs>::value < MaxExponent<Rhs>::value
-                                ? LEFT_PROMOTION
-                                : RIGHT_PROMOTION))>
-struct LowestValuePromotion;
-
-template <typename Lhs, typename Rhs>
-struct LowestValuePromotion<Lhs, Rhs, LEFT_PROMOTION> {
-  using type = Lhs;
-};
-
-template <typename Lhs, typename Rhs>
-struct LowestValuePromotion<Lhs, Rhs, RIGHT_PROMOTION> {
-  using type = Rhs;
-};
-
-// Determines the type that is best able to represent an arithmetic result.
-template <
-    typename Lhs, typename Rhs = Lhs,
-    bool is_intmax_type =
-        std::is_integral_v<typename MaxExponentPromotion<Lhs, Rhs>::type> &&
-        IntegerBitsPlusSign<typename MaxExponentPromotion<Lhs, Rhs>::type>::
-                value == IntegerBitsPlusSign<intmax_t>::value,
-    bool is_max_exponent =
-        StaticDstRangeRelationToSrcRange<
-            typename MaxExponentPromotion<Lhs, Rhs>::type, Lhs>::value ==
-            NUMERIC_RANGE_CONTAINED &&
-        StaticDstRangeRelationToSrcRange<
-            typename MaxExponentPromotion<Lhs, Rhs>::type, Rhs>::value ==
-            NUMERIC_RANGE_CONTAINED>
-struct BigEnoughPromotion;
-
-// The side with the max exponent is big enough.
-template <typename Lhs, typename Rhs, bool is_intmax_type>
-struct BigEnoughPromotion<Lhs, Rhs, is_intmax_type, true> {
-  using type = typename MaxExponentPromotion<Lhs, Rhs>::type;
-  static const bool is_contained = true;
-};
-
-// We can use a twice wider type to fit.
-template <typename Lhs, typename Rhs>
-struct BigEnoughPromotion<Lhs, Rhs, false, false> {
-  using type =
-      typename TwiceWiderInteger<typename MaxExponentPromotion<Lhs, Rhs>::type,
-                                 std::is_signed_v<Lhs> ||
-                                     std::is_signed_v<Rhs>>::type;
-  static const bool is_contained = true;
-};
-
-// No type is large enough.
-template <typename Lhs, typename Rhs>
-struct BigEnoughPromotion<Lhs, Rhs, true, false> {
-  using type = typename MaxExponentPromotion<Lhs, Rhs>::type;
-  static const bool is_contained = false;
-};
-
-// We can statically check if operations on the provided types can wrap, so we
-// can skip the checked operations if they're not needed. So, for an integer we
-// care if the destination type preserves the sign and is twice the width of
-// the source.
-template <typename T, typename Lhs, typename Rhs = Lhs>
-struct IsIntegerArithmeticSafe {
-  static const bool value =
-      !std::is_floating_point_v<T> && !std::is_floating_point_v<Lhs> &&
-      !std::is_floating_point_v<Rhs> &&
-      std::is_signed_v<T> >= std::is_signed_v<Lhs> &&
-      IntegerBitsPlusSign<T>::value >= (2 * IntegerBitsPlusSign<Lhs>::value) &&
-      std::is_signed_v<T> >= std::is_signed_v<Rhs> &&
-      IntegerBitsPlusSign<T>::value >= (2 * IntegerBitsPlusSign<Rhs>::value);
-};
-
-// Promotes to a type that can represent any possible result of a binary
-// arithmetic operation with the source types.
-template <typename Lhs, typename Rhs>
-struct FastIntegerArithmeticPromotion {
-  using type = typename BigEnoughPromotion<Lhs, Rhs>::type;
-  static const bool is_contained = false;
-};
-
-template <typename Lhs, typename Rhs>
-  requires(IsIntegerArithmeticSafe<
-           std::conditional_t<std::is_signed_v<Lhs> || std::is_signed_v<Rhs>,
-                              intmax_t, uintmax_t>,
-           typename MaxExponentPromotion<Lhs, Rhs>::type>::value)
-struct FastIntegerArithmeticPromotion<Lhs, Rhs> {
-  using type =
-      typename TwiceWiderInteger<typename MaxExponentPromotion<Lhs, Rhs>::type,
-                                 std::is_signed_v<Lhs> ||
-                                     std::is_signed_v<Rhs>>::type;
-  static_assert(IsIntegerArithmeticSafe<type, Lhs, Rhs>::value, "");
-  static const bool is_contained = true;
-};
-
-// Extracts the underlying type from an enum.
-template <typename T>
-struct ArithmeticOrUnderlyingEnum {
-  using type = T;
-  static const bool value = std::is_arithmetic_v<type>;
-};
-
-template <typename T>
-  requires(std::is_enum_v<T>)
-struct ArithmeticOrUnderlyingEnum<T> {
-  using type = typename std::underlying_type<T>::type;
-  static const bool value = std::is_arithmetic_v<type>;
-};
-
-// The following are helper templates used in the CheckedNumeric class.
-template <typename T>
-class CheckedNumeric;
-
-template <typename T>
-class ClampedNumeric;
-
-template <typename T>
-class StrictNumeric;
-
-// Used to treat CheckedNumeric and arithmetic underlying types the same.
-template <typename T>
-struct UnderlyingType {
-  using type = typename ArithmeticOrUnderlyingEnum<T>::type;
-  static const bool is_numeric = std::is_arithmetic_v<type>;
-  static const bool is_checked = false;
-  static const bool is_clamped = false;
-  static const bool is_strict = false;
-};
-
-template <typename T>
-struct UnderlyingType<CheckedNumeric<T>> {
-  using type = T;
-  static const bool is_numeric = true;
-  static const bool is_checked = true;
-  static const bool is_clamped = false;
-  static const bool is_strict = false;
-};
-
-template <typename T>
-struct UnderlyingType<ClampedNumeric<T>> {
-  using type = T;
-  static const bool is_numeric = true;
-  static const bool is_checked = false;
-  static const bool is_clamped = true;
-  static const bool is_strict = false;
-};
-
-template <typename T>
-struct UnderlyingType<StrictNumeric<T>> {
-  using type = T;
-  static const bool is_numeric = true;
-  static const bool is_checked = false;
-  static const bool is_clamped = false;
-  static const bool is_strict = true;
-};
-
-template <typename L, typename R>
-struct IsCheckedOp {
-  static const bool value =
-      UnderlyingType<L>::is_numeric && UnderlyingType<R>::is_numeric &&
-      (UnderlyingType<L>::is_checked || UnderlyingType<R>::is_checked);
-};
-
-template <typename L, typename R>
-struct IsClampedOp {
-  static const bool value =
-      UnderlyingType<L>::is_numeric && UnderlyingType<R>::is_numeric &&
-      (UnderlyingType<L>::is_clamped || UnderlyingType<R>::is_clamped) &&
-      !(UnderlyingType<L>::is_checked || UnderlyingType<R>::is_checked);
-};
-
-template <typename L, typename R>
-struct IsStrictOp {
-  static const bool value =
-      UnderlyingType<L>::is_numeric && UnderlyingType<R>::is_numeric &&
-      (UnderlyingType<L>::is_strict || UnderlyingType<R>::is_strict) &&
-      !(UnderlyingType<L>::is_checked || UnderlyingType<R>::is_checked) &&
-      !(UnderlyingType<L>::is_clamped || UnderlyingType<R>::is_clamped);
-};
-
-// as_signed<> returns the supplied integral value (or integral castable
-// Numeric template) cast as a signed integral of equivalent precision.
-// I.e. it's mostly an alias for: static_cast<std::make_signed<T>::type>(t)
-template <typename Src>
-constexpr typename std::make_signed<
-    typename base::internal::UnderlyingType<Src>::type>::type
-as_signed(const Src value) {
-  static_assert(std::is_integral_v<decltype(as_signed(value))>,
-                "Argument must be a signed or unsigned integer type.");
-  return static_cast<decltype(as_signed(value))>(value);
-}
-
-// as_unsigned<> returns the supplied integral value (or integral castable
-// Numeric template) cast as an unsigned integral of equivalent precision.
-// I.e. it's mostly an alias for: static_cast<std::make_unsigned<T>::type>(t)
-template <typename Src>
-constexpr typename std::make_unsigned<
-    typename base::internal::UnderlyingType<Src>::type>::type
-as_unsigned(const Src value) {
-  static_assert(std::is_integral_v<decltype(as_unsigned(value))>,
-                "Argument must be a signed or unsigned integer type.");
-  return static_cast<decltype(as_unsigned(value))>(value);
-}
-
-template <typename L, typename R>
-constexpr bool IsLessImpl(const L lhs, const R rhs, const RangeCheck l_range,
-                          const RangeCheck r_range) {
-  return l_range.IsUnderflow() || r_range.IsOverflow() ||
-         (l_range == r_range && static_cast<decltype(lhs + rhs)>(lhs) <
-                                    static_cast<decltype(lhs + rhs)>(rhs));
-}
-
-template <typename L, typename R>
-struct IsLess {
-  static_assert(std::is_arithmetic_v<L> && std::is_arithmetic_v<R>,
-                "Types must be numeric.");
-  static constexpr bool Test(const L lhs, const R rhs) {
-    return IsLessImpl(lhs, rhs, DstRangeRelationToSrcRange<R>(lhs),
-                      DstRangeRelationToSrcRange<L>(rhs));
-  }
-};
-
-template <typename L, typename R>
-constexpr bool IsLessOrEqualImpl(const L lhs, const R rhs,
-                                 const RangeCheck l_range,
-                                 const RangeCheck r_range) {
-  return l_range.IsUnderflow() || r_range.IsOverflow() ||
-         (l_range == r_range && static_cast<decltype(lhs + rhs)>(lhs) <=
-                                    static_cast<decltype(lhs + rhs)>(rhs));
-}
-
-template <typename L, typename R>
-struct IsLessOrEqual {
-  static_assert(std::is_arithmetic_v<L> && std::is_arithmetic_v<R>,
-                "Types must be numeric.");
-  static constexpr bool Test(const L lhs, const R rhs) {
-    return IsLessOrEqualImpl(lhs, rhs, DstRangeRelationToSrcRange<R>(lhs),
-                             DstRangeRelationToSrcRange<L>(rhs));
-  }
-};
-
-template <typename L, typename R>
-constexpr bool IsGreaterImpl(const L lhs, const R rhs, const RangeCheck l_range,
-                             const RangeCheck r_range) {
-  return l_range.IsOverflow() || r_range.IsUnderflow() ||
-         (l_range == r_range && static_cast<decltype(lhs + rhs)>(lhs) >
-                                    static_cast<decltype(lhs + rhs)>(rhs));
-}
-
-template <typename L, typename R>
-struct IsGreater {
-  static_assert(std::is_arithmetic_v<L> && std::is_arithmetic_v<R>,
-                "Types must be numeric.");
-  static constexpr bool Test(const L lhs, const R rhs) {
-    return IsGreaterImpl(lhs, rhs, DstRangeRelationToSrcRange<R>(lhs),
-                         DstRangeRelationToSrcRange<L>(rhs));
-  }
-};
-
-template <typename L, typename R>
-constexpr bool IsGreaterOrEqualImpl(const L lhs, const R rhs,
-                                    const RangeCheck l_range,
-                                    const RangeCheck r_range) {
-  return l_range.IsOverflow() || r_range.IsUnderflow() ||
-         (l_range == r_range && static_cast<decltype(lhs + rhs)>(lhs) >=
-                                    static_cast<decltype(lhs + rhs)>(rhs));
-}
-
-template <typename L, typename R>
-struct IsGreaterOrEqual {
-  static_assert(std::is_arithmetic_v<L> && std::is_arithmetic_v<R>,
-                "Types must be numeric.");
-  static constexpr bool Test(const L lhs, const R rhs) {
-    return IsGreaterOrEqualImpl(lhs, rhs, DstRangeRelationToSrcRange<R>(lhs),
-                                DstRangeRelationToSrcRange<L>(rhs));
-  }
-};
-
-template <typename L, typename R>
-struct IsEqual {
-  static_assert(std::is_arithmetic_v<L> && std::is_arithmetic_v<R>,
-                "Types must be numeric.");
-  static constexpr bool Test(const L lhs, const R rhs) {
-    return DstRangeRelationToSrcRange<R>(lhs) ==
-               DstRangeRelationToSrcRange<L>(rhs) &&
-           static_cast<decltype(lhs + rhs)>(lhs) ==
-               static_cast<decltype(lhs + rhs)>(rhs);
-  }
-};
-
-template <typename L, typename R>
-struct IsNotEqual {
-  static_assert(std::is_arithmetic_v<L> && std::is_arithmetic_v<R>,
-                "Types must be numeric.");
-  static constexpr bool Test(const L lhs, const R rhs) {
-    return DstRangeRelationToSrcRange<R>(lhs) !=
-               DstRangeRelationToSrcRange<L>(rhs) ||
-           static_cast<decltype(lhs + rhs)>(lhs) !=
-               static_cast<decltype(lhs + rhs)>(rhs);
-  }
-};
-
-// These perform the actual math operations on the CheckedNumerics.
-// Binary arithmetic operations.
-template <template <typename, typename> class C, typename L, typename R>
-constexpr bool SafeCompare(const L lhs, const R rhs) {
-  static_assert(std::is_arithmetic_v<L> && std::is_arithmetic_v<R>,
-                "Types must be numeric.");
-  using Promotion = BigEnoughPromotion<L, R>;
-  using BigType = typename Promotion::type;
-  return Promotion::is_contained
-             // Force to a larger type for speed if both are contained.
-             ? C<BigType, BigType>::Test(
-                   static_cast<BigType>(static_cast<L>(lhs)),
-                   static_cast<BigType>(static_cast<R>(rhs)))
-             // Let the template functions figure it out for mixed types.
-             : C<L, R>::Test(lhs, rhs);
-}
-
-template <typename Dst, typename Src>
-constexpr bool IsMaxInRangeForNumericType() {
-  return IsGreaterOrEqual<Dst, Src>::Test(std::numeric_limits<Dst>::max(),
-                                          std::numeric_limits<Src>::max());
-}
-
-template <typename Dst, typename Src>
-constexpr bool IsMinInRangeForNumericType() {
-  return IsLessOrEqual<Dst, Src>::Test(std::numeric_limits<Dst>::lowest(),
-                                       std::numeric_limits<Src>::lowest());
-}
-
-template <typename Dst, typename Src>
-constexpr Dst CommonMax() {
-  return !IsMaxInRangeForNumericType<Dst, Src>()
-             ? Dst(std::numeric_limits<Dst>::max())
-             : Dst(std::numeric_limits<Src>::max());
-}
-
-template <typename Dst, typename Src>
-constexpr Dst CommonMin() {
-  return !IsMinInRangeForNumericType<Dst, Src>()
-             ? Dst(std::numeric_limits<Dst>::lowest())
-             : Dst(std::numeric_limits<Src>::lowest());
-}
-
-// This is a wrapper to generate return the max or min for a supplied type.
-// If the argument is false, the returned value is the maximum. If true the
-// returned value is the minimum.
-template <typename Dst, typename Src = Dst>
-constexpr Dst CommonMaxOrMin(bool is_min) {
-  return is_min ? CommonMin<Dst, Src>() : CommonMax<Dst, Src>();
-}
-
-}  // namespace v8::base::internal
-
-#endif  // V8_BASE_SAFE_CONVERSIONS_IMPL_H_
diff --git a/deps/v8/src/base/small-map.h b/deps/v8/src/base/small-map.h
index 579f884c9246b8..140ee98b1fdcd2 100644
--- a/deps/v8/src/base/small-map.h
+++ b/deps/v8/src/base/small-map.h
@@ -234,10 +234,6 @@ class SmallMap {
       }
     }
 
-    V8_INLINE bool operator!=(const iterator& other) const {
-      return !(*this == other);
-    }
-
    private:
     friend class SmallMap;
     friend class const_iterator;
@@ -310,10 +306,6 @@ class SmallMap {
       return other.array_iter_ == nullptr && map_iter_ == other.map_iter_;
     }
 
-    V8_INLINE bool operator!=(const const_iterator& other) const {
-      return !(*this == other);
-    }
-
    private:
     friend class SmallMap;
     V8_INLINE explicit const_iterator(const value_type* init)
diff --git a/deps/v8/src/base/threaded-list.h b/deps/v8/src/base/threaded-list.h
index 20adc365a57d3e..a77788983ee090 100644
--- a/deps/v8/src/base/threaded-list.h
+++ b/deps/v8/src/base/threaded-list.h
@@ -196,9 +196,6 @@ class ThreadedListBase final : public BaseClass {
     bool operator==(const Iterator& other) const {
       return entry_ == other.entry_;
     }
-    bool operator!=(const Iterator& other) const {
-      return entry_ != other.entry_;
-    }
     T*& operator*() { return *entry_; }
     T* operator->() { return *entry_; }
     Iterator& operator=(T* entry) {
@@ -247,9 +244,6 @@ class ThreadedListBase final : public BaseClass {
     bool operator==(const ConstIterator& other) const {
       return entry_ == other.entry_;
     }
-    bool operator!=(const ConstIterator& other) const {
-      return entry_ != other.entry_;
-    }
     const T* operator*() const { return *entry_; }
 
    private:
diff --git a/deps/v8/src/base/vector.h b/deps/v8/src/base/vector.h
index fa2583efb5c837..696c616f00bd6f 100644
--- a/deps/v8/src/base/vector.h
+++ b/deps/v8/src/base/vector.h
@@ -130,7 +130,7 @@ class Vector {
     length_ = 0;
   }
 
-  Vector<T> operator+(size_t offset) {
+  const Vector<T> operator+(size_t offset) const {
     DCHECK_LE(offset, length_);
     return Vector<T>(start_ + offset, length_ - offset);
   }
@@ -169,22 +169,12 @@ class Vector {
     return std::equal(begin(), end(), other.begin(), other.end());
   }
 
-  bool operator!=(const Vector<T>& other) const {
-    return !operator==(other);
-  }
-
   template <typename TT = T>
     requires(!std::is_const_v<TT>)
   bool operator==(const Vector<const T>& other) const {
     return std::equal(begin(), end(), other.begin(), other.end());
   }
 
-  template <typename TT = T>
-    requires(!std::is_const_v<TT>)
-  bool operator!=(const Vector<const T>& other) const {
-    return !operator==(other);
-  }
-
  private:
   T* start_;
   size_t length_;
@@ -289,6 +279,16 @@ class OwnedVector {
     return OwnedVector<T>(std::make_unique<T[]>(size), size);
   }
 
+  // Allocates a new vector of the specified size via the default allocator and
+  // initializes all elements by assigning from `init`.
+  template <typename U>
+  static OwnedVector<T> New(size_t size, U init) {
+    if (size == 0) return {};
+    OwnedVector<T> vec = NewForOverwrite(size);
+    std::fill_n(vec.begin(), size, init);
+    return vec;
+  }
+
   // Allocates a new vector of the specified size via the default allocator.
   // Elements in the new vector are default-initialized.
   static OwnedVector<T> NewForOverwrite(size_t size) {
@@ -307,7 +307,6 @@ class OwnedVector {
   }
 
   bool operator==(std::nullptr_t) const { return data_ == nullptr; }
-  bool operator!=(std::nullptr_t) const { return data_ != nullptr; }
 
  private:
   template <typename U>
diff --git a/deps/v8/src/baseline/arm/baseline-assembler-arm-inl.h b/deps/v8/src/baseline/arm/baseline-assembler-arm-inl.h
index 417a8ff0b64c6a..8047302b5648b4 100644
--- a/deps/v8/src/baseline/arm/baseline-assembler-arm-inl.h
+++ b/deps/v8/src/baseline/arm/baseline-assembler-arm-inl.h
@@ -441,9 +441,9 @@ void BaselineAssembler::AddToInterruptBudgetAndJumpIfNotExceeded(
   if (skip_interrupt_label) __ b(ge, skip_interrupt_label);
 }
 
-void BaselineAssembler::LdaContextSlot(Register context, uint32_t index,
-                                       uint32_t depth,
-                                       CompressionMode compression_mode) {
+void BaselineAssembler::LdaContextSlotNoCell(Register context, uint32_t index,
+                                             uint32_t depth,
+                                             CompressionMode compression_mode) {
   for (; depth > 0; --depth) {
     LoadTaggedField(context, context, Context::kPreviousOffset);
   }
@@ -451,8 +451,8 @@ void BaselineAssembler::LdaContextSlot(Register context, uint32_t index,
                   Context::OffsetOfElementAt(index));
 }
 
-void BaselineAssembler::StaContextSlot(Register context, Register value,
-                                       uint32_t index, uint32_t depth) {
+void BaselineAssembler::StaContextSlotNoCell(Register context, Register value,
+                                             uint32_t index, uint32_t depth) {
   for (; depth > 0; --depth) {
     LoadTaggedField(context, context, Context::kPreviousOffset);
   }
diff --git a/deps/v8/src/baseline/arm64/baseline-assembler-arm64-inl.h b/deps/v8/src/baseline/arm64/baseline-assembler-arm64-inl.h
index bcb1c388e964b9..c0abc2df621351 100644
--- a/deps/v8/src/baseline/arm64/baseline-assembler-arm64-inl.h
+++ b/deps/v8/src/baseline/arm64/baseline-assembler-arm64-inl.h
@@ -494,9 +494,9 @@ void BaselineAssembler::AddToInterruptBudgetAndJumpIfNotExceeded(
   if (skip_interrupt_label) __ B(ge, skip_interrupt_label);
 }
 
-void BaselineAssembler::LdaContextSlot(Register context, uint32_t index,
-                                       uint32_t depth,
-                                       CompressionMode compression_mode) {
+void BaselineAssembler::LdaContextSlotNoCell(Register context, uint32_t index,
+                                             uint32_t depth,
+                                             CompressionMode compression_mode) {
   for (; depth > 0; --depth) {
     LoadTaggedField(context, context, Context::kPreviousOffset);
   }
@@ -504,8 +504,8 @@ void BaselineAssembler::LdaContextSlot(Register context, uint32_t index,
                   Context::OffsetOfElementAt(index));
 }
 
-void BaselineAssembler::StaContextSlot(Register context, Register value,
-                                       uint32_t index, uint32_t depth) {
+void BaselineAssembler::StaContextSlotNoCell(Register context, Register value,
+                                             uint32_t index, uint32_t depth) {
   for (; depth > 0; --depth) {
     LoadTaggedField(context, context, Context::kPreviousOffset);
   }
diff --git a/deps/v8/src/baseline/baseline-assembler.h b/deps/v8/src/baseline/baseline-assembler.h
index ec86accd92d2cb..6ce97fe03cdcf4 100644
--- a/deps/v8/src/baseline/baseline-assembler.h
+++ b/deps/v8/src/baseline/baseline-assembler.h
@@ -208,11 +208,11 @@ class BaselineAssembler {
     kDefault,
     kForceDecompression,
   };
-  inline void LdaContextSlot(
+  inline void LdaContextSlotNoCell(
       Register context, uint32_t index, uint32_t depth,
       CompressionMode compression_mode = CompressionMode::kDefault);
-  inline void StaContextSlot(Register context, Register value, uint32_t index,
-                             uint32_t depth);
+  inline void StaContextSlotNoCell(Register context, Register value,
+                                   uint32_t index, uint32_t depth);
   inline void LdaModuleVariable(Register context, int cell_index,
                                 uint32_t depth);
   inline void StaModuleVariable(Register context, Register value,
diff --git a/deps/v8/src/baseline/baseline-compiler.cc b/deps/v8/src/baseline/baseline-compiler.cc
index eaec6ca8a4bb63..67c7ed818d682f 100644
--- a/deps/v8/src/baseline/baseline-compiler.cc
+++ b/deps/v8/src/baseline/baseline-compiler.cc
@@ -626,8 +626,8 @@ constexpr static bool BuiltinMayDeopt(Builtin id) {
     case Builtin::kBaselineOutOfLinePrologue:
     case Builtin::kIncBlockCounter:
     case Builtin::kToObject:
-    case Builtin::kStoreScriptContextSlotBaseline:
-    case Builtin::kStoreCurrentScriptContextSlotBaseline:
+    case Builtin::kStoreContextElementBaseline:
+    case Builtin::kStoreCurrentContextElementBaseline:
     // This one explicitly skips the construct if the debugger is enabled.
     case Builtin::kFindNonDefaultConstructorOrConstruct:
       return false;
@@ -757,37 +757,41 @@ void BaselineCompiler::VisitPopContext() {
   __ StoreContext(context);
 }
 
-void BaselineCompiler::VisitLdaContextSlot() {
+void BaselineCompiler::VisitLdaContextSlotNoCell() {
   BaselineAssembler::ScratchRegisterScope scratch_scope(&basm_);
   Register context = scratch_scope.AcquireScratch();
   LoadRegister(context, 0);
   uint32_t index = Index(1);
   uint32_t depth = Uint(2);
-  __ LdaContextSlot(context, index, depth);
+  __ LdaContextSlotNoCell(context, index, depth);
 }
 
-void BaselineCompiler::VisitLdaScriptContextSlot() {
+void BaselineCompiler::VisitLdaContextSlot() {
   BaselineAssembler::ScratchRegisterScope scratch_scope(&basm_);
   Register context = scratch_scope.AcquireScratch();
   Label done;
   LoadRegister(context, 0);
   uint32_t index = Index(1);
   uint32_t depth = Uint(2);
-  __ LdaContextSlot(context, index, depth,
-                    BaselineAssembler::CompressionMode::kForceDecompression);
+  __ LdaContextSlotNoCell(
+      context, index, depth,
+      BaselineAssembler::CompressionMode::kForceDecompression);
   __ JumpIfSmi(kInterpreterAccumulatorRegister, &done);
   __ JumpIfObjectTypeFast(kNotEqual, kInterpreterAccumulatorRegister,
-                          HEAP_NUMBER_TYPE, &done, Label::kNear);
-  CallBuiltin<Builtin::kAllocateIfMutableHeapNumberScriptContextSlot>(
+                          CONTEXT_CELL_TYPE, &done, Label::kNear);
+  // TODO(victorgomes): inline trivial constant value read from context cell.
+  CallBuiltin<Builtin::kLoadFromContextCell>(
       kInterpreterAccumulatorRegister,  // heap number
       context,                          // context
       Smi::FromInt(index));             // slot
   __ Bind(&done);
 }
 
-void BaselineCompiler::VisitLdaImmutableContextSlot() { VisitLdaContextSlot(); }
+void BaselineCompiler::VisitLdaImmutableContextSlot() {
+  VisitLdaContextSlotNoCell();
+}
 
-void BaselineCompiler::VisitLdaCurrentContextSlot() {
+void BaselineCompiler::VisitLdaCurrentContextSlotNoCell() {
   BaselineAssembler::ScratchRegisterScope scratch_scope(&basm_);
   Register context = scratch_scope.AcquireScratch();
   __ LoadContext(context);
@@ -795,7 +799,7 @@ void BaselineCompiler::VisitLdaCurrentContextSlot() {
                      Context::OffsetOfElementAt(Index(0)));
 }
 
-void BaselineCompiler::VisitLdaCurrentScriptContextSlot() {
+void BaselineCompiler::VisitLdaCurrentContextSlot() {
   BaselineAssembler::ScratchRegisterScope scratch_scope(&basm_);
   Register context = scratch_scope.AcquireScratch();
   Label done;
@@ -805,8 +809,9 @@ void BaselineCompiler::VisitLdaCurrentScriptContextSlot() {
                      Context::OffsetOfElementAt(index));
   __ JumpIfSmi(kInterpreterAccumulatorRegister, &done);
   __ JumpIfObjectTypeFast(kNotEqual, kInterpreterAccumulatorRegister,
-                          HEAP_NUMBER_TYPE, &done, Label::kNear);
-  CallBuiltin<Builtin::kAllocateIfMutableHeapNumberScriptContextSlot>(
+                          CONTEXT_CELL_TYPE, &done, Label::kNear);
+  // TODO(victorgomes): inline trivial constant value read from context cell.
+  CallBuiltin<Builtin::kLoadFromContextCell>(
       kInterpreterAccumulatorRegister,  // heap number
       context,                          // context
       Smi::FromInt(index));             // slot
@@ -814,10 +819,10 @@ void BaselineCompiler::VisitLdaCurrentScriptContextSlot() {
 }
 
 void BaselineCompiler::VisitLdaImmutableCurrentContextSlot() {
-  VisitLdaCurrentContextSlot();
+  VisitLdaCurrentContextSlotNoCell();
 }
 
-void BaselineCompiler::VisitStaContextSlot() {
+void BaselineCompiler::VisitStaContextSlotNoCell() {
   Register value = WriteBarrierDescriptor::ValueRegister();
   Register context = WriteBarrierDescriptor::ObjectRegister();
   DCHECK(!AreAliased(value, context, kInterpreterAccumulatorRegister));
@@ -825,10 +830,10 @@ void BaselineCompiler::VisitStaContextSlot() {
   LoadRegister(context, 0);
   uint32_t index = Index(1);
   uint32_t depth = Uint(2);
-  __ StaContextSlot(context, value, index, depth);
+  __ StaContextSlotNoCell(context, value, index, depth);
 }
 
-void BaselineCompiler::VisitStaCurrentContextSlot() {
+void BaselineCompiler::VisitStaCurrentContextSlotNoCell() {
   Register value = WriteBarrierDescriptor::ValueRegister();
   Register context = WriteBarrierDescriptor::ObjectRegister();
   DCHECK(!AreAliased(value, context, kInterpreterAccumulatorRegister));
@@ -838,26 +843,25 @@ void BaselineCompiler::VisitStaCurrentContextSlot() {
       context, Context::OffsetOfElementAt(Index(0)), value);
 }
 
-void BaselineCompiler::VisitStaScriptContextSlot() {
+void BaselineCompiler::VisitStaContextSlot() {
   Register value = WriteBarrierDescriptor::ValueRegister();
   Register context = WriteBarrierDescriptor::ObjectRegister();
   DCHECK(!AreAliased(value, context, kInterpreterAccumulatorRegister));
   __ Move(value, kInterpreterAccumulatorRegister);
   LoadRegister(context, 0);
   SaveAccumulatorScope accumulator_scope(this, &basm_);
-  CallBuiltin<Builtin::kStoreScriptContextSlotBaseline>(
-      context,           // context
-      value,             // value
-      IndexAsSmi(1),     // slot
-      UintAsTagged(2));  // depth
+  CallBuiltin<Builtin::kStoreContextElementBaseline>(context,        // context
+                                                     value,          // value
+                                                     IndexAsSmi(1),  // slot
+                                                     UintAsTagged(2));  // depth
 }
 
-void BaselineCompiler::VisitStaCurrentScriptContextSlot() {
+void BaselineCompiler::VisitStaCurrentContextSlot() {
   Register value = WriteBarrierDescriptor::ValueRegister();
   DCHECK(!AreAliased(value, kInterpreterAccumulatorRegister));
   SaveAccumulatorScope accumulator_scope(this, &basm_);
   __ Move(value, kInterpreterAccumulatorRegister);
-  CallBuiltin<Builtin::kStoreCurrentScriptContextSlotBaseline>(
+  CallBuiltin<Builtin::kStoreCurrentContextElementBaseline>(
       value,           // value
       IndexAsSmi(0));  // slot
 }
@@ -866,12 +870,12 @@ void BaselineCompiler::VisitLdaLookupSlot() {
   CallRuntime(Runtime::kLoadLookupSlot, Constant<Name>(0));
 }
 
-void BaselineCompiler::VisitLdaLookupContextSlot() {
-  CallBuiltin<Builtin::kLookupContextBaseline>(
+void BaselineCompiler::VisitLdaLookupContextSlotNoCell() {
+  CallBuiltin<Builtin::kLookupContextNoCellBaseline>(
       Constant<Name>(0), UintAsTagged(2), IndexAsTagged(1));
 }
 
-void BaselineCompiler::VisitLdaLookupScriptContextSlot() {
+void BaselineCompiler::VisitLdaLookupContextSlot() {
   CallBuiltin<Builtin::kLookupScriptContextBaseline>(
       Constant<Name>(0), UintAsTagged(2), IndexAsTagged(1));
 }
@@ -885,13 +889,13 @@ void BaselineCompiler::VisitLdaLookupSlotInsideTypeof() {
   CallRuntime(Runtime::kLoadLookupSlotInsideTypeof, Constant<Name>(0));
 }
 
-void BaselineCompiler::VisitLdaLookupContextSlotInsideTypeof() {
-  CallBuiltin<Builtin::kLookupContextInsideTypeofBaseline>(
+void BaselineCompiler::VisitLdaLookupContextSlotNoCellInsideTypeof() {
+  CallBuiltin<Builtin::kLookupContextNoCellInsideTypeofBaseline>(
       Constant<Name>(0), UintAsTagged(2), IndexAsTagged(1));
 }
 
-void BaselineCompiler::VisitLdaLookupScriptContextSlotInsideTypeof() {
-  CallBuiltin<Builtin::kLookupScriptContextInsideTypeofBaseline>(
+void BaselineCompiler::VisitLdaLookupContextSlotInsideTypeof() {
+  CallBuiltin<Builtin::kLookupContextInsideTypeofBaseline>(
       Constant<Name>(0), UintAsTagged(2), IndexAsTagged(1));
 }
 
@@ -1072,6 +1076,11 @@ void BaselineCompiler::VisitAdd() {
       RegisterOperand(0), kInterpreterAccumulatorRegister, Index(1));
 }
 
+void BaselineCompiler::VisitAdd_LhsIsStringConstant_Internalize() {
+  CallBuiltin<Builtin::kAdd_LhsIsStringConstant_Internalize_Baseline>(
+      RegisterOperand(0), kInterpreterAccumulatorRegister, Index(1));
+}
+
 void BaselineCompiler::VisitSub() {
   CallBuiltin<Builtin::kSubtract_Baseline>(
       RegisterOperand(0), kInterpreterAccumulatorRegister, Index(1));
diff --git a/deps/v8/src/baseline/ia32/baseline-assembler-ia32-inl.h b/deps/v8/src/baseline/ia32/baseline-assembler-ia32-inl.h
index 7e6a3097ff0aef..e2cc4e22db49aa 100644
--- a/deps/v8/src/baseline/ia32/baseline-assembler-ia32-inl.h
+++ b/deps/v8/src/baseline/ia32/baseline-assembler-ia32-inl.h
@@ -413,9 +413,9 @@ void BaselineAssembler::AddToInterruptBudgetAndJumpIfNotExceeded(
   if (skip_interrupt_label) __ j(greater_equal, skip_interrupt_label);
 }
 
-void BaselineAssembler::LdaContextSlot(Register context, uint32_t index,
-                                       uint32_t depth,
-                                       CompressionMode compression_mode) {
+void BaselineAssembler::LdaContextSlotNoCell(Register context, uint32_t index,
+                                             uint32_t depth,
+                                             CompressionMode compression_mode) {
   for (; depth > 0; --depth) {
     LoadTaggedField(context, context, Context::kPreviousOffset);
   }
@@ -423,8 +423,8 @@ void BaselineAssembler::LdaContextSlot(Register context, uint32_t index,
                   Context::OffsetOfElementAt(index));
 }
 
-void BaselineAssembler::StaContextSlot(Register context, Register value,
-                                       uint32_t index, uint32_t depth) {
+void BaselineAssembler::StaContextSlotNoCell(Register context, Register value,
+                                             uint32_t index, uint32_t depth) {
   for (; depth > 0; --depth) {
     LoadTaggedField(context, context, Context::kPreviousOffset);
   }
diff --git a/deps/v8/src/baseline/loong64/baseline-assembler-loong64-inl.h b/deps/v8/src/baseline/loong64/baseline-assembler-loong64-inl.h
index 34ec124c0ecfa3..89415b719e721d 100644
--- a/deps/v8/src/baseline/loong64/baseline-assembler-loong64-inl.h
+++ b/deps/v8/src/baseline/loong64/baseline-assembler-loong64-inl.h
@@ -428,9 +428,9 @@ void BaselineAssembler::AddToInterruptBudgetAndJumpIfNotExceeded(
     __ Branch(skip_interrupt_label, ge, interrupt_budget, Operand(zero_reg));
 }
 
-void BaselineAssembler::LdaContextSlot(Register context, uint32_t index,
-                                       uint32_t depth,
-                                       CompressionMode compression_mode) {
+void BaselineAssembler::LdaContextSlotNoCell(Register context, uint32_t index,
+                                             uint32_t depth,
+                                             CompressionMode compression_mode) {
   for (; depth > 0; --depth) {
     LoadTaggedField(context, context, Context::kPreviousOffset);
   }
@@ -438,8 +438,8 @@ void BaselineAssembler::LdaContextSlot(Register context, uint32_t index,
                   Context::OffsetOfElementAt(index));
 }
 
-void BaselineAssembler::StaContextSlot(Register context, Register value,
-                                       uint32_t index, uint32_t depth) {
+void BaselineAssembler::StaContextSlotNoCell(Register context, Register value,
+                                             uint32_t index, uint32_t depth) {
   for (; depth > 0; --depth) {
     LoadTaggedField(context, context, Context::kPreviousOffset);
   }
diff --git a/deps/v8/src/baseline/mips64/baseline-assembler-mips64-inl.h b/deps/v8/src/baseline/mips64/baseline-assembler-mips64-inl.h
index 2ba5f70ecbcd6a..f89d224c5a5500 100644
--- a/deps/v8/src/baseline/mips64/baseline-assembler-mips64-inl.h
+++ b/deps/v8/src/baseline/mips64/baseline-assembler-mips64-inl.h
@@ -425,9 +425,9 @@ void BaselineAssembler::AddToInterruptBudgetAndJumpIfNotExceeded(
     __ Branch(skip_interrupt_label, ge, interrupt_budget, Operand(zero_reg));
 }
 
-void BaselineAssembler::LdaContextSlot(Register context, uint32_t index,
-                                       uint32_t depth,
-                                       CompressionMode compression_mode) {
+void BaselineAssembler::LdaContextSlotNoCell(Register context, uint32_t index,
+                                             uint32_t depth,
+                                             CompressionMode compression_mode) {
   for (; depth > 0; --depth) {
     LoadTaggedField(context, context, Context::kPreviousOffset);
   }
@@ -435,8 +435,8 @@ void BaselineAssembler::LdaContextSlot(Register context, uint32_t index,
                   Context::OffsetOfElementAt(index));
 }
 
-void BaselineAssembler::StaContextSlot(Register context, Register value,
-                                       uint32_t index, uint32_t depth) {
+void BaselineAssembler::StaContextSlotNoCell(Register context, Register value,
+                                             uint32_t index, uint32_t depth) {
   for (; depth > 0; --depth) {
     LoadTaggedField(context, context, Context::kPreviousOffset);
   }
diff --git a/deps/v8/src/baseline/ppc/baseline-assembler-ppc-inl.h b/deps/v8/src/baseline/ppc/baseline-assembler-ppc-inl.h
index c2135c91eb7a15..ead1f455dc67a3 100644
--- a/deps/v8/src/baseline/ppc/baseline-assembler-ppc-inl.h
+++ b/deps/v8/src/baseline/ppc/baseline-assembler-ppc-inl.h
@@ -534,9 +534,9 @@ void BaselineAssembler::AddToInterruptBudgetAndJumpIfNotExceeded(
   if (skip_interrupt_label) __ bge(skip_interrupt_label, cr0);
 }
 
-void BaselineAssembler::LdaContextSlot(Register context, uint32_t index,
-                                       uint32_t depth,
-                                       CompressionMode compression_mode) {
+void BaselineAssembler::LdaContextSlotNoCell(Register context, uint32_t index,
+                                             uint32_t depth,
+                                             CompressionMode compression_mode) {
   ASM_CODE_COMMENT(masm_);
   for (; depth > 0; --depth) {
     LoadTaggedField(context, context, Context::kPreviousOffset);
@@ -545,8 +545,8 @@ void BaselineAssembler::LdaContextSlot(Register context, uint32_t index,
                   Context::OffsetOfElementAt(index));
 }
 
-void BaselineAssembler::StaContextSlot(Register context, Register value,
-                                       uint32_t index, uint32_t depth) {
+void BaselineAssembler::StaContextSlotNoCell(Register context, Register value,
+                                             uint32_t index, uint32_t depth) {
   ASM_CODE_COMMENT(masm_);
   for (; depth > 0; --depth) {
     LoadTaggedField(context, context, Context::kPreviousOffset);
diff --git a/deps/v8/src/baseline/riscv/baseline-assembler-riscv-inl.h b/deps/v8/src/baseline/riscv/baseline-assembler-riscv-inl.h
index 30e139d6fefe8d..e08ab913e7e82e 100644
--- a/deps/v8/src/baseline/riscv/baseline-assembler-riscv-inl.h
+++ b/deps/v8/src/baseline/riscv/baseline-assembler-riscv-inl.h
@@ -437,9 +437,9 @@ void BaselineAssembler::AddToInterruptBudgetAndJumpIfNotExceeded(
   }
 }
 
-void BaselineAssembler::LdaContextSlot(Register context, uint32_t index,
-                                       uint32_t depth,
-                                       CompressionMode compression_mode) {
+void BaselineAssembler::LdaContextSlotNoCell(Register context, uint32_t index,
+                                             uint32_t depth,
+                                             CompressionMode compression_mode) {
   for (; depth > 0; --depth) {
     LoadTaggedField(context, context, Context::kPreviousOffset);
   }
@@ -447,8 +447,8 @@ void BaselineAssembler::LdaContextSlot(Register context, uint32_t index,
                   Context::OffsetOfElementAt(index));
 }
 
-void BaselineAssembler::StaContextSlot(Register context, Register value,
-                                       uint32_t index, uint32_t depth) {
+void BaselineAssembler::StaContextSlotNoCell(Register context, Register value,
+                                             uint32_t index, uint32_t depth) {
   for (; depth > 0; --depth) {
     LoadTaggedField(context, context, Context::kPreviousOffset);
   }
diff --git a/deps/v8/src/baseline/s390/baseline-assembler-s390-inl.h b/deps/v8/src/baseline/s390/baseline-assembler-s390-inl.h
index 4c43e9b70eaa21..34d109f01c7031 100644
--- a/deps/v8/src/baseline/s390/baseline-assembler-s390-inl.h
+++ b/deps/v8/src/baseline/s390/baseline-assembler-s390-inl.h
@@ -534,9 +534,9 @@ void BaselineAssembler::AddToInterruptBudgetAndJumpIfNotExceeded(
   if (skip_interrupt_label) __ b(ge, skip_interrupt_label);
 }
 
-void BaselineAssembler::LdaContextSlot(Register context, uint32_t index,
-                                       uint32_t depth,
-                                       CompressionMode compression_mode) {
+void BaselineAssembler::LdaContextSlotNoCell(Register context, uint32_t index,
+                                             uint32_t depth,
+                                             CompressionMode compression_mode) {
   for (; depth > 0; --depth) {
     LoadTaggedField(context, context, Context::kPreviousOffset);
   }
@@ -544,8 +544,8 @@ void BaselineAssembler::LdaContextSlot(Register context, uint32_t index,
                   Context::OffsetOfElementAt(index));
 }
 
-void BaselineAssembler::StaContextSlot(Register context, Register value,
-                                       uint32_t index, uint32_t depth) {
+void BaselineAssembler::StaContextSlotNoCell(Register context, Register value,
+                                             uint32_t index, uint32_t depth) {
   for (; depth > 0; --depth) {
     LoadTaggedField(context, context, Context::kPreviousOffset);
   }
diff --git a/deps/v8/src/baseline/x64/baseline-assembler-x64-inl.h b/deps/v8/src/baseline/x64/baseline-assembler-x64-inl.h
index 9251fa2105fc3c..7df3f00776ac98 100644
--- a/deps/v8/src/baseline/x64/baseline-assembler-x64-inl.h
+++ b/deps/v8/src/baseline/x64/baseline-assembler-x64-inl.h
@@ -423,9 +423,9 @@ void BaselineAssembler::AddToInterruptBudgetAndJumpIfNotExceeded(
   if (skip_interrupt_label) __ j(greater_equal, skip_interrupt_label);
 }
 
-void BaselineAssembler::LdaContextSlot(Register context, uint32_t index,
-                                       uint32_t depth,
-                                       CompressionMode compression_mode) {
+void BaselineAssembler::LdaContextSlotNoCell(Register context, uint32_t index,
+                                             uint32_t depth,
+                                             CompressionMode compression_mode) {
   // [context] is coming from interpreter frame so it is already decompressed
   // when pointer compression is enabled. In order to make use of complex
   // addressing mode, any intermediate context pointer is loaded in compressed
@@ -449,8 +449,8 @@ void BaselineAssembler::LdaContextSlot(Register context, uint32_t index,
   }
 }
 
-void BaselineAssembler::StaContextSlot(Register context, Register value,
-                                       uint32_t index, uint32_t depth) {
+void BaselineAssembler::StaContextSlotNoCell(Register context, Register value,
+                                             uint32_t index, uint32_t depth) {
   // [context] is coming from interpreter frame so it is already decompressed
   // when pointer compression is enabled. In order to make use of complex
   // addressing mode, any intermediate context pointer is loaded in compressed
diff --git a/deps/v8/src/builtins/accessors.cc b/deps/v8/src/builtins/accessors.cc
index 19f63be011eb77..0801f68fe35868 100644
--- a/deps/v8/src/builtins/accessors.cc
+++ b/deps/v8/src/builtins/accessors.cc
@@ -206,7 +206,7 @@ void Accessors::ArrayLengthSetter(
     return;
   }
 
-  if (JSArray::SetLength(array, length).IsNothing()) {
+  if (JSArray::SetLength(isolate, array, length).IsNothing()) {
     // TODO(victorgomes): AccessorNameBooleanSetterCallback does not handle
     // exceptions.
     FATAL("Fatal JavaScript invalid array length %u", length);
@@ -326,7 +326,7 @@ static DirectHandle<Object> GetFunctionPrototype(
     DisableTemporaryObjectTracking no_temp_tracking(isolate->debug());
     DirectHandle<JSObject> proto =
         isolate->factory()->NewFunctionPrototype(function);
-    JSFunction::SetPrototype(function, proto);
+    JSFunction::SetPrototype(isolate, function, proto);
   }
   return DirectHandle<Object>(function->prototype(), isolate);
 }
@@ -353,7 +353,7 @@ void Accessors::FunctionPrototypeSetter(
   DirectHandle<JSFunction> object =
       Cast<JSFunction>(Utils::OpenDirectHandle(*info.Holder()));
   DCHECK(object->has_prototype_property());
-  JSFunction::SetPrototype(object, value);
+  JSFunction::SetPrototype(isolate, object, value);
   info.GetReturnValue().Set(true);
 }
 
diff --git a/deps/v8/src/builtins/arm/builtins-arm.cc b/deps/v8/src/builtins/arm/builtins-arm.cc
index 509fc3dd70b9d7..e219398a3eb216 100644
--- a/deps/v8/src/builtins/arm/builtins-arm.cc
+++ b/deps/v8/src/builtins/arm/builtins-arm.cc
@@ -2947,77 +2947,59 @@ void Builtins::Generate_WasmDebugBreak(MacroAssembler* masm) {
 namespace {
 // Check that the stack was in the old state (if generated code assertions are
 // enabled), and switch to the new state.
-void SwitchStackState(MacroAssembler* masm, Register jmpbuf, Register tmp,
+void SwitchStackState(MacroAssembler* masm, Register stack, Register tmp,
                       wasm::JumpBuffer::StackState old_state,
                       wasm::JumpBuffer::StackState new_state) {
-  __ ldr(tmp, MemOperand(jmpbuf, wasm::kJmpBufStateOffset));
+  __ ldr(tmp, MemOperand(stack, wasm::kStackStateOffset));
   Label ok;
   __ JumpIfEqual(tmp, old_state, &ok);
   __ Trap();
   __ bind(&ok);
   __ mov(tmp, Operand(new_state));
-  __ str(tmp, MemOperand(jmpbuf, wasm::kJmpBufStateOffset));
+  __ str(tmp, MemOperand(stack, wasm::kStackStateOffset));
 }
 
 // Switch the stack pointer.
-void SwitchStackPointer(MacroAssembler* masm, Register jmpbuf) {
-  __ ldr(sp, MemOperand(jmpbuf, wasm::kJmpBufSpOffset));
+void SwitchStackPointer(MacroAssembler* masm, Register stack) {
+  __ ldr(sp, MemOperand(stack, wasm::kStackSpOffset));
 }
 
-void FillJumpBuffer(MacroAssembler* masm, Register jmpbuf, Label* target,
+void FillJumpBuffer(MacroAssembler* masm, Register stack, Label* target,
                     Register tmp) {
   __ mov(tmp, sp);
-  __ str(tmp, MemOperand(jmpbuf, wasm::kJmpBufSpOffset));
-  __ str(fp, MemOperand(jmpbuf, wasm::kJmpBufFpOffset));
+  __ str(tmp, MemOperand(stack, wasm::kStackSpOffset));
+  __ str(fp, MemOperand(stack, wasm::kStackFpOffset));
   __ LoadStackLimit(tmp, StackLimitKind::kRealStackLimit);
-  __ str(tmp, MemOperand(jmpbuf, wasm::kJmpBufStackLimitOffset));
+  __ str(tmp, MemOperand(stack, wasm::kStackLimitOffset));
 
   __ GetLabelAddress(tmp, target);
   // Stash the address in the jump buffer.
-  __ str(tmp, MemOperand(jmpbuf, wasm::kJmpBufPcOffset));
+  __ str(tmp, MemOperand(stack, wasm::kStackPcOffset));
 }
 
-void LoadJumpBuffer(MacroAssembler* masm, Register jmpbuf, bool load_pc,
+void LoadJumpBuffer(MacroAssembler* masm, Register stack, bool load_pc,
                     Register tmp, wasm::JumpBuffer::StackState expected_state) {
-  SwitchStackPointer(masm, jmpbuf);
-  __ ldr(fp, MemOperand(jmpbuf, wasm::kJmpBufFpOffset));
-  SwitchStackState(masm, jmpbuf, tmp, expected_state, wasm::JumpBuffer::Active);
+  SwitchStackPointer(masm, stack);
+  __ ldr(fp, MemOperand(stack, wasm::kStackFpOffset));
+  SwitchStackState(masm, stack, tmp, expected_state, wasm::JumpBuffer::Active);
   if (load_pc) {
-    __ ldr(tmp, MemOperand(jmpbuf, wasm::kJmpBufPcOffset));
+    __ ldr(tmp, MemOperand(stack, wasm::kStackPcOffset));
     __ bx(tmp);
   }
   // The stack limit in StackGuard is set separately under the ExecutionAccess
   // lock.
 }
 
-void SaveState(MacroAssembler* masm, Register active_continuation, Register tmp,
-               Label* suspend) {
-  Register jmpbuf = tmp;
-  __ ldr(jmpbuf, FieldMemOperand(active_continuation,
-                                 WasmContinuationObject::kStackOffset));
-  __ add(jmpbuf, jmpbuf, Operand(wasm::StackMemory::jmpbuf_offset()));
-
-  UseScratchRegisterScope temps(masm);
-  FillJumpBuffer(masm, jmpbuf, suspend, temps.Acquire());
-}
-
-void LoadTargetJumpBuffer(MacroAssembler* masm, Register target_continuation,
+void LoadTargetJumpBuffer(MacroAssembler* masm, Register target_stack,
                           Register tmp,
                           wasm::JumpBuffer::StackState expected_state) {
-  Register target_jmpbuf = target_continuation;
-  __ ldr(target_jmpbuf, FieldMemOperand(target_continuation,
-                                        WasmContinuationObject::kStackOffset));
-  __ add(target_jmpbuf, target_jmpbuf,
-         Operand(wasm::StackMemory::jmpbuf_offset()));
-
   __ Zero(MemOperand(fp, StackSwitchFrameConstants::kGCScanSlotCountOffset));
   // Switch stack!
-  LoadJumpBuffer(masm, target_jmpbuf, false, tmp, expected_state);
+  LoadJumpBuffer(masm, target_stack, false, tmp, expected_state);
 }
 
 // Updates the stack limit and central stack info, and validates the switch.
-void SwitchStacks(MacroAssembler* masm, Register old_continuation,
-                  bool return_switch,
+void SwitchStacks(MacroAssembler* masm, Register old_stack, bool return_switch,
                   const std::initializer_list<Register> keep) {
   using ER = ExternalReference;
 
@@ -3028,8 +3010,9 @@ void SwitchStacks(MacroAssembler* masm, Register old_continuation,
   {
     __ PrepareCallCFunction(2);
     FrameScope scope(masm, StackFrame::MANUAL);
+    // Move {old_stack} first in case it aliases kCArgRegs[0].
+    __ Move(kCArgRegs[1], old_stack);
     __ Move(kCArgRegs[0], ExternalReference::isolate_address(masm->isolate()));
-    __ Move(kCArgRegs[1], old_continuation);
     __ CallCFunction(
         return_switch ? ER::wasm_return_switch() : ER::wasm_switch_stacks(), 2);
   }
@@ -3039,47 +3022,34 @@ void SwitchStacks(MacroAssembler* masm, Register old_continuation,
   }
 }
 
-void ReloadParentContinuation(MacroAssembler* masm, Register return_reg,
-                              Register return_value, Register context,
-                              Register tmp1, Register tmp2, Register tmp3) {
-  Register active_continuation = tmp1;
-  __ LoadRoot(active_continuation, RootIndex::kActiveContinuation);
+void ReloadParentStack(MacroAssembler* masm, Register return_reg,
+                       Register return_value, Register context, Register tmp1,
+                       Register tmp2, Register tmp3) {
+  Register active_stack = tmp1;
+  __ LoadRootRelative(active_stack, IsolateData::active_stack_offset());
 
   // Set a null pointer in the jump buffer's SP slot to indicate to the stack
   // frame iterator that this stack is empty.
-  Register jmpbuf = tmp2;
-  __ ldr(jmpbuf, FieldMemOperand(active_continuation,
-                                 WasmContinuationObject::kStackOffset));
-  __ add(jmpbuf, jmpbuf, Operand(wasm::StackMemory::jmpbuf_offset()));
-  __ Zero(MemOperand(jmpbuf, wasm::kJmpBufSpOffset));
+  __ Zero(MemOperand(active_stack, wasm::kStackSpOffset));
   {
     UseScratchRegisterScope temps(masm);
     Register scratch = temps.Acquire();
-    SwitchStackState(masm, jmpbuf, scratch, wasm::JumpBuffer::Active,
+    SwitchStackState(masm, active_stack, scratch, wasm::JumpBuffer::Active,
                      wasm::JumpBuffer::Retired);
   }
   Register parent = tmp2;
-  __ LoadTaggedField(parent,
-                     FieldMemOperand(active_continuation,
-                                     WasmContinuationObject::kParentOffset));
+  __ ldr(parent, MemOperand(active_stack, wasm::kStackParentOffset));
 
-  // Update active continuation root.
-  int32_t active_continuation_offset =
-      MacroAssembler::RootRegisterOffsetForRootIndex(
-          RootIndex::kActiveContinuation);
-  __ str(parent, MemOperand(kRootRegister, active_continuation_offset));
-  jmpbuf = parent;
-  __ ldr(jmpbuf, FieldMemOperand(parent, WasmContinuationObject::kStackOffset));
-  __ add(jmpbuf, jmpbuf, Operand(wasm::StackMemory::jmpbuf_offset()));
+  // Update active stack.
+  __ StoreRootRelative(IsolateData::active_stack_offset(), parent);
 
   // Switch stack!
-  SwitchStacks(masm, active_continuation, true,
-               {return_reg, return_value, context, jmpbuf});
-  LoadJumpBuffer(masm, jmpbuf, false, tmp3, wasm::JumpBuffer::Inactive);
+  SwitchStacks(masm, active_stack, true,
+               {return_reg, return_value, context, parent});
+  LoadJumpBuffer(masm, parent, false, tmp3, wasm::JumpBuffer::Inactive);
 }
 
-void RestoreParentSuspender(MacroAssembler* masm, Register tmp1,
-                            Register tmp2) {
+void RestoreParentSuspender(MacroAssembler* masm, Register tmp1) {
   Register suspender = tmp1;
   __ LoadRoot(suspender, RootIndex::kActiveSuspender);
   __ LoadTaggedField(
@@ -3290,30 +3260,25 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
   // Save current state in active jump buffer.
   // -------------------------------------------
   Label resume;
-  DEFINE_REG(continuation);
-  __ LoadRoot(continuation, RootIndex::kActiveContinuation);
-  DEFINE_REG(jmpbuf);
+  DEFINE_REG(stack);
+  __ LoadRootRelative(stack, IsolateData::active_stack_offset());
   DEFINE_REG(scratch);
-  __ ldr(jmpbuf,
-         FieldMemOperand(continuation, WasmContinuationObject::kStackOffset));
-  __ add(jmpbuf, jmpbuf, Operand(wasm::StackMemory::jmpbuf_offset()));
-  FillJumpBuffer(masm, jmpbuf, &resume, scratch);
-  SwitchStackState(masm, jmpbuf, scratch, wasm::JumpBuffer::Active,
+  FillJumpBuffer(masm, stack, &resume, scratch);
+  SwitchStackState(masm, stack, scratch, wasm::JumpBuffer::Active,
                    wasm::JumpBuffer::Suspended);
-  regs.ResetExcept(suspender, continuation);
+  regs.ResetExcept(suspender, stack);
 
-  DEFINE_REG(suspender_continuation);
-  __ LoadTaggedField(
-      suspender_continuation,
-      FieldMemOperand(suspender, WasmSuspenderObject::kContinuationOffset));
+  DEFINE_REG(suspender_stack);
+  __ ldr(suspender_stack,
+         FieldMemOperand(suspender, WasmSuspenderObject::kStackOffset));
   if (v8_flags.debug_code) {
     // -------------------------------------------
-    // Check that the suspender's continuation is the active continuation.
+    // Check that the suspender's stack is the active stack.
     // -------------------------------------------
     // TODO(thibaudm): Once we add core stack-switching instructions, this
-    // check will not hold anymore: it's possible that the active continuation
+    // check will not hold anymore: it's possible that the active stack
     // changed (due to an internal switch), so we have to update the suspender.
-    __ cmp(suspender_continuation, continuation);
+    __ cmp(suspender_stack, stack);
     Label ok;
     __ b(&ok, eq);
     __ Trap();
@@ -3323,13 +3288,8 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
   // Update roots.
   // -------------------------------------------
   DEFINE_REG(caller);
-  __ LoadTaggedField(caller,
-                     FieldMemOperand(suspender_continuation,
-                                     WasmContinuationObject::kParentOffset));
-  int32_t active_continuation_offset =
-      MacroAssembler::RootRegisterOffsetForRootIndex(
-          RootIndex::kActiveContinuation);
-  __ str(caller, MemOperand(kRootRegister, active_continuation_offset));
+  __ ldr(caller, MemOperand(suspender_stack, wasm::kStackParentOffset));
+  __ StoreRootRelative(IsolateData::active_stack_offset(), caller);
   DEFINE_REG(parent);
   __ LoadTaggedField(
       parent, FieldMemOperand(suspender, WasmSuspenderObject::kParentOffset));
@@ -3337,16 +3297,13 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
       MacroAssembler::RootRegisterOffsetForRootIndex(
           RootIndex::kActiveSuspender);
   __ str(parent, MemOperand(kRootRegister, active_suspender_offset));
-  regs.ResetExcept(suspender, caller, continuation);
+  regs.ResetExcept(suspender, caller, stack);
 
   // -------------------------------------------
   // Load jump buffer.
   // -------------------------------------------
-  SwitchStacks(masm, continuation, false, {caller, suspender});
-  FREE_REG(continuation);
-  ASSIGN_REG(jmpbuf);
-  __ ldr(jmpbuf, FieldMemOperand(caller, WasmContinuationObject::kStackOffset));
-  __ add(jmpbuf, jmpbuf, Operand(wasm::StackMemory::jmpbuf_offset()));
+  SwitchStacks(masm, stack, false, {caller, suspender});
+  FREE_REG(stack);
   __ LoadTaggedField(
       kReturnRegister0,
       FieldMemOperand(suspender, WasmSuspenderObject::kPromiseOffset));
@@ -3354,7 +3311,7 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
       MemOperand(fp, StackSwitchFrameConstants::kGCScanSlotCountOffset);
   __ Zero(GCScanSlotPlace);
   ASSIGN_REG(scratch)
-  LoadJumpBuffer(masm, jmpbuf, true, scratch, wasm::JumpBuffer::Inactive);
+  LoadJumpBuffer(masm, caller, true, scratch, wasm::JumpBuffer::Inactive);
   if (v8_flags.debug_code) {
     __ Trap();
   }
@@ -3408,21 +3365,15 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
   // Save current state.
   // -------------------------------------------
   Label suspend;
-  DEFINE_REG(active_continuation);
-  __ LoadRoot(active_continuation, RootIndex::kActiveContinuation);
-  DEFINE_REG(current_jmpbuf);
+  DEFINE_REG(active_stack);
+  __ LoadRootRelative(active_stack, IsolateData::active_stack_offset());
   DEFINE_REG(scratch);
-  __ ldr(current_jmpbuf, FieldMemOperand(active_continuation,
-                                         WasmContinuationObject::kStackOffset));
-  __ add(current_jmpbuf, current_jmpbuf,
-         Operand(wasm::StackMemory::jmpbuf_offset()));
-  FillJumpBuffer(masm, current_jmpbuf, &suspend, scratch);
-  SwitchStackState(masm, current_jmpbuf, scratch, wasm::JumpBuffer::Active,
+  FillJumpBuffer(masm, active_stack, &suspend, scratch);
+  SwitchStackState(masm, active_stack, scratch, wasm::JumpBuffer::Active,
                    wasm::JumpBuffer::Inactive);
-  FREE_REG(current_jmpbuf);
 
   // -------------------------------------------
-  // Set the suspender and continuation parents and update the roots
+  // Set the suspender and stack parents and update the roots
   // -------------------------------------------
   DEFINE_REG(active_suspender);
   __ LoadRoot(active_suspender, RootIndex::kActiveSuspender);
@@ -3441,50 +3392,29 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
   // the same register for target_continuation to use it in RecordWriteField.
   // So, free suspender here to use pinned reg, but load from it next line.
   FREE_REG(suspender);
-  DEFINE_PINNED(target_continuation, WriteBarrierDescriptor::ObjectRegister());
-  suspender = target_continuation;
-  __ LoadTaggedField(
-      target_continuation,
-      FieldMemOperand(suspender, WasmSuspenderObject::kContinuationOffset));
+  DEFINE_REG(target_stack);
+  suspender = target_stack;
+  __ ldr(target_stack,
+         FieldMemOperand(suspender, WasmSuspenderObject::kStackOffset));
   suspender = no_reg;
 
-  __ StoreTaggedField(active_continuation,
-                      FieldMemOperand(target_continuation,
-                                      WasmContinuationObject::kParentOffset));
-  DEFINE_REG(old_continuation);
-  __ Move(old_continuation, active_continuation);
-  __ RecordWriteField(
-      target_continuation, WasmContinuationObject::kParentOffset,
-      active_continuation, kLRHasBeenSaved, SaveFPRegsMode::kIgnore);
-  FREE_REG(active_continuation);
-  int32_t active_continuation_offset =
-      MacroAssembler::RootRegisterOffsetForRootIndex(
-          RootIndex::kActiveContinuation);
-  __ str(target_continuation,
-         MemOperand(kRootRegister, active_continuation_offset));
-
-  SwitchStacks(masm, old_continuation, false, {target_continuation});
-
-  regs.ResetExcept(target_continuation);
+  __ StoreRootRelative(IsolateData::active_stack_offset(), target_stack);
+  SwitchStacks(masm, active_stack, false, {target_stack});
+  regs.ResetExcept(target_stack);
 
   // -------------------------------------------
   // Load state from target jmpbuf (longjmp).
   // -------------------------------------------
   regs.Reserve(kReturnRegister0);
-  DEFINE_REG(target_jmpbuf);
   ASSIGN_REG(scratch);
-  __ ldr(target_jmpbuf, FieldMemOperand(target_continuation,
-                                        WasmContinuationObject::kStackOffset));
-  __ add(target_jmpbuf, target_jmpbuf,
-         Operand(wasm::StackMemory::jmpbuf_offset()));
   // Move resolved value to return register.
   __ ldr(kReturnRegister0, MemOperand(fp, 3 * kSystemPointerSize));
   MemOperand GCScanSlotPlace =
       MemOperand(fp, StackSwitchFrameConstants::kGCScanSlotCountOffset);
   __ Zero(GCScanSlotPlace);
   if (on_resume == wasm::OnResume::kThrow) {
-    // Switch to the continuation's stack without restoring the PC.
-    LoadJumpBuffer(masm, target_jmpbuf, false, scratch,
+    // Switch without restoring the PC.
+    LoadJumpBuffer(masm, target_stack, false, scratch,
                    wasm::JumpBuffer::Suspended);
     // Pop this frame now. The unwinder expects that the first STACK_SWITCH
     // frame is the outermost one.
@@ -3493,8 +3423,8 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
     __ Push(kReturnRegister0);
     __ CallRuntime(Runtime::kThrow);
   } else {
-    // Resume the continuation normally.
-    LoadJumpBuffer(masm, target_jmpbuf, true, scratch,
+    // Resume the stack normally.
+    LoadJumpBuffer(masm, target_stack, true, scratch,
                    wasm::JumpBuffer::Suspended);
   }
   if (v8_flags.debug_code) {
@@ -3528,27 +3458,23 @@ void SwitchToAllocatedStack(MacroAssembler* masm, RegisterAllocator& regs,
                             Label* suspend) {
   ResetStackSwitchFrameStackSlots(masm);
   DEFINE_SCOPED(scratch)
-  DEFINE_REG(target_continuation)
-  __ LoadRoot(target_continuation, RootIndex::kActiveContinuation);
-  DEFINE_REG(parent_continuation)
-  __ LoadTaggedField(parent_continuation,
-                     FieldMemOperand(target_continuation,
-                                     WasmContinuationObject::kParentOffset));
-
-  SaveState(masm, parent_continuation, scratch, suspend);
+  DEFINE_REG(target_stack)
+  __ LoadRootRelative(target_stack, IsolateData::active_stack_offset());
+  DEFINE_REG(parent_stack)
+  __ ldr(parent_stack, MemOperand(target_stack, wasm::kStackParentOffset));
 
-  SwitchStacks(masm, parent_continuation, false,
-               {wasm_instance, wrapper_buffer});
+  FillJumpBuffer(masm, parent_stack, suspend, scratch);
+  SwitchStacks(masm, parent_stack, false, {wasm_instance, wrapper_buffer});
 
-  FREE_REG(parent_continuation);
+  FREE_REG(parent_stack);
   // Save the old stack's fp in x9, and use it to access the parameters in
   // the parent frame.
   regs.Pinned(r9, &original_fp);
   __ Move(original_fp, fp);
-  __ LoadRoot(target_continuation, RootIndex::kActiveContinuation);
-  LoadTargetJumpBuffer(masm, target_continuation, scratch,
+  __ LoadRootRelative(target_stack, IsolateData::active_stack_offset());
+  LoadTargetJumpBuffer(masm, target_stack, scratch,
                        wasm::JumpBuffer::Suspended);
-  FREE_REG(target_continuation);
+  FREE_REG(target_stack);
 
   // Push the loaded fp. We know it is null, because there is no frame yet,
   // so we could also push 0 directly. In any case we need to push it,
@@ -3629,9 +3555,9 @@ void SwitchBackAndReturnPromise(MacroAssembler* masm, RegisterAllocator& regs,
          MemOperand(fp, StackSwitchFrameConstants::kImplicitArgOffset));
   GetContextFromImplicitArg(masm, kContextRegister, tmp);
 
-  ReloadParentContinuation(masm, promise, return_value, kContextRegister, tmp,
-                           tmp2, tmp3);
-  RestoreParentSuspender(masm, tmp, tmp2);
+  ReloadParentStack(masm, promise, return_value, kContextRegister, tmp, tmp2,
+                    tmp3);
+  RestoreParentSuspender(masm, tmp);
 
   if (mode == wasm::kPromise) {
     __ Move(tmp, Operand(1));
@@ -3678,9 +3604,8 @@ void GenerateExceptionHandlingLandingPad(MacroAssembler* masm,
   __ ldr(kContextRegister,
          MemOperand(fp, StackSwitchFrameConstants::kImplicitArgOffset));
   GetContextFromImplicitArg(masm, kContextRegister, tmp);
-  ReloadParentContinuation(masm, promise, reason, kContextRegister, tmp, tmp2,
-                           tmp3);
-  RestoreParentSuspender(masm, tmp, tmp2);
+  ReloadParentStack(masm, promise, reason, kContextRegister, tmp, tmp2, tmp3);
+  RestoreParentSuspender(masm, tmp);
 
   __ Move(tmp, Operand(1));
   __ str(tmp,
diff --git a/deps/v8/src/builtins/arm64/builtins-arm64.cc b/deps/v8/src/builtins/arm64/builtins-arm64.cc
index 1a2d310bfeed92..9d2af4dbe6dc89 100644
--- a/deps/v8/src/builtins/arm64/builtins-arm64.cc
+++ b/deps/v8/src/builtins/arm64/builtins-arm64.cc
@@ -3473,12 +3473,11 @@ void Builtins::Generate_WasmDebugBreak(MacroAssembler* masm) {
 namespace {
 // Check that the stack was in the old state (if generated code assertions are
 // enabled), and switch to the new state.
-void SwitchStackState(MacroAssembler* masm, Register jmpbuf,
-                      Register tmp,
+void SwitchStackState(MacroAssembler* masm, Register stack, Register tmp,
                       wasm::JumpBuffer::StackState old_state,
                       wasm::JumpBuffer::StackState new_state) {
 #if V8_ENABLE_SANDBOX
-  __ Ldr(tmp.W(), MemOperand(jmpbuf, wasm::kJmpBufStateOffset));
+  __ Ldr(tmp.W(), MemOperand(stack, wasm::kStackStateOffset));
   __ Cmp(tmp.W(), old_state);
   Label ok;
   __ B(&ok, eq);
@@ -3486,7 +3485,7 @@ void SwitchStackState(MacroAssembler* masm, Register jmpbuf,
   __ bind(&ok);
 #endif
   __ Mov(tmp.W(), new_state);
-  __ Str(tmp.W(), MemOperand(jmpbuf, wasm::kJmpBufStateOffset));
+  __ Str(tmp.W(), MemOperand(stack, wasm::kStackStateOffset));
 }
 
 // Switch the stack pointer. Also switch the simulator's stack limit when
@@ -3494,77 +3493,55 @@ void SwitchStackState(MacroAssembler* masm, Register jmpbuf,
 // changing the stack pointer, as a mismatch between the stack pointer and the
 // simulator's stack limit can cause stack access check failures.
 void SwitchStackPointerAndSimulatorStackLimit(MacroAssembler* masm,
-                                              Register jmpbuf, Register tmp) {
+                                              Register stack, Register tmp) {
   if (masm->options().enable_simulator_code) {
     UseScratchRegisterScope temps(masm);
     temps.Exclude(x16);
-    __ Ldr(tmp, MemOperand(jmpbuf, wasm::kJmpBufSpOffset));
-    __ Ldr(x16, MemOperand(jmpbuf, wasm::kJmpBufStackLimitOffset));
+    __ Ldr(tmp, MemOperand(stack, wasm::kStackSpOffset));
+    __ Ldr(x16, MemOperand(stack, wasm::kStackLimitOffset));
     __ Mov(sp, tmp);
     __ hlt(kImmExceptionIsSwitchStackLimit);
   } else {
-    __ Ldr(tmp, MemOperand(jmpbuf, wasm::kJmpBufSpOffset));
+    __ Ldr(tmp, MemOperand(stack, wasm::kStackSpOffset));
     __ Mov(sp, tmp);
   }
 }
 
-void FillJumpBuffer(MacroAssembler* masm, Register jmpbuf, Label* pc,
+void FillJumpBuffer(MacroAssembler* masm, Register stack, Label* pc,
                     Register tmp) {
   __ Mov(tmp, sp);
-  __ Str(tmp, MemOperand(jmpbuf, wasm::kJmpBufSpOffset));
-  __ Str(fp, MemOperand(jmpbuf, wasm::kJmpBufFpOffset));
+  __ Str(tmp, MemOperand(stack, wasm::kStackSpOffset));
+  __ Str(fp, MemOperand(stack, wasm::kStackFpOffset));
   __ LoadStackLimit(tmp, StackLimitKind::kRealStackLimit);
-  __ Str(tmp, MemOperand(jmpbuf, wasm::kJmpBufStackLimitOffset));
+  __ Str(tmp, MemOperand(stack, wasm::kStackLimitOffset));
   __ Adr(tmp, pc);
-  __ Str(tmp, MemOperand(jmpbuf, wasm::kJmpBufPcOffset));
+  __ Str(tmp, MemOperand(stack, wasm::kStackPcOffset));
 }
 
-void LoadJumpBuffer(MacroAssembler* masm, Register jmpbuf, bool load_pc,
+void LoadJumpBuffer(MacroAssembler* masm, Register stack, bool load_pc,
                     Register tmp, wasm::JumpBuffer::StackState expected_state) {
-  SwitchStackPointerAndSimulatorStackLimit(masm, jmpbuf, tmp);
-  __ Ldr(fp, MemOperand(jmpbuf, wasm::kJmpBufFpOffset));
-  SwitchStackState(masm, jmpbuf, tmp, expected_state, wasm::JumpBuffer::Active);
+  SwitchStackPointerAndSimulatorStackLimit(masm, stack, tmp);
+  __ Ldr(fp, MemOperand(stack, wasm::kStackFpOffset));
+  SwitchStackState(masm, stack, tmp, expected_state, wasm::JumpBuffer::Active);
   if (load_pc) {
-    __ Ldr(tmp, MemOperand(jmpbuf, wasm::kJmpBufPcOffset));
+    __ Ldr(tmp, MemOperand(stack, wasm::kStackPcOffset));
     __ Br(tmp);
   }
   // The stack limit in StackGuard is set separately under the ExecutionAccess
   // lock.
 }
 
-void SaveState(MacroAssembler* masm, Register active_continuation,
-               Register tmp, Label* suspend) {
-  Register jmpbuf = tmp;
-  __ LoadExternalPointerField(
-      jmpbuf,
-      FieldMemOperand(active_continuation,
-                      WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag);
-  __ Add(jmpbuf, jmpbuf, wasm::StackMemory::jmpbuf_offset());
-  UseScratchRegisterScope temps(masm);
-  Register scratch = temps.AcquireX();
-  FillJumpBuffer(masm, jmpbuf, suspend, scratch);
-}
-
-void LoadTargetJumpBuffer(MacroAssembler* masm, Register target_continuation,
+void LoadTargetJumpBuffer(MacroAssembler* masm, Register target_stack,
                           Register tmp,
                           wasm::JumpBuffer::StackState expected_state) {
-  Register target_jmpbuf = target_continuation;
-  __ LoadExternalPointerField(
-      target_jmpbuf,
-      FieldMemOperand(target_continuation,
-                      WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag);
-  __ Add(target_jmpbuf, target_jmpbuf, wasm::StackMemory::jmpbuf_offset());
   __ Str(xzr,
          MemOperand(fp, StackSwitchFrameConstants::kGCScanSlotCountOffset));
   // Switch stack!
-  LoadJumpBuffer(masm, target_jmpbuf, false, tmp, expected_state);
+  LoadJumpBuffer(masm, target_stack, false, tmp, expected_state);
 }
 
 // Updates the stack limit and central stack info, and validates the switch.
-void SwitchStacks(MacroAssembler* masm, Register old_continuation,
-                  bool return_switch,
+void SwitchStacks(MacroAssembler* masm, Register old_stack, bool return_switch,
                   const std::initializer_list<CPURegister> keep) {
   using ER = ExternalReference;
   for (size_t i = 0; i < (keep.size() & ~0x1); i += 2) {
@@ -3575,8 +3552,9 @@ void SwitchStacks(MacroAssembler* masm, Register old_continuation,
   }
   {
     FrameScope scope(masm, StackFrame::MANUAL);
+    // Move {old_stack} first in case it aliases kCArgRegs[0].
+    __ Mov(kCArgRegs[1], old_stack);
     __ Mov(kCArgRegs[0], ExternalReference::isolate_address(masm->isolate()));
-    __ Mov(kCArgRegs[1], old_continuation);
     __ CallCFunction(
         return_switch ? ER::wasm_return_switch() : ER::wasm_switch_stacks(), 2);
   }
@@ -3588,52 +3566,34 @@ void SwitchStacks(MacroAssembler* masm, Register old_continuation,
   }
 }
 
-void ReloadParentContinuation(MacroAssembler* masm, Register return_reg,
-                              Register return_value, Register context,
-                              Register tmp1, Register tmp2, Register tmp3) {
-  Register active_continuation = tmp1;
-  __ LoadRoot(active_continuation, RootIndex::kActiveContinuation);
+void ReloadParentStack(MacroAssembler* masm, Register return_reg,
+                       Register return_value, Register context, Register tmp1,
+                       Register tmp2, Register tmp3) {
+  Register active_stack = tmp1;
+  __ LoadRootRelative(active_stack, IsolateData::active_stack_offset());
 
   // Set a null pointer in the jump buffer's SP slot to indicate to the stack
   // frame iterator that this stack is empty.
-  Register jmpbuf = tmp2;
-  __ LoadExternalPointerField(
-      jmpbuf,
-      FieldMemOperand(active_continuation,
-                      WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag);
-  __ Add(jmpbuf, jmpbuf, wasm::StackMemory::jmpbuf_offset());
-  __ Str(xzr, MemOperand(jmpbuf, wasm::kJmpBufSpOffset));
+  __ Str(xzr, MemOperand(active_stack, wasm::kStackSpOffset));
   {
     UseScratchRegisterScope temps(masm);
     Register scratch = temps.AcquireX();
-    SwitchStackState(masm, jmpbuf, scratch, wasm::JumpBuffer::Active,
+    SwitchStackState(masm, active_stack, scratch, wasm::JumpBuffer::Active,
                      wasm::JumpBuffer::Retired);
   }
   Register parent = tmp2;
-  __ LoadTaggedField(parent,
-                     FieldMemOperand(active_continuation,
-                                     WasmContinuationObject::kParentOffset));
+  __ Ldr(parent, MemOperand(active_stack, wasm::kStackParentOffset));
 
-  // Update active continuation root.
-  int32_t active_continuation_offset =
-      MacroAssembler::RootRegisterOffsetForRootIndex(
-          RootIndex::kActiveContinuation);
-  __ Str(parent, MemOperand(kRootRegister, active_continuation_offset));
-  jmpbuf = parent;
-  __ LoadExternalPointerField(
-      jmpbuf, FieldMemOperand(parent, WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag);
-  __ Add(jmpbuf, jmpbuf, wasm::StackMemory::jmpbuf_offset());
+  // Update active stack.
+  __ StoreRootRelative(IsolateData::active_stack_offset(), parent);
 
   // Switch stack!
-  SwitchStacks(masm, active_continuation, true,
-               {return_reg, return_value, context, jmpbuf});
-  LoadJumpBuffer(masm, jmpbuf, false, tmp3, wasm::JumpBuffer::Inactive);
+  SwitchStacks(masm, active_stack, true,
+               {return_reg, return_value, context, parent});
+  LoadJumpBuffer(masm, parent, false, tmp3, wasm::JumpBuffer::Inactive);
 }
 
-void RestoreParentSuspender(MacroAssembler* masm, Register tmp1,
-                            Register tmp2) {
+void RestoreParentSuspender(MacroAssembler* masm, Register tmp1) {
   Register suspender = tmp1;
   __ LoadRoot(suspender, RootIndex::kActiveSuspender);
   __ LoadTaggedField(
@@ -3840,32 +3800,27 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
   // Save current state in active jump buffer.
   // -------------------------------------------
   Label resume;
-  DEFINE_REG(continuation);
-  __ LoadRoot(continuation, RootIndex::kActiveContinuation);
-  DEFINE_REG(jmpbuf);
+  DEFINE_REG(stack);
+  __ LoadRootRelative(stack, IsolateData::active_stack_offset());
   DEFINE_REG(scratch);
-  __ LoadExternalPointerField(
-      jmpbuf,
-      FieldMemOperand(continuation, WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag);
-  __ Add(jmpbuf, jmpbuf, wasm::StackMemory::jmpbuf_offset());
-  FillJumpBuffer(masm, jmpbuf, &resume, scratch);
-  SwitchStackState(masm, jmpbuf, scratch, wasm::JumpBuffer::Active,
+  FillJumpBuffer(masm, stack, &resume, scratch);
+  SwitchStackState(masm, stack, scratch, wasm::JumpBuffer::Active,
                    wasm::JumpBuffer::Suspended);
-  regs.ResetExcept(suspender, continuation);
+  regs.ResetExcept(suspender, stack);
 
-  DEFINE_REG(suspender_continuation);
-  __ LoadTaggedField(
-      suspender_continuation,
-      FieldMemOperand(suspender, WasmSuspenderObject::kContinuationOffset));
+  DEFINE_REG(suspender_stack);
+  __ LoadExternalPointerField(
+      suspender_stack,
+      FieldMemOperand(suspender, WasmSuspenderObject::kStackOffset),
+      kWasmStackMemoryTag);
   if (v8_flags.debug_code) {
     // -------------------------------------------
-    // Check that the suspender's continuation is the active continuation.
+    // Check that the suspender's stack is the active stack.
     // -------------------------------------------
     // TODO(thibaudm): Once we add core stack-switching instructions, this
-    // check will not hold anymore: it's possible that the active continuation
-    // changed (due to an internal switch), so we have to update the suspender.
-    __ cmp(suspender_continuation, continuation);
+    // check will not hold anymore: it's possible that the active stack changed
+    // (due to an internal switch), so we have to update the suspender.
+    __ cmp(suspender_stack, stack);
     Label ok;
     __ B(&ok, eq);
     __ Trap();
@@ -3875,13 +3830,8 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
   // Update roots.
   // -------------------------------------------
   DEFINE_REG(caller);
-  __ LoadTaggedField(caller,
-                     FieldMemOperand(suspender_continuation,
-                                     WasmContinuationObject::kParentOffset));
-  int32_t active_continuation_offset =
-      MacroAssembler::RootRegisterOffsetForRootIndex(
-          RootIndex::kActiveContinuation);
-  __ Str(caller, MemOperand(kRootRegister, active_continuation_offset));
+  __ Ldr(caller, MemOperand(suspender_stack, wasm::kStackParentOffset));
+  __ StoreRootRelative(IsolateData::active_stack_offset(), caller);
   DEFINE_REG(parent);
   __ LoadTaggedField(
       parent, FieldMemOperand(suspender, WasmSuspenderObject::kParentOffset));
@@ -3889,18 +3839,13 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
       MacroAssembler::RootRegisterOffsetForRootIndex(
           RootIndex::kActiveSuspender);
   __ Str(parent, MemOperand(kRootRegister, active_suspender_offset));
-  regs.ResetExcept(suspender, caller, continuation);
+  regs.ResetExcept(suspender, caller, stack);
 
   // -------------------------------------------
   // Load jump buffer.
   // -------------------------------------------
-  SwitchStacks(masm, continuation, false, {caller, suspender});
-  FREE_REG(continuation);
-  ASSIGN_REG(jmpbuf);
-  __ LoadExternalPointerField(
-      jmpbuf, FieldMemOperand(caller, WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag);
-  __ Add(jmpbuf, jmpbuf, wasm::StackMemory::jmpbuf_offset());
+  SwitchStacks(masm, stack, false, {caller, suspender});
+  FREE_REG(stack);
   __ LoadTaggedField(
       kReturnRegister0,
       FieldMemOperand(suspender, WasmSuspenderObject::kPromiseOffset));
@@ -3908,7 +3853,7 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
       MemOperand(fp, StackSwitchFrameConstants::kGCScanSlotCountOffset);
   __ Str(xzr, GCScanSlotPlace);
   ASSIGN_REG(scratch)
-  LoadJumpBuffer(masm, jmpbuf, true, scratch, wasm::JumpBuffer::Inactive);
+  LoadJumpBuffer(masm, caller, true, scratch, wasm::JumpBuffer::Inactive);
   __ Trap();
   __ Bind(&resume, BranchTargetIdentifier::kBtiJump);
   __ LeaveFrame(StackFrame::STACK_SWITCH);
@@ -3962,23 +3907,15 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
   // Save current state.
   // -------------------------------------------
   Label suspend;
-  DEFINE_REG(active_continuation);
-  __ LoadRoot(active_continuation, RootIndex::kActiveContinuation);
-  DEFINE_REG(current_jmpbuf);
+  DEFINE_REG(active_stack);
+  __ LoadRootRelative(active_stack, IsolateData::active_stack_offset());
   DEFINE_REG(scratch);
-  __ LoadExternalPointerField(
-      current_jmpbuf,
-      FieldMemOperand(active_continuation,
-                      WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag);
-  __ Add(current_jmpbuf, current_jmpbuf, wasm::StackMemory::jmpbuf_offset());
-  FillJumpBuffer(masm, current_jmpbuf, &suspend, scratch);
-  SwitchStackState(masm, current_jmpbuf, scratch, wasm::JumpBuffer::Active,
+  FillJumpBuffer(masm, active_stack, &suspend, scratch);
+  SwitchStackState(masm, active_stack, scratch, wasm::JumpBuffer::Active,
                    wasm::JumpBuffer::Inactive);
-  FREE_REG(current_jmpbuf);
 
   // -------------------------------------------
-  // Set the suspender and continuation parents and update the roots
+  // Set the suspender and stack parents and update the roots
   // -------------------------------------------
   DEFINE_REG(active_suspender);
   __ LoadRoot(active_suspender, RootIndex::kActiveSuspender);
@@ -3993,56 +3930,32 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
           RootIndex::kActiveSuspender);
   __ Str(suspender, MemOperand(kRootRegister, active_suspender_offset));
 
-  // Next line we are going to load a field from suspender, but we have to use
-  // the same register for target_continuation to use it in RecordWriteField.
-  // So, free suspender here to use pinned reg, but load from it next line.
+  DEFINE_REG(target_stack);
+  __ LoadExternalPointerField(
+      target_stack,
+      FieldMemOperand(suspender, WasmSuspenderObject::kStackOffset),
+      kWasmStackMemoryTag);
   FREE_REG(suspender);
-  DEFINE_PINNED(target_continuation, WriteBarrierDescriptor::ObjectRegister());
-  suspender = target_continuation;
-  __ LoadTaggedField(
-      target_continuation,
-      FieldMemOperand(suspender, WasmSuspenderObject::kContinuationOffset));
-  suspender = no_reg;
 
-  __ StoreTaggedField(
-      active_continuation,
-      FieldMemOperand(target_continuation,
-                      WasmContinuationObject::kParentOffset));
-  DEFINE_REG(old_continuation);
-  __ Move(old_continuation, active_continuation);
-  __ RecordWriteField(
-      target_continuation, WasmContinuationObject::kParentOffset,
-      active_continuation, kLRHasBeenSaved, SaveFPRegsMode::kIgnore);
-  int32_t active_continuation_offset =
-      MacroAssembler::RootRegisterOffsetForRootIndex(
-          RootIndex::kActiveContinuation);
-  __ Str(target_continuation,
-         MemOperand(kRootRegister, active_continuation_offset));
+  __ StoreRootRelative(IsolateData::active_stack_offset(), target_stack);
 
-  SwitchStacks(masm, old_continuation, false, {target_continuation});
+  SwitchStacks(masm, active_stack, false, {target_stack});
 
-  regs.ResetExcept(target_continuation);
+  regs.ResetExcept(target_stack);
 
   // -------------------------------------------
   // Load state from target jmpbuf (longjmp).
   // -------------------------------------------
   regs.Reserve(kReturnRegister0);
-  DEFINE_REG(target_jmpbuf);
   ASSIGN_REG(scratch);
-  __ LoadExternalPointerField(
-      target_jmpbuf,
-      FieldMemOperand(target_continuation,
-                      WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag);
-  __ Add(target_jmpbuf, target_jmpbuf, wasm::StackMemory::jmpbuf_offset());
   // Move resolved value to return register.
   __ Ldr(kReturnRegister0, MemOperand(fp, 3 * kSystemPointerSize));
   MemOperand GCScanSlotPlace =
       MemOperand(fp, StackSwitchFrameConstants::kGCScanSlotCountOffset);
   __ Str(xzr, GCScanSlotPlace);
   if (on_resume == wasm::OnResume::kThrow) {
-    // Switch to the continuation's stack without restoring the PC.
-    LoadJumpBuffer(masm, target_jmpbuf, false, scratch,
+    // Switch without restoring the PC.
+    LoadJumpBuffer(masm, target_stack, false, scratch,
                    wasm::JumpBuffer::Suspended);
     // Pop this frame now. The unwinder expects that the first STACK_SWITCH
     // frame is the outermost one.
@@ -4051,8 +3964,8 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
     __ Push(xzr, kReturnRegister0);
     __ CallRuntime(Runtime::kThrow);
   } else {
-    // Resume the continuation normally.
-    LoadJumpBuffer(masm, target_jmpbuf, true, scratch,
+    // Resume the stack normally.
+    LoadJumpBuffer(masm, target_stack, true, scratch,
                    wasm::JumpBuffer::Suspended);
   }
   __ Trap();
@@ -4083,24 +3996,21 @@ void SwitchToAllocatedStack(MacroAssembler* masm, RegisterAllocator& regs,
                             Label* suspend) {
   ResetStackSwitchFrameStackSlots(masm);
   DEFINE_SCOPED(scratch)
-  DEFINE_REG(target_continuation)
-  __ LoadRoot(target_continuation, RootIndex::kActiveContinuation);
-  DEFINE_REG(parent_continuation)
-  __ LoadTaggedField(parent_continuation,
-                     FieldMemOperand(target_continuation,
-                                     WasmContinuationObject::kParentOffset));
-  SaveState(masm, parent_continuation, scratch, suspend);
-  SwitchStacks(masm, parent_continuation, false,
-               {wasm_instance, wrapper_buffer});
-  FREE_REG(parent_continuation);
+  DEFINE_REG(parent_stack)
+  __ LoadRootRelative(parent_stack, IsolateData::active_stack_offset());
+  __ Ldr(parent_stack, MemOperand(parent_stack, wasm::kStackParentOffset));
+  FillJumpBuffer(masm, parent_stack, suspend, scratch);
+  SwitchStacks(masm, parent_stack, false, {wasm_instance, wrapper_buffer});
+  FREE_REG(parent_stack);
   // Save the old stack's fp in x9, and use it to access the parameters in
   // the parent frame.
   regs.Pinned(x9, &original_fp);
   __ Mov(original_fp, fp);
-  __ LoadRoot(target_continuation, RootIndex::kActiveContinuation);
-  LoadTargetJumpBuffer(masm, target_continuation, scratch,
+  DEFINE_REG(target_stack);
+  __ LoadRootRelative(target_stack, IsolateData::active_stack_offset());
+  LoadTargetJumpBuffer(masm, target_stack, scratch,
                        wasm::JumpBuffer::Suspended);
-  FREE_REG(target_continuation);
+  FREE_REG(target_stack);
   // Push the loaded fp. We know it is null, because there is no frame yet,
   // so we could also push 0 directly. In any case we need to push it,
   // because this marks the base of the stack segment for
@@ -4158,9 +4068,9 @@ void SwitchBackAndReturnPromise(MacroAssembler* masm, RegisterAllocator& regs,
          MemOperand(fp, StackSwitchFrameConstants::kImplicitArgOffset));
   GetContextFromImplicitArg(masm, kContextRegister, tmp);
 
-  ReloadParentContinuation(masm, promise, return_value, kContextRegister, tmp,
-                           tmp2, tmp3);
-  RestoreParentSuspender(masm, tmp, tmp2);
+  ReloadParentStack(masm, promise, return_value, kContextRegister, tmp, tmp2,
+                    tmp3);
+  RestoreParentSuspender(masm, tmp);
 
   if (mode == wasm::kPromise) {
     __ Mov(tmp, 1);
@@ -4208,9 +4118,8 @@ void GenerateExceptionHandlingLandingPad(MacroAssembler* masm,
   DEFINE_SCOPED(tmp2);
   DEFINE_SCOPED(tmp3);
   GetContextFromImplicitArg(masm, kContextRegister, tmp);
-  ReloadParentContinuation(masm, promise, reason, kContextRegister, tmp, tmp2,
-                           tmp3);
-  RestoreParentSuspender(masm, tmp, tmp2);
+  ReloadParentStack(masm, promise, reason, kContextRegister, tmp, tmp2, tmp3);
+  RestoreParentSuspender(masm, tmp);
 
   __ Mov(tmp, 1);
   __ Str(tmp,
@@ -4718,10 +4627,17 @@ void Builtins::Generate_CEntry(MacroAssembler* masm, int result_size,
   __ Ldr(cp, MemOperand(cp));
   {
     UseScratchRegisterScope temps(masm);
-    Register scratch = temps.AcquireX();
+    temps.Exclude(x16);
+    Register scratch = x1;
     __ Mov(scratch, ER::Create(IsolateAddressId::kPendingHandlerSPAddress,
                                masm->isolate()));
     __ Ldr(scratch, MemOperand(scratch));
+    if (masm->options().enable_simulator_code) {
+      // Update the simulator stack limit in case the exception was caught in a
+      // different stack.
+      __ LoadStackLimit(x16, StackLimitKind::kRealStackLimit);
+      __ hlt(kImmExceptionIsSwitchStackLimit);
+    }
     __ Mov(sp, scratch);
   }
   __ Mov(fp, ER::Create(IsolateAddressId::kPendingHandlerFPAddress,
diff --git a/deps/v8/src/builtins/base.tq b/deps/v8/src/builtins/base.tq
index b5f1e324a1002b..b45442de1f51a8 100644
--- a/deps/v8/src/builtins/base.tq
+++ b/deps/v8/src/builtins/base.tq
@@ -274,6 +274,7 @@ extern class NameToIndexHashTable extends HashTable;
 extern class RegisteredSymbolTable extends HashTable;
 extern class NameDictionary extends HashTable;
 extern class GlobalDictionary extends HashTable;
+extern class SimpleNameDictionary extends HashTable;
 extern class SimpleNumberDictionary extends HashTable;
 extern class EphemeronHashTable extends HashTable;
 type ObjectHashTable extends HashTable
@@ -1315,6 +1316,7 @@ extern macro IsInteger(JSAny): bool;
 extern macro IsInteger(HeapNumber): bool;
 
 extern macro AllocateHeapNumberWithValue(float64): HeapNumber;
+extern macro AllocateContextCell(Object): ContextCell;
 extern macro ChangeInt32ToTagged(int32): Number;
 extern macro ChangeUint32ToTagged(uint32): Number;
 extern macro ChangeUintPtrToFloat64(uintptr): float64;
@@ -1462,8 +1464,6 @@ extern macro IsTypedArraySpeciesProtectorCellInvalid(): bool;
 extern macro IsPromiseSpeciesProtectorCellInvalid(): bool;
 extern macro IsMockArrayBufferAllocatorFlag(): bool;
 extern macro HasBuiltinSubclassingFlag(): bool;
-extern macro IsScriptContextMutableHeapNumberFlag(): bool;
-extern macro IsScriptContextMutableHeapInt32Flag(): bool;
 extern macro IsPrototypeTypedArrayPrototype(
     implicit context: Context)(Map): bool;
 extern macro IsSetIteratorProtectorCellInvalid(): bool;
diff --git a/deps/v8/src/builtins/builtins-array-gen.cc b/deps/v8/src/builtins/builtins-array-gen.cc
index 7cd4c9e79729ab..a48f355b6ff046 100644
--- a/deps/v8/src/builtins/builtins-array-gen.cc
+++ b/deps/v8/src/builtins/builtins-array-gen.cc
@@ -551,7 +551,7 @@ class ArrayPopulatorAssembler : public CodeStubAssembler {
     {
       Label allocate_js_array(this);
 
-      TNode<Map> array_map = CAST(LoadContextElement(
+      TNode<Map> array_map = CAST(LoadContextElementNoCell(
           context, Context::JS_ARRAY_PACKED_SMI_ELEMENTS_MAP_INDEX));
 
       TNode<IntPtrT> capacity = IntPtrConstant(0);
@@ -1687,7 +1687,8 @@ void ArrayBuiltinsAssembler::CreateArrayDispatchSingleArgument(
       // Make elements kind holey and update elements kind in the type info.
       var_elements_kind = Word32Or(var_elements_kind.value(), Int32Constant(1));
       StoreObjectFieldNoWriteBarrier(
-          *allocation_site, AllocationSite::kTransitionInfoOrBoilerplateOffset,
+          *allocation_site,
+          offsetof(AllocationSite, transition_info_or_boilerplate_),
           SmiOr(transition_info, SmiConstant(fast_elements_kind_holey_mask)));
       Goto(&normal_sequence);
     }
diff --git a/deps/v8/src/builtins/builtins-array.cc b/deps/v8/src/builtins/builtins-array.cc
index 0240f0eb5c8144..26e8868e548e88 100644
--- a/deps/v8/src/builtins/builtins-array.cc
+++ b/deps/v8/src/builtins/builtins-array.cc
@@ -95,7 +95,7 @@ void MatchArrayElementsKindToArguments(Isolate* isolate,
     // Use a short-lived HandleScope to avoid creating several copies of the
     // elements handle which would cause issues when left-trimming later-on.
     HandleScope scope(isolate);
-    JSObject::TransitionElementsKind(array, target_kind);
+    JSObject::TransitionElementsKind(isolate, array, target_kind);
   }
 }
 
@@ -185,7 +185,7 @@ V8_WARN_UNUSED_RESULT MaybeDirectHandle<Object> SetLengthProperty(
     if (!JSArray::HasReadOnlyLength(array)) {
       DCHECK_LE(length, kMaxUInt32);
       MAYBE_RETURN_NULL(
-          JSArray::SetLength(array, static_cast<uint32_t>(length)));
+          JSArray::SetLength(isolate, array, static_cast<uint32_t>(length)));
       return receiver;
     }
   }
@@ -235,7 +235,7 @@ V8_WARN_UNUSED_RESULT MaybeDirectHandle<Map> GetReplacedElementsKindsMap(
     Tagged<Context> native_context = map->map()->native_context();
     if (native_context->GetInitialJSArrayMap(origin_kind) == map) {
       Tagged<Object> maybe_target_map =
-          native_context->get(Context::ArrayMapIndex(target_kind));
+          native_context->GetNoCell(Context::ArrayMapIndex(target_kind));
       if (Tagged<Map> target_map; TryCast<Map>(maybe_target_map, &target_map)) {
         map->NotifyLeafMapLayoutChange(isolate);
         return direct_handle(target_map, isolate);
@@ -323,7 +323,7 @@ V8_WARN_UNUSED_RESULT bool TryFastArrayFill(
         if (IsMoreGeneralElementsKindTransition(origin_kind, target_kind)) {
           // Transition through the allocation site as well if present, but
           // only if this is a forward transition.
-          JSObject::UpdateAllocationSite(array, target_kind);
+          JSObject::UpdateAllocationSite(isolate, array, target_kind);
         }
         did_transition_map = true;
       }
@@ -331,12 +331,12 @@ V8_WARN_UNUSED_RESULT bool TryFastArrayFill(
 
     if (!did_transition_map) {
       target_kind = GetMoreGeneralElementsKind(origin_kind, target_kind);
-      JSObject::TransitionElementsKind(array, target_kind);
+      JSObject::TransitionElementsKind(isolate, array, target_kind);
     }
   }
 
   ElementsAccessor* accessor = array->GetElementsAccessor();
-  accessor->Fill(array, value, start, end).Check();
+  accessor->Fill(isolate, array, value, start, end).Check();
 
   // It's possible the JSArray's 'length' property was assigned to after the
   // length was loaded due to user code during argument coercion of the start
@@ -347,7 +347,7 @@ V8_WARN_UNUSED_RESULT bool TryFastArrayFill(
   // need to ensure the JSArray's length is correctly set in case the user
   // assigned a smaller value.
   if (Object::NumberValue(array->length()) < end) {
-    CHECK(accessor->SetLength(array, end).FromJust());
+    CHECK(accessor->SetLength(isolate, array, end).FromJust());
   }
 
   return true;
@@ -496,7 +496,7 @@ BUILTIN(ArrayPush) {
   ElementsAccessor* accessor = array->GetElementsAccessor();
   uint32_t new_length;
   MAYBE_ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, new_length, accessor->Push(array, &args, to_add));
+      isolate, new_length, accessor->Push(isolate, array, &args, to_add));
   return *isolate->factory()->NewNumberFromUint((new_length));
 }
 
@@ -579,7 +579,7 @@ BUILTIN(ArrayPop) {
   if (IsJSArrayFastElementMovingAllowed(isolate, *array)) {
     // Fast Elements Path
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-        isolate, result, array->GetElementsAccessor()->Pop(array));
+        isolate, result, array->GetElementsAccessor()->Pop(isolate, array));
   } else {
     // Use Slow Lookup otherwise
     uint32_t new_length = len - 1;
@@ -596,7 +596,7 @@ BUILTIN(ArrayPop) {
     }
     bool set_len_ok;
     MAYBE_ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-        isolate, set_len_ok, JSArray::SetLength(array, new_length));
+        isolate, set_len_ok, JSArray::SetLength(isolate, array, new_length));
   }
 
   return *result;
@@ -704,8 +704,8 @@ BUILTIN(ArrayShift) {
 
   if (CanUseFastArrayShift(isolate, receiver)) {
     DirectHandle<JSArray> array = Cast<JSArray>(receiver);
-    RETURN_RESULT_OR_FAILURE(isolate,
-                             array->GetElementsAccessor()->Shift(array));
+    RETURN_RESULT_OR_FAILURE(
+        isolate, array->GetElementsAccessor()->Shift(isolate, array));
   }
 
   return GenericArrayShift(isolate, receiver, length);
@@ -735,7 +735,7 @@ BUILTIN(ArrayUnshift) {
   ElementsAccessor* accessor = array->GetElementsAccessor();
   uint32_t new_length;
   MAYBE_ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, new_length, accessor->Unshift(array, &args, to_add));
+      isolate, new_length, accessor->Unshift(isolate, array, &args, to_add));
   return Smi::FromInt(new_length);
 }
 
@@ -855,7 +855,8 @@ class ArrayConcatVisitor {
     DirectHandle<Number> length =
         isolate_->factory()->NewNumber(static_cast<double>(index_offset_));
     DirectHandle<Map> map = JSObject::GetElementsTransitionMap(
-        array, fast_elements() ? HOLEY_ELEMENTS : DICTIONARY_ELEMENTS);
+        isolate_, array,
+        fast_elements() ? HOLEY_ELEMENTS : DICTIONARY_ELEMENTS);
     {
       DisallowGarbageCollection no_gc;
       Tagged<JSArray> raw = *array;
@@ -1109,7 +1110,7 @@ void CollectElementIndices(Isolate* isolate, DirectHandle<JSObject> object,
       Tagged<JSObject> raw_object = *object;
       ElementsAccessor* accessor = object->GetElementsAccessor();
       for (uint32_t i = 0; i < range; i++) {
-        if (accessor->HasElement(raw_object, i, elements)) {
+        if (accessor->HasElement(isolate, raw_object, i, elements)) {
           indices->push_back(i);
         }
       }
@@ -1129,7 +1130,7 @@ void CollectElementIndices(Isolate* isolate, DirectHandle<JSObject> object,
       }
       ElementsAccessor* accessor = object->GetElementsAccessor();
       for (; i < range; i++) {
-        if (accessor->HasElement(*object, i)) {
+        if (accessor->HasElement(isolate, *object, i)) {
           indices->push_back(i);
         }
       }
@@ -1147,7 +1148,7 @@ void CollectElementIndices(Isolate* isolate, DirectHandle<JSObject> object,
       for (uint32_t i = 0; i < length; i++) {
         // JSSharedArrays are created non-resizable and do not have holes.
         SLOW_DCHECK(object->GetElementsAccessor()->HasElement(
-            *object, i, object->elements()));
+            isolate, *object, i, object->elements()));
         indices->push_back(i);
       }
       if (length == range) return;
diff --git a/deps/v8/src/builtins/builtins-arraybuffer.cc b/deps/v8/src/builtins/builtins-arraybuffer.cc
index 1e23371b9e0c8e..4283914312035f 100644
--- a/deps/v8/src/builtins/builtins-arraybuffer.cc
+++ b/deps/v8/src/builtins/builtins-arraybuffer.cc
@@ -176,6 +176,12 @@ BUILTIN(ArrayBufferConstructor) {
     }
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, number_max_length,
                                        Object::ToInteger(isolate, max_length));
+    if (Object::NumberValue(*number_length) >
+        Object::NumberValue(*number_max_length)) {
+      THROW_NEW_ERROR_RETURN_FAILURE(
+          isolate,
+          NewRangeError(MessageTemplate::kInvalidArrayBufferMaxLength));
+    }
   }
   return ConstructBuffer(isolate, target, new_target, number_length,
                          number_max_length, InitializedFlag::kZeroInitialized);
diff --git a/deps/v8/src/builtins/builtins-async-disposable-stack.cc b/deps/v8/src/builtins/builtins-async-disposable-stack.cc
index 86487c2a11f119..226184d9d5497a 100644
--- a/deps/v8/src/builtins/builtins-async-disposable-stack.cc
+++ b/deps/v8/src/builtins/builtins-async-disposable-stack.cc
@@ -25,11 +25,12 @@ BUILTIN(AsyncDisposableStackOnFulfilled) {
   HandleScope scope(isolate);
 
   DirectHandle<JSDisposableStackBase> stack(
-      Cast<JSDisposableStackBase>(isolate->context()->get(static_cast<int>(
+      Cast<
+          JSDisposableStackBase>(isolate->context()->GetNoCell(static_cast<int>(
           JSDisposableStackBase::AsyncDisposableStackContextSlots::kStack))),
       isolate);
   DirectHandle<JSPromise> promise(
-      Cast<JSPromise>(isolate->context()->get(static_cast<int>(
+      Cast<JSPromise>(isolate->context()->GetNoCell(static_cast<int>(
           JSDisposableStackBase::AsyncDisposableStackContextSlots::
               kOuterPromise))),
       isolate);
@@ -44,11 +45,12 @@ BUILTIN(AsyncDisposableStackOnRejected) {
   HandleScope scope(isolate);
 
   DirectHandle<JSDisposableStackBase> stack(
-      Cast<JSDisposableStackBase>(isolate->context()->get(static_cast<int>(
+      Cast<
+          JSDisposableStackBase>(isolate->context()->GetNoCell(static_cast<int>(
           JSDisposableStackBase::AsyncDisposableStackContextSlots::kStack))),
       isolate);
   DirectHandle<JSPromise> promise(
-      Cast<JSPromise>(isolate->context()->get(static_cast<int>(
+      Cast<JSPromise>(isolate->context()->GetNoCell(static_cast<int>(
           JSDisposableStackBase::AsyncDisposableStackContextSlots::
               kOuterPromise))),
       isolate);
@@ -82,7 +84,7 @@ BUILTIN(AsyncDisposeFromSyncDispose) {
 
   //        c. Let result be Completion(Call(method, O)).
   DirectHandle<JSFunction> sync_method(
-      Cast<JSFunction>(isolate->context()->get(static_cast<int>(
+      Cast<JSFunction>(isolate->context()->GetNoCell(static_cast<int>(
           JSDisposableStackBase::AsyncDisposeFromSyncDisposeContextSlots::
               kMethod))),
       isolate);
@@ -375,7 +377,7 @@ BUILTIN(AsyncDisposableStackPrototypeMove) {
   // 5. Set newAsyncDisposableStack.[[AsyncDisposableState]] to pending.
 
   Tagged<JSFunction> constructor_function =
-      Cast<JSFunction>(isolate->native_context()->get(
+      Cast<JSFunction>(isolate->native_context()->GetNoCell(
           Context::JS_ASYNC_DISPOSABLE_STACK_FUNCTION_INDEX));
   DirectHandle<Map> map(constructor_function->initial_map(), isolate);
 
diff --git a/deps/v8/src/builtins/builtins-async-function-gen.cc b/deps/v8/src/builtins/builtins-async-function-gen.cc
index 18b24df6d3b960..71e4eaa365cb76 100644
--- a/deps/v8/src/builtins/builtins-async-function-gen.cc
+++ b/deps/v8/src/builtins/builtins-async-function-gen.cc
@@ -36,7 +36,7 @@ void AsyncFunctionBuiltinsAssembler::AsyncFunctionAwaitResumeClosure(
          resume_mode == JSGeneratorObject::kThrow);
 
   TNode<JSAsyncFunctionObject> async_function_object =
-      CAST(LoadContextElement(context, Context::EXTENSION_INDEX));
+      CAST(LoadContextElementNoCell(context, Context::EXTENSION_INDEX));
 
   // Inline version of GeneratorPrototypeNext / GeneratorPrototypeReturn with
   // unnecessary runtime checks removed.
@@ -93,7 +93,7 @@ TF_BUILTIN(AsyncFunctionEnter, AsyncFunctionBuiltinsAssembler) {
 
   // Allocate and initialize the async function object.
   TNode<NativeContext> native_context = LoadNativeContext(context);
-  TNode<Map> async_function_object_map = CAST(LoadContextElement(
+  TNode<Map> async_function_object_map = CAST(LoadContextElementNoCell(
       native_context, Context::ASYNC_FUNCTION_OBJECT_MAP_INDEX));
   TNode<JSAsyncFunctionObject> async_function_object =
       UncheckedCast<JSAsyncFunctionObject>(
diff --git a/deps/v8/src/builtins/builtins-async-gen.cc b/deps/v8/src/builtins/builtins-async-gen.cc
index 1085d527ab0cd3..31c8f59df35826 100644
--- a/deps/v8/src/builtins/builtins-async-gen.cc
+++ b/deps/v8/src/builtins/builtins-async-gen.cc
@@ -63,8 +63,8 @@ TNode<Object> AsyncBuiltinsAssembler::Await(
     // is the (initial) Promise.prototype and the @@species protector is
     // intact, as that guards the lookup path for "constructor" on
     // JSPromise instances which have the (initial) Promise.prototype.
-    const TNode<Object> promise_prototype =
-        LoadContextElement(native_context, Context::PROMISE_PROTOTYPE_INDEX);
+    const TNode<Object> promise_prototype = LoadContextElementNoCell(
+        native_context, Context::PROMISE_PROTOTYPE_INDEX);
     GotoIfNot(TaggedEqual(LoadMapPrototype(value_map), promise_prototype),
               &if_slow_constructor);
     Branch(IsPromiseSpeciesProtectorCellInvalid(), &if_slow_constructor,
@@ -78,8 +78,8 @@ TNode<Object> AsyncBuiltinsAssembler::Await(
     {
       const TNode<Object> value_constructor = GetProperty(
           context, value, isolate()->factory()->constructor_string());
-      const TNode<Object> promise_function =
-          LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX);
+      const TNode<Object> promise_function = LoadContextElementNoCell(
+          native_context, Context::PROMISE_FUNCTION_INDEX);
       Branch(TaggedEqual(value_constructor, promise_function), &if_done,
              &if_slow_path);
     }
@@ -105,14 +105,14 @@ TNode<Object> AsyncBuiltinsAssembler::Await(
       UncheckedCast<Context>(AllocateInNewSpace(kClosureContextSize));
   {
     // Initialize the await context, storing the {generator} as extension.
-    TNode<Map> map = CAST(
-        LoadContextElement(native_context, Context::AWAIT_CONTEXT_MAP_INDEX));
+    TNode<Map> map = CAST(LoadContextElementNoCell(
+        native_context, Context::AWAIT_CONTEXT_MAP_INDEX));
     StoreMapNoWriteBarrier(closure_context, map);
     StoreObjectFieldNoWriteBarrier(
         closure_context, Context::kLengthOffset,
         SmiConstant(Context::MIN_CONTEXT_EXTENDED_SLOTS));
     const TNode<Object> empty_scope_info =
-        LoadContextElement(native_context, Context::SCOPE_INFO_INDEX);
+        LoadContextElementNoCell(native_context, Context::SCOPE_INFO_INDEX);
     StoreContextElementNoWriteBarrier(
         closure_context, Context::SCOPE_INFO_INDEX, empty_scope_info);
     StoreContextElementNoWriteBarrier(closure_context, Context::PREVIOUS_INDEX,
@@ -183,7 +183,7 @@ TF_BUILTIN(AsyncIteratorValueUnwrap, AsyncBuiltinsAssembler) {
   auto context = Parameter<Context>(Descriptor::kContext);
 
   const TNode<Object> done =
-      LoadContextElement(context, ValueUnwrapContext::kDoneSlot);
+      LoadContextElementNoCell(context, ValueUnwrapContext::kDoneSlot);
   CSA_DCHECK(this, IsBoolean(CAST(done)));
 
   const TNode<Object> unwrapped_value =
diff --git a/deps/v8/src/builtins/builtins-async-generator-gen.cc b/deps/v8/src/builtins/builtins-async-generator-gen.cc
index 73857fda13ad78..6e2cf809d6c777 100644
--- a/deps/v8/src/builtins/builtins-async-generator-gen.cc
+++ b/deps/v8/src/builtins/builtins-async-generator-gen.cc
@@ -241,7 +241,7 @@ void AsyncGeneratorBuiltinsAssembler::AsyncGeneratorAwaitResumeClosure(
     TNode<Context> context, TNode<Object> value,
     JSAsyncGeneratorObject::ResumeMode resume_mode) {
   const TNode<JSAsyncGeneratorObject> async_generator_object =
-      CAST(LoadContextElement(context, Context::EXTENSION_INDEX));
+      CAST(LoadContextElementNoCell(context, Context::EXTENSION_INDEX));
 
   AsyncGeneratorAwaitResume(context, async_generator_object, value,
                             resume_mode);
@@ -519,7 +519,7 @@ TF_BUILTIN(AsyncGeneratorResolve, AsyncGeneratorBuiltinsAssembler) {
   // Let iteratorResult be CreateIterResultObject(value, done).
   const TNode<HeapObject> iter_result = Allocate(JSIteratorResult::kSize);
   {
-    TNode<Map> map = CAST(LoadContextElement(
+    TNode<Map> map = CAST(LoadContextElementNoCell(
         LoadNativeContext(context), Context::ITERATOR_RESULT_MAP_INDEX));
     StoreMapNoWriteBarrier(iter_result, map);
     StoreObjectFieldRoot(iter_result, JSIteratorResult::kPropertiesOrHashOffset,
@@ -604,7 +604,7 @@ TF_BUILTIN(AsyncGeneratorYieldWithAwaitResolveClosure,
   const auto context = Parameter<Context>(Descriptor::kContext);
   const auto value = Parameter<JSAny>(Descriptor::kValue);
   const TNode<JSAsyncGeneratorObject> generator =
-      CAST(LoadContextElement(context, Context::EXTENSION_INDEX));
+      CAST(LoadContextElementNoCell(context, Context::EXTENSION_INDEX));
 
   SetGeneratorNotAwaiting(generator);
 
@@ -721,7 +721,7 @@ TF_BUILTIN(AsyncGeneratorReturnClosedResolveClosure,
   const auto context = Parameter<Context>(Descriptor::kContext);
   const auto value = Parameter<JSAny>(Descriptor::kValue);
   const TNode<JSAsyncGeneratorObject> generator =
-      CAST(LoadContextElement(context, Context::EXTENSION_INDEX));
+      CAST(LoadContextElementNoCell(context, Context::EXTENSION_INDEX));
 
   SetGeneratorNotAwaiting(generator);
 
@@ -739,7 +739,7 @@ TF_BUILTIN(AsyncGeneratorReturnClosedRejectClosure,
   const auto context = Parameter<Context>(Descriptor::kContext);
   const auto value = Parameter<JSAny>(Descriptor::kValue);
   const TNode<JSAsyncGeneratorObject> generator =
-      CAST(LoadContextElement(context, Context::EXTENSION_INDEX));
+      CAST(LoadContextElementNoCell(context, Context::EXTENSION_INDEX));
 
   AsyncGeneratorReturnClosedReject(context, generator, value);
 }
diff --git a/deps/v8/src/builtins/builtins-async-iterator-gen.cc b/deps/v8/src/builtins/builtins-async-iterator-gen.cc
index 70e941e0d95ba6..bfa47a700fc863 100644
--- a/deps/v8/src/builtins/builtins-async-iterator-gen.cc
+++ b/deps/v8/src/builtins/builtins-async-iterator-gen.cc
@@ -150,8 +150,8 @@ void AsyncFromSyncBuiltinsAssembler::Generate_AsyncFromSyncIteratorMethod(
       LoadIteratorResult(context, native_context, iter_result.value(),
                          &maybe_close_sync_then_reject_promise, &var_exception);
 
-  const TNode<JSFunction> promise_fun =
-      CAST(LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX));
+  const TNode<JSFunction> promise_fun = CAST(LoadContextElementNoCell(
+      native_context, Context::PROMISE_FUNCTION_INDEX));
   CSA_DCHECK(this, IsConstructor(promise_fun));
 
   // 6. Let valueWrapper be PromiseResolve(%Promise%, « value »).
@@ -233,8 +233,8 @@ AsyncFromSyncBuiltinsAssembler::LoadIteratorResult(
   const TNode<Map> iter_result_map = LoadMap(CAST(iter_result));
   GotoIfNot(JSAnyIsNotPrimitiveMap(iter_result_map), &if_notanobject);
 
-  const TNode<Object> fast_iter_result_map =
-      LoadContextElement(native_context, Context::ITERATOR_RESULT_MAP_INDEX);
+  const TNode<Object> fast_iter_result_map = LoadContextElementNoCell(
+      native_context, Context::ITERATOR_RESULT_MAP_INDEX);
 
   TVARIABLE(Object, var_value);
   TVARIABLE(Object, var_done);
@@ -442,7 +442,7 @@ TF_BUILTIN(AsyncFromSyncIteratorCloseSyncAndRethrow,
   auto error = Parameter<Object>(Descriptor::kError);
   auto context = Parameter<Context>(Descriptor::kContext);
 
-  const TNode<JSReceiver> sync_iterator = CAST(LoadContextElement(
+  const TNode<JSReceiver> sync_iterator = CAST(LoadContextElementNoCell(
       context, AsyncFromSyncIteratorCloseSyncAndRethrowContext::kSyncIterator));
   // iterator.next field is not used by IteratorCloseOnException.
   TorqueStructIteratorRecord sync_iterator_record = {sync_iterator, {}};
diff --git a/deps/v8/src/builtins/builtins-async-module.cc b/deps/v8/src/builtins/builtins-async-module.cc
index a1d124d543bad6..65f7841c547556 100644
--- a/deps/v8/src/builtins/builtins-async-module.cc
+++ b/deps/v8/src/builtins/builtins-async-module.cc
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "src/builtins/builtins-utils-inl.h"
+#include "src/common/globals.h"
 #include "src/objects/module-inl.h"
 #include "src/objects/objects-inl.h"
 
@@ -12,7 +13,7 @@ namespace internal {
 BUILTIN(CallAsyncModuleFulfilled) {
   HandleScope handle_scope(isolate);
   Handle<SourceTextModule> module(
-      Cast<SourceTextModule>(isolate->context()->get(
+      Cast<SourceTextModule>(isolate->context()->GetNoCell(
           SourceTextModule::ExecuteAsyncModuleContextSlots::kModule)),
       isolate);
   if (SourceTextModule::AsyncModuleExecutionFulfilled(isolate, module)
@@ -29,7 +30,7 @@ BUILTIN(CallAsyncModuleFulfilled) {
 BUILTIN(CallAsyncModuleRejected) {
   HandleScope handle_scope(isolate);
   DirectHandle<SourceTextModule> module(
-      Cast<SourceTextModule>(isolate->context()->get(
+      Cast<SourceTextModule>(isolate->context()->GetNoCell(
           SourceTextModule::ExecuteAsyncModuleContextSlots::kModule)),
       isolate);
 
diff --git a/deps/v8/src/builtins/builtins-atomics-synchronization.cc b/deps/v8/src/builtins/builtins-atomics-synchronization.cc
index 2529a128c31a57..db52964c0ca77c 100644
--- a/deps/v8/src/builtins/builtins-atomics-synchronization.cc
+++ b/deps/v8/src/builtins/builtins-atomics-synchronization.cc
@@ -26,11 +26,12 @@ DirectHandle<JSPromise> UnlockAsyncLockedMutexFromPromiseHandler(
     Isolate* isolate) {
   DirectHandle<Context> context(isolate->context(), isolate);
   DirectHandle<Object> mutex(
-      context->get(JSAtomicsMutex::kMutexAsyncContextSlot), isolate);
+      context->GetNoCell(JSAtomicsMutex::kMutexAsyncContextSlot), isolate);
   DirectHandle<Object> unlock_promise(
-      context->get(JSAtomicsMutex::kUnlockedPromiseAsyncContextSlot), isolate);
+      context->GetNoCell(JSAtomicsMutex::kUnlockedPromiseAsyncContextSlot),
+      isolate);
   DirectHandle<Object> waiter_wrapper_obj(
-      context->get(JSAtomicsMutex::kAsyncLockedWaiterAsyncContextSlot),
+      context->GetNoCell(JSAtomicsMutex::kAsyncLockedWaiterAsyncContextSlot),
       isolate);
 
   auto js_mutex = Cast<JSAtomicsMutex>(mutex);
@@ -390,7 +391,7 @@ BUILTIN(AtomicsConditionAcquireLock) {
 
   DirectHandle<Context> context(isolate->context(), isolate);
   DirectHandle<Object> js_mutex_obj(
-      context->get(JSAtomicsCondition::kMutexAsyncContextSlot), isolate);
+      context->GetNoCell(JSAtomicsCondition::kMutexAsyncContextSlot), isolate);
   DirectHandle<JSAtomicsMutex> js_mutex = Cast<JSAtomicsMutex>(js_mutex_obj);
   DirectHandle<JSPromise> lock_promise =
       JSAtomicsMutex::LockAsyncWrapperForWait(isolate, js_mutex);
diff --git a/deps/v8/src/builtins/builtins-call-gen.cc b/deps/v8/src/builtins/builtins-call-gen.cc
index 717d66c3b45df6..6909d87f9ca80d 100644
--- a/deps/v8/src/builtins/builtins-call-gen.cc
+++ b/deps/v8/src/builtins/builtins-call-gen.cc
@@ -217,11 +217,11 @@ void CallOrConstructBuiltinsAssembler::CallOrConstructWithArrayLike(
   TNode<NativeContext> native_context = LoadNativeContext(context);
 
   // Check if {arguments_list} is an (unmodified) arguments object.
-  TNode<Map> sloppy_arguments_map = CAST(
-      LoadContextElement(native_context, Context::SLOPPY_ARGUMENTS_MAP_INDEX));
+  TNode<Map> sloppy_arguments_map = CAST(LoadContextElementNoCell(
+      native_context, Context::SLOPPY_ARGUMENTS_MAP_INDEX));
   GotoIf(TaggedEqual(arguments_list_map, sloppy_arguments_map), &if_arguments);
-  TNode<Map> strict_arguments_map = CAST(
-      LoadContextElement(native_context, Context::STRICT_ARGUMENTS_MAP_INDEX));
+  TNode<Map> strict_arguments_map = CAST(LoadContextElementNoCell(
+      native_context, Context::STRICT_ARGUMENTS_MAP_INDEX));
   GotoIf(TaggedEqual(arguments_list_map, strict_arguments_map), &if_arguments);
 
   // Check if {arguments_list} is a fast JSArray.
diff --git a/deps/v8/src/builtins/builtins-collections-gen.cc b/deps/v8/src/builtins/builtins-collections-gen.cc
index 7155cc0cd8a2b6..e12fe524f11edf 100644
--- a/deps/v8/src/builtins/builtins-collections-gen.cc
+++ b/deps/v8/src/builtins/builtins-collections-gen.cc
@@ -277,8 +277,8 @@ void BaseCollectionsAssembler::AddConstructorEntriesFromIterable(
 
   CSA_DCHECK(this, Word32BinaryNot(IsUndefined(iterator.object)));
 
-  TNode<Map> fast_iterator_result_map = CAST(
-      LoadContextElement(native_context, Context::ITERATOR_RESULT_MAP_INDEX));
+  TNode<Map> fast_iterator_result_map = CAST(LoadContextElementNoCell(
+      native_context, Context::ITERATOR_RESULT_MAP_INDEX));
 
   Goto(&loop);
   BIND(&loop);
@@ -440,7 +440,7 @@ TNode<JSFunction> BaseCollectionsAssembler::GetConstructor(
       index = Context::JS_WEAK_SET_FUN_INDEX;
       break;
   }
-  return CAST(LoadContextElement(native_context, index));
+  return CAST(LoadContextElementNoCell(native_context, index));
 }
 
 TNode<JSFunction> BaseCollectionsAssembler::GetInitialAddFunction(
@@ -460,7 +460,7 @@ TNode<JSFunction> BaseCollectionsAssembler::GetInitialAddFunction(
       index = Context::WEAKSET_ADD_INDEX;
       break;
   }
-  return CAST(LoadContextElement(native_context, index));
+  return CAST(LoadContextElementNoCell(native_context, index));
 }
 
 int BaseCollectionsAssembler::GetTableOffset(Variant variant) {
@@ -517,7 +517,8 @@ TNode<Map> BaseCollectionsAssembler::GetInitialCollectionPrototype(
       initial_prototype_index = Context::INITIAL_WEAKSET_PROTOTYPE_MAP_INDEX;
       break;
   }
-  return CAST(LoadContextElement(native_context, initial_prototype_index));
+  return CAST(
+      LoadContextElementNoCell(native_context, initial_prototype_index));
 }
 
 TNode<BoolT> BaseCollectionsAssembler::HasInitialCollectionPrototype(
@@ -724,7 +725,7 @@ TNode<HeapObject> CollectionsBuiltinsAssembler::AllocateJSCollectionIterator(
       LoadObjectField(collection, JSCollection::kTableOffset);
   const TNode<NativeContext> native_context = LoadNativeContext(context);
   const TNode<Map> iterator_map =
-      CAST(LoadContextElement(native_context, map_index));
+      CAST(LoadContextElementNoCell(native_context, map_index));
   const TNode<HeapObject> iterator =
       AllocateInNewSpace(IteratorType::kHeaderSize);
   StoreMapNoWriteBarrier(iterator, iterator_map);
@@ -884,14 +885,14 @@ void CollectionsBuiltinsAssembler::
   BIND(&extra_checks);
   // Check if the iterator object has the original %MapIteratorPrototype%.
   const TNode<NativeContext> native_context = LoadNativeContext(context);
-  const TNode<Object> initial_map_iter_proto = LoadContextElement(
+  const TNode<Object> initial_map_iter_proto = LoadContextElementNoCell(
       native_context, Context::INITIAL_MAP_ITERATOR_PROTOTYPE_INDEX);
   const TNode<HeapObject> map_iter_proto = LoadMapPrototype(iter_map);
   GotoIfNot(TaggedEqual(map_iter_proto, initial_map_iter_proto), if_false);
 
   // Check if the original MapIterator prototype has the original
   // %IteratorPrototype%.
-  const TNode<Object> initial_iter_proto = LoadContextElement(
+  const TNode<Object> initial_iter_proto = LoadContextElementNoCell(
       native_context, Context::INITIAL_ITERATOR_PROTOTYPE_INDEX);
   const TNode<HeapObject> iter_proto =
       LoadMapPrototype(LoadMap(map_iter_proto));
@@ -933,7 +934,7 @@ void CollectionsBuiltinsAssembler::BranchIfIterableWithOriginalValueSetIterator(
 
   BIND(&if_set);
   // Check if the set object has the original Set prototype.
-  const TNode<Object> initial_set_proto = LoadContextElement(
+  const TNode<Object> initial_set_proto = LoadContextElementNoCell(
       LoadNativeContext(context), Context::INITIAL_SET_PROTOTYPE_INDEX);
   const TNode<HeapObject> set_proto = LoadMapPrototype(iterable_map);
   GotoIfNot(TaggedEqual(set_proto, initial_set_proto), if_false);
@@ -947,14 +948,14 @@ void CollectionsBuiltinsAssembler::BranchIfIterableWithOriginalValueSetIterator(
 
   // Check if the iterator object has the original SetIterator prototype.
   const TNode<NativeContext> native_context = LoadNativeContext(context);
-  const TNode<Object> initial_set_iter_proto = LoadContextElement(
+  const TNode<Object> initial_set_iter_proto = LoadContextElementNoCell(
       native_context, Context::INITIAL_SET_ITERATOR_PROTOTYPE_INDEX);
   const TNode<HeapObject> set_iter_proto = LoadMapPrototype(iterable_map);
   GotoIfNot(TaggedEqual(set_iter_proto, initial_set_iter_proto), if_false);
 
   // Check if the original SetIterator prototype has the original
   // %IteratorPrototype%.
-  const TNode<Object> initial_iter_proto = LoadContextElement(
+  const TNode<Object> initial_iter_proto = LoadContextElementNoCell(
       native_context, Context::INITIAL_ITERATOR_PROTOTYPE_INDEX);
   const TNode<HeapObject> iter_proto =
       LoadMapPrototype(LoadMap(set_iter_proto));
diff --git a/deps/v8/src/builtins/builtins-console.cc b/deps/v8/src/builtins/builtins-console.cc
index d82cf66ccc856b..4048fe28e4f2ac 100644
--- a/deps/v8/src/builtins/builtins-console.cc
+++ b/deps/v8/src/builtins/builtins-console.cc
@@ -162,9 +162,10 @@ void ConsoleCall(
   if (!IsNativeContext(args.target()->context())) {
     DirectHandle<Context> context(args.target()->context(), isolate);
     CHECK_EQ(CONSOLE_CONTEXT_SLOTS, context->length());
-    context_id = Cast<Smi>(context->get(CONSOLE_CONTEXT_ID_INDEX)).value();
+    context_id =
+        Cast<Smi>(context->GetNoCell(CONSOLE_CONTEXT_ID_INDEX)).value();
     context_name = direct_handle(
-        Cast<String>(context->get(CONSOLE_CONTEXT_NAME_INDEX)), isolate);
+        Cast<String>(context->GetNoCell(CONSOLE_CONTEXT_NAME_INDEX)), isolate);
   }
   (isolate->console_delegate()->*func)(
       debug::ConsoleCallArguments(isolate, args),
@@ -289,7 +290,7 @@ BUILTIN(ConsoleContext) {
 
   DirectHandle<JSObject> prototype =
       factory->NewJSObject(isolate->object_function());
-  JSFunction::SetPrototype(cons, prototype);
+  JSFunction::SetPrototype(isolate, cons, prototype);
 
   DirectHandle<JSObject> console_context =
       factory->NewJSObject(cons, AllocationType::kOld);
@@ -297,8 +298,8 @@ BUILTIN(ConsoleContext) {
 
   DirectHandle<Context> context = factory->NewBuiltinContext(
       isolate->native_context(), CONSOLE_CONTEXT_SLOTS);
-  context->set(CONSOLE_CONTEXT_ID_INDEX, Smi::FromInt(context_id));
-  context->set(CONSOLE_CONTEXT_NAME_INDEX, *context_name);
+  context->SetNoCell(CONSOLE_CONTEXT_ID_INDEX, Smi::FromInt(context_id));
+  context->SetNoCell(CONSOLE_CONTEXT_NAME_INDEX, *context_name);
 
 #define CONSOLE_BUILTIN_SETUP(call, name, ...)            \
   InstallContextFunction(isolate, console_context, #name, \
diff --git a/deps/v8/src/builtins/builtins-constructor-gen.cc b/deps/v8/src/builtins/builtins-constructor-gen.cc
index 702c2df8f7318b..55aa51dec07a66 100644
--- a/deps/v8/src/builtins/builtins-constructor-gen.cc
+++ b/deps/v8/src/builtins/builtins-constructor-gen.cc
@@ -262,7 +262,7 @@ TF_BUILTIN(FastNewClosure, ConstructorBuiltinsAssembler) {
   // as the map of the allocated object.
   const TNode<NativeContext> native_context = LoadNativeContext(context);
   const TNode<Map> function_map =
-      CAST(LoadContextElement(native_context, function_map_index));
+      CAST(LoadContextElementNoCell(native_context, function_map_index));
 
   // Create a new closure from the given function info in new space
   TNode<IntPtrT> instance_size_in_bytes =
@@ -411,7 +411,7 @@ TNode<Context> ConstructorBuiltinsAssembler::FastNewFunctionContext(
     default:
       UNREACHABLE();
   }
-  TNode<Map> map = CAST(LoadContextElement(native_context, index));
+  TNode<Map> map = CAST(LoadContextElementNoCell(native_context, index));
   // Set up the header.
   StoreMapNoWriteBarrier(function_context, map);
   TNode<IntPtrT> min_context_slots = IntPtrConstant(Context::MIN_CONTEXT_SLOTS);
@@ -464,7 +464,7 @@ TNode<JSRegExp> ConstructorBuiltinsAssembler::CreateRegExpLiteral(
     TNode<HeapObject> new_object = Allocate(JSRegExp::Size());
 
     // Initialize Object fields.
-    TNode<JSFunction> regexp_function = CAST(LoadContextElement(
+    TNode<JSFunction> regexp_function = CAST(LoadContextElementNoCell(
         LoadNativeContext(context), Context::REGEXP_FUNCTION_INDEX));
     TNode<Map> initial_map = CAST(LoadObjectField(
         regexp_function, JSFunction::kPrototypeOrInitialMapOffset));
@@ -665,7 +665,7 @@ TNode<HeapObject> ConstructorBuiltinsAssembler::CreateShallowObjectLiteral(
     // Prepare for inner-allocating the AllocationMemento.
     allocation_size = IntPtrAdd(aligned_instance_size,
                                 IntPtrConstant(ALIGN_TO_ALLOCATION_ALIGNMENT(
-                                    AllocationMemento::kSize)));
+                                    sizeof(AllocationMemento))));
   }
 
   TNode<HeapObject> copy =
diff --git a/deps/v8/src/builtins/builtins-date.cc b/deps/v8/src/builtins/builtins-date.cc
index 02d753157d7c67..fda65cbf806102 100644
--- a/deps/v8/src/builtins/builtins-date.cc
+++ b/deps/v8/src/builtins/builtins-date.cc
@@ -227,19 +227,21 @@ BUILTIN(DatePrototypeSetDate) {
   HandleScope scope(isolate);
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setDate");
   DirectHandle<Object> value = args.atOrUndefined(isolate, 1);
+  double time_val = date->value();
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, value,
                                      Object::ToNumber(isolate, value));
-  double time_val = date->value();
-  if (!std::isnan(time_val)) {
-    int64_t const time_ms = static_cast<int64_t>(time_val);
-    int64_t local_time_ms = isolate->date_cache()->ToLocal(time_ms);
-    int const days = isolate->date_cache()->DaysFromTime(local_time_ms);
-    int time_within_day = isolate->date_cache()->TimeInDay(local_time_ms, days);
-    int year, month, day;
-    isolate->date_cache()->YearMonthDayFromDays(days, &year, &month, &day);
-    time_val = MakeDate(MakeDay(year, month, Object::NumberValue(*value)),
-                        time_within_day);
+  if (std::isnan(time_val)) {
+    return ReadOnlyRoots(isolate).nan_value();
   }
+
+  int64_t const time_ms = static_cast<int64_t>(time_val);
+  int64_t local_time_ms = isolate->date_cache()->ToLocal(time_ms);
+  int const days = isolate->date_cache()->DaysFromTime(local_time_ms);
+  int time_within_day = isolate->date_cache()->TimeInDay(local_time_ms, days);
+  int year, month, day;
+  isolate->date_cache()->YearMonthDayFromDays(days, &year, &month, &day);
+  time_val = MakeDate(MakeDay(year, month, Object::NumberValue(*value)),
+                      time_within_day);
   return SetLocalDateValue(isolate, date, time_val);
 }
 
@@ -288,10 +290,10 @@ BUILTIN(DatePrototypeSetHours) {
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setHours");
   int const argc = args.length() - 1;
   DirectHandle<Object> hour = args.atOrUndefined(isolate, 1);
+  double time_val = date->value();
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, hour,
                                      Object::ToNumber(isolate, hour));
   double const h = Object::NumberValue(*hour);
-  double time_val = date->value();
   std::optional<double> m;
   std::optional<double> s;
   std::optional<double> milli;
@@ -315,17 +317,19 @@ BUILTIN(DatePrototypeSetHours) {
     }
   }
 
-  if (!std::isnan(time_val)) {
-    int64_t const time_ms = static_cast<int64_t>(time_val);
-    int64_t const local_time_ms = isolate->date_cache()->ToLocal(time_ms);
-    int const day = isolate->date_cache()->DaysFromTime(local_time_ms);
-    int const time_within_day =
-        isolate->date_cache()->TimeInDay(local_time_ms, day);
-    time_val = MakeDate(
-        day, MakeTime(h, m.value_or((time_within_day / (60 * 1000)) % 60),
-                      s.value_or((time_within_day / 1000) % 60),
-                      milli.value_or(time_within_day % 1000)));
-  }
+  if (std::isnan(time_val)) {
+    return ReadOnlyRoots(isolate).nan_value();
+  }
+
+  int64_t const time_ms = static_cast<int64_t>(time_val);
+  int64_t const local_time_ms = isolate->date_cache()->ToLocal(time_ms);
+  int const day = isolate->date_cache()->DaysFromTime(local_time_ms);
+  int const time_within_day =
+      isolate->date_cache()->TimeInDay(local_time_ms, day);
+  time_val = MakeDate(
+      day, MakeTime(h, m.value_or((time_within_day / (60 * 1000)) % 60),
+                    s.value_or((time_within_day / 1000) % 60),
+                    milli.value_or(time_within_day % 1000)));
   return SetLocalDateValue(isolate, date, time_val);
 }
 
@@ -334,20 +338,22 @@ BUILTIN(DatePrototypeSetMilliseconds) {
   HandleScope scope(isolate);
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setMilliseconds");
   DirectHandle<Object> ms = args.atOrUndefined(isolate, 1);
+  double time_val = date->value();
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, ms,
                                      Object::ToNumber(isolate, ms));
-  double time_val = date->value();
-  if (!std::isnan(time_val)) {
-    int64_t const time_ms = static_cast<int64_t>(time_val);
-    int64_t const local_time_ms = isolate->date_cache()->ToLocal(time_ms);
-    int const day = isolate->date_cache()->DaysFromTime(local_time_ms);
-    int const time_within_day =
-        isolate->date_cache()->TimeInDay(local_time_ms, day);
-    int const h = time_within_day / (60 * 60 * 1000);
-    int const m = (time_within_day / (60 * 1000)) % 60;
-    int const s = (time_within_day / 1000) % 60;
-    time_val = MakeDate(day, MakeTime(h, m, s, Object::NumberValue(*ms)));
-  }
+  if (std::isnan(time_val)) {
+    return ReadOnlyRoots(isolate).nan_value();
+  }
+  int64_t const time_ms = static_cast<int64_t>(time_val);
+  int64_t const local_time_ms = isolate->date_cache()->ToLocal(time_ms);
+  int const day = isolate->date_cache()->DaysFromTime(local_time_ms);
+  int const time_within_day =
+      isolate->date_cache()->TimeInDay(local_time_ms, day);
+  int const h = time_within_day / (60 * 60 * 1000);
+  int const m = (time_within_day / (60 * 1000)) % 60;
+  int const s = (time_within_day / 1000) % 60;
+  time_val = MakeDate(day, MakeTime(h, m, s, Object::NumberValue(*ms)));
+
   return SetLocalDateValue(isolate, date, time_val);
 }
 
@@ -357,9 +363,9 @@ BUILTIN(DatePrototypeSetMinutes) {
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setMinutes");
   int const argc = args.length() - 1;
   DirectHandle<Object> min = args.atOrUndefined(isolate, 1);
+  double time_val = date->value();
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, min,
                                      Object::ToNumber(isolate, min));
-  double time_val = date->value();
   std::optional<double> s;
   std::optional<double> milli;
 
@@ -376,18 +382,20 @@ BUILTIN(DatePrototypeSetMinutes) {
     }
   }
 
-  if (!std::isnan(time_val)) {
-    int64_t const time_ms = static_cast<int64_t>(time_val);
-    int64_t const local_time_ms = isolate->date_cache()->ToLocal(time_ms);
-    int const day = isolate->date_cache()->DaysFromTime(local_time_ms);
-    int const time_within_day =
-        isolate->date_cache()->TimeInDay(local_time_ms, day);
-    int const h = time_within_day / (60 * 60 * 1000);
-    double const m = Object::NumberValue(*min);
-    time_val =
-        MakeDate(day, MakeTime(h, m, s.value_or((time_within_day / 1000) % 60),
-                               milli.value_or(time_within_day % 1000)));
-  }
+  if (std::isnan(time_val)) {
+    return ReadOnlyRoots(isolate).nan_value();
+  }
+
+  int64_t const time_ms = static_cast<int64_t>(time_val);
+  int64_t const local_time_ms = isolate->date_cache()->ToLocal(time_ms);
+  int const day = isolate->date_cache()->DaysFromTime(local_time_ms);
+  int const time_within_day =
+      isolate->date_cache()->TimeInDay(local_time_ms, day);
+  int const h = time_within_day / (60 * 60 * 1000);
+  double const m = Object::NumberValue(*min);
+  time_val =
+      MakeDate(day, MakeTime(h, m, s.value_or((time_within_day / 1000) % 60),
+                             milli.value_or(time_within_day % 1000)));
   return SetLocalDateValue(isolate, date, time_val);
 }
 
@@ -397,9 +405,9 @@ BUILTIN(DatePrototypeSetMonth) {
   CHECK_RECEIVER(JSDate, this_date, "Date.prototype.setMonth");
   int const argc = args.length() - 1;
   DirectHandle<Object> month = args.atOrUndefined(isolate, 1);
+  double time_val = this_date->value();
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, month,
                                      Object::ToNumber(isolate, month));
-  double time_val = this_date->value();
   std::optional<double> dt;
 
   if (argc >= 2) {
@@ -409,17 +417,20 @@ BUILTIN(DatePrototypeSetMonth) {
     dt = Object::NumberValue(*date);
   }
 
-  if (!std::isnan(time_val)) {
-    int64_t const time_ms = static_cast<int64_t>(time_val);
-    int64_t const local_time_ms = isolate->date_cache()->ToLocal(time_ms);
-    int const days = isolate->date_cache()->DaysFromTime(local_time_ms);
-    int const time_within_day =
-        isolate->date_cache()->TimeInDay(local_time_ms, days);
-    int year, unused, day;
-    isolate->date_cache()->YearMonthDayFromDays(days, &year, &unused, &day);
-    double const m = Object::NumberValue(*month);
-    time_val = MakeDate(MakeDay(year, m, dt.value_or(day)), time_within_day);
+  if (std::isnan(time_val)) {
+    return ReadOnlyRoots(isolate).nan_value();
   }
+
+  int64_t const time_ms = static_cast<int64_t>(time_val);
+  int64_t const local_time_ms = isolate->date_cache()->ToLocal(time_ms);
+  int const days = isolate->date_cache()->DaysFromTime(local_time_ms);
+  int const time_within_day =
+      isolate->date_cache()->TimeInDay(local_time_ms, days);
+  int year, unused, day;
+  isolate->date_cache()->YearMonthDayFromDays(days, &year, &unused, &day);
+  double const m = Object::NumberValue(*month);
+  time_val = MakeDate(MakeDay(year, m, dt.value_or(day)), time_within_day);
+
   return SetLocalDateValue(isolate, this_date, time_val);
 }
 
@@ -429,9 +440,9 @@ BUILTIN(DatePrototypeSetSeconds) {
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setSeconds");
   int const argc = args.length() - 1;
   DirectHandle<Object> sec = args.atOrUndefined(isolate, 1);
+  double time_val = date->value();
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, sec,
                                      Object::ToNumber(isolate, sec));
-  double time_val = date->value();
   std::optional<double> milli;
 
   if (argc >= 2) {
@@ -441,18 +452,20 @@ BUILTIN(DatePrototypeSetSeconds) {
     milli = Object::NumberValue(*ms);
   }
 
-  if (!std::isnan(time_val)) {
-    int64_t const time_ms = static_cast<int64_t>(time_val);
-    int64_t const local_time_ms = isolate->date_cache()->ToLocal(time_ms);
-    int const day = isolate->date_cache()->DaysFromTime(local_time_ms);
-    int const time_within_day =
-        isolate->date_cache()->TimeInDay(local_time_ms, day);
-    int const h = time_within_day / (60 * 60 * 1000);
-    double const m = (time_within_day / (60 * 1000)) % 60;
-    double const s = Object::NumberValue(*sec);
-    time_val = MakeDate(
-        day, MakeTime(h, m, s, milli.value_or(time_within_day % 1000)));
-  }
+  if (std::isnan(time_val)) {
+    return ReadOnlyRoots(isolate).nan_value();
+  }
+
+  int64_t const time_ms = static_cast<int64_t>(time_val);
+  int64_t const local_time_ms = isolate->date_cache()->ToLocal(time_ms);
+  int const day = isolate->date_cache()->DaysFromTime(local_time_ms);
+  int const time_within_day =
+      isolate->date_cache()->TimeInDay(local_time_ms, day);
+  int const h = time_within_day / (60 * 60 * 1000);
+  double const m = (time_within_day / (60 * 1000)) % 60;
+  double const s = Object::NumberValue(*sec);
+  time_val =
+      MakeDate(day, MakeTime(h, m, s, milli.value_or(time_within_day % 1000)));
   return SetLocalDateValue(isolate, date, time_val);
 }
 
@@ -488,16 +501,20 @@ BUILTIN(DatePrototypeSetUTCDate) {
   HandleScope scope(isolate);
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setUTCDate");
   DirectHandle<Object> value = args.atOrUndefined(isolate, 1);
+  double time_val = date->value();
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, value,
                                      Object::ToNumber(isolate, value));
-  if (std::isnan(date->value())) return ReadOnlyRoots(isolate).nan_value();
-  int64_t const time_ms = static_cast<int64_t>(date->value());
+  if (std::isnan(time_val)) {
+    return ReadOnlyRoots(isolate).nan_value();
+  }
+
+  int64_t const time_ms = static_cast<int64_t>(time_val);
   int const days = isolate->date_cache()->DaysFromTime(time_ms);
   int const time_within_day = isolate->date_cache()->TimeInDay(time_ms, days);
   int year, month, day;
   isolate->date_cache()->YearMonthDayFromDays(days, &year, &month, &day);
-  double const time_val = MakeDate(
-      MakeDay(year, month, Object::NumberValue(*value)), time_within_day);
+  time_val = MakeDate(MakeDay(year, month, Object::NumberValue(*value)),
+                      time_within_day);
   return SetDateValue(isolate, date, time_val);
 }
 
@@ -545,6 +562,7 @@ BUILTIN(DatePrototypeSetUTCHours) {
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setUTCHours");
   int const argc = args.length() - 1;
   DirectHandle<Object> hour = args.atOrUndefined(isolate, 1);
+  double time_val = date->value();
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, hour,
                                      Object::ToNumber(isolate, hour));
   double const h = Object::NumberValue(*hour);
@@ -571,16 +589,17 @@ BUILTIN(DatePrototypeSetUTCHours) {
     }
   }
 
-  double time_val = date->value();
-  if (!std::isnan(time_val)) {
-    int64_t const time_ms = static_cast<int64_t>(time_val);
-    int const day = isolate->date_cache()->DaysFromTime(time_ms);
-    int const time_within_day = isolate->date_cache()->TimeInDay(time_ms, day);
-    time_val = MakeDate(
-        day, MakeTime(h, m.value_or((time_within_day / (60 * 1000)) % 60),
-                      s.value_or((time_within_day / 1000) % 60),
-                      milli.value_or(time_within_day % 1000)));
+  if (std::isnan(time_val)) {
+    return ReadOnlyRoots(isolate).nan_value();
   }
+
+  int64_t const time_ms = static_cast<int64_t>(time_val);
+  int const day = isolate->date_cache()->DaysFromTime(time_ms);
+  int const time_within_day = isolate->date_cache()->TimeInDay(time_ms, day);
+  time_val = MakeDate(
+      day, MakeTime(h, m.value_or((time_within_day / (60 * 1000)) % 60),
+                    s.value_or((time_within_day / 1000) % 60),
+                    milli.value_or(time_within_day % 1000)));
   return SetDateValue(isolate, date, time_val);
 }
 
@@ -589,18 +608,21 @@ BUILTIN(DatePrototypeSetUTCMilliseconds) {
   HandleScope scope(isolate);
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setUTCMilliseconds");
   DirectHandle<Object> ms = args.atOrUndefined(isolate, 1);
+  double time_val = date->value();
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, ms,
                                      Object::ToNumber(isolate, ms));
-  double time_val = date->value();
-  if (!std::isnan(time_val)) {
-    int64_t const time_ms = static_cast<int64_t>(time_val);
-    int const day = isolate->date_cache()->DaysFromTime(time_ms);
-    int const time_within_day = isolate->date_cache()->TimeInDay(time_ms, day);
-    int const h = time_within_day / (60 * 60 * 1000);
-    int const m = (time_within_day / (60 * 1000)) % 60;
-    int const s = (time_within_day / 1000) % 60;
-    time_val = MakeDate(day, MakeTime(h, m, s, Object::NumberValue(*ms)));
+  if (std::isnan(time_val)) {
+    return ReadOnlyRoots(isolate).nan_value();
   }
+
+  int64_t const time_ms = static_cast<int64_t>(time_val);
+  int const day = isolate->date_cache()->DaysFromTime(time_ms);
+  int const time_within_day = isolate->date_cache()->TimeInDay(time_ms, day);
+  int const h = time_within_day / (60 * 60 * 1000);
+  int const m = (time_within_day / (60 * 1000)) % 60;
+  int const s = (time_within_day / 1000) % 60;
+  time_val = MakeDate(day, MakeTime(h, m, s, Object::NumberValue(*ms)));
+
   return SetDateValue(isolate, date, time_val);
 }
 
@@ -610,9 +632,9 @@ BUILTIN(DatePrototypeSetUTCMinutes) {
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setUTCMinutes");
   int const argc = args.length() - 1;
   DirectHandle<Object> min = args.atOrUndefined(isolate, 1);
+  double time_val = date->value();
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, min,
                                      Object::ToNumber(isolate, min));
-  double time_val = date->value();
   std::optional<double> s;
   std::optional<double> milli;
 
@@ -629,16 +651,18 @@ BUILTIN(DatePrototypeSetUTCMinutes) {
     }
   }
 
-  if (!std::isnan(time_val)) {
-    int64_t const time_ms = static_cast<int64_t>(time_val);
-    int const day = isolate->date_cache()->DaysFromTime(time_ms);
-    int const time_within_day = isolate->date_cache()->TimeInDay(time_ms, day);
-    int const h = time_within_day / (60 * 60 * 1000);
-    double const m = Object::NumberValue(*min);
-    time_val =
-        MakeDate(day, MakeTime(h, m, s.value_or((time_within_day / 1000) % 60),
-                               milli.value_or(time_within_day % 1000)));
+  if (std::isnan(time_val)) {
+    return ReadOnlyRoots(isolate).nan_value();
   }
+
+  int64_t const time_ms = static_cast<int64_t>(time_val);
+  int const day = isolate->date_cache()->DaysFromTime(time_ms);
+  int const time_within_day = isolate->date_cache()->TimeInDay(time_ms, day);
+  int const h = time_within_day / (60 * 60 * 1000);
+  double const m = Object::NumberValue(*min);
+  time_val =
+      MakeDate(day, MakeTime(h, m, s.value_or((time_within_day / 1000) % 60),
+                             milli.value_or(time_within_day % 1000)));
   return SetDateValue(isolate, date, time_val);
 }
 
@@ -648,9 +672,9 @@ BUILTIN(DatePrototypeSetUTCMonth) {
   CHECK_RECEIVER(JSDate, this_date, "Date.prototype.setUTCMonth");
   int const argc = args.length() - 1;
   DirectHandle<Object> month = args.atOrUndefined(isolate, 1);
+  double time_val = this_date->value();
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, month,
                                      Object::ToNumber(isolate, month));
-  double time_val = this_date->value();
   std::optional<double> dt;
   if (argc >= 2) {
     DirectHandle<Object> date = args.at(2);
@@ -659,15 +683,18 @@ BUILTIN(DatePrototypeSetUTCMonth) {
     dt = Object::NumberValue(*date);
   }
 
-  if (!std::isnan(time_val)) {
-    int64_t const time_ms = static_cast<int64_t>(time_val);
-    int const days = isolate->date_cache()->DaysFromTime(time_ms);
-    int const time_within_day = isolate->date_cache()->TimeInDay(time_ms, days);
-    int year, unused, day;
-    isolate->date_cache()->YearMonthDayFromDays(days, &year, &unused, &day);
-    double const m = Object::NumberValue(*month);
-    time_val = MakeDate(MakeDay(year, m, dt.value_or(day)), time_within_day);
+  if (std::isnan(time_val)) {
+    return ReadOnlyRoots(isolate).nan_value();
   }
+
+  int64_t const time_ms = static_cast<int64_t>(time_val);
+  int const days = isolate->date_cache()->DaysFromTime(time_ms);
+  int const time_within_day = isolate->date_cache()->TimeInDay(time_ms, days);
+  int year, unused, day;
+  isolate->date_cache()->YearMonthDayFromDays(days, &year, &unused, &day);
+  double const m = Object::NumberValue(*month);
+  time_val = MakeDate(MakeDay(year, m, dt.value_or(day)), time_within_day);
+
   return SetDateValue(isolate, this_date, time_val);
 }
 
@@ -677,9 +704,9 @@ BUILTIN(DatePrototypeSetUTCSeconds) {
   CHECK_RECEIVER(JSDate, date, "Date.prototype.setUTCSeconds");
   int const argc = args.length() - 1;
   DirectHandle<Object> sec = args.atOrUndefined(isolate, 1);
+  double time_val = date->value();
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, sec,
                                      Object::ToNumber(isolate, sec));
-  double time_val = date->value();
   std::optional<double> milli;
   if (argc >= 2) {
     DirectHandle<Object> ms = args.at(2);
@@ -687,16 +714,18 @@ BUILTIN(DatePrototypeSetUTCSeconds) {
                                        Object::ToNumber(isolate, ms));
     milli = Object::NumberValue(*ms);
   }
-  if (!std::isnan(time_val)) {
-    int64_t const time_ms = static_cast<int64_t>(time_val);
-    int const day = isolate->date_cache()->DaysFromTime(time_ms);
-    int const time_within_day = isolate->date_cache()->TimeInDay(time_ms, day);
-    int const h = time_within_day / (60 * 60 * 1000);
-    double const m = (time_within_day / (60 * 1000)) % 60;
-    double const s = Object::NumberValue(*sec);
-    time_val = MakeDate(
-        day, MakeTime(h, m, s, milli.value_or(time_within_day % 1000)));
+  if (std::isnan(time_val)) {
+    return ReadOnlyRoots(isolate).nan_value();
   }
+
+  int64_t const time_ms = static_cast<int64_t>(time_val);
+  int const day = isolate->date_cache()->DaysFromTime(time_ms);
+  int const time_within_day = isolate->date_cache()->TimeInDay(time_ms, day);
+  int const h = time_within_day / (60 * 60 * 1000);
+  double const m = (time_within_day / (60 * 1000)) % 60;
+  double const s = Object::NumberValue(*sec);
+  time_val =
+      MakeDate(day, MakeTime(h, m, s, milli.value_or(time_within_day % 1000)));
   return SetDateValue(isolate, date, time_val);
 }
 
diff --git a/deps/v8/src/builtins/builtins-definitions.h b/deps/v8/src/builtins/builtins-definitions.h
index 3673567e368ed2..9366865fb8f0a6 100644
--- a/deps/v8/src/builtins/builtins-definitions.h
+++ b/deps/v8/src/builtins/builtins-definitions.h
@@ -235,11 +235,13 @@ namespace internal {
   /* String helpers */                                                         \
   IF_TSA(TSC, TFC, StringFromCodePointAt, StringAtAsString)                    \
   TFC(StringEqual, StringEqual)                                                \
+  IF_WASM(TFC, WasmJSStringEqual, StringEqual)                                 \
   TFC(StringGreaterThan, CompareNoContext)                                     \
   TFC(StringGreaterThanOrEqual, CompareNoContext)                              \
   TFC(StringLessThan, CompareNoContext)                                        \
   TFC(StringLessThanOrEqual, CompareNoContext)                                 \
   TFC(StringCompare, CompareNoContext)                                         \
+  IF_WASM(TFC, WasmStringCompare, CompareNoContext)                            \
   TFC(StringSubstring, StringSubstring)                                        \
                                                                                \
   /* OrderedHashTable helpers */                                               \
@@ -325,6 +327,7 @@ namespace internal {
   TFC(AllocateInOldGeneration, Allocate)                                       \
   IF_WASM(TFC, WasmAllocateInYoungGeneration, Allocate)                        \
   IF_WASM(TFC, WasmAllocateInOldGeneration, Allocate)                          \
+  IF_WASM(TFC, WasmAllocateInSharedHeap, Allocate)                             \
                                                                                \
   TFC(NewHeapNumber, NewHeapNumber)                                            \
                                                                                \
@@ -777,14 +780,14 @@ namespace internal {
   TFH(DefineKeyedOwnICBaseline, DefineKeyedOwnBaseline)                        \
   TFH(StoreInArrayLiteralIC, StoreWithVector)                                  \
   TFH(StoreInArrayLiteralICBaseline, StoreBaseline)                            \
+  TFH(LookupContextNoCellTrampoline, LookupTrampoline)                         \
   TFH(LookupContextTrampoline, LookupTrampoline)                               \
-  TFH(LookupScriptContextTrampoline, LookupTrampoline)                         \
-  TFH(LookupContextBaseline, LookupBaseline)                                   \
+  TFH(LookupContextNoCellBaseline, LookupBaseline)                             \
   TFH(LookupScriptContextBaseline, LookupBaseline)                             \
+  TFH(LookupContextNoCellInsideTypeofTrampoline, LookupTrampoline)             \
   TFH(LookupContextInsideTypeofTrampoline, LookupTrampoline)                   \
-  TFH(LookupScriptContextInsideTypeofTrampoline, LookupTrampoline)             \
+  TFH(LookupContextNoCellInsideTypeofBaseline, LookupBaseline)                 \
   TFH(LookupContextInsideTypeofBaseline, LookupBaseline)                       \
-  TFH(LookupScriptContextInsideTypeofBaseline, LookupBaseline)                 \
   TFH(LoadGlobalIC, LoadGlobalWithVector)                                      \
   TFH(LoadGlobalICInsideTypeof, LoadGlobalWithVector)                          \
   TFH(LoadGlobalICTrampoline, LoadGlobal)                                      \
@@ -803,6 +806,10 @@ namespace internal {
   TFH(KeyedHasIC, KeyedHasICWithVector)                                        \
   TFH(KeyedHasICBaseline, KeyedHasICBaseline)                                  \
   TFH(KeyedHasIC_Megamorphic, KeyedHasICWithVector)                            \
+  TFH(AddLhsIsStringConstantInternalizeWithVector,                             \
+      AddLhsIsStringConstantInternalizeWithVector)                             \
+  TFH(AddLhsIsStringConstantInternalizeTrampoline,                             \
+      AddLhsIsStringConstantInternalizeTrampoline)                             \
                                                                                \
   /* IterableToList */                                                         \
   /* ES #sec-iterabletolist */                                                 \
@@ -888,6 +895,11 @@ namespace internal {
   TFC(ShiftRight_WithFeedback, BinaryOp_WithFeedback)                          \
   TFC(ShiftRightLogical_WithFeedback, BinaryOp_WithFeedback)                   \
                                                                                \
+  /* Like Add_WithFeedback, but lhs is a known constant and the result is */   \
+  /* used as a property key and thus should be internalized early.        */   \
+  TFC(Add_LhsIsStringConstant_Internalize_WithFeedback, BinaryOp_WithFeedback) \
+  TFC(Add_LhsIsStringConstant_Internalize_Baseline, BinaryOp_Baseline)         \
+                                                                               \
   /* Compare ops with feedback collection */                                   \
   TFC(Equal_Baseline, Compare_Baseline)                                        \
   TFC(StrictEqual_Baseline, Compare_Baseline)                                  \
@@ -1107,8 +1119,12 @@ namespace internal {
   TFJ(TypedArrayPrototypeMap, kDontAdaptArgumentsSentinel)                     \
   /* proposal-arraybuffer-base64 #sec-uint8array.frombase64 */                 \
   CPP(Uint8ArrayFromBase64, kDontAdaptArgumentsSentinel)                       \
+  /* proposal-arraybuffer-base64 #sec-uint8array.prototype.setfrombase64 */    \
+  CPP(Uint8ArrayPrototypeSetFromBase64, kDontAdaptArgumentsSentinel)           \
   /* proposal-arraybuffer-base64 #sec-uint8array.fromhex */                    \
   CPP(Uint8ArrayFromHex, kDontAdaptArgumentsSentinel)                          \
+  /* proposal-arraybuffer-base64 #sec-uint8array.prototype.setfromhex */       \
+  CPP(Uint8ArrayPrototypeSetFromHex, kDontAdaptArgumentsSentinel)              \
   /* proposal-arraybuffer-base64 #sec-uint8array.prototype.tobase64 */         \
   CPP(Uint8ArrayPrototypeToBase64, kDontAdaptArgumentsSentinel)                \
   /* proposal-arraybuffer-base64 #sec-uint8array.prototype.tohex */            \
@@ -1451,6 +1467,7 @@ namespace internal {
                                                                                \
   /* String helpers */                                                         \
   TFS(StringAdd_CheckNone, NeedsContext::kYes, kLeft, kRight)                  \
+  IF_WASM(TFS, WasmStringAdd_CheckNone, NeedsContext::kYes, kLeft, kRight)     \
   TFS(SubString, NeedsContext::kYes, kString, kFrom, kTo)                      \
                                                                                \
   /* Miscellaneous */                                                          \
@@ -2292,6 +2309,7 @@ namespace internal {
   /* ES #sec-string.prototype.touppercase */                                   \
   CPP(StringPrototypeToUpperCaseIntl, kDontAdaptArgumentsSentinel)             \
   TFS(StringToLowerCaseIntl, NeedsContext::kYes, kString)                      \
+  IF_WASM(TFS, WasmStringToLowerCaseIntl, NeedsContext::kYes, kString)         \
                                                                                \
   /* Temporal */                                                               \
   /* Temporal #sec-temporal.calendar.prototype.era */                          \
diff --git a/deps/v8/src/builtins/builtins-disposable-stack.cc b/deps/v8/src/builtins/builtins-disposable-stack.cc
index 72a99b5229c24e..a81f4c9db9185b 100644
--- a/deps/v8/src/builtins/builtins-disposable-stack.cc
+++ b/deps/v8/src/builtins/builtins-disposable-stack.cc
@@ -241,7 +241,7 @@ BUILTIN(DisposableStackPrototypeMove) {
   // 5. Set newDisposableStack.[[DisposableState]] to pending.
 
   Tagged<JSFunction> constructor_function =
-      Cast<JSFunction>(isolate->native_context()->get(
+      Cast<JSFunction>(isolate->native_context()->GetNoCell(
           Context::JS_DISPOSABLE_STACK_FUNCTION_INDEX));
   DirectHandle<Map> map(constructor_function->initial_map(), isolate);
 
diff --git a/deps/v8/src/builtins/builtins-error.cc b/deps/v8/src/builtins/builtins-error.cc
index 9ddd1f10b09937..6f4d6169899730 100644
--- a/deps/v8/src/builtins/builtins-error.cc
+++ b/deps/v8/src/builtins/builtins-error.cc
@@ -69,8 +69,8 @@ BUILTIN(ErrorIsError) {
     // DOMExceptions should return true. See
     // https://github.com/whatwg/webidl/pull/1421
     return *isolate->factory()->ToBoolean(
-        InstanceTypeChecker::IsJSError(obj_map) ||
-        (IsJSApiWrapperObject(obj_map) &&
+        IsJSErrorMap(obj_map) ||
+        (IsJSApiWrapperObjectMap(obj_map) &&
          isolate->IsJSApiWrapperNativeError(Cast<JSReceiver>(obj))));
   } else {
     return ReadOnlyRoots(isolate).false_value();
diff --git a/deps/v8/src/builtins/builtins-function.cc b/deps/v8/src/builtins/builtins-function.cc
index b42e3bb1d5aebe..a34393bf3cd7ac 100644
--- a/deps/v8/src/builtins/builtins-function.cc
+++ b/deps/v8/src/builtins/builtins-function.cc
@@ -86,7 +86,7 @@ MaybeDirectHandle<Object> CreateDynamicFunction(Isolate* isolate,
     ASSIGN_RETURN_ON_EXCEPTION(
         isolate, function,
         Compiler::GetFunctionFromString(
-            direct_handle(target->native_context(), isolate),
+            isolate, direct_handle(target->native_context(), isolate),
             indirect_handle(source, isolate), parameters_end_pos,
             is_code_like));
     DirectHandle<Object> result;
@@ -255,10 +255,10 @@ BUILTIN(FunctionPrototypeToString) {
   HandleScope scope(isolate);
   DirectHandle<Object> receiver = args.receiver();
   if (IsJSBoundFunction(*receiver)) {
-    return *JSBoundFunction::ToString(Cast<JSBoundFunction>(receiver));
+    return *JSBoundFunction::ToString(isolate, Cast<JSBoundFunction>(receiver));
   }
   if (IsJSFunction(*receiver)) {
-    return *JSFunction::ToString(Cast<JSFunction>(receiver));
+    return *JSFunction::ToString(isolate, Cast<JSFunction>(receiver));
   }
   // With the revised toString behavior, all callable objects are valid
   // receivers for this method.
diff --git a/deps/v8/src/builtins/builtins-global.cc b/deps/v8/src/builtins/builtins-global.cc
index 53ab9e8c043d5e..89be05c0b3ef4a 100644
--- a/deps/v8/src/builtins/builtins-global.cc
+++ b/deps/v8/src/builtins/builtins-global.cc
@@ -105,7 +105,7 @@ BUILTIN(GlobalEval) {
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, function,
       Compiler::GetFunctionFromValidatedString(
-          direct_handle(target->native_context(), isolate), source,
+          isolate, direct_handle(target->native_context(), isolate), source,
           NO_PARSE_RESTRICTION, kNoSourcePosition));
   RETURN_RESULT_OR_FAILURE(
       isolate, Execution::Call(isolate, function, target_global_proxy, {}));
diff --git a/deps/v8/src/builtins/builtins-ic-gen.cc b/deps/v8/src/builtins/builtins-ic-gen.cc
index cb63ddc22de44d..0db6d30418b505 100644
--- a/deps/v8/src/builtins/builtins-ic-gen.cc
+++ b/deps/v8/src/builtins/builtins-ic-gen.cc
@@ -290,60 +290,60 @@ void Builtins::Generate_LookupGlobalICInsideTypeofBaseline(
   assembler.GenerateLookupGlobalICBaseline(TypeofMode::kInside);
 }
 
-void Builtins::Generate_LookupContextTrampoline(
+void Builtins::Generate_LookupContextNoCellTrampoline(
     compiler::CodeAssemblerState* state) {
   AccessorAssembler assembler(state);
   assembler.GenerateLookupContextTrampoline(TypeofMode::kNotInside,
-                                            ContextKind::kDefault);
+                                            ContextMode::kNoContextCells);
 }
 
-void Builtins::Generate_LookupScriptContextTrampoline(
+void Builtins::Generate_LookupContextTrampoline(
     compiler::CodeAssemblerState* state) {
   AccessorAssembler assembler(state);
   assembler.GenerateLookupContextTrampoline(TypeofMode::kNotInside,
-                                            ContextKind::kScriptContext);
+                                            ContextMode::kHasContextCells);
 }
 
-void Builtins::Generate_LookupContextBaseline(
+void Builtins::Generate_LookupContextNoCellBaseline(
     compiler::CodeAssemblerState* state) {
   AccessorAssembler assembler(state);
   assembler.GenerateLookupContextBaseline(TypeofMode::kNotInside,
-                                          ContextKind::kDefault);
+                                          ContextMode::kNoContextCells);
 }
 
 void Builtins::Generate_LookupScriptContextBaseline(
     compiler::CodeAssemblerState* state) {
   AccessorAssembler assembler(state);
   assembler.GenerateLookupContextBaseline(TypeofMode::kNotInside,
-                                          ContextKind::kScriptContext);
+                                          ContextMode::kHasContextCells);
 }
 
-void Builtins::Generate_LookupContextInsideTypeofTrampoline(
+void Builtins::Generate_LookupContextNoCellInsideTypeofTrampoline(
     compiler::CodeAssemblerState* state) {
   AccessorAssembler assembler(state);
   assembler.GenerateLookupContextTrampoline(TypeofMode::kInside,
-                                            ContextKind::kDefault);
+                                            ContextMode::kNoContextCells);
 }
 
-void Builtins::Generate_LookupScriptContextInsideTypeofTrampoline(
+void Builtins::Generate_LookupContextInsideTypeofTrampoline(
     compiler::CodeAssemblerState* state) {
   AccessorAssembler assembler(state);
   assembler.GenerateLookupContextTrampoline(TypeofMode::kInside,
-                                            ContextKind::kScriptContext);
+                                            ContextMode::kHasContextCells);
 }
 
-void Builtins::Generate_LookupContextInsideTypeofBaseline(
+void Builtins::Generate_LookupContextNoCellInsideTypeofBaseline(
     compiler::CodeAssemblerState* state) {
   AccessorAssembler assembler(state);
   assembler.GenerateLookupContextBaseline(TypeofMode::kInside,
-                                          ContextKind::kDefault);
+                                          ContextMode::kNoContextCells);
 }
 
-void Builtins::Generate_LookupScriptContextInsideTypeofBaseline(
+void Builtins::Generate_LookupContextInsideTypeofBaseline(
     compiler::CodeAssemblerState* state) {
   AccessorAssembler assembler(state);
   assembler.GenerateLookupContextBaseline(TypeofMode::kInside,
-                                          ContextKind::kScriptContext);
+                                          ContextMode::kHasContextCells);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/builtins/builtins-internal-gen.cc b/deps/v8/src/builtins/builtins-internal-gen.cc
index 413b5e74adaf4c..5a90786cf9d661 100644
--- a/deps/v8/src/builtins/builtins-internal-gen.cc
+++ b/deps/v8/src/builtins/builtins-internal-gen.cc
@@ -984,8 +984,8 @@ class SetOrCopyDataPropertiesAssembler : public CodeStubAssembler {
  protected:
   TNode<JSObject> AllocateJsObjectTarget(TNode<Context> context) {
     const TNode<NativeContext> native_context = LoadNativeContext(context);
-    const TNode<JSFunction> object_function = Cast(
-        LoadContextElement(native_context, Context::OBJECT_FUNCTION_INDEX));
+    const TNode<JSFunction> object_function = Cast(LoadContextElementNoCell(
+        native_context, Context::OBJECT_FUNCTION_INDEX));
     const TNode<Map> map =
         Cast(LoadJSFunctionPrototypeOrInitialMap(object_function));
     const TNode<JSObject> target = AllocateJSObjectFromMap(map);
@@ -1383,6 +1383,16 @@ TF_BUILTIN(WasmAllocateInOldGeneration, CodeStubAssembler) {
   TailCallRuntime(Runtime::kAllocateInOldGeneration, NoContextConstant(),
                   SmiFromIntPtr(requested_size), runtime_flags);
 }
+
+TF_BUILTIN(WasmAllocateInSharedHeap, CodeStubAssembler) {
+  auto requested_size = UncheckedParameter<IntPtrT>(Descriptor::kRequestedSize);
+  CSA_CHECK(this, IsValidPositiveSmi(requested_size));
+
+  TNode<Smi> runtime_flags =
+      SmiConstant(Smi::FromInt(AllocateDoubleAlignFlag::encode(false)));
+  TailCallRuntime(Runtime::kAllocateInSharedHeap, NoContextConstant(),
+                  SmiFromIntPtr(requested_size), runtime_flags);
+}
 #endif
 
 TF_BUILTIN(Abort, CodeStubAssembler) {
diff --git a/deps/v8/src/builtins/builtins-intl-gen.cc b/deps/v8/src/builtins/builtins-intl-gen.cc
index 60bf0d63c1460e..9bac1aad7a7205 100644
--- a/deps/v8/src/builtins/builtins-intl-gen.cc
+++ b/deps/v8/src/builtins/builtins-intl-gen.cc
@@ -88,6 +88,15 @@ TF_BUILTIN(StringToLowerCaseIntl, IntlBuiltinsAssembler) {
                   [this](TNode<Object> ret) { Return(ret); });
 }
 
+#if V8_ENABLE_WEBASSEMBLY
+TF_BUILTIN(WasmStringToLowerCaseIntl, IntlBuiltinsAssembler) {
+  const auto string = Parameter<String>(Descriptor::kString);
+  ToLowerCaseImpl(string, TNode<Object>() /*maybe_locales*/, TNode<Context>(),
+                  ToLowerCaseKind::kToLowerCase,
+                  [this](TNode<Object> ret) { Return(ret); });
+}
+#endif
+
 TF_BUILTIN(StringPrototypeToLowerCaseIntl, IntlBuiltinsAssembler) {
   auto maybe_string = Parameter<Object>(Descriptor::kReceiver);
   auto context = Parameter<Context>(Descriptor::kContext);
diff --git a/deps/v8/src/builtins/builtins-intl.cc b/deps/v8/src/builtins/builtins-intl.cc
index dc2702fa9079b0..da89517eacb709 100644
--- a/deps/v8/src/builtins/builtins-intl.cc
+++ b/deps/v8/src/builtins/builtins-intl.cc
@@ -218,8 +218,9 @@ DirectHandle<JSFunction> CreateBoundFunction(Isolate* isolate,
       native_context,
       static_cast<int>(Intl::BoundFunctionContextSlot::kLength));
 
-  context->set(static_cast<int>(Intl::BoundFunctionContextSlot::kBoundFunction),
-               *object);
+  context->SetNoCell(
+      static_cast<int>(Intl::BoundFunctionContextSlot::kBoundFunction),
+      *object);
 
   DirectHandle<SharedFunctionInfo> info =
       isolate->factory()->NewSharedFunctionInfoForBuiltin(
@@ -520,7 +521,7 @@ BUILTIN(NumberFormatInternalFormatNumber) {
   // 2. Assert: Type(nf) is Object and nf has an
   //    [[InitializedNumberFormat]] internal slot.
   DirectHandle<JSNumberFormat> number_format(
-      Cast<JSNumberFormat>(context->get(
+      Cast<JSNumberFormat>(context->GetNoCell(
           static_cast<int>(Intl::BoundFunctionContextSlot::kBoundFunction))),
       isolate);
 
@@ -626,7 +627,7 @@ BUILTIN(DateTimeFormatInternalFormat) {
   // 2. Assert: Type(dtf) is Object and dtf has an [[InitializedDateTimeFormat]]
   // internal slot.
   DirectHandle<JSDateTimeFormat> date_format_holder(
-      Cast<JSDateTimeFormat>(context->get(
+      Cast<JSDateTimeFormat>(context->GetNoCell(
           static_cast<int>(Intl::BoundFunctionContextSlot::kBoundFunction))),
       isolate);
 
@@ -1187,7 +1188,7 @@ BUILTIN(CollatorInternalCompare) {
   // 2. Assert: Type(collator) is Object and collator has an
   // [[InitializedCollator]] internal slot.
   DirectHandle<JSCollator> collator(
-      Cast<JSCollator>(context->get(
+      Cast<JSCollator>(context->GetNoCell(
           static_cast<int>(Intl::BoundFunctionContextSlot::kBoundFunction))),
       isolate);
 
@@ -1333,7 +1334,7 @@ BUILTIN(V8BreakIteratorInternalAdoptText) {
   DirectHandle<Context> context(isolate->context(), isolate);
 
   DirectHandle<JSV8BreakIterator> break_iterator(
-      Cast<JSV8BreakIterator>(context->get(
+      Cast<JSV8BreakIterator>(context->GetNoCell(
           static_cast<int>(Intl::BoundFunctionContextSlot::kBoundFunction))),
       isolate);
 
@@ -1369,7 +1370,7 @@ BUILTIN(V8BreakIteratorInternalFirst) {
   DirectHandle<Context> context(isolate->context(), isolate);
 
   DirectHandle<JSV8BreakIterator> break_iterator(
-      Cast<JSV8BreakIterator>(context->get(
+      Cast<JSV8BreakIterator>(context->GetNoCell(
           static_cast<int>(Intl::BoundFunctionContextSlot::kBoundFunction))),
       isolate);
 
@@ -1399,7 +1400,7 @@ BUILTIN(V8BreakIteratorInternalNext) {
   DirectHandle<Context> context(isolate->context(), isolate);
 
   DirectHandle<JSV8BreakIterator> break_iterator(
-      Cast<JSV8BreakIterator>(context->get(
+      Cast<JSV8BreakIterator>(context->GetNoCell(
           static_cast<int>(Intl::BoundFunctionContextSlot::kBoundFunction))),
       isolate);
   return *JSV8BreakIterator::Next(isolate, break_iterator);
@@ -1428,7 +1429,7 @@ BUILTIN(V8BreakIteratorInternalCurrent) {
   DirectHandle<Context> context(isolate->context(), isolate);
 
   DirectHandle<JSV8BreakIterator> break_iterator(
-      Cast<JSV8BreakIterator>(context->get(
+      Cast<JSV8BreakIterator>(context->GetNoCell(
           static_cast<int>(Intl::BoundFunctionContextSlot::kBoundFunction))),
       isolate);
   return *JSV8BreakIterator::Current(isolate, break_iterator);
@@ -1459,7 +1460,7 @@ BUILTIN(V8BreakIteratorInternalBreakType) {
   DirectHandle<Context> context(isolate->context(), isolate);
 
   DirectHandle<JSV8BreakIterator> break_iterator(
-      Cast<JSV8BreakIterator>(context->get(
+      Cast<JSV8BreakIterator>(context->GetNoCell(
           static_cast<int>(Intl::BoundFunctionContextSlot::kBoundFunction))),
       isolate);
   return JSV8BreakIterator::BreakType(isolate, break_iterator);
diff --git a/deps/v8/src/builtins/builtins-lazy-gen.cc b/deps/v8/src/builtins/builtins-lazy-gen.cc
index 7ea10997c19e94..75baa8c57f8942 100644
--- a/deps/v8/src/builtins/builtins-lazy-gen.cc
+++ b/deps/v8/src/builtins/builtins-lazy-gen.cc
@@ -122,8 +122,8 @@ void LazyBuiltinsAssembler::CompileLazy(TNode<JSFunction> function) {
   // If feedback cell isn't initialized, compile function
   GotoIf(IsUndefined(feedback_cell_value), &compile_function);
 
-  CSA_DCHECK(this, TaggedNotEqual(sfi_code, HeapConstantNoHole(BUILTIN_CODE(
-                                                isolate(), CompileLazy))));
+  CSA_DCHECK(this, SafeNotEqual(sfi_code, HeapConstantNoHole(BUILTIN_CODE(
+                                              isolate(), CompileLazy))));
   USE(sfi_code);
 #ifndef V8_ENABLE_LEAPTIERING
   // In the leaptiering case, the code is installed below, through the
diff --git a/deps/v8/src/builtins/builtins-number-gen.cc b/deps/v8/src/builtins/builtins-number-gen.cc
index 019a2606e4d349..be41b0b4cc7266 100644
--- a/deps/v8/src/builtins/builtins-number-gen.cc
+++ b/deps/v8/src/builtins/builtins-number-gen.cc
@@ -46,6 +46,8 @@ DEF_BINOP(ShiftLeft_WithFeedback, Generate_ShiftLeftWithFeedback)
 DEF_BINOP(ShiftRight_WithFeedback, Generate_ShiftRightWithFeedback)
 DEF_BINOP(ShiftRightLogical_WithFeedback,
           Generate_ShiftRightLogicalWithFeedback)
+DEF_BINOP(Add_LhsIsStringConstant_Internalize_WithFeedback,
+          Generate_AddLhsIsStringConstantInternalizeWithFeedback)
 #undef DEF_BINOP
 
 #define DEF_BINOP(Name, Generator)                                   \
@@ -74,6 +76,8 @@ DEF_BINOP(BitwiseAnd_Baseline, Generate_BitwiseAndWithFeedback)
 DEF_BINOP(ShiftLeft_Baseline, Generate_ShiftLeftWithFeedback)
 DEF_BINOP(ShiftRight_Baseline, Generate_ShiftRightWithFeedback)
 DEF_BINOP(ShiftRightLogical_Baseline, Generate_ShiftRightLogicalWithFeedback)
+DEF_BINOP(Add_LhsIsStringConstant_Internalize_Baseline,
+          Generate_AddLhsIsStringConstantInternalizeWithFeedback)
 #undef DEF_BINOP
 
 #define DEF_BINOP_RHS_SMI(Name, Generator)                           \
@@ -217,6 +221,35 @@ DEF_COMPARE(GreaterThan)
 DEF_COMPARE(GreaterThanOrEqual)
 #undef DEF_COMPARE
 
+TF_BUILTIN(AddLhsIsStringConstantInternalizeWithVector, CodeStubAssembler) {
+  auto left = Parameter<String>(Descriptor::kLeft);
+  auto right = Parameter<Object>(Descriptor::kRight);
+  auto slot = Parameter<Smi>(Descriptor::kSlot);
+  auto vector = Parameter<HeapObject>(Descriptor::kVector);
+  TNode<Context> context = Parameter<Context>(Descriptor::kContext);
+  BinaryOpAssembler binop_asm(state());
+  TNode<Object> result =
+      binop_asm.Generate_AddLhsIsStringConstantInternalizeWithFeedback(
+          [&]() { return context; }, left, right, Unsigned(SmiUntag(slot)),
+          [&]() { return vector; }, UpdateFeedbackMode::kGuaranteedFeedback,
+          false);
+  Return(result);
+}
+
+TF_BUILTIN(AddLhsIsStringConstantInternalizeTrampoline, CodeStubAssembler) {
+  auto left = Parameter<String>(Descriptor::kLeft);
+  auto right = Parameter<Object>(Descriptor::kRight);
+  auto slot = Parameter<Smi>(Descriptor::kSlot);
+  TNode<Context> context = Parameter<Context>(Descriptor::kContext);
+  BinaryOpAssembler binop_asm(state());
+  TNode<Object> result =
+      binop_asm.Generate_AddLhsIsStringConstantInternalizeWithFeedback(
+          [&]() { return context; }, left, right, Unsigned(SmiUntag(slot)),
+          [&]() { return LoadFeedbackVectorForStub(); },
+          UpdateFeedbackMode::kGuaranteedFeedback, false);
+  Return(result);
+}
+
 TF_BUILTIN(Equal_WithFeedback, CodeStubAssembler) {
   auto lhs = Parameter<Object>(Descriptor::kLeft);
   auto rhs = Parameter<Object>(Descriptor::kRight);
diff --git a/deps/v8/src/builtins/builtins-object-gen.cc b/deps/v8/src/builtins/builtins-object-gen.cc
index 465dc20fee4b32..e25a089b6b4146 100644
--- a/deps/v8/src/builtins/builtins-object-gen.cc
+++ b/deps/v8/src/builtins/builtins-object-gen.cc
@@ -73,7 +73,7 @@ TNode<JSObject> ObjectBuiltinsAssembler::ConstructAccessorDescriptor(
     TNode<Context> context, TNode<Object> getter, TNode<Object> setter,
     TNode<BoolT> enumerable, TNode<BoolT> configurable) {
   TNode<NativeContext> native_context = LoadNativeContext(context);
-  TNode<Map> map = CAST(LoadContextElement(
+  TNode<Map> map = CAST(LoadContextElementNoCell(
       native_context, Context::ACCESSOR_PROPERTY_DESCRIPTOR_MAP_INDEX));
   TNode<JSObject> js_desc = AllocateJSObjectFromMap(map);
 
@@ -95,7 +95,7 @@ TNode<JSObject> ObjectBuiltinsAssembler::ConstructDataDescriptor(
     TNode<Context> context, TNode<Object> value, TNode<BoolT> writable,
     TNode<BoolT> enumerable, TNode<BoolT> configurable) {
   TNode<NativeContext> native_context = LoadNativeContext(context);
-  TNode<Map> map = CAST(LoadContextElement(
+  TNode<Map> map = CAST(LoadContextElementNoCell(
       native_context, Context::DATA_PROPERTY_DESCRIPTOR_MAP_INDEX));
   TNode<JSObject> js_desc = AllocateJSObjectFromMap(map);
 
@@ -979,8 +979,8 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
   BIND(&if_boolean);
   {
     TNode<NativeContext> native_context = LoadNativeContext(context);
-    TNode<JSFunction> boolean_constructor = CAST(
-        LoadContextElement(native_context, Context::BOOLEAN_FUNCTION_INDEX));
+    TNode<JSFunction> boolean_constructor = CAST(LoadContextElementNoCell(
+        native_context, Context::BOOLEAN_FUNCTION_INDEX));
     TNode<Map> boolean_initial_map = LoadObjectField<Map>(
         boolean_constructor, JSFunction::kPrototypeOrInitialMapOffset);
     TNode<JSPrototype> boolean_prototype =
@@ -1012,8 +1012,8 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
   BIND(&if_number);
   {
     TNode<NativeContext> native_context = LoadNativeContext(context);
-    TNode<JSFunction> number_constructor = CAST(
-        LoadContextElement(native_context, Context::NUMBER_FUNCTION_INDEX));
+    TNode<JSFunction> number_constructor = CAST(LoadContextElementNoCell(
+        native_context, Context::NUMBER_FUNCTION_INDEX));
     TNode<Map> number_initial_map = LoadObjectField<Map>(
         number_constructor, JSFunction::kPrototypeOrInitialMapOffset);
     TNode<JSPrototype> number_prototype = LoadMapPrototype(number_initial_map);
@@ -1056,8 +1056,8 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
   BIND(&if_string);
   {
     TNode<NativeContext> native_context = LoadNativeContext(context);
-    TNode<JSFunction> string_constructor = CAST(
-        LoadContextElement(native_context, Context::STRING_FUNCTION_INDEX));
+    TNode<JSFunction> string_constructor = CAST(LoadContextElementNoCell(
+        native_context, Context::STRING_FUNCTION_INDEX));
     TNode<Map> string_initial_map = LoadObjectField<Map>(
         string_constructor, JSFunction::kPrototypeOrInitialMapOffset);
     TNode<JSPrototype> string_prototype = LoadMapPrototype(string_initial_map);
@@ -1070,8 +1070,8 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
   BIND(&if_symbol);
   {
     TNode<NativeContext> native_context = LoadNativeContext(context);
-    TNode<JSFunction> symbol_constructor = CAST(
-        LoadContextElement(native_context, Context::SYMBOL_FUNCTION_INDEX));
+    TNode<JSFunction> symbol_constructor = CAST(LoadContextElementNoCell(
+        native_context, Context::SYMBOL_FUNCTION_INDEX));
     TNode<Map> symbol_initial_map = LoadObjectField<Map>(
         symbol_constructor, JSFunction::kPrototypeOrInitialMapOffset);
     TNode<JSPrototype> symbol_prototype = LoadMapPrototype(symbol_initial_map);
@@ -1084,8 +1084,8 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
   BIND(&if_bigint);
   {
     TNode<NativeContext> native_context = LoadNativeContext(context);
-    TNode<JSFunction> bigint_constructor = CAST(
-        LoadContextElement(native_context, Context::BIGINT_FUNCTION_INDEX));
+    TNode<JSFunction> bigint_constructor = CAST(LoadContextElementNoCell(
+        native_context, Context::BIGINT_FUNCTION_INDEX));
     TNode<Map> bigint_initial_map = LoadObjectField<Map>(
         bigint_constructor, JSFunction::kPrototypeOrInitialMapOffset);
     TNode<JSPrototype> bigint_prototype = LoadMapPrototype(bigint_initial_map);
@@ -1336,8 +1336,8 @@ TF_BUILTIN(CreateIterResultObject, ObjectBuiltinsAssembler) {
   const auto context = Parameter<Context>(Descriptor::kContext);
 
   const TNode<NativeContext> native_context = LoadNativeContext(context);
-  const TNode<Map> map = CAST(
-      LoadContextElement(native_context, Context::ITERATOR_RESULT_MAP_INDEX));
+  const TNode<Map> map = CAST(LoadContextElementNoCell(
+      native_context, Context::ITERATOR_RESULT_MAP_INDEX));
 
   const TNode<JSObject> result = AllocateJSObjectFromMap(map);
 
@@ -1616,7 +1616,7 @@ TNode<JSObject> ObjectBuiltinsAssembler::FromPropertyDescriptor(
   BIND(&if_generic_desc);
   {
     TNode<NativeContext> native_context = LoadNativeContext(context);
-    TNode<Map> map = CAST(LoadContextElement(
+    TNode<Map> map = CAST(LoadContextElementNoCell(
         native_context, Context::SLOW_OBJECT_WITH_OBJECT_PROTOTYPE_MAP));
     // We want to preallocate the slots for value, writable, get, set,
     // enumerable and configurable - a total of 6
@@ -1701,10 +1701,10 @@ TNode<JSObject> ObjectBuiltinsAssembler::FromPropertyDetails(
   BIND(&if_accessor_desc);
   {
     TNode<AccessorPair> accessor_pair_value = CAST(raw_value);
-    TNode<HeapObject> getter = LoadObjectField<HeapObject>(
-        accessor_pair_value, AccessorPair::kGetterOffset);
-    TNode<HeapObject> setter = LoadObjectField<HeapObject>(
-        accessor_pair_value, AccessorPair::kSetterOffset);
+    TNode<HeapObject> getter =
+        CAST(LoadAccessorPairGetter(accessor_pair_value));
+    TNode<HeapObject> setter =
+        CAST(LoadAccessorPairSetter(accessor_pair_value));
     js_descriptor = ConstructAccessorDescriptor(
         context, GetAccessorOrUndefined(getter, if_bailout),
         GetAccessorOrUndefined(setter, if_bailout),
diff --git a/deps/v8/src/builtins/builtins-object.cc b/deps/v8/src/builtins/builtins-object.cc
index 34b964bd2fa5cc..60a2b40df1d82e 100644
--- a/deps/v8/src/builtins/builtins-object.cc
+++ b/deps/v8/src/builtins/builtins-object.cc
@@ -152,6 +152,7 @@ Tagged<Object> ObjectLookupAccessor(Isolate* isolate,
         return ObjectLookupAccessor(isolate, prototype, key, component);
       }
       case LookupIterator::WASM_OBJECT:
+        continue;  // Continue to the prototype, if present.
       case LookupIterator::TYPED_ARRAY_INDEX_NOT_FOUND:
       case LookupIterator::DATA:
       case LookupIterator::NOT_FOUND:
diff --git a/deps/v8/src/builtins/builtins-proxy-gen.cc b/deps/v8/src/builtins/builtins-proxy-gen.cc
index 65b3953dc86e3f..c025ff8eef8f0f 100644
--- a/deps/v8/src/builtins/builtins-proxy-gen.cc
+++ b/deps/v8/src/builtins/builtins-proxy-gen.cc
@@ -36,19 +36,20 @@ TNode<JSProxy> ProxiesCodeStubAssembler::AllocateProxy(
     // Every object that is a constructor is implicitly callable
     // so it's okay to nest this check here
     GotoIf(IsConstructor(target), &constructor_target);
-    map = CAST(
-        LoadContextElement(nativeContext, Context::PROXY_CALLABLE_MAP_INDEX));
+    map = CAST(LoadContextElementNoCell(nativeContext,
+                                        Context::PROXY_CALLABLE_MAP_INDEX));
     Goto(&create_proxy);
   }
   BIND(&constructor_target);
   {
-    map = CAST(LoadContextElement(nativeContext,
-                                  Context::PROXY_CONSTRUCTOR_MAP_INDEX));
+    map = CAST(LoadContextElementNoCell(nativeContext,
+                                        Context::PROXY_CONSTRUCTOR_MAP_INDEX));
     Goto(&create_proxy);
   }
   BIND(&none_target);
   {
-    map = CAST(LoadContextElement(nativeContext, Context::PROXY_MAP_INDEX));
+    map =
+        CAST(LoadContextElementNoCell(nativeContext, Context::PROXY_MAP_INDEX));
     Goto(&create_proxy);
   }
 
@@ -261,8 +262,7 @@ void ProxiesCodeStubAssembler::CheckGetSetTrapResult(
         Label continue_check(this, Label::kDeferred);
         // 10.b. If IsAccessorDescriptor(targetDesc) is true and
         // targetDesc.[[Get]] is undefined, then:
-        TNode<Object> getter =
-            LoadObjectField(accessor_pair, AccessorPair::kGetterOffset);
+        TNode<Object> getter = LoadAccessorPairGetter(CAST(accessor_pair));
         // Here we check for null as well because if the getter was never
         // defined it's set as null.
         GotoIf(IsUndefined(getter), &continue_check);
@@ -275,8 +275,7 @@ void ProxiesCodeStubAssembler::CheckGetSetTrapResult(
       } else {
         // 11.b.i. If targetDesc.[[Set]] is undefined, throw a TypeError
         // exception.
-        TNode<Object> setter =
-            LoadObjectField(accessor_pair, AccessorPair::kSetterOffset);
+        TNode<Object> setter = LoadAccessorPairSetter(CAST(accessor_pair));
         GotoIf(IsUndefined(setter), &throw_non_configurable_accessor);
         GotoIf(IsNull(setter), &throw_non_configurable_accessor);
       }
diff --git a/deps/v8/src/builtins/builtins-regexp-gen.cc b/deps/v8/src/builtins/builtins-regexp-gen.cc
index 69123f37311446..ccdbcb471cc2e5 100644
--- a/deps/v8/src/builtins/builtins-regexp-gen.cc
+++ b/deps/v8/src/builtins/builtins-regexp-gen.cc
@@ -74,8 +74,8 @@ TNode<JSRegExpResult> RegExpBuiltinsAssembler::AllocateRegExpResult(
 
   GotoIf(has_indices, &result_has_indices, GotoHint::kFallthrough);
   {
-    TNode<Map> map = CAST(LoadContextElement(LoadNativeContext(context),
-                                             Context::REGEXP_RESULT_MAP_INDEX));
+    TNode<Map> map = CAST(LoadContextElementNoCell(
+        LoadNativeContext(context), Context::REGEXP_RESULT_MAP_INDEX));
     std::tie(var_array, var_elements) =
         AllocateUninitializedJSArrayWithElements(
             elements_kind, map, length, no_gc_site, length_intptr,
@@ -85,9 +85,9 @@ TNode<JSRegExpResult> RegExpBuiltinsAssembler::AllocateRegExpResult(
 
   BIND(&result_has_indices);
   {
-    TNode<Map> map =
-        CAST(LoadContextElement(LoadNativeContext(context),
-                                Context::REGEXP_RESULT_WITH_INDICES_MAP_INDEX));
+    TNode<Map> map = CAST(LoadContextElementNoCell(
+        LoadNativeContext(context),
+        Context::REGEXP_RESULT_WITH_INDICES_MAP_INDEX));
     std::tie(var_array, var_elements) =
         AllocateUninitializedJSArrayWithElements(
             elements_kind, map, length, no_gc_site, length_intptr,
@@ -597,8 +597,8 @@ TNode<RegExpMatchInfo> RegExpBuiltinsAssembler::RegExpExecInternal_Single(
 
     CSA_DCHECK(this, IntPtrEqual(num_matches, IntPtrConstant(1)));
     CSA_DCHECK(this, TaggedEqual(context, LoadNativeContext(context)));
-    TNode<RegExpMatchInfo> last_match_info = CAST(
-        LoadContextElement(context, Context::REGEXP_LAST_MATCH_INFO_INDEX));
+    TNode<RegExpMatchInfo> last_match_info = CAST(LoadContextElementNoCell(
+        context, Context::REGEXP_LAST_MATCH_INFO_INDEX));
     var_result = InitializeMatchInfoFromRegisters(
         context, last_match_info, register_count_per_match, string,
         result_offsets_vector);
@@ -922,8 +922,8 @@ TNode<BoolT> RegExpBuiltinsAssembler::IsFastRegExpNoPrototype(
   GotoIfForceSlowPath(&out);
 
   const TNode<NativeContext> native_context = LoadNativeContext(context);
-  const TNode<HeapObject> regexp_fun =
-      CAST(LoadContextElement(native_context, Context::REGEXP_FUNCTION_INDEX));
+  const TNode<HeapObject> regexp_fun = CAST(
+      LoadContextElementNoCell(native_context, Context::REGEXP_FUNCTION_INDEX));
   const TNode<Object> initial_map =
       LoadObjectField(regexp_fun, JSFunction::kPrototypeOrInitialMapOffset);
   const TNode<BoolT> has_initialmap = TaggedEqual(map, initial_map);
@@ -962,8 +962,8 @@ void RegExpBuiltinsAssembler::BranchIfFastRegExp(
          GotoHint::kFallthrough);
 
   TNode<NativeContext> native_context = LoadNativeContext(context);
-  TNode<JSFunction> regexp_fun =
-      CAST(LoadContextElement(native_context, Context::REGEXP_FUNCTION_INDEX));
+  TNode<JSFunction> regexp_fun = CAST(
+      LoadContextElementNoCell(native_context, Context::REGEXP_FUNCTION_INDEX));
   TNode<Map> initial_map = CAST(
       LoadObjectField(regexp_fun, JSFunction::kPrototypeOrInitialMapOffset));
   TNode<BoolT> has_initialmap = TaggedEqual(map, initial_map);
@@ -978,8 +978,8 @@ void RegExpBuiltinsAssembler::BranchIfFastRegExp(
 
   // Verify the prototype.
 
-  TNode<Map> initial_proto_initial_map = CAST(
-      LoadContextElement(native_context, Context::REGEXP_PROTOTYPE_MAP_INDEX));
+  TNode<Map> initial_proto_initial_map = CAST(LoadContextElementNoCell(
+      native_context, Context::REGEXP_PROTOTYPE_MAP_INDEX));
 
   DescriptorIndexNameValue properties_to_check[2];
   int property_count = 0;
@@ -1047,8 +1047,8 @@ void RegExpBuiltinsAssembler::BranchIfRegExpResult(const TNode<Context> context,
   const TNode<Map> map = LoadReceiverMap(object);
 
   const TNode<NativeContext> native_context = LoadNativeContext(context);
-  const TNode<Object> initial_regexp_result_map =
-      LoadContextElement(native_context, Context::REGEXP_RESULT_MAP_INDEX);
+  const TNode<Object> initial_regexp_result_map = LoadContextElementNoCell(
+      native_context, Context::REGEXP_RESULT_MAP_INDEX);
 
   Label maybe_result_with_indices(this);
   Branch(TaggedEqual(map, initial_regexp_result_map), if_isunmodified,
@@ -1058,8 +1058,8 @@ void RegExpBuiltinsAssembler::BranchIfRegExpResult(const TNode<Context> context,
     static_assert(std::is_base_of_v<JSRegExpResult, JSRegExpResultWithIndices>,
                   "JSRegExpResultWithIndices is a subclass of JSRegExpResult");
     const TNode<Object> initial_regexp_result_with_indices_map =
-        LoadContextElement(native_context,
-                           Context::REGEXP_RESULT_WITH_INDICES_MAP_INDEX);
+        LoadContextElementNoCell(native_context,
+                                 Context::REGEXP_RESULT_WITH_INDICES_MAP_INDEX);
     Branch(TaggedEqual(map, initial_regexp_result_with_indices_map),
            if_isunmodified, if_ismodified);
   }
@@ -1325,8 +1325,8 @@ TF_BUILTIN(RegExpConstructor, RegExpBuiltinsAssembler) {
   TVARIABLE(JSAny, var_new_target, new_target);
 
   TNode<NativeContext> native_context = LoadNativeContext(context);
-  TNode<JSFunction> regexp_function =
-      CAST(LoadContextElement(native_context, Context::REGEXP_FUNCTION_INDEX));
+  TNode<JSFunction> regexp_function = CAST(
+      LoadContextElementNoCell(native_context, Context::REGEXP_FUNCTION_INDEX));
 
   TNode<BoolT> pattern_is_regexp = IsRegExp(context, pattern);
 
@@ -1567,7 +1567,7 @@ TNode<Number> RegExpBuiltinsAssembler::AdvanceStringIndex(
 TNode<JSAny> RegExpMatchAllAssembler::CreateRegExpStringIterator(
     TNode<NativeContext> native_context, TNode<JSAny> regexp,
     TNode<String> string, TNode<BoolT> global, TNode<BoolT> full_unicode) {
-  TNode<Map> map = CAST(LoadContextElement(
+  TNode<Map> map = CAST(LoadContextElementNoCell(
       native_context,
       Context::INITIAL_REGEXP_STRING_ITERATOR_PROTOTYPE_MAP_INDEX));
 
@@ -1670,8 +1670,9 @@ TNode<JSArray> RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(
         {
           CSA_DCHECK(this, IntPtrEqual(num_matches, IntPtrConstant(1)));
           CSA_DCHECK(this, TaggedEqual(context, LoadNativeContext(context)));
-          TNode<RegExpMatchInfo> last_match_info = CAST(LoadContextElement(
-              context, Context::REGEXP_LAST_MATCH_INFO_INDEX));
+          TNode<RegExpMatchInfo> last_match_info =
+              CAST(LoadContextElementNoCell(
+                  context, Context::REGEXP_LAST_MATCH_INFO_INDEX));
 
           InitializeMatchInfoFromRegisters(context, last_match_info,
                                            register_count_per_match, string,
@@ -1744,8 +1745,8 @@ TNode<JSArray> RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(
       // makes it hard to tell if we're at the 'last match except for
       // empty-match-at-end-of-string'.
       CSA_DCHECK(this, TaggedEqual(context, LoadNativeContext(context)));
-      TNode<RegExpMatchInfo> match_info = CAST(
-          LoadContextElement(context, Context::REGEXP_LAST_MATCH_INFO_INDEX));
+      TNode<RegExpMatchInfo> match_info = CAST(LoadContextElementNoCell(
+          context, Context::REGEXP_LAST_MATCH_INFO_INDEX));
       match_info = InitializeMatchInfoFromRegisters(
           context, match_info, register_count_per_match, string,
           result_offsets_vector);
@@ -2026,8 +2027,8 @@ TNode<IntPtrT> RegExpBuiltinsAssembler::RegExpExecInternal_Batched(
 
   // Otherwise initialize the last match info and the result JSArray.
   CSA_DCHECK(this, TaggedEqual(context, LoadNativeContext(context)));
-  TNode<RegExpMatchInfo> last_match_info =
-      CAST(LoadContextElement(context, Context::REGEXP_LAST_MATCH_INFO_INDEX));
+  TNode<RegExpMatchInfo> last_match_info = CAST(
+      LoadContextElementNoCell(context, Context::REGEXP_LAST_MATCH_INFO_INDEX));
 
   InitializeMatchInfoFromRegisters(context, last_match_info,
                                    register_count_per_match, subject,
diff --git a/deps/v8/src/builtins/builtins-shadow-realm-gen.cc b/deps/v8/src/builtins/builtins-shadow-realm-gen.cc
index 8ebca4d8cd15e1..87386b36cb3f5d 100644
--- a/deps/v8/src/builtins/builtins-shadow-realm-gen.cc
+++ b/deps/v8/src/builtins/builtins-shadow-realm-gen.cc
@@ -48,8 +48,8 @@ class ShadowRealmBuiltinsAssembler : public CodeStubAssembler {
 TNode<JSObject> ShadowRealmBuiltinsAssembler::AllocateJSWrappedFunction(
     TNode<Context> context, TNode<Object> target) {
   TNode<NativeContext> native_context = LoadNativeContext(context);
-  TNode<Map> map = CAST(
-      LoadContextElement(native_context, Context::WRAPPED_FUNCTION_MAP_INDEX));
+  TNode<Map> map = CAST(LoadContextElementNoCell(
+      native_context, Context::WRAPPED_FUNCTION_MAP_INDEX));
   TNode<JSObject> wrapped = AllocateJSObjectFromMap(map);
   StoreObjectFieldNoWriteBarrier(
       wrapped, JSWrappedFunction::kWrappedTargetFunctionOffset, target);
@@ -183,8 +183,8 @@ TF_BUILTIN(ShadowRealmGetWrappedValue, ShadowRealmBuiltinsAssembler) {
   // Verify that prototype matches the function prototype of the target
   // context.
   TNode<Object> prototype = LoadMapPrototype(map);
-  TNode<Object> function_map =
-      LoadContextElement(target_context, Context::WRAPPED_FUNCTION_MAP_INDEX);
+  TNode<Object> function_map = LoadContextElementNoCell(
+      target_context, Context::WRAPPED_FUNCTION_MAP_INDEX);
   TNode<Object> function_prototype = LoadMapPrototype(CAST(function_map));
   GotoIf(TaggedNotEqual(prototype, function_prototype), &slow_wrap);
 
@@ -359,7 +359,7 @@ TNode<Object> ShadowRealmBuiltinsAssembler::ImportValue(
   TNode<JSFunction> on_fulfilled = AllocateImportValueFulfilledFunction(
       caller_context, eval_context, specifier, export_name);
 
-  TNode<JSFunction> on_rejected = CAST(LoadContextElement(
+  TNode<JSFunction> on_rejected = CAST(LoadContextElementNoCell(
       caller_context, Context::SHADOW_REALM_IMPORT_VALUE_REJECTED_INDEX));
   // 12. Let promiseCapability be ! NewPromiseCapability(%Promise%).
   TNode<JSPromise> promise = NewJSPromise(caller_context);
@@ -377,7 +377,7 @@ TF_BUILTIN(ShadowRealmImportValueFulfilled, ShadowRealmBuiltinsAssembler) {
   // with argument exports, it performs the following steps:
   // 8. Let realm be f.[[Realm]].
   TNode<Context> context = Parameter<Context>(Descriptor::kContext);
-  TNode<Context> eval_context = CAST(LoadContextElement(
+  TNode<Context> eval_context = CAST(LoadContextElementNoCell(
       context, ImportValueFulfilledFunctionContextSlot::kEvalContextSlot));
 
   Label get_export_exception(this, Label::kDeferred);
@@ -385,7 +385,7 @@ TF_BUILTIN(ShadowRealmImportValueFulfilled, ShadowRealmBuiltinsAssembler) {
   // 2. Let f be the active function object.
   // 3. Let string be f.[[ExportNameString]].
   // 4. Assert: Type(string) is String.
-  TNode<String> export_name_string = CAST(LoadContextElement(
+  TNode<String> export_name_string = CAST(LoadContextElementNoCell(
       context, ImportValueFulfilledFunctionContextSlot::kExportNameSlot));
 
   // 1. Assert: exports is a module namespace exotic object.
@@ -416,7 +416,7 @@ TF_BUILTIN(ShadowRealmImportValueFulfilled, ShadowRealmBuiltinsAssembler) {
 
   BIND(&get_export_exception);
   {
-    TNode<String> specifier_string = CAST(LoadContextElement(
+    TNode<String> specifier_string = CAST(LoadContextElementNoCell(
         context, ImportValueFulfilledFunctionContextSlot::kSpecifierSlot));
     ThrowTypeError(context, MessageTemplate::kUnresolvableExport,
                    specifier_string, export_name_string);
diff --git a/deps/v8/src/builtins/builtins-shadow-realm.cc b/deps/v8/src/builtins/builtins-shadow-realm.cc
index fb509e3fef1f3b..31382837f9e868 100644
--- a/deps/v8/src/builtins/builtins-shadow-realm.cc
+++ b/deps/v8/src/builtins/builtins-shadow-realm.cc
@@ -166,9 +166,9 @@ BUILTIN(ShadowRealmPrototypeEvaluate) {
     // 7. If strictEval is true, set varEnv to lexEnv.
     DirectHandle<JSFunction> function;
     MaybeDirectHandle<JSFunction> maybe_function =
-        Compiler::GetFunctionFromValidatedString(eval_context, validated_source,
-                                                 NO_PARSE_RESTRICTION,
-                                                 kNoSourcePosition);
+        Compiler::GetFunctionFromValidatedString(
+            isolate, eval_context, validated_source, NO_PARSE_RESTRICTION,
+            kNoSourcePosition);
     if (maybe_function.is_null()) {
       is_parse_failed = true;
     } else {
diff --git a/deps/v8/src/builtins/builtins-string-gen.cc b/deps/v8/src/builtins/builtins-string-gen.cc
index aa5f850fa878a7..d7b450785a513f 100644
--- a/deps/v8/src/builtins/builtins-string-gen.cc
+++ b/deps/v8/src/builtins/builtins-string-gen.cc
@@ -937,6 +937,38 @@ TF_BUILTIN(StringGreaterThanOrEqual, StringBuiltinsAssembler) {
                                      StringComparison::kGreaterThanOrEqual);
 }
 
+#if V8_ENABLE_WEBASSEMBLY
+// Duplicate of string builtins for wasm. The only difference is that these
+// builtins are listed in WASM_BUILTIN_LIST. Builtins in this list are
+// instrumented to check if they are running on a secondary stack and switch
+// back to the central stack before calling a runtime function or a JS builtin
+// if needed.
+TF_BUILTIN(WasmJSStringEqual, StringBuiltinsAssembler) {
+  auto left = Parameter<String>(Descriptor::kLeft);
+  auto right = Parameter<String>(Descriptor::kRight);
+  auto length = UncheckedParameter<IntPtrT>(Descriptor::kLength);
+  // Callers must handle the case where {lhs} and {rhs} refer to the same
+  // String object.
+  CSA_DCHECK(this, TaggedNotEqual(left, right));
+  GenerateStringEqual(left, right, length);
+}
+
+TF_BUILTIN(WasmStringAdd_CheckNone, StringBuiltinsAssembler) {
+  auto left = Parameter<String>(Descriptor::kLeft);
+  auto right = Parameter<String>(Descriptor::kRight);
+  TNode<ContextOrEmptyContext> context =
+      UncheckedParameter<ContextOrEmptyContext>(Descriptor::kContext);
+  CSA_DCHECK(this, IsZeroOrContext(context));
+  Return(StringAdd(context, left, right));
+}
+
+TF_BUILTIN(WasmStringCompare, StringBuiltinsAssembler) {
+  auto left = Parameter<String>(Descriptor::kLeft);
+  auto right = Parameter<String>(Descriptor::kRight);
+  GenerateStringRelationalComparison(left, right, StringComparison::kCompare);
+}
+#endif
+
 #ifndef V8_ENABLE_EXPERIMENTAL_TSA_BUILTINS
 
 // NOTE: This needs to be kept in sync with the Turboshaft implementation in
@@ -1488,7 +1520,6 @@ TNode<JSArray> StringBuiltinsAssembler::StringToArray(
     TNode<RawPtrT> string_data =
         to_direct.PointerToData(&fill_thehole_and_call_runtime);
     TNode<IntPtrT> string_data_offset = to_direct.offset();
-    TNode<FixedArray> cache = SingleCharacterStringTableConstant();
 
     BuildFastLoop<IntPtrT>(
         IntPtrConstant(0), length,
@@ -1498,14 +1529,13 @@ TNode<JSArray> StringBuiltinsAssembler::StringToArray(
           // ToDirectStringAssembler.PointerToData().
           CSA_DCHECK(this, WordEqual(to_direct.PointerToData(&call_runtime),
                                      string_data));
-          TNode<Int32T> char_code =
-              UncheckedCast<Int32T>(Load(MachineType::Uint8(), string_data,
-                                         IntPtrAdd(index, string_data_offset)));
-          TNode<UintPtrT> code_index = ChangeUint32ToWord(char_code);
-          TNode<Object> entry = LoadFixedArrayElement(cache, code_index);
-
-          CSA_DCHECK(this, Word32BinaryNot(IsUndefined(entry)));
+          TNode<Uint8T> char_code =
+              Load<Uint8T>(string_data, IntPtrAdd(index, string_data_offset));
+          TNode<String> entry = StringFromSingleOneByteCharCode(char_code);
 
+          // TODO(ishell): make it possible to skip write barriers here.
+          // The single-character strings are in RO space so it should
+          // be safe to skip the write barriers.
           StoreFixedArrayElement(elements, index, entry);
         },
         1, LoopUnrollingMode::kNo, IndexAdvanceMode::kPost);
diff --git a/deps/v8/src/builtins/builtins-typed-array-gen.cc b/deps/v8/src/builtins/builtins-typed-array-gen.cc
index 66091c77b5f6b2..08caa85d481257 100644
--- a/deps/v8/src/builtins/builtins-typed-array-gen.cc
+++ b/deps/v8/src/builtins/builtins-typed-array-gen.cc
@@ -39,8 +39,8 @@ void TypedArrayBuiltinsAssembler::SetupTypedArrayEmbedderFields(
 TNode<JSArrayBuffer> TypedArrayBuiltinsAssembler::AllocateEmptyOnHeapBuffer(
     TNode<Context> context) {
   TNode<NativeContext> native_context = LoadNativeContext(context);
-  TNode<Map> map =
-      CAST(LoadContextElement(native_context, Context::ARRAY_BUFFER_MAP_INDEX));
+  TNode<Map> map = CAST(LoadContextElementNoCell(
+      native_context, Context::ARRAY_BUFFER_MAP_INDEX));
   TNode<FixedArray> empty_fixed_array = EmptyFixedArrayConstant();
 
   TNode<JSArrayBuffer> buffer = UncheckedCast<JSArrayBuffer>(
@@ -269,8 +269,8 @@ TNode<JSFunction> TypedArrayBuiltinsAssembler::GetDefaultConstructor(
         context_slot = IntPtrConstant(typed_array_function_index);
       });
 
-  return CAST(
-      LoadContextElement(LoadNativeContext(context), context_slot.value()));
+  return CAST(LoadContextElementNoCell(LoadNativeContext(context),
+                                       context_slot.value()));
 }
 
 TNode<JSTypedArray> TypedArrayBuiltinsAssembler::ValidateTypedArray(
diff --git a/deps/v8/src/builtins/builtins-typed-array-gen.h b/deps/v8/src/builtins/builtins-typed-array-gen.h
index c2201f598c463a..5c48644a7961ee 100644
--- a/deps/v8/src/builtins/builtins-typed-array-gen.h
+++ b/deps/v8/src/builtins/builtins-typed-array-gen.h
@@ -28,6 +28,8 @@ class TypedArrayBuiltinsAssembler : public CodeStubAssembler {
   TNode<UintPtrT> CalculateExternalPointer(TNode<UintPtrT> backing_store,
                                            TNode<UintPtrT> byte_offset);
 
+  TNode<BoolT> IsScriptContextCellsFlag();
+
   // Returns true if kind is either UINT8_ELEMENTS, UINT8_CLAMPED_ELEMENTS,
   // RAB_GSAB_UINT8_ELEMENTS, or RAB_GSAB_UINT8_CLAMPED_ELEMENTS.
   TNode<BoolT> IsUint8ElementsKind(TNode<Int32T> kind);
diff --git a/deps/v8/src/builtins/builtins-typed-array.cc b/deps/v8/src/builtins/builtins-typed-array.cc
index f1a46d5b2c4822..5804f154bf1854 100644
--- a/deps/v8/src/builtins/builtins-typed-array.cc
+++ b/deps/v8/src/builtins/builtins-typed-array.cc
@@ -226,7 +226,7 @@ BUILTIN(TypedArrayPrototypeFill) {
   //   c. Set k to k + 1.
   // 20. Return O.
   RETURN_RESULT_OR_FAILURE(isolate, ElementsAccessor::ForKind(kind)->Fill(
-                                        array, obj_value, start, end));
+                                        isolate, array, obj_value, start, end));
 }
 
 BUILTIN(TypedArrayPrototypeIncludes) {
@@ -352,6 +352,15 @@ SimdutfBase64OptionsVector() {
           {"base64url", 9, simdutf::base64_options::base64_url}};
 }
 
+std::vector<
+    std::tuple<const char*, size_t, simdutf::last_chunk_handling_options>>
+SimdutfLastChunkHandlingOptionsVector() {
+  return {{"loose", 5, simdutf::last_chunk_handling_options::loose},
+          {"strict", 6, simdutf::last_chunk_handling_options::strict},
+          {"stop-before-partial", 19,
+           simdutf::last_chunk_handling_options::stop_before_partial}};
+}
+
 template <typename T>
 Maybe<T> MapOptionToEnum(
     Isolate* isolate, DirectHandle<String> option_string,
@@ -392,6 +401,72 @@ Maybe<T> MapOptionToEnum(
   return Nothing<T>();
 }
 
+Maybe<std::pair<simdutf::base64_options, simdutf::last_chunk_handling_options>>
+HandleOptionsBag(Isolate* isolate, DirectHandle<Object> options) {
+  simdutf::base64_options alphabet;
+  simdutf::last_chunk_handling_options last_chunk_handling;
+
+  // 1. Let alphabet be ? Get(opts, "alphabet").
+  DirectHandle<Object> opt_alphabet;
+  ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+      isolate, opt_alphabet,
+      JSObject::ReadFromOptionsBag(
+          options, isolate->factory()->alphabet_string(), isolate),
+      (Nothing<std::pair<simdutf::base64_options,
+                         simdutf::last_chunk_handling_options>>()));
+
+  // 2. If alphabet is undefined, set alphabet to "base64".
+  if (IsUndefined(*opt_alphabet)) {
+    alphabet = simdutf::base64_default;
+  } else if (!IsString(*opt_alphabet)) {
+    isolate->Throw(*isolate->factory()->NewTypeError(
+        MessageTemplate::kInvalidOption, opt_alphabet));
+    return Nothing<std::pair<simdutf::base64_options,
+                             simdutf::last_chunk_handling_options>>();
+  } else {
+    // 3. If alphabet is neither "base64" nor "base64url", throw a TypeError
+    //    exception.
+    DirectHandle<String> alphabet_string = Cast<String>(opt_alphabet);
+    MAYBE_ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+        isolate, alphabet,
+        MapOptionToEnum(isolate, alphabet_string, SimdutfBase64OptionsVector()),
+        (Nothing<std::pair<simdutf::base64_options,
+                           simdutf::last_chunk_handling_options>>()));
+  }
+
+  // 4. Let lastChunkHandling be ? Get(opts, "lastChunkHandling").
+  DirectHandle<Object> opt_last_chunk_handling;
+  ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+      isolate, opt_last_chunk_handling,
+      JSObject::ReadFromOptionsBag(
+          options, isolate->factory()->last_chunk_handling_string(), isolate),
+      (Nothing<std::pair<simdutf::base64_options,
+                         simdutf::last_chunk_handling_options>>()));
+
+  // 5. If lastChunkHandling is undefined, set lastChunkHandling to "loose".
+  if (IsUndefined(*opt_last_chunk_handling)) {
+    last_chunk_handling = simdutf::last_chunk_handling_options::loose;
+  } else if (!IsString(*opt_last_chunk_handling)) {
+    isolate->Throw(*isolate->factory()->NewTypeError(
+        MessageTemplate::kInvalidOption, opt_last_chunk_handling));
+    return Nothing<std::pair<simdutf::base64_options,
+                             simdutf::last_chunk_handling_options>>();
+  } else {
+    // 6. If lastChunkHandling is not one of "loose", "strict", or
+    //     "stop-before-partial", throw a TypeError exception.
+    DirectHandle<String> last_chunk_handling_string =
+        Cast<String>(opt_last_chunk_handling);
+
+    MAYBE_ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+        isolate, last_chunk_handling,
+        MapOptionToEnum(isolate, last_chunk_handling_string,
+                        SimdutfLastChunkHandlingOptionsVector()),
+        (Nothing<std::pair<simdutf::base64_options,
+                           simdutf::last_chunk_handling_options>>()));
+  }
+  return Just(std::make_pair(alphabet, last_chunk_handling));
+}
+
 MessageTemplate ToMessageTemplate(simdutf::error_code error) {
   switch (error) {
     case simdutf::error_code::INVALID_BASE64_CHARACTER:
@@ -408,9 +483,9 @@ MessageTemplate ToMessageTemplate(simdutf::error_code error) {
 template <typename T>
 Maybe<simdutf::result> ArrayBufferFromBase64(
     Isolate* isolate, T input_vector, size_t input_length,
-    size_t& output_length, simdutf::base64_options alphabet,
+    simdutf::base64_options alphabet,
     simdutf::last_chunk_handling_options last_chunk_handling,
-    DirectHandle<JSArrayBuffer>& buffer) {
+    DirectHandle<JSArrayBuffer>& buffer, size_t& output_length) {
   const char method_name[] = "Uint8Array.fromBase64";
 
   output_length = simdutf::maximal_binary_length_from_base64(
@@ -437,6 +512,25 @@ Maybe<simdutf::result> ArrayBufferFromBase64(
   return Just<simdutf::result>(simd_result);
 }
 
+template <typename T>
+simdutf::result ArrayBufferSetFromBase64(
+    T input_vector, size_t input_length, size_t array_length,
+    simdutf::base64_options alphabet,
+    simdutf::last_chunk_handling_options last_chunk_handling,
+    DirectHandle<JSTypedArray> typed_array, size_t& output_length) {
+  // TODO(rezvan): Add path for typed arrays backed by SharedArrayBuffer
+  if (typed_array->buffer()->is_shared()) {
+    UNIMPLEMENTED();
+  }
+  output_length = array_length;
+  simdutf::result simd_result = simdutf::base64_to_binary_safe(
+      reinterpret_cast<const T>(input_vector), input_length,
+      reinterpret_cast<char*>(typed_array->DataPtr()), output_length, alphabet,
+      last_chunk_handling);
+
+  return simd_result;
+}
+
 }  // namespace
 
 // https://tc39.es/proposal-arraybuffer-base64/spec/#sec-uint8array.frombase64
@@ -457,64 +551,11 @@ BUILTIN(Uint8ArrayFromBase64) {
   // 2. Let opts be ? GetOptionsObject(options).
   DirectHandle<Object> options = args.atOrUndefined(isolate, 2);
 
-  // 3. Let alphabet be ? Get(opts, "alphabet").
-  DirectHandle<Object> opt_alphabet;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, opt_alphabet,
-      JSObject::ReadFromOptionsBag(
-          options, isolate->factory()->alphabet_string(), isolate));
-
-  // 4. If alphabet is undefined, set alphabet to "base64".
-  simdutf::base64_options alphabet;
-  if (IsUndefined(*opt_alphabet)) {
-    alphabet = simdutf::base64_default;
-  } else if (!IsString(*opt_alphabet)) {
-    THROW_NEW_ERROR_RETURN_FAILURE(
-        isolate, NewTypeError(MessageTemplate::kInvalidOption, opt_alphabet));
-  } else {
-    // 5. If alphabet is neither "base64" nor "base64url", throw a TypeError
-    // exception.
-    DirectHandle<String> alphabet_string = Cast<String>(opt_alphabet);
-
-    MAYBE_ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-        isolate, alphabet,
-        MapOptionToEnum(isolate, alphabet_string,
-                        SimdutfBase64OptionsVector()));
-  }
-
-  // 6. Let lastChunkHandling be ? Get(opts, "lastChunkHandling").
-  DirectHandle<Object> opt_last_chunk_handling;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, opt_last_chunk_handling,
-      JSObject::ReadFromOptionsBag(
-          options, isolate->factory()->last_chunk_handling_string(), isolate));
-
-  // 7. If lastChunkHandling is undefined, set lastChunkHandling to "loose".
-  simdutf::last_chunk_handling_options last_chunk_handling;
-  if (IsUndefined(*opt_last_chunk_handling)) {
-    last_chunk_handling = simdutf::last_chunk_handling_options::loose;
-  } else if (!IsString(*opt_last_chunk_handling)) {
-    THROW_NEW_ERROR_RETURN_FAILURE(
-        isolate,
-        NewTypeError(MessageTemplate::kInvalidOption, opt_last_chunk_handling));
-  } else {
-    // 8. If lastChunkHandling is not one of "loose", "strict", or
-    // "stop-before-partial", throw a TypeError exception.
-    DirectHandle<String> last_chunk_handling_string =
-        Cast<String>(opt_last_chunk_handling);
-
-    std::vector<
-        std::tuple<const char*, size_t, simdutf::last_chunk_handling_options>>
-        last_chunk_handling_vector = {
-            {"loose", 5, simdutf::last_chunk_handling_options::loose},
-            {"strict", 6, simdutf::last_chunk_handling_options::strict},
-            {"stop-before-partial", 19,
-             simdutf::last_chunk_handling_options::stop_before_partial}};
-    MAYBE_ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-        isolate, last_chunk_handling,
-        MapOptionToEnum(isolate, last_chunk_handling_string,
-                        last_chunk_handling_vector));
-  }
+  // Steps 3-8 handled in HandleOptionsBag
+  std::pair<simdutf::base64_options, simdutf::last_chunk_handling_options>
+      options_pair;
+  MAYBE_ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, options_pair,
+                                           HandleOptionsBag(isolate, options));
 
   // 9. Let result be ? FromBase64(string, alphabet, lastChunkHandling).
   size_t input_length;
@@ -532,8 +573,8 @@ BUILTIN(Uint8ArrayFromBase64) {
           isolate, simd_result,
           ArrayBufferFromBase64(isolate,
                                 reinterpret_cast<const char*>(input_vector),
-                                input_length, output_length, alphabet,
-                                last_chunk_handling, buffer));
+                                input_length, options_pair.first,
+                                options_pair.second, buffer, output_length));
     } else {
       const base::uc16* input_vector = input_content.ToUC16Vector().data();
       input_length = input_content.ToUC16Vector().size();
@@ -541,8 +582,8 @@ BUILTIN(Uint8ArrayFromBase64) {
           isolate, simd_result,
           ArrayBufferFromBase64(isolate,
                                 reinterpret_cast<const char16_t*>(input_vector),
-                                input_length, output_length, alphabet,
-                                last_chunk_handling, buffer));
+                                input_length, options_pair.first,
+                                options_pair.second, buffer, output_length));
     }
   }
 
@@ -555,10 +596,10 @@ BUILTIN(Uint8ArrayFromBase64) {
 
   // 11. Let resultLength be the length of result.[[Bytes]].
   // 12. Let ta be ? AllocateTypedArray("Uint8Array", %Uint8Array%,
-  // "%Uint8Array.prototype%", resultLength).
+  //     "%Uint8Array.prototype%", resultLength).
   // 13. Set the value at each index of
-  // ta.[[ViewedArrayBuffer]].[[ArrayBufferData]] to the value at the
-  // corresponding index of result.[[Bytes]].
+  //     ta.[[ViewedArrayBuffer]].[[ArrayBufferData]] to the value at the
+  //     corresponding index of result.[[Bytes]].
   // 14. Return ta.
   DirectHandle<JSTypedArray> result_typed_array =
       isolate->factory()->NewJSTypedArray(kExternalUint8Array, buffer, 0,
@@ -566,6 +607,112 @@ BUILTIN(Uint8ArrayFromBase64) {
   return *result_typed_array;
 }
 
+// https://tc39.es/proposal-arraybuffer-base64/spec/#sec-uint8array.prototype.setfrombase64
+BUILTIN(Uint8ArrayPrototypeSetFromBase64) {
+  HandleScope scope(isolate);
+  const char method_name[] = "Uint8Array.prototype.setFromBase64";
+
+  // 1. Let into be the this value.
+  // 2. Perform ? ValidateUint8Array(into).
+  CHECK_RECEIVER(JSTypedArray, uint8array, method_name);
+  if (uint8array->GetElementsKind() != ElementsKind::UINT8_ELEMENTS) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kIncompatibleMethodReceiver,
+                              isolate->factory()->NewStringFromAsciiChecked(
+                                  method_name)));
+  }
+
+  // 3. If string is not a String, throw a TypeError exception.
+  DirectHandle<Object> input = args.atOrUndefined(isolate, 1);
+  if (!IsString(*input)) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kArgumentIsNonString,
+                              isolate->factory()->input_string()));
+  }
+
+  DirectHandle<String> input_string =
+      String::Flatten(isolate, Cast<String>(input));
+
+  // 4. Let opts be ? GetOptionsObject(options).
+  DirectHandle<Object> options = args.atOrUndefined(isolate, 2);
+
+  // Steps 5-10 handled in HandleOptionsBag
+  std::pair<simdutf::base64_options, simdutf::last_chunk_handling_options>
+      options_pair;
+  MAYBE_ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, options_pair,
+                                           HandleOptionsBag(isolate, options));
+
+  // 11. Let taRecord be MakeTypedArrayWithBufferWitnessRecord(into, seq-cst).
+  // 12. If IsTypedArrayOutOfBounds(taRecord) is true, throw a TypeError
+  //     exception.
+  // 13. Let byteLength be TypedArrayLength(taRecord).
+  bool out_of_bounds = false;
+  size_t array_length = uint8array->GetLengthOrOutOfBounds(out_of_bounds);
+
+  if (out_of_bounds || uint8array->WasDetached()) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kDetachedOperation,
+                              isolate->factory()->NewStringFromAsciiChecked(
+                                  method_name)));
+  }
+
+  // 14. Let result be FromBase64(string, alphabet, lastChunkHandling,
+  //     byteLength).
+  // 15. Let bytes be result.[[Bytes]].
+  // 16. Let written be the length of bytes.
+  // 17. NOTE: FromBase64 does not invoke any user code, so the ArrayBuffer
+  //     backing into cannot have been detached or shrunk.
+  size_t input_length;
+  size_t output_length;
+  simdutf::result simd_result;
+  {
+    DisallowGarbageCollection no_gc;
+    String::FlatContent input_content = input_string->GetFlatContent(no_gc);
+    if (input_content.IsOneByte()) {
+      const unsigned char* input_vector =
+          input_content.ToOneByteVector().data();
+      input_length = input_content.ToOneByteVector().size();
+      simd_result = ArrayBufferSetFromBase64(
+          reinterpret_cast<const char*>(input_vector), input_length,
+          array_length, options_pair.first, options_pair.second, uint8array,
+          output_length);
+    } else {
+      const base::uc16* input_vector = input_content.ToUC16Vector().data();
+      input_length = input_content.ToUC16Vector().size();
+      simd_result = ArrayBufferSetFromBase64(
+          reinterpret_cast<const char16_t*>(input_vector), input_length,
+          array_length, options_pair.first, options_pair.second, uint8array,
+          output_length);
+    }
+  }
+
+  // 18. Assert: written ≤ byteLength.
+  DCHECK_LE(output_length, array_length);
+  // 19. Perform SetUint8ArrayBytes(into, bytes).
+  // already done in ArrayBufferSetFromBase64.
+
+  // 20. If result.[[Error]] is not none, then
+  //    a. Throw result.[[Error]].
+  // the typed array length may be less than the required output length. In that
+  // case, the result has written in typed array to the available length and
+  // we should not throw here.
+  if (simd_result.error != simdutf::error_code::SUCCESS &&
+      simd_result.error != simdutf::error_code::OUTPUT_BUFFER_TOO_SMALL) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewSyntaxError(ToMessageTemplate(simd_result.error)));
+  }
+
+  // 21. Let resultObject be OrdinaryObjectCreate(%Object.prototype%).
+  // 22. Perform ! CreateDataPropertyOrThrow(resultObject, "read",
+  //     𝔽(result.[[Read]])).
+  // 23. Perform ! CreateDataPropertyOrThrow(resultObject, "written",
+  //     𝔽(written)).
+  // 24. Return resultObject.
+  return *isolate->factory()->NewJSUint8ArraySetFromResult(
+      isolate->factory()->NewNumberFromSize(simd_result.count),
+      isolate->factory()->NewNumberFromSize(output_length));
+}
+
 // https://tc39.es/proposal-arraybuffer-base64/spec/#sec-uint8array.prototype.tobase64
 BUILTIN(Uint8ArrayPrototypeToBase64) {
   HandleScope scope(isolate);
@@ -735,11 +882,15 @@ BUILTIN(Uint8ArrayFromHex) {
       if (input_content.IsOneByte()) {
         base::Vector<const uint8_t> input_vector =
             input_content.ToOneByteVector();
-        result = ArrayBufferFromHex(input_vector, buffer, output_length);
+        result = ArrayBufferFromHex(
+            input_vector, static_cast<uint8_t*>(buffer->backing_store()),
+            output_length);
       } else {
         base::Vector<const base::uc16> input_vector =
             input_content.ToUC16Vector();
-        result = ArrayBufferFromHex(input_vector, buffer, output_length);
+        result = ArrayBufferFromHex(
+            input_vector, static_cast<uint8_t*>(buffer->backing_store()),
+            output_length);
       }
   }
 
@@ -759,6 +910,105 @@ BUILTIN(Uint8ArrayFromHex) {
   return *result_typed_array;
 }
 
+// https://tc39.es/proposal-arraybuffer-base64/spec/#sec-uint8array.prototype.setfromhex
+BUILTIN(Uint8ArrayPrototypeSetFromHex) {
+  HandleScope scope(isolate);
+  const char method_name[] = "Uint8Array.prototypr.setFromHex";
+
+  // 1. Let into be the this value.
+  // 2. Perform ? ValidateUint8Array(into).
+  CHECK_RECEIVER(JSTypedArray, uint8array, method_name);
+  if (uint8array->GetElementsKind() != ElementsKind::UINT8_ELEMENTS) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kIncompatibleMethodReceiver,
+                              isolate->factory()->NewStringFromAsciiChecked(
+                                  method_name)));
+  }
+
+  // 3. If string is not a String, throw a TypeError exception.
+  DirectHandle<Object> input = args.atOrUndefined(isolate, 1);
+  if (!IsString(*input)) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kArgumentIsNonString,
+                              isolate->factory()->input_string()));
+  }
+
+  DirectHandle<String> input_string =
+      String::Flatten(isolate, Cast<String>(input));
+
+  // 4. Let taRecord be MakeTypedArrayWithBufferWitnessRecord(into, seq-cst).
+  // 5. If IsTypedArrayOutOfBounds(taRecord) is true, throw a TypeError
+  // exception.
+  // 6. Let byteLength be TypedArrayLength(taRecord).
+  bool out_of_bounds = false;
+  size_t array_length = uint8array->GetLengthOrOutOfBounds(out_of_bounds);
+
+  if (out_of_bounds || uint8array->WasDetached()) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kDetachedOperation,
+                              isolate->factory()->NewStringFromAsciiChecked(
+                                  method_name)));
+  }
+
+  size_t input_length = input_string->length();
+  if (input_length % 2 != 0) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewSyntaxError(MessageTemplate::kInvalidHexString));
+  }
+
+  size_t output_length = (input_length / 2);
+  output_length = std::min(output_length, array_length);
+
+  // TODO(rezvan): Add path for typed arrays backed by SharedArrayBuffer
+  if (uint8array->buffer()->is_shared()) {
+    UNIMPLEMENTED();
+  }
+
+  // 7. Let result be FromHex(string, byteLength).
+  // 8. Let bytes be result.[[Bytes]].
+  // 9. Let written be the length of bytes.
+  // 10. NOTE: FromHex does not invoke any user code, so the ArrayBuffer backing
+  // into cannot have been detached or shrunk.
+  // 11. Assert: written ≤ byteLength.
+  // 12. Perform SetUint8ArrayBytes(into, bytes).
+  bool result;
+  {
+    DisallowGarbageCollection no_gc;
+    String::FlatContent input_content = input_string->GetFlatContent(no_gc);
+
+    if (input_content.IsOneByte()) {
+      base::Vector<const uint8_t> input_vector =
+          input_content.ToOneByteVector();
+      result = ArrayBufferFromHex(input_vector,
+                                  static_cast<uint8_t*>(uint8array->DataPtr()),
+                                  output_length);
+    } else {
+      base::Vector<const base::uc16> input_vector =
+          input_content.ToUC16Vector();
+      result = ArrayBufferFromHex(input_vector,
+                                  static_cast<uint8_t*>(uint8array->DataPtr()),
+                                  output_length);
+    }
+  }
+
+  // 13. If result.[[Error]] is not none, then
+  //     a. Throw result.[[Error]].
+  if (!result) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewSyntaxError(MessageTemplate::kInvalidHexString));
+  }
+
+  // 14. Let resultObject be OrdinaryObjectCreate(%Object.prototype%).
+  // 15. Perform ! CreateDataPropertyOrThrow(resultObject, "read",
+  // 𝔽(result.[[Read]])).
+  // 16. Perform ! CreateDataPropertyOrThrow(resultObject, "written",
+  // 𝔽(written)).
+  // 17. Return resultObject.
+  return *isolate->factory()->NewJSUint8ArraySetFromResult(
+      isolate->factory()->NewNumberFromSize(output_length * 2),
+      isolate->factory()->NewNumberFromSize(output_length));
+}
+
 // https://tc39.es/proposal-arraybuffer-base64/spec/#sec-uint8array.prototype.tohex
 BUILTIN(Uint8ArrayPrototypeToHex) {
   HandleScope scope(isolate);
diff --git a/deps/v8/src/builtins/builtins.cc b/deps/v8/src/builtins/builtins.cc
index 585f4d67d1b269..77d931541320a9 100644
--- a/deps/v8/src/builtins/builtins.cc
+++ b/deps/v8/src/builtins/builtins.cc
@@ -458,7 +458,7 @@ DirectHandle<Code> Builtins::CreateInterpreterEntryTrampolineForProfiling(
   desc.handler_table_offset = instruction_size;
   desc.constant_pool_offset = instruction_size;
   desc.code_comments_offset = instruction_size;
-  desc.builtin_jump_table_info_offset = instruction_size;
+  desc.jump_table_info_offset = instruction_size;
 
   CodeDesc::Verify(&desc);
 
diff --git a/deps/v8/src/builtins/frame-arguments.tq b/deps/v8/src/builtins/frame-arguments.tq
index fe499a881f3531..cd9d3d84d615b9 100644
--- a/deps/v8/src/builtins/frame-arguments.tq
+++ b/deps/v8/src/builtins/frame-arguments.tq
@@ -14,7 +14,6 @@ struct Arguments {
 }
 
 extern operator '[]' macro GetArgumentValue(Arguments, intptr): JSAny;
-extern operator '[]=' macro SetArgumentValue(Arguments, intptr, Object): void;
 extern macro GetFrameArguments(FrameWithArguments, intptr): Arguments;
 
 struct ArgumentsIterator {
diff --git a/deps/v8/src/builtins/ia32/builtins-ia32.cc b/deps/v8/src/builtins/ia32/builtins-ia32.cc
index c056566a7bedd9..fcb0b0c5f2acdb 100644
--- a/deps/v8/src/builtins/ia32/builtins-ia32.cc
+++ b/deps/v8/src/builtins/ia32/builtins-ia32.cc
@@ -3289,67 +3289,51 @@ void Builtins::Generate_WasmDebugBreak(MacroAssembler* masm) {
 namespace {
 // Check that the stack was in the old state (if generated code assertions are
 // enabled), and switch to the new state.
-void SwitchStackState(MacroAssembler* masm, Register jmpbuf,
+void SwitchStackState(MacroAssembler* masm, Register stack,
                       wasm::JumpBuffer::StackState old_state,
                       wasm::JumpBuffer::StackState new_state) {
-  __ cmp(MemOperand(jmpbuf, wasm::kJmpBufStateOffset), Immediate(old_state));
+  __ cmp(MemOperand(stack, wasm::kStackStateOffset), Immediate(old_state));
   Label ok;
   __ j(equal, &ok, Label::kNear);
   __ Trap();
   __ bind(&ok);
-  __ mov(MemOperand(jmpbuf, wasm::kJmpBufStateOffset), Immediate(new_state));
+  __ mov(MemOperand(stack, wasm::kStackStateOffset), Immediate(new_state));
 }
 
-void FillJumpBuffer(MacroAssembler* masm, Register jmpbuf, Register scratch,
+void FillJumpBuffer(MacroAssembler* masm, Register stack, Register scratch,
                     Label* pc) {
-  DCHECK(!AreAliased(scratch, jmpbuf));
+  DCHECK(!AreAliased(scratch, stack));
 
-  __ mov(MemOperand(jmpbuf, wasm::kJmpBufSpOffset), esp);
-  __ mov(MemOperand(jmpbuf, wasm::kJmpBufFpOffset), ebp);
+  __ mov(MemOperand(stack, wasm::kStackSpOffset), esp);
+  __ mov(MemOperand(stack, wasm::kStackFpOffset), ebp);
   __ mov(scratch, __ StackLimitAsOperand(StackLimitKind::kRealStackLimit));
-  __ mov(MemOperand(jmpbuf, wasm::kJmpBufStackLimitOffset), scratch);
+  __ mov(MemOperand(stack, wasm::kStackLimitOffset), scratch);
   __ LoadLabelAddress(scratch, pc);
-  __ mov(MemOperand(jmpbuf, wasm::kJmpBufPcOffset), scratch);
+  __ mov(MemOperand(stack, wasm::kStackPcOffset), scratch);
 }
 
-void LoadJumpBuffer(MacroAssembler* masm, Register jmpbuf, bool load_pc,
+void LoadJumpBuffer(MacroAssembler* masm, Register stack, bool load_pc,
                     wasm::JumpBuffer::StackState expected_state) {
-  __ mov(esp, MemOperand(jmpbuf, wasm::kJmpBufSpOffset));
-  __ mov(ebp, MemOperand(jmpbuf, wasm::kJmpBufFpOffset));
-  SwitchStackState(masm, jmpbuf, expected_state, wasm::JumpBuffer::Active);
+  __ mov(esp, MemOperand(stack, wasm::kStackSpOffset));
+  __ mov(ebp, MemOperand(stack, wasm::kStackFpOffset));
+  SwitchStackState(masm, stack, expected_state, wasm::JumpBuffer::Active);
   if (load_pc) {
-    __ jmp(MemOperand(jmpbuf, wasm::kJmpBufPcOffset));
+    __ jmp(MemOperand(stack, wasm::kStackPcOffset));
   }
   // The stack limit is set separately under the ExecutionAccess lock.
 }
 
-void SaveState(MacroAssembler* masm, Register active_continuation, Register tmp,
-               Register tmp2, Label* suspend) {
-  DCHECK(!AreAliased(active_continuation, tmp));
-  Register jmpbuf = tmp;
-  __ mov(jmpbuf, FieldOperand(active_continuation,
-                              WasmContinuationObject::kStackOffset));
-  __ lea(jmpbuf, MemOperand(jmpbuf, wasm::StackMemory::jmpbuf_offset()));
-  FillJumpBuffer(masm, jmpbuf, tmp2, suspend);
-}
-
-void LoadTargetJumpBuffer(MacroAssembler* masm, Register target_continuation,
+void LoadTargetJumpBuffer(MacroAssembler* masm, Register target_stack,
                           wasm::JumpBuffer::StackState expected_state) {
-  Register target_jmpbuf = target_continuation;
-  __ mov(target_jmpbuf, FieldOperand(target_continuation,
-                                     WasmContinuationObject::kStackOffset));
-  __ lea(target_jmpbuf,
-         MemOperand(target_jmpbuf, wasm::StackMemory::jmpbuf_offset()));
   MemOperand GCScanSlotPlace =
       MemOperand(ebp, StackSwitchFrameConstants::kGCScanSlotCountOffset);
   __ Move(GCScanSlotPlace, Immediate(0));
   // Switch stack!
-  LoadJumpBuffer(masm, target_jmpbuf, false, expected_state);
+  LoadJumpBuffer(masm, target_stack, false, expected_state);
 }
 
 // Updates the stack limit and central stack info, and validates the switch.
-void SwitchStacks(MacroAssembler* masm, Register old_continuation,
-                  bool return_switch,
+void SwitchStacks(MacroAssembler* masm, Register old_stack, bool return_switch,
                   const std::initializer_list<Register> keep) {
   using ER = ExternalReference;
   for (auto reg : keep) {
@@ -3359,7 +3343,7 @@ void SwitchStacks(MacroAssembler* masm, Register old_continuation,
   __ PrepareCallCFunction(2, eax);
   __ Move(Operand(esp, 0 * kSystemPointerSize),
           Immediate(ER::isolate_address(masm->isolate())));
-  __ mov(Operand(esp, 1 * kSystemPointerSize), old_continuation);
+  __ mov(Operand(esp, 1 * kSystemPointerSize), old_stack);
   __ CallCFunction(
       return_switch ? ER::wasm_return_switch() : ER::wasm_switch_stacks(), 2);
   for (auto it = std::rbegin(keep); it != std::rend(keep); ++it) {
@@ -3367,11 +3351,11 @@ void SwitchStacks(MacroAssembler* masm, Register old_continuation,
   }
 }
 
-void ReloadParentContinuation(MacroAssembler* masm, Register promise,
-                              Register return_value, Register context,
-                              Register tmp, Register tmp2) {
-  Register active_continuation = tmp;
-  __ LoadRoot(active_continuation, RootIndex::kActiveContinuation);
+void ReloadParentStack(MacroAssembler* masm, Register promise,
+                       Register return_value, Register context, Register tmp,
+                       Register tmp2) {
+  Register active_stack = tmp;
+  __ LoadRootRelative(active_stack, IsolateData::active_stack_offset());
 
   DCHECK(!AreAliased(promise, return_value, context, tmp));
 
@@ -3379,28 +3363,20 @@ void ReloadParentContinuation(MacroAssembler* masm, Register promise,
 
   // We don't need to save the full register state since we are switching out of
   // this stack for the last time. Mark the stack as retired.
-  Register jmpbuf = promise;
-  __ mov(jmpbuf, FieldOperand(active_continuation,
-                              WasmContinuationObject::kStackOffset));
-  __ lea(jmpbuf, MemOperand(jmpbuf, wasm::StackMemory::jmpbuf_offset()));
-  SwitchStackState(masm, jmpbuf, wasm::JumpBuffer::Active,
+  SwitchStackState(masm, active_stack, wasm::JumpBuffer::Active,
                    wasm::JumpBuffer::Retired);
 
   Register parent = tmp2;
-  __ mov(parent, FieldOperand(active_continuation,
-                              WasmContinuationObject::kParentOffset));
+  __ mov(parent, Operand(active_stack, wasm::kStackParentOffset));
 
-  // Update active continuation root.
-  __ mov(masm->RootAsOperand(RootIndex::kActiveContinuation), parent);
-  jmpbuf = parent;
-  __ mov(jmpbuf, FieldOperand(parent, WasmContinuationObject::kStackOffset));
-  __ lea(jmpbuf, MemOperand(jmpbuf, wasm::StackMemory::jmpbuf_offset()));
+  // Update active stack root.
+  __ StoreRootRelative(IsolateData::active_stack_offset(), parent);
 
   __ Pop(promise);
   // Switch stack!
-  SwitchStacks(masm, active_continuation, true,
-               {promise, return_value, context, jmpbuf});
-  LoadJumpBuffer(masm, jmpbuf, false, wasm::JumpBuffer::Inactive);
+  SwitchStacks(masm, active_stack, true,
+               {promise, return_value, context, parent});
+  LoadJumpBuffer(masm, parent, false, wasm::JumpBuffer::Inactive);
 }
 
 // Loads the context field of the WasmTrustedInstanceData or WasmImportData
@@ -3420,8 +3396,7 @@ void GetContextFromImplicitArg(MacroAssembler* masm, Register data,
   __ bind(&end);
 }
 
-void RestoreParentSuspender(MacroAssembler* masm, Register tmp1,
-                            Register tmp2) {
+void RestoreParentSuspender(MacroAssembler* masm, Register tmp1) {
   Register suspender = tmp1;
   __ LoadRoot(suspender, RootIndex::kActiveSuspender);
   __ Move(suspender,
@@ -3442,20 +3417,18 @@ void SwitchToAllocatedStack(MacroAssembler* masm, Register wrapper_buffer,
                             Register scratch, Register scratch2,
                             Label* suspend) {
   ResetStackSwitchFrameStackSlots(masm);
-  Register parent_continuation = new_wrapper_buffer;
-  __ LoadRoot(parent_continuation, RootIndex::kActiveContinuation);
-  __ Move(
-      parent_continuation,
-      FieldOperand(parent_continuation, WasmContinuationObject::kParentOffset));
-  SaveState(masm, parent_continuation, scratch, scratch2, suspend);
-  SwitchStacks(masm, parent_continuation, false, {wrapper_buffer});
-  parent_continuation = no_reg;
-  Register target_continuation = scratch;
-  __ LoadRoot(target_continuation, RootIndex::kActiveContinuation);
+  Register parent_stack = new_wrapper_buffer;
+  __ LoadRootRelative(parent_stack, IsolateData::active_stack_offset());
+  __ Move(parent_stack, Operand(parent_stack, wasm::kStackParentOffset));
+  FillJumpBuffer(masm, parent_stack, scratch, suspend);
+  SwitchStacks(masm, parent_stack, false, {wrapper_buffer});
+  parent_stack = no_reg;
+  Register target_stack = scratch;
+  __ LoadRootRelative(target_stack, IsolateData::active_stack_offset());
   // Save the old stack's ebp, and use it to access the parameters in
   // the parent frame.
   __ mov(original_fp, ebp);
-  LoadTargetJumpBuffer(masm, target_continuation, wasm::JumpBuffer::Suspended);
+  LoadTargetJumpBuffer(masm, target_stack, wasm::JumpBuffer::Suspended);
   // Return address slot. The builtin itself returns by switching to the parent
   // jump buffer and does not actually use this slot, but it is read by the
   // profiler.
@@ -3532,11 +3505,8 @@ void SwitchBackAndReturnPromise(MacroAssembler* masm, Register tmp,
          MemOperand(ebp, StackSwitchFrameConstants::kImplicitArgOffset));
   GetContextFromImplicitArg(masm, kContextRegister, tmp);
 
-  ReloadParentContinuation(masm, promise, return_value, kContextRegister, tmp,
-                           tmp2);
-  __ Push(promise);
-  RestoreParentSuspender(masm, promise, tmp);
-  __ Pop(promise);
+  ReloadParentStack(masm, promise, return_value, kContextRegister, tmp, tmp2);
+  RestoreParentSuspender(masm, tmp);
 
   if (mode == wasm::kPromise) {
     __ Move(MemOperand(ebp, StackSwitchFrameConstants::kGCScanSlotCountOffset),
@@ -3583,15 +3553,12 @@ void GenerateExceptionHandlingLandingPad(MacroAssembler* masm,
   constexpr Register tmp2 = edx;
   static_assert(tmp2 != promise && tmp2 != reason && tmp2 != kContextRegister);
   GetContextFromImplicitArg(masm, kContextRegister, tmp1);
-  ReloadParentContinuation(masm, promise, reason, kContextRegister, tmp1, tmp2);
-  __ Push(promise);
-  RestoreParentSuspender(masm, promise, edi);
-  __ Pop(promise);
+  ReloadParentStack(masm, promise, reason, kContextRegister, tmp1, tmp2);
+  RestoreParentSuspender(masm, edi);
 
   __ Move(MemOperand(ebp, StackSwitchFrameConstants::kGCScanSlotCountOffset),
           Immediate(1));
   __ Push(promise);
-
   Register debug_event = desc.GetRegisterParameter(2);
   __ LoadRoot(debug_event, RootIndex::kTrueValue);
   __ CallBuiltin(Builtin::kRejectPromise);
@@ -3872,28 +3839,23 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
   // Save current state in active jump buffer.
   // -------------------------------------------
   Label resume;
-  Register continuation = edx;
-  __ LoadRoot(continuation, RootIndex::kActiveContinuation);
-  Register jmpbuf = edi;
-  __ Move(jmpbuf,
-          FieldOperand(continuation, WasmContinuationObject::kStackOffset));
-  __ lea(jmpbuf, MemOperand(jmpbuf, wasm::StackMemory::jmpbuf_offset()));
-  FillJumpBuffer(masm, jmpbuf, ecx, &resume);
-  SwitchStackState(masm, jmpbuf, wasm::JumpBuffer::Active,
+  Register stack = edx;
+  __ LoadRootRelative(stack, IsolateData::active_stack_offset());
+  FillJumpBuffer(masm, stack, ecx, &resume);
+  SwitchStackState(masm, stack, wasm::JumpBuffer::Active,
                    wasm::JumpBuffer::Suspended);
-  jmpbuf = no_reg;
 
-  Register suspender_continuation = edi;
-  __ Move(suspender_continuation,
-          FieldOperand(suspender, WasmSuspenderObject::kContinuationOffset));
+  Register suspender_stack = edi;
+  __ Move(suspender_stack,
+          FieldOperand(suspender, WasmSuspenderObject::kStackOffset));
 #ifdef DEBUG
   // -------------------------------------------
-  // Check that the suspender's continuation is the active continuation.
+  // Check that the suspender's stack is the active stack.
   // -------------------------------------------
   // TODO(thibaudm): Once we add core stack-switching instructions, this check
-  // will not hold anymore: it's possible that the active continuation changed
+  // will not hold anymore: it's possible that the active stack changed
   // (due to an internal switch), so we have to update the suspender.
-  __ cmp(suspender_continuation, continuation);
+  __ cmp(suspender_stack, stack);
   Label ok;
   __ j(equal, &ok);
   __ Trap();
@@ -3904,9 +3866,8 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
   // Update roots.
   // -------------------------------------------
   Register caller = ecx;
-  __ Move(caller, FieldOperand(suspender_continuation,
-                               WasmContinuationObject::kParentOffset));
-  __ mov(masm->RootAsOperand(RootIndex::kActiveContinuation), caller);
+  __ Move(caller, Operand(suspender_stack, wasm::kStackParentOffset));
+  __ StoreRootRelative(IsolateData::active_stack_offset(), caller);
   Register parent = edi;
   __ Move(parent, FieldOperand(suspender, WasmSuspenderObject::kParentOffset));
   __ mov(masm->RootAsOperand(RootIndex::kActiveSuspender), parent);
@@ -3915,17 +3876,13 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
   // -------------------------------------------
   // Load jump buffer.
   // -------------------------------------------
-  SwitchStacks(masm, continuation, false, {caller, suspender});
-  jmpbuf = caller;
-  __ Move(jmpbuf, FieldOperand(caller, WasmContinuationObject::kStackOffset));
-  __ lea(jmpbuf, MemOperand(jmpbuf, wasm::StackMemory::jmpbuf_offset()));
-  caller = no_reg;
+  SwitchStacks(masm, stack, false, {caller, suspender});
   __ Move(kReturnRegister0,
           FieldOperand(suspender, WasmSuspenderObject::kPromiseOffset));
   MemOperand GCScanSlotPlace =
       MemOperand(ebp, StackSwitchFrameConstants::kGCScanSlotCountOffset);
   __ Move(GCScanSlotPlace, Immediate(0));
-  LoadJumpBuffer(masm, jmpbuf, true, wasm::JumpBuffer::Inactive);
+  LoadJumpBuffer(masm, caller, true, wasm::JumpBuffer::Inactive);
   __ Trap();
   __ bind(&resume);
   __ LeaveFrame(StackFrame::STACK_SWITCH);
@@ -3972,18 +3929,12 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
   // -------------------------------------------
 
   Label suspend;
-  Register active_continuation = edx;
-  __ LoadRoot(active_continuation, RootIndex::kActiveContinuation);
-  Register current_jmpbuf = eax;
-  __ Move(current_jmpbuf, FieldOperand(active_continuation,
-                                       WasmContinuationObject::kStackOffset));
-  __ lea(current_jmpbuf,
-         MemOperand(current_jmpbuf, wasm::StackMemory::jmpbuf_offset()));
-  active_continuation = no_reg;  // We reload this later.
-  FillJumpBuffer(masm, current_jmpbuf, edx, &suspend);
-  SwitchStackState(masm, current_jmpbuf, wasm::JumpBuffer::Active,
+  Register active_stack = eax;
+  __ LoadRootRelative(active_stack, IsolateData::active_stack_offset());
+  FillJumpBuffer(masm, active_stack, edx, &suspend);
+  SwitchStackState(masm, active_stack, wasm::JumpBuffer::Active,
                    wasm::JumpBuffer::Inactive);
-  current_jmpbuf = no_reg;
+  active_stack = no_reg;
 
   // -------------------------------------------
   // Set the suspender and continuation parents and update the roots.
@@ -4002,40 +3953,25 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
 
   active_suspender = no_reg;
 
-  Register target_continuation = suspender;
-  __ Move(target_continuation,
-          FieldOperand(suspender, WasmSuspenderObject::kContinuationOffset));
+  Register target_stack = suspender;
+  __ Move(target_stack,
+          FieldOperand(suspender, WasmSuspenderObject::kStackOffset));
   suspender = no_reg;
-  active_continuation = edx;
-  __ LoadRoot(active_continuation, RootIndex::kActiveContinuation);
-  __ mov(
-      FieldOperand(target_continuation, WasmContinuationObject::kParentOffset),
-      active_continuation);
-  __ push(active_continuation);
-  __ RecordWriteField(
-      target_continuation, WasmContinuationObject::kParentOffset,
-      active_continuation, slot_address, SaveFPRegsMode::kIgnore);
-  Register old_continuation = active_continuation;
-  __ pop(old_continuation);
-  __ mov(masm->RootAsOperand(RootIndex::kActiveContinuation),
-         target_continuation);
-  SwitchStacks(masm, old_continuation, false, {target_continuation});
+  active_stack = edx;
+  __ LoadRootRelative(active_stack, IsolateData::active_stack_offset());
+  __ StoreRootRelative(IsolateData::active_stack_offset(), target_stack);
+  SwitchStacks(masm, active_stack, false, {target_stack});
 
   // -------------------------------------------
   // Load state from target jmpbuf (longjmp).
   // -------------------------------------------
-  Register target_jmpbuf = edi;
-  __ Move(target_jmpbuf, FieldOperand(target_continuation,
-                                      WasmContinuationObject::kStackOffset));
-  __ lea(target_jmpbuf,
-         MemOperand(target_jmpbuf, wasm::StackMemory::jmpbuf_offset()));
   // Move resolved value to return register.
   __ mov(kReturnRegister0, Operand(ebp, 3 * kSystemPointerSize));
   __ Move(MemOperand(ebp, StackSwitchFrameConstants::kGCScanSlotCountOffset),
           Immediate(0));
   if (on_resume == wasm::OnResume::kThrow) {
-    // Switch to the continuation's stack without restoring the PC.
-    LoadJumpBuffer(masm, target_jmpbuf, false, wasm::JumpBuffer::Suspended);
+    // Switch without restoring the PC.
+    LoadJumpBuffer(masm, target_stack, false, wasm::JumpBuffer::Suspended);
     // Pop this frame now. The unwinder expects that the first STACK_SWITCH
     // frame is the outermost one.
     __ LeaveFrame(StackFrame::STACK_SWITCH);
@@ -4044,8 +3980,8 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
     __ Move(kContextRegister, Smi::zero());
     __ CallRuntime(Runtime::kThrow);
   } else {
-    // Resume the continuation normally.
-    LoadJumpBuffer(masm, target_jmpbuf, true, wasm::JumpBuffer::Suspended);
+    // Resume the stack normally.
+    LoadJumpBuffer(masm, target_stack, true, wasm::JumpBuffer::Suspended);
   }
   __ Trap();
   __ bind(&suspend);
diff --git a/deps/v8/src/builtins/js-to-wasm.tq b/deps/v8/src/builtins/js-to-wasm.tq
index 1ccfa6d9c70154..3e8ba12d73b275 100644
--- a/deps/v8/src/builtins/js-to-wasm.tq
+++ b/deps/v8/src/builtins/js-to-wasm.tq
@@ -135,6 +135,8 @@ const kValueTypeHasIndexBit:
     constexpr uint32 generates 'wasm::ValueType::kHasIndexBit';
 const kValueTypeIsNullableBit:
     constexpr uint32 generates 'wasm::ValueType::kIsNullableBit';
+const kValueTypeIsSharedBit:
+    constexpr uint32 generates 'wasm::ValueType::kIsSharedBit';
 
 const kValueTypeRefKindBits:
     constexpr uint32 generates 'wasm::ValueType::kRefKindBits';
@@ -465,7 +467,9 @@ macro JSToWasmObject(
       if (!isNullable && value == Null) {
         ThrowTypeError(MessageTemplate::kWasmTrapJSTypeError);
       }
-      return value;
+      if ((targetType & kValueTypeIsSharedBit) == 0) {
+        return value;
+      }
     }
     if (standardType == ToUint(StandardType::kString)) {
       if (TaggedIsSmi(value)) {
diff --git a/deps/v8/src/builtins/loong64/builtins-loong64.cc b/deps/v8/src/builtins/loong64/builtins-loong64.cc
index 42f6c346733dba..26523e2f004966 100644
--- a/deps/v8/src/builtins/loong64/builtins-loong64.cc
+++ b/deps/v8/src/builtins/loong64/builtins-loong64.cc
@@ -1167,7 +1167,6 @@ void Builtins::Generate_InterpreterEntryTrampoline(
       sfi, FieldMemOperand(closure, JSFunction::kSharedFunctionInfoOffset));
   ResetSharedFunctionInfoAge(masm, sfi);
 
-
   // The bytecode array could have been flushed from the shared function info,
   // if so, call into CompileLazy.
   Label is_baseline, compile_lazy;
@@ -3069,85 +3068,62 @@ void Builtins::Generate_WasmDebugBreak(MacroAssembler* masm) {
 namespace {
 // Check that the stack was in the old state (if generated code assertions are
 // enabled), and switch to the new state.
-void SwitchStackState(MacroAssembler* masm, Register jmpbuf, Register tmp,
+void SwitchStackState(MacroAssembler* masm, Register stack, Register tmp,
                       wasm::JumpBuffer::StackState old_state,
                       wasm::JumpBuffer::StackState new_state) {
 #if V8_ENABLE_SANDBOX
-  __ Ld_w(tmp, MemOperand(jmpbuf, wasm::kJmpBufStateOffset));
+  __ Ld_w(tmp, MemOperand(stack, wasm::kStackStateOffset));
   Label ok;
   __ JumpIfEqual(tmp, old_state, &ok);
   __ Trap();
   __ bind(&ok);
 #endif
   __ li(tmp, Operand(new_state));
-  __ St_w(tmp, MemOperand(jmpbuf, wasm::kJmpBufStateOffset));
+  __ St_w(tmp, MemOperand(stack, wasm::kStackStateOffset));
 }
 
 // Switch the stack pointer.
-void SwitchStackPointer(MacroAssembler* masm, Register jmpbuf) {
-  __ Ld_d(sp, MemOperand(jmpbuf, wasm::kJmpBufSpOffset));
+void SwitchStackPointer(MacroAssembler* masm, Register stack) {
+  __ Ld_d(sp, MemOperand(stack, wasm::kStackSpOffset));
 }
 
-void FillJumpBuffer(MacroAssembler* masm, Register jmpbuf, Label* target,
+void FillJumpBuffer(MacroAssembler* masm, Register stack, Label* target,
                     Register tmp) {
   __ mov(tmp, sp);
-  __ St_d(tmp, MemOperand(jmpbuf, wasm::kJmpBufSpOffset));
-  __ St_d(fp, MemOperand(jmpbuf, wasm::kJmpBufFpOffset));
+  __ St_d(tmp, MemOperand(stack, wasm::kStackSpOffset));
+  __ St_d(fp, MemOperand(stack, wasm::kStackFpOffset));
   __ LoadStackLimit(tmp, __ StackLimitKind::kRealStackLimit);
-  __ St_d(tmp, MemOperand(jmpbuf, wasm::kJmpBufStackLimitOffset));
+  __ St_d(tmp, MemOperand(stack, wasm::kStackLimitOffset));
 
   __ LoadLabelRelative(tmp, target);
   // Stash the address in the jump buffer.
-  __ St_d(tmp, MemOperand(jmpbuf, wasm::kJmpBufPcOffset));
+  __ St_d(tmp, MemOperand(stack, wasm::kStackPcOffset));
 }
 
-void LoadJumpBuffer(MacroAssembler* masm, Register jmpbuf, bool load_pc,
+void LoadJumpBuffer(MacroAssembler* masm, Register stack, bool load_pc,
                     Register tmp, wasm::JumpBuffer::StackState expected_state) {
-  SwitchStackPointer(masm, jmpbuf);
-  __ Ld_d(fp, MemOperand(jmpbuf, wasm::kJmpBufFpOffset));
-  SwitchStackState(masm, jmpbuf, tmp, expected_state, wasm::JumpBuffer::Active);
+  SwitchStackPointer(masm, stack);
+  __ Ld_d(fp, MemOperand(stack, wasm::kStackFpOffset));
+  SwitchStackState(masm, stack, tmp, expected_state, wasm::JumpBuffer::Active);
   if (load_pc) {
-    __ Ld_d(tmp, MemOperand(jmpbuf, wasm::kJmpBufPcOffset));
+    __ Ld_d(tmp, MemOperand(stack, wasm::kStackPcOffset));
     __ Jump(tmp);
   }
   // The stack limit in StackGuard is set separately under the ExecutionAccess
   // lock.
 }
 
-void SaveState(MacroAssembler* masm, Register active_continuation, Register tmp,
-               Label* suspend) {
-  Register jmpbuf = tmp;
-  __ LoadExternalPointerField(
-      jmpbuf,
-      FieldMemOperand(active_continuation,
-                      WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag);
-  __ Add_d(jmpbuf, jmpbuf, wasm::StackMemory::jmpbuf_offset());
-
-  UseScratchRegisterScope temps(masm);
-  FillJumpBuffer(masm, jmpbuf, suspend, temps.Acquire());
-}
-
-void LoadTargetJumpBuffer(MacroAssembler* masm, Register target_continuation,
+void LoadTargetJumpBuffer(MacroAssembler* masm, Register target_stack,
                           Register tmp,
                           wasm::JumpBuffer::StackState expected_state) {
-  Register target_jmpbuf = target_continuation;
-  __ LoadExternalPointerField(
-      target_jmpbuf,
-      FieldMemOperand(target_continuation,
-                      WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag);
-  __ Add_d(target_jmpbuf, target_jmpbuf, wasm::StackMemory::jmpbuf_offset());
-
   __ St_d(zero_reg,
           MemOperand(fp, StackSwitchFrameConstants::kGCScanSlotCountOffset));
   // Switch stack!
-  LoadJumpBuffer(masm, target_jmpbuf, false, tmp, expected_state);
+  LoadJumpBuffer(masm, target_stack, false, tmp, expected_state);
 }
 
 // Updates the stack limit and central stack info, and validates the switch.
-void SwitchStacks(MacroAssembler* masm, Register old_continuation,
-                  bool return_switch,
+void SwitchStacks(MacroAssembler* masm, Register old_stack, bool return_switch,
                   const std::initializer_list<Register> keep) {
   using ER = ExternalReference;
 
@@ -3156,10 +3132,15 @@ void SwitchStacks(MacroAssembler* masm, Register old_continuation,
   }
 
   {
-    __ PrepareCallCFunction(2, a0);
+    Register scratch = kCArgRegs[0];
+    if (scratch == old_stack) {
+      scratch = kCArgRegs[1];
+    }
+    __ PrepareCallCFunction(2, scratch);
     FrameScope scope(masm, StackFrame::MANUAL);
+    // Move {old_stack} first in case it aliases kCArgRegs[0].
+    __ mov(kCArgRegs[1], old_stack);
     __ li(kCArgRegs[0], ExternalReference::isolate_address(masm->isolate()));
-    __ mov(kCArgRegs[1], old_continuation);
     __ CallCFunction(
         return_switch ? ER::wasm_return_switch() : ER::wasm_switch_stacks(), 2);
   }
@@ -3169,52 +3150,34 @@ void SwitchStacks(MacroAssembler* masm, Register old_continuation,
   }
 }
 
-void ReloadParentContinuation(MacroAssembler* masm, Register return_reg,
-                              Register return_value, Register context,
-                              Register tmp1, Register tmp2, Register tmp3) {
-  Register active_continuation = tmp1;
-  __ LoadRoot(active_continuation, RootIndex::kActiveContinuation);
+void ReloadParentStack(MacroAssembler* masm, Register return_reg,
+                       Register return_value, Register context, Register tmp1,
+                       Register tmp2, Register tmp3) {
+  Register active_stack = tmp1;
+  __ LoadRootRelative(active_stack, IsolateData::active_stack_offset());
 
   // Set a null pointer in the jump buffer's SP slot to indicate to the stack
   // frame iterator that this stack is empty.
-  Register jmpbuf = tmp2;
-  __ LoadExternalPointerField(
-      jmpbuf,
-      FieldMemOperand(active_continuation,
-                      WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag);
-  __ Add_d(jmpbuf, jmpbuf, wasm::StackMemory::jmpbuf_offset());
-  __ St_d(zero_reg, MemOperand(jmpbuf, wasm::kJmpBufSpOffset));
+  __ St_d(zero_reg, MemOperand(active_stack, wasm::kStackSpOffset));
   {
     UseScratchRegisterScope temps(masm);
     Register scratch = temps.Acquire();
-    SwitchStackState(masm, jmpbuf, scratch, wasm::JumpBuffer::Active,
+    SwitchStackState(masm, active_stack, scratch, wasm::JumpBuffer::Active,
                      wasm::JumpBuffer::Retired);
   }
   Register parent = tmp2;
-  __ LoadTaggedField(parent,
-                     FieldMemOperand(active_continuation,
-                                     WasmContinuationObject::kParentOffset));
+  __ Ld_d(parent, MemOperand(active_stack, wasm::kStackParentOffset));
 
-  // Update active continuation root.
-  int32_t active_continuation_offset =
-      MacroAssembler::RootRegisterOffsetForRootIndex(
-          RootIndex::kActiveContinuation);
-  __ St_d(parent, MemOperand(kRootRegister, active_continuation_offset));
-  jmpbuf = parent;
-  __ LoadExternalPointerField(
-      jmpbuf, FieldMemOperand(parent, WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag);
-  __ Add_d(jmpbuf, jmpbuf, wasm::StackMemory::jmpbuf_offset());
+  // Update active stack.
+  __ StoreRootRelative(IsolateData::active_stack_offset(), parent);
 
   // Switch stack!
-  SwitchStacks(masm, active_continuation, true,
-               {return_reg, return_value, context, jmpbuf});
-  LoadJumpBuffer(masm, jmpbuf, false, tmp3, wasm::JumpBuffer::Inactive);
+  SwitchStacks(masm, active_stack, true,
+               {return_reg, return_value, context, parent});
+  LoadJumpBuffer(masm, parent, false, tmp3, wasm::JumpBuffer::Inactive);
 }
 
-void RestoreParentSuspender(MacroAssembler* masm, Register tmp1,
-                            Register tmp2) {
+void RestoreParentSuspender(MacroAssembler* masm, Register tmp1) {
   Register suspender = tmp1;
   __ LoadRoot(suspender, RootIndex::kActiveSuspender);
   __ LoadTaggedField(
@@ -3453,33 +3416,28 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
   // Save current state in active jump buffer.
   // -------------------------------------------
   Label resume;
-  DEFINE_REG(continuation);
-  __ LoadRoot(continuation, RootIndex::kActiveContinuation);
-  DEFINE_REG(jmpbuf);
+  DEFINE_REG(stack);
+  __ LoadRootRelative(stack, IsolateData::active_stack_offset());
   DEFINE_REG(scratch);
-  __ LoadExternalPointerField(
-      jmpbuf,
-      FieldMemOperand(continuation, WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag);
-  __ Add_d(jmpbuf, jmpbuf, wasm::StackMemory::jmpbuf_offset());
-  FillJumpBuffer(masm, jmpbuf, &resume, scratch);
-  SwitchStackState(masm, jmpbuf, scratch, wasm::JumpBuffer::Active,
+  FillJumpBuffer(masm, stack, &resume, scratch);
+  SwitchStackState(masm, stack, scratch, wasm::JumpBuffer::Active,
                    wasm::JumpBuffer::Suspended);
-  regs.ResetExcept(suspender, continuation);
+  regs.ResetExcept(suspender, stack);
 
-  DEFINE_REG(suspender_continuation);
-  __ LoadTaggedField(
-      suspender_continuation,
-      FieldMemOperand(suspender, WasmSuspenderObject::kContinuationOffset));
+  DEFINE_REG(suspender_stack);
+  __ LoadExternalPointerField(
+      suspender_stack,
+      FieldMemOperand(suspender, WasmSuspenderObject::kStackOffset),
+      kWasmStackMemoryTag);
   if (v8_flags.debug_code) {
     // -------------------------------------------
-    // Check that the suspender's continuation is the active continuation.
+    // Check that the suspender's stack is the active stack.
     // -------------------------------------------
     // TODO(thibaudm): Once we add core stack-switching instructions, this
-    // check will not hold anymore: it's possible that the active continuation
+    // check will not hold anymore: it's possible that the active stack
     // changed (due to an internal switch), so we have to update the suspender.
     Label ok;
-    __ Branch(&ok, eq, suspender_continuation, Operand(continuation));
+    __ Branch(&ok, eq, suspender_stack, Operand(stack));
     __ Trap();
     __ bind(&ok);
   }
@@ -3487,13 +3445,8 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
   // Update roots.
   // -------------------------------------------
   DEFINE_REG(caller);
-  __ LoadTaggedField(caller,
-                     FieldMemOperand(suspender_continuation,
-                                     WasmContinuationObject::kParentOffset));
-  int32_t active_continuation_offset =
-      MacroAssembler::RootRegisterOffsetForRootIndex(
-          RootIndex::kActiveContinuation);
-  __ St_d(caller, MemOperand(kRootRegister, active_continuation_offset));
+  __ Ld_d(caller, MemOperand(suspender_stack, wasm::kStackParentOffset));
+  __ StoreRootRelative(IsolateData::active_stack_offset(), caller);
   DEFINE_REG(parent);
   __ LoadTaggedField(
       parent, FieldMemOperand(suspender, WasmSuspenderObject::kParentOffset));
@@ -3501,18 +3454,13 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
       MacroAssembler::RootRegisterOffsetForRootIndex(
           RootIndex::kActiveSuspender);
   __ St_d(parent, MemOperand(kRootRegister, active_suspender_offset));
-  regs.ResetExcept(suspender, caller, continuation);
+  regs.ResetExcept(suspender, caller, stack);
 
   // -------------------------------------------
   // Load jump buffer.
   // -------------------------------------------
-  SwitchStacks(masm, continuation, false, {caller, suspender});
-  FREE_REG(continuation);
-  ASSIGN_REG(jmpbuf);
-  __ LoadExternalPointerField(
-      jmpbuf, FieldMemOperand(caller, WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag);
-  __ Add_d(jmpbuf, jmpbuf, wasm::StackMemory::jmpbuf_offset());
+  SwitchStacks(masm, stack, false, {caller, suspender});
+  FREE_REG(stack);
   __ LoadTaggedField(
       kReturnRegister0,
       FieldMemOperand(suspender, WasmSuspenderObject::kPromiseOffset));
@@ -3520,7 +3468,7 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
       MemOperand(fp, StackSwitchFrameConstants::kGCScanSlotCountOffset);
   __ St_d(zero_reg, GCScanSlotPlace);
   ASSIGN_REG(scratch)
-  LoadJumpBuffer(masm, jmpbuf, true, scratch, wasm::JumpBuffer::Inactive);
+  LoadJumpBuffer(masm, caller, true, scratch, wasm::JumpBuffer::Inactive);
   __ Trap();
   __ bind(&resume);
   __ LeaveFrame(StackFrame::STACK_SWITCH);
@@ -3572,23 +3520,15 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
   // Save current state.
   // -------------------------------------------
   Label suspend;
-  DEFINE_REG(active_continuation);
-  __ LoadRoot(active_continuation, RootIndex::kActiveContinuation);
-  DEFINE_REG(current_jmpbuf);
+  DEFINE_REG(active_stack);
+  __ LoadRootRelative(active_stack, IsolateData::active_stack_offset());
   DEFINE_REG(scratch);
-  __ LoadExternalPointerField(
-      current_jmpbuf,
-      FieldMemOperand(active_continuation,
-                      WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag);
-  __ Add_d(current_jmpbuf, current_jmpbuf, wasm::StackMemory::jmpbuf_offset());
-  FillJumpBuffer(masm, current_jmpbuf, &suspend, scratch);
-  SwitchStackState(masm, current_jmpbuf, scratch, wasm::JumpBuffer::Active,
+  FillJumpBuffer(masm, active_stack, &suspend, scratch);
+  SwitchStackState(masm, active_stack, scratch, wasm::JumpBuffer::Active,
                    wasm::JumpBuffer::Inactive);
-  FREE_REG(current_jmpbuf);
 
   // -------------------------------------------
-  // Set the suspender and continuation parents and update the roots
+  // Set the suspender and stack parents and update the roots
   // -------------------------------------------
   DEFINE_REG(active_suspender);
   __ LoadRoot(active_suspender, RootIndex::kActiveSuspender);
@@ -3603,55 +3543,32 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
           RootIndex::kActiveSuspender);
   __ St_d(suspender, MemOperand(kRootRegister, active_suspender_offset));
 
-  // Next line we are going to load a field from suspender, but we have to use
-  // the same register for target_continuation to use it in RecordWriteField.
-  // So, free suspender here to use pinned reg, but load from it next line.
+  DEFINE_REG(target_stack);
+  __ LoadExternalPointerField(
+      target_stack,
+      FieldMemOperand(suspender, WasmSuspenderObject::kStackOffset),
+      kWasmStackMemoryTag);
   FREE_REG(suspender);
-  DEFINE_PINNED(target_continuation, WriteBarrierDescriptor::ObjectRegister());
-  suspender = target_continuation;
-  __ LoadTaggedField(
-      target_continuation,
-      FieldMemOperand(suspender, WasmSuspenderObject::kContinuationOffset));
-  suspender = no_reg;
-
-  __ StoreTaggedField(active_continuation,
-                      FieldMemOperand(target_continuation,
-                                      WasmContinuationObject::kParentOffset));
-  DEFINE_REG(old_continuation);
-  __ Move(old_continuation, active_continuation);
-  __ RecordWriteField(
-      target_continuation, WasmContinuationObject::kParentOffset,
-      active_continuation, kRAHasBeenSaved, SaveFPRegsMode::kIgnore);
-  int32_t active_continuation_offset =
-      MacroAssembler::RootRegisterOffsetForRootIndex(
-          RootIndex::kActiveContinuation);
-  __ St_d(target_continuation,
-          MemOperand(kRootRegister, active_continuation_offset));
 
-  SwitchStacks(masm, old_continuation, false, {target_continuation});
+  __ StoreRootRelative(IsolateData::active_stack_offset(), target_stack);
+
+  SwitchStacks(masm, active_stack, false, {target_stack});
 
-  regs.ResetExcept(target_continuation);
+  regs.ResetExcept(target_stack);
 
   // -------------------------------------------
   // Load state from target jmpbuf (longjmp).
   // -------------------------------------------
   regs.Reserve(kReturnRegister0);
-  DEFINE_REG(target_jmpbuf);
   ASSIGN_REG(scratch);
-  __ LoadExternalPointerField(
-      target_jmpbuf,
-      FieldMemOperand(target_continuation,
-                      WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag);
-  __ Add_d(target_jmpbuf, target_jmpbuf, wasm::StackMemory::jmpbuf_offset());
   // Move resolved value to return register.
   __ Ld_d(kReturnRegister0, MemOperand(fp, 3 * kSystemPointerSize));
   MemOperand GCScanSlotPlace =
       MemOperand(fp, StackSwitchFrameConstants::kGCScanSlotCountOffset);
   __ St_d(zero_reg, GCScanSlotPlace);
   if (on_resume == wasm::OnResume::kThrow) {
-    // Switch to the continuation's stack without restoring the PC.
-    LoadJumpBuffer(masm, target_jmpbuf, false, scratch,
+    // Switch without restoring the PC.
+    LoadJumpBuffer(masm, target_stack, false, scratch,
                    wasm::JumpBuffer::Suspended);
     // Pop this frame now. The unwinder expects that the first STACK_SWITCH
     // frame is the outermost one.
@@ -3660,8 +3577,8 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
     __ Push(kReturnRegister0);
     __ CallRuntime(Runtime::kThrow);
   } else {
-    // Resume the continuation normally.
-    LoadJumpBuffer(masm, target_jmpbuf, true, scratch,
+    // Resume the stack normally.
+    LoadJumpBuffer(masm, target_stack, true, scratch,
                    wasm::JumpBuffer::Suspended);
   }
   __ Trap();
@@ -3693,27 +3610,21 @@ void SwitchToAllocatedStack(MacroAssembler* masm, RegisterAllocator& regs,
                             Label* suspend) {
   ResetStackSwitchFrameStackSlots(masm);
   DEFINE_SCOPED(scratch)
-  DEFINE_REG(target_continuation)
-  __ LoadRoot(target_continuation, RootIndex::kActiveContinuation);
-  DEFINE_REG(parent_continuation)
-  __ LoadTaggedField(parent_continuation,
-                     FieldMemOperand(target_continuation,
-                                     WasmContinuationObject::kParentOffset));
-
-  SaveState(masm, parent_continuation, scratch, suspend);
-
-  SwitchStacks(masm, parent_continuation, false,
-               {wasm_instance, wrapper_buffer});
-
-  FREE_REG(parent_continuation);
+  DEFINE_REG(parent_stack)
+  __ LoadRootRelative(parent_stack, IsolateData::active_stack_offset());
+  __ Ld_d(parent_stack, MemOperand(parent_stack, wasm::kStackParentOffset));
+  FillJumpBuffer(masm, parent_stack, suspend, scratch);
+  SwitchStacks(masm, parent_stack, false, {wasm_instance, wrapper_buffer});
+  FREE_REG(parent_stack);
   // Save the old stack's fp in t0, and use it to access the parameters in
   // the parent frame.
   regs.Pinned(t1, &original_fp);
   __ mov(original_fp, fp);
-  __ LoadRoot(target_continuation, RootIndex::kActiveContinuation);
-  LoadTargetJumpBuffer(masm, target_continuation, scratch,
+  DEFINE_REG(target_stack);
+  __ LoadRootRelative(target_stack, IsolateData::active_stack_offset());
+  LoadTargetJumpBuffer(masm, target_stack, scratch,
                        wasm::JumpBuffer::Suspended);
-  FREE_REG(target_continuation);
+  FREE_REG(target_stack);
 
   // Push the loaded fp. We know it is null, because there is no frame yet,
   // so we could also push 0 directly. In any case we need to push it,
@@ -3776,9 +3687,9 @@ void SwitchBackAndReturnPromise(MacroAssembler* masm, RegisterAllocator& regs,
           MemOperand(fp, StackSwitchFrameConstants::kImplicitArgOffset));
   GetContextFromImplicitArg(masm, kContextRegister, tmp);
 
-  ReloadParentContinuation(masm, promise, return_value, kContextRegister, tmp,
-                           tmp2, tmp3);
-  RestoreParentSuspender(masm, tmp, tmp2);
+  ReloadParentStack(masm, promise, return_value, kContextRegister, tmp, tmp2,
+                    tmp3);
+  RestoreParentSuspender(masm, tmp);
 
   if (mode == wasm::kPromise) {
     __ li(tmp, Operand(1));
@@ -3827,9 +3738,8 @@ void GenerateExceptionHandlingLandingPad(MacroAssembler* masm,
   DEFINE_SCOPED(tmp2);
   DEFINE_SCOPED(tmp3);
   GetContextFromImplicitArg(masm, kContextRegister, tmp);
-  ReloadParentContinuation(masm, promise, reason, kContextRegister, tmp, tmp2,
-                           tmp3);
-  RestoreParentSuspender(masm, tmp, tmp2);
+  ReloadParentStack(masm, promise, reason, kContextRegister, tmp, tmp2, tmp3);
+  RestoreParentSuspender(masm, tmp);
 
   __ li(tmp, Operand(1));
   __ St_d(tmp,
@@ -4238,14 +4148,7 @@ void Builtins::Generate_CEntry(MacroAssembler* masm, int result_size,
 
   __ StoreReturnAddressAndCall(target_fun);
 
-#if V8_ENABLE_WEBASSEMBLY
-  if (switch_to_central_stack) {
-    SwitchFromTheCentralStackIfNeeded(masm);
-  }
-#endif  // V8_ENABLE_WEBASSEMBLY
-
   // Result returned in a0 or a1:a0 - do not destroy these registers!
-
   // Check result for exception sentinel.
   Label exception_returned;
   // The returned value may be a trusted object, living outside of the main
@@ -4253,6 +4156,12 @@ void Builtins::Generate_CEntry(MacroAssembler* masm, int result_size,
   __ CompareRootAndBranch(a0, RootIndex::kException, eq, &exception_returned,
                           ComparisonMode::kFullPointer);
 
+#if V8_ENABLE_WEBASSEMBLY
+  if (switch_to_central_stack) {
+    SwitchFromTheCentralStackIfNeeded(masm);
+  }
+#endif  // V8_ENABLE_WEBASSEMBLY
+
   // Check that there is no exception, otherwise we
   // should have returned the exception sentinel.
   if (v8_flags.debug_code) {
diff --git a/deps/v8/src/builtins/ppc/builtins-ppc.cc b/deps/v8/src/builtins/ppc/builtins-ppc.cc
index fd74da9c77c5fe..ae30775121f3dc 100644
--- a/deps/v8/src/builtins/ppc/builtins-ppc.cc
+++ b/deps/v8/src/builtins/ppc/builtins-ppc.cc
@@ -3124,81 +3124,59 @@ void Builtins::Generate_WasmDebugBreak(MacroAssembler* masm) {
 namespace {
 // Check that the stack was in the old state (if generated code assertions are
 // enabled), and switch to the new state.
-void SwitchStackState(MacroAssembler* masm, Register jmpbuf, Register tmp,
+void SwitchStackState(MacroAssembler* masm, Register stack, Register tmp,
                       wasm::JumpBuffer::StackState old_state,
                       wasm::JumpBuffer::StackState new_state) {
-  __ LoadU32(tmp, MemOperand(jmpbuf, wasm::kJmpBufStateOffset));
+  __ LoadU32(tmp, MemOperand(stack, wasm::kStackStateOffset));
   Label ok;
   __ JumpIfEqual(tmp, old_state, &ok);
   __ Trap();
   __ bind(&ok);
   __ mov(tmp, Operand(new_state));
-  __ StoreU32(tmp, MemOperand(jmpbuf, wasm::kJmpBufStateOffset), r0);
+  __ StoreU32(tmp, MemOperand(stack, wasm::kStackStateOffset), r0);
 }
 
 // Switch the stack pointer.
-void SwitchStackPointer(MacroAssembler* masm, Register jmpbuf) {
-  __ LoadU64(sp, MemOperand(jmpbuf, wasm::kJmpBufSpOffset));
+void SwitchStackPointer(MacroAssembler* masm, Register stack) {
+  __ LoadU64(sp, MemOperand(stack, wasm::kStackSpOffset));
 }
 
-void FillJumpBuffer(MacroAssembler* masm, Register jmpbuf, Label* target,
+void FillJumpBuffer(MacroAssembler* masm, Register stack, Label* target,
                     Register tmp) {
   __ mr(tmp, sp);
-  __ StoreU64(tmp, MemOperand(jmpbuf, wasm::kJmpBufSpOffset));
-  __ StoreU64(fp, MemOperand(jmpbuf, wasm::kJmpBufFpOffset));
+  __ StoreU64(tmp, MemOperand(stack, wasm::kStackSpOffset));
+  __ StoreU64(fp, MemOperand(stack, wasm::kStackFpOffset));
   __ LoadStackLimit(tmp, StackLimitKind::kRealStackLimit, r0);
-  __ StoreU64(tmp, MemOperand(jmpbuf, wasm::kJmpBufStackLimitOffset));
+  __ StoreU64(tmp, MemOperand(stack, wasm::kStackLimitOffset));
 
   __ GetLabelAddress(tmp, target);
   // Stash the address in the jump buffer.
-  __ StoreU64(tmp, MemOperand(jmpbuf, wasm::kJmpBufPcOffset));
+  __ StoreU64(tmp, MemOperand(stack, wasm::kStackPcOffset));
 }
 
-void LoadJumpBuffer(MacroAssembler* masm, Register jmpbuf, bool load_pc,
+void LoadJumpBuffer(MacroAssembler* masm, Register stack, bool load_pc,
                     Register tmp, wasm::JumpBuffer::StackState expected_state) {
-  SwitchStackPointer(masm, jmpbuf);
-  __ LoadU64(fp, MemOperand(jmpbuf, wasm::kJmpBufFpOffset));
-  SwitchStackState(masm, jmpbuf, tmp, expected_state, wasm::JumpBuffer::Active);
+  SwitchStackPointer(masm, stack);
+  __ LoadU64(fp, MemOperand(stack, wasm::kStackFpOffset));
+  SwitchStackState(masm, stack, tmp, expected_state, wasm::JumpBuffer::Active);
   if (load_pc) {
-    __ LoadU64(tmp, MemOperand(jmpbuf, wasm::kJmpBufPcOffset));
+    __ LoadU64(tmp, MemOperand(stack, wasm::kStackPcOffset));
     __ Jump(tmp);
   }
   // The stack limit in StackGuard is set separately under the ExecutionAccess
   // lock.
 }
 
-void SaveState(MacroAssembler* masm, Register active_continuation, Register tmp,
-               Label* suspend) {
-  Register jmpbuf = tmp;
-  __ LoadU64(jmpbuf,
-             FieldMemOperand(active_continuation,
-                             WasmContinuationObject::kStackOffset),
-             r0);
-  __ AddS64(jmpbuf, jmpbuf, Operand(wasm::StackMemory::jmpbuf_offset()));
-
-  UseScratchRegisterScope temps(masm);
-  FillJumpBuffer(masm, jmpbuf, suspend, temps.Acquire());
-}
-
-void LoadTargetJumpBuffer(MacroAssembler* masm, Register target_continuation,
+void LoadTargetJumpBuffer(MacroAssembler* masm, Register target_stack,
                           Register tmp,
                           wasm::JumpBuffer::StackState expected_state) {
-  Register target_jmpbuf = target_continuation;
-  __ LoadU64(target_jmpbuf,
-             FieldMemOperand(target_continuation,
-                             WasmContinuationObject::kStackOffset),
-             r0);
-  __ AddS64(target_jmpbuf, target_jmpbuf,
-            Operand(wasm::StackMemory::jmpbuf_offset()));
-
   __ Zero(MemOperand(fp, StackSwitchFrameConstants::kGCScanSlotCountOffset));
   // Switch stack!
-  LoadJumpBuffer(masm, target_jmpbuf, false, tmp, expected_state);
+  LoadJumpBuffer(masm, target_stack, false, tmp, expected_state);
 }
 
 // Updates the stack limit and central stack info, and validates the switch.
-void SwitchStacks(MacroAssembler* masm, Register old_continuation,
-                  bool return_switch,
+void SwitchStacks(MacroAssembler* masm, Register old_stack, bool return_switch,
                   const std::initializer_list<Register> keep) {
   using ER = ExternalReference;
 
@@ -3209,8 +3187,9 @@ void SwitchStacks(MacroAssembler* masm, Register old_continuation,
   {
     __ PrepareCallCFunction(2, r0);
     FrameScope scope(masm, StackFrame::MANUAL);
+    // Move {old_stack} first in case it aliases kCArgRegs[0].
+    __ Move(kCArgRegs[1], old_stack);
     __ Move(kCArgRegs[0], ExternalReference::isolate_address(masm->isolate()));
-    __ Move(kCArgRegs[1], old_continuation);
     __ CallCFunction(
         return_switch ? ER::wasm_return_switch() : ER::wasm_switch_stacks(), 2);
   }
@@ -3220,51 +3199,34 @@ void SwitchStacks(MacroAssembler* masm, Register old_continuation,
   }
 }
 
-void ReloadParentContinuation(MacroAssembler* masm, Register return_reg,
-                              Register return_value, Register context,
-                              Register tmp1, Register tmp2, Register tmp3) {
-  Register active_continuation = tmp1;
-  __ LoadRoot(active_continuation, RootIndex::kActiveContinuation);
+void ReloadParentStack(MacroAssembler* masm, Register return_reg,
+                       Register return_value, Register context, Register tmp1,
+                       Register tmp2, Register tmp3) {
+  Register active_stack = tmp1;
+  __ LoadRootRelative(active_stack, IsolateData::active_stack_offset());
 
   // Set a null pointer in the jump buffer's SP slot to indicate to the stack
   // frame iterator that this stack is empty.
-  Register jmpbuf = tmp2;
-  __ LoadU64(jmpbuf,
-             FieldMemOperand(active_continuation,
-                             WasmContinuationObject::kStackOffset),
-             r0);
-  __ AddS64(jmpbuf, jmpbuf, Operand(wasm::StackMemory::jmpbuf_offset()));
-  __ Zero(MemOperand(jmpbuf, wasm::kJmpBufSpOffset));
+  __ Zero(MemOperand(active_stack, wasm::kStackSpOffset));
   {
     UseScratchRegisterScope temps(masm);
     Register scratch = temps.Acquire();
-    SwitchStackState(masm, jmpbuf, scratch, wasm::JumpBuffer::Active,
+    SwitchStackState(masm, active_stack, scratch, wasm::JumpBuffer::Active,
                      wasm::JumpBuffer::Retired);
   }
   Register parent = tmp2;
-  __ LoadTaggedField(parent,
-                     FieldMemOperand(active_continuation,
-                                     WasmContinuationObject::kParentOffset),
-                     r0);
+  __ LoadU64(parent, MemOperand(active_stack, wasm::kStackParentOffset), r0);
 
-  // Update active continuation root.
-  int32_t active_continuation_offset =
-      MacroAssembler::RootRegisterOffsetForRootIndex(
-          RootIndex::kActiveContinuation);
-  __ StoreU64(parent, MemOperand(kRootRegister, active_continuation_offset));
-  jmpbuf = parent;
-  __ LoadU64(jmpbuf,
-             FieldMemOperand(parent, WasmContinuationObject::kStackOffset), r0);
-  __ AddS64(jmpbuf, jmpbuf, Operand(wasm::StackMemory::jmpbuf_offset()));
+  // Update active stack.
+  __ StoreRootRelative(IsolateData::active_stack_offset(), parent);
 
   // Switch stack!
-  SwitchStacks(masm, active_continuation, true,
-               {return_reg, return_value, context, jmpbuf});
-  LoadJumpBuffer(masm, jmpbuf, false, tmp3, wasm::JumpBuffer::Inactive);
+  SwitchStacks(masm, active_stack, true,
+               {return_reg, return_value, context, parent});
+  LoadJumpBuffer(masm, parent, false, tmp3, wasm::JumpBuffer::Inactive);
 }
 
-void RestoreParentSuspender(MacroAssembler* masm, Register tmp1,
-                            Register tmp2) {
+void RestoreParentSuspender(MacroAssembler* masm, Register tmp1) {
   Register suspender = tmp1;
   __ LoadRoot(suspender, RootIndex::kActiveSuspender);
   __ LoadTaggedField(
@@ -3476,31 +3438,25 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
   // Save current state in active jump buffer.
   // -------------------------------------------
   Label resume;
-  DEFINE_REG(continuation);
-  __ LoadRoot(continuation, RootIndex::kActiveContinuation);
-  DEFINE_REG(jmpbuf);
+  DEFINE_REG(stack);
+  __ LoadRootRelative(stack, IsolateData::active_stack_offset());
   DEFINE_REG(scratch);
-  __ LoadU64(
-      jmpbuf,
-      FieldMemOperand(continuation, WasmContinuationObject::kStackOffset), r0);
-  __ AddS64(jmpbuf, jmpbuf, Operand(wasm::StackMemory::jmpbuf_offset()));
-  FillJumpBuffer(masm, jmpbuf, &resume, scratch);
-  SwitchStackState(masm, jmpbuf, scratch, wasm::JumpBuffer::Active,
+  FillJumpBuffer(masm, stack, &resume, scratch);
+  SwitchStackState(masm, stack, scratch, wasm::JumpBuffer::Active,
                    wasm::JumpBuffer::Suspended);
-  regs.ResetExcept(suspender, continuation);
+  regs.ResetExcept(suspender, stack);
 
-  DEFINE_REG(suspender_continuation);
-  __ LoadTaggedField(
-      suspender_continuation,
-      FieldMemOperand(suspender, WasmSuspenderObject::kContinuationOffset), r0);
+  DEFINE_REG(suspender_stack);
+  __ LoadU64(suspender_stack,
+             FieldMemOperand(suspender, WasmSuspenderObject::kStackOffset), r0);
   if (v8_flags.debug_code) {
     // -------------------------------------------
-    // Check that the suspender's continuation is the active continuation.
+    // Check that the suspender's stack is the active stack.
     // -------------------------------------------
     // TODO(thibaudm): Once we add core stack-switching instructions, this
-    // check will not hold anymore: it's possible that the active continuation
+    // check will not hold anymore: it's possible that the active stack
     // changed (due to an internal switch), so we have to update the suspender.
-    __ CmpS64(suspender_continuation, continuation);
+    __ CmpS64(suspender_stack, stack);
     Label ok;
     __ beq(&ok);
     __ Trap();
@@ -3510,14 +3466,8 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
   // Update roots.
   // -------------------------------------------
   DEFINE_REG(caller);
-  __ LoadTaggedField(caller,
-                     FieldMemOperand(suspender_continuation,
-                                     WasmContinuationObject::kParentOffset),
-                     r0);
-  int32_t active_continuation_offset =
-      MacroAssembler::RootRegisterOffsetForRootIndex(
-          RootIndex::kActiveContinuation);
-  __ StoreU64(caller, MemOperand(kRootRegister, active_continuation_offset));
+  __ LoadU64(caller, MemOperand(suspender_stack, wasm::kStackParentOffset), r0);
+  __ StoreRootRelative(IsolateData::active_stack_offset(), caller);
   DEFINE_REG(parent);
   __ LoadTaggedField(
       parent, FieldMemOperand(suspender, WasmSuspenderObject::kParentOffset),
@@ -3526,17 +3476,13 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
       MacroAssembler::RootRegisterOffsetForRootIndex(
           RootIndex::kActiveSuspender);
   __ StoreU64(parent, MemOperand(kRootRegister, active_suspender_offset));
-  regs.ResetExcept(suspender, caller, continuation);
+  regs.ResetExcept(suspender, caller, stack);
 
   // -------------------------------------------
   // Load jump buffer.
   // -------------------------------------------
-  SwitchStacks(masm, continuation, false, {caller, suspender});
-  FREE_REG(continuation);
-  ASSIGN_REG(jmpbuf);
-  __ LoadU64(jmpbuf,
-             FieldMemOperand(caller, WasmContinuationObject::kStackOffset), r0);
-  __ AddS64(jmpbuf, jmpbuf, Operand(wasm::StackMemory::jmpbuf_offset()));
+  SwitchStacks(masm, stack, false, {caller, suspender});
+  FREE_REG(stack);
   __ LoadTaggedField(
       kReturnRegister0,
       FieldMemOperand(suspender, WasmSuspenderObject::kPromiseOffset), r0);
@@ -3544,7 +3490,7 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
       MemOperand(fp, StackSwitchFrameConstants::kGCScanSlotCountOffset);
   __ Zero(GCScanSlotPlace);
   ASSIGN_REG(scratch)
-  LoadJumpBuffer(masm, jmpbuf, true, scratch, wasm::JumpBuffer::Inactive);
+  LoadJumpBuffer(masm, caller, true, scratch, wasm::JumpBuffer::Inactive);
   if (v8_flags.debug_code) {
     __ Trap();
   }
@@ -3600,23 +3546,15 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
   // Save current state.
   // -------------------------------------------
   Label suspend;
-  DEFINE_REG(active_continuation);
-  __ LoadRoot(active_continuation, RootIndex::kActiveContinuation);
-  DEFINE_REG(current_jmpbuf);
+  DEFINE_REG(active_stack);
+  __ LoadRootRelative(active_stack, IsolateData::active_stack_offset());
   DEFINE_REG(scratch);
-  __ LoadU64(current_jmpbuf,
-             FieldMemOperand(active_continuation,
-                             WasmContinuationObject::kStackOffset),
-             r0);
-  __ AddS64(current_jmpbuf, current_jmpbuf,
-            Operand(wasm::StackMemory::jmpbuf_offset()));
-  FillJumpBuffer(masm, current_jmpbuf, &suspend, scratch);
-  SwitchStackState(masm, current_jmpbuf, scratch, wasm::JumpBuffer::Active,
+  FillJumpBuffer(masm, active_stack, &suspend, scratch);
+  SwitchStackState(masm, active_stack, scratch, wasm::JumpBuffer::Active,
                    wasm::JumpBuffer::Inactive);
-  FREE_REG(current_jmpbuf);
 
   // -------------------------------------------
-  // Set the suspender and continuation parents and update the roots
+  // Set the suspender and stack parents and update the roots
   // -------------------------------------------
   DEFINE_REG(active_suspender);
   __ LoadRoot(active_suspender, RootIndex::kActiveSuspender);
@@ -3635,53 +3573,29 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
   // the same register for target_continuation to use it in RecordWriteField.
   // So, free suspender here to use pinned reg, but load from it next line.
   FREE_REG(suspender);
-  DEFINE_PINNED(target_continuation, WriteBarrierDescriptor::ObjectRegister());
-  suspender = target_continuation;
-  __ LoadTaggedField(
-      target_continuation,
-      FieldMemOperand(suspender, WasmSuspenderObject::kContinuationOffset), r0);
+  DEFINE_REG(target_stack);
+  suspender = target_stack;
+  __ LoadU64(target_stack,
+             FieldMemOperand(suspender, WasmSuspenderObject::kStackOffset), r0);
   suspender = no_reg;
 
-  __ StoreTaggedField(active_continuation,
-                      FieldMemOperand(target_continuation,
-                                      WasmContinuationObject::kParentOffset),
-                      r0);
-  DEFINE_REG(old_continuation);
-  __ Move(old_continuation, active_continuation);
-  __ RecordWriteField(
-      target_continuation, WasmContinuationObject::kParentOffset,
-      active_continuation, ip, kLRHasBeenSaved, SaveFPRegsMode::kIgnore);
-  FREE_REG(active_continuation);
-  int32_t active_continuation_offset =
-      MacroAssembler::RootRegisterOffsetForRootIndex(
-          RootIndex::kActiveContinuation);
-  __ StoreU64(target_continuation,
-              MemOperand(kRootRegister, active_continuation_offset));
-
-  SwitchStacks(masm, old_continuation, false, {target_continuation});
-
-  regs.ResetExcept(target_continuation);
+  __ StoreRootRelative(IsolateData::active_stack_offset(), target_stack);
+  SwitchStacks(masm, active_stack, false, {target_stack});
+  regs.ResetExcept(target_stack);
 
   // -------------------------------------------
   // Load state from target jmpbuf (longjmp).
   // -------------------------------------------
   regs.Reserve(kReturnRegister0);
-  DEFINE_REG(target_jmpbuf);
   ASSIGN_REG(scratch);
-  __ LoadU64(target_jmpbuf,
-             FieldMemOperand(target_continuation,
-                             WasmContinuationObject::kStackOffset),
-             r0);
-  __ AddS64(target_jmpbuf, target_jmpbuf,
-            Operand(wasm::StackMemory::jmpbuf_offset()));
   // Move resolved value to return register.
   __ LoadU64(kReturnRegister0, MemOperand(fp, 3 * kSystemPointerSize));
   MemOperand GCScanSlotPlace =
       MemOperand(fp, StackSwitchFrameConstants::kGCScanSlotCountOffset);
   __ Zero(GCScanSlotPlace);
   if (on_resume == wasm::OnResume::kThrow) {
-    // Switch to the continuation's stack without restoring the PC.
-    LoadJumpBuffer(masm, target_jmpbuf, false, scratch,
+    // Switch without restoring the PC.
+    LoadJumpBuffer(masm, target_stack, false, scratch,
                    wasm::JumpBuffer::Suspended);
     // Pop this frame now. The unwinder expects that the first STACK_SWITCH
     // frame is the outermost one.
@@ -3690,8 +3604,8 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
     __ Push(kReturnRegister0);
     __ CallRuntime(Runtime::kThrow);
   } else {
-    // Resume the continuation normally.
-    LoadJumpBuffer(masm, target_jmpbuf, true, scratch,
+    // Resume the stack normally.
+    LoadJumpBuffer(masm, target_stack, true, scratch,
                    wasm::JumpBuffer::Suspended);
   }
   if (v8_flags.debug_code) {
@@ -3725,28 +3639,24 @@ void SwitchToAllocatedStack(MacroAssembler* masm, RegisterAllocator& regs,
                             Label* suspend) {
   ResetStackSwitchFrameStackSlots(masm);
   DEFINE_SCOPED(scratch)
-  DEFINE_REG(target_continuation)
-  __ LoadRoot(target_continuation, RootIndex::kActiveContinuation);
-  DEFINE_REG(parent_continuation)
-  __ LoadTaggedField(parent_continuation,
-                     FieldMemOperand(target_continuation,
-                                     WasmContinuationObject::kParentOffset),
-                     r0);
-
-  SaveState(masm, parent_continuation, scratch, suspend);
+  DEFINE_REG(target_stack)
+  __ LoadRootRelative(target_stack, IsolateData::active_stack_offset());
+  DEFINE_REG(parent_stack)
+  __ LoadU64(parent_stack, MemOperand(target_stack, wasm::kStackParentOffset),
+             r0);
 
-  SwitchStacks(masm, parent_continuation, false,
-               {wasm_instance, wrapper_buffer});
+  FillJumpBuffer(masm, parent_stack, suspend, scratch);
+  SwitchStacks(masm, parent_stack, false, {wasm_instance, wrapper_buffer});
 
-  FREE_REG(parent_continuation);
+  FREE_REG(parent_stack);
   // Save the old stack's fp in r15, and use it to access the parameters in
   // the parent frame.
   regs.Pinned(r15, &original_fp);
   __ Move(original_fp, fp);
-  __ LoadRoot(target_continuation, RootIndex::kActiveContinuation);
-  LoadTargetJumpBuffer(masm, target_continuation, scratch,
+  __ LoadRootRelative(target_stack, IsolateData::active_stack_offset());
+  LoadTargetJumpBuffer(masm, target_stack, scratch,
                        wasm::JumpBuffer::Suspended);
-  FREE_REG(target_continuation);
+  FREE_REG(target_stack);
 
   // Push the loaded fp. We know it is null, because there is no frame yet,
   // so we could also push 0 directly. In any case we need to push it,
@@ -3814,9 +3724,9 @@ void SwitchBackAndReturnPromise(MacroAssembler* masm, RegisterAllocator& regs,
              MemOperand(fp, StackSwitchFrameConstants::kImplicitArgOffset));
   GetContextFromImplicitArg(masm, kContextRegister, tmp);
 
-  ReloadParentContinuation(masm, promise, return_value, kContextRegister, tmp,
-                           tmp2, tmp3);
-  RestoreParentSuspender(masm, tmp, tmp2);
+  ReloadParentStack(masm, promise, return_value, kContextRegister, tmp, tmp2,
+                    tmp3);
+  RestoreParentSuspender(masm, tmp);
 
   if (mode == wasm::kPromise) {
     __ mov(tmp, Operand(1));
@@ -3865,9 +3775,8 @@ void GenerateExceptionHandlingLandingPad(MacroAssembler* masm,
   __ LoadU64(kContextRegister,
              MemOperand(fp, StackSwitchFrameConstants::kImplicitArgOffset));
   GetContextFromImplicitArg(masm, kContextRegister, tmp);
-  ReloadParentContinuation(masm, promise, reason, kContextRegister, tmp, tmp2,
-                           tmp3);
-  RestoreParentSuspender(masm, tmp, tmp2);
+  ReloadParentStack(masm, promise, reason, kContextRegister, tmp, tmp2, tmp3);
+  RestoreParentSuspender(masm, tmp);
 
   __ mov(tmp, Operand(1));
   __ StoreU64(
@@ -4180,6 +4089,12 @@ void SwitchToTheCentralStackIfNeeded(MacroAssembler* masm, Register argc_input,
   __ SubS64(sp, central_stack_sp, Operand(kReturnAddressSlotOffset + kPadding));
   __ EnforceStackAlignment();
 
+  // When we switch stack we leave home space allocated on the old stack.
+  // Allocate home space on the central stack to prevent stack corruption.
+  __ li(r0, Operand::Zero());
+  __ StoreU64WithUpdate(
+      r0, MemOperand(sp, -kNumRequiredStackFrameSlots * kSystemPointerSize));
+
   // Update the sp saved in the frame.
   // It will be used to calculate the callee pc during GC.
   // The pc is going to be on the new stack segment, so rewrite it here.
diff --git a/deps/v8/src/builtins/promise-all-element-closure.tq b/deps/v8/src/builtins/promise-all-element-closure.tq
index 2a8525ba622bab..63238d5d200ed5 100644
--- a/deps/v8/src/builtins/promise-all-element-closure.tq
+++ b/deps/v8/src/builtins/promise-all-element-closure.tq
@@ -76,9 +76,9 @@ extern enum PromiseAllResolveElementContextSlots extends intptr
       Slot<PromiseAllResolveElementContext, FixedArray>,
   kPromiseAllResolveElementLength
 }
-extern operator '[]=' macro StoreContextElement(
+extern operator '[]=' macro StoreContextElementNoCell(
     Context, constexpr PromiseAllResolveElementContextSlots, Object): void;
-extern operator '[]' macro LoadContextElement(
+extern operator '[]' macro LoadContextElementNoCell(
     Context, constexpr PromiseAllResolveElementContextSlots): Object;
 
 const kPropertyArrayNoHashSentinel: constexpr int31
diff --git a/deps/v8/src/builtins/promise-any.tq b/deps/v8/src/builtins/promise-any.tq
index 78eeea968a6de2..b46794277c21a6 100644
--- a/deps/v8/src/builtins/promise-any.tq
+++ b/deps/v8/src/builtins/promise-any.tq
@@ -17,9 +17,9 @@ extern enum PromiseAnyRejectElementContextSlots extends intptr
   kPromiseAnyRejectElementLength
 }
 
-extern operator '[]=' macro StoreContextElement(
+extern operator '[]=' macro StoreContextElementNoCell(
     Context, constexpr PromiseAnyRejectElementContextSlots, Object): void;
-extern operator '[]' macro LoadContextElement(
+extern operator '[]' macro LoadContextElementNoCell(
     Context, constexpr PromiseAnyRejectElementContextSlots): Object;
 
 // Creates the context used by all Promise.any reject element closures,
diff --git a/deps/v8/src/builtins/riscv/builtins-riscv.cc b/deps/v8/src/builtins/riscv/builtins-riscv.cc
index 06649f0a813479..51b691aedebbfe 100644
--- a/deps/v8/src/builtins/riscv/builtins-riscv.cc
+++ b/deps/v8/src/builtins/riscv/builtins-riscv.cc
@@ -3588,12 +3588,12 @@ void Builtins::Generate_WasmTrapHandlerLandingPad(MacroAssembler* masm) {
 namespace {
 // Check that the stack was in the old state (if generated code assertions are
 // enabled), and switch to the new state.
-void SwitchStackState(MacroAssembler* masm, Register jmpbuf, Register tmp,
+void SwitchStackState(MacroAssembler* masm, Register stack, Register tmp,
                       wasm::JumpBuffer::StackState old_state,
                       wasm::JumpBuffer::StackState new_state) {
   ASM_CODE_COMMENT(masm);
 #if V8_ENABLE_SANDBOX
-  __ Lw(tmp, MemOperand(jmpbuf, wasm::kJmpBufStateOffset));
+  __ Lw(tmp, MemOperand(stack, wasm::kStackStateOffset));
   Label ok;
   // is branch32?
   __ Branch(&ok, eq, tmp, Operand(old_state));
@@ -3601,7 +3601,7 @@ void SwitchStackState(MacroAssembler* masm, Register jmpbuf, Register tmp,
   __ bind(&ok);
 #endif
   __ li(tmp, new_state);
-  __ Sw(tmp, MemOperand(jmpbuf, wasm::kJmpBufStateOffset));
+  __ Sw(tmp, MemOperand(stack, wasm::kStackStateOffset));
 }
 
 // Switch the stack pointer. Also switch the simulator's stack limit when
@@ -3609,40 +3609,40 @@ void SwitchStackState(MacroAssembler* masm, Register jmpbuf, Register tmp,
 // changing the stack pointer, as a mismatch between the stack pointer and the
 // simulator's stack limit can cause stack access check failures.
 void SwitchStackPointerAndSimulatorStackLimit(MacroAssembler* masm,
-                                              Register jmpbuf) {
+                                              Register stack) {
   ASM_CODE_COMMENT(masm);
   if (masm->options().enable_simulator_code) {
     UseScratchRegisterScope temps(masm);
     temps.Exclude(kSimulatorBreakArgument);
-    __ LoadWord(sp, MemOperand(jmpbuf, wasm::kJmpBufSpOffset));
+    __ LoadWord(sp, MemOperand(stack, wasm::kStackSpOffset));
     __ LoadWord(kSimulatorBreakArgument,
-                MemOperand(jmpbuf, wasm::kJmpBufStackLimitOffset));
+                MemOperand(stack, wasm::kStackLimitOffset));
     __ break_(kExceptionIsSwitchStackLimit);
   } else {
-    __ LoadWord(sp, MemOperand(jmpbuf, wasm::kJmpBufSpOffset));
+    __ LoadWord(sp, MemOperand(stack, wasm::kStackSpOffset));
   }
 }
 
-void FillJumpBuffer(MacroAssembler* masm, Register jmpbuf, Label* pc,
+void FillJumpBuffer(MacroAssembler* masm, Register stack, Label* pc,
                     Register tmp) {
   ASM_CODE_COMMENT(masm);
   __ mv(tmp, sp);
-  __ StoreWord(tmp, MemOperand(jmpbuf, wasm::kJmpBufSpOffset));
-  __ StoreWord(fp, MemOperand(jmpbuf, wasm::kJmpBufFpOffset));
+  __ StoreWord(tmp, MemOperand(stack, wasm::kStackSpOffset));
+  __ StoreWord(fp, MemOperand(stack, wasm::kStackFpOffset));
   __ LoadStackLimit(tmp, StackLimitKind::kRealStackLimit);
-  __ StoreWord(tmp, MemOperand(jmpbuf, wasm::kJmpBufStackLimitOffset));
+  __ StoreWord(tmp, MemOperand(stack, wasm::kStackLimitOffset));
   __ LoadAddress(tmp, pc);
-  __ StoreWord(tmp, MemOperand(jmpbuf, wasm::kJmpBufPcOffset));
+  __ StoreWord(tmp, MemOperand(stack, wasm::kStackPcOffset));
 }
 
-void LoadJumpBuffer(MacroAssembler* masm, Register jmpbuf, bool load_pc,
+void LoadJumpBuffer(MacroAssembler* masm, Register stack, bool load_pc,
                     Register tmp, wasm::JumpBuffer::StackState expected_state) {
   ASM_CODE_COMMENT(masm);
-  SwitchStackPointerAndSimulatorStackLimit(masm, jmpbuf);
-  __ LoadWord(fp, MemOperand(jmpbuf, wasm::kJmpBufFpOffset));
-  SwitchStackState(masm, jmpbuf, tmp, expected_state, wasm::JumpBuffer::Active);
+  SwitchStackPointerAndSimulatorStackLimit(masm, stack);
+  __ LoadWord(fp, MemOperand(stack, wasm::kStackFpOffset));
+  SwitchStackState(masm, stack, tmp, expected_state, wasm::JumpBuffer::Active);
   if (load_pc) {
-    __ LoadWord(tmp, MemOperand(jmpbuf, wasm::kJmpBufPcOffset));
+    __ LoadWord(tmp, MemOperand(stack, wasm::kStackPcOffset));
     __ Jump(tmp);
   }
   // The stack limit in StackGuard is set separately under the ExecutionAccess
@@ -3650,19 +3650,18 @@ void LoadJumpBuffer(MacroAssembler* masm, Register jmpbuf, bool load_pc,
 }
 
 // Updates the stack limit and central stack info, and validates the switch.
-void SwitchStacks(MacroAssembler* masm, Register old_continuation,
-                  bool return_switch, Register tmp,
-                  const std::initializer_list<Register> keep) {
+void SwitchStacks(MacroAssembler* masm, Register old_stack, bool return_switch,
+                  Register tmp, const std::initializer_list<Register> keep) {
   ASM_CODE_COMMENT(masm);
-  CHECK(!AreAliased(old_continuation, a0));
   using ER = ExternalReference;
   for (auto reg : keep) {
     __ Push(reg);
   }
   {
     FrameScope scope(masm, StackFrame::MANUAL);
+    // Move {old_stack} first in case it aliases kCArgRegs[0].
+    __ mv(kCArgRegs[1], old_stack);
     __ li(kCArgRegs[0], ExternalReference::isolate_address(masm->isolate()));
-    __ mv(kCArgRegs[1], old_continuation);
     __ PrepareCallCFunction(2, tmp);
     __ CallCFunction(
         return_switch ? ER::wasm_return_switch() : ER::wasm_switch_stacks(), 2);
@@ -3672,53 +3671,36 @@ void SwitchStacks(MacroAssembler* masm, Register old_continuation,
   }
 }
 
-void ReloadParentContinuation(MacroAssembler* masm, Register return_reg,
-                              Register return_value, Register context,
-                              Register tmp1, Register tmp2, Register tmp3) {
+void ReloadParentStack(MacroAssembler* masm, Register return_reg,
+                       Register return_value, Register context, Register tmp1,
+                       Register tmp2, Register tmp3) {
   ASM_CODE_COMMENT(masm);
-  Register active_continuation = tmp1;
-  __ LoadRoot(active_continuation, RootIndex::kActiveContinuation);
+  Register active_stack = tmp1;
+  __ LoadRootRelative(active_stack, IsolateData::active_stack_offset());
 
   // Set a null pointer in the jump buffer's SP slot to indicate to the stack
   // frame iterator that this stack is empty.
-  Register jmpbuf = tmp2;
-  __ LoadExternalPointerField(
-      jmpbuf,
-      FieldMemOperand(active_continuation,
-                      WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag);
-  __ AddWord(jmpbuf, jmpbuf, wasm::StackMemory::jmpbuf_offset());
-  __ StoreWord(zero_reg, MemOperand(jmpbuf, wasm::kJmpBufSpOffset));
+  __ StoreWord(zero_reg, MemOperand(active_stack, wasm::kStackSpOffset));
   {
     UseScratchRegisterScope temps(masm);
     Register scratch = temps.Acquire();
-    SwitchStackState(masm, jmpbuf, scratch, wasm::JumpBuffer::Active,
+    SwitchStackState(masm, active_stack, scratch, wasm::JumpBuffer::Active,
                      wasm::JumpBuffer::Retired);
   }
   Register parent = tmp2;
-  __ LoadTaggedField(parent,
-                     FieldMemOperand(active_continuation,
-                                     WasmContinuationObject::kParentOffset));
 
-  // Update active continuation root.
-  int32_t active_continuation_offset =
-      MacroAssembler::RootRegisterOffsetForRootIndex(
-          RootIndex::kActiveContinuation);
-  __ StoreWord(parent, MemOperand(kRootRegister, active_continuation_offset));
-  jmpbuf = parent;
-  __ LoadExternalPointerField(
-      jmpbuf, FieldMemOperand(parent, WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag);
-  __ AddWord(jmpbuf, jmpbuf, wasm::StackMemory::jmpbuf_offset());
+  __ LoadWord(parent, MemOperand(active_stack, wasm::kStackParentOffset));
+
+  // Update active stack.
+  __ StoreRootRelative(IsolateData::active_stack_offset(), parent);
 
   // Switch stack!
-  SwitchStacks(masm, active_continuation, true, tmp3,
-               {return_reg, return_value, context, jmpbuf});
-  LoadJumpBuffer(masm, jmpbuf, false, tmp3, wasm::JumpBuffer::Inactive);
+  SwitchStacks(masm, active_stack, true, tmp3,
+               {return_reg, return_value, context, parent});
+  LoadJumpBuffer(masm, parent, false, tmp3, wasm::JumpBuffer::Inactive);
 }
 
-void RestoreParentSuspender(MacroAssembler* masm, Register tmp1,
-                            Register tmp2) {
+void RestoreParentSuspender(MacroAssembler* masm, Register tmp1) {
   ASM_CODE_COMMENT(masm);
   Register suspender = tmp1;
   __ LoadRoot(suspender, RootIndex::kActiveSuspender);
@@ -3864,22 +3846,15 @@ void ResetStackSwitchFrameStackSlots(MacroAssembler* masm) {
                MemOperand(fp, StackSwitchFrameConstants::kImplicitArgOffset));
 }
 
-void LoadTargetJumpBuffer(MacroAssembler* masm, Register target_continuation,
+void LoadTargetJumpBuffer(MacroAssembler* masm, Register target_stack,
                           Register tmp,
                           wasm::JumpBuffer::StackState expected_state) {
   ASM_CODE_COMMENT(masm);
-  Register target_jmpbuf = target_continuation;
-  __ LoadExternalPointerField(
-      target_jmpbuf,
-      FieldMemOperand(target_continuation,
-                      WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag);
-  __ AddWord(target_jmpbuf, target_jmpbuf, wasm::StackMemory::jmpbuf_offset());
   __ StoreWord(
       zero_reg,
       MemOperand(fp, StackSwitchFrameConstants::kGCScanSlotCountOffset));
   // Switch stack!
-  LoadJumpBuffer(masm, target_jmpbuf, false, tmp, expected_state);
+  LoadJumpBuffer(masm, target_stack, false, tmp, expected_state);
 }
 }  // namespace
 
@@ -3901,33 +3876,28 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
   // Save current state in active jump buffer.
   // -------------------------------------------
   Label resume;
-  DEFINE_REG(continuation);
-  __ LoadRoot(continuation, RootIndex::kActiveContinuation);
-  DEFINE_REG(jmpbuf);
+  DEFINE_REG(stack);
+  __ LoadRootRelative(stack, IsolateData::active_stack_offset());
   DEFINE_REG(scratch);
-  __ LoadExternalPointerField(
-      jmpbuf,
-      FieldMemOperand(continuation, WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag);
-  __ AddWord(jmpbuf, jmpbuf, wasm::StackMemory::jmpbuf_offset());
-  FillJumpBuffer(masm, jmpbuf, &resume, scratch);
-  SwitchStackState(masm, jmpbuf, scratch, wasm::JumpBuffer::Active,
+  FillJumpBuffer(masm, stack, &resume, scratch);
+  SwitchStackState(masm, stack, scratch, wasm::JumpBuffer::Active,
                    wasm::JumpBuffer::Suspended);
-  regs.ResetExcept(suspender, continuation);
+  regs.ResetExcept(suspender, stack);
 
-  DEFINE_REG(suspender_continuation);
-  __ LoadTaggedField(
-      suspender_continuation,
-      FieldMemOperand(suspender, WasmSuspenderObject::kContinuationOffset));
+  DEFINE_REG(suspender_stack);
+  __ LoadExternalPointerField(
+      suspender_stack,
+      FieldMemOperand(suspender, WasmSuspenderObject::kStackOffset),
+      kWasmStackMemoryTag);
   if (v8_flags.debug_code) {
     // -------------------------------------------
-    // Check that the suspender's continuation is the active continuation.
+    // Check that the suspender's stack is the active stack.
     // -------------------------------------------
     // TODO(thibaudm): Once we add core stack-switching instructions, this
-    // check will not hold anymore: it's possible that the active continuation
-    // changed (due to an internal switch), so we have to update the suspender.
+    // check will not hold anymore: it's possible that the active stack changed
+    // (due to an internal switch), so we have to update the suspender.
     Label ok;
-    __ Branch(&ok, eq, suspender_continuation, Operand(continuation));
+    __ Branch(&ok, eq, suspender_stack, Operand(stack));
     __ Trap();
     __ bind(&ok);
   }
@@ -3935,13 +3905,8 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
   // Update roots.
   // -------------------------------------------
   DEFINE_REG(caller);
-  __ LoadTaggedField(caller,
-                     FieldMemOperand(suspender_continuation,
-                                     WasmContinuationObject::kParentOffset));
-  int32_t active_continuation_offset =
-      MacroAssembler::RootRegisterOffsetForRootIndex(
-          RootIndex::kActiveContinuation);
-  __ StoreWord(caller, MemOperand(kRootRegister, active_continuation_offset));
+  __ LoadWord(caller, MemOperand(suspender_stack, wasm::kStackParentOffset));
+  __ StoreRootRelative(IsolateData::active_stack_offset(), caller);
   DEFINE_REG(parent);
   __ LoadTaggedField(
       parent, FieldMemOperand(suspender, WasmSuspenderObject::kParentOffset));
@@ -3949,25 +3914,20 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
       MacroAssembler::RootRegisterOffsetForRootIndex(
           RootIndex::kActiveSuspender);
   __ StoreWord(parent, MemOperand(kRootRegister, active_suspender_offset));
-  regs.ResetExcept(suspender, caller, continuation);
+  regs.ResetExcept(suspender, caller, stack);
   // -------------------------------------------
   // Load jump buffer.
   // -------------------------------------------
-  SwitchStacks(masm, continuation, false, caller, {caller, suspender});
-  FREE_REG(continuation);
-  ASSIGN_REG(jmpbuf);
-  __ LoadExternalPointerField(
-      jmpbuf, FieldMemOperand(caller, WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag);
-  __ AddWord(jmpbuf, jmpbuf, wasm::StackMemory::jmpbuf_offset());
+  ASSIGN_REG(scratch);
+  SwitchStacks(masm, stack, false, scratch, {caller, suspender});
+  FREE_REG(stack);
   __ LoadTaggedField(
       kReturnRegister0,
       FieldMemOperand(suspender, WasmSuspenderObject::kPromiseOffset));
   MemOperand GCScanSlotPlace =
       MemOperand(fp, StackSwitchFrameConstants::kGCScanSlotCountOffset);
   __ StoreWord(zero_reg, GCScanSlotPlace);
-  ASSIGN_REG(scratch)
-  LoadJumpBuffer(masm, jmpbuf, true, scratch, wasm::JumpBuffer::Inactive);
+  LoadJumpBuffer(masm, caller, true, scratch, wasm::JumpBuffer::Inactive);
   __ Trap();
   __ bind(&resume);
   __ LeaveFrame(StackFrame::STACK_SWITCH);
@@ -3984,7 +3944,6 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
   auto regs = RegisterAllocator::WithAllocatableGeneralRegisters();
   UseScratchRegisterScope temps(masm);
   __ EnterFrame(StackFrame::STACK_SWITCH);
-
   DEFINE_PINNED(closure, kJSFunctionRegister);  // a1
 
   __ SubWord(
@@ -4021,23 +3980,14 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
   // Save current state.
   // -------------------------------------------
   Label suspend;
-  DEFINE_REG(active_continuation);
-  __ LoadRoot(active_continuation, RootIndex::kActiveContinuation);
-  DEFINE_REG(current_jmpbuf);
+  DEFINE_REG(active_stack);
+  __ LoadRootRelative(active_stack, IsolateData::active_stack_offset());
   DEFINE_REG(scratch);
-  __ LoadExternalPointerField(
-      current_jmpbuf,
-      FieldMemOperand(active_continuation,
-                      WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag);
-  __ AddWord(current_jmpbuf, current_jmpbuf,
-             wasm::StackMemory::jmpbuf_offset());
-  FillJumpBuffer(masm, current_jmpbuf, &suspend, scratch);
-  SwitchStackState(masm, current_jmpbuf, scratch, wasm::JumpBuffer::Active,
+  FillJumpBuffer(masm, active_stack, &suspend, scratch);
+  SwitchStackState(masm, active_stack, scratch, wasm::JumpBuffer::Active,
                    wasm::JumpBuffer::Inactive);
-  FREE_REG(current_jmpbuf);
   // -------------------------------------------
-  // Set the suspender and continuation parents and update the roots
+  // Set the suspender and stack parents and update the roots
   // -------------------------------------------
   DEFINE_REG(active_suspender);
   __ LoadRoot(active_suspender, RootIndex::kActiveSuspender);
@@ -4052,56 +4002,31 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
           RootIndex::kActiveSuspender);
   __ StoreWord(suspender, MemOperand(kRootRegister, active_suspender_offset));
 
-  // Next line we are going to load a field from suspender, but we have to use
-  // the same register for target_continuation to use it in RecordWriteField.
-  // So, free suspender here to use pinned reg, but load from it next line.
+  regs.Reserve(kReturnRegister0);
+  DEFINE_REG(target_stack);
+  __ LoadExternalPointerField(
+      target_stack,
+      FieldMemOperand(suspender, WasmSuspenderObject::kStackOffset),
+      kWasmStackMemoryTag);
+
   FREE_REG(suspender);
-  DEFINE_PINNED(target_continuation, WriteBarrierDescriptor::ObjectRegister());
-  suspender = target_continuation;
-  __ LoadTaggedField(
-      target_continuation,
-      FieldMemOperand(suspender, WasmSuspenderObject::kContinuationOffset));
-  suspender = no_reg;
-
-  __ StoreTaggedField(active_continuation,
-                      FieldMemOperand(target_continuation,
-                                      WasmContinuationObject::kParentOffset));
-  DEFINE_PINNED(old_continuation, s10);
-  __ mv(old_continuation, active_continuation);
-  __ RecordWriteField(
-      target_continuation, WasmContinuationObject::kParentOffset,
-      active_continuation, kRAHasBeenSaved, SaveFPRegsMode::kIgnore);
-  int32_t active_continuation_offset =
-      MacroAssembler::RootRegisterOffsetForRootIndex(
-          RootIndex::kActiveContinuation);
-  __ StoreWord(target_continuation,
-               MemOperand(kRootRegister, active_continuation_offset));
 
-  SwitchStacks(masm, old_continuation, false, scratch, {target_continuation});
-  regs.ResetExcept(target_continuation);
+  __ StoreRootRelative(IsolateData::active_stack_offset(), target_stack);
+  SwitchStacks(masm, active_stack, false, scratch, {target_stack});
+  regs.ResetExcept(target_stack, kReturnRegister0);
 
   // -------------------------------------------
   // Load state from target jmpbuf (longjmp).
   // -------------------------------------------
-  regs.Reserve(kReturnRegister0);
-  DEFINE_REG(target_jmpbuf);
   ASSIGN_REG(scratch);
-
-  __ LoadExternalPointerField(
-      target_jmpbuf,
-      FieldMemOperand(target_continuation,
-                      WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag);
-  __ AddWord(target_jmpbuf, target_jmpbuf, wasm::StackMemory::jmpbuf_offset());
-
   // Move resolved value to return register.
   __ LoadWord(kReturnRegister0, MemOperand(fp, 3 * kSystemPointerSize));
   MemOperand GCScanSlotPlace =
       MemOperand(fp, StackSwitchFrameConstants::kGCScanSlotCountOffset);
   __ StoreWord(zero_reg, GCScanSlotPlace);
   if (on_resume == wasm::OnResume::kThrow) {
-    // Switch to the continuation's stack without restoring the PC.
-    LoadJumpBuffer(masm, target_jmpbuf, false, scratch,
+    // Switch without restoring the PC.
+    LoadJumpBuffer(masm, target_stack, false, scratch,
                    wasm::JumpBuffer::Suspended);
     // Pop this frame now. The unwinder expects that the first STACK_SWITCH
     // frame is the outermost one.
@@ -4110,8 +4035,8 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
     __ Push(kReturnRegister0);
     __ CallRuntime(Runtime::kThrow);
   } else {
-    // Resume the continuation normally.
-    LoadJumpBuffer(masm, target_jmpbuf, true, scratch,
+    // Resume the stack normally.
+    LoadJumpBuffer(masm, target_stack, true, scratch,
                    wasm::JumpBuffer::Suspended);
   }
   __ Trap();
@@ -4138,22 +4063,6 @@ void Builtins::Generate_WasmOnStackReplace(MacroAssembler* masm) {
 }
 
 namespace {
-
-void SaveState(MacroAssembler* masm, Register active_continuation, Register tmp,
-               Label* suspend) {
-  ASM_CODE_COMMENT(masm);
-  Register jmpbuf = tmp;
-  __ LoadExternalPointerField(
-      jmpbuf,
-      FieldMemOperand(active_continuation,
-                      WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag);
-  __ AddWord(jmpbuf, jmpbuf, wasm::StackMemory::jmpbuf_offset());
-  UseScratchRegisterScope temps(masm);
-  Register scratch = temps.Acquire();
-  FillJumpBuffer(masm, jmpbuf, suspend, scratch);
-}
-
 void SwitchToAllocatedStack(MacroAssembler* masm, RegisterAllocator& regs,
                             Register wasm_instance, Register wrapper_buffer,
                             Register& original_fp, Register& new_wrapper_buffer,
@@ -4162,24 +4071,22 @@ void SwitchToAllocatedStack(MacroAssembler* masm, RegisterAllocator& regs,
   UseScratchRegisterScope temps(masm);
   ResetStackSwitchFrameStackSlots(masm);
   DEFINE_SCOPED(scratch)
-  DEFINE_REG(target_continuation)
-  __ LoadRoot(target_continuation, RootIndex::kActiveContinuation);
-  DEFINE_PINNED(parent_continuation, a2)
-  __ LoadTaggedField(parent_continuation,
-                     FieldMemOperand(target_continuation,
-                                     WasmContinuationObject::kParentOffset));
-  SaveState(masm, parent_continuation, scratch, suspend);
-  SwitchStacks(masm, parent_continuation, false, scratch,
+  DEFINE_REG(parent_stack)
+  __ LoadRootRelative(parent_stack, IsolateData::active_stack_offset());
+  __ LoadWord(parent_stack, MemOperand(parent_stack, wasm::kStackParentOffset));
+  FillJumpBuffer(masm, parent_stack, suspend, scratch);
+  SwitchStacks(masm, parent_stack, false, scratch,
                {wasm_instance, wrapper_buffer});
-  FREE_REG(parent_continuation);
+  FREE_REG(parent_stack);
   // Save the old stack's fp in t4, and use it to access the parameters in
   // the parent frame.
   regs.Pinned(t4, &original_fp);
   __ mv(original_fp, fp);
-  __ LoadRoot(target_continuation, RootIndex::kActiveContinuation);
-  LoadTargetJumpBuffer(masm, target_continuation, scratch,
+  DEFINE_REG(target_stack);
+  __ LoadRootRelative(target_stack, IsolateData::active_stack_offset());
+  LoadTargetJumpBuffer(masm, target_stack, scratch,
                        wasm::JumpBuffer::Suspended);
-  FREE_REG(target_continuation);
+  FREE_REG(target_stack);
 
   // Push the loaded fp. We know it is null, because there is no frame yet,
   // so we could also push 0 directly. In any case we need to push it,
@@ -4266,9 +4173,9 @@ void SwitchBackAndReturnPromise(MacroAssembler* masm, RegisterAllocator& regs,
               MemOperand(fp, StackSwitchFrameConstants::kImplicitArgOffset));
   GetContextFromImplicitArg(masm, kContextRegister, tmp);
 
-  ReloadParentContinuation(masm, promise, return_value, kContextRegister, tmp,
-                           tmp2, tmp3);
-  RestoreParentSuspender(masm, tmp, tmp2);
+  ReloadParentStack(masm, promise, return_value, kContextRegister, tmp, tmp2,
+                    tmp3);
+  RestoreParentSuspender(masm, tmp);
 
   if (mode == wasm::kPromise) {
     __ li(tmp, 1);
@@ -4287,19 +4194,20 @@ void GenerateExceptionHandlingLandingPad(MacroAssembler* masm,
                                          RegisterAllocator& regs,
                                          Label* return_promise) {
   ASM_CODE_COMMENT(masm);
+  regs.ResetExcept();
   static const Builtin_RejectPromise_InterfaceDescriptor desc;
   DEFINE_PINNED(promise, desc.GetRegisterParameter(0));
   DEFINE_PINNED(reason, desc.GetRegisterParameter(1));
   DEFINE_PINNED(debug_event, desc.GetRegisterParameter(2));
   int catch_handler = __ pc_offset();
-  {
-    DEFINE_SCOPED(thread_in_wasm_flag_addr);
-    // Unset thread_in_wasm_flag.
-    __ LoadWord(thread_in_wasm_flag_addr,
-                MemOperand(kRootRegister,
-                           Isolate::thread_in_wasm_flag_address_offset()));
-    __ StoreWord(zero_reg, MemOperand(thread_in_wasm_flag_addr, 0));
-  }
+  DEFINE_SCOPED(thread_in_wasm_flag_addr);
+  thread_in_wasm_flag_addr = a2;
+
+  // Unset thread_in_wasm_flag.
+  __ LoadWord(
+      thread_in_wasm_flag_addr,
+      MemOperand(kRootRegister, Isolate::thread_in_wasm_flag_address_offset()));
+  __ StoreWord(zero_reg, MemOperand(thread_in_wasm_flag_addr, 0));
   // The exception becomes the parameter of the RejectPromise builtin, and the
   // promise is the return value of this wrapper.
   __ mv(reason, kReturnRegister0);
@@ -4313,9 +4221,8 @@ void GenerateExceptionHandlingLandingPad(MacroAssembler* masm,
   DEFINE_SCOPED(tmp2);
   DEFINE_SCOPED(tmp3);
   GetContextFromImplicitArg(masm, kContextRegister, tmp);
-  ReloadParentContinuation(masm, promise, reason, kContextRegister, tmp, tmp2,
-                           tmp3);
-  RestoreParentSuspender(masm, tmp, tmp2);
+  ReloadParentStack(masm, promise, reason, kContextRegister, tmp, tmp2, tmp3);
+  RestoreParentSuspender(masm, tmp);
 
   __ li(tmp, 1);
   __ StoreWord(
diff --git a/deps/v8/src/builtins/s390/builtins-s390.cc b/deps/v8/src/builtins/s390/builtins-s390.cc
index 2a3a8b894e178b..b50cb2aeba8905 100644
--- a/deps/v8/src/builtins/s390/builtins-s390.cc
+++ b/deps/v8/src/builtins/s390/builtins-s390.cc
@@ -3129,78 +3129,59 @@ void Builtins::Generate_WasmDebugBreak(MacroAssembler* masm) {
 namespace {
 // Check that the stack was in the old state (if generated code assertions are
 // enabled), and switch to the new state.
-void SwitchStackState(MacroAssembler* masm, Register jmpbuf, Register tmp,
+void SwitchStackState(MacroAssembler* masm, Register stack, Register tmp,
                       wasm::JumpBuffer::StackState old_state,
                       wasm::JumpBuffer::StackState new_state) {
-  __ LoadU32(tmp, MemOperand(jmpbuf, wasm::kJmpBufStateOffset));
+  __ LoadU32(tmp, MemOperand(stack, wasm::kStackStateOffset));
   Label ok;
   __ JumpIfEqual(tmp, old_state, &ok);
   __ Trap();
   __ bind(&ok);
   __ mov(tmp, Operand(new_state));
-  __ StoreU32(tmp, MemOperand(jmpbuf, wasm::kJmpBufStateOffset));
+  __ StoreU32(tmp, MemOperand(stack, wasm::kStackStateOffset));
 }
 
 // Switch the stack pointer.
-void SwitchStackPointer(MacroAssembler* masm, Register jmpbuf) {
-  __ LoadU64(sp, MemOperand(jmpbuf, wasm::kJmpBufSpOffset));
+void SwitchStackPointer(MacroAssembler* masm, Register stack) {
+  __ LoadU64(sp, MemOperand(stack, wasm::kStackSpOffset));
 }
 
-void FillJumpBuffer(MacroAssembler* masm, Register jmpbuf, Label* target,
+void FillJumpBuffer(MacroAssembler* masm, Register stack, Label* target,
                     Register tmp) {
   __ mov(tmp, sp);
-  __ StoreU64(tmp, MemOperand(jmpbuf, wasm::kJmpBufSpOffset));
-  __ StoreU64(fp, MemOperand(jmpbuf, wasm::kJmpBufFpOffset));
+  __ StoreU64(tmp, MemOperand(stack, wasm::kStackSpOffset));
+  __ StoreU64(fp, MemOperand(stack, wasm::kStackFpOffset));
   __ LoadStackLimit(tmp, StackLimitKind::kRealStackLimit);
-  __ StoreU64(tmp, MemOperand(jmpbuf, wasm::kJmpBufStackLimitOffset));
+  __ StoreU64(tmp, MemOperand(stack, wasm::kStackLimitOffset));
 
   __ GetLabelAddress(tmp, target);
   // Stash the address in the jump buffer.
-  __ StoreU64(tmp, MemOperand(jmpbuf, wasm::kJmpBufPcOffset));
+  __ StoreU64(tmp, MemOperand(stack, wasm::kStackPcOffset));
 }
 
-void LoadJumpBuffer(MacroAssembler* masm, Register jmpbuf, bool load_pc,
+void LoadJumpBuffer(MacroAssembler* masm, Register stack, bool load_pc,
                     Register tmp, wasm::JumpBuffer::StackState expected_state) {
-  SwitchStackPointer(masm, jmpbuf);
-  __ LoadU64(fp, MemOperand(jmpbuf, wasm::kJmpBufFpOffset));
-  SwitchStackState(masm, jmpbuf, tmp, expected_state, wasm::JumpBuffer::Active);
+  SwitchStackPointer(masm, stack);
+  __ LoadU64(fp, MemOperand(stack, wasm::kStackFpOffset));
+  SwitchStackState(masm, stack, tmp, expected_state, wasm::JumpBuffer::Active);
   if (load_pc) {
-    __ LoadU64(tmp, MemOperand(jmpbuf, wasm::kJmpBufPcOffset));
+    __ LoadU64(tmp, MemOperand(stack, wasm::kStackPcOffset));
     __ Jump(tmp);
   }
   // The stack limit in StackGuard is set separately under the ExecutionAccess
   // lock.
 }
 
-void SaveState(MacroAssembler* masm, Register active_continuation, Register tmp,
-               Label* suspend) {
-  Register jmpbuf = tmp;
-  __ LoadU64(jmpbuf, FieldMemOperand(active_continuation,
-                                     WasmContinuationObject::kStackOffset));
-  __ AddS64(jmpbuf, jmpbuf, Operand(wasm::StackMemory::jmpbuf_offset()));
-
-  UseScratchRegisterScope temps(masm);
-  FillJumpBuffer(masm, jmpbuf, suspend, temps.Acquire());
-}
-
-void LoadTargetJumpBuffer(MacroAssembler* masm, Register target_continuation,
+void LoadTargetJumpBuffer(MacroAssembler* masm, Register target_stack,
                           Register tmp,
                           wasm::JumpBuffer::StackState expected_state) {
-  Register target_jmpbuf = target_continuation;
-  __ LoadU64(target_jmpbuf,
-             FieldMemOperand(target_continuation,
-                             WasmContinuationObject::kStackOffset));
-  __ AddS64(target_jmpbuf, target_jmpbuf,
-            Operand(wasm::StackMemory::jmpbuf_offset()));
-
   __ Zero(MemOperand(fp, StackSwitchFrameConstants::kGCScanSlotCountOffset));
   // Switch stack!
-  LoadJumpBuffer(masm, target_jmpbuf, false, tmp, expected_state);
+  LoadJumpBuffer(masm, target_stack, false, tmp, expected_state);
 }
 
 // Updates the stack limit and central stack info, and validates the switch.
-void SwitchStacks(MacroAssembler* masm, Register old_continuation,
-                  bool return_switch,
+void SwitchStacks(MacroAssembler* masm, Register old_stack, bool return_switch,
                   const std::initializer_list<Register> keep) {
   using ER = ExternalReference;
 
@@ -3211,8 +3192,9 @@ void SwitchStacks(MacroAssembler* masm, Register old_continuation,
   {
     __ PrepareCallCFunction(2, r0);
     FrameScope scope(masm, StackFrame::MANUAL);
+    // Move {old_stack} first in case it aliases kCArgRegs[0].
+    __ Move(kCArgRegs[1], old_stack);
     __ Move(kCArgRegs[0], ExternalReference::isolate_address(masm->isolate()));
-    __ Move(kCArgRegs[1], old_continuation);
     __ CallCFunction(
         return_switch ? ER::wasm_return_switch() : ER::wasm_switch_stacks(), 2);
   }
@@ -3222,48 +3204,34 @@ void SwitchStacks(MacroAssembler* masm, Register old_continuation,
   }
 }
 
-void ReloadParentContinuation(MacroAssembler* masm, Register return_reg,
-                              Register return_value, Register context,
-                              Register tmp1, Register tmp2, Register tmp3) {
-  Register active_continuation = tmp1;
-  __ LoadRoot(active_continuation, RootIndex::kActiveContinuation);
+void ReloadParentStack(MacroAssembler* masm, Register return_reg,
+                       Register return_value, Register context, Register tmp1,
+                       Register tmp2, Register tmp3) {
+  Register active_stack = tmp1;
+  __ LoadRootRelative(active_stack, IsolateData::active_stack_offset());
 
   // Set a null pointer in the jump buffer's SP slot to indicate to the stack
   // frame iterator that this stack is empty.
-  Register jmpbuf = tmp2;
-  __ LoadU64(jmpbuf, FieldMemOperand(active_continuation,
-                                     WasmContinuationObject::kStackOffset));
-  __ AddS64(jmpbuf, jmpbuf, Operand(wasm::StackMemory::jmpbuf_offset()));
-  __ Zero(MemOperand(jmpbuf, wasm::kJmpBufSpOffset));
+  __ Zero(MemOperand(active_stack, wasm::kStackSpOffset));
   {
     UseScratchRegisterScope temps(masm);
     Register scratch = temps.Acquire();
-    SwitchStackState(masm, jmpbuf, scratch, wasm::JumpBuffer::Active,
+    SwitchStackState(masm, active_stack, scratch, wasm::JumpBuffer::Active,
                      wasm::JumpBuffer::Retired);
   }
   Register parent = tmp2;
-  __ LoadTaggedField(parent,
-                     FieldMemOperand(active_continuation,
-                                     WasmContinuationObject::kParentOffset));
+  __ LoadU64(parent, MemOperand(active_stack, wasm::kStackParentOffset));
 
-  // Update active continuation root.
-  int32_t active_continuation_offset =
-      MacroAssembler::RootRegisterOffsetForRootIndex(
-          RootIndex::kActiveContinuation);
-  __ StoreU64(parent, MemOperand(kRootRegister, active_continuation_offset));
-  jmpbuf = parent;
-  __ LoadU64(jmpbuf,
-             FieldMemOperand(parent, WasmContinuationObject::kStackOffset));
-  __ AddS64(jmpbuf, jmpbuf, Operand(wasm::StackMemory::jmpbuf_offset()));
+  // Update active stack.
+  __ StoreRootRelative(IsolateData::active_stack_offset(), parent);
 
   // Switch stack!
-  SwitchStacks(masm, active_continuation, true,
-               {return_reg, return_value, context, jmpbuf});
-  LoadJumpBuffer(masm, jmpbuf, false, tmp3, wasm::JumpBuffer::Inactive);
+  SwitchStacks(masm, active_stack, true,
+               {return_reg, return_value, context, parent});
+  LoadJumpBuffer(masm, parent, false, tmp3, wasm::JumpBuffer::Inactive);
 }
 
-void RestoreParentSuspender(MacroAssembler* masm, Register tmp1,
-                            Register tmp2) {
+void RestoreParentSuspender(MacroAssembler* masm, Register tmp1) {
   Register suspender = tmp1;
   __ LoadRoot(suspender, RootIndex::kActiveSuspender);
   __ LoadTaggedField(
@@ -3474,30 +3442,25 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
   // Save current state in active jump buffer.
   // -------------------------------------------
   Label resume;
-  DEFINE_REG(continuation);
-  __ LoadRoot(continuation, RootIndex::kActiveContinuation);
-  DEFINE_REG(jmpbuf);
+  DEFINE_REG(stack);
+  __ LoadRootRelative(stack, IsolateData::active_stack_offset());
   DEFINE_REG(scratch);
-  __ LoadU64(jmpbuf, FieldMemOperand(continuation,
-                                     WasmContinuationObject::kStackOffset));
-  __ AddS64(jmpbuf, jmpbuf, Operand(wasm::StackMemory::jmpbuf_offset()));
-  FillJumpBuffer(masm, jmpbuf, &resume, scratch);
-  SwitchStackState(masm, jmpbuf, scratch, wasm::JumpBuffer::Active,
+  FillJumpBuffer(masm, stack, &resume, scratch);
+  SwitchStackState(masm, stack, scratch, wasm::JumpBuffer::Active,
                    wasm::JumpBuffer::Suspended);
-  regs.ResetExcept(suspender, continuation);
+  regs.ResetExcept(suspender, stack);
 
-  DEFINE_REG(suspender_continuation);
-  __ LoadTaggedField(
-      suspender_continuation,
-      FieldMemOperand(suspender, WasmSuspenderObject::kContinuationOffset));
+  DEFINE_REG(suspender_stack);
+  __ LoadU64(suspender_stack,
+             FieldMemOperand(suspender, WasmSuspenderObject::kStackOffset));
   if (v8_flags.debug_code) {
     // -------------------------------------------
-    // Check that the suspender's continuation is the active continuation.
+    // Check that the suspender's stack is the active stack.
     // -------------------------------------------
     // TODO(thibaudm): Once we add core stack-switching instructions, this
-    // check will not hold anymore: it's possible that the active continuation
+    // check will not hold anymore: it's possible that the active stack
     // changed (due to an internal switch), so we have to update the suspender.
-    __ CmpS64(suspender_continuation, continuation);
+    __ CmpS64(suspender_stack, stack);
     Label ok;
     __ beq(&ok);
     __ Trap();
@@ -3507,13 +3470,8 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
   // Update roots.
   // -------------------------------------------
   DEFINE_REG(caller);
-  __ LoadTaggedField(caller,
-                     FieldMemOperand(suspender_continuation,
-                                     WasmContinuationObject::kParentOffset));
-  int32_t active_continuation_offset =
-      MacroAssembler::RootRegisterOffsetForRootIndex(
-          RootIndex::kActiveContinuation);
-  __ StoreU64(caller, MemOperand(kRootRegister, active_continuation_offset));
+  __ LoadU64(caller, MemOperand(suspender_stack, wasm::kStackParentOffset));
+  __ StoreRootRelative(IsolateData::active_stack_offset(), caller);
   DEFINE_REG(parent);
   __ LoadTaggedField(
       parent, FieldMemOperand(suspender, WasmSuspenderObject::kParentOffset));
@@ -3521,17 +3479,13 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
       MacroAssembler::RootRegisterOffsetForRootIndex(
           RootIndex::kActiveSuspender);
   __ StoreU64(parent, MemOperand(kRootRegister, active_suspender_offset));
-  regs.ResetExcept(suspender, caller, continuation);
+  regs.ResetExcept(suspender, caller, stack);
 
   // -------------------------------------------
   // Load jump buffer.
   // -------------------------------------------
-  SwitchStacks(masm, continuation, false, {caller, suspender});
-  FREE_REG(continuation);
-  ASSIGN_REG(jmpbuf);
-  __ LoadU64(jmpbuf,
-             FieldMemOperand(caller, WasmContinuationObject::kStackOffset));
-  __ AddS64(jmpbuf, jmpbuf, Operand(wasm::StackMemory::jmpbuf_offset()));
+  SwitchStacks(masm, stack, false, {caller, suspender});
+  FREE_REG(stack);
   __ LoadTaggedField(
       kReturnRegister0,
       FieldMemOperand(suspender, WasmSuspenderObject::kPromiseOffset));
@@ -3539,7 +3493,7 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
       MemOperand(fp, StackSwitchFrameConstants::kGCScanSlotCountOffset);
   __ Zero(GCScanSlotPlace);
   ASSIGN_REG(scratch)
-  LoadJumpBuffer(masm, jmpbuf, true, scratch, wasm::JumpBuffer::Inactive);
+  LoadJumpBuffer(masm, caller, true, scratch, wasm::JumpBuffer::Inactive);
   if (v8_flags.debug_code) {
     __ Trap();
   }
@@ -3593,22 +3547,15 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
   // Save current state.
   // -------------------------------------------
   Label suspend;
-  DEFINE_REG(active_continuation);
-  __ LoadRoot(active_continuation, RootIndex::kActiveContinuation);
-  DEFINE_REG(current_jmpbuf);
+  DEFINE_REG(active_stack);
+  __ LoadRootRelative(active_stack, IsolateData::active_stack_offset());
   DEFINE_REG(scratch);
-  __ LoadU64(current_jmpbuf,
-             FieldMemOperand(active_continuation,
-                             WasmContinuationObject::kStackOffset));
-  __ AddS64(current_jmpbuf, current_jmpbuf,
-            Operand(wasm::StackMemory::jmpbuf_offset()));
-  FillJumpBuffer(masm, current_jmpbuf, &suspend, scratch);
-  SwitchStackState(masm, current_jmpbuf, scratch, wasm::JumpBuffer::Active,
+  FillJumpBuffer(masm, active_stack, &suspend, scratch);
+  SwitchStackState(masm, active_stack, scratch, wasm::JumpBuffer::Active,
                    wasm::JumpBuffer::Inactive);
-  FREE_REG(current_jmpbuf);
 
   // -------------------------------------------
-  // Set the suspender and continuation parents and update the roots
+  // Set the suspender and stack parents and update the roots
   // -------------------------------------------
   DEFINE_REG(active_suspender);
   __ LoadRoot(active_suspender, RootIndex::kActiveSuspender);
@@ -3627,51 +3574,29 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
   // the same register for target_continuation to use it in RecordWriteField.
   // So, free suspender here to use pinned reg, but load from it next line.
   FREE_REG(suspender);
-  DEFINE_PINNED(target_continuation, WriteBarrierDescriptor::ObjectRegister());
-  suspender = target_continuation;
-  __ LoadTaggedField(
-      target_continuation,
-      FieldMemOperand(suspender, WasmSuspenderObject::kContinuationOffset));
+  DEFINE_REG(target_stack);
+  suspender = target_stack;
+  __ LoadU64(target_stack,
+             FieldMemOperand(suspender, WasmSuspenderObject::kStackOffset));
   suspender = no_reg;
 
-  __ StoreTaggedField(active_continuation,
-                      FieldMemOperand(target_continuation,
-                                      WasmContinuationObject::kParentOffset));
-  DEFINE_REG(old_continuation);
-  __ Move(old_continuation, active_continuation);
-  __ RecordWriteField(
-      target_continuation, WasmContinuationObject::kParentOffset,
-      active_continuation, ip, kLRHasBeenSaved, SaveFPRegsMode::kIgnore);
-  FREE_REG(active_continuation);
-  int32_t active_continuation_offset =
-      MacroAssembler::RootRegisterOffsetForRootIndex(
-          RootIndex::kActiveContinuation);
-  __ StoreU64(target_continuation,
-              MemOperand(kRootRegister, active_continuation_offset));
-
-  SwitchStacks(masm, old_continuation, false, {target_continuation});
-
-  regs.ResetExcept(target_continuation);
+  __ StoreRootRelative(IsolateData::active_stack_offset(), target_stack);
+  SwitchStacks(masm, active_stack, false, {target_stack});
+  regs.ResetExcept(target_stack);
 
   // -------------------------------------------
   // Load state from target jmpbuf (longjmp).
   // -------------------------------------------
   regs.Reserve(kReturnRegister0);
-  DEFINE_REG(target_jmpbuf);
   ASSIGN_REG(scratch);
-  __ LoadU64(target_jmpbuf,
-             FieldMemOperand(target_continuation,
-                             WasmContinuationObject::kStackOffset));
-  __ AddS64(target_jmpbuf, target_jmpbuf,
-            Operand(wasm::StackMemory::jmpbuf_offset()));
   // Move resolved value to return register.
   __ LoadU64(kReturnRegister0, MemOperand(fp, 3 * kSystemPointerSize));
   MemOperand GCScanSlotPlace =
       MemOperand(fp, StackSwitchFrameConstants::kGCScanSlotCountOffset);
   __ Zero(GCScanSlotPlace);
   if (on_resume == wasm::OnResume::kThrow) {
-    // Switch to the continuation's stack without restoring the PC.
-    LoadJumpBuffer(masm, target_jmpbuf, false, scratch,
+    // Switch without restoring the PC.
+    LoadJumpBuffer(masm, target_stack, false, scratch,
                    wasm::JumpBuffer::Suspended);
     // Pop this frame now. The unwinder expects that the first STACK_SWITCH
     // frame is the outermost one.
@@ -3680,8 +3605,8 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
     __ Push(kReturnRegister0);
     __ CallRuntime(Runtime::kThrow);
   } else {
-    // Resume the continuation normally.
-    LoadJumpBuffer(masm, target_jmpbuf, true, scratch,
+    // Resume the stack normally.
+    LoadJumpBuffer(masm, target_stack, true, scratch,
                    wasm::JumpBuffer::Suspended);
   }
   if (v8_flags.debug_code) {
@@ -3715,27 +3640,23 @@ void SwitchToAllocatedStack(MacroAssembler* masm, RegisterAllocator& regs,
                             Label* suspend) {
   ResetStackSwitchFrameStackSlots(masm);
   DEFINE_SCOPED(scratch)
-  DEFINE_REG(target_continuation)
-  __ LoadRoot(target_continuation, RootIndex::kActiveContinuation);
-  DEFINE_REG(parent_continuation)
-  __ LoadTaggedField(parent_continuation,
-                     FieldMemOperand(target_continuation,
-                                     WasmContinuationObject::kParentOffset));
-
-  SaveState(masm, parent_continuation, scratch, suspend);
+  DEFINE_REG(target_stack)
+  __ LoadRootRelative(target_stack, IsolateData::active_stack_offset());
+  DEFINE_REG(parent_stack)
+  __ LoadU64(parent_stack, MemOperand(target_stack, wasm::kStackParentOffset));
 
-  SwitchStacks(masm, parent_continuation, false,
-               {wasm_instance, wrapper_buffer});
+  FillJumpBuffer(masm, parent_stack, suspend, scratch);
+  SwitchStacks(masm, parent_stack, false, {wasm_instance, wrapper_buffer});
 
-  FREE_REG(parent_continuation);
+  FREE_REG(parent_stack);
   // Save the old stack's fp in r13, and use it to access the parameters in
   // the parent frame.
   regs.Pinned(r13, &original_fp);
   __ Move(original_fp, fp);
-  __ LoadRoot(target_continuation, RootIndex::kActiveContinuation);
-  LoadTargetJumpBuffer(masm, target_continuation, scratch,
+  __ LoadRootRelative(target_stack, IsolateData::active_stack_offset());
+  LoadTargetJumpBuffer(masm, target_stack, scratch,
                        wasm::JumpBuffer::Suspended);
-  FREE_REG(target_continuation);
+  FREE_REG(target_stack);
 
   // Push the loaded fp. We know it is null, because there is no frame yet,
   // so we could also push 0 directly. In any case we need to push it,
@@ -3802,9 +3723,9 @@ void SwitchBackAndReturnPromise(MacroAssembler* masm, RegisterAllocator& regs,
              MemOperand(fp, StackSwitchFrameConstants::kImplicitArgOffset));
   GetContextFromImplicitArg(masm, kContextRegister, tmp);
 
-  ReloadParentContinuation(masm, promise, return_value, kContextRegister, tmp,
-                           tmp2, tmp3);
-  RestoreParentSuspender(masm, tmp, tmp2);
+  ReloadParentStack(masm, promise, return_value, kContextRegister, tmp, tmp2,
+                    tmp3);
+  RestoreParentSuspender(masm, tmp);
 
   if (mode == wasm::kPromise) {
     __ mov(tmp, Operand(1));
@@ -3852,9 +3773,8 @@ void GenerateExceptionHandlingLandingPad(MacroAssembler* masm,
   __ LoadU64(kContextRegister,
              MemOperand(fp, StackSwitchFrameConstants::kImplicitArgOffset));
   GetContextFromImplicitArg(masm, kContextRegister, tmp);
-  ReloadParentContinuation(masm, promise, reason, kContextRegister, tmp, tmp2,
-                           tmp3);
-  RestoreParentSuspender(masm, tmp, tmp2);
+  ReloadParentStack(masm, promise, reason, kContextRegister, tmp, tmp2, tmp3);
+  RestoreParentSuspender(masm, tmp);
 
   __ mov(tmp, Operand(1));
   __ StoreU64(
@@ -4171,6 +4091,7 @@ void SwitchToTheCentralStackIfNeeded(MacroAssembler* masm, Register argc_input,
   // zLinux ABI requires caller's frame to have sufficient space for callee
   // preserved register save area.
   __ lay(sp, MemOperand(sp, -kNumRequiredStackFrameSlots * kSystemPointerSize));
+  __ StoreU64(MemOperand(sp), Operand::Zero(), r0);
 
   // Update the sp saved in the frame.
   // It will be used to calculate the callee pc during GC.
diff --git a/deps/v8/src/builtins/wasm.tq b/deps/v8/src/builtins/wasm.tq
index 900d7d98867e8d..19f2042925056c 100644
--- a/deps/v8/src/builtins/wasm.tq
+++ b/deps/v8/src/builtins/wasm.tq
@@ -44,7 +44,7 @@ extern runtime WasmI64AtomicWait(
 extern runtime WasmArrayCopy(Context, WasmArray, Smi, WasmArray, Smi, Smi):
     JSAny;
 extern runtime WasmAllocateDescriptorStruct(
-    Context, WasmTrustedInstanceData, Map, Smi): WasmStruct;
+    Context, WasmTrustedInstanceData, Map, Smi, Object): WasmStruct;
 extern runtime WasmArrayNewSegment(
     Context, WasmTrustedInstanceData, Smi, Smi, Smi, Map): Object;
 extern runtime WasmStringNewSegmentWtf8(
@@ -83,6 +83,7 @@ extern runtime WasmLiftoffDeoptFinish(NoContext, WasmTrustedInstanceData):
     Undefined;
 
 extern runtime PropagateException(NoContext): JSAny;
+extern runtime AllocateInSharedHeap(Context, Smi, Smi): HeapObject;
 }
 
 extern operator '.wasm_exported_function_data' macro
@@ -502,12 +503,24 @@ builtin WasmAllocateStructWithRtt(rtt: Map, instanceSize: int32): HeapObject {
   return result;
 }
 
-builtin WasmAllocateDescriptorStruct(map: Map, typeIndex: int32): WasmStruct {
+builtin WasmAllocateDescriptorStruct(
+    map: Map, typeIndex: int32, firstField: Object): WasmStruct {
   // TODO(42204563): Figure out support for shared objects.
   const trustedData: WasmTrustedInstanceData = LoadInstanceDataFromFrame();
   const result: WasmStruct = runtime::WasmAllocateDescriptorStruct(
       LoadContextFromInstanceData(trustedData), trustedData, map,
-      SmiTag(Convert<intptr>(typeIndex)));
+      SmiTag(Convert<intptr>(typeIndex)), firstField);
+  return result;
+}
+
+builtin WasmAllocateSharedStructWithRtt(rtt: Map, instanceSize: int32):
+    HeapObject {
+  const result: HeapObject = runtime::AllocateInSharedHeap(
+      LoadContextFromFrame(), SmiFromInt32(instanceSize), SmiConstant(0));
+  *UnsafeConstCast(&result.map) = rtt;
+  // TODO(ishell): consider removing properties_or_hash field from
+  // WasmObjects.
+  %RawDownCast<WasmStruct>(result).properties_or_hash = kEmptyFixedArray;
   return result;
 }
 
@@ -527,6 +540,23 @@ builtin WasmAllocateArray_Uninitialized(
   return %RawDownCast<WasmArray>(result);
 }
 
+builtin WasmAllocateSharedArray_Uninitialized(
+    rtt: Map, length: uint32, elementSize: uint32): WasmArray {
+  // instanceSize = RoundUp(elementSize * length, kObjectAlignment)
+  //              + WasmArray::kHeaderSize
+  const instanceSize: intptr =
+      torque_internal::AlignTagged(
+          Convert<intptr>(length) * Convert<intptr>(elementSize)) +
+      Convert<intptr>(kWasmArrayHeaderSize);
+  const result: HeapObject = runtime::AllocateInSharedHeap(
+      LoadContextFromFrame(), SmiFromIntPtr(instanceSize), SmiConstant(0));
+  *UnsafeConstCast(&result.map) = rtt;
+  // TODO(ishell): consider removing properties_or_hash field from WasmObjects.
+  %RawDownCast<WasmArray>(result).properties_or_hash = kEmptyFixedArray;
+  %RawDownCast<WasmArray>(result).length = length;
+  return %RawDownCast<WasmArray>(result);
+}
+
 builtin WasmArrayNewSegment(
     segmentIndex: uint32, offset: uint32, length: uint32, isElement: Smi,
     extractSharedData: Smi, rtt: Map): Object {
@@ -790,7 +820,7 @@ transitioning builtin WasmGetOwnProperty(
           receiver, receiver.map, receiver.instanceType, uniqueName)
           otherwise Found, NotFound, NotFound;
     } label Found {
-      tail GetPropertyWithReceiver(
+      return GetPropertyWithReceiver(
           receiver, uniqueName, receiver, SmiConstant(kReturnUndefined));
     }
   } label NotFound deferred {
@@ -1198,9 +1228,12 @@ builtin ThrowDataViewOutOfBounds(): JSAny {
   runtime::WasmThrowRangeError(context, SmiConstant(error));
 }
 
+extern builtin WasmStringAdd_CheckNone(
+    implicit context: Context)(String, String): String;
+
 builtin WasmStringConcat(a: String, b: String): String {
   const context = LoadContextFromFrame();
-  tail StringAdd_CheckNone(a, b);
+  tail WasmStringAdd_CheckNone(a, b);
 }
 
 extern builtin StringEqual(NoContext, String, String, intptr): Boolean;
@@ -1561,4 +1594,8 @@ builtin WasmFastApiCallTypeCheckAndUpdateIC(
     runtime::WasmThrowTypeError(context, SmiConstant(error), Convert<Smi>(0));
   }
 }
+
+builtin WasmStringIndexOf(s: String, searchString: String, start: Smi): Smi {
+  return AbstractStringIndexOf(s, searchString, SmiMax(start, 0));
+}
 }  // namespace wasm
diff --git a/deps/v8/src/builtins/x64/builtins-x64.cc b/deps/v8/src/builtins/x64/builtins-x64.cc
index b212110efb7b4d..9020ed56647339 100644
--- a/deps/v8/src/builtins/x64/builtins-x64.cc
+++ b/deps/v8/src/builtins/x64/builtins-x64.cc
@@ -3420,70 +3420,51 @@ void Builtins::Generate_WasmDebugBreak(MacroAssembler* masm) {
 namespace {
 // Check that the stack was in the old state (if generated code assertions are
 // enabled), and switch to the new state.
-void SwitchStackState(MacroAssembler* masm, Register jmpbuf,
+void SwitchStackState(MacroAssembler* masm, Register stack,
                       wasm::JumpBuffer::StackState old_state,
                       wasm::JumpBuffer::StackState new_state) {
 #if V8_ENABLE_SANDBOX
-  __ cmpl(MemOperand(jmpbuf, wasm::kJmpBufStateOffset), Immediate(old_state));
+  __ cmpl(MemOperand(stack, wasm::kStackStateOffset), Immediate(old_state));
   Label ok;
   __ j(equal, &ok, Label::kNear);
   __ Trap();
   __ bind(&ok);
 #endif
-  __ movl(MemOperand(jmpbuf, wasm::kJmpBufStateOffset), Immediate(new_state));
+  __ movl(MemOperand(stack, wasm::kStackStateOffset), Immediate(new_state));
 }
 
-void FillJumpBuffer(MacroAssembler* masm, Register jmpbuf, Label* pc) {
-  __ movq(MemOperand(jmpbuf, wasm::kJmpBufSpOffset), rsp);
-  __ movq(MemOperand(jmpbuf, wasm::kJmpBufFpOffset), rbp);
+void FillJumpBuffer(MacroAssembler* masm, Register stack, Label* pc) {
+  __ movq(MemOperand(stack, wasm::kStackSpOffset), rsp);
+  __ movq(MemOperand(stack, wasm::kStackFpOffset), rbp);
   __ movq(kScratchRegister,
           __ StackLimitAsOperand(StackLimitKind::kRealStackLimit));
-  __ movq(MemOperand(jmpbuf, wasm::kJmpBufStackLimitOffset), kScratchRegister);
+  __ movq(MemOperand(stack, wasm::kStackLimitOffset), kScratchRegister);
   __ leaq(kScratchRegister, MemOperand(pc, 0));
-  __ movq(MemOperand(jmpbuf, wasm::kJmpBufPcOffset), kScratchRegister);
+  __ movq(MemOperand(stack, wasm::kStackPcOffset), kScratchRegister);
 }
 
-void LoadJumpBuffer(MacroAssembler* masm, Register jmpbuf, bool load_pc,
+void LoadJumpBuffer(MacroAssembler* masm, Register stack, bool load_pc,
                     wasm::JumpBuffer::StackState expected_state) {
-  __ movq(rsp, MemOperand(jmpbuf, wasm::kJmpBufSpOffset));
-  __ movq(rbp, MemOperand(jmpbuf, wasm::kJmpBufFpOffset));
-  SwitchStackState(masm, jmpbuf, expected_state, wasm::JumpBuffer::Active);
+  __ movq(rsp, MemOperand(stack, wasm::kStackSpOffset));
+  __ movq(rbp, MemOperand(stack, wasm::kStackFpOffset));
+  SwitchStackState(masm, stack, expected_state, wasm::JumpBuffer::Active);
   if (load_pc) {
-    __ jmp(MemOperand(jmpbuf, wasm::kJmpBufPcOffset));
+    __ jmp(MemOperand(stack, wasm::kStackPcOffset));
   }
   // The stack limit is set separately under the ExecutionAccess lock.
 }
 
-void SaveState(MacroAssembler* masm, Register active_continuation, Register tmp,
-               Label* suspend) {
-  Register jmpbuf = tmp;
-  __ LoadExternalPointerField(
-      jmpbuf,
-      FieldOperand(active_continuation, WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag, kScratchRegister);
-  __ leaq(jmpbuf, Operand(jmpbuf, wasm::StackMemory::jmpbuf_offset()));
-  FillJumpBuffer(masm, jmpbuf, suspend);
-}
-
-void LoadTargetJumpBuffer(MacroAssembler* masm, Register target_continuation,
+void LoadTargetJumpBuffer(MacroAssembler* masm, Register target_stack,
                           wasm::JumpBuffer::StackState expected_state) {
-  Register target_jmpbuf = target_continuation;
-  __ LoadExternalPointerField(
-      target_jmpbuf,
-      FieldOperand(target_continuation, WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag, kScratchRegister);
-  __ leaq(target_jmpbuf,
-          Operand(target_jmpbuf, wasm::StackMemory::jmpbuf_offset()));
   MemOperand GCScanSlotPlace =
       MemOperand(rbp, StackSwitchFrameConstants::kGCScanSlotCountOffset);
   __ Move(GCScanSlotPlace, 0);
   // Switch stack!
-  LoadJumpBuffer(masm, target_jmpbuf, false, expected_state);
+  LoadJumpBuffer(masm, target_stack, false, expected_state);
 }
 
 // Updates the stack limit and central stack info, and validates the switch.
-void SwitchStacks(MacroAssembler* masm, Register old_continuation,
-                  bool return_switch,
+void SwitchStacks(MacroAssembler* masm, Register old_stack, bool return_switch,
                   const std::initializer_list<Register> keep) {
   using ER = ExternalReference;
   for (auto reg : keep) {
@@ -3491,8 +3472,9 @@ void SwitchStacks(MacroAssembler* masm, Register old_continuation,
   }
   {
     FrameScope scope(masm, StackFrame::MANUAL);
+    // Move {old_stack} first in case it aliases kCArgRegs[0].
+    __ Move(kCArgRegs[1], old_stack);
     __ Move(kCArgRegs[0], ExternalReference::isolate_address());
-    __ Move(kCArgRegs[1], old_continuation);
     __ PrepareCallCFunction(2);
     __ CallCFunction(
         return_switch ? ER::wasm_return_switch() : ER::wasm_switch_stacks(), 2);
@@ -3502,40 +3484,23 @@ void SwitchStacks(MacroAssembler* masm, Register old_continuation,
   }
 }
 
-void ReloadParentContinuation(MacroAssembler* masm, Register promise,
-                              Register return_value, Register context,
-                              Register tmp1, Register tmp2) {
-  Register active_continuation = tmp1;
-  __ LoadRoot(active_continuation, RootIndex::kActiveContinuation);
+void ReloadParentStack(MacroAssembler* masm, Register promise,
+                       Register return_value, Register context, Register tmp1,
+                       Register tmp2) {
+  Register active_stack = tmp1;
+  __ LoadRootRelative(active_stack, IsolateData::active_stack_offset());
 
   // We don't need to save the full register state since we are switching out of
   // this stack for the last time. Mark the stack as retired.
-  Register jmpbuf = kScratchRegister;
-  __ LoadExternalPointerField(
-      jmpbuf,
-      FieldOperand(active_continuation, WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag, tmp2);
-  __ leaq(jmpbuf, Operand(jmpbuf, wasm::StackMemory::jmpbuf_offset()));
-  SwitchStackState(masm, jmpbuf, wasm::JumpBuffer::Active,
+  SwitchStackState(masm, active_stack, wasm::JumpBuffer::Active,
                    wasm::JumpBuffer::Retired);
-
   Register parent = tmp2;
-  __ LoadTaggedField(
-      parent,
-      FieldOperand(active_continuation, WasmContinuationObject::kParentOffset));
-
-  // Update active continuation root.
-  __ movq(masm->RootAsOperand(RootIndex::kActiveContinuation), parent);
-  jmpbuf = parent;
-  __ LoadExternalPointerField(
-      jmpbuf, FieldOperand(parent, WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag, kScratchRegister);
-  __ leaq(jmpbuf, Operand(jmpbuf, wasm::StackMemory::jmpbuf_offset()));
-
+  __ Move(parent, MemOperand(active_stack, wasm::kStackParentOffset));
+  __ StoreRootRelative(IsolateData::active_stack_offset(), parent);
   // Switch stack!
-  SwitchStacks(masm, active_continuation, true,
-               {promise, return_value, context, jmpbuf});
-  LoadJumpBuffer(masm, jmpbuf, false, wasm::JumpBuffer::Inactive);
+  SwitchStacks(masm, active_stack, true,
+               {promise, return_value, context, parent});
+  LoadJumpBuffer(masm, parent, false, wasm::JumpBuffer::Inactive);
 }
 
 // Loads the context field of the WasmTrustedInstanceData or WasmImportData
@@ -3556,8 +3521,7 @@ void GetContextFromImplicitArg(MacroAssembler* masm, Register data) {
   __ bind(&end);
 }
 
-void RestoreParentSuspender(MacroAssembler* masm, Register tmp1,
-                            Register tmp2) {
+void RestoreParentSuspender(MacroAssembler* masm, Register tmp1) {
   Register suspender = tmp1;
   __ LoadRoot(suspender, RootIndex::kActiveSuspender);
   __ LoadTaggedField(
@@ -3579,21 +3543,19 @@ void SwitchToAllocatedStack(MacroAssembler* masm, Register wasm_instance,
                             Register new_wrapper_buffer, Register scratch,
                             Label* suspend) {
   ResetStackSwitchFrameStackSlots(masm);
-  Register parent_continuation = new_wrapper_buffer;
-  __ LoadRoot(parent_continuation, RootIndex::kActiveContinuation);
-  __ LoadTaggedField(
-      parent_continuation,
-      FieldOperand(parent_continuation, WasmContinuationObject::kParentOffset));
-  SaveState(masm, parent_continuation, scratch, suspend);
-  SwitchStacks(masm, parent_continuation, false,
+  Register parent_stack = new_wrapper_buffer;
+  __ LoadRootRelative(parent_stack, IsolateData::active_stack_offset());
+  __ Move(parent_stack, MemOperand(parent_stack, wasm::kStackParentOffset));
+  FillJumpBuffer(masm, parent_stack, suspend);
+  SwitchStacks(masm, parent_stack, false,
                {kWasmImplicitArgRegister, wrapper_buffer});
-  parent_continuation = no_reg;
-  Register target_continuation = scratch;
-  __ LoadRoot(target_continuation, RootIndex::kActiveContinuation);
+  parent_stack = no_reg;
+  Register target_stack = scratch;
+  __ LoadRootRelative(target_stack, IsolateData::active_stack_offset());
   // Save the old stack's rbp in r9, and use it to access the parameters in
   // the parent frame.
   __ movq(original_fp, rbp);
-  LoadTargetJumpBuffer(masm, target_continuation, wasm::JumpBuffer::Suspended);
+  LoadTargetJumpBuffer(masm, target_stack, wasm::JumpBuffer::Suspended);
   // Return address slot. The builtin itself returns by switching to the parent
   // jump buffer and does not actually use this slot, but it is read by the
   // profiler.
@@ -3650,9 +3612,8 @@ void SwitchBackAndReturnPromise(MacroAssembler* masm, Register tmp1,
   __ movq(kContextRegister,
           MemOperand(rbp, StackSwitchFrameConstants::kImplicitArgOffset));
   GetContextFromImplicitArg(masm, kContextRegister);
-  ReloadParentContinuation(masm, promise, return_value, kContextRegister, tmp1,
-                           tmp2);
-  RestoreParentSuspender(masm, tmp1, tmp2);
+  ReloadParentStack(masm, promise, return_value, kContextRegister, tmp1, tmp2);
+  RestoreParentSuspender(masm, tmp1);
 
   if (mode == wasm::kPromise) {
     __ Move(MemOperand(rbp, StackSwitchFrameConstants::kGCScanSlotCountOffset),
@@ -3696,8 +3657,8 @@ void GenerateExceptionHandlingLandingPad(MacroAssembler* masm,
           MemOperand(rbp, StackSwitchFrameConstants::kImplicitArgOffset));
   GetContextFromImplicitArg(masm, kContextRegister);
 
-  ReloadParentContinuation(masm, promise, reason, kContextRegister, r8, rdi);
-  RestoreParentSuspender(masm, r8, rdi);
+  ReloadParentStack(masm, promise, reason, kContextRegister, r8, rdi);
+  RestoreParentSuspender(masm, r8);
 
   __ Move(MemOperand(rbp, StackSwitchFrameConstants::kGCScanSlotCountOffset),
           1);
@@ -3975,31 +3936,26 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
   // Save current state in active jump buffer.
   // -------------------------------------------
   Label resume;
-  Register continuation = rbx;
-  __ LoadRoot(continuation, RootIndex::kActiveContinuation);
-  Register jmpbuf = rdx;
-  __ LoadExternalPointerField(
-      jmpbuf, FieldOperand(continuation, WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag, r8);
-  __ leaq(jmpbuf, Operand(jmpbuf, wasm::StackMemory::jmpbuf_offset()));
-  FillJumpBuffer(masm, jmpbuf, &resume);
-  SwitchStackState(masm, jmpbuf, wasm::JumpBuffer::Active,
+  Register stack = rbx;
+  __ LoadRootRelative(stack, IsolateData::active_stack_offset());
+  FillJumpBuffer(masm, stack, &resume);
+  SwitchStackState(masm, stack, wasm::JumpBuffer::Active,
                    wasm::JumpBuffer::Suspended);
-  jmpbuf = no_reg;
-  // live: [rax, rbx, rcx]
+  // live: [rax, rbx]
 
-  Register suspender_continuation = rdx;
-  __ LoadTaggedField(
-      suspender_continuation,
-      FieldOperand(suspender, WasmSuspenderObject::kContinuationOffset));
+  Register suspender_stack = rdx;
+  __ LoadExternalPointerField(
+      suspender_stack,
+      FieldOperand(suspender, WasmSuspenderObject::kStackOffset),
+      kWasmStackMemoryTag, kScratchRegister);
 #ifdef DEBUG
   // -------------------------------------------
-  // Check that the suspender's continuation is the active continuation.
+  // Check that the suspender's stack is the active stack.
   // -------------------------------------------
   // TODO(thibaudm): Once we add core stack-switching instructions, this check
-  // will not hold anymore: it's possible that the active continuation changed
+  // will not hold anymore: it's possible that the active stack changed
   // (due to an internal switch), so we have to update the suspender.
-  __ cmpq(suspender_continuation, continuation);
+  __ cmpq(suspender_stack, stack);
   Label ok;
   __ j(equal, &ok);
   __ Trap();
@@ -4010,35 +3966,26 @@ void Builtins::Generate_WasmSuspend(MacroAssembler* masm) {
   // Update roots.
   // -------------------------------------------
   Register caller = rcx;
-  __ LoadTaggedField(caller,
-                     FieldOperand(suspender_continuation,
-                                  WasmContinuationObject::kParentOffset));
-  __ movq(masm->RootAsOperand(RootIndex::kActiveContinuation), caller);
+  __ Move(caller, MemOperand(suspender_stack, wasm::kStackParentOffset));
+  __ StoreRootRelative(IsolateData::active_stack_offset(), caller);
   Register parent = rdx;
   __ LoadTaggedField(
       parent, FieldOperand(suspender, WasmSuspenderObject::kParentOffset));
   __ movq(masm->RootAsOperand(RootIndex::kActiveSuspender), parent);
   parent = no_reg;
-  // live: [rax, rbx, rcx]
+  // live: [suspender:rax, stack:rbx, caller:rcx]
 
   // -------------------------------------------
   // Load jump buffer.
   // -------------------------------------------
-  SwitchStacks(masm, continuation, false, {caller, suspender});
-  continuation = no_reg;
-  jmpbuf = caller;
-  __ LoadExternalPointerField(
-      jmpbuf, FieldOperand(caller, WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag, r8);
-  __ leaq(jmpbuf, Operand(jmpbuf, wasm::StackMemory::jmpbuf_offset()));
-  caller = no_reg;
+  SwitchStacks(masm, stack, false, {caller, suspender});
   __ LoadTaggedField(
       kReturnRegister0,
       FieldOperand(suspender, WasmSuspenderObject::kPromiseOffset));
   MemOperand GCScanSlotPlace =
       MemOperand(rbp, StackSwitchFrameConstants::kGCScanSlotCountOffset);
   __ Move(GCScanSlotPlace, 0);
-  LoadJumpBuffer(masm, jmpbuf, true, wasm::JumpBuffer::Inactive);
+  LoadJumpBuffer(masm, caller, true, wasm::JumpBuffer::Inactive);
   __ Trap();
   __ bind(&resume);
   __ endbr64();
@@ -4090,22 +4037,14 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
   // Save current state.
   // -------------------------------------------
   Label suspend;
-  Register active_continuation = r9;
-  __ LoadRoot(active_continuation, RootIndex::kActiveContinuation);
-  Register current_jmpbuf = rax;
-  __ LoadExternalPointerField(
-      current_jmpbuf,
-      FieldOperand(active_continuation, WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag, rdx);
-  __ leaq(current_jmpbuf,
-          Operand(current_jmpbuf, wasm::StackMemory::jmpbuf_offset()));
-  FillJumpBuffer(masm, current_jmpbuf, &suspend);
-  SwitchStackState(masm, current_jmpbuf, wasm::JumpBuffer::Active,
+  Register active_stack = r9;
+  __ LoadRootRelative(active_stack, IsolateData::active_stack_offset());
+  FillJumpBuffer(masm, active_stack, &suspend);
+  SwitchStackState(masm, active_stack, wasm::JumpBuffer::Active,
                    wasm::JumpBuffer::Inactive);
-  current_jmpbuf = no_reg;
 
   // -------------------------------------------
-  // Set the suspender and continuation parents and update the roots
+  // Set the suspender and stack parents and update the roots
   // -------------------------------------------
   Register active_suspender = rcx;
   Register slot_address = WriteBarrierDescriptor::SlotAddressRegister();
@@ -4119,42 +4058,25 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
                       active_suspender, slot_address, SaveFPRegsMode::kIgnore);
   __ movq(masm->RootAsOperand(RootIndex::kActiveSuspender), suspender);
 
-  Register target_continuation = suspender;
-  __ LoadTaggedField(
-      target_continuation,
-      FieldOperand(suspender, WasmSuspenderObject::kContinuationOffset));
+  Register target_stack = suspender;
+  __ LoadExternalPointerField(
+      target_stack, FieldOperand(suspender, WasmSuspenderObject::kStackOffset),
+      kWasmStackMemoryTag, kScratchRegister);
   suspender = no_reg;
-  __ StoreTaggedField(
-      FieldOperand(target_continuation, WasmContinuationObject::kParentOffset),
-      active_continuation);
-  Register old_continuation = r11;
-  __ movq(old_continuation, active_continuation);
-  __ RecordWriteField(
-      target_continuation, WasmContinuationObject::kParentOffset,
-      active_continuation, slot_address, SaveFPRegsMode::kIgnore);
-  active_continuation = no_reg;
-  __ movq(masm->RootAsOperand(RootIndex::kActiveContinuation),
-          target_continuation);
-
-  SwitchStacks(masm, old_continuation, false, {target_continuation});
+  __ StoreRootRelative(IsolateData::active_stack_offset(), target_stack);
+
+  SwitchStacks(masm, active_stack, false, {target_stack});
 
   // -------------------------------------------
   // Load state from target jmpbuf (longjmp).
   // -------------------------------------------
-  Register target_jmpbuf = rdi;
-  __ LoadExternalPointerField(
-      target_jmpbuf,
-      FieldOperand(target_continuation, WasmContinuationObject::kStackOffset),
-      kWasmStackMemoryTag, rax);
-  __ leaq(target_jmpbuf,
-          Operand(target_jmpbuf, wasm::StackMemory::jmpbuf_offset()));
   // Move resolved value to return register.
   __ movq(kReturnRegister0, Operand(rbp, 3 * kSystemPointerSize));
   __ Move(MemOperand(rbp, StackSwitchFrameConstants::kGCScanSlotCountOffset),
           0);
   if (on_resume == wasm::OnResume::kThrow) {
-    // Switch to the continuation's stack without restoring the PC.
-    LoadJumpBuffer(masm, target_jmpbuf, false, wasm::JumpBuffer::Suspended);
+    // Switch to the target stack without restoring the PC.
+    LoadJumpBuffer(masm, target_stack, false, wasm::JumpBuffer::Suspended);
     // Pop this frame now. The unwinder expects that the first STACK_SWITCH
     // frame is the outermost one.
     __ LeaveFrame(StackFrame::STACK_SWITCH);
@@ -4163,8 +4085,8 @@ void Generate_WasmResumeHelper(MacroAssembler* masm, wasm::OnResume on_resume) {
     __ Move(kContextRegister, Smi::zero());
     __ CallRuntime(Runtime::kThrow);
   } else {
-    // Resume the continuation normally.
-    LoadJumpBuffer(masm, target_jmpbuf, true, wasm::JumpBuffer::Suspended);
+    // Resume the stack normally.
+    LoadJumpBuffer(masm, target_stack, true, wasm::JumpBuffer::Suspended);
   }
   __ Trap();
   __ bind(&suspend);
diff --git a/deps/v8/src/codegen/arm64/assembler-arm64-inl.h b/deps/v8/src/codegen/arm64/assembler-arm64-inl.h
index 163150a1b6c730..69dff10a50a7df 100644
--- a/deps/v8/src/codegen/arm64/assembler-arm64-inl.h
+++ b/deps/v8/src/codegen/arm64/assembler-arm64-inl.h
@@ -655,8 +655,7 @@ Tagged<HeapObject> RelocInfo::target_object(PtrComprCageBase cage_base) {
     Tagged_t compressed =
         Assembler::target_compressed_address_at(pc_, constant_pool_);
     DCHECK(!HAS_SMI_TAG(compressed));
-    Tagged<Object> obj(
-        V8HeapCompressionScheme::DecompressTagged(cage_base, compressed));
+    Tagged<Object> obj(V8HeapCompressionScheme::DecompressTagged(compressed));
     return Cast<HeapObject>(obj);
   } else {
     return Cast<HeapObject>(
diff --git a/deps/v8/src/codegen/arm64/assembler-arm64.cc b/deps/v8/src/codegen/arm64/assembler-arm64.cc
index 427256d8c683e1..2528ab81bf618c 100644
--- a/deps/v8/src/codegen/arm64/assembler-arm64.cc
+++ b/deps/v8/src/codegen/arm64/assembler-arm64.cc
@@ -70,6 +70,9 @@ constexpr unsigned CpuFeaturesFromCompiler() {
 #if defined(__ARM_FEATURE_DOTPROD)
   features |= 1u << DOTPROD;
 #endif
+#if defined(__ARM_FEATURE_SHA3)
+  features |= 1u << SHA3;
+#endif
 #if defined(__ARM_FEATURE_ATOMICS)
   features |= 1u << LSE;
 #endif
@@ -77,6 +80,9 @@ constexpr unsigned CpuFeaturesFromCompiler() {
 // covers the FEAT_PMULL feature too.
 #if defined(__ARM_FEATURE_AES)
   features |= 1u << PMULL1Q;
+#endif
+#if defined(__ARM_FEATURE_HBC)
+  features |= 1u << HBC;
 #endif
   return features;
 }
@@ -124,6 +130,9 @@ void CpuFeatures::ProbeImpl(bool cross_compile) {
   if (cpu.has_dot_prod()) {
     runtime |= 1u << DOTPROD;
   }
+  if (cpu.has_sha3()) {
+    runtime |= 1u << SHA3;
+  }
   if (cpu.has_lse()) {
     runtime |= 1u << LSE;
   }
@@ -133,6 +142,12 @@ void CpuFeatures::ProbeImpl(bool cross_compile) {
   if (cpu.has_fp16()) {
     runtime |= 1u << FP16;
   }
+  if (cpu.has_hbc()) {
+    runtime |= 1u << HBC;
+  }
+  if (cpu.has_cssc()) {
+    runtime |= 1u << CSSC;
+  }
 
   // Use the best of the features found by CPU detection and those inferred from
   // the build system.
@@ -447,7 +462,8 @@ void Assembler::GetCode(LocalIsolate* isolate, CodeDesc* desc,
   ForceConstantPoolEmissionWithoutJump();
   DCHECK(constpool_.IsEmpty());
 
-  int code_comments_size = WriteCodeComments();
+  const int code_comments_size = WriteCodeComments();
+  const int jump_table_info_size = WriteJumpTableInfos();
 
   AllocateAndInstallRequestedHeapNumbers(isolate);
 
@@ -456,12 +472,9 @@ void Assembler::GetCode(LocalIsolate* isolate, CodeDesc* desc,
   // this point to make CodeDesc initialization less fiddly.
 
   static constexpr int kConstantPoolSize = 0;
-  static constexpr int kBuiltinJumpTableInfoSize = 0;
   const int instruction_size = pc_offset();
-  const int builtin_jump_table_info_offset =
-      instruction_size - kBuiltinJumpTableInfoSize;
-  const int code_comments_offset =
-      builtin_jump_table_info_offset - code_comments_size;
+  const int jump_table_info_offset = instruction_size - jump_table_info_size;
+  const int code_comments_offset = jump_table_info_offset - code_comments_size;
   const int constant_pool_offset = code_comments_offset - kConstantPoolSize;
   const int handler_table_offset2 = (handler_table_offset == kNoHandlerTable)
                                         ? constant_pool_offset
@@ -474,7 +487,7 @@ void Assembler::GetCode(LocalIsolate* isolate, CodeDesc* desc,
       static_cast<int>(reloc_info_writer.pos() - buffer_->start());
   CodeDesc::Initialize(desc, this, safepoint_table_offset,
                        handler_table_offset2, constant_pool_offset,
-                       code_comments_offset, builtin_jump_table_info_offset,
+                       code_comments_offset, jump_table_info_offset,
                        reloc_info_offset);
 }
 
@@ -881,6 +894,14 @@ void Assembler::b(Label* label, Condition cond) {
   b(LinkAndGetBranchInstructionOffsetTo(label), cond);
 }
 
+void Assembler::bc(int imm19, Condition cond) {
+  Emit(BC_cond | ImmCondBranch(imm19) | cond);
+}
+
+void Assembler::bc(Label* label, Condition cond) {
+  bc(LinkAndGetBranchInstructionOffsetTo(label), cond);
+}
+
 void Assembler::bl(int imm26) { Emit(BL | ImmUncondBranch(imm26)); }
 
 void Assembler::bl(Label* label) {
@@ -1299,6 +1320,27 @@ void Assembler::cls(const Register& rd, const Register& rn) {
   DataProcessing1Source(rd, rn, CLS);
 }
 
+void Assembler::abs(const Register& rd, const Register& rn) {
+  DCHECK(IsEnabled(CSSC));
+  DCHECK(rd.IsSameSizeAndType(rn));
+
+  Emit(0x5ac02000 | SF(rd) | Rd(rd) | Rn(rn));
+}
+
+void Assembler::cnt(const Register& rd, const Register& rn) {
+  DCHECK(IsEnabled(CSSC));
+  DCHECK(rd.IsSameSizeAndType(rn));
+
+  Emit(0x5ac01c00 | SF(rd) | Rd(rd) | Rn(rn));
+}
+
+void Assembler::ctz(const Register& rd, const Register& rn) {
+  DCHECK(IsEnabled(CSSC));
+  DCHECK(rd.IsSameSizeAndType(rn));
+
+  Emit(0x5ac01800 | SF(rd) | Rd(rd) | Rn(rn));
+}
+
 void Assembler::pacib1716() { Emit(PACIB1716); }
 void Assembler::autib1716() { Emit(AUTIB1716); }
 void Assembler::pacibsp() { Emit(PACIBSP); }
@@ -3401,6 +3443,20 @@ NEON_3SAME_LIST(DEFINE_ASM_FUNC)
 NEON_FP3SAME_LIST_V2(DEFINE_ASM_FUNC)
 #undef DEFINE_ASM_FUNC
 
+void Assembler::bcax(const VRegister& vd, const VRegister& vn,
+                     const VRegister& vm, const VRegister& va) {
+  DCHECK(IsEnabled(SHA3));
+  DCHECK(vd.Is16B() && vn.Is16B() && vm.Is16B());
+  Emit(NEON_BCAX | Rd(vd) | Rn(vn) | Rm(vm) | Ra(va));
+}
+
+void Assembler::eor3(const VRegister& vd, const VRegister& vn,
+                     const VRegister& vm, const VRegister& va) {
+  DCHECK(IsEnabled(SHA3));
+  DCHECK(vd.Is16B() && vn.Is16B() && vm.Is16B() && va.Is16B());
+  Emit(NEON_EOR3 | Rd(vd) | Rn(vn) | Rm(vm) | Ra(va));
+}
+
 void Assembler::addp(const VRegister& vd, const VRegister& vn) {
   DCHECK((vd.Is1D() && vn.Is2D()));
   Emit(SFormat(vd) | NEON_ADDP_scalar | Rn(vn) | Rd(vd));
@@ -3934,6 +3990,23 @@ void Assembler::EmitStringData(const char* string) {
   EmitData(pad, RoundUp(pc_offset(), kInstrSize) - pc_offset());
 }
 
+void Assembler::WriteJumpTableEntry(Label* label, int table_pos) {
+  if constexpr (V8_JUMP_TABLE_INFO_BOOL) {
+    jump_table_info_writer_.Add(pc_offset(), label->pos());
+  }
+  dc32(label->pos() - table_pos);
+}
+
+int Assembler::WriteJumpTableInfos() {
+  if constexpr (!V8_JUMP_TABLE_INFO_BOOL) return 0;
+  if (jump_table_info_writer_.entry_count() == 0) return 0;
+  int offset = pc_offset();
+  jump_table_info_writer_.Emit(this);
+  int size = pc_offset() - offset;
+  DCHECK_EQ(size, jump_table_info_writer_.size_in_bytes());
+  return size;
+}
+
 void Assembler::debug(const char* message, uint32_t code, Instr params) {
   if (options().enable_simulator_code) {
     size_t size_of_debug_sequence =
diff --git a/deps/v8/src/codegen/arm64/assembler-arm64.h b/deps/v8/src/codegen/arm64/assembler-arm64.h
index d720a4377eb4eb..b5a4ce31deec06 100644
--- a/deps/v8/src/codegen/arm64/assembler-arm64.h
+++ b/deps/v8/src/codegen/arm64/assembler-arm64.h
@@ -16,6 +16,7 @@
 #include "src/codegen/arm64/register-arm64.h"
 #include "src/codegen/assembler.h"
 #include "src/codegen/constant-pool.h"
+#include "src/codegen/jump-table-info.h"
 #include "src/common/globals.h"
 #include "src/utils/utils.h"
 #include "src/zone/zone-containers.h"
@@ -416,6 +417,12 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   // Conditional branch to PC offset.
   void b(int imm19, Condition cond);
 
+  // Conditional branch consistent to label.
+  void bc(Label* label, Condition cond);
+
+  // Conditional branch consistent to PC offset.
+  void bc(int imm19, Condition cond);
+
   // Branch-link to label / pc offset.
   void bl(Label* label);
   void bl(int imm26);
@@ -812,6 +819,15 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   void clz(const Register& rd, const Register& rn);
   void cls(const Register& rd, const Register& rn);
 
+  // Absolute value.
+  void abs(const Register& rd, const Register& rn);
+
+  // Count bits.
+  void cnt(const Register& rd, const Register& rn);
+
+  // Count Trailing Zeros.
+  void ctz(const Register& rd, const Register& rn);
+
   // Pointer Authentication InstructionStream for Instruction address, using key
   // B, with address in x17 and modifier in x16 [Armv8.3].
   void pacib1716();
@@ -2710,11 +2726,22 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   // Emit an address in the instruction stream.
   void dcptr(Label* label);
 
+  // SHA3 instructions
+  // Bit Clear and exclusive-OR.
+  void bcax(const VRegister& vd, const VRegister& vn, const VRegister& vm,
+            const VRegister& va);
+
+  // Three-way Exclusive-OR.
+  void eor3(const VRegister& vd, const VRegister& vn, const VRegister& vm,
+            const VRegister& va);
+
   // Copy a string into the instruction stream, including the terminating
   // nullptr character. The instruction pointer (pc_) is then aligned correctly
   // for subsequent instructions.
   void EmitStringData(const char* string);
 
+  void WriteJumpTableEntry(Label* label, int table_pos);
+
   // Pseudo-instructions ------------------------------------------------------
 
   // Parameters are described in arm64/instructions-arm64.h.
@@ -3422,6 +3449,10 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   // veneer margin (or kMaxInt if there are no unresolved branches).
   int next_veneer_pool_check_;
 
+  // Record jump table locations, this is only used when the disassembler is
+  // enabled.
+  JumpTableInfoWriter jump_table_info_writer_;
+
 #if defined(V8_OS_WIN)
   std::unique_ptr<win64_unwindinfo::XdataEncoder> xdata_encoder_;
 #endif
@@ -3444,6 +3475,7 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
   void AllocateAndInstallRequestedHeapNumbers(LocalIsolate* isolate);
 
   int WriteCodeComments();
+  int WriteJumpTableInfos();
 
   // The pending constant pool.
   ConstantPool constpool_;
diff --git a/deps/v8/src/codegen/arm64/constants-arm64.h b/deps/v8/src/codegen/arm64/constants-arm64.h
index 68a770702fb475..7ab527b53e51a5 100644
--- a/deps/v8/src/codegen/arm64/constants-arm64.h
+++ b/deps/v8/src/codegen/arm64/constants-arm64.h
@@ -760,6 +760,11 @@ constexpr ConditionalBranchOp ConditionalBranchFMask = 0xFE000000;
 constexpr ConditionalBranchOp ConditionalBranchMask = 0xFF000010;
 constexpr ConditionalBranchOp B_cond = ConditionalBranchFixed | 0x00000000;
 
+// Consistent Conditional branch.
+constexpr ConditionalBranchOp ConditionalBranchConsistentFixed = 0x54000010;
+constexpr ConditionalBranchOp BC_cond =
+    ConditionalBranchConsistentFixed | 0x00000000;
+
 // System.
 // System instruction encoding is complicated because some instructions use op
 // and CR fields to encode parameters. To handle this cleanly, the system
@@ -1193,6 +1198,15 @@ constexpr DataProcessing1SourceOp CLZ_x = CLZ | SixtyFourBits;
 constexpr DataProcessing1SourceOp CLS = DataProcessing1SourceFixed | 0x00001400;
 constexpr DataProcessing1SourceOp CLS_w = CLS;
 constexpr DataProcessing1SourceOp CLS_x = CLS | SixtyFourBits;
+constexpr DataProcessing1SourceOp CTZ = DataProcessing1SourceFixed | 0x00001800;
+constexpr DataProcessing1SourceOp CTZ_w = CTZ;
+constexpr DataProcessing1SourceOp CTZ_x = CTZ | SixtyFourBits;
+constexpr DataProcessing1SourceOp CNT = DataProcessing1SourceFixed | 0x00001C00;
+constexpr DataProcessing1SourceOp CNT_w = CNT;
+constexpr DataProcessing1SourceOp CNT_x = CNT | SixtyFourBits;
+constexpr DataProcessing1SourceOp ABS = DataProcessing1SourceFixed | 0x00002000;
+constexpr DataProcessing1SourceOp ABS_w = ABS;
+constexpr DataProcessing1SourceOp ABS_x = ABS | SixtyFourBits;
 
 // Data processing 2 source.
 using DataProcessing2SourceOp = uint32_t;
@@ -2407,6 +2421,14 @@ constexpr NEONTableOp NEON_TBX_2v = NEON_TBL_2v | NEONTableExt;
 constexpr NEONTableOp NEON_TBX_3v = NEON_TBL_3v | NEONTableExt;
 constexpr NEONTableOp NEON_TBX_4v = NEON_TBL_4v | NEONTableExt;
 
+// NEON SHA3
+using NEONSHA3Op = uint32_t;
+constexpr NEONSHA3Op NEONSHA3Fixed = 0xce000000;
+constexpr NEONSHA3Op NEONSHA3FMask = 0xce000000;
+constexpr NEONSHA3Op NEONSHA3Mask = 0xcee00000;
+constexpr NEONSHA3Op NEON_BCAX = NEONSHA3Fixed | 0x00200000;
+constexpr NEONSHA3Op NEON_EOR3 = NEONSHA3Fixed;
+
 // NEON perm.
 using NEONPermOp = uint32_t;
 constexpr NEONPermOp NEONPermFixed = 0x0E000800;
diff --git a/deps/v8/src/codegen/arm64/decoder-arm64-inl.h b/deps/v8/src/codegen/arm64/decoder-arm64-inl.h
index 62830e272af777..31b5e2170014ed 100644
--- a/deps/v8/src/codegen/arm64/decoder-arm64-inl.h
+++ b/deps/v8/src/codegen/arm64/decoder-arm64-inl.h
@@ -141,8 +141,7 @@ void Decoder<V>::DecodeBranchSystemException(Instruction* instr) {
     }
     case 2: {
       if (instr->Bit(25) == 0) {
-        if ((instr->Bit(24) == 0x1) ||
-            (instr->Mask(0x01000010) == 0x00000010)) {
+        if ((instr->Bit(24) == 0x1)) {
           V::VisitUnallocated(instr);
         } else {
           V::VisitConditionalBranch(instr);
@@ -464,10 +463,8 @@ void Decoder<V>::DecodeDataProcessing(Instruction* instr) {
                 V::VisitDataProcessing2Source(instr);
               }
             } else {
-              if ((instr->Bit(13) == 1) || (instr->Bits(20, 16) != 0) ||
-                  (instr->Bits(15, 14) != 0) ||
-                  (instr->Mask(0xA01FFC00) == 0x00000C00) ||
-                  (instr->Mask(0x201FF800) == 0x00001800)) {
+              if ((instr->Bits(20, 16) != 0) || (instr->Bits(15, 10) > 8) ||
+                  (instr->Mask(0xFFFFFC00) == 0x5AC00C00)) {
                 V::VisitUnallocated(instr);
               } else {
                 V::VisitDataProcessing1Source(instr);
@@ -757,7 +754,11 @@ void Decoder<V>::DecodeNEONVectorDataProcessing(Instruction* instr) {
       }
     }
   } else {
-    V::VisitUnallocated(instr);
+    if (instr->Bit(30) == 1) {
+      V::VisitNEONSHA3(instr);
+    } else {
+      V::VisitUnallocated(instr);
+    }
   }
 }
 
diff --git a/deps/v8/src/codegen/arm64/decoder-arm64.cc b/deps/v8/src/codegen/arm64/decoder-arm64.cc
index af8bbf965500f4..08fb265eefb540 100644
--- a/deps/v8/src/codegen/arm64/decoder-arm64.cc
+++ b/deps/v8/src/codegen/arm64/decoder-arm64.cc
@@ -60,9 +60,7 @@ void DispatchingDecoderVisitor::RemoveVisitor(DecoderVisitor* visitor) {
 
 #define DEFINE_VISITOR_CALLERS(A)                                \
   void DispatchingDecoderVisitor::Visit##A(Instruction* instr) { \
-    if (!(instr->Mask(A##FMask) == A##Fixed)) {                  \
-      DCHECK(instr->Mask(A##FMask) == A##Fixed);                 \
-    }                                                            \
+    DCHECK_EQ(instr->Mask(A##FMask), A##Fixed);                  \
     std::list<DecoderVisitor*>::iterator it;                     \
     for (it = visitors_.begin(); it != visitors_.end(); it++) {  \
       (*it)->Visit##A(instr);                                    \
diff --git a/deps/v8/src/codegen/arm64/decoder-arm64.h b/deps/v8/src/codegen/arm64/decoder-arm64.h
index 2eccaa82df272b..8a8841001cec64 100644
--- a/deps/v8/src/codegen/arm64/decoder-arm64.h
+++ b/deps/v8/src/codegen/arm64/decoder-arm64.h
@@ -83,6 +83,7 @@ namespace internal {
   V(NEONShiftImmediate)                 \
   V(NEONTable)                          \
   V(NEONPerm)                           \
+  V(NEONSHA3)                           \
   V(Unallocated)                        \
   V(Unimplemented)
 
diff --git a/deps/v8/src/codegen/arm64/macro-assembler-arm64-inl.h b/deps/v8/src/codegen/arm64/macro-assembler-arm64-inl.h
index c4749cb4da0507..7db159676e28b9 100644
--- a/deps/v8/src/codegen/arm64/macro-assembler-arm64-inl.h
+++ b/deps/v8/src/codegen/arm64/macro-assembler-arm64-inl.h
@@ -522,6 +522,24 @@ void MacroAssembler::Cneg(const Register& rd, const Register& rn,
   cneg(rd, rn, cond);
 }
 
+void MacroAssembler::Abs(const Register& rd, const Register& rn) {
+  DCHECK(allow_macro_instructions());
+  DCHECK(!rd.IsZero());
+  abs(rd, rn);
+}
+
+void MacroAssembler::Cnt(const Register& rd, const Register& rn) {
+  DCHECK(allow_macro_instructions());
+  DCHECK(!rd.IsZero());
+  cnt(rd, rn);
+}
+
+void MacroAssembler::Ctz(const Register& rd, const Register& rn) {
+  DCHECK(allow_macro_instructions());
+  DCHECK(!rd.IsZero());
+  ctz(rd, rn);
+}
+
 // Conditionally zero the destination register. Only X registers are supported
 // due to the truncation side-effect when used on W registers.
 void MacroAssembler::CzeroX(const Register& rd, Condition cond) {
diff --git a/deps/v8/src/codegen/arm64/macro-assembler-arm64.cc b/deps/v8/src/codegen/arm64/macro-assembler-arm64.cc
index 18caab8c5b9fdf..5362c09134c15e 100644
--- a/deps/v8/src/codegen/arm64/macro-assembler-arm64.cc
+++ b/deps/v8/src/codegen/arm64/macro-assembler-arm64.cc
@@ -1096,6 +1096,23 @@ void MacroAssembler::B(Label* label, Condition cond) {
   }
 }
 
+void MacroAssembler::Bc(Condition cond, Label* label) {
+  DCHECK(allow_macro_instructions());
+  DCHECK((cond != al) && (cond != nv));
+
+  bool need_extra_instructions =
+      NeedExtraInstructionsOrRegisterBranch<CondBranchType>(label);
+
+  if (V8_UNLIKELY(need_extra_instructions)) {
+    Label done;
+    bc(&done, NegateCondition(cond));
+    B(label);
+    bind(&done);
+  } else {
+    bc(label, cond);
+  }
+}
+
 void MacroAssembler::Tbnz(const Register& rt, unsigned bit_pos, Label* label) {
   DCHECK(allow_macro_instructions());
 
@@ -1162,13 +1179,21 @@ void MacroAssembler::Cbz(const Register& rt, Label* label) {
 
 // Pseudo-instructions.
 
-void MacroAssembler::Abs(const Register& rd, const Register& rm,
-                         Label* is_not_representable, Label* is_representable) {
+void MacroAssembler::AbsWithOverflow(const Register& rd, const Register& rm,
+                                     Label* is_not_representable,
+                                     Label* is_representable) {
   DCHECK(allow_macro_instructions());
   DCHECK(AreSameSizeAndType(rd, rm));
 
   Cmp(rm, 1);
-  Cneg(rd, rm, lt);
+
+  if (CpuFeatures::IsSupported(CSSC)) {
+    CpuFeatureScope scope(this, CSSC);
+
+    Abs(rd, rm);
+  } else {
+    Cneg(rd, rm, lt);
+  }
 
   // If the comparison sets the v flag, the input was the smallest value
   // representable by rm, and the mathematical result of abs(rm) is not
@@ -2552,6 +2577,9 @@ void MacroAssembler::CallJSFunction(Register function_object,
   LoadEntrypointAndParameterCountFromJSDispatchTable(code, parameter_count,
                                                      dispatch_handle, scratch);
   // Force a safe crash if the parameter count doesn't match.
+  // TODO(412398354): to avoid this runtime check, we should switch all
+  // remaining users to call the function via its dispatch handle instead. See
+  // CallJSDispatchEntry below and crbug.com/412398354 for more details.
   Cmp(parameter_count, Immediate(argument_count));
   SbxCheck(le, AbortReason::kJSSignatureMismatch);
   Call(code);
@@ -4788,13 +4816,19 @@ void MacroAssembler::StoreReturnAddressInWasmExitFrame(Label* return_location) {
 #endif  // V8_ENABLE_WEBASSEMBLY
 
 void MacroAssembler::PopcntHelper(Register dst, Register src) {
-  UseScratchRegisterScope temps(this);
-  VRegister scratch = temps.AcquireV(kFormat8B);
-  VRegister tmp = src.Is32Bits() ? scratch.S() : scratch.D();
-  Fmov(tmp, src);
-  Cnt(scratch, scratch);
-  Addv(scratch.B(), scratch);
-  Fmov(dst, tmp);
+  if (CpuFeatures::IsSupported(CSSC)) {
+    CpuFeatureScope scope(this, CSSC);
+
+    Cnt(dst, src);
+  } else {
+    UseScratchRegisterScope temps(this);
+    VRegister scratch = temps.AcquireV(kFormat8B);
+    VRegister tmp = src.Is32Bits() ? scratch.S() : scratch.D();
+    Fmov(tmp, src);
+    Cnt(scratch, scratch);
+    Addv(scratch.B(), scratch);
+    Fmov(dst, tmp);
+  }
 }
 
 void MacroAssembler::I8x16BitMask(Register dst, VRegister src, VRegister temp) {
diff --git a/deps/v8/src/codegen/arm64/macro-assembler-arm64.h b/deps/v8/src/codegen/arm64/macro-assembler-arm64.h
index 88aa6f09f47fa9..0d82c22a70ebbc 100644
--- a/deps/v8/src/codegen/arm64/macro-assembler-arm64.h
+++ b/deps/v8/src/codegen/arm64/macro-assembler-arm64.h
@@ -548,6 +548,18 @@ class V8_EXPORT_PRIVATE MacroAssembler : public MacroAssemblerBase {
   NEON_3VREG_MACRO_LIST(DEFINE_MACRO_ASM_FUNC)
 #undef DEFINE_MACRO_ASM_FUNC
 
+  void Bcax(const VRegister& vd, const VRegister& vn, const VRegister& vm,
+            const VRegister& va) {
+    DCHECK(allow_macro_instructions());
+    bcax(vd, vn, vm, va);
+  }
+
+  void Eor3(const VRegister& vd, const VRegister& vn, const VRegister& vm,
+            const VRegister& va) {
+    DCHECK(allow_macro_instructions());
+    eor3(vd, vn, vm, va);
+  }
+
   void Bic(const VRegister& vd, const int imm8, const int left_shift = 0) {
     DCHECK(allow_macro_instructions());
     bic(vd, imm8, left_shift);
@@ -559,6 +571,7 @@ class V8_EXPORT_PRIVATE MacroAssembler : public MacroAssemblerBase {
   void B(Label* label, BranchType type, Register reg = NoReg, int bit = -1);
   inline void B(Label* label);
   inline void B(Condition cond, Label* label);
+  void Bc(Condition cond, Label* label);
   void B(Label* label, Condition cond);
 
   void Tbnz(const Register& rt, unsigned bit_pos, Label* label);
@@ -1240,6 +1253,10 @@ class V8_EXPORT_PRIVATE MacroAssembler : public MacroAssemblerBase {
 
   inline void Clz(const Register& rd, const Register& rn);
 
+  inline void Abs(const Register& rd, const Register& rn);
+  inline void Cnt(const Register& rd, const Register& rn);
+  inline void Ctz(const Register& rd, const Register& rn);
+
   // Poke 'src' onto the stack. The offset is in bytes. The stack pointer must
   // be 16 byte aligned.
   // When the optional template argument is kSignLR and control flow integrity
@@ -1523,9 +1540,9 @@ class V8_EXPORT_PRIVATE MacroAssembler : public MacroAssemblerBase {
   //
   // If rm is the minimum representable value, the result is not representable.
   // Handlers for each case can be specified using the relevant labels.
-  void Abs(const Register& rd, const Register& rm,
-           Label* is_not_representable = nullptr,
-           Label* is_representable = nullptr);
+  void AbsWithOverflow(const Register& rd, const Register& rm,
+                       Label* is_not_representable = nullptr,
+                       Label* is_representable = nullptr);
 
   inline void Cls(const Register& rd, const Register& rn);
   inline void Cneg(const Register& rd, const Register& rn, Condition cond);
diff --git a/deps/v8/src/codegen/arm64/utils-arm64.h b/deps/v8/src/codegen/arm64/utils-arm64.h
index f6bbc09b94189e..8adaeeb18f4985 100644
--- a/deps/v8/src/codegen/arm64/utils-arm64.h
+++ b/deps/v8/src/codegen/arm64/utils-arm64.h
@@ -38,6 +38,13 @@ inline static int CountLeadingZeros(uint64_t value, int width) {
   }
   return base::bits::CountLeadingZeros64(value << (64 - width));
 }
+inline static int CountTrailingZeros(uint64_t value, int width) {
+  DCHECK(base::bits::IsPowerOfTwo(width) && (width <= 64));
+  if (value == 0) {
+    return width;
+  }
+  return base::bits::CountTrailingZeros(value);
+}
 int CountLeadingSignBits(int64_t value, int width);
 V8_EXPORT_PRIVATE int CountSetBits(uint64_t value, int width);
 int LowestSetBitPosition(uint64_t value);
diff --git a/deps/v8/src/codegen/bailout-reason.h b/deps/v8/src/codegen/bailout-reason.h
index f0c6b4911650be..0aa6f2cfcd8eb9 100644
--- a/deps/v8/src/codegen/bailout-reason.h
+++ b/deps/v8/src/codegen/bailout-reason.h
@@ -122,6 +122,7 @@ namespace internal {
   V(kNoReason, "no reason")                                                  \
                                                                              \
   V(kBailedOutDueToDependencyChange, "Bailed out due to dependency change")  \
+  V(kCancelled, "Job got cancelled")                                         \
   V(kConcurrentMapDeprecation, "Maps became deprecated during optimization") \
   V(kCodeGenerationFailed, "Code generation failed")                         \
   V(kFunctionBeingDebugged, "Function is being debugged")                    \
diff --git a/deps/v8/src/codegen/code-desc.cc b/deps/v8/src/codegen/code-desc.cc
index 1e36bc84814e7d..b39b2a9045c362 100644
--- a/deps/v8/src/codegen/code-desc.cc
+++ b/deps/v8/src/codegen/code-desc.cc
@@ -13,19 +13,17 @@ namespace internal {
 void CodeDesc::Initialize(CodeDesc* desc, Assembler* assembler,
                           int safepoint_table_offset, int handler_table_offset,
                           int constant_pool_offset, int code_comments_offset,
-                          int builtin_jump_table_info_offset,
-                          int reloc_info_offset) {
+                          int jump_table_info_offset, int reloc_info_offset) {
   desc->buffer = assembler->buffer_start();
   desc->buffer_size = assembler->buffer_size();
   desc->instr_size = assembler->instruction_size();
 
-  desc->builtin_jump_table_info_offset = builtin_jump_table_info_offset;
-  desc->builtin_jump_table_info_size =
-      desc->instr_size - builtin_jump_table_info_offset;
+  desc->jump_table_info_offset = jump_table_info_offset;
+  desc->jump_table_info_size = desc->instr_size - jump_table_info_offset;
 
   desc->code_comments_offset = code_comments_offset;
   desc->code_comments_size =
-      desc->builtin_jump_table_info_offset - code_comments_offset;
+      desc->jump_table_info_offset - code_comments_offset;
 
   desc->constant_pool_offset = constant_pool_offset;
   desc->constant_pool_size = desc->code_comments_offset - constant_pool_offset;
@@ -67,11 +65,10 @@ void CodeDesc::Verify(const CodeDesc* desc) {
             desc->code_comments_offset);
   DCHECK_GE(desc->code_comments_size, 0);
   DCHECK_EQ(desc->code_comments_size + desc->code_comments_offset,
-            desc->builtin_jump_table_info_offset);
-  DCHECK_GE(desc->builtin_jump_table_info_size, 0);
-  DCHECK_EQ(
-      desc->builtin_jump_table_info_size + desc->builtin_jump_table_info_offset,
-      desc->instr_size);
+            desc->jump_table_info_offset);
+  DCHECK_GE(desc->jump_table_info_size, 0);
+  DCHECK_EQ(desc->jump_table_info_size + desc->jump_table_info_offset,
+            desc->instr_size);
 
   DCHECK_GE(desc->reloc_offset, 0);
   DCHECK_GE(desc->reloc_size, 0);
diff --git a/deps/v8/src/codegen/code-desc.h b/deps/v8/src/codegen/code-desc.h
index 11db5652a04ef9..2ff054f67727cb 100644
--- a/deps/v8/src/codegen/code-desc.h
+++ b/deps/v8/src/codegen/code-desc.h
@@ -32,8 +32,7 @@ class CodeDesc {
   static void Initialize(CodeDesc* desc, Assembler* assembler,
                          int safepoint_table_offset, int handler_table_offset,
                          int constant_pool_offset, int code_comments_offset,
-                         int builtin_jump_table_info_offset,
-                         int reloc_info_offset);
+                         int jump_table_info_offset, int reloc_info_offset);
 
 #ifdef DEBUG
   static void Verify(const CodeDesc* desc);
@@ -63,8 +62,8 @@ class CodeDesc {
   int code_comments_offset = 0;
   int code_comments_size = 0;
 
-  int builtin_jump_table_info_offset = 0;
-  int builtin_jump_table_info_size = 0;
+  int jump_table_info_offset = 0;
+  int jump_table_info_size = 0;
 
   // TODO(jgruber,v8:11036): Remove these functions once CodeDesc fields have
   // been made consistent with InstructionStream layout.
@@ -83,8 +82,8 @@ class CodeDesc {
   int code_comments_offset_relative() const {
     return code_comments_offset - instruction_size();
   }
-  int builtin_jump_table_info_offset_relative() const {
-    return builtin_jump_table_info_offset - instruction_size();
+  int jump_table_info_offset_relative() const {
+    return jump_table_info_offset - instruction_size();
   }
 
   // Relocation info is located at the end of the buffer and not part of the
@@ -100,8 +99,7 @@ class CodeDesc {
   int unwinding_info_offset_relative() const {
     // TODO(jgruber,v8:11036): Remove this function once unwinding_info setup
     // is more consistent with other metadata tables.
-    return builtin_jump_table_info_offset_relative() +
-           builtin_jump_table_info_size;
+    return jump_table_info_offset_relative() + jump_table_info_size;
   }
 
   Assembler* origin = nullptr;
diff --git a/deps/v8/src/codegen/code-reference.cc b/deps/v8/src/codegen/code-reference.cc
index 7f3893e3940998..8800fdef18f635 100644
--- a/deps/v8/src/codegen/code-reference.cc
+++ b/deps/v8/src/codegen/code-reference.cc
@@ -30,6 +30,8 @@ struct CodeOps {
   int relocation_size() const { return code->relocation_size(); }
   Address code_comments() const { return code->code_comments(); }
   int code_comments_size() const { return code->code_comments_size(); }
+  Address jump_table_info() const { return code->jump_table_info(); }
+  int jump_table_info_size() const { return code->jump_table_info_size(); }
 };
 
 #if V8_ENABLE_WEBASSEMBLY
@@ -52,6 +54,8 @@ struct WasmCodeOps {
   int relocation_size() const { return code->reloc_info().length(); }
   Address code_comments() const { return code->code_comments(); }
   int code_comments_size() const { return code->code_comments_size(); }
+  Address jump_table_info() const { return code->jump_table_info(); }
+  int jump_table_info_size() const { return code->jump_table_info_size(); }
 };
 #endif  // V8_ENABLE_WEBASSEMBLY
 
@@ -79,6 +83,10 @@ struct CodeDescOps {
     return instruction_start() + code_desc->code_comments_offset;
   }
   int code_comments_size() const { return code_desc->code_comments_size; }
+  Address jump_table_info() const {
+    return instruction_start() + code_desc->jump_table_info_offset;
+  }
+  int jump_table_info_size() const { return code_desc->jump_table_info_size; }
 };
 }  // namespace
 
@@ -112,6 +120,8 @@ DISPATCH(const uint8_t*, relocation_end)
 DISPATCH(int, relocation_size)
 DISPATCH(Address, code_comments)
 DISPATCH(int, code_comments_size)
+DISPATCH(Address, jump_table_info)
+DISPATCH(int, jump_table_info_size)
 
 #undef DISPATCH
 #undef HANDLE_WASM
diff --git a/deps/v8/src/codegen/code-reference.h b/deps/v8/src/codegen/code-reference.h
index f1cc666218931b..af16d1e2035326 100644
--- a/deps/v8/src/codegen/code-reference.h
+++ b/deps/v8/src/codegen/code-reference.h
@@ -38,6 +38,8 @@ class CodeReference {
   int relocation_size() const;
   Address code_comments() const;
   int code_comments_size() const;
+  Address jump_table_info() const;
+  int jump_table_info_size() const;
 
   bool is_null() const { return kind_ == Kind::NONE; }
   bool is_code() const { return kind_ == Kind::CODE; }
diff --git a/deps/v8/src/codegen/code-stub-assembler.cc b/deps/v8/src/codegen/code-stub-assembler.cc
index 9071cb487d7294..75d9e459346564 100644
--- a/deps/v8/src/codegen/code-stub-assembler.cc
+++ b/deps/v8/src/codegen/code-stub-assembler.cc
@@ -47,7 +47,7 @@ namespace internal {
 
 #ifdef DEBUG
 #define CSA_DCHECK_BRANCH(csa, gen, ...) \
-  (csa)->Dcheck(gen, #gen, __FILE__, __LINE__, CSA_DCHECK_ARGS(__VA_ARGS__))
+  (csa)->Dcheck(gen, #gen, CSA_DCHECK_ARGS(__VA_ARGS__))
 #else
 #define CSA_DCHECK_BRANCH(csa, ...) ((void)0)
 #endif
@@ -105,40 +105,40 @@ void CodeStubAssembler::HandleBreakOnNode() {
 }
 
 void CodeStubAssembler::Dcheck(const BranchGenerator& branch,
-                               const char* message, const char* file, int line,
+                               const char* message,
                                std::initializer_list<ExtraNode> extra_nodes,
                                const SourceLocation& loc) {
 #if defined(DEBUG)
   if (v8_flags.debug_code) {
-    Check(branch, message, file, line, extra_nodes, loc);
+    Check(branch, message, extra_nodes, loc);
   }
 #endif
 }
 
 void CodeStubAssembler::Dcheck(const NodeGenerator<BoolT>& condition_body,
-                               const char* message, const char* file, int line,
+                               const char* message,
                                std::initializer_list<ExtraNode> extra_nodes,
                                const SourceLocation& loc) {
 #if defined(DEBUG)
   if (v8_flags.debug_code) {
-    Check(condition_body, message, file, line, extra_nodes, loc);
+    Check(condition_body, message, extra_nodes, loc);
   }
 #endif
 }
 
 void CodeStubAssembler::Dcheck(TNode<Word32T> condition_node,
-                               const char* message, const char* file, int line,
+                               const char* message,
                                std::initializer_list<ExtraNode> extra_nodes,
                                const SourceLocation& loc) {
 #if defined(DEBUG)
   if (v8_flags.debug_code) {
-    Check(condition_node, message, file, line, extra_nodes, loc);
+    Check(condition_node, message, extra_nodes, loc);
   }
 #endif
 }
 
 void CodeStubAssembler::Check(const BranchGenerator& branch,
-                              const char* message, const char* file, int line,
+                              const char* message,
                               std::initializer_list<ExtraNode> extra_nodes,
                               const SourceLocation& loc) {
   Label ok(this);
@@ -152,17 +152,17 @@ void CodeStubAssembler::Check(const BranchGenerator& branch,
 
   BIND(&not_ok);
   std::vector<FileAndLine> file_and_line;
-  if (file != nullptr) {
-    file_and_line.push_back({file, line});
+  if (loc.FileName()) {
+    file_and_line.push_back({loc.FileName(), static_cast<size_t>(loc.Line())});
   }
-  FailAssert(message, file_and_line, extra_nodes, loc);
+  FailAssert(message, file_and_line, extra_nodes);
 
   BIND(&ok);
   Comment({"] Assert", SourceLocation()});
 }
 
 void CodeStubAssembler::Check(const NodeGenerator<BoolT>& condition_body,
-                              const char* message, const char* file, int line,
+                              const char* message,
                               std::initializer_list<ExtraNode> extra_nodes,
                               const SourceLocation& loc) {
   BranchGenerator branch = [=, this](Label* ok, Label* not_ok) {
@@ -170,18 +170,18 @@ void CodeStubAssembler::Check(const NodeGenerator<BoolT>& condition_body,
     Branch(condition, ok, not_ok);
   };
 
-  Check(branch, message, file, line, extra_nodes, loc);
+  Check(branch, message, extra_nodes, loc);
 }
 
 void CodeStubAssembler::Check(TNode<Word32T> condition_node,
-                              const char* message, const char* file, int line,
+                              const char* message,
                               std::initializer_list<ExtraNode> extra_nodes,
                               const SourceLocation& loc) {
   BranchGenerator branch = [=, this](Label* ok, Label* not_ok) {
     Branch(condition_node, ok, not_ok);
   };
 
-  Check(branch, message, file, line, extra_nodes, loc);
+  Check(branch, message, extra_nodes, loc);
 }
 
 void CodeStubAssembler::IncrementCallCount(
@@ -209,7 +209,7 @@ void CodeStubAssembler::FastCheck(TNode<BoolT> condition) {
 
 void CodeStubAssembler::FailAssert(
     const char* message, const std::vector<FileAndLine>& files_and_lines,
-    std::initializer_list<ExtraNode> extra_nodes, const SourceLocation& loc) {
+    std::initializer_list<ExtraNode> extra_nodes) {
   DCHECK_NOT_NULL(message);
   base::EmbeddedVector<char, 1024> chars;
   std::stringstream stream;
@@ -299,12 +299,14 @@ HEAP_MUTABLE_IMMOVABLE_OBJECT_LIST(HEAP_CONSTANT_ACCESSOR)
 HEAP_IMMUTABLE_IMMOVABLE_OBJECT_LIST(HEAP_CONSTANT_ACCESSOR)
 #undef HEAP_CONSTANT_ACCESSOR
 
-#define HEAP_CONSTANT_TEST(rootIndexName, rootAccessorName, name)    \
-  TNode<BoolT> CodeStubAssembler::Is##name(TNode<Object> value) {    \
-    return TaggedEqual(value, name##Constant());                     \
-  }                                                                  \
-  TNode<BoolT> CodeStubAssembler::IsNot##name(TNode<Object> value) { \
-    return TaggedNotEqual(value, name##Constant());                  \
+#define HEAP_CONSTANT_TEST(rootIndexName, rootAccessorName, name)   \
+  TNode<BoolT> CodeStubAssembler::Is##name(TNode<Object> value,     \
+                                           SourceLocation loc) {    \
+    return TaggedEqual(value, name##Constant(), loc);               \
+  }                                                                 \
+  TNode<BoolT> CodeStubAssembler::IsNot##name(TNode<Object> value,  \
+                                              SourceLocation loc) { \
+    return TaggedNotEqual(value, name##Constant(), loc);            \
   }
 HEAP_IMMOVABLE_OBJECT_LIST(HEAP_CONSTANT_TEST)
 #undef HEAP_CONSTANT_TEST
@@ -1348,6 +1350,19 @@ TNode<BoolT> CodeStubAssembler::TaggedIsNotSmi(TNode<MaybeObject> a) {
   return Word32BinaryNot(TaggedIsSmi(a));
 }
 
+TNode<BoolT> CodeStubAssembler::TaggedIsStrongHeapObject(TNode<MaybeObject> a) {
+  static_assert(kHeapObjectTagMask < kMaxUInt32);
+  return Word32Equal(
+      Word32And(TruncateIntPtrToInt32(BitcastTaggedToWordForTagAndSmiBits(a)),
+                Int32Constant(kHeapObjectTagMask)),
+      Int32Constant(kHeapObjectTag));
+}
+
+TNode<BoolT> CodeStubAssembler::TaggedIsNotStrongHeapObject(
+    TNode<MaybeObject> a) {
+  return Word32BinaryNot(TaggedIsStrongHeapObject(a));
+}
+
 TNode<BoolT> CodeStubAssembler::TaggedIsPositiveSmi(TNode<Object> a) {
 #if defined(V8_HOST_ARCH_32_BIT) || defined(V8_31BIT_SMIS_ON_64BIT_ARCH)
   return Word32Equal(
@@ -1362,6 +1377,35 @@ TNode<BoolT> CodeStubAssembler::TaggedIsPositiveSmi(TNode<Object> a) {
 #endif
 }
 
+#if defined(V8_EXTERNAL_CODE_SPACE) || defined(V8_ENABLE_SANDBOX)
+void CodeStubAssembler::CheckObjectComparisonAllowed(TNode<AnyTaggedT> a,
+                                                     TNode<AnyTaggedT> b,
+                                                     SourceLocation loc) {
+  // LINT.IfChange(CheckObjectComparisonAllowed)
+  Label done(this);
+  GotoIf(TaggedIsNotStrongHeapObject(a), &done);
+  GotoIf(TaggedIsNotStrongHeapObject(b), &done);
+  TNode<HeapObject> obj_a = UncheckedCast<HeapObject>(a);
+  TNode<HeapObject> obj_b = UncheckedCast<HeapObject>(b);
+
+  // This check might fail when we try to compare objects in different pointer
+  // compression cages (e.g. the one used by code space or trusted space) with
+  // each other. The main legitimate case when such "mixed" comparison could
+  // happen is comparing two AbstractCode objects. If that's the case one must
+  // use SafeEqual().
+  CSA_CHECK_AT(this, loc,
+               WordEqual(WordAnd(LoadMemoryChunkFlags(obj_a),
+                                 IntPtrConstant(MemoryChunk::IS_EXECUTABLE |
+                                                MemoryChunk::IS_TRUSTED)),
+                         WordAnd(LoadMemoryChunkFlags(obj_b),
+                                 IntPtrConstant(MemoryChunk::IS_EXECUTABLE |
+                                                MemoryChunk::IS_TRUSTED))));
+  Goto(&done);
+  Bind(&done);
+  // LINT.ThenChange(src/objects/tagged-impl.cc:CheckObjectComparisonAllowed)
+}
+#endif  // defined(V8_EXTERNAL_CODE_SPACE) || defined(V8_ENABLE_SANDBOX)
+
 TNode<BoolT> CodeStubAssembler::WordIsAligned(TNode<WordT> word,
                                               size_t alignment) {
   DCHECK(base::bits::IsPowerOfTwo(alignment));
@@ -2141,16 +2185,15 @@ TNode<Float64T> CodeStubAssembler::LoadHeapNumberValue(
   return LoadObjectField<Float64T>(object, offsetof(HeapNumber, value_));
 }
 
-TNode<Int32T> CodeStubAssembler::LoadHeapInt32Value(TNode<HeapObject> object) {
-  return LoadObjectField<Int32T>(
-      object, offsetof(HeapNumber, value_) + kIeeeDoubleMantissaWordOffset);
+TNode<Int32T> CodeStubAssembler::LoadContextCellInt32Value(
+    TNode<ContextCell> object) {
+  return LoadObjectField<Int32T>(object, offsetof(ContextCell, double_value_));
 }
 
-void CodeStubAssembler::StoreHeapInt32Value(TNode<HeapObject> object,
-                                            TNode<Int32T> value) {
-  StoreObjectFieldNoWriteBarrier(
-      object, offsetof(HeapNumber, value_) + kIeeeDoubleMantissaWordOffset,
-      value);
+void CodeStubAssembler::StoreContextCellInt32Value(TNode<ContextCell> object,
+                                                   TNode<Int32T> value) {
+  StoreObjectFieldNoWriteBarrier(object, offsetof(ContextCell, double_value_),
+                                 value);
 }
 
 TNode<Map> CodeStubAssembler::GetInstanceTypeMap(InstanceType instance_type) {
@@ -3473,7 +3516,7 @@ TNode<Float64T> CodeStubAssembler::LoadDoubleWithUndefinedAndHoleCheck(
 #endif  // V8_ENABLE_EXPERIMENTAL_UNDEFINED_DOUBLE
 
 TNode<ScopeInfo> CodeStubAssembler::LoadScopeInfo(TNode<Context> context) {
-  return CAST(LoadContextElement(context, Context::SCOPE_INFO_INDEX));
+  return CAST(LoadContextElementNoCell(context, Context::SCOPE_INFO_INDEX));
 }
 
 TNode<BoolT> CodeStubAssembler::LoadScopeInfoHasExtensionField(
@@ -3506,8 +3549,8 @@ TNode<NativeContext> CodeStubAssembler::LoadNativeContext(
 
 TNode<Context> CodeStubAssembler::LoadModuleContext(TNode<Context> context) {
   TNode<NativeContext> native_context = LoadNativeContext(context);
-  TNode<Map> module_map = CAST(
-      LoadContextElement(native_context, Context::MODULE_CONTEXT_MAP_INDEX));
+  TNode<Map> module_map = CAST(LoadContextElementNoCell(
+      native_context, Context::MODULE_CONTEXT_MAP_INDEX));
   TVariable<Object> cur_context(context, this);
 
   Label context_found(this);
@@ -3523,8 +3566,8 @@ TNode<Context> CodeStubAssembler::LoadModuleContext(TNode<Context> context) {
     GotoIf(TaggedEqual(LoadMap(CAST(cur_context.value())), module_map),
            &context_found);
 
-    cur_context =
-        LoadContextElement(CAST(cur_context.value()), Context::PREVIOUS_INDEX);
+    cur_context = LoadContextElementNoCell(CAST(cur_context.value()),
+                                           Context::PREVIOUS_INDEX);
     Goto(&context_search);
   }
 
@@ -3535,7 +3578,7 @@ TNode<Context> CodeStubAssembler::LoadModuleContext(TNode<Context> context) {
 TNode<Object> CodeStubAssembler::GetImportMetaObject(TNode<Context> context) {
   const TNode<Context> module_context = LoadModuleContext(context);
   const TNode<HeapObject> module =
-      CAST(LoadContextElement(module_context, Context::EXTENSION_INDEX));
+      CAST(LoadContextElementNoCell(module_context, Context::EXTENSION_INDEX));
   const TNode<Object> import_meta =
       LoadObjectField(module, SourceTextModule::kImportMetaOffset);
 
@@ -3553,8 +3596,8 @@ TNode<Object> CodeStubAssembler::GetImportMetaObject(TNode<Context> context) {
 
 TNode<Map> CodeStubAssembler::LoadObjectFunctionInitialMap(
     TNode<NativeContext> native_context) {
-  TNode<JSFunction> object_function =
-      CAST(LoadContextElement(native_context, Context::OBJECT_FUNCTION_INDEX));
+  TNode<JSFunction> object_function = CAST(
+      LoadContextElementNoCell(native_context, Context::OBJECT_FUNCTION_INDEX));
   return CAST(LoadJSFunctionPrototypeOrInitialMap(object_function));
 }
 
@@ -3564,7 +3607,7 @@ TNode<Map> CodeStubAssembler::LoadCachedMap(TNode<NativeContext> native_context,
   CSA_DCHECK(this, UintPtrLessThan(number_of_properties,
                                    IntPtrConstant(JSObject::kMapCacheSize)));
   TNode<WeakFixedArray> cache =
-      CAST(LoadContextElement(native_context, Context::MAP_CACHE_INDEX));
+      CAST(LoadContextElementNoCell(native_context, Context::MAP_CACHE_INDEX));
   TNode<MaybeObject> value =
       LoadWeakFixedArrayElement(cache, number_of_properties, 0);
   TNode<Map> result = CAST(GetHeapObjectAssumeWeak(value, runtime));
@@ -3573,7 +3616,7 @@ TNode<Map> CodeStubAssembler::LoadCachedMap(TNode<NativeContext> native_context,
 
 TNode<Map> CodeStubAssembler::LoadSlowObjectWithNullPrototypeMap(
     TNode<NativeContext> native_context) {
-  TNode<Map> map = CAST(LoadContextElement(
+  TNode<Map> map = CAST(LoadContextElementNoCell(
       native_context, Context::SLOW_OBJECT_WITH_NULL_PROTOTYPE_MAP));
   return map;
 }
@@ -3584,13 +3627,13 @@ TNode<Map> CodeStubAssembler::LoadJSArrayElementsMap(
   TNode<IntPtrT> offset =
       IntPtrAdd(IntPtrConstant(Context::FIRST_JS_ARRAY_MAP_SLOT),
                 ChangeInt32ToIntPtr(kind));
-  return UncheckedCast<Map>(LoadContextElement(native_context, offset));
+  return UncheckedCast<Map>(LoadContextElementNoCell(native_context, offset));
 }
 
 TNode<Map> CodeStubAssembler::LoadJSArrayElementsMap(
     ElementsKind kind, TNode<NativeContext> native_context) {
   return UncheckedCast<Map>(
-      LoadContextElement(native_context, Context::ArrayMapIndex(kind)));
+      LoadContextElementNoCell(native_context, Context::ArrayMapIndex(kind)));
 }
 
 TNode<Uint32T> CodeStubAssembler::LoadFunctionKind(TNode<JSFunction> function) {
@@ -4110,7 +4153,8 @@ TNode<Smi> CodeStubAssembler::BuildAppendJSArray(ElementsKind kind,
   Comment("BuildAppendJSArray: ", ElementsKindToString(kind));
   Label pre_bailout(this);
   Label success(this);
-  TVARIABLE(Smi, var_tagged_length, LoadFastJSArrayLength(array));
+  TNode<Smi> orig_tagged_length = LoadFastJSArrayLength(array);
+  TVARIABLE(Smi, var_tagged_length, orig_tagged_length);
   TVARIABLE(BInt, var_length, SmiToBInt(var_tagged_length.value()));
   TVARIABLE(FixedArrayBase, var_elements, LoadElements(array));
 
@@ -4154,7 +4198,7 @@ TNode<Smi> CodeStubAssembler::BuildAppendJSArray(ElementsKind kind,
   {
     TNode<Smi> length = ParameterToTagged(var_length.value());
     var_tagged_length = length;
-    TNode<Smi> diff = SmiSub(length, LoadFastJSArrayLength(array));
+    TNode<Smi> diff = SmiSub(length, orig_tagged_length);
     StoreObjectFieldNoWriteBarrier(array, JSArray::kLengthOffset, length);
     *arg_index = IntPtrAdd(arg_index->value(), SmiUntag(diff));
     Goto(bailout);
@@ -4243,14 +4287,24 @@ TNode<HeapNumber> CodeStubAssembler::AllocateHeapNumberWithValue(
   return result;
 }
 
-TNode<HeapNumber> CodeStubAssembler::AllocateHeapInt32WithValue(
-    TNode<Int32T> value) {
-  TNode<HeapNumber> result = AllocateHeapNumber();
-  StoreHeapInt32Value(result, value);
+TNode<ContextCell> CodeStubAssembler::AllocateContextCell(
+    TNode<Object> tagged_value) {
+  TNode<HeapObject> result =
+      Allocate(sizeof(ContextCell), AllocationFlag::kNone);
+  StoreMapNoWriteBarrier(result, RootIndex::kContextCellMap);
+  StoreObjectFieldNoWriteBarrier(result, offsetof(ContextCell, tagged_value_),
+                                 tagged_value);
+  StoreObjectFieldNoWriteBarrier(result, offsetof(ContextCell, dependent_code_),
+                                 LoadRoot(RootIndex::kEmptyWeakArrayList));
+  StoreObjectFieldNoWriteBarrier(result, offsetof(ContextCell, state_),
+                                 Int32Constant(ContextCell::kConst));
+#if TAGGED_SIZE_8_BYTES
   StoreObjectFieldNoWriteBarrier(
-      result, offsetof(HeapNumber, value_) + kIeeeDoubleExponentWordOffset,
-      Int32Constant(kHoleNanUpper32));
-  return result;
+      result, offsetof(ContextCell, optional_padding_), Int32Constant(0));
+#endif  // TAGGED_SIZE_8_BYTES
+  StoreObjectFieldNoWriteBarrier(result, offsetof(ContextCell, double_value_),
+                                 Float64Constant(0));
+  return UncheckedCast<ContextCell>(result);
 }
 
 TNode<Object> CodeStubAssembler::CloneIfMutablePrimitive(TNode<Object> object) {
@@ -4447,6 +4501,10 @@ TNode<BoolT> CodeStubAssembler::IsZeroOrContext(TNode<Object> object) {
       [=, this] { return IsContext(CAST(object)); });
 }
 
+TNode<BoolT> CodeStubAssembler::IsEmptyDependentCode(TNode<Object> object) {
+  return TaggedEqual(object, EmptyWeakArrayListConstant());
+}
+
 TNode<String> CodeStubAssembler::AllocateSeqTwoByteString(
     uint32_t length, AllocationFlags flags) {
   Comment("AllocateSeqTwoByteString");
@@ -4947,7 +5005,7 @@ TNode<JSArray> CodeStubAssembler::AllocateJSArray(
   int base_size = array_header_size;
   if (allocation_site) {
     DCHECK(V8_ALLOCATION_SITE_TRACKING_BOOL);
-    base_size += ALIGN_TO_ALLOCATION_ALIGNMENT(AllocationMemento::kSize);
+    base_size += ALIGN_TO_ALLOCATION_ALIGNMENT(sizeof(AllocationMemento));
   }
 
   TNode<IntPtrT> size = IntPtrConstant(base_size);
@@ -5039,7 +5097,7 @@ CodeStubAssembler::AllocateUninitializedJSArrayWithElements(
     int base_size = ALIGN_TO_ALLOCATION_ALIGNMENT(array_header_size);
     if (allocation_site) {
       DCHECK(V8_ALLOCATION_SITE_TRACKING_BOOL);
-      base_size += ALIGN_TO_ALLOCATION_ALIGNMENT(AllocationMemento::kSize);
+      base_size += ALIGN_TO_ALLOCATION_ALIGNMENT(sizeof(AllocationMemento));
     }
 
     const int elements_offset = base_size;
@@ -6458,15 +6516,15 @@ void CodeStubAssembler::InitializeAllocationMemento(
       InnerAllocateMemento(this, base, base_allocation_size);
   StoreMapNoWriteBarrier(memento, RootIndex::kAllocationMementoMap);
   StoreObjectFieldNoWriteBarrier(
-      memento, AllocationMemento::kAllocationSiteOffset, allocation_site);
+      memento, offsetof(AllocationMemento, allocation_site_), allocation_site);
   if (v8_flags.allocation_site_pretenuring) {
     TNode<Int32T> count = LoadObjectField<Int32T>(
-        allocation_site, AllocationSite::kPretenureCreateCountOffset);
+        allocation_site, offsetof(AllocationSite, pretenure_create_count_));
 
     TNode<Int32T> incremented_count = Int32Add(count, Int32Constant(1));
-    StoreObjectFieldNoWriteBarrier(allocation_site,
-                                   AllocationSite::kPretenureCreateCountOffset,
-                                   incremented_count);
+    StoreObjectFieldNoWriteBarrier(
+        allocation_site, offsetof(AllocationSite, pretenure_create_count_),
+        incremented_count);
   }
   Comment("]");
 }
@@ -7680,7 +7738,7 @@ TNode<BoolT> CodeStubAssembler::IsMapIteratorProtectorCellInvalid() {
 TNode<BoolT> CodeStubAssembler::IsPrototypeInitialArrayPrototype(
     TNode<Context> context, TNode<Map> map) {
   const TNode<NativeContext> native_context = LoadNativeContext(context);
-  const TNode<Object> initial_array_prototype = LoadContextElement(
+  const TNode<Object> initial_array_prototype = LoadContextElementNoCell(
       native_context, Context::INITIAL_ARRAY_PROTOTYPE_INDEX);
   TNode<HeapObject> proto = LoadMapPrototype(map);
   return TaggedEqual(proto, initial_array_prototype);
@@ -7689,8 +7747,8 @@ TNode<BoolT> CodeStubAssembler::IsPrototypeInitialArrayPrototype(
 TNode<BoolT> CodeStubAssembler::IsPrototypeTypedArrayPrototype(
     TNode<Context> context, TNode<Map> map) {
   const TNode<NativeContext> native_context = LoadNativeContext(context);
-  const TNode<Object> typed_array_prototype =
-      LoadContextElement(native_context, Context::TYPED_ARRAY_PROTOTYPE_INDEX);
+  const TNode<Object> typed_array_prototype = LoadContextElementNoCell(
+      native_context, Context::TYPED_ARRAY_PROTOTYPE_INDEX);
   TNode<HeapObject> proto = LoadMapPrototype(map);
   TNode<HeapObject> proto_of_proto = Select<HeapObject>(
       IsJSObject(proto), [=, this] { return LoadMapPrototype(LoadMap(proto)); },
@@ -7707,7 +7765,7 @@ void CodeStubAssembler::InvalidateStringWrapperToPrimitiveProtector() {
 TNode<BoolT> CodeStubAssembler::IsFastAliasedArgumentsMap(
     TNode<Context> context, TNode<Map> map) {
   const TNode<NativeContext> native_context = LoadNativeContext(context);
-  const TNode<Object> arguments_map = LoadContextElement(
+  const TNode<Object> arguments_map = LoadContextElementNoCell(
       native_context, Context::FAST_ALIASED_ARGUMENTS_MAP_INDEX);
   return TaggedEqual(arguments_map, map);
 }
@@ -7715,7 +7773,7 @@ TNode<BoolT> CodeStubAssembler::IsFastAliasedArgumentsMap(
 TNode<BoolT> CodeStubAssembler::IsSlowAliasedArgumentsMap(
     TNode<Context> context, TNode<Map> map) {
   const TNode<NativeContext> native_context = LoadNativeContext(context);
-  const TNode<Object> arguments_map = LoadContextElement(
+  const TNode<Object> arguments_map = LoadContextElementNoCell(
       native_context, Context::SLOW_ALIASED_ARGUMENTS_MAP_INDEX);
   return TaggedEqual(arguments_map, map);
 }
@@ -7723,16 +7781,16 @@ TNode<BoolT> CodeStubAssembler::IsSlowAliasedArgumentsMap(
 TNode<BoolT> CodeStubAssembler::IsSloppyArgumentsMap(TNode<Context> context,
                                                      TNode<Map> map) {
   const TNode<NativeContext> native_context = LoadNativeContext(context);
-  const TNode<Object> arguments_map =
-      LoadContextElement(native_context, Context::SLOPPY_ARGUMENTS_MAP_INDEX);
+  const TNode<Object> arguments_map = LoadContextElementNoCell(
+      native_context, Context::SLOPPY_ARGUMENTS_MAP_INDEX);
   return TaggedEqual(arguments_map, map);
 }
 
 TNode<BoolT> CodeStubAssembler::IsStrictArgumentsMap(TNode<Context> context,
                                                      TNode<Map> map) {
   const TNode<NativeContext> native_context = LoadNativeContext(context);
-  const TNode<Object> arguments_map =
-      LoadContextElement(native_context, Context::STRICT_ARGUMENTS_MAP_INDEX);
+  const TNode<Object> arguments_map = LoadContextElementNoCell(
+      native_context, Context::STRICT_ARGUMENTS_MAP_INDEX);
   return TaggedEqual(arguments_map, map);
 }
 
@@ -8689,6 +8747,24 @@ TNode<Uint16T> CodeStubAssembler::StringCharCodeAt(TNode<String> string,
   return var_result.value();
 }
 
+TNode<String> CodeStubAssembler::StringFromSingleOneByteCharCode(
+    TNode<Uint8T> code) {
+  CSA_DCHECK(this, Uint32LessThanOrEqual(
+                       code, Int32Constant(String::kMaxOneByteCharCode)));
+
+  // Load the string for the {code} directly from the roots table.
+  TNode<UintPtrT> code_index = ChangeUint32ToWord(code);
+  TNode<IntPtrT> single_char_string_table_offset = IntPtrConstant(
+      IsolateData::root_slot_offset(RootIndex::kFirstSingleCharacterString));
+
+  // TODO(ishell): consider completely avoiding the load:
+  // entry = roots.single_character_string('\0') +
+  //     SeqOneByteString::SizeFor(1) * code + kHeapObjectTag;
+  TNode<Object> entry = LoadTaggedFromRootRegister(Signed(IntPtrAdd(
+      single_char_string_table_offset, TimesSystemPointerSize(code_index))));
+  return CAST(entry);
+}
+
 TNode<String> CodeStubAssembler::StringFromSingleCharCode(TNode<Int32T> code) {
   TVARIABLE(String, var_result);
 
@@ -8700,14 +8776,9 @@ TNode<String> CodeStubAssembler::StringFromSingleCharCode(TNode<Int32T> code) {
   BIND(&if_codeisonebyte);
   {
     // Load the isolate wide single character string cache.
-    TNode<FixedArray> cache = SingleCharacterStringTableConstant();
-    TNode<IntPtrT> code_index = Signed(ChangeUint32ToWord(code));
-
-    TNode<Object> entry = UnsafeLoadFixedArrayElement(cache, code_index);
-    CSA_DCHECK(this, Word32BinaryNot(IsUndefined(entry)));
-
-    // Return the entry from the {cache}.
-    var_result = CAST(entry);
+    TNode<String> entry =
+        StringFromSingleOneByteCharCode(UncheckedCast<Uint8T>(code));
+    var_result = entry;
     Goto(&if_done);
   }
 
@@ -10228,6 +10299,8 @@ template TNode<Object> CodeStubAssembler::LoadValueByKeyIndex(
     TNode<NameDictionary> container, TNode<IntPtrT> key_index);
 template TNode<Object> CodeStubAssembler::LoadValueByKeyIndex(
     TNode<GlobalDictionary> container, TNode<IntPtrT> key_index);
+template TNode<Object> CodeStubAssembler::LoadValueByKeyIndex(
+    TNode<SimpleNameDictionary> container, TNode<IntPtrT> key_index);
 template TNode<Uint32T> CodeStubAssembler::LoadDetailsByKeyIndex(
     TNode<NameDictionary> container, TNode<IntPtrT> key_index);
 template void CodeStubAssembler::StoreDetailsByKeyIndex(
@@ -10303,6 +10376,13 @@ TNode<HeapObject> CodeStubAssembler::LoadName<NameToIndexHashTable>(
   return key;
 }
 
+template <>
+TNode<HeapObject> CodeStubAssembler::LoadName<SimpleNameDictionary>(
+    TNode<HeapObject> key) {
+  CSA_DCHECK(this, IsName(key));
+  return key;
+}
+
 // The implementation should be in sync with NameToIndexHashTable::Lookup.
 TNode<IntPtrT> CodeStubAssembler::NameToIndexHashTableLookup(
     TNode<NameToIndexHashTable> table, TNode<Name> name, Label* not_found) {
@@ -10323,7 +10403,8 @@ void CodeStubAssembler::NameDictionaryLookup(
     TVariable<IntPtrT>* var_name_index, Label* if_not_found, LookupMode mode) {
   static_assert(std::is_same_v<Dictionary, NameDictionary> ||
                     std::is_same_v<Dictionary, GlobalDictionary> ||
-                    std::is_same_v<Dictionary, NameToIndexHashTable>,
+                    std::is_same_v<Dictionary, NameToIndexHashTable> ||
+                    std::is_same_v<Dictionary, SimpleNameDictionary>,
                 "Unexpected NameDictionary");
   DCHECK_IMPLIES(var_name_index != nullptr,
                  MachineType::PointerRepresentation() == var_name_index->rep());
@@ -10409,6 +10490,9 @@ CodeStubAssembler::NameDictionaryLookup<NameDictionary>(TNode<NameDictionary>,
 template V8_EXPORT_PRIVATE void CodeStubAssembler::NameDictionaryLookup<
     GlobalDictionary>(TNode<GlobalDictionary>, TNode<Name>, Label*,
                       TVariable<IntPtrT>*, Label*, LookupMode);
+template V8_EXPORT_PRIVATE void CodeStubAssembler::NameDictionaryLookup<
+    SimpleNameDictionary>(TNode<SimpleNameDictionary>, TNode<Name>, Label*,
+                          TVariable<IntPtrT>*, Label*, LookupMode);
 
 template <typename Dictionary>
 void CodeStubAssembler::NameDictionaryLookupWithForwardIndex(
@@ -11475,7 +11559,7 @@ TNode<JSObject> CodeStubAssembler::CreateAsyncFromSyncIterator(
     TNode<Context> context, TNode<JSReceiver> sync_iterator,
     TNode<Object> next) {
   const TNode<NativeContext> native_context = LoadNativeContext(context);
-  const TNode<Map> map = CAST(LoadContextElement(
+  const TNode<Map> map = CAST(LoadContextElementNoCell(
       native_context, Context::ASYNC_FROM_SYNC_ITERATOR_MAP_INDEX));
   const TNode<JSObject> iterator = AllocateJSObjectFromMap(map);
 
@@ -11659,8 +11743,7 @@ TNode<Object> CodeStubAssembler::CallGetterIfAccessor(
         mode == kCallJSGetterDontUseCachedName) {
       Label if_callable(this), if_function_template_info(this);
       TNode<AccessorPair> accessor_pair = CAST(value);
-      TNode<HeapObject> getter =
-          CAST(LoadObjectField(accessor_pair, AccessorPair::kGetterOffset));
+      TNode<HeapObject> getter = CAST(LoadAccessorPairGetter(accessor_pair));
       TNode<Map> getter_map = LoadMap(getter);
 
       GotoIf(IsCallableMap(getter_map), &if_callable);
@@ -11929,10 +12012,8 @@ void CodeStubAssembler::InitializePropertyDescriptorObject(
       return result.value();
     };
 
-    TNode<HeapObject> getter =
-        LoadObjectField<HeapObject>(accessor_pair, AccessorPair::kGetterOffset);
-    TNode<HeapObject> setter =
-        LoadObjectField<HeapObject>(accessor_pair, AccessorPair::kSetterOffset);
+    TNode<HeapObject> getter = CAST(LoadAccessorPairGetter(accessor_pair));
+    TNode<HeapObject> setter = CAST(LoadAccessorPairSetter(accessor_pair));
     getter = BailoutIfTemplateInfo(getter);
     setter = BailoutIfTemplateInfo(setter);
 
@@ -12882,8 +12963,9 @@ TNode<IntPtrT> CodeStubAssembler::TryToIntptr(
 TNode<Context> CodeStubAssembler::LoadScriptContext(
     TNode<Context> context, TNode<IntPtrT> context_index) {
   TNode<NativeContext> native_context = LoadNativeContext(context);
-  TNode<ScriptContextTable> script_context_table = CAST(
-      LoadContextElement(native_context, Context::SCRIPT_CONTEXT_TABLE_INDEX));
+  TNode<ScriptContextTable> script_context_table =
+      CAST(LoadContextElementNoCell(native_context,
+                                    Context::SCRIPT_CONTEXT_TABLE_INDEX));
   return LoadArrayElement(script_context_table, context_index);
 }
 
@@ -13855,7 +13937,7 @@ void CodeStubAssembler::TrapAllocationMemento(TNode<JSObject> object,
   const int kMementoMapOffset =
       ALIGN_TO_ALLOCATION_ALIGNMENT(JSArray::kHeaderSize);
   const int kMementoLastWordOffset =
-      kMementoMapOffset + AllocationMemento::kSize - kTaggedSize;
+      kMementoMapOffset + sizeof(AllocationMemento) - kTaggedSize;
 
   // Bail out if the object is not in new space.
   TNode<IntPtrT> object_word = BitcastTaggedToWord(object);
@@ -13966,30 +14048,32 @@ TNode<IntPtrT> CodeStubAssembler::PageMetadataFromAddress(
 
 TNode<AllocationSite> CodeStubAssembler::CreateAllocationSiteInFeedbackVector(
     TNode<FeedbackVector> feedback_vector, TNode<UintPtrT> slot) {
-  TNode<IntPtrT> size = IntPtrConstant(AllocationSite::kSizeWithWeakNext);
+  TNode<IntPtrT> size = IntPtrConstant(sizeof(AllocationSiteWithWeakNext));
   TNode<HeapObject> site = Allocate(size, AllocationFlag::kPretenured);
   StoreMapNoWriteBarrier(site, RootIndex::kAllocationSiteWithWeakNextMap);
   // Should match AllocationSite::Initialize.
   TNode<WordT> field = UpdateWord<AllocationSite::ElementsKindBits>(
       IntPtrConstant(0), UintPtrConstant(GetInitialFastElementsKind()));
   StoreObjectFieldNoWriteBarrier(
-      site, AllocationSite::kTransitionInfoOrBoilerplateOffset,
+      site, offsetof(AllocationSite, transition_info_or_boilerplate_),
       SmiTag(Signed(field)));
 
   // Unlike literals, constructed arrays don't have nested sites
   TNode<Smi> zero = SmiConstant(0);
-  StoreObjectFieldNoWriteBarrier(site, AllocationSite::kNestedSiteOffset, zero);
+  StoreObjectFieldNoWriteBarrier(site, offsetof(AllocationSite, nested_site_),
+                                 zero);
 
   // Pretenuring calculation field.
-  StoreObjectFieldNoWriteBarrier(site, AllocationSite::kPretenureDataOffset,
-                                 Int32Constant(0));
+  StoreObjectFieldNoWriteBarrier(
+      site, offsetof(AllocationSite, pretenure_data_), Int32Constant(0));
 
   // Pretenuring memento creation count field.
   StoreObjectFieldNoWriteBarrier(
-      site, AllocationSite::kPretenureCreateCountOffset, Int32Constant(0));
+      site, offsetof(AllocationSite, pretenure_create_count_),
+      Int32Constant(0));
 
   // Store an empty fixed array for the code dependency.
-  StoreObjectFieldRoot(site, AllocationSite::kDependentCodeOffset,
+  StoreObjectFieldRoot(site, offsetof(AllocationSite, dependent_code_),
                        DependentCode::kEmptyDependentCode);
 
   // Link the object to the allocation site list
@@ -14003,7 +14087,8 @@ TNode<AllocationSite> CodeStubAssembler::CreateAllocationSiteInFeedbackVector(
   // system for weakness. For now we decided to keep it like this because having
   // an initial write barrier backed store makes this pointer strong until the
   // next GC, and allocation sites are designed to survive several GCs anyway.
-  StoreObjectField(site, AllocationSite::kWeakNextOffset, next_site);
+  StoreObjectField(site, offsetof(AllocationSiteWithWeakNext, weak_next_),
+                   next_site);
   StoreFullTaggedNoWriteBarrier(site_list, site);
 
   StoreFeedbackVectorSlot(feedback_vector, slot, site);
@@ -14027,14 +14112,16 @@ TNode<BoolT> CodeStubAssembler::HasBoilerplate(
 TNode<Smi> CodeStubAssembler::LoadTransitionInfo(
     TNode<AllocationSite> allocation_site) {
   TNode<Smi> transition_info = CAST(LoadObjectField(
-      allocation_site, AllocationSite::kTransitionInfoOrBoilerplateOffset));
+      allocation_site,
+      offsetof(AllocationSite, transition_info_or_boilerplate_)));
   return transition_info;
 }
 
 TNode<JSObject> CodeStubAssembler::LoadBoilerplate(
     TNode<AllocationSite> allocation_site) {
   TNode<JSObject> boilerplate = CAST(LoadObjectField(
-      allocation_site, AllocationSite::kTransitionInfoOrBoilerplateOffset));
+      allocation_site,
+      offsetof(AllocationSite, transition_info_or_boilerplate_)));
   return boilerplate;
 }
 
@@ -14050,7 +14137,8 @@ TNode<Int32T> CodeStubAssembler::LoadElementsKind(
 
 TNode<Object> CodeStubAssembler::LoadNestedAllocationSite(
     TNode<AllocationSite> allocation_site) {
-  return LoadObjectField(allocation_site, AllocationSite::kNestedSiteOffset);
+  return LoadObjectField(allocation_site,
+                         offsetof(AllocationSite, nested_site_));
 }
 
 template <typename TIndex>
@@ -14421,20 +14509,6 @@ TNode<Context> CodeStubAssembler::GotoIfHasContextExtensionUpToDepth(
   Goto(&context_search);
   BIND(&context_search);
   {
-#if DEBUG
-    // Const tracking let data is stored in the extension slot of a
-    // ScriptContext - however, it's unrelated to the sloppy eval variable
-    // extension. We should never iterate through a ScriptContext here.
-    auto scope_info = LoadScopeInfo(cur_context.value());
-    TNode<Uint32T> flags =
-        LoadObjectField<Uint32T>(scope_info, ScopeInfo::kFlagsOffset);
-    auto scope_type = DecodeWord32<ScopeInfo::ScopeTypeBits>(flags);
-    CSA_DCHECK(this, Word32NotEqual(scope_type,
-                                    Int32Constant(ScopeType::SCRIPT_SCOPE)));
-    CSA_DCHECK(this, Word32NotEqual(scope_type,
-                                    Int32Constant(ScopeType::REPL_MODE_SCOPE)));
-#endif
-
     // Check if context has an extension slot.
     TNode<BoolT> has_extension =
         LoadScopeInfoHasExtensionField(LoadScopeInfo(cur_context.value()));
@@ -14442,15 +14516,15 @@ TNode<Context> CodeStubAssembler::GotoIfHasContextExtensionUpToDepth(
 
     // Jump to the target if the extension slot is not an undefined value.
     TNode<Object> extension_slot =
-        LoadContextElement(cur_context.value(), Context::EXTENSION_INDEX);
+        LoadContextElementNoCell(cur_context.value(), Context::EXTENSION_INDEX);
     Branch(TaggedNotEqual(extension_slot, UndefinedConstant()), target,
            &no_extension);
 
     BIND(&no_extension);
     {
       cur_depth = Unsigned(Int32Sub(cur_depth.value(), Int32Constant(1)));
-      cur_context = CAST(
-          LoadContextElement(cur_context.value(), Context::PREVIOUS_INDEX));
+      cur_context = CAST(LoadContextElementNoCell(cur_context.value(),
+                                                  Context::PREVIOUS_INDEX));
 
       Branch(Word32NotEqual(cur_depth.value(), Int32Constant(0)),
              &context_search, &exit_loop);
@@ -14584,7 +14658,17 @@ TNode<Boolean> CodeStubAssembler::RelationalComparison(
 
       BIND(&if_right_not_numeric);
       {
-        OverwriteFeedback(var_type_feedback, CompareOperationFeedback::kAny);
+        if (var_type_feedback != nullptr) {
+          // Collect NumberOrOddball if {right} is an Oddball. Otherwise collect
+          // Any feedback.
+          CombineFeedback(
+              var_type_feedback,
+              SelectSmiConstant(
+                  InstanceTypeEqual(right_instance_type, ODDBALL_TYPE),
+                  CompareOperationFeedback::kNumberOrOddball,
+                  CompareOperationFeedback::kAny));
+        }
+
         // Convert {right} to a Numeric; we don't need to perform the
         // dedicated ToPrimitive(right, hint Number) operation, as the
         // ToNumeric(right) will by itself already invoke ToPrimitive with
@@ -14629,7 +14713,17 @@ TNode<Boolean> CodeStubAssembler::RelationalComparison(
 
         BIND(&if_left_not_numeric);
         {
-          OverwriteFeedback(var_type_feedback, CompareOperationFeedback::kAny);
+          if (var_type_feedback != nullptr) {
+            // Collect NumberOrOddball if {left} is an Oddball. Otherwise
+            // collect Any feedback.
+            CombineFeedback(
+                var_type_feedback,
+                SelectSmiConstant(
+                    InstanceTypeEqual(left_instance_type, ODDBALL_TYPE),
+                    CompareOperationFeedback::kNumberOrOddball,
+                    CompareOperationFeedback::kAny));
+          }
+
           // Convert {left} to a Numeric; we don't need to perform the
           // dedicated ToPrimitive(left, hint Number) operation, as the
           // ToNumeric(left) will by itself already invoke ToPrimitive with
@@ -14683,8 +14777,17 @@ TNode<Boolean> CodeStubAssembler::RelationalComparison(
 
           BIND(&if_right_not_numeric);
           {
-            OverwriteFeedback(var_type_feedback,
-                              CompareOperationFeedback::kAny);
+            if (var_type_feedback != nullptr) {
+              // Collect NumberOrOddball if {right} is an Oddball. Otherwise
+              // collect Any feedback.
+              CombineFeedback(
+                  var_type_feedback,
+                  SelectSmiConstant(
+                      InstanceTypeEqual(right_instance_type, ODDBALL_TYPE),
+                      CompareOperationFeedback::kNumberOrOddball,
+                      CompareOperationFeedback::kAny));
+            }
+
             // Convert {right} to a Numeric; we don't need to perform
             // dedicated ToPrimitive(right, hint Number) operation, as the
             // ToNumeric(right) will by itself already invoke ToPrimitive with
@@ -16391,8 +16494,8 @@ TNode<Boolean> CodeStubAssembler::InstanceOf(TNode<Object> object,
   // Function.prototype[@@hasInstance] method, and emit a direct call in
   // that case without any additional checking.
   TNode<NativeContext> native_context = LoadNativeContext(context);
-  TNode<JSFunction> function_has_instance = CAST(
-      LoadContextElement(native_context, Context::FUNCTION_HAS_INSTANCE_INDEX));
+  TNode<JSFunction> function_has_instance = CAST(LoadContextElementNoCell(
+      native_context, Context::FUNCTION_HAS_INSTANCE_INDEX));
   GotoIfNot(TaggedEqual(inst_of_handler, function_has_instance),
             &if_otherhandler);
   {
@@ -16663,8 +16766,8 @@ TNode<JSObject> CodeStubAssembler::AllocateJSIteratorResult(
     TNode<Context> context, TNode<Object> value, TNode<Boolean> done) {
   CSA_DCHECK(this, IsBoolean(done));
   TNode<NativeContext> native_context = LoadNativeContext(context);
-  TNode<Map> map = CAST(
-      LoadContextElement(native_context, Context::ITERATOR_RESULT_MAP_INDEX));
+  TNode<Map> map = CAST(LoadContextElementNoCell(
+      native_context, Context::ITERATOR_RESULT_MAP_INDEX));
   TNode<HeapObject> result = Allocate(JSIteratorResult::kSize);
   StoreMapNoWriteBarrier(result, map);
   StoreObjectFieldRoot(result, JSIteratorResult::kPropertiesOrHashOffset,
@@ -16689,7 +16792,7 @@ TNode<JSObject> CodeStubAssembler::AllocateJSIteratorResultForEntry(
                                  length);
   StoreFixedArrayElement(elements, 0, key);
   StoreFixedArrayElement(elements, 1, value);
-  TNode<Map> array_map = CAST(LoadContextElement(
+  TNode<Map> array_map = CAST(LoadContextElementNoCell(
       native_context, Context::JS_ARRAY_PACKED_ELEMENTS_MAP_INDEX));
   TNode<HeapObject> array =
       Allocate(ALIGN_TO_ALLOCATION_ALIGNMENT(JSArray::kHeaderSize));
@@ -16698,8 +16801,8 @@ TNode<JSObject> CodeStubAssembler::AllocateJSIteratorResultForEntry(
                        RootIndex::kEmptyFixedArray);
   StoreObjectFieldNoWriteBarrier(array, JSArray::kElementsOffset, elements);
   StoreObjectFieldNoWriteBarrier(array, JSArray::kLengthOffset, length);
-  TNode<Map> iterator_map = CAST(
-      LoadContextElement(native_context, Context::ITERATOR_RESULT_MAP_INDEX));
+  TNode<Map> iterator_map = CAST(LoadContextElementNoCell(
+      native_context, Context::ITERATOR_RESULT_MAP_INDEX));
   TNode<HeapObject> result = Allocate(JSIteratorResult::kSize);
   StoreMapNoWriteBarrier(result, iterator_map);
   StoreObjectFieldRoot(result, JSIteratorResult::kPropertiesOrHashOffset,
@@ -16716,7 +16819,7 @@ TNode<JSObject> CodeStubAssembler::AllocatePromiseWithResolversResult(
     TNode<Context> context, TNode<Object> promise, TNode<Object> resolve,
     TNode<Object> reject) {
   TNode<NativeContext> native_context = LoadNativeContext(context);
-  TNode<Map> map = CAST(LoadContextElement(
+  TNode<Map> map = CAST(LoadContextElementNoCell(
       native_context, Context::PROMISE_WITHRESOLVERS_RESULT_MAP_INDEX));
   TNode<HeapObject> result = Allocate(JSPromiseWithResolversResult::kSize);
   StoreMapNoWriteBarrier(result, map);
@@ -17133,8 +17236,9 @@ TNode<RawPtrT> CodeStubArguments::AtIndexPtr(TNode<IntPtrT> index) const {
 }
 
 TNode<JSAny> CodeStubArguments::AtIndex(TNode<IntPtrT> index) const {
-  CSA_DCHECK(assembler_, assembler_->UintPtrOrSmiLessThan(
-                             index, GetLengthWithoutReceiver()));
+  // Defense-in-depth check to prevent out-of-bounds stack access.
+  CSA_SBXCHECK(assembler_, assembler_->UintPtrOrSmiLessThan(
+                               index, GetLengthWithoutReceiver()));
   return assembler_->CAST(assembler_->LoadFullTagged(AtIndexPtr(index)));
 }
 
@@ -17171,12 +17275,6 @@ TNode<JSAny> CodeStubArguments::GetOptionalArgumentValue(
   return result.value();
 }
 
-void CodeStubArguments::SetArgumentValue(TNode<IntPtrT> index,
-                                         TNode<JSAny> value) {
-  TNode<RawPtrT> slot = AtIndexPtr(index);
-  assembler_->StoreFullTaggedNoWriteBarrier(slot, value);
-}
-
 void CodeStubArguments::ForEach(
     const CodeStubAssembler::VariableList& vars,
     const CodeStubArguments::ForEachBodyFunction& body, TNode<IntPtrT> first,
@@ -17624,7 +17722,7 @@ TNode<JSFunction> CodeStubAssembler::AllocateRootFunctionWithContext(
       UncheckedCast<SharedFunctionInfo>(LoadRoot(function));
   const TNode<NativeContext> native_context =
       maybe_native_context ? *maybe_native_context : LoadNativeContext(context);
-  const TNode<Map> map = CAST(LoadContextElement(
+  const TNode<Map> map = CAST(LoadContextElementNoCell(
       native_context, Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX));
   const TNode<HeapObject> fun = Allocate(JSFunction::kSizeWithoutPrototype);
   static_assert(JSFunction::kSizeWithoutPrototype == 7 * kTaggedSize);
@@ -17768,12 +17866,6 @@ TNode<JSAny> CodeStubAssembler::GetArgumentValue(TorqueStructArguments args,
   return CodeStubArguments(this, args).GetOptionalArgumentValue(index);
 }
 
-void CodeStubAssembler::SetArgumentValue(TorqueStructArguments args,
-                                         TNode<IntPtrT> index,
-                                         TNode<JSAny> value) {
-  CodeStubArguments(this, args).SetArgumentValue(index, value);
-}
-
 TorqueStructArguments CodeStubAssembler::GetFrameArguments(
     TNode<RawPtrT> frame, TNode<IntPtrT> argc,
     FrameArgumentsArgcType argc_type) {
@@ -17962,8 +18054,8 @@ TNode<JSArray> CodeStubAssembler::ArrayCreate(TNode<Context> context,
   BIND(&runtime);
   {
     TNode<NativeContext> native_context = LoadNativeContext(context);
-    TNode<JSFunction> array_function =
-        CAST(LoadContextElement(native_context, Context::ARRAY_FUNCTION_INDEX));
+    TNode<JSFunction> array_function = CAST(LoadContextElementNoCell(
+        native_context, Context::ARRAY_FUNCTION_INDEX));
     array = CAST(CallRuntimeNewArray(context, array_function, length,
                                      array_function, UndefinedConstant()));
     Goto(&done);
@@ -17972,7 +18064,7 @@ TNode<JSArray> CodeStubAssembler::ArrayCreate(TNode<Context> context,
   BIND(&next);
   TNode<Smi> length_smi = CAST(length);
 
-  TNode<Map> array_map = CAST(LoadContextElement(
+  TNode<Map> array_map = CAST(LoadContextElementNoCell(
       context, Context::JS_ARRAY_PACKED_SMI_ELEMENTS_MAP_INDEX));
 
   // TODO(delphick): Consider using
@@ -18134,8 +18226,8 @@ void PrototypeCheckAssembler::CheckAndBranch(TNode<HeapObject> prototype,
                                  &var_value);
 
       TNode<Object> actual_value = var_value.value();
-      TNode<Object> expected_value =
-          LoadContextElement(native_context_, p.expected_value_context_index);
+      TNode<Object> expected_value = LoadContextElementNoCell(
+          native_context_, p.expected_value_context_index);
       GotoIfNot(TaggedEqual(actual_value, expected_value), if_modified);
     }
 
diff --git a/deps/v8/src/codegen/code-stub-assembler.h b/deps/v8/src/codegen/code-stub-assembler.h
index 6f9846af5ab123..78e62389fda3db 100644
--- a/deps/v8/src/codegen/code-stub-assembler.h
+++ b/deps/v8/src/codegen/code-stub-assembler.h
@@ -283,7 +283,18 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   intptr_t ConstexprWordNot(intptr_t a) { return ~a; }
   uintptr_t ConstexprWordNot(uintptr_t a) { return ~a; }
 
-  TNode<BoolT> TaggedEqual(TNode<AnyTaggedT> a, TNode<AnyTaggedT> b) {
+#if defined(V8_EXTERNAL_CODE_SPACE) || defined(V8_ENABLE_SANDBOX)
+  void CheckObjectComparisonAllowed(TNode<AnyTaggedT> a, TNode<AnyTaggedT> b,
+                                    SourceLocation loc);
+#endif
+
+  TNode<BoolT> TaggedEqual(TNode<AnyTaggedT> a, TNode<AnyTaggedT> b,
+                           SourceLocation loc = SourceLocation::Current()) {
+#if defined(V8_EXTERNAL_CODE_SPACE) || defined(V8_ENABLE_SANDBOX)
+    if (v8_flags.enable_slow_asserts) {
+      CheckObjectComparisonAllowed(a, b, loc);
+    }
+#endif
     if (COMPRESS_POINTERS_BOOL) {
       return Word32Equal(ReinterpretCast<Word32T>(a),
                          ReinterpretCast<Word32T>(b));
@@ -292,8 +303,25 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
     }
   }
 
-  TNode<BoolT> TaggedNotEqual(TNode<AnyTaggedT> a, TNode<AnyTaggedT> b) {
-    return Word32BinaryNot(TaggedEqual(a, b));
+  TNode<BoolT> TaggedNotEqual(TNode<AnyTaggedT> a, TNode<AnyTaggedT> b,
+                              SourceLocation loc = SourceLocation::Current()) {
+    return Word32BinaryNot(TaggedEqual(a, b, loc));
+  }
+
+  // A variant of TaggedEqual which allows comparing objects in different
+  // pointer compression cages. In particular, this should be used when
+  // comparing objects in trusted- or code space with objects in the main
+  // pointer compression cage. Currently only defined for HeapObject, this
+  // type can be expanded if needed.
+  TNode<BoolT> SafeEqual(TNode<HeapObject> a, TNode<HeapObject> b) {
+    if (V8_EXTERNAL_CODE_SPACE_BOOL || V8_ENABLE_SANDBOX_BOOL) {
+      return WordEqual(BitcastTaggedToWord(a), BitcastTaggedToWord(b));
+    }
+    return TaggedEqual(a, b);
+  }
+
+  TNode<BoolT> SafeNotEqual(TNode<HeapObject> a, TNode<HeapObject> b) {
+    return Word32BinaryNot(SafeEqual(a, b));
   }
 
   TNode<Smi> NoContextConstant();
@@ -322,9 +350,11 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   HEAP_MUTABLE_IMMOVABLE_OBJECT_LIST(HEAP_CONSTANT_ACCESSOR)
 #undef HEAP_CONSTANT_ACCESSOR
 
-#define HEAP_CONSTANT_TEST(rootIndexName, rootAccessorName, name) \
-  TNode<BoolT> Is##name(TNode<Object> value);                     \
-  TNode<BoolT> IsNot##name(TNode<Object> value);
+#define HEAP_CONSTANT_TEST(rootIndexName, rootAccessorName, name)        \
+  TNode<BoolT> Is##name(TNode<Object> value,                             \
+                        SourceLocation loc = SourceLocation::Current()); \
+  TNode<BoolT> IsNot##name(TNode<Object> value,                          \
+                           SourceLocation loc = SourceLocation::Current());
   HEAP_IMMOVABLE_OBJECT_LIST(HEAP_CONSTANT_TEST)
 #undef HEAP_CONSTANT_TEST
 
@@ -609,33 +639,26 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   using ExtraNode = std::pair<TNode<Object>, const char*>;
 
   void Dcheck(const BranchGenerator& branch, const char* message,
-              const char* file, int line,
               std::initializer_list<ExtraNode> extra_nodes = {},
               const SourceLocation& loc = SourceLocation::Current());
   void Dcheck(const NodeGenerator<BoolT>& condition_body, const char* message,
-              const char* file, int line,
               std::initializer_list<ExtraNode> extra_nodes = {},
               const SourceLocation& loc = SourceLocation::Current());
   void Dcheck(TNode<Word32T> condition_node, const char* message,
-              const char* file, int line,
               std::initializer_list<ExtraNode> extra_nodes = {},
               const SourceLocation& loc = SourceLocation::Current());
   void Check(const BranchGenerator& branch, const char* message,
-             const char* file, int line,
              std::initializer_list<ExtraNode> extra_nodes = {},
              const SourceLocation& loc = SourceLocation::Current());
   void Check(const NodeGenerator<BoolT>& condition_body, const char* message,
-             const char* file, int line,
              std::initializer_list<ExtraNode> extra_nodes = {},
              const SourceLocation& loc = SourceLocation::Current());
   void Check(TNode<Word32T> condition_node, const char* message,
-             const char* file, int line,
              std::initializer_list<ExtraNode> extra_nodes = {},
              const SourceLocation& loc = SourceLocation::Current());
   void FailAssert(const char* message,
                   const std::vector<FileAndLine>& files_and_lines,
-                  std::initializer_list<ExtraNode> extra_nodes = {},
-                  const SourceLocation& loc = SourceLocation::Current());
+                  std::initializer_list<ExtraNode> extra_nodes = {});
 
   void FastCheck(TNode<BoolT> condition);
 
@@ -774,6 +797,10 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<BoolT> TaggedIsSmi(TNode<MaybeObject> a);
   TNode<BoolT> TaggedIsNotSmi(TNode<MaybeObject> a);
 
+  // Check a value for HeapObject-ness (for a heap object tag bit).
+  TNode<BoolT> TaggedIsStrongHeapObject(TNode<MaybeObject> a);
+  TNode<BoolT> TaggedIsNotStrongHeapObject(TNode<MaybeObject> a);
+
   // Check that the value is a non-negative smi.
   TNode<BoolT> TaggedIsPositiveSmi(TNode<Object> a);
   // Check that a word has a word-aligned address.
@@ -1288,8 +1315,9 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
 
   // Load the floating point value of a HeapNumber.
   TNode<Float64T> LoadHeapNumberValue(TNode<HeapObject> object);
-  TNode<Int32T> LoadHeapInt32Value(TNode<HeapObject> object);
-  void StoreHeapInt32Value(TNode<HeapObject> object, TNode<Int32T> value);
+  TNode<Int32T> LoadContextCellInt32Value(TNode<ContextCell> object);
+  void StoreContextCellInt32Value(TNode<ContextCell> object,
+                                  TNode<Int32T> value);
   // Load the Map of an HeapObject.
   TNode<Map> LoadMap(TNode<HeapObject> object);
   // Load the instance type of an HeapObject.
@@ -1631,7 +1659,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   void GotoIfContextElementEqual(TNode<Object> value,
                                  TNode<NativeContext> native_context,
                                  int slot_index, Label* if_equal) {
-    GotoIf(TaggedEqual(value, LoadContextElement(native_context, slot_index)),
+    GotoIf(TaggedEqual(value,
+                       LoadContextElementNoCell(native_context, slot_index)),
            if_equal);
   }
 
@@ -1973,7 +2002,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<HeapNumber> AllocateHeapNumberWithValue(double value) {
     return AllocateHeapNumberWithValue(Float64Constant(value));
   }
-  TNode<HeapNumber> AllocateHeapInt32WithValue(TNode<Int32T> value);
+
+  TNode<ContextCell> AllocateContextCell(TNode<Object> value);
 
   // Allocate a BigInt with {length} digits. Sets the sign bit to {false}.
   // Does not initialize the digits.
@@ -2860,6 +2890,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<BoolT> IsUndetectableMap(TNode<Map> map);
   TNode<BoolT> IsNotWeakFixedArraySubclass(TNode<HeapObject> object);
   TNode<BoolT> IsZeroOrContext(TNode<Object> object);
+  TNode<BoolT> IsEmptyDependentCode(TNode<Object> object);
 
   TNode<BoolT> IsPromiseResolveProtectorCellInvalid();
   TNode<BoolT> IsPromiseThenProtectorCellInvalid();
@@ -2897,20 +2928,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
         ExternalReference::address_of_shared_string_table_flag());
   }
 
-  TNode<BoolT> IsScriptContextMutableHeapNumberFlag() {
-    return LoadRuntimeFlag(
-        ExternalReference::script_context_mutable_heap_number_flag());
-  }
-
-  TNode<BoolT> IsScriptContextMutableHeapInt32Flag() {
-#ifdef SUPPORT_SCRIPT_CONTEXT_MUTABLE_HEAP_INT32
-    return LoadRuntimeFlag(
-        ExternalReference::script_context_mutable_heap_int32_flag());
-#else
-    return BoolConstant(false);
-#endif  // SUPPORT_SCRIPT_CONTEXT_MUTABLE_HEAP_INT32
-  }
-
   TNode<BoolT> IsAdditiveSafeIntegerFeedbackEnabled() {
     if (Is64()) {
       return LoadRuntimeFlag(
@@ -2920,6 +2937,11 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
     }
   }
 
+  TNode<BoolT> IsScriptContextCellsFlag() {
+    return LoadRuntimeFlag(
+        ExternalReference::address_of_script_context_cells_flag());
+  }
+
   // True iff |object| is a Smi or a HeapNumber or a BigInt.
   TNode<BoolT> IsNumeric(TNode<Object> object);
 
@@ -2997,6 +3019,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<Uint16T> StringCharCodeAt(TNode<String> string, TNode<UintPtrT> index);
   // Return the single character string with only {code}.
   TNode<String> StringFromSingleCharCode(TNode<Int32T> code);
+  // Return the one byte single character string with only {code}.
+  TNode<String> StringFromSingleOneByteCharCode(TNode<Uint8T> code);
 
   // Type conversion helpers.
   enum class BigIntHandling { kConvertToNumber, kThrow };
@@ -3821,6 +3845,15 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<Int32T> LoadElementsKind(TNode<AllocationSite> allocation_site);
   TNode<Object> LoadNestedAllocationSite(TNode<AllocationSite> allocation_site);
 
+  TNode<Object> LoadAccessorPairGetter(TNode<AccessorPair> accessor_pair) {
+    return LoadObjectField<Object>(accessor_pair,
+                                   offsetof(AccessorPair, getter_));
+  }
+  TNode<Object> LoadAccessorPairSetter(TNode<AccessorPair> accessor_pair) {
+    return LoadObjectField<Object>(accessor_pair,
+                                   offsetof(AccessorPair, setter_));
+  }
+
   enum class IndexAdvanceMode { kPre, kPost };
   enum class IndexAdvanceDirection { kUp, kDown };
   enum class LoopUnrollingMode { kNo, kYes };
@@ -4248,9 +4281,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<JSAny> GetArgumentValue(TorqueStructArguments args,
                                 TNode<IntPtrT> index);
 
-  void SetArgumentValue(TorqueStructArguments args, TNode<IntPtrT> index,
-                        TNode<JSAny> value);
-
   enum class FrameArgumentsArgcType {
     kCountIncludesReceiver,
     kCountExcludesReceiver
@@ -4823,8 +4853,6 @@ class V8_EXPORT_PRIVATE CodeStubArguments {
     return GetOptionalArgumentValue(assembler_->IntPtrConstant(index));
   }
 
-  void SetArgumentValue(TNode<IntPtrT> index, TNode<JSAny> value);
-
   // Iteration doesn't include the receiver. |first| and |last| are zero-based.
   using ForEachBodyFunction = std::function<void(TNode<JSAny> arg)>;
   void ForEach(const ForEachBodyFunction& body, TNode<IntPtrT> first = {},
diff --git a/deps/v8/src/codegen/compilation-cache.cc b/deps/v8/src/codegen/compilation-cache.cc
index 81a726e883a9ef..dad7fef67973df 100644
--- a/deps/v8/src/codegen/compilation-cache.cc
+++ b/deps/v8/src/codegen/compilation-cache.cc
@@ -95,32 +95,13 @@ void CompilationCacheEval::Age() {
     Tagged<Object> key;
     if (!table->ToKey(isolate(), entry, &key)) continue;
 
-    if (IsNumber(key, isolate())) {
-      // The ageing mechanism for the initial dummy entry in the eval cache.
-      // The 'key' is the hash represented as a Number. The 'value' is a smi
-      // counting down from kHashGenerations. On reaching zero, the entry is
-      // cleared.
-      // Note: The following static assert only establishes an explicit
-      // connection between initialization- and use-sites of the smi value
-      // field.
-      static_assert(CompilationCacheTable::kHashGenerations);
-      const int new_count = Smi::ToInt(table->PrimaryValueAt(entry)) - 1;
-      if (new_count == 0) {
-        table->RemoveEntry(entry);
-      } else {
-        DCHECK_GT(new_count, 0);
-        table->SetPrimaryValueAt(entry, Smi::FromInt(new_count),
-                                 SKIP_WRITE_BARRIER);
-      }
-    } else {
-      DCHECK(IsFixedArray(key));
-      // The ageing mechanism for eval caches.
-      Tagged<SharedFunctionInfo> info =
-          Cast<SharedFunctionInfo>(table->PrimaryValueAt(entry));
-      // Clear entries after Bytecode was flushed from SFI.
-      if (!info->HasBytecodeArray()) {
-        table->RemoveEntry(entry);
-      }
+    DCHECK(IsFixedArray(key));
+    // The ageing mechanism for eval caches.
+    Tagged<SharedFunctionInfo> info =
+        Cast<SharedFunctionInfo>(table->PrimaryValueAt(entry));
+    // Clear entries after Bytecode was flushed from SFI.
+    if (!info->HasBytecodeArray()) {
+      table->RemoveEntry(entry);
     }
   }
 }
@@ -153,24 +134,10 @@ void CompilationCacheEvalOrScript::Remove(
 
 CompilationCacheScript::LookupResult CompilationCacheScript::Lookup(
     Handle<String> source, const ScriptDetails& script_details) {
-  LookupResult result;
-  LookupResult::RawObjects raw_result_for_escaping_handle_scope;
-
-  // Probe the script table. Make sure not to leak handles
-  // into the caller's handle scope.
-  {
-    HandleScope scope(isolate());
-    DirectHandle<CompilationCacheTable> table = GetTable();
-    LookupResult probe = CompilationCacheTable::LookupScript(
-        table, source, script_details, isolate());
-    raw_result_for_escaping_handle_scope = probe.GetRawObjects();
-  }
-  result = LookupResult::FromRawObjects(raw_result_for_escaping_handle_scope,
-                                        isolate());
+  DirectHandle<CompilationCacheTable> table = GetTable();
+  LookupResult result = CompilationCacheTable::LookupScript(
+      table, source, script_details, isolate());
 
-  // Once outside the manacles of the handle scope, we need to recheck
-  // to see if we actually found a cached script. If so, we return a
-  // handle created in the caller's handle scope.
   DirectHandle<Script> script;
   if (result.script().ToHandle(&script)) {
     DirectHandle<SharedFunctionInfo> sfi;
@@ -188,20 +155,25 @@ CompilationCacheScript::LookupResult CompilationCacheScript::Lookup(
 
 void CompilationCacheScript::Put(
     Handle<String> source, DirectHandle<SharedFunctionInfo> function_info) {
-  HandleScope scope(isolate());
   Handle<CompilationCacheTable> table = GetTable();
   table_ = *CompilationCacheTable::PutScript(table, source, kNullMaybeHandle,
                                              function_info, isolate());
 }
 
+void CompilationCacheEval::UpdateEval(
+    DirectHandle<String> source, DirectHandle<SharedFunctionInfo> outer_info,
+    DirectHandle<NativeContext> native_context,
+    DirectHandle<FeedbackCell> feedback_cell, LanguageMode language_mode,
+    int position) {
+  DirectHandle<CompilationCacheTable> table = GetTable();
+  CompilationCacheTable::UpdateEval(table, source, outer_info, native_context,
+                                    feedback_cell, language_mode, position);
+}
+
 InfoCellPair CompilationCacheEval::Lookup(
     DirectHandle<String> source, DirectHandle<SharedFunctionInfo> outer_info,
     DirectHandle<NativeContext> native_context, LanguageMode language_mode,
     int position) {
-  HandleScope scope(isolate());
-  // Make sure not to leak the table into the surrounding handle
-  // scope. Otherwise, we risk keeping old tables around even after
-  // having cleared the cache.
   InfoCellPair result;
   DirectHandle<CompilationCacheTable> table = GetTable();
   result = CompilationCacheTable::LookupEval(
@@ -220,7 +192,6 @@ void CompilationCacheEval::Put(DirectHandle<String> source,
                                DirectHandle<NativeContext> native_context,
                                DirectHandle<FeedbackCell> feedback_cell,
                                int position) {
-  HandleScope scope(isolate());
   DirectHandle<CompilationCacheTable> table = GetTable();
   table_ =
       *CompilationCacheTable::PutEval(table, source, outer_info, function_info,
@@ -278,6 +249,24 @@ CompilationCacheScript::LookupResult CompilationCache::LookupScript(
   return script_.Lookup(source, script_details);
 }
 
+void CompilationCache::UpdateEval(DirectHandle<String> source,
+                                  DirectHandle<SharedFunctionInfo> outer_info,
+                                  DirectHandle<Context> context,
+                                  DirectHandle<FeedbackCell> new_feedback_cell,
+                                  LanguageMode language_mode, int position) {
+  DirectHandle<NativeContext> maybe_native_context;
+  if (TryCast<NativeContext>(context, &maybe_native_context)) {
+    eval_global_.UpdateEval(source, outer_info, maybe_native_context,
+                            new_feedback_cell, language_mode, position);
+  } else {
+    DCHECK_NE(position, kNoSourcePosition);
+    DirectHandle<NativeContext> native_context(context->native_context(),
+                                               isolate());
+    eval_contextual_.UpdateEval(source, outer_info, native_context,
+                                new_feedback_cell, language_mode, position);
+  }
+}
+
 InfoCellPair CompilationCache::LookupEval(
     DirectHandle<String> source, DirectHandle<SharedFunctionInfo> outer_info,
     DirectHandle<Context> context, LanguageMode language_mode, int position) {
@@ -331,7 +320,6 @@ void CompilationCache::PutEval(DirectHandle<String> source,
   if (!IsEnabledScriptAndEval()) return;
 
   const char* cache_type;
-  HandleScope scope(isolate());
   DirectHandle<NativeContext> maybe_native_context;
   if (TryCast<NativeContext>(context, &maybe_native_context)) {
     eval_global_.Put(source, outer_info, function_info, maybe_native_context,
diff --git a/deps/v8/src/codegen/compilation-cache.h b/deps/v8/src/codegen/compilation-cache.h
index d83eb3c56893d4..e58a91f65171f7 100644
--- a/deps/v8/src/codegen/compilation-cache.h
+++ b/deps/v8/src/codegen/compilation-cache.h
@@ -86,6 +86,12 @@ class CompilationCacheEval : public CompilationCacheEvalOrScript {
                       DirectHandle<NativeContext> native_context,
                       LanguageMode language_mode, int position);
 
+  void UpdateEval(DirectHandle<String> source,
+                  DirectHandle<SharedFunctionInfo> outer_info,
+                  DirectHandle<NativeContext> native_context,
+                  DirectHandle<FeedbackCell> new_feedback_cell,
+                  LanguageMode language_mode, int position);
+
   void Put(DirectHandle<String> source,
            DirectHandle<SharedFunctionInfo> outer_info,
            DirectHandle<SharedFunctionInfo> function_info,
@@ -101,7 +107,7 @@ class CompilationCacheEval : public CompilationCacheEvalOrScript {
 // Sub-cache for regular expressions.
 class CompilationCacheRegExp {
  public:
-  CompilationCacheRegExp(Isolate* isolate) : isolate_(isolate) {}
+  explicit CompilationCacheRegExp(Isolate* isolate) : isolate_(isolate) {}
 
   MaybeDirectHandle<RegExpData> Lookup(DirectHandle<String> source,
                                        JSRegExp::Flags flags);
@@ -159,6 +165,12 @@ class V8_EXPORT_PRIVATE CompilationCache {
                           DirectHandle<Context> context,
                           LanguageMode language_mode, int position);
 
+  void UpdateEval(DirectHandle<String> source,
+                  DirectHandle<SharedFunctionInfo> outer_info,
+                  DirectHandle<Context> context,
+                  DirectHandle<FeedbackCell> new_feedback_cell,
+                  LanguageMode language_mode, int position);
+
   // Returns the regexp data associated with the given regexp if it
   // is in cache, otherwise an empty handle.
   MaybeDirectHandle<RegExpData> LookupRegExp(DirectHandle<String> source,
diff --git a/deps/v8/src/codegen/compiler.cc b/deps/v8/src/codegen/compiler.cc
index e31937f0429645..9c60944288630c 100644
--- a/deps/v8/src/codegen/compiler.cc
+++ b/deps/v8/src/codegen/compiler.cc
@@ -542,6 +542,8 @@ CompilationJob::Status TurbofanCompilationJob::AbortOptimization(
   return UpdateState(FAILED, State::kFailed);
 }
 
+void TurbofanCompilationJob::Cancel() { compilation_info_->mark_cancelled(); }
+
 void TurbofanCompilationJob::RecordCompilationStats(ConcurrencyMode mode,
                                                     Isolate* isolate) const {
   DCHECK(compilation_info()->IsOptimizing());
@@ -1088,7 +1090,7 @@ bool CompileTurbofan_NotConcurrent(Isolate* isolate,
   DCHECK_EQ(compilation_info->code_kind(), CodeKind::TURBOFAN_JS);
 
   TimerEventScope<TimerEventRecompileSynchronous> timer(isolate);
-  RCS_SCOPE(isolate, RuntimeCallCounterId::kOptimizeNonConcurrent);
+  RCS_SCOPE(isolate, RuntimeCallCounterId::kOptimizeSynchronous);
   TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
                "V8.OptimizeNonConcurrent");
 
@@ -1164,12 +1166,14 @@ bool CompileTurbofan_Concurrent(Isolate* isolate,
   }
 
   if (V8_LIKELY(!compilation_info->discard_result_for_testing())) {
-    function->SetTieringInProgress(true, compilation_info->osr_offset());
+    function->SetTieringInProgress(isolate, true,
+                                   compilation_info->osr_offset());
   }
 
   // The background recompile will own this job.
   if (!isolate->optimizing_compile_dispatcher()->TryQueueForOptimization(job)) {
-    function->SetTieringInProgress(false, compilation_info->osr_offset());
+    function->SetTieringInProgress(isolate, false,
+                                   compilation_info->osr_offset());
 
     if (v8_flags.trace_concurrent_recompilation) {
       PrintF("  ** Compilation queue full, will retry optimizing ");
@@ -1331,7 +1335,7 @@ MaybeHandle<Code> CompileMaglev(Isolate* isolate, Handle<JSFunction> function,
   isolate->maglev_concurrent_dispatcher()->EnqueueJob(std::move(job));
 
   // Remember that the function is currently being processed.
-  function->SetTieringInProgress(true, osr_offset);
+  function->SetTieringInProgress(isolate, true, osr_offset);
   function->SetInterruptBudget(isolate, BudgetModification::kRaise,
                                CodeKind::MAGLEV);
 
@@ -2192,9 +2196,18 @@ class ConstantPoolPointerForwarder {
  private:
   void VerifyScopeInfo(Tagged<ScopeInfo> scope_info,
                        Tagged<ScopeInfo> replacement) {
-    CHECK_EQ(replacement->EndPosition(), scope_info->EndPosition());
-    CHECK_EQ(replacement->scope_type(), scope_info->scope_type());
-    CHECK_EQ(replacement->ContextLength(), scope_info->ContextLength());
+    if (replacement->scope_type() == SCRIPT_SCOPE ||
+        replacement->scope_type() == MODULE_SCOPE) {
+      // During streaming compilation we might not know whether we want to parse
+      // this script as a classic script or module, and do the wrong thing. In
+      // case compilation succeeded, we'll only reject the result later.
+      CHECK(scope_info->scope_type() == SCRIPT_SCOPE ||
+            scope_info->scope_type() == MODULE_SCOPE);
+    } else {
+      CHECK_EQ(replacement->EndPosition(), scope_info->EndPosition());
+      CHECK_EQ(replacement->scope_type(), scope_info->scope_type());
+      CHECK_EQ(replacement->ContextLength(), scope_info->ContextLength());
+    }
   }
   template <typename TArray>
   void IterateConstantPoolEntry(Tagged<TArray> constant_pool, int i) {
@@ -2447,7 +2460,10 @@ void BackgroundMergeTask::BeginMergeInBackground(
           // Also push the old_sfi to make sure it stays alive / isn't replaced.
           new_compiled_data_for_cached_sfis_.push_back(
               {old_sfi_handle, local_heap->NewPersistentHandle(new_sfi)});
-          if (old_sfi->HasOuterScopeInfo()) {
+          Tagged<ScopeInfo> info = old_sfi->scope_info();
+          if (!info->IsEmpty()) {
+            new_sfi->SetScopeInfo(info);
+          } else if (old_sfi->HasOuterScopeInfo()) {
             new_sfi->scope_info()->set_outer_scope_info(
                 old_sfi->GetOuterScopeInfo());
           }
@@ -3027,10 +3043,11 @@ bool Compiler::Compile(Isolate* isolate, DirectHandle<JSFunction> function,
   // which means we are compiling after a bytecode flush.
   // TODO(verwaest/mythria): Investigate if allocating feedback vector
   // immediately after a flush would be better.
-  JSFunction::InitializeFeedbackCell(function, is_compiled_scope, true);
+  JSFunction::InitializeFeedbackCell(isolate, function, is_compiled_scope,
+                                     true);
   function->ResetTieringRequests();
 
-  function->UpdateCode(*code);
+  function->UpdateCode(isolate, *code);
 
   // Optimize now if --always-turbofan is enabled.
 #if V8_ENABLE_WEBASSEMBLY
@@ -3138,7 +3155,7 @@ bool Compiler::CompileBaseline(Isolate* isolate,
 
   Tagged<Code> baseline_code = shared->baseline_code(kAcquireLoad);
   DCHECK_EQ(baseline_code->kind(), CodeKind::BASELINE);
-  function->UpdateCodeKeepTieringRequests(baseline_code);
+  function->UpdateCodeKeepTieringRequests(isolate, baseline_code);
   return true;
 }
 
@@ -3207,7 +3224,7 @@ void Compiler::CompileOptimized(Isolate* isolate,
     // leaptiering case, we potentially need to do this now.
     if (!function->is_compiled(isolate)) {
       function->UpdateCodeKeepTieringRequests(
-          function->shared()->GetCode(isolate));
+          isolate, function->shared()->GetCode(isolate));
     }
 #endif  // V8_ENABLE_LEAPTIERING
   }
@@ -3243,12 +3260,11 @@ MaybeDirectHandle<SharedFunctionInfo> Compiler::CompileForLiveEdit(
 
 // static
 MaybeDirectHandle<JSFunction> Compiler::GetFunctionFromEval(
-    DirectHandle<String> source, DirectHandle<SharedFunctionInfo> outer_info,
-    DirectHandle<Context> context, LanguageMode language_mode,
-    ParseRestriction restriction, int parameters_end_pos, int eval_position,
+    Isolate* isolate, DirectHandle<String> source,
+    DirectHandle<SharedFunctionInfo> outer_info, DirectHandle<Context> context,
+    LanguageMode language_mode, ParseRestriction restriction,
+    int parameters_end_pos, int eval_position,
     ParsingWhileDebugging parsing_while_debugging) {
-  Isolate* isolate = context->GetIsolate();
-
   // The cache lookup key needs to be aware of the separation between the
   // parameters and the body to prevent this valid invocation:
   //   Function("", "function anonymous(\n/**/) {\n}");
@@ -3278,6 +3294,11 @@ MaybeDirectHandle<JSFunction> Compiler::GetFunctionFromEval(
   IsCompiledScope is_compiled_scope;
   bool allow_eval_cache;
   if (eval_result.has_shared()) {
+    // Make sure that the scope_info of the context we're eval-ing in matches
+    // the scope_info we compiled the code for.
+    CHECK_IMPLIES(
+        !IsNativeContext(*context),
+        eval_result.shared()->GetOuterScopeInfo() == context->scope_info());
     shared_info =
         DirectHandle<SharedFunctionInfo>(eval_result.shared(), isolate);
     script = Handle<Script>(Cast<Script>(shared_info->script()), isolate);
@@ -3348,13 +3369,15 @@ MaybeDirectHandle<JSFunction> Compiler::GetFunctionFromEval(
                    .Build();
       // TODO(mythria): I don't think we need this here. PostInstantiation
       // already initializes feedback cell.
-      JSFunction::InitializeFeedbackCell(result, &is_compiled_scope, true);
+      JSFunction::InitializeFeedbackCell(isolate, result, &is_compiled_scope,
+                                         true);
       if (allow_eval_cache) {
         // Make sure to cache this result.
         DirectHandle<FeedbackCell> new_feedback_cell(
             result->raw_feedback_cell(), isolate);
-        compilation_cache->PutEval(source, outer_info, context, shared_info,
-                                   new_feedback_cell, eval_cache_position);
+        compilation_cache->UpdateEval(source, outer_info, context,
+                                      new_feedback_cell, language_mode,
+                                      eval_cache_position);
       }
     }
   } else {
@@ -3363,7 +3386,8 @@ MaybeDirectHandle<JSFunction> Compiler::GetFunctionFromEval(
                  .Build();
     // TODO(mythria): I don't think we need this here. PostInstantiation
     // already initializes feedback cell.
-    JSFunction::InitializeFeedbackCell(result, &is_compiled_scope, true);
+    JSFunction::InitializeFeedbackCell(isolate, result, &is_compiled_scope,
+                                       true);
     if (allow_eval_cache) {
       // Add the SharedFunctionInfo and the LiteralsArray to the eval cache if
       // we didn't retrieve from there.
@@ -3463,11 +3487,9 @@ Compiler::ValidateDynamicCompilationSource(Isolate* isolate,
 
 // static
 MaybeDirectHandle<JSFunction> Compiler::GetFunctionFromValidatedString(
-    DirectHandle<NativeContext> native_context,
+    Isolate* isolate, DirectHandle<NativeContext> native_context,
     MaybeDirectHandle<String> source, ParseRestriction restriction,
     int parameters_end_pos) {
-  Isolate* const isolate = native_context->GetIsolate();
-
   // Raise an EvalError if we did not receive a string.
   if (source.is_null()) {
     Handle<Object> error_message =
@@ -3481,19 +3503,18 @@ MaybeDirectHandle<JSFunction> Compiler::GetFunctionFromValidatedString(
   DirectHandle<SharedFunctionInfo> outer_info(
       native_context->empty_function()->shared(), isolate);
   return Compiler::GetFunctionFromEval(
-      source.ToHandleChecked(), outer_info, native_context,
+      isolate, source.ToHandleChecked(), outer_info, native_context,
       LanguageMode::kSloppy, restriction, parameters_end_pos, eval_position);
 }
 
 // static
 MaybeDirectHandle<JSFunction> Compiler::GetFunctionFromString(
-    DirectHandle<NativeContext> context, Handle<Object> source,
-    int parameters_end_pos, bool is_code_like) {
-  Isolate* const isolate = context->GetIsolate();
+    Isolate* isolate, DirectHandle<NativeContext> context,
+    Handle<Object> source, int parameters_end_pos, bool is_code_like) {
   MaybeDirectHandle<String> validated_source =
       ValidateDynamicCompilationSource(isolate, context, source, is_code_like)
           .first;
-  return GetFunctionFromValidatedString(context, validated_source,
+  return GetFunctionFromValidatedString(isolate, context, validated_source,
                                         ONLY_SINGLE_FUNCTION_LITERAL,
                                         parameters_end_pos);
 }
@@ -3852,7 +3873,7 @@ CompileScriptOnBothBackgroundAndMainThread(Handle<String> source,
   MaybeDirectHandle<SharedFunctionInfo> maybe_result =
       Compiler::GetSharedFunctionInfoForStreamedScript(
           isolate, source, script_details, background_compile_thread.data(),
-          &compilation_details);
+          is_compiled_scope, &compilation_details);
 
   // Either both compiles should succeed, or both should fail. The one exception
   // to this is that the main-thread compilation might stack overflow while the
@@ -3864,14 +3885,6 @@ CompileScriptOnBothBackgroundAndMainThread(Handle<String> source,
     CHECK_EQ(maybe_result.is_null(), main_thread_maybe_result.is_null());
   }
 
-  DirectHandle<SharedFunctionInfo> result;
-  if (maybe_result.ToHandle(&result)) {
-    // The BackgroundCompileTask's IsCompiledScope will keep the result alive
-    // until it dies at the end of this function, after which this new
-    // IsCompiledScope can take over.
-    *is_compiled_scope = result->is_compiled_scope(isolate);
-  }
-
   return maybe_result;
 }
 
@@ -4120,11 +4133,10 @@ Compiler::GetSharedFunctionInfoForScriptWithCompileHints(
 
 // static
 MaybeDirectHandle<JSFunction> Compiler::GetWrappedFunction(
-    Handle<String> source, DirectHandle<Context> context,
+    Isolate* isolate, Handle<String> source, DirectHandle<Context> context,
     const ScriptDetails& script_details, AlignedCachedData* cached_data,
     v8::ScriptCompiler::CompileOptions compile_options,
     v8::ScriptCompiler::NoCacheReason no_cache_reason) {
-  Isolate* isolate = context->GetIsolate();
   ScriptCompiler::CompilationDetails compilation_details;
   ScriptCompileTimerScope compile_timer(isolate, no_cache_reason,
                                         &compilation_details);
@@ -4236,6 +4248,7 @@ MaybeDirectHandle<SharedFunctionInfo>
 Compiler::GetSharedFunctionInfoForStreamedScript(
     Isolate* isolate, Handle<String> source,
     const ScriptDetails& script_details, ScriptStreamingData* streaming_data,
+    IsCompiledScope* is_compiled_scope,
     ScriptCompiler::CompilationDetails* compilation_details) {
   DCHECK(!script_details.origin_options.IsWasm());
 
@@ -4259,6 +4272,7 @@ Compiler::GetSharedFunctionInfoForStreamedScript(
                                         task->flags().outer_language_mode());
     compilation_details->in_memory_cache_result =
         CategorizeLookupResult(lookup_result);
+    *is_compiled_scope = lookup_result.is_compiled_scope();
 
     if (!lookup_result.toplevel_sfi().is_null()) {
       maybe_result = lookup_result.toplevel_sfi();
@@ -4284,6 +4298,11 @@ Compiler::GetSharedFunctionInfoForStreamedScript(
 
     DirectHandle<SharedFunctionInfo> result;
     if (maybe_result.ToHandle(&result)) {
+      // Get a new is_compiled_scope off the result before the task's data
+      // (including the persistent handles owned by its IsCompiledScope) are
+      // released.
+      *is_compiled_scope = result->is_compiled_scope(isolate);
+
       if (task->flags().produce_compile_hints()) {
         Cast<Script>(result->script())->set_produce_compile_hints(true);
       }
@@ -4398,7 +4417,8 @@ void Compiler::DisposeTurbofanCompilationJob(Isolate* isolate,
                          "V8.OptimizeConcurrentDispose", job->trace_id(),
                          TRACE_EVENT_FLAG_FLOW_IN);
   DirectHandle<JSFunction> function = job->compilation_info()->closure();
-  function->SetTieringInProgress(false, job->compilation_info()->osr_offset());
+  function->SetTieringInProgress(isolate, false,
+                                 job->compilation_info()->osr_offset());
 }
 
 // static
@@ -4434,7 +4454,7 @@ void Compiler::FinalizeTurbofanCompilationJob(TurbofanCompilationJob* job,
       job->RecordFunctionCompilation(LogEventListener::CodeTag::kFunction,
                                      isolate);
       if (V8_LIKELY(use_result)) {
-        function->SetTieringInProgress(false,
+        function->SetTieringInProgress(isolate, false,
                                        job->compilation_info()->osr_offset());
         if (!V8_ENABLE_LEAPTIERING_BOOL || IsOSR(osr_offset)) {
           OptimizedCodeCache::Insert(
@@ -4459,10 +4479,10 @@ void Compiler::FinalizeTurbofanCompilationJob(TurbofanCompilationJob* job,
                                   job->prepare_in_ms(), job->execute_in_ms(),
                                   job->finalize_in_ms());
   if (V8_LIKELY(use_result)) {
-    function->SetTieringInProgress(false,
+    function->SetTieringInProgress(isolate, false,
                                    job->compilation_info()->osr_offset());
     if (!IsOSR(osr_offset)) {
-      function->UpdateCode(shared->GetCode(isolate));
+      function->UpdateCode(isolate, shared->GetCode(isolate));
     }
   }
 }
@@ -4472,7 +4492,7 @@ void Compiler::DisposeMaglevCompilationJob(maglev::MaglevCompilationJob* job,
                                            Isolate* isolate) {
 #ifdef V8_ENABLE_MAGLEV
   DirectHandle<JSFunction> function = job->function();
-  function->SetTieringInProgress(false, job->osr_offset());
+  function->SetTieringInProgress(isolate, false, job->osr_offset());
 #endif  // V8_ENABLE_MAGLEV
 }
 
@@ -4486,7 +4506,7 @@ void Compiler::FinalizeMaglevCompilationJob(maglev::MaglevCompilationJob* job,
   BytecodeOffset osr_offset = job->osr_offset();
 
   if (function->ActiveTierIsTurbofan(isolate) && !job->is_osr()) {
-    function->SetTieringInProgress(false, osr_offset);
+    function->SetTieringInProgress(isolate, false, osr_offset);
     CompilerTracer::TraceAbortedMaglevCompile(
         isolate, function, BailoutReason::kHigherTierAvailable);
     return;
@@ -4537,7 +4557,7 @@ void Compiler::FinalizeMaglevCompilationJob(maglev::MaglevCompilationJob* job,
     CompilerTracer::TraceAbortedMaglevCompile(isolate, function,
                                               job->bailout_reason_);
   }
-  function->SetTieringInProgress(false, osr_offset);
+  function->SetTieringInProgress(isolate, false, osr_offset);
 #endif
 }
 
@@ -4552,7 +4572,8 @@ void Compiler::PostInstantiation(Isolate* isolate,
   if (is_compiled_scope->is_compiled() && shared->HasBytecodeArray()) {
     // Don't reset budget if there is a closure feedback cell array already. We
     // are just creating a new closure that shares the same feedback cell.
-    JSFunction::InitializeFeedbackCell(function, is_compiled_scope, false);
+    JSFunction::InitializeFeedbackCell(isolate, function, is_compiled_scope,
+                                       false);
 
 #ifndef V8_ENABLE_LEAPTIERING
     if (function->has_feedback_vector()) {
diff --git a/deps/v8/src/codegen/compiler.h b/deps/v8/src/codegen/compiler.h
index 7b3bf62f4e90c1..358416cb0505ab 100644
--- a/deps/v8/src/codegen/compiler.h
+++ b/deps/v8/src/codegen/compiler.h
@@ -164,7 +164,7 @@ class V8_EXPORT_PRIVATE Compiler : public AllStatic {
 
   // Create a (bound) function for a String source within a context for eval.
   V8_WARN_UNUSED_RESULT static MaybeDirectHandle<JSFunction>
-  GetFunctionFromEval(DirectHandle<String> source,
+  GetFunctionFromEval(Isolate* isolate, DirectHandle<String> source,
                       DirectHandle<SharedFunctionInfo> outer_info,
                       DirectHandle<Context> context, LanguageMode language_mode,
                       ParseRestriction restriction, int parameters_end_pos,
@@ -175,14 +175,14 @@ class V8_EXPORT_PRIVATE Compiler : public AllStatic {
   // Create a function that results from wrapping |source| in a function,
   // with |arguments| being a list of parameters for that function.
   V8_WARN_UNUSED_RESULT static MaybeDirectHandle<JSFunction> GetWrappedFunction(
-      Handle<String> source, DirectHandle<Context> context,
+      Isolate* isolate, Handle<String> source, DirectHandle<Context> context,
       const ScriptDetails& script_details, AlignedCachedData* cached_data,
       v8::ScriptCompiler::CompileOptions compile_options,
       v8::ScriptCompiler::NoCacheReason no_cache_reason);
 
   // Create a (bound) function for a String source within a context for eval.
   V8_WARN_UNUSED_RESULT static MaybeDirectHandle<JSFunction>
-  GetFunctionFromString(DirectHandle<NativeContext> context,
+  GetFunctionFromString(Isolate* isolate, DirectHandle<NativeContext> context,
                         Handle<i::Object> source, int parameters_end_pos,
                         bool is_code_like);
 
@@ -194,7 +194,8 @@ class V8_EXPORT_PRIVATE Compiler : public AllStatic {
                                    Handle<i::Object> source_object,
                                    bool is_code_like = false);
   V8_WARN_UNUSED_RESULT static MaybeDirectHandle<JSFunction>
-  GetFunctionFromValidatedString(DirectHandle<NativeContext> context,
+  GetFunctionFromValidatedString(Isolate* isolate,
+                                 DirectHandle<NativeContext> context,
                                  MaybeDirectHandle<String> source,
                                  ParseRestriction restriction,
                                  int parameters_end_pos);
@@ -263,6 +264,7 @@ class V8_EXPORT_PRIVATE Compiler : public AllStatic {
   GetSharedFunctionInfoForStreamedScript(
       Isolate* isolate, Handle<String> source,
       const ScriptDetails& script_details, ScriptStreamingData* streaming_data,
+      IsCompiledScope* is_compiled_scope,
       ScriptCompiler::CompilationDetails* compilation_details);
 
   // Create a shared function info object for the given function literal
@@ -491,6 +493,8 @@ class TurbofanCompilationJob : public OptimizedCompilationJob {
 
   Isolate* isolate() const { return isolate_; }
 
+  void Cancel();
+
  private:
   Isolate* const isolate_;
   OptimizedCompilationInfo* const compilation_info_;
diff --git a/deps/v8/src/codegen/cpu-features.h b/deps/v8/src/codegen/cpu-features.h
index 7b94c6eb2265f3..cc293030bea5f4 100644
--- a/deps/v8/src/codegen/cpu-features.h
+++ b/deps/v8/src/codegen/cpu-features.h
@@ -55,6 +55,11 @@ enum CpuFeature {
   PMULL1Q,
   // Half-precision NEON ops support.
   FP16,
+  SHA3,
+  // Hinted Conditional Branches
+  HBC,
+  // Common short sequence compression instructions
+  CSSC,
 
 #elif V8_TARGET_ARCH_MIPS64
   FPU,
diff --git a/deps/v8/src/codegen/define-code-stub-assembler-macros.inc b/deps/v8/src/codegen/define-code-stub-assembler-macros.inc
index fb272f6afdea72..0adff3c6601edd 100644
--- a/deps/v8/src/codegen/define-code-stub-assembler-macros.inc
+++ b/deps/v8/src/codegen/define-code-stub-assembler-macros.inc
@@ -12,16 +12,18 @@
 #define V8_CODEGEN_CODE_STUB_ASSEMBLER_MACROS_DEFINED 1
 
 #ifdef DEBUG
-#define CSA_CHECK(csa, x) \
-  (csa)->Check([&]() -> TNode<BoolT> { return x; }, #x, __FILE__, __LINE__)
+#define CSA_CHECK(csa, x) (csa)->Check([&]() -> TNode<BoolT> { return x; }, #x)
+#define CSA_CHECK_AT(csa, loc, x) \
+  (csa)->Check([&]() -> TNode<BoolT> { return x; }, #x, {}, loc)
 #else
 #define CSA_CHECK(csa, x) (csa)->FastCheck(x)
+#define CSA_CHECK_AT(csa, loc, x) (csa)->FastCheck(x)
 #endif
 
 // This is a check that always calls into the runtime if it aborts.
 // This also exits silently when --hole-fuzzing is enabled.
 #define CSA_HOLE_SECURITY_CHECK(csa, x) \
-  (csa)->Check([&]() -> TNode<BoolT> { return x; }, #x, __FILE__, __LINE__)
+  (csa)->Check([&]() -> TNode<BoolT> { return x; }, #x)
 
 #ifdef DEBUG
 // CSA_DCHECK_ARGS generates an
@@ -38,9 +40,11 @@
 
 // CSA_DCHECK(csa, <condition>, <extra values to print...>)
 
-#define CSA_DCHECK(csa, condition_node, ...)                         \
-  (csa)->Dcheck(condition_node, #condition_node, __FILE__, __LINE__, \
-                CSA_DCHECK_ARGS(__VA_ARGS__))
+#define CSA_DCHECK(csa, condition_node, ...) \
+  (csa)->Dcheck(condition_node, #condition_node, CSA_DCHECK_ARGS(__VA_ARGS__))
+
+#define CSA_DCHECK_AT(csa, loc, condition_node, ...) \
+  (csa)->Dcheck(condition_node, #condition_node, CSA_DCHECK_ARGS(__VA_ARGS__), loc)
 
 #define CSA_DCHECK_JS_ARGC_EQ(csa, expected)                            \
   (csa)->Dcheck(                                                        \
@@ -50,7 +54,7 @@
         return (csa)->Word32Equal(                                      \
             argc, (csa)->Int32Constant(i::JSParameterCount(expected))); \
       },                                                                \
-      "argc == " #expected, __FILE__, __LINE__,                         \
+      "argc == " #expected,                                             \
       {{SmiFromInt32((csa)->UncheckedParameter<Int32T>(                 \
             Descriptor::kJSActualArgumentsCount)),                      \
         "argc"}})
@@ -64,6 +68,7 @@
   name(CSA_DEBUG_INFO(name), __VA_ARGS__)
 #else  // DEBUG
 #define CSA_DCHECK(csa, ...) ((void)0)
+#define CSA_DCHECK_AT(csa, ...) ((void)0)
 #define CSA_DCHECK_JS_ARGC_EQ(csa, expected) ((void)0)
 #define BIND(label) Bind(label)
 #define TYPED_VARIABLE_DEF(type, name, ...) TVariable<UNPAREN(type)> name(__VA_ARGS__)
diff --git a/deps/v8/src/codegen/external-reference.cc b/deps/v8/src/codegen/external-reference.cc
index fc16f7bc8d5a5d..623b9e5fe9cf3f 100644
--- a/deps/v8/src/codegen/external-reference.cc
+++ b/deps/v8/src/codegen/external-reference.cc
@@ -897,10 +897,6 @@ ExternalReference ExternalReference::address_of_cet_compatible_flag() {
 }
 #endif  // V8_ENABLE_CET_SHADOW_STACK
 
-ExternalReference ExternalReference::script_context_mutable_heap_number_flag() {
-  return ExternalReference(&v8_flags.script_context_mutable_heap_number);
-}
-
 ExternalReference ExternalReference::additive_safe_int_feedback_flag() {
 #ifdef V8_TARGET_ARCH_64_BIT
   return ExternalReference(&v8_flags.additive_safe_int_feedback);
@@ -909,12 +905,8 @@ ExternalReference ExternalReference::additive_safe_int_feedback_flag() {
 #endif  // V8_TARGET_ARCH_64_BIT
 }
 
-ExternalReference ExternalReference::script_context_mutable_heap_int32_flag() {
-#ifdef SUPPORT_SCRIPT_CONTEXT_MUTABLE_HEAP_INT32
-  return ExternalReference(&v8_flags.script_context_mutable_heap_int32);
-#else
-  return ExternalReference();
-#endif  // SUPPORT_SCRIPT_CONTEXT_MUTABLE_HEAP_INT32
+ExternalReference ExternalReference::address_of_script_context_cells_flag() {
+  return ExternalReference(&v8_flags.script_context_cells);
 }
 
 ExternalReference ExternalReference::address_of_load_from_stack_count(
@@ -1421,9 +1413,9 @@ FUNCTION_REFERENCE(compute_integer_hash, ComputeSeededIntegerHash)
 
 enum LookupMode { kFindExisting, kFindInsertionEntry };
 template <typename Dictionary, LookupMode mode>
-static size_t NameDictionaryLookupForwardedString(Isolate* isolate,
-                                                  Address raw_dict,
-                                                  Address raw_key) {
+static size_t NameDictionaryLookupForwardedStringWithHandle(Isolate* isolate,
+                                                            Address raw_dict,
+                                                            Address raw_key) {
   // This function cannot allocate, but there is a HandleScope because it needs
   // to pass Handle<Name> to the dictionary methods.
   DisallowGarbageCollection no_gc;
@@ -1442,18 +1434,36 @@ static size_t NameDictionaryLookupForwardedString(Isolate* isolate,
   return entry.raw_value();
 }
 
-FUNCTION_REFERENCE(
-    name_dictionary_lookup_forwarded_string,
-    (NameDictionaryLookupForwardedString<NameDictionary, kFindExisting>))
-FUNCTION_REFERENCE(
-    name_dictionary_find_insertion_entry_forwarded_string,
-    (NameDictionaryLookupForwardedString<NameDictionary, kFindInsertionEntry>))
-FUNCTION_REFERENCE(
-    global_dictionary_lookup_forwarded_string,
-    (NameDictionaryLookupForwardedString<GlobalDictionary, kFindExisting>))
+FUNCTION_REFERENCE(name_dictionary_lookup_forwarded_string,
+                   (NameDictionaryLookupForwardedStringWithHandle<
+                       NameDictionary, kFindExisting>))
+FUNCTION_REFERENCE(name_dictionary_find_insertion_entry_forwarded_string,
+                   (NameDictionaryLookupForwardedStringWithHandle<
+                       NameDictionary, kFindInsertionEntry>))
+FUNCTION_REFERENCE(global_dictionary_lookup_forwarded_string,
+                   (NameDictionaryLookupForwardedStringWithHandle<
+                       GlobalDictionary, kFindExisting>))
 FUNCTION_REFERENCE(global_dictionary_find_insertion_entry_forwarded_string,
-                   (NameDictionaryLookupForwardedString<GlobalDictionary,
-                                                        kFindInsertionEntry>))
+                   (NameDictionaryLookupForwardedStringWithHandle<
+                       GlobalDictionary, kFindInsertionEntry>))
+
+template <typename Dictionary, LookupMode mode>
+static size_t NameDictionaryLookupForwardedString(Isolate* isolate,
+                                                  Address raw_dict,
+                                                  Address raw_key) {
+  Tagged<String> key = Cast<String>(Tagged<Object>(raw_key));
+  // This function should only be used as the slow path for forwarded strings.
+  DCHECK(Name::IsForwardingIndex(key->raw_hash_field()));
+
+  Tagged<Dictionary> dict = Cast<Dictionary>(Tagged<Object>(raw_dict));
+  ReadOnlyRoots roots(isolate);
+  uint32_t hash = key->hash();
+  InternalIndex entry = mode == kFindExisting
+                            ? dict->FindEntry(isolate, roots, key, hash)
+                            : dict->FindInsertionEntry(isolate, roots, hash);
+  return entry.raw_value();
+}
+
 FUNCTION_REFERENCE(
     name_to_index_hashtable_lookup_forwarded_string,
     (NameDictionaryLookupForwardedString<NameToIndexHashTable, kFindExisting>))
diff --git a/deps/v8/src/codegen/external-reference.h b/deps/v8/src/codegen/external-reference.h
index 702dcf5618bc95..e4ef9573bcb00e 100644
--- a/deps/v8/src/codegen/external-reference.h
+++ b/deps/v8/src/codegen/external-reference.h
@@ -116,6 +116,7 @@ enum class IsolateFieldId : uint8_t;
     "v8_flags.mock_arraybuffer_allocator")                                     \
   V(address_of_one_half, "LDoubleConstant::one_half")                          \
   V(address_of_runtime_stats_flag, "TracingFlags::runtime_stats")              \
+  V(address_of_script_context_cells_flag, "v8_flags.script_context_cells")     \
   V(address_of_shared_string_table_flag, "v8_flags.shared_string_table")       \
   V(address_of_the_hole_nan, "the_hole_nan")                                   \
   V(address_of_uint32_bias, "uint32_bias")                                     \
@@ -232,10 +233,6 @@ enum class IsolateFieldId : uint8_t;
   V(search_string_raw_two_two, "search_string_raw_two_two")                    \
   V(string_write_to_flat_one_byte, "string_write_to_flat_one_byte")            \
   V(string_write_to_flat_two_byte, "string_write_to_flat_two_byte")            \
-  V(script_context_mutable_heap_number_flag,                                   \
-    "v8_flags.script_context_mutable_heap_number")                             \
-  V(script_context_mutable_heap_int32_flag,                                    \
-    "v8_flags.script_context_mutable_heap_int32")                              \
   V(additive_safe_int_feedback_flag, "v8_flags.additive_safe_int_feedback")    \
   V(external_one_byte_string_get_chars, "external_one_byte_string_get_chars")  \
   V(external_two_byte_string_get_chars, "external_two_byte_string_get_chars")  \
diff --git a/deps/v8/src/codegen/heap-object-list.h b/deps/v8/src/codegen/heap-object-list.h
index 4e4a29d1e24d19..449874335e1527 100644
--- a/deps/v8/src/codegen/heap-object-list.h
+++ b/deps/v8/src/codegen/heap-object-list.h
@@ -74,6 +74,7 @@
     EmptySwissPropertyDictionary)                                            \
   V(EmptySlowElementDictionary, empty_slow_element_dictionary,               \
     EmptySlowElementDictionary)                                              \
+  V(EmptyWeakArrayList, empty_weak_array_list, EmptyWeakArrayList)           \
   V(empty_string, empty_string, EmptyString)                                 \
   V(error_to_string, error_to_string, ErrorToString)                         \
   V(error_string, error_string, ErrorString)                                 \
@@ -135,8 +136,6 @@
   V(resolve_string, resolve_string, ResolveString)                           \
   V(return_string, return_string, ReturnString)                              \
   V(search_symbol, search_symbol, SearchSymbol)                              \
-  V(SingleCharacterStringTable, single_character_string_table,               \
-    SingleCharacterStringTable)                                              \
   V(size_string, size_string, SizeString)                                    \
   V(species_symbol, species_symbol, SpeciesSymbol)                           \
   V(StaleRegister, stale_register, StaleRegister)                            \
diff --git a/deps/v8/src/codegen/interface-descriptors.h b/deps/v8/src/codegen/interface-descriptors.h
index b8d8a7d89b1c8a..ea1f8a9a8923c1 100644
--- a/deps/v8/src/codegen/interface-descriptors.h
+++ b/deps/v8/src/codegen/interface-descriptors.h
@@ -23,6 +23,8 @@ namespace internal {
 
 #define INTERFACE_DESCRIPTOR_LIST(V)                 \
   V(Abort)                                           \
+  V(AddLhsIsStringConstantInternalizeWithVector)     \
+  V(AddLhsIsStringConstantInternalizeTrampoline)     \
   V(Allocate)                                        \
   V(CallApiCallbackGeneric)                          \
   V(CallApiCallbackOptimized)                        \
@@ -1020,6 +1022,31 @@ class LoadGlobalBaselineDescriptor
   static constexpr auto registers();
 };
 
+class AddLhsIsStringConstantInternalizeWithVectorDescriptor
+    : public StaticCallInterfaceDescriptor<
+          AddLhsIsStringConstantInternalizeWithVectorDescriptor> {
+ public:
+  INTERNAL_DESCRIPTOR()
+  DEFINE_PARAMETERS(kLeft, kRight, kSlot, kVector)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kLeft
+                         MachineType::AnyTagged(),  // kRight
+                         MachineType::AnyTagged(),  // kSlot
+                         MachineType::AnyTagged())  // kVector
+  DECLARE_DESCRIPTOR(AddLhsIsStringConstantInternalizeWithVectorDescriptor)
+};
+
+class AddLhsIsStringConstantInternalizeTrampolineDescriptor
+    : public StaticCallInterfaceDescriptor<
+          AddLhsIsStringConstantInternalizeTrampolineDescriptor> {
+ public:
+  INTERNAL_DESCRIPTOR()
+  DEFINE_PARAMETERS(kLeft, kRight, kSlot)
+  DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kLeft
+                         MachineType::AnyTagged(),  // kRight
+                         MachineType::AnyTagged())  // kSlot
+  DECLARE_DESCRIPTOR(AddLhsIsStringConstantInternalizeTrampolineDescriptor)
+};
+
 class LookupWithVectorDescriptor
     : public StaticCallInterfaceDescriptor<LookupWithVectorDescriptor> {
  public:
diff --git a/deps/v8/src/codegen/jump-table-info.cc b/deps/v8/src/codegen/jump-table-info.cc
new file mode 100644
index 00000000000000..26befdf658445c
--- /dev/null
+++ b/deps/v8/src/codegen/jump-table-info.cc
@@ -0,0 +1,58 @@
+// Copyright 2023 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/codegen/jump-table-info.h"
+
+#include "src/base/memory.h"
+#include "src/codegen/assembler-inl.h"
+#include "src/common/globals.h"
+
+namespace v8 {
+namespace internal {
+
+void JumpTableInfoWriter::Add(uint32_t pc_offset, int32_t target) {
+  entries_.emplace_back(pc_offset, target);
+}
+
+size_t JumpTableInfoWriter::entry_count() const { return entries_.size(); }
+
+uint32_t JumpTableInfoWriter::size_in_bytes() const {
+  return static_cast<uint32_t>(entry_count() * JumpTableInfoEntry::kSize);
+}
+
+void JumpTableInfoWriter::Emit(Assembler* assm) {
+  for (auto i = entries_.begin(); i != entries_.end(); ++i) {
+    static_assert(JumpTableInfoEntry::kPCOffsetSize == kUInt32Size);
+    assm->dd(i->pc_offset);
+    static_assert(JumpTableInfoEntry::kTargetSize == kInt32Size);
+    assm->dd(i->target);
+    static_assert(JumpTableInfoEntry::kSize ==
+                  JumpTableInfoEntry::kPCOffsetSize +
+                      JumpTableInfoEntry::kTargetSize);
+  }
+}
+
+JumpTableInfoIterator::JumpTableInfoIterator(Address start, uint32_t size)
+    : start_(start), size_(size), cursor_(start_) {
+  DCHECK_NE(kNullAddress, start);
+}
+
+uint32_t JumpTableInfoIterator::GetPCOffset() const {
+  return base::ReadUnalignedValue<uint32_t>(
+      cursor_ + offsetof(JumpTableInfoEntry, pc_offset));
+}
+
+int32_t JumpTableInfoIterator::GetTarget() const {
+  return base::ReadUnalignedValue<int32_t>(
+      cursor_ + offsetof(JumpTableInfoEntry, target));
+}
+
+void JumpTableInfoIterator::Next() { cursor_ += JumpTableInfoEntry::kSize; }
+
+bool JumpTableInfoIterator::HasCurrent() const {
+  return cursor_ < start_ + size_;
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/src/codegen/x64/builtin-jump-table-info-x64.h b/deps/v8/src/codegen/jump-table-info.h
similarity index 62%
rename from deps/v8/src/codegen/x64/builtin-jump-table-info-x64.h
rename to deps/v8/src/codegen/jump-table-info.h
index 11b9ac2f0cb7b7..2062b807f170a9 100644
--- a/deps/v8/src/codegen/x64/builtin-jump-table-info-x64.h
+++ b/deps/v8/src/codegen/jump-table-info.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef V8_CODEGEN_X64_BUILTIN_JUMP_TABLE_INFO_X64_H_
-#define V8_CODEGEN_X64_BUILTIN_JUMP_TABLE_INFO_X64_H_
+#ifndef V8_CODEGEN_JUMP_TABLE_INFO_H_
+#define V8_CODEGEN_JUMP_TABLE_INFO_H_
 
 #include <vector>
 
@@ -16,17 +16,17 @@ namespace internal {
 
 class Assembler;
 
-// The builtin jump table info is a part of code metadata, used by the
-// disassembler. The layout is:
+// The jump table info is a part of code metadata, used by the disassembler. The
+// layout is:
 //
 // byte count       content
 // ----------------------------------------------------------------
-// [Inline array of BuiltinJumpTableInfoEntry in increasing pc_offset order]
+// [Inline array of JumpTableInfoEntry in increasing pc_offset order]
 // ┌ 4              pc_offset of entry as uint32_t
 // └ 4              target of entry as int32_t
 
-struct BuiltinJumpTableInfoEntry {
-  constexpr BuiltinJumpTableInfoEntry(uint32_t pc_offset, int32_t target)
+struct JumpTableInfoEntry {
+  constexpr JumpTableInfoEntry(uint32_t pc_offset, int32_t target)
       : pc_offset(pc_offset), target(target) {}
   uint32_t pc_offset;
   int32_t target;
@@ -35,11 +35,10 @@ struct BuiltinJumpTableInfoEntry {
   static constexpr int kTargetSize = kInt32Size;
   static constexpr int kSize = kPCOffsetSize + kTargetSize;
 };
-static_assert(sizeof(BuiltinJumpTableInfoEntry) ==
-              BuiltinJumpTableInfoEntry::kSize);
+static_assert(sizeof(JumpTableInfoEntry) == JumpTableInfoEntry::kSize);
 
 // Used during codegen.
-class BuiltinJumpTableInfoWriter {
+class JumpTableInfoWriter {
  public:
   V8_EXPORT_PRIVATE void Add(uint32_t pc_offset, int32_t target);
   void Emit(Assembler* assm);
@@ -48,13 +47,13 @@ class BuiltinJumpTableInfoWriter {
   uint32_t size_in_bytes() const;
 
  private:
-  std::vector<BuiltinJumpTableInfoEntry> entries_;
+  std::vector<JumpTableInfoEntry> entries_;
 };
 
 // Used during disassembly.
-class V8_EXPORT_PRIVATE BuiltinJumpTableInfoIterator {
+class V8_EXPORT_PRIVATE JumpTableInfoIterator {
  public:
-  BuiltinJumpTableInfoIterator(Address start, uint32_t size);
+  JumpTableInfoIterator(Address start, uint32_t size);
   uint32_t GetPCOffset() const;
   int32_t GetTarget() const;
   void Next();
@@ -69,4 +68,4 @@ class V8_EXPORT_PRIVATE BuiltinJumpTableInfoIterator {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_CODEGEN_X64_BUILTIN_JUMP_TABLE_INFO_X64_H_
+#endif  // V8_CODEGEN_JUMP_TABLE_INFO_H_
diff --git a/deps/v8/src/codegen/loong64/assembler-loong64-inl.h b/deps/v8/src/codegen/loong64/assembler-loong64-inl.h
index 3666ccff02b6fc..09646f1195a823 100644
--- a/deps/v8/src/codegen/loong64/assembler-loong64-inl.h
+++ b/deps/v8/src/codegen/loong64/assembler-loong64-inl.h
@@ -115,8 +115,7 @@ Tagged<HeapObject> RelocInfo::target_object(PtrComprCageBase cage_base) {
     Tagged_t compressed =
         Assembler::target_compressed_address_at(pc_, constant_pool_);
     DCHECK(!HAS_SMI_TAG(compressed));
-    Tagged<Object> obj(
-        V8HeapCompressionScheme::DecompressTagged(cage_base, compressed));
+    Tagged<Object> obj(V8HeapCompressionScheme::DecompressTagged(compressed));
     return Cast<HeapObject>(obj);
   } else {
     return Cast<HeapObject>(
diff --git a/deps/v8/src/codegen/optimized-compilation-info.cc b/deps/v8/src/codegen/optimized-compilation-info.cc
index 3491bf2dd57012..418506d50ffa06 100644
--- a/deps/v8/src/codegen/optimized-compilation-info.cc
+++ b/deps/v8/src/codegen/optimized-compilation-info.cc
@@ -246,6 +246,10 @@ void OptimizedCompilationInfo::SetTracingFlags(bool passes_filter) {
   if (v8_flags.turboshaft_trace_reduction) set_turboshaft_trace_reduction();
 }
 
+void OptimizedCompilationInfo::mark_cancelled() {
+  was_cancelled_.store(true, std::memory_order_relaxed);
+}
+
 OptimizedCompilationInfo::InlinedFunctionHolder::InlinedFunctionHolder(
     IndirectHandle<SharedFunctionInfo> inlined_shared_info,
     IndirectHandle<BytecodeArray> inlined_bytecode, SourcePosition pos)
diff --git a/deps/v8/src/codegen/optimized-compilation-info.h b/deps/v8/src/codegen/optimized-compilation-info.h
index 6cd64196574c39..098147ed5e3ef1 100644
--- a/deps/v8/src/codegen/optimized-compilation-info.h
+++ b/deps/v8/src/codegen/optimized-compilation-info.h
@@ -255,6 +255,12 @@ class V8_EXPORT_PRIVATE OptimizedCompilationInfo final {
 
   TickCounter& tick_counter() { return tick_counter_; }
 
+  bool was_cancelled() const {
+    return was_cancelled_.load(std::memory_order_relaxed);
+  }
+
+  void mark_cancelled();
+
   BasicBlockProfilerData* profiler_data() const { return profiler_data_; }
   void set_profiler_data(BasicBlockProfilerData* profiler_data) {
     profiler_data_ = profiler_data;
@@ -329,6 +335,8 @@ class V8_EXPORT_PRIVATE OptimizedCompilationInfo final {
 
   TickCounter tick_counter_;
 
+  std::atomic<bool> was_cancelled_ = false;
+
   // 1) PersistentHandles created via PersistentHandlesScope inside of
   //    CompilationHandleScope
   // 2) Owned by OptimizedCompilationInfo
diff --git a/deps/v8/src/codegen/ppc/assembler-ppc-inl.h b/deps/v8/src/codegen/ppc/assembler-ppc-inl.h
index 53854721be2992..52f2f78e09b87e 100644
--- a/deps/v8/src/codegen/ppc/assembler-ppc-inl.h
+++ b/deps/v8/src/codegen/ppc/assembler-ppc-inl.h
@@ -155,8 +155,7 @@ Tagged<HeapObject> RelocInfo::target_object(PtrComprCageBase cage_base) {
     Tagged_t compressed =
         Assembler::target_compressed_address_at(pc_, constant_pool_);
     DCHECK(!HAS_SMI_TAG(compressed));
-    Tagged<Object> obj(
-        V8HeapCompressionScheme::DecompressTagged(cage_base, compressed));
+    Tagged<Object> obj(V8HeapCompressionScheme::DecompressTagged(compressed));
     return Cast<HeapObject>(obj);
   } else {
     return Cast<HeapObject>(
diff --git a/deps/v8/src/codegen/ppc/macro-assembler-ppc.cc b/deps/v8/src/codegen/ppc/macro-assembler-ppc.cc
index 29e9fdfb5d488d..df738c6dfd3e7d 100644
--- a/deps/v8/src/codegen/ppc/macro-assembler-ppc.cc
+++ b/deps/v8/src/codegen/ppc/macro-assembler-ppc.cc
@@ -157,7 +157,7 @@ void MacroAssembler::LoadRootRelative(Register destination, int32_t offset) {
 }
 
 void MacroAssembler::StoreRootRelative(int32_t offset, Register value) {
-  StoreU64(value, MemOperand(kRootRegister, offset));
+  StoreU64(value, MemOperand(kRootRegister, offset), r0);
 }
 
 void MacroAssembler::LoadRootRegisterOffset(Register destination,
diff --git a/deps/v8/src/codegen/riscv/assembler-riscv-inl.h b/deps/v8/src/codegen/riscv/assembler-riscv-inl.h
index d5e11e562b334c..ee605d536722ce 100644
--- a/deps/v8/src/codegen/riscv/assembler-riscv-inl.h
+++ b/deps/v8/src/codegen/riscv/assembler-riscv-inl.h
@@ -64,10 +64,10 @@ void Assembler::CheckBuffer() {
 void WritableRelocInfo::apply(intptr_t delta) {
   if (IsInternalReference(rmode_) || IsInternalReferenceEncoded(rmode_)) {
     // Absolute code pointer inside code object moves with the code object.
-    Assembler::RelocateInternalReference(rmode_, pc_, delta);
+    Assembler::RelocateInternalReference(rmode_, pc_, delta, &jit_allocation_);
   } else {
     DCHECK(IsRelativeCodeTarget(rmode_) || IsNearBuiltinEntry(rmode_));
-    Assembler::RelocateRelativeReference(rmode_, pc_, delta);
+    Assembler::RelocateRelativeReference(rmode_, pc_, delta, &jit_allocation_);
   }
 }
 
@@ -115,8 +115,9 @@ void Assembler::set_target_compressed_address_at(
     Address pc, Address constant_pool, Tagged_t target,
     WritableJitAllocation* jit_allocation, ICacheFlushMode icache_flush_mode) {
   if (COMPRESS_POINTERS_BOOL) {
-    Assembler::set_uint32_constant_at(pc, constant_pool, target, jit_allocation,
-                                      icache_flush_mode);
+    Assembler::set_uint32_constant_at(pc, constant_pool,
+                                      static_cast<uint32_t>(target),
+                                      jit_allocation, icache_flush_mode);
   } else {
     UNREACHABLE();
   }
@@ -241,7 +242,6 @@ Tagged<HeapObject> RelocInfo::target_object(PtrComprCageBase cage_base) {
   if (IsCompressedEmbeddedObject(rmode_)) {
     return Cast<HeapObject>(
         Tagged<Object>(V8HeapCompressionScheme::DecompressTagged(
-            cage_base,
             Assembler::target_compressed_address_at(pc_, constant_pool_))));
   } else {
     return Cast<HeapObject>(
diff --git a/deps/v8/src/codegen/riscv/assembler-riscv.cc b/deps/v8/src/codegen/riscv/assembler-riscv.cc
index a9093ed33122c1..21a651c7c03cc1 100644
--- a/deps/v8/src/codegen/riscv/assembler-riscv.cc
+++ b/deps/v8/src/codegen/riscv/assembler-riscv.cc
@@ -1344,14 +1344,21 @@ void Assembler::AdjustBaseAndOffset(MemOperand* src, Register scratch,
   src->rm_ = scratch;
 }
 
-int Assembler::RelocateInternalReference(RelocInfo::Mode rmode, Address pc,
-                                         intptr_t pc_delta) {
+int Assembler::RelocateInternalReference(
+    RelocInfo::Mode rmode, Address pc, intptr_t pc_delta,
+    WritableJitAllocation* jit_allocation) {
   if (RelocInfo::IsInternalReference(rmode)) {
-    intptr_t* p = reinterpret_cast<intptr_t*>(pc);
-    if (*p == kEndOfJumpChain) {
+    intptr_t internal_ref = ReadUnalignedValue<intptr_t>(pc);
+    if (internal_ref == kEndOfJumpChain) {
       return 0;  // Number of instructions patched.
     }
-    *p += pc_delta;
+    internal_ref += pc_delta;
+    if (jit_allocation) {
+      jit_allocation->WriteUnalignedValue(pc, internal_ref);
+    } else {
+      WriteUnalignedValue<intptr_t>(pc, internal_ref);
+    }
+
     return 2;  // Number of instructions patched.
   }
   Instr instr = instr_at(pc);
@@ -1359,7 +1366,7 @@ int Assembler::RelocateInternalReference(RelocInfo::Mode rmode, Address pc,
   if (IsLui(instr)) {
     uintptr_t target_address = target_constant_address_at(pc) + pc_delta;
     DEBUG_PRINTF("\ttarget_address 0x%" PRIxPTR "\n", target_address);
-    set_target_value_at(pc, target_address);
+    set_target_value_at(pc, target_address, jit_allocation);
 #if V8_TARGET_ARCH_RISCV64
 #ifdef RISCV_USE_SV39
     return 6;  // Number of instructions patched.
@@ -1374,8 +1381,9 @@ int Assembler::RelocateInternalReference(RelocInfo::Mode rmode, Address pc,
   }
 }
 
-void Assembler::RelocateRelativeReference(RelocInfo::Mode rmode, Address pc,
-                                          intptr_t pc_delta) {
+void Assembler::RelocateRelativeReference(
+    RelocInfo::Mode rmode, Address pc, intptr_t pc_delta,
+    WritableJitAllocation* jit_allocation) {
   Instr instr = instr_at(pc);
   Instr instr1 = instr_at(pc + 1 * kInstrSize);
   DCHECK(RelocInfo::IsRelativeCodeTarget(rmode) ||
@@ -1384,7 +1392,7 @@ void Assembler::RelocateRelativeReference(RelocInfo::Mode rmode, Address pc,
     int32_t imm;
     imm = BrachlongOffset(instr, instr1);
     imm -= pc_delta;
-    PatchBranchlongOffset(pc, instr, instr1, imm);
+    PatchBranchlongOffset(pc, instr, instr1, imm, jit_allocation);
     return;
   } else {
     UNREACHABLE();
@@ -1424,6 +1432,11 @@ void Assembler::GrowBuffer() {
   reloc_info_writer.Reposition(reloc_info_writer.pos() + rc_delta,
                                reloc_info_writer.last_pc() + pc_delta);
 
+  // None of our relocation types are pc relative pointing outside the code
+  // buffer nor pc absolute pointing inside the code buffer, so there is no need
+  // to relocate any emitted relocation entries.
+
+  // Relocate internal references.
   // Relocate runtime entries.
   base::Vector<uint8_t> instructions{buffer_start_,
                                      static_cast<size_t>(pc_offset())};
@@ -1434,8 +1447,6 @@ void Assembler::GrowBuffer() {
       RelocateInternalReference(rmode, it.rinfo()->pc(), pc_delta);
     }
   }
-
-  DCHECK(!overflow());
 }
 
 void Assembler::db(uint8_t data) {
@@ -1460,6 +1471,7 @@ void Assembler::dd(Label* label) {
   uintptr_t data;
   if (!is_buffer_growth_blocked()) CheckBuffer();
   if (label->is_bound()) {
+    internal_reference_positions_.insert(pc_offset());
     data = reinterpret_cast<uintptr_t>(buffer_start_ + label->pos());
   } else {
     data = jump_address(label);
diff --git a/deps/v8/src/codegen/riscv/assembler-riscv.h b/deps/v8/src/codegen/riscv/assembler-riscv.h
index 2577e12a5d8038..dd9db7290036c9 100644
--- a/deps/v8/src/codegen/riscv/assembler-riscv.h
+++ b/deps/v8/src/codegen/riscv/assembler-riscv.h
@@ -523,11 +523,12 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase,
   // Use --trace-deopt to enable.
   void RecordDeoptReason(DeoptimizeReason reason, uint32_t node_id,
                          SourcePosition position, int id);
-
-  static int RelocateInternalReference(RelocInfo::Mode rmode, Address pc,
-                                       intptr_t pc_delta);
-  static void RelocateRelativeReference(RelocInfo::Mode rmode, Address pc,
-                                        intptr_t pc_delta);
+  static int RelocateInternalReference(
+      RelocInfo::Mode rmode, Address pc, intptr_t pc_delta,
+      WritableJitAllocation* jit_allocation = nullptr);
+  static void RelocateRelativeReference(
+      RelocInfo::Mode rmode, Address pc, intptr_t pc_delta,
+      WritableJitAllocation* jit_allocation = nullptr);
 
   // Writes a single byte or word of data in the code stream.  Used for
   // inline tables, e.g., jump-tables.
diff --git a/deps/v8/src/codegen/riscv/macro-assembler-riscv.cc b/deps/v8/src/codegen/riscv/macro-assembler-riscv.cc
index 9ac7746ad14e15..2c2c5ccc850f60 100644
--- a/deps/v8/src/codegen/riscv/macro-assembler-riscv.cc
+++ b/deps/v8/src/codegen/riscv/macro-assembler-riscv.cc
@@ -261,8 +261,13 @@ void MacroAssembler::OptimizeCodeOrTailCallOptimizedCodeSlot(
   LoadTaggedField(optimized_code_entry,
                   FieldMemOperand(feedback_vector,
                                   FeedbackVector::kMaybeOptimizedCodeOffset));
-  TailCallOptimizedCodeSlot(this, optimized_code_entry, temps.Acquire(),
-                            temps.Acquire());
+  {
+    UseScratchRegisterScope temps(this);
+    temps.Include(t0, t1);
+    Register scratch1 = temps.Acquire();
+    Register scratch2 = temps.Acquire();
+    TailCallOptimizedCodeSlot(this, optimized_code_entry, scratch1, scratch2);
+  }
 }
 #endif  // V8_ENABLE_LEAPTIERING
 
@@ -449,7 +454,7 @@ void MacroAssembler::ResolveTrustedPointerHandle(Register destination,
   // Untag the pointer and remove the marking bit in one operation.
   Register tag_reg = handle;
   li(tag_reg, Operand(~(tag | kTrustedPointerTableMarkBit)));
-  and_(destination, destination, tag_reg);
+  And(destination, destination, tag_reg);
 }
 
 void MacroAssembler::ResolveCodePointerHandle(Register destination,
@@ -483,7 +488,7 @@ void MacroAssembler::LoadCodeEntrypointViaCodePointer(Register destination,
   LoadWord(destination, MemOperand(scratch, 0));
   if (tag != 0) {
     li(scratch, Operand(tag));
-    xor_(destination, destination, scratch);
+    Xor(destination, destination, scratch);
   }
 }
 
@@ -511,13 +516,13 @@ void MacroAssembler::LoadCodePointerTableBase(Register destination) {
 
 void MacroAssembler::LoadExternalPointerField(Register destination,
                                               MemOperand field_operand,
-                                              ExternalPointerTag tag,
+                                              ExternalPointerTagRange tag_range,
                                               Register isolate_root) {
   DCHECK(!AreAliased(destination, isolate_root));
   ASM_CODE_COMMENT(this);
 #ifdef V8_ENABLE_SANDBOX
-  DCHECK_NE(tag, kExternalPointerNullTag);
-  DCHECK(!IsSharedExternalPointerType(tag));
+  DCHECK(!tag_range.IsEmpty());
+  DCHECK(!IsSharedExternalPointerType(tag_range));
   UseScratchRegisterScope temps(this);
   Register external_table = temps.Acquire();
   if (isolate_root == no_reg) {
@@ -531,11 +536,28 @@ void MacroAssembler::LoadExternalPointerField(Register destination,
   Lwu(destination, field_operand);
   srli(destination, destination, kExternalPointerIndexShift);
   slli(destination, destination, kExternalPointerTableEntrySizeLog2);
-  AddWord(external_table, external_table, destination);
-  LoadWord(destination, MemOperand(external_table, 0));
-  temps.Include(external_table);
-  external_table = no_reg;
-  And(destination, destination, Operand(~tag));
+  LoaWord(destination, MemOperand(external_table, destination));
+
+  // We don't expect to see empty fields here. If this is ever needed, consider
+  // using an dedicated empty value entry for those tags instead (i.e. an entry
+  // with the right tag and nullptr payload).
+  DCHECK(!ExternalPointerCanBeEmpty(tag_range));
+  // We need another scratch register for the 64-bit tag constant. Instead of
+  // forcing the `And` to allocate a new temp register (which we may not have),
+  // reuse the temp register that we used for the external pointer table base.
+  Register scratch = external_table;
+  Register scratch = external_table;
+  if (tag_range.Size() == 1) {
+    // The common and simple case: we expect exactly one tag.
+    And(scratch, destination, Operand(kExternalPointerTagMask));
+    srli(destination, Operand(destination), kExternalPointerPayloadShift);
+    SbxCheck(eq, AbortReason::kExternalPointerTagMismatch, scratch,
+             Operand(tag_range.first << kExternalPointerTagShift));
+  } else {
+    // Not currently supported. Implement once needed.
+    DCHECK_NE(tag_range, kAnyExternalPointerTagRange);
+    UNREACHABLE();
+  }
 #else
   LoadWord(destination, field_operand);
 #endif  // V8_ENABLE_SANDBOX
@@ -664,7 +686,7 @@ void MacroAssembler::MoveObjectAndSlot(Register dst_object, Register dst_slot,
   // overwrite it.
   if (dst_slot != object) {
     AddWord(dst_slot, object, offset);
-    mv(dst_object, object);
+    Mv(dst_object, object);
     return;
   }
 
@@ -673,7 +695,7 @@ void MacroAssembler::MoveObjectAndSlot(Register dst_object, Register dst_slot,
   // If the destination object register does not overlap with the offset
   // register, we can overwrite it.
   if (offset.IsImmediate() || (offset.rm() != dst_object)) {
-    mv(dst_object, dst_slot);
+    Mv(dst_object, dst_slot);
     AddWord(dst_slot, dst_slot, offset);
     return;
   }
@@ -778,7 +800,7 @@ void MacroAssembler::RecordWrite(Register object, Operand offset,
 void MacroAssembler::DecodeSandboxedPointer(Register value) {
   ASM_CODE_COMMENT(this);
 #ifdef V8_ENABLE_SANDBOX
-  srli(value, value, kSandboxedPointerShift);
+  SrlWord(value, value, kSandboxedPointerShift);
   AddWord(value, value, kPtrComprCageBaseRegister);
 #else
   UNREACHABLE();
@@ -804,7 +826,7 @@ void MacroAssembler::StoreSandboxedPointerField(
   UseScratchRegisterScope temps(this);
   Register scratch = temps.Acquire();
   SubWord(scratch, value, kPtrComprCageBaseRegister);
-  slli(scratch, scratch, kSandboxedPointerShift);
+  SllWord(scratch, scratch, kSandboxedPointerShift);
   StoreWord(scratch, dst_field_operand, std::forward<Trapper>(trapper));
 #else
   UNREACHABLE();
@@ -1002,19 +1024,19 @@ void MacroAssembler::Mulh32(Register rd, Register rs, const Operand& rt) {
     Li(scratch, rt.immediate());
     mul(rd, rs, scratch);
   }
-  srai(rd, rd, 32);
+  SraWord(rd, rd, 32);
 }
 
 void MacroAssembler::Mulhu32(Register rd, Register rs, const Operand& rt,
                              Register rsz, Register rtz) {
-  slli(rsz, rs, 32);
+  SllWord(rsz, rs, 32);
   if (rt.is_reg()) {
-    slli(rtz, rt.rm(), 32);
+    SllWord(rtz, rt.rm(), 32);
   } else {
     Li(rtz, rt.immediate() << 32);
   }
   mulhu(rd, rsz, rtz);
-  srai(rd, rd, 32);
+  SraWord(rd, rd, 32);
 }
 
 void MacroAssembler::Mul64(Register rd, Register rs, const Operand& rt) {
@@ -1410,7 +1432,7 @@ void MacroAssembler::Xor(Register rd, Register rs, const Operand& rt) {
 
 void MacroAssembler::Nor(Register rd, Register rs, const Operand& rt) {
   if (rt.is_reg()) {
-    or_(rd, rs, rt.rm());
+    Or(rd, rs, rt.rm());
     not_(rd, rd);
   } else {
     Or(rd, rs, rt);
@@ -1657,9 +1679,9 @@ void MacroAssembler::Ror(Register rd, Register rs, const Operand& rt) {
   BlockTrampolinePoolScope block_trampoline_pool(this);
   if (rt.is_reg()) {
     negw(scratch, rt.rm());
-    sllw(scratch, rs, scratch);
-    srlw(rd, rs, rt.rm());
-    or_(rd, scratch, rd);
+    Sll32(scratch, rs, scratch);
+    Srl32(rd, rs, rt.rm());
+    Or(rd, scratch, rd);
     sext_w(rd, rd);
   } else {
     int64_t ror_value = rt.immediate() % 32;
@@ -1669,9 +1691,9 @@ void MacroAssembler::Ror(Register rd, Register rs, const Operand& rt) {
     } else if (ror_value < 0) {
       ror_value += 32;
     }
-    srliw(scratch, rs, ror_value);
-    slliw(rd, rs, 32 - ror_value);
-    or_(rd, scratch, rd);
+    Srl32(scratch, rs, Operand(ror_value));
+    Sll32(rd, rs, Operand(32 - ror_value));
+    Or(rd, scratch, rd);
     sext_w(rd, rd);
   }
 }
@@ -1694,9 +1716,9 @@ void MacroAssembler::Dror(Register rd, Register rs, const Operand& rt) {
   BlockTrampolinePoolScope block_trampoline_pool(this);
   if (rt.is_reg()) {
     negw(scratch, rt.rm());
-    sll(scratch, rs, scratch);
-    srl(rd, rs, rt.rm());
-    or_(rd, scratch, rd);
+    Sll64(scratch, rs, scratch);
+    Srl64(rd, rs, rt.rm());
+    Or(rd, scratch, rd);
   } else {
     int64_t dror_value = rt.immediate() % 64;
     if (dror_value == 0) {
@@ -1705,9 +1727,9 @@ void MacroAssembler::Dror(Register rd, Register rs, const Operand& rt) {
     } else if (dror_value < 0) {
       dror_value += 64;
     }
-    srli(scratch, rs, dror_value);
-    slli(rd, rs, 64 - dror_value);
-    or_(rd, scratch, rd);
+    SrlWord(scratch, rs, Operand(dror_value));
+    SllWord(rd, rs, Operand(64 - dror_value));
+    Or(rd, scratch, rd);
   }
 }
 #elif V8_TARGET_ARCH_RISCV32
@@ -1768,9 +1790,9 @@ void MacroAssembler::Ror(Register rd, Register rs, const Operand& rt) {
   BlockTrampolinePoolScope block_trampoline_pool(this);
   if (rt.is_reg()) {
     neg(scratch, rt.rm());
-    sll(scratch, rs, scratch);
-    srl(rd, rs, rt.rm());
-    or_(rd, scratch, rd);
+    SllWord(scratch, rs, scratch);
+    SrlWord(rd, rs, rt.rm());
+    Or(rd, scratch, rd);
   } else {
     int32_t ror_value = rt.immediate() % 32;
     if (ror_value == 0) {
@@ -1779,9 +1801,9 @@ void MacroAssembler::Ror(Register rd, Register rs, const Operand& rt) {
     } else if (ror_value < 0) {
       ror_value += 32;
     }
-    srli(scratch, rs, ror_value);
-    slli(rd, rs, 32 - ror_value);
-    or_(rd, scratch, rd);
+    SrlWord(scratch, rs, ror_value);
+    SllWord(rd, rs, 32 - ror_value);
+    Or(rd, scratch, rd);
   }
 }
 #endif
@@ -1823,7 +1845,7 @@ void MacroAssembler::CalcScaledAddress(Register rd, Register rt, Register rs,
   UseScratchRegisterScope temps(this);
   Register tmp = rd == rt ? temps.Acquire() : rd;
   DCHECK(tmp != rt);
-  slli(tmp, rs, sa);
+  SllWord(tmp, rs, sa);
   AddWord(rd, rt, tmp);
   return;
 }
@@ -1848,17 +1870,17 @@ void MacroAssembler::ReverseBytesHelper(Register rd, Register rs, Register tmp1,
   // }
   // rd[0] = rs[NBYTES-1]; take upper byte
   // rd[NBYTES-1 : 1] = tmp1[NBYTES-1 : 1]; fill other bytes
-  andi(tmp1, rs, ByteMask);
-  slli(tmp1, tmp1, kBitsPerByte);
+  And(tmp1, rs, ByteMask);
+  SllWord(tmp1, tmp1, kBitsPerByte);
   for (int nbyte = 1; nbyte < NBYTES - 1; nbyte++) {
-    srli(tmp2, rs, nbyte * kBitsPerByte);
-    andi(tmp2, tmp2, ByteMask);
-    or_(tmp1, tmp1, tmp2);
-    slli(tmp1, tmp1, kBitsPerByte);
+    SrlWord(tmp2, rs, nbyte * kBitsPerByte);
+    And(tmp2, tmp2, ByteMask);
+    Or(tmp1, tmp1, tmp2);
+    SllWord(tmp1, tmp1, kBitsPerByte);
   }
-  srli(rd, rs, (NBYTES - 1) * kBitsPerByte);
-  andi(rd, rd, ByteMask);
-  or_(rd, tmp1, rd);
+  SrlWord(rd, rs, (NBYTES - 1) * kBitsPerByte);
+  And(rd, rd, ByteMask);
+  Or(rd, tmp1, rd);
 }
 
 #if V8_TARGET_ARCH_RISCV64
@@ -1868,40 +1890,36 @@ void MacroAssembler::ByteSwap(Register rd, Register rs, int operand_size,
   if (CpuFeatures::IsSupported(ZBB)) {
     rev8(rd, rs);
     if (operand_size == 4) {
-      srai(rd, rd, 32);
+      SraWord(rd, rd, 32);
     }
     return;
   }
   UseScratchRegisterScope temps(this);
-  temps.Include(t2, t4);
+  temps.Include(t4, t6);
   Register x0 = temps.Acquire();
   Register x1 = temps.Acquire();
-  DCHECK_NE(scratch, rs);
-  DCHECK_NE(scratch, rd);
-  DCHECK(x0 != x1);
-  DCHECK((rs != x0) && (rs != x1));
-  DCHECK((rd != x0) && (rd != x1));
+  DCHECK(!AreAliased(rs, rd, x0, x1, scratch));
   BlockTrampolinePoolScope block_trampoline_pool(this);
   if (operand_size == 4) {
     DCHECK((rd != t6) && (rs != t6));
     if (scratch == no_reg) {
       ReverseBytesHelper<8>(rd, rs, x0, x1);
-      srai(rd, rd, 32);
+      Sra64(rd, rd, 32);
     } else {
       // Uint32_t x1 = 0x00FF00FF;
       // x0 = (x0 << 16 | x0 >> 16);
       // x0 = (((x0 & x1) << 8)  | ((x0 & (x1 << 8)) >> 8));
       Register x2 = scratch;
       li(x1, 0x00FF00FF);
-      slliw(x0, rs, 16);
-      srliw(rd, rs, 16);
-      or_(x0, rd, x0);   // x0 <- x0 << 16 | x0 >> 16
-      and_(x2, x0, x1);  // x2 <- x0 & 0x00FF00FF
-      slliw(x2, x2, 8);  // x2 <- (x0 & x1) << 8
-      slliw(x1, x1, 8);  // x1 <- 0xFF00FF00
-      and_(rd, x0, x1);  // x0 & 0xFF00FF00
-      srliw(rd, rd, 8);
-      or_(rd, rd, x2);  // (((x0 & x1) << 8)  | ((x0 & (x1 << 8)) >> 8))
+      Sll32(x0, rs, 16);
+      Srl32(rd, rs, 16);
+      Or(x0, rd, x0);    // x0 <- x0 << 16 | x0 >> 16
+      And(x2, x0, x1);   // x2 <- x0 & 0x00FF00FF
+      Sll32(x2, x2, 8);  // x2 <- (x0 & x1) << 8
+      Sll32(x1, x1, 8);  // x1 <- 0xFF00FF00
+      And(rd, x0, x1);   // x0 & 0xFF00FF00
+      Srl32(rd, rd, 8);
+      Or(rd, rd, x2);  // (((x0 & x1) << 8)  | ((x0 & (x1 << 8)) >> 8))
     }
   } else {
     DCHECK((rd != t6) && (rs != t6));
@@ -1915,22 +1933,22 @@ void MacroAssembler::ByteSwap(Register rd, Register rs, int operand_size,
       // x0 = (x0 & x1) << 8  | (x0 & (x1 << 8)) >> 8;
       Register x2 = scratch;
       li(x1, 0x0000FFFF0000FFFFl);
-      slli(x0, rs, 32);
-      srli(rd, rs, 32);
-      or_(x0, rd, x0);   // x0 <- x0 << 32 | x0 >> 32
-      and_(x2, x0, x1);  // x2 <- x0 & 0x0000FFFF0000FFFF
-      slli(x2, x2, 16);  // x2 <- (x0 & 0x0000FFFF0000FFFF) << 16
-      slli(x1, x1, 16);  // x1 <- 0xFFFF0000FFFF0000
-      and_(rd, x0, x1);  // rd <- x0 & 0xFFFF0000FFFF0000
-      srli(rd, rd, 16);  // rd <- x0 & (x1 << 16)) >> 16
-      or_(x0, rd, x2);   // (x0 & x1) << 16 | (x0 & (x1 << 16)) >> 16;
+      SllWord(x0, rs, 32);
+      SrlWord(rd, rs, 32);
+      Or(x0, rd, x0);       // x0 <- x0 << 32 | x0 >> 32
+      And(x2, x0, x1);      // x2 <- x0 & 0x0000FFFF0000FFFF
+      SllWord(x2, x2, 16);  // x2 <- (x0 & 0x0000FFFF0000FFFF) << 16
+      SllWord(x1, x1, 16);  // x1 <- 0xFFFF0000FFFF0000
+      And(rd, x0, x1);      // rd <- x0 & 0xFFFF0000FFFF0000
+      SrlWord(rd, rd, 16);  // rd <- x0 & (x1 << 16)) >> 16
+      Or(x0, rd, x2);       // (x0 & x1) << 16 | (x0 & (x1 << 16)) >> 16;
       li(x1, 0x00FF00FF00FF00FFl);
-      and_(x2, x0, x1);  // x2 <- x0 & 0x00FF00FF00FF00FF
-      slli(x2, x2, 8);   // x2 <- (x0 & x1) << 8
-      slli(x1, x1, 8);   // x1 <- 0xFF00FF00FF00FF00
-      and_(rd, x0, x1);
-      srli(rd, rd, 8);  // rd <- (x0 & (x1 << 8)) >> 8
-      or_(rd, rd, x2);  // (((x0 & x1) << 8)  | ((x0 & (x1 << 8)) >> 8))
+      And(x2, x0, x1);     // x2 <- x0 & 0x00FF00FF00FF00FF
+      SllWord(x2, x2, 8);  // x2 <- (x0 & x1) << 8
+      SllWord(x1, x1, 8);  // x1 <- 0xFF00FF00FF00FF00
+      And(rd, x0, x1);
+      SrlWord(rd, rd, 8);  // rd <- (x0 & (x1 << 8)) >> 8
+      Or(rd, rd, x2);      // (((x0 & x1) << 8)  | ((x0 & (x1 << 8)) >> 8))
     }
   }
 }
@@ -1957,15 +1975,15 @@ void MacroAssembler::ByteSwap(Register rd, Register rs, int operand_size,
     // x0 = (((x0 & x1) << 8)  | ((x0 & (x1 << 8)) >> 8));
     Register x2 = scratch;
     li(x1, 0x00FF00FF);
-    slli(x0, rs, 16);
-    srli(rd, rs, 16);
-    or_(x0, rd, x0);   // x0 <- x0 << 16 | x0 >> 16
-    and_(x2, x0, x1);  // x2 <- x0 & 0x00FF00FF
-    slli(x2, x2, 8);   // x2 <- (x0 & x1) << 8
-    slli(x1, x1, 8);   // x1 <- 0xFF00FF00
-    and_(rd, x0, x1);  // x0 & 0xFF00FF00
-    srli(rd, rd, 8);
-    or_(rd, rd, x2);  // (((x0 & x1) << 8)  | ((x0 & (x1 << 8)) >> 8))
+    SllWord(x0, rs, 16);
+    SrlWord(rd, rs, 16);
+    Or(x0, rd, x0);      // x0 <- x0 << 16 | x0 >> 16
+    And(x2, x0, x1);     // x2 <- x0 & 0x00FF00FF
+    SllWord(x2, x2, 8);  // x2 <- (x0 & x1) << 8
+    SllWord(x1, x1, 8);  // x1 <- 0xFF00FF00
+    And(rd, x0, x1);     // x0 & 0xFF00FF00
+    SrlWord(rd, rd, 8);
+    Or(rd, rd, x2);  // (((x0 & x1) << 8)  | ((x0 & (x1 << 8)) >> 8))
   }
 }
 #endif
@@ -1984,11 +2002,11 @@ void MacroAssembler::LoadNBytes(Register rd, const MemOperand& rs,
   }
 
   // load remaining (nbytes-1) bytes from higher to lower
-  slli(rd, rd, 8 * (NBYTES - 1));
+  SllWord(rd, rd, 8 * (NBYTES - 1));
   for (int i = (NBYTES - 2); i >= 0; i--) {
     lbu(scratch, rs.rm(), rs.offset() + i);
-    if (i) slli(scratch, scratch, i * 8);
-    or_(rd, rd, scratch);
+    if (i) SllWord(scratch, scratch, i * 8);
+    Or(rd, rd, scratch);
   }
 }
 
@@ -2008,15 +2026,15 @@ void MacroAssembler::LoadNBytesOverwritingBaseReg(const MemOperand& rs,
   }
 
   // load remaining (nbytes-1) bytes from higher to lower
-  slli(scratch0, scratch0, 8 * (NBYTES - 1));
+  SllWord(scratch0, scratch0, 8 * (NBYTES - 1));
   for (int i = (NBYTES - 2); i >= 0; i--) {
     lbu(scratch1, rs.rm(), rs.offset() + i);
     if (i) {
-      slli(scratch1, scratch1, i * 8);
-      or_(scratch0, scratch0, scratch1);
+      SllWord(scratch1, scratch1, i * 8);
+      Or(scratch0, scratch0, scratch1);
     } else {
       // write to rs.rm() when processing the last byte
-      or_(rs.rm(), scratch0, scratch1);
+      Or(rs.rm(), scratch0, scratch1);
     }
   }
 }
@@ -2066,7 +2084,7 @@ void MacroAssembler::UnalignedFLoadHelper(FPURegister frd,
     AdjustBaseAndOffset(&source, scratch_base, OffsetAccessType::TWO_ACCESSES,
                         NBYTES - 1);
   }
-  temps.Include(t2, t4);
+  temps.Include(t4, t6);
   Register scratch = temps.Acquire();
   Register scratch_other = temps.Acquire();
   DCHECK(scratch != rs.rm() && scratch_other != scratch &&
@@ -2092,7 +2110,7 @@ void MacroAssembler::UnalignedFLoadHelper(FPURegister frd,
     AdjustBaseAndOffset(&source, scratch_base, OffsetAccessType::TWO_ACCESSES,
                         NBYTES - 1);
   }
-  temps.Include(t2, t4);
+  temps.Include(t4, t6);
   Register scratch = temps.Acquire();
   Register scratch_other = temps.Acquire();
   DCHECK(scratch != rs.rm() && scratch_other != scratch &&
@@ -2113,7 +2131,7 @@ void MacroAssembler::UnalignedDoubleHelper(FPURegister frd,
     AdjustBaseAndOffset(&source, scratch_base, OffsetAccessType::TWO_ACCESSES,
                         8 - 1);
   }
-  temps.Include(t2, t4);
+  temps.Include(t4, t6);
   Register scratch = temps.Acquire();
   Register scratch_other = temps.Acquire();
   DCHECK(scratch != rs.rm() && scratch_other != scratch &&
@@ -2151,7 +2169,7 @@ void MacroAssembler::UnalignedStoreHelper(Register rd, const MemOperand& rs,
 
   sb(rd, source.rm(), source.offset());
   for (size_t i = 1; i <= (NBYTES - 1); i++) {
-    srli(scratch_other, rd, i * 8);
+    SrlWord(scratch_other, rd, Operand(i * 8));
     sb(scratch_other, source.rm(), source.offset() + i);
   }
 }
@@ -2265,7 +2283,7 @@ void MacroAssembler::LoadWordPair(Register rd, const MemOperand& rs) {
   Register scratch = temps.Acquire();
   Lwu(rd, rs);
   Lw(scratch, MemOperand(rs.rm(), rs.offset() + kSystemPointerSize / 2));
-  slli(scratch, scratch, 32);
+  SllWord(scratch, scratch, 32);
   AddWord(rd, rd, scratch);
 }
 
@@ -2274,7 +2292,7 @@ void MacroAssembler::StoreWordPair(Register rd, const MemOperand& rs) {
   UseScratchRegisterScope temps(this);
   Register scratch = temps.Acquire();
   Sw(rd, rs);
-  srai(scratch, rd, 32);
+  SraWord(scratch, rd, 32);
   Sw(scratch, MemOperand(rs.rm(), rs.offset() + kSystemPointerSize / 2));
 }
 #endif
@@ -2785,7 +2803,7 @@ void MacroAssembler::MultiPop(RegList regs) {
 
   DCHECK(regs.is_empty());
 
-  addi(sp, sp, stack_offset);
+  AddWord(sp, sp, stack_offset);
 
 #undef TEST_AND_POP_REG
 #undef T_REGS
@@ -2815,7 +2833,7 @@ void MacroAssembler::MultiPopFPU(DoubleRegList regs) {
       stack_offset += kDoubleSize;
     }
   }
-  addi(sp, sp, stack_offset);
+  AddWord(sp, sp, stack_offset);
 }
 
 #if V8_TARGET_ARCH_RISCV32
@@ -2883,7 +2901,7 @@ void MacroAssembler::MulPair(Register dst_low, Register dst_high,
   Register scratch3 = temps.Acquire();
   BlockTrampolinePoolScope block_trampoline_pool(this);
   if (dst_low == right_low) {
-    mv(scratch1, right_low);
+    Mv(scratch1, right_low);
   }
   Mul(scratch3, left_low, right_high);
   // NOTE: do not move these around, recommended sequence is MULH-MUL
@@ -2912,13 +2930,13 @@ void MacroAssembler::ShlPair(Register dst_low, Register dst_high,
   Register scratch3 = no_reg;
   if (dst_low == src_low) {
     scratch3 = temps.Acquire();
-    mv(scratch3, src_low);
+    Mv(scratch3, src_low);
   }
   And(scratch1, shift, 0x1F);
   // LOW32 << shamt
-  sll(dst_low, src_low, scratch1);
+  SllWord(dst_low, src_low, scratch1);
   // HIGH32 << shamt
-  sll(dst_high, src_high, scratch1);
+  SllWord(dst_high, src_high, scratch1);
 
   // If the shift amount is 0, we're done
   Branch(&done, eq, shift, Operand(zero_reg));
@@ -2927,9 +2945,9 @@ void MacroAssembler::ShlPair(Register dst_low, Register dst_high,
   li(scratch2, 32);
   Sub32(scratch2, scratch2, scratch1);
   if (dst_low == src_low) {
-    srl(scratch1, scratch3, scratch2);
+    SrlWord(scratch1, scratch3, scratch2);
   } else {
-    srl(scratch1, src_low, scratch2);
+    SrlWord(scratch1, src_low, scratch2);
   }
 
   // (HIGH32 << shamt) | (LOW32 >> (32 - shamt))
@@ -2961,12 +2979,12 @@ void MacroAssembler::ShlPair(Register dst_low, Register dst_high,
     li(dst_low, Operand(0));
   } else if (shift > 32) {
     shift &= 0x1F;
-    slli(dst_high, src_low, shift);
+    SllWord(dst_high, src_low, shift);
     li(dst_low, Operand(0));
   } else {
-    slli(dst_high, src_high, shift);
-    slli(dst_low, src_low, shift);
-    srli(scratch1, src_low, 32 - shift);
+    SllWord(dst_high, src_high, shift);
+    SllWord(dst_low, src_low, shift);
+    SrlWord(scratch1, src_low, 32 - shift);
     Or(dst_high, dst_high, scratch1);
   }
 }
@@ -2982,13 +3000,13 @@ void MacroAssembler::ShrPair(Register dst_low, Register dst_high,
   Register scratch3 = no_reg;
   if (dst_high == src_high) {
     scratch3 = temps.Acquire();
-    mv(scratch3, src_high);
+    Mv(scratch3, src_high);
   }
   And(scratch1, shift, 0x1F);
   // HIGH32 >> shamt
-  srl(dst_high, src_high, scratch1);
+  SrlWord(dst_high, src_high, scratch1);
   // LOW32 >> shamt
-  srl(dst_low, src_low, scratch1);
+  SrlWord(dst_low, src_low, scratch1);
 
   // If the shift amount is 0, we're done
   Branch(&done, eq, shift, Operand(zero_reg));
@@ -2997,9 +3015,9 @@ void MacroAssembler::ShrPair(Register dst_low, Register dst_high,
   li(scratch2, 32);
   Sub32(scratch2, scratch2, scratch1);
   if (dst_high == src_high) {
-    sll(scratch1, scratch3, scratch2);
+    SllWord(scratch1, scratch3, scratch2);
   } else {
-    sll(scratch1, src_high, scratch2);
+    SllWord(scratch1, src_high, scratch2);
   }
 
   // (HIGH32 << (32 - shamt)) | (LOW32 >> shamt)
@@ -3024,19 +3042,19 @@ void MacroAssembler::ShrPair(Register dst_low, Register dst_high,
   DCHECK_NE(dst_high, src_high);
   shift &= 0x3F;
   if (shift == 32) {
-    mv(dst_low, src_high);
+    Mv(dst_low, src_high);
     li(dst_high, Operand(0));
   } else if (shift > 32) {
     shift &= 0x1F;
-    srli(dst_low, src_high, shift);
+    SrlWord(dst_low, src_high, shift);
     li(dst_high, Operand(0));
   } else if (shift == 0) {
     Move(dst_low, src_low);
     Move(dst_high, src_high);
   } else {
-    srli(dst_low, src_low, shift);
-    srli(dst_high, src_high, shift);
-    slli(scratch1, src_high, 32 - shift);
+    SrlWord(dst_low, src_low, shift);
+    SrlWord(dst_high, src_high, shift);
+    SllWord(scratch1, src_high, 32 - shift);
     Or(dst_low, dst_low, scratch1);
   }
 }
@@ -3051,13 +3069,13 @@ void MacroAssembler::SarPair(Register dst_low, Register dst_high,
   Register scratch3 = no_reg;
   if (dst_high == src_high) {
     scratch3 = temps.Acquire();
-    mv(scratch3, src_high);
+    Mv(scratch3, src_high);
   }
   And(scratch1, shift, 0x1F);
   // HIGH32 >> shamt (arithmetic)
-  sra(dst_high, src_high, scratch1);
+  Sra32(dst_high, src_high, scratch1);
   // LOW32 >> shamt (logical)
-  srl(dst_low, src_low, scratch1);
+  SrlWord(dst_low, src_low, scratch1);
 
   // If the shift amount is 0, we're done
   Branch(&done, eq, shift, Operand(zero_reg));
@@ -3066,9 +3084,9 @@ void MacroAssembler::SarPair(Register dst_low, Register dst_high,
   li(scratch2, 32);
   Sub32(scratch2, scratch2, scratch1);
   if (dst_high == src_high) {
-    sll(scratch1, scratch3, scratch2);
+    SllWord(scratch1, scratch3, scratch2);
   } else {
-    sll(scratch1, src_high, scratch2);
+    SllWord(scratch1, src_high, scratch2);
   }
   // (HIGH32 << (32 - shamt)) | (LOW32 >> shamt)
   Or(dst_low, dst_low, scratch1);
@@ -3092,19 +3110,19 @@ void MacroAssembler::SarPair(Register dst_low, Register dst_high,
   DCHECK_NE(dst_high, src_high);
   shift = shift & 0x3F;
   if (shift == 0) {
-    mv(dst_low, src_low);
-    mv(dst_high, src_high);
+    Mv(dst_low, src_low);
+    Mv(dst_high, src_high);
   } else if (shift < 32) {
-    srli(dst_low, src_low, shift);
-    srai(dst_high, src_high, shift);
-    slli(scratch1, src_high, 32 - shift);
+    SrlWord(dst_low, src_low, shift);
+    SraWord(dst_high, src_high, shift);
+    SllWord(scratch1, src_high, 32 - shift);
     Or(dst_low, dst_low, scratch1);
   } else if (shift == 32) {
-    srai(dst_high, src_high, 31);
-    mv(dst_low, src_high);
+    SraWord(dst_high, src_high, 31);
+    Mv(dst_low, src_high);
   } else {
-    srai(dst_high, src_high, 31);
-    srai(dst_low, src_high, shift - 32);
+    SraWord(dst_high, src_high, 31);
+    SraWord(dst_low, src_high, shift - 32);
   }
 }
 #endif
@@ -3112,27 +3130,20 @@ void MacroAssembler::SarPair(Register dst_low, Register dst_high,
 void MacroAssembler::ExtractBits(Register rt, Register rs, uint16_t pos,
                                  uint16_t size, bool sign_extend) {
 #if V8_TARGET_ARCH_RISCV64
-  DCHECK(pos < 64 && 0 < size && size <= 64 && 0 < pos + size &&
-         pos + size <= 64);
-  slli(rt, rs, 64 - (pos + size));
-  if (sign_extend) {
-    srai(rt, rt, 64 - size);
-  } else {
-    srli(rt, rt, 64 - size);
-  }
+  uint16_t arch_mode = 64;
 #elif V8_TARGET_ARCH_RISCV32
-  DCHECK_LT(pos, 32);
+  uint16_t arch_mode = 32;
+#endif
+  DCHECK_LT(pos, arch_mode);
   DCHECK_GT(size, 0);
-  DCHECK_LE(size, 32);
+  DCHECK_LE(size, arch_mode);
   DCHECK_GT(pos + size, 0);
-  DCHECK_LE(pos + size, 32);
-  slli(rt, rs, 32 - (pos + size));
-  if (sign_extend) {
-    srai(rt, rt, 32 - size);
-  } else {
-    srli(rt, rt, 32 - size);
-  }
-#endif
+  DCHECK_LE(pos + size, arch_mode);
+  SllWord(rt, rs, arch_mode - (pos + size));
+  if (sign_extend)
+    SraWord(rt, rt, arch_mode - size);
+  else
+    SrlWord(rt, rt, arch_mode - size);
 }
 
 void MacroAssembler::InsertBits(Register dest, Register source, Register pos,
@@ -3148,17 +3159,17 @@ void MacroAssembler::InsertBits(Register dest, Register source, Register pos,
   Register source_ = temps.Acquire();
   // Create a mask of the length=size.
   li(mask, 1);
-  slli(mask, mask, size);
-  addi(mask, mask, -1);
-  and_(source_, mask, source);
-  sll(source_, source_, pos);
+  SllWord(mask, mask, size);
+  AddWord(mask, mask, -1);
+  And(source_, mask, source);
+  SllWord(source_, source_, pos);
   // Make a mask containing 0's. 0's start at "pos" with length=size.
-  sll(mask, mask, pos);
+  SllWord(mask, mask, pos);
   not_(mask, mask);
   // cut area for insertion of source.
-  and_(dest, mask, dest);
+  And(dest, mask, dest);
   // insert source
-  or_(dest, dest, source_);
+  Or(dest, dest, source_);
 }
 
 void MacroAssembler::Neg_s(FPURegister fd, FPURegister fs) { fneg_s(fd, fs); }
@@ -3212,7 +3223,7 @@ void MacroAssembler::RoundFloatingPointToInteger(Register rd, FPURegister fs,
     // check kInvalidOperation flag (out-of-range, NaN)
     // set result to 1 if normal, otherwise set result to 0 for abnormal
     frflags(result);
-    andi(result, result, exception_flags);
+    And(result, result, exception_flags);
     seqz(result, result);  // result <-- 1 (normal), result <-- 0 (abnormal)
   } else {
     // actual conversion instruction
@@ -3261,7 +3272,7 @@ void MacroAssembler::Trunc_w_d(Register rd, FPURegister fs, Register result) {
     j(&done);
     bind(&bad);
     // scratch still holds proper max/min value
-    mv(rd, scratch);
+    Mv(rd, scratch);
     li(result, 0);
     // set result to 1 if normal, otherwise set result to 0 for abnormal
     bind(&done);
@@ -3897,10 +3908,10 @@ void MacroAssembler::InsertHighWordF64(FPURegister dst, Register src_high) {
   DCHECK(src_high != scratch2 && src_high != scratch);
 
   fmv_x_d(scratch, dst);
-  slli(scratch2, src_high, 32);
-  slli(scratch, scratch, 32);
-  srli(scratch, scratch, 32);
-  or_(scratch, scratch, scratch2);
+  SllWord(scratch2, src_high, 32);
+  SllWord(scratch, scratch, 32);
+  SrlWord(scratch, scratch, 32);
+  Or(scratch, scratch, scratch2);
   fmv_d_x(dst, scratch);
 #elif V8_TARGET_ARCH_RISCV32
   BlockTrampolinePoolScope block_trampoline_pool(this);
@@ -3921,11 +3932,11 @@ void MacroAssembler::InsertLowWordF64(FPURegister dst, Register src_low) {
 
   DCHECK(src_low != scratch && src_low != scratch2);
   fmv_x_d(scratch, dst);
-  slli(scratch2, src_low, 32);
-  srli(scratch2, scratch2, 32);
-  srli(scratch, scratch, 32);
-  slli(scratch, scratch, 32);
-  or_(scratch, scratch, scratch2);
+  SllWord(scratch2, src_low, 32);
+  SrlWord(scratch2, scratch2, 32);
+  SrlWord(scratch, scratch, 32);
+  SllWord(scratch, scratch, 32);
+  Or(scratch, scratch, scratch2);
   fmv_d_x(dst, scratch);
 #elif V8_TARGET_ARCH_RISCV32
   BlockTrampolinePoolScope block_trampoline_pool(this);
@@ -4069,7 +4080,7 @@ void MacroAssembler::LoadZeroIfConditionNotZero(Register dest,
     seqz(scratch, condition);
     // neg + and may be more efficient than mul(dest, dest, scratch)
     neg(scratch, scratch);  // 0 is still 0, 1 becomes all 1s
-    and_(dest, dest, scratch);
+    And(dest, dest, scratch);
   }
 }
 
@@ -4084,7 +4095,7 @@ void MacroAssembler::LoadZeroIfConditionZero(Register dest,
     snez(scratch, condition);
     //  neg + and may be more efficient than mul(dest, dest, scratch);
     neg(scratch, scratch);  // 0 is still 0, 1 becomes all 1s
-    and_(dest, dest, scratch);
+    And(dest, dest, scratch);
   }
 }
 
@@ -4117,56 +4128,56 @@ void MacroAssembler::Clz32(Register rd, Register xx) {
     Move(x, xx);
     li(n, Operand(32));
 #if V8_TARGET_ARCH_RISCV64
-    srliw(y, x, 16);
+    Srl32(y, x, 16);
     BranchShort(&L0, eq, y, Operand(zero_reg));
     Move(x, y);
-    addiw(n, n, -16);
+    Add32(n, n, -16);
     bind(&L0);
-    srliw(y, x, 8);
+    Srl32(y, x, 8);
     BranchShort(&L1, eq, y, Operand(zero_reg));
-    addiw(n, n, -8);
+    Add32(n, n, -8);
     Move(x, y);
     bind(&L1);
-    srliw(y, x, 4);
+    Srl32(y, x, 4);
     BranchShort(&L2, eq, y, Operand(zero_reg));
-    addiw(n, n, -4);
+    Add32(n, n, -4);
     Move(x, y);
     bind(&L2);
-    srliw(y, x, 2);
+    Srl32(y, x, 2);
     BranchShort(&L3, eq, y, Operand(zero_reg));
-    addiw(n, n, -2);
+    Add32(n, n, -2);
     Move(x, y);
     bind(&L3);
-    srliw(y, x, 1);
-    subw(rd, n, x);
+    Srl32(y, x, 1);
+    Sub32(rd, n, x);
     BranchShort(&L4, eq, y, Operand(zero_reg));
-    addiw(rd, n, -2);
+    Add32(rd, n, -2);
     bind(&L4);
 #elif V8_TARGET_ARCH_RISCV32
-    srli(y, x, 16);
+    SrlWord(y, x, 16);
     BranchShort(&L0, eq, y, Operand(zero_reg));
     Move(x, y);
-    addi(n, n, -16);
+    AddWord(n, n, -16);
     bind(&L0);
-    srli(y, x, 8);
+    SrlWord(y, x, 8);
     BranchShort(&L1, eq, y, Operand(zero_reg));
-    addi(n, n, -8);
+    AddWord(n, n, -8);
     Move(x, y);
     bind(&L1);
-    srli(y, x, 4);
+    SrlWord(y, x, 4);
     BranchShort(&L2, eq, y, Operand(zero_reg));
-    addi(n, n, -4);
+    AddWord(n, n, -4);
     Move(x, y);
     bind(&L2);
-    srli(y, x, 2);
+    SrlWord(y, x, 2);
     BranchShort(&L3, eq, y, Operand(zero_reg));
-    addi(n, n, -2);
+    AddWord(n, n, -2);
     Move(x, y);
     bind(&L3);
-    srli(y, x, 1);
-    sub(rd, n, x);
+    SrlWord(y, x, 1);
+    SubWord(rd, n, x);
     BranchShort(&L4, eq, y, Operand(zero_reg));
-    addi(rd, n, -2);
+    AddWord(rd, n, -2);
     bind(&L4);
 #endif
   }
@@ -4198,35 +4209,35 @@ void MacroAssembler::Clz64(Register rd, Register xx) {
     DCHECK(xx != y && xx != n);
     Move(x, xx);
     li(n, Operand(64));
-    srli(y, x, 32);
+    SrlWord(y, x, 32);
     BranchShort(&L0, eq, y, Operand(zero_reg));
-    addiw(n, n, -32);
+    Add32(n, n, -32);
     Move(x, y);
     bind(&L0);
-    srli(y, x, 16);
+    SrlWord(y, x, 16);
     BranchShort(&L1, eq, y, Operand(zero_reg));
-    addiw(n, n, -16);
+    Add32(n, n, -16);
     Move(x, y);
     bind(&L1);
-    srli(y, x, 8);
+    SrlWord(y, x, 8);
     BranchShort(&L2, eq, y, Operand(zero_reg));
-    addiw(n, n, -8);
+    Add32(n, n, -8);
     Move(x, y);
     bind(&L2);
-    srli(y, x, 4);
+    SrlWord(y, x, 4);
     BranchShort(&L3, eq, y, Operand(zero_reg));
-    addiw(n, n, -4);
+    Add32(n, n, -4);
     Move(x, y);
     bind(&L3);
-    srli(y, x, 2);
+    SrlWord(y, x, 2);
     BranchShort(&L4, eq, y, Operand(zero_reg));
-    addiw(n, n, -2);
+    Add32(n, n, -2);
     Move(x, y);
     bind(&L4);
-    srli(y, x, 1);
-    subw(rd, n, x);
+    SrlWord(y, x, 1);
+    Sub32(rd, n, x);
     BranchShort(&L5, eq, y, Operand(zero_reg));
-    addiw(rd, n, -2);
+    Add32(rd, n, -2);
     bind(&L5);
   }
 }
@@ -4331,8 +4342,8 @@ void MacroAssembler::Popcnt32(Register rd, Register rs, Register scratch) {
     And(scratch, scratch, scratch2);
     Sub32(scratch, rs, scratch);
     li(scratch2, 0x33333333);  // B1 = 0x33333333;
-    slli(rd, scratch2, 4);
-    or_(scratch2, scratch2, rd);
+    SllWord(rd, scratch2, 4);
+    Or(scratch2, scratch2, rd);
     And(rd, scratch, scratch2);
     Srl32(scratch, scratch, 2);
     And(scratch, scratch, scratch2);
@@ -4383,7 +4394,7 @@ void MacroAssembler::Popcnt64(Register rd, Register rs, Register scratch) {
     Mul64(scratch2, value, scratch2);  // B2 = 0x0F0F0F0F0F0F0F0Fl;
     And(rd, rd, scratch2);
     Mul64(rd, rd, value);
-    srli(rd, rd, 32 + shift);
+    SrlWord(rd, rd, Operand(32 + shift));
   }
 }
 #endif
@@ -5323,13 +5334,13 @@ void MacroAssembler::StoreReturnAddressAndCall(Register target) {
   // This is the return address of the exit frame.
   auipc(ra, 0);  // Set ra the current PC
   bind(&find_ra);
-  addi(ra, ra,
-       (kNumInstructionsToJump + 1) *
-           kInstrSize);  // Set ra to insn after the call
+  AddWord(ra, ra,
+          (kNumInstructionsToJump + 1) *
+              kInstrSize);  // Set ra to insn after the call
 
   // This spot was reserved in EnterExitFrame.
   StoreWord(ra, MemOperand(sp));
-  addi(sp, sp, -kCArgsSlotsSize);
+  AddWord(sp, sp, -kCArgsSlotsSize);
   // Stack is still aligned.
 
   // Call the C routine.
@@ -5355,7 +5366,7 @@ void MacroAssembler::BranchLong(Label* L) {
   if (L->is_bound() && is_intn(imm, Assembler::kJumpOffsetBits) &&
       (imm & 1) == 0) {
     j(imm);
-    nop();
+    NOP();
     EmitConstPoolWithJumpIfNeeded();
     return;
   }
@@ -5371,7 +5382,7 @@ void MacroAssembler::BranchAndLinkLong(Label* L) {
   if (L->is_bound() && is_intn(imm, Assembler::kJumpOffsetBits) &&
       (imm & 1) == 0) {
     jal(t6, imm);
-    nop();
+    NOP();
     return;
   }
   GenPCRelativeJumpAndLink(t6, imm);
@@ -5451,7 +5462,7 @@ void MacroAssembler::LoadAddress(Register dst, Label* target,
     int32_t Lo12 = (int32_t)offset << 20 >> 20;
     BlockTrampolinePoolScope block_trampoline_pool(this);
     auipc(dst, Hi20);
-    addi(dst, dst, Lo12);
+    AddWord(dst, dst, Lo12);
   } else {
     uintptr_t address = jump_address(target);
     li(dst, Operand(address, rmode), ADDRESS_LOAD);
@@ -5476,7 +5487,7 @@ void MacroAssembler::Switch(Register scratch, Register value,
   // trampoline right here if necessary, i.e. if label area is too large and
   // all unbound forward branches cannot be bound over it. Use nop() because the
   // trampoline cannot be emitted right after Jump().
-  nop();
+  NOP();
   static constexpr int mask = kInstrSize - 1;
   int aligned_label_area_size = num_labels * kUIntptrSize + kSystemPointerSize;
   int instructions_per_label_area =
@@ -6138,16 +6149,16 @@ void MacroAssembler::AddOverflow64(Register dst, Register left,
          overflow != scratch2);
   DCHECK(overflow != left && overflow != right_reg);
   if (dst == left || dst == right_reg) {
-    add(scratch2, left, right_reg);
-    xor_(overflow, scratch2, left);
-    xor_(scratch, scratch2, right_reg);
-    and_(overflow, overflow, scratch);
+    AddWord(scratch2, left, right_reg);
+    Xor(overflow, scratch2, left);
+    Xor(scratch, scratch2, right_reg);
+    And(overflow, overflow, scratch);
     Mv(dst, scratch2);
   } else {
-    add(dst, left, right_reg);
-    xor_(overflow, dst, left);
-    xor_(scratch, dst, right_reg);
-    and_(overflow, overflow, scratch);
+    AddWord(dst, left, right_reg);
+    Xor(overflow, dst, left);
+    Xor(scratch, dst, right_reg);
+    And(overflow, overflow, scratch);
   }
 }
 
@@ -6170,16 +6181,16 @@ void MacroAssembler::SubOverflow64(Register dst, Register left,
   DCHECK(overflow != left && overflow != right_reg);
 
   if (dst == left || dst == right_reg) {
-    sub(scratch2, left, right_reg);
-    xor_(overflow, left, scratch2);
-    xor_(scratch, left, right_reg);
-    and_(overflow, overflow, scratch);
+    SubWord(scratch2, left, right_reg);
+    Xor(overflow, left, scratch2);
+    Xor(scratch, left, right_reg);
+    And(overflow, overflow, scratch);
     Mv(dst, scratch2);
   } else {
-    sub(dst, left, right_reg);
-    xor_(overflow, left, dst);
-    xor_(scratch, left, right_reg);
-    and_(overflow, overflow, scratch);
+    SubWord(dst, left, right_reg);
+    Xor(overflow, left, dst);
+    Xor(scratch, left, right_reg);
+    And(overflow, overflow, scratch);
   }
 }
 
@@ -6226,7 +6237,7 @@ void MacroAssembler::MulOverflow32(Register dst, Register left,
   }
   mul(overflow, rs1, rs2);
   sext_w(dst, overflow);
-  xor_(overflow, overflow, dst);
+  Xor(overflow, overflow, dst);
 }
 
 void MacroAssembler::MulOverflow64(Register dst, Register left,
@@ -6254,10 +6265,10 @@ void MacroAssembler::MulOverflow64(Register dst, Register left,
   // Lower part.
   mul(dst, left, right_reg);
   // Expand the sign of the lower part to 64bit.
-  srai(overflow, dst, 63);
+  SraWord(overflow, dst, 63);
   // If the upper part is not equal to the expanded sign bit of the lower part,
   // overflow happens.
-  xor_(overflow, overflow, scratch2);
+  Xor(overflow, overflow, scratch2);
 }
 
 #elif V8_TARGET_ARCH_RISCV32
@@ -6278,16 +6289,16 @@ void MacroAssembler::AddOverflow(Register dst, Register left,
          overflow != scratch2);
   DCHECK(overflow != left && overflow != right_reg);
   if (dst == left || dst == right_reg) {
-    add(scratch2, left, right_reg);
-    xor_(overflow, scratch2, left);
-    xor_(scratch, scratch2, right_reg);
-    and_(overflow, overflow, scratch);
+    AddWord(scratch2, left, right_reg);
+    Xor(overflow, scratch2, left);
+    Xor(scratch, scratch2, right_reg);
+    And(overflow, overflow, scratch);
     Mv(dst, scratch2);
   } else {
-    add(dst, left, right_reg);
-    xor_(overflow, dst, left);
-    xor_(scratch, dst, right_reg);
-    and_(overflow, overflow, scratch);
+    AddWord(dst, left, right_reg);
+    Xor(overflow, dst, left);
+    Xor(scratch, dst, right_reg);
+    And(overflow, overflow, scratch);
   }
 }
 
@@ -6310,16 +6321,16 @@ void MacroAssembler::SubOverflow(Register dst, Register left,
   DCHECK(overflow != left && overflow != right_reg);
 
   if (dst == left || dst == right_reg) {
-    sub(scratch2, left, right_reg);
-    xor_(overflow, left, scratch2);
-    xor_(scratch, left, right_reg);
-    and_(overflow, overflow, scratch);
+    SubWord(scratch2, left, right_reg);
+    Xor(overflow, left, scratch2);
+    Xor(scratch, left, right_reg);
+    And(overflow, overflow, scratch);
     Mv(dst, scratch2);
   } else {
-    sub(dst, left, right_reg);
-    xor_(overflow, left, dst);
-    xor_(scratch, left, right_reg);
-    and_(overflow, overflow, scratch);
+    SubWord(dst, left, right_reg);
+    Xor(overflow, left, dst);
+    Xor(scratch, left, right_reg);
+    And(overflow, overflow, scratch);
   }
 }
 
@@ -6344,8 +6355,8 @@ void MacroAssembler::MulOverflow32(Register dst, Register left,
   DCHECK(overflow != left && overflow != right_reg);
   mulh(overflow, left, right_reg);
   mul(dst, left, right_reg);
-  srai(scratch2, dst, 31);
-  xor_(overflow, overflow, scratch2);
+  SraWord(scratch2, dst, 31);
+  Xor(overflow, overflow, scratch2);
 }
 #endif
 
@@ -6569,7 +6580,7 @@ void MacroAssembler::Abort(AbortReason reason) {
     int abort_instructions = InstructionsGeneratedSince(&abort_start);
     DCHECK_LE(abort_instructions, kExpectedAbortInstructions);
     while (abort_instructions++ < kExpectedAbortInstructions) {
-      nop();
+      NOP();
     }
   }
 }
@@ -6702,7 +6713,7 @@ void MacroAssembler::EnterFrame(StackFrame::Type type) {
 
 void MacroAssembler::LeaveFrame(StackFrame::Type type) {
   ASM_CODE_COMMENT(this);
-  addi(sp, fp, 2 * kSystemPointerSize);
+  AddWord(sp, fp, 2 * kSystemPointerSize);
   LoadWord(ra, MemOperand(fp, 1 * kSystemPointerSize));
   LoadWord(fp, MemOperand(fp, 0 * kSystemPointerSize));
 }
@@ -6733,15 +6744,15 @@ void MacroAssembler::EnterExitFrame(Register scratch, int stack_space,
   using ER = ExternalReference;
 
   // Save registers and reserve room for saved entry sp.
-  addi(sp, sp,
-       -2 * kSystemPointerSize - ExitFrameConstants::kFixedFrameSizeFromFp);
+  AddWord(sp, sp,
+          -2 * kSystemPointerSize - ExitFrameConstants::kFixedFrameSizeFromFp);
   StoreWord(ra, MemOperand(sp, 3 * kSystemPointerSize));
   StoreWord(fp, MemOperand(sp, 2 * kSystemPointerSize));
 
   li(scratch, Operand(StackFrame::TypeToMarker(frame_type)));
   StoreWord(scratch, MemOperand(sp, 1 * kSystemPointerSize));
   // Set up new frame pointer.
-  addi(fp, sp, ExitFrameConstants::kFixedFrameSizeFromFp);
+  AddWord(fp, sp, ExitFrameConstants::kFixedFrameSizeFromFp);
 
   if (v8_flags.debug_code) {
     StoreWord(zero_reg, MemOperand(fp, ExitFrameConstants::kSPOffset));
@@ -6768,7 +6779,7 @@ void MacroAssembler::EnterExitFrame(Register scratch, int stack_space,
 
   // Set the exit frame sp value to point just before the return address
   // location.
-  addi(scratch, sp, kSystemPointerSize);
+  AddWord(scratch, sp, kSystemPointerSize);
   StoreWord(scratch, MemOperand(fp, ExitFrameConstants::kSPOffset));
 }
 
@@ -6796,7 +6807,7 @@ void MacroAssembler::LeaveExitFrame(Register scratch) {
   LoadWord(fp, MemOperand(sp, ExitFrameConstants::kCallerFPOffset));
   LoadWord(ra, MemOperand(sp, ExitFrameConstants::kCallerPCOffset));
 
-  addi(sp, sp, 2 * kSystemPointerSize);
+  AddWord(sp, sp, 2 * kSystemPointerSize);
 }
 
 int MacroAssembler::ActivationFrameAlignment() {
@@ -6827,7 +6838,7 @@ void MacroAssembler::AssertStackIsAligned() {
       {
         UseScratchRegisterScope temps(this);
         Register scratch = temps.Acquire();
-        andi(scratch, sp, frame_alignment_mask);
+        And(scratch, sp, frame_alignment_mask);
         BranchShort(&alignment_as_expected, eq, scratch, Operand(zero_reg));
       }
       // Don't use Check here, as it will call Runtime_Abort re-entering here.
@@ -6874,7 +6885,7 @@ void MacroAssembler::JumpIfSmi(Register value, Label* smi_label,
   DCHECK_EQ(0, kSmiTag);
   UseScratchRegisterScope temps(this);
   Register scratch = temps.Acquire();
-  andi(scratch, value, kSmiTagMask);
+  And(scratch, value, kSmiTagMask);
   Branch(smi_label, eq, scratch, Operand(zero_reg), distance);
 }
 
@@ -6895,7 +6906,7 @@ void MacroAssembler::JumpIfNotSmi(Register value, Label* not_smi_label,
   UseScratchRegisterScope temps(this);
   Register scratch = temps.Acquire();
   DCHECK_EQ(0, kSmiTag);
-  andi(scratch, value, kSmiTagMask);
+  And(scratch, value, kSmiTagMask);
   Branch(not_smi_label, ne, scratch, Operand(zero_reg), distance);
 }
 
@@ -6965,7 +6976,7 @@ void MacroAssembler::AssertNotSmi(Register object, AbortReason reason) {
     UseScratchRegisterScope temps(this);
     Register scratch = temps.Acquire();
     static_assert(kSmiTag == 0);
-    andi(scratch, object, kSmiTagMask);
+    And(scratch, object, kSmiTagMask);
     Check(ne, reason, scratch, Operand(zero_reg));
   }
 }
@@ -6976,7 +6987,7 @@ void MacroAssembler::AssertSmi(Register object, AbortReason reason) {
     UseScratchRegisterScope temps(this);
     Register scratch = temps.Acquire();
     static_assert(kSmiTag == 0);
-    andi(scratch, object, kSmiTagMask);
+    And(scratch, object, kSmiTagMask);
     Check(eq, reason, scratch, Operand(zero_reg));
   }
 }
@@ -7647,10 +7658,10 @@ void MacroAssembler::LoadEntrypointFromJSDispatchTable(Register destination,
   li(scratch, ExternalReference::js_dispatch_table_address());
 #ifdef V8_TARGET_ARCH_RISCV32
   static_assert(kJSDispatchHandleShift == 0);
-  slli(index, dispatch_handle, kJSDispatchTableEntrySizeLog2);
+  SllWord(index, dispatch_handle, kJSDispatchTableEntrySizeLog2);
 #else
-  srli(index, dispatch_handle, kJSDispatchHandleShift);
-  slli(index, index, kJSDispatchTableEntrySizeLog2);
+  SrlWord(index, dispatch_handle, kJSDispatchHandleShift);
+  SllWord(index, index, kJSDispatchTableEntrySizeLog2);
 #endif
   AddWord(scratch, scratch, index);
   LoadWord(destination,
@@ -7680,8 +7691,8 @@ void MacroAssembler::LoadParameterCountFromJSDispatchTable(
   DCHECK(!AreAliased(destination, scratch));
   ASM_CODE_COMMENT(this);
   Register index = destination;
-  srli(index, dispatch_handle, kJSDispatchHandleShift);
-  slli(index, index, kJSDispatchTableEntrySizeLog2);
+  SrlWord(index, dispatch_handle, kJSDispatchHandleShift);
+  SllWord(index, index, kJSDispatchTableEntrySizeLog2);
   li(scratch, ExternalReference::js_dispatch_table_address());
   AddWord(scratch, scratch, index);
   static_assert(JSDispatchEntry::kParameterCountMask == 0xffff);
@@ -7695,8 +7706,8 @@ void MacroAssembler::LoadEntrypointAndParameterCountFromJSDispatchTable(
   ASM_CODE_COMMENT(this);
   Register index = parameter_count;
   li(scratch, ExternalReference::js_dispatch_table_address());
-  srli(index, dispatch_handle, kJSDispatchHandleShift);
-  slli(index, index, kJSDispatchTableEntrySizeLog2);
+  SrlWord(index, dispatch_handle, kJSDispatchHandleShift);
+  SllWord(index, index, kJSDispatchTableEntrySizeLog2);
   AddWord(scratch, scratch, index);
   LoadWord(entrypoint, MemOperand(scratch, JSDispatchEntry::kEntrypointOffset));
   static_assert(JSDispatchEntry::kParameterCountMask == 0xffff);
diff --git a/deps/v8/src/codegen/riscv/macro-assembler-riscv.h b/deps/v8/src/codegen/riscv/macro-assembler-riscv.h
index 4e4cb2b39271d3..35d1b9d41183d9 100644
--- a/deps/v8/src/codegen/riscv/macro-assembler-riscv.h
+++ b/deps/v8/src/codegen/riscv/macro-assembler-riscv.h
@@ -488,7 +488,7 @@ class V8_EXPORT_PRIVATE MacroAssembler : public MacroAssemblerBase {
         stack_offset += kSystemPointerSize;
       }
     }
-    addi(sp, sp, stack_offset);
+    AddWord(sp, sp, stack_offset);
   }
 
   void PushAll(DoubleRegList registers, int stack_slot_size = kDoubleSize) {
@@ -514,7 +514,7 @@ class V8_EXPORT_PRIVATE MacroAssembler : public MacroAssemblerBase {
         stack_offset += kDoubleSize;
       }
     }
-    addi(sp, sp, stack_offset);
+    AddWord(sp, sp, stack_offset);
   }
 
   // Push multiple registers on the stack.
@@ -682,11 +682,11 @@ class V8_EXPORT_PRIVATE MacroAssembler : public MacroAssemblerBase {
     if (COMPRESS_POINTERS_BOOL) {
       sraiw(dst, src, kSmiShift);
     } else {
-      srai(dst, src, kSmiShift);
+      SraWord(dst, src, kSmiShift);
     }
 #elif V8_TARGET_ARCH_RISCV32
     DCHECK(SmiValuesAre31Bits());
-    srai(dst, src, kSmiShift);
+    SraWord(dst, src, kSmiShift);
 #endif
   }
 
@@ -792,8 +792,8 @@ class V8_EXPORT_PRIVATE MacroAssembler : public MacroAssemblerBase {
     if (CpuFeatures::IsSupported(ZBB)) {
       sextb(rd, rs);
     } else {
-      slli(rd, rs, xlen - 8);
-      srai(rd, rd, xlen - 8);
+      SllWord(rd, rs, xlen - 8);
+      SraWord(rd, rd, xlen - 8);
     }
   }
 
@@ -801,8 +801,8 @@ class V8_EXPORT_PRIVATE MacroAssembler : public MacroAssemblerBase {
     if (CpuFeatures::IsSupported(ZBB)) {
       sexth(rd, rs);
     } else {
-      slli(rd, rs, xlen - 16);
-      srai(rd, rd, xlen - 16);
+      SllWord(rd, rs, xlen - 16);
+      SraWord(rd, rd, xlen - 16);
     }
   }
 
@@ -816,8 +816,8 @@ class V8_EXPORT_PRIVATE MacroAssembler : public MacroAssemblerBase {
     if (CpuFeatures::IsSupported(ZBA)) {
       zextw(rd, rs);
     } else {
-      slli(rd, rs, 32);
-      srli(rd, rd, 32);
+      Sll64(rd, rs, 32);
+      Srl64(rd, rd, 32);
     }
   }
   void Popcnt64(Register rd, Register rs, Register scratch);
@@ -1043,7 +1043,7 @@ class V8_EXPORT_PRIVATE MacroAssembler : public MacroAssemblerBase {
   inline void Move(Register dst_low, Register dst_high, FPURegister src) {
     fmv_x_d(dst_high, src);
     fmv_x_w(dst_low, src);
-    srli(dst_high, dst_high, 32);
+    Srl64(dst_high, dst_high, 32);
   }
 
   inline void Move(Register dst, FPURegister src) { fmv_x_d(dst, src); }
@@ -1059,7 +1059,7 @@ class V8_EXPORT_PRIVATE MacroAssembler : public MacroAssemblerBase {
   inline void ExtractHighWordFromF64(Register dst_high, FPURegister src) {
 #if V8_TARGET_ARCH_RISCV64
     fmv_x_d(dst_high, src);
-    srai(dst_high, dst_high, 32);
+    Sra64(dst_high, dst_high, 32);
 #elif V8_TARGET_ARCH_RISCV32
     // todo(riscv32): delete storedouble
     AddWord(sp, sp, Operand(-8));
@@ -1240,7 +1240,7 @@ class V8_EXPORT_PRIVATE MacroAssembler : public MacroAssemblerBase {
 #if V8_TARGET_ARCH_RISCV64
     if (SmiValuesAre32Bits()) {
       // Smi goes to upper 32
-      slli(dst, src, 32);
+      Sll64(dst, src, 32);
     } else {
       DCHECK(SmiValuesAre31Bits());
       // Smi is shifted left by 1
@@ -1250,7 +1250,7 @@ class V8_EXPORT_PRIVATE MacroAssembler : public MacroAssemblerBase {
 
     DCHECK(SmiValuesAre31Bits());
     // Smi is shifted left by 1
-    slli(dst, src, kSmiShift);
+    Sll32(dst, src, kSmiShift);
 #endif
   }
 
@@ -1322,7 +1322,7 @@ class V8_EXPORT_PRIVATE MacroAssembler : public MacroAssemblerBase {
   // Loads a field containing an off-heap ("external") pointer and does
   // necessary decoding if sandbox is enabled.
   void LoadExternalPointerField(Register destination, MemOperand field_operand,
-                                ExternalPointerTag tag,
+                                ExternalPointerTagRange tag_range,
                                 Register isolate_root = no_reg);
 
 #if V8_TARGET_ARCH_RISCV64
@@ -1798,16 +1798,16 @@ class V8_EXPORT_PRIVATE MacroAssembler : public MacroAssemblerBase {
 #if V8_TARGET_ARCH_RISCV64
     if (SmiValuesAre32Bits()) {
       // The int portion is upper 32-bits of 64-bit word.
-      srai(dst, src, (kSmiShift - scale) & 0x3F);
+      Sra64(dst, src, (kSmiShift - scale) & 0x3F);
     } else {
       DCHECK(SmiValuesAre31Bits());
       DCHECK_GE(scale, kSmiTagSize);
-      slliw(dst, src, scale - kSmiTagSize);
+      Sra32(dst, src, scale - kSmiTagSize);
     }
 #elif V8_TARGET_ARCH_RISCV32
     DCHECK(SmiValuesAre31Bits());
     DCHECK_GE(scale, kSmiTagSize);
-    slli(dst, src, scale - kSmiTagSize);
+    Sll32(dst, src, scale - kSmiTagSize);
 #endif
   }
 
@@ -1980,10 +1980,10 @@ void MacroAssembler::GenerateSwitchTable(Register index, size_t case_count,
   Align(8);
   // Load the address from the jump table at index and jump to it
   auipc(scratch, 0);  // Load the current PC into scratch
-  slli(scratch2, index,
-       kSystemPointerSizeLog2);  // scratch2 = offset of indexth entry
-  add(scratch2, scratch2,
-      scratch);  // scratch2 = (saved PC) + (offset of indexth entry)
+  SllWord(scratch2, index,
+          kSystemPointerSizeLog2);  // scratch2 = offset of indexth entry
+  AddWord(scratch2, scratch2,
+          scratch);  // scratch2 = (saved PC) + (offset of indexth entry)
   LoadWord(scratch2,
            MemOperand(scratch2,
                       6 * kInstrSize));  // Add the size of these 6 instructions
diff --git a/deps/v8/src/codegen/riscv/register-riscv.h b/deps/v8/src/codegen/riscv/register-riscv.h
index 69eed2f168814d..ae9fd1442f3f97 100644
--- a/deps/v8/src/codegen/riscv/register-riscv.h
+++ b/deps/v8/src/codegen/riscv/register-riscv.h
@@ -25,6 +25,7 @@ namespace internal {
 // t3 t5 : scratch register used in scratch_register_list
 // t6 : call reg.
 // t0 t1 t2 t4:caller saved scratch register can be used in macroassembler and
+// t2: kMaglevExtraScratchRegister
 // builtin-riscv64
 #define ALWAYS_ALLOCATABLE_GENERAL_REGISTERS(V)  \
              V(a0)  V(a1)  V(a2)  V(a3) \
diff --git a/deps/v8/src/codegen/s390/assembler-s390-inl.h b/deps/v8/src/codegen/s390/assembler-s390-inl.h
index a962af1b840c7d..9669d8d8fdf25b 100644
--- a/deps/v8/src/codegen/s390/assembler-s390-inl.h
+++ b/deps/v8/src/codegen/s390/assembler-s390-inl.h
@@ -147,7 +147,6 @@ Tagged<HeapObject> RelocInfo::target_object(PtrComprCageBase cage_base) {
   if (IsCompressedEmbeddedObject(rmode_)) {
     return Cast<HeapObject>(
         Tagged<Object>(V8HeapCompressionScheme::DecompressTagged(
-            cage_base,
             Assembler::target_compressed_address_at(pc_, constant_pool_))));
   } else {
     return Cast<HeapObject>(
diff --git a/deps/v8/src/codegen/source-position-table.cc b/deps/v8/src/codegen/source-position-table.cc
index 42accbc12b8ec2..08869a86bb8441 100644
--- a/deps/v8/src/codegen/source-position-table.cc
+++ b/deps/v8/src/codegen/source-position-table.cc
@@ -43,6 +43,7 @@ void AddAndSetEntry(PositionTableEntry* value,
   value->source_position += other.source_position;
   DCHECK_LE(0, value->source_position);
   value->is_statement = other.is_statement;
+  value->is_breakable = other.is_breakable;
 }
 
 // Helper: Subtract the offsets from 'other' from 'value'.
@@ -52,23 +53,29 @@ void SubtractFromEntry(PositionTableEntry* value,
   value->source_position -= other.source_position;
 }
 
+template <typename T>
+inline void EncodeUInt(ZoneVector<uint8_t>* bytes, T value) {
+  bool more;
+  do {
+    more = value > ValueBits::kMax;
+    uint8_t current =
+        MoreBit::encode(more) | ValueBits::encode(value & ValueBits::kMask);
+    bytes->push_back(current);
+    value >>= ValueBits::kSize;
+  } while (more);
+}
+
 // Helper: Encode an integer.
 template <typename T>
-void EncodeInt(ZoneVector<uint8_t>* bytes, T value) {
+inline void EncodeInt(ZoneVector<uint8_t>* bytes, T value) {
   using unsigned_type = std::make_unsigned_t<T>;
   // Zig-zag encoding.
   static constexpr int kShift = sizeof(T) * kBitsPerByte - 1;
   value = ((static_cast<unsigned_type>(value) << 1) ^ (value >> kShift));
   DCHECK_GE(value, 0);
   unsigned_type encoded = static_cast<unsigned_type>(value);
-  bool more;
-  do {
-    more = encoded > ValueBits::kMax;
-    uint8_t current =
-        MoreBit::encode(more) | ValueBits::encode(encoded & ValueBits::kMask);
-    bytes->push_back(current);
-    encoded >>= ValueBits::kSize;
-  } while (more);
+
+  EncodeUInt(bytes, encoded);
 }
 
 // Encode a PositionTableEntry.
@@ -79,15 +86,17 @@ void EncodeEntry(ZoneVector<uint8_t>* bytes, const PositionTableEntry& entry) {
   // the same position).
   // TODO(11496): This DCHECK fails tests.
   // DCHECK_IMPLIES(!bytes->empty(), entry.code_offset > 0);
-  // Since code_offset is not negative, we use sign to encode is_statement.
-  EncodeInt(bytes,
-            entry.is_statement ? entry.code_offset : -entry.code_offset - 1);
+  // The least significant bit is used to encode is_breakable.
+  // The second least significant bit is used to encode is_statement.
+  uint32_t encoded_entry = (entry.code_offset << 2) |
+                           (entry.is_breakable << 1) | (entry.is_statement);
+
+  EncodeUInt(bytes, encoded_entry);
   EncodeInt(bytes, entry.source_position);
 }
 
-// Helper: Decode an integer.
 template <typename T>
-T DecodeInt(base::Vector<const uint8_t> bytes, int* index) {
+T DecodeUInt(base::Vector<const uint8_t> bytes, int* index) {
   uint8_t current;
   int shift = 0;
   T decoded = 0;
@@ -100,20 +109,27 @@ T DecodeInt(base::Vector<const uint8_t> bytes, int* index) {
     shift += ValueBits::kSize;
   } while (more);
   DCHECK_GE(decoded, 0);
-  decoded = (decoded >> 1) ^ (-(decoded & 1));
   return decoded;
 }
 
+// Helper: Decode an integer.
+template <typename T>
+T DecodeInt(base::Vector<const uint8_t> bytes, int* index) {
+  using unsigned_type = std::make_unsigned_t<T>;
+
+  unsigned_type zigzag_value = DecodeUInt<unsigned_type>(bytes, index);
+  T result = static_cast<T>((zigzag_value >> 1) ^ (-(zigzag_value & 1)));
+  return result;
+}
+
 void DecodeEntry(base::Vector<const uint8_t> bytes, int* index,
                  PositionTableEntry* entry) {
-  int tmp = DecodeInt<int>(bytes, index);
-  if (tmp >= 0) {
-    entry->is_statement = true;
-    entry->code_offset = tmp;
-  } else {
-    entry->is_statement = false;
-    entry->code_offset = -(tmp + 1);
-  }
+  // The least significant bit is used to encode is_breakable.
+  // The second least significant bit is used to encode is_statement.
+  int tmp = DecodeUInt<int>(bytes, index);
+  entry->code_offset = tmp >> 2;
+  entry->is_breakable = (tmp & 0b10) >> 1;
+  entry->is_statement = tmp & 1;
   entry->source_position = DecodeInt<int64_t>(bytes, index);
 }
 
@@ -152,11 +168,12 @@ SourcePositionTableBuilder::SourcePositionTableBuilder(
 
 void SourcePositionTableBuilder::AddPosition(size_t code_offset,
                                              SourcePosition source_position,
-                                             bool is_statement) {
+                                             bool is_statement,
+                                             bool is_breakable) {
   if (Omit()) return;
   DCHECK(source_position.IsKnown());
   int offset = static_cast<int>(code_offset);
-  AddEntry({offset, source_position.raw(), is_statement});
+  AddEntry({offset, source_position.raw(), is_statement, is_breakable});
 }
 
 V8_INLINE void SourcePositionTableBuilder::AddEntry(
diff --git a/deps/v8/src/codegen/source-position-table.h b/deps/v8/src/codegen/source-position-table.h
index a3bfbc9d5e1553..284654c3fe0cbd 100644
--- a/deps/v8/src/codegen/source-position-table.h
+++ b/deps/v8/src/codegen/source-position-table.h
@@ -23,13 +23,19 @@ struct PositionTableEntry {
   PositionTableEntry()
       : source_position(0),
         code_offset(kFunctionEntryBytecodeOffset),
-        is_statement(false) {}
-  PositionTableEntry(int offset, int64_t source, bool statement)
-      : source_position(source), code_offset(offset), is_statement(statement) {}
+        is_statement(false),
+        is_breakable(true) {}
+  PositionTableEntry(int offset, int64_t source, bool statement,
+                     bool breakable = true)
+      : source_position(source),
+        code_offset(offset),
+        is_statement(statement),
+        is_breakable(breakable) {}
 
   int64_t source_position;
   int code_offset;
   bool is_statement;
+  bool is_breakable;
 };
 
 class V8_EXPORT_PRIVATE SourcePositionTableBuilder {
@@ -49,7 +55,7 @@ class V8_EXPORT_PRIVATE SourcePositionTableBuilder {
       Zone* zone, RecordingMode mode = RECORD_SOURCE_POSITIONS);
 
   void AddPosition(size_t code_offset, SourcePosition source_position,
-                   bool is_statement);
+                   bool is_statement, bool is_breakable = true);
 
   template <typename IsolateT>
   EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE)
@@ -130,6 +136,10 @@ class V8_EXPORT_PRIVATE SourcePositionTableIterator {
     DCHECK(!done());
     return current_.is_statement;
   }
+  bool is_breakable() const {
+    DCHECK(!done());
+    return current_.is_breakable;
+  }
   bool done() const { return index_ == kDone; }
 
   IndexAndPositionState GetState() const {
diff --git a/deps/v8/src/codegen/x64/assembler-x64-inl.h b/deps/v8/src/codegen/x64/assembler-x64-inl.h
index eca42f172d71dc..e102a4fa962668 100644
--- a/deps/v8/src/codegen/x64/assembler-x64-inl.h
+++ b/deps/v8/src/codegen/x64/assembler-x64-inl.h
@@ -307,8 +307,7 @@ Tagged<HeapObject> RelocInfo::target_object(PtrComprCageBase cage_base) {
   if (IsCompressedEmbeddedObject(rmode_)) {
     Tagged_t compressed = ReadUnalignedValue<Tagged_t>(pc_);
     DCHECK(!HAS_SMI_TAG(compressed));
-    Tagged<Object> obj(
-        V8HeapCompressionScheme::DecompressTagged(cage_base, compressed));
+    Tagged<Object> obj(V8HeapCompressionScheme::DecompressTagged(compressed));
     return Cast<HeapObject>(obj);
   }
   DCHECK(IsFullEmbeddedObject(rmode_));
diff --git a/deps/v8/src/codegen/x64/assembler-x64.cc b/deps/v8/src/codegen/x64/assembler-x64.cc
index a9f9c2dd447b36..cda3ac36d32099 100644
--- a/deps/v8/src/codegen/x64/assembler-x64.cc
+++ b/deps/v8/src/codegen/x64/assembler-x64.cc
@@ -4696,7 +4696,7 @@ void Assembler::WriteBuiltinJumpTableEntry(Label* label, int table_pos) {
   EnsureSpace ensure_space(this);
   CHECK(label->is_bound());
   int32_t value = label->pos() - table_pos;
-  if constexpr (V8_BUILTIN_JUMP_TABLE_INFO_BOOL) {
+  if constexpr (V8_JUMP_TABLE_INFO_BOOL) {
     builtin_jump_table_info_writer_.Add(pc_offset(), label->pos());
   }
   emitl(value);
@@ -4704,7 +4704,7 @@ void Assembler::WriteBuiltinJumpTableEntry(Label* label, int table_pos) {
 
 int Assembler::WriteBuiltinJumpTableInfos() {
   if (builtin_jump_table_info_writer_.entry_count() == 0) return 0;
-  CHECK(V8_BUILTIN_JUMP_TABLE_INFO_BOOL);
+  CHECK(V8_JUMP_TABLE_INFO_BOOL);
   int offset = pc_offset();
   builtin_jump_table_info_writer_.Emit(this);
   int size = pc_offset() - offset;
diff --git a/deps/v8/src/codegen/x64/assembler-x64.h b/deps/v8/src/codegen/x64/assembler-x64.h
index d0e30a2303810d..ba7e7baa459795 100644
--- a/deps/v8/src/codegen/x64/assembler-x64.h
+++ b/deps/v8/src/codegen/x64/assembler-x64.h
@@ -45,8 +45,8 @@
 #include "src/base/export-template.h"
 #include "src/codegen/assembler.h"
 #include "src/codegen/cpu-features.h"
+#include "src/codegen/jump-table-info.h"
 #include "src/codegen/label.h"
-#include "src/codegen/x64/builtin-jump-table-info-x64.h"
 #include "src/codegen/x64/constants-x64.h"
 #include "src/codegen/x64/fma-instr.h"
 #include "src/codegen/x64/register-x64.h"
@@ -3079,7 +3079,7 @@ class V8_EXPORT_PRIVATE Assembler : public AssemblerBase {
 
   friend class ConstPool;
 
-  BuiltinJumpTableInfoWriter builtin_jump_table_info_writer_;
+  JumpTableInfoWriter builtin_jump_table_info_writer_;
 
 #if defined(V8_OS_WIN_X64)
   std::unique_ptr<win64_unwindinfo::XdataEncoder> xdata_encoder_;
diff --git a/deps/v8/src/codegen/x64/builtin-jump-table-info-x64.cc b/deps/v8/src/codegen/x64/builtin-jump-table-info-x64.cc
deleted file mode 100644
index 5393ac520f7baa..00000000000000
--- a/deps/v8/src/codegen/x64/builtin-jump-table-info-x64.cc
+++ /dev/null
@@ -1,64 +0,0 @@
-// Copyright 2023 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/codegen/x64/builtin-jump-table-info-x64.h"
-
-#include "src/base/memory.h"
-#include "src/codegen/assembler-inl.h"
-#include "src/common/globals.h"
-
-namespace v8 {
-namespace internal {
-
-void BuiltinJumpTableInfoWriter::Add(uint32_t pc_offset, int32_t target) {
-  entries_.emplace_back(pc_offset, target);
-}
-
-size_t BuiltinJumpTableInfoWriter::entry_count() const {
-  return entries_.size();
-}
-
-uint32_t BuiltinJumpTableInfoWriter::size_in_bytes() const {
-  return static_cast<uint32_t>(entry_count() *
-                               BuiltinJumpTableInfoEntry::kSize);
-}
-
-void BuiltinJumpTableInfoWriter::Emit(Assembler* assm) {
-  for (auto i = entries_.begin(); i != entries_.end(); ++i) {
-    static_assert(BuiltinJumpTableInfoEntry::kPCOffsetSize == kUInt32Size);
-    assm->dd(i->pc_offset);
-    static_assert(BuiltinJumpTableInfoEntry::kTargetSize == kInt32Size);
-    assm->dd(i->target);
-    static_assert(BuiltinJumpTableInfoEntry::kSize ==
-                  BuiltinJumpTableInfoEntry::kPCOffsetSize +
-                      BuiltinJumpTableInfoEntry::kTargetSize);
-  }
-}
-
-BuiltinJumpTableInfoIterator::BuiltinJumpTableInfoIterator(Address start,
-                                                           uint32_t size)
-    : start_(start), size_(size), cursor_(start_) {
-  DCHECK_NE(kNullAddress, start);
-}
-
-uint32_t BuiltinJumpTableInfoIterator::GetPCOffset() const {
-  return base::ReadUnalignedValue<uint32_t>(
-      cursor_ + offsetof(BuiltinJumpTableInfoEntry, pc_offset));
-}
-
-int32_t BuiltinJumpTableInfoIterator::GetTarget() const {
-  return base::ReadUnalignedValue<int32_t>(
-      cursor_ + offsetof(BuiltinJumpTableInfoEntry, target));
-}
-
-void BuiltinJumpTableInfoIterator::Next() {
-  cursor_ += BuiltinJumpTableInfoEntry::kSize;
-}
-
-bool BuiltinJumpTableInfoIterator::HasCurrent() const {
-  return cursor_ < start_ + size_;
-}
-
-}  // namespace internal
-}  // namespace v8
diff --git a/deps/v8/src/codegen/x64/macro-assembler-x64.cc b/deps/v8/src/codegen/x64/macro-assembler-x64.cc
index 243438b57f3c52..dded54b245f936 100644
--- a/deps/v8/src/codegen/x64/macro-assembler-x64.cc
+++ b/deps/v8/src/codegen/x64/macro-assembler-x64.cc
@@ -3321,6 +3321,9 @@ void MacroAssembler::CallJSFunction(Register function_object,
   movl(r15, FieldOperand(function_object, JSFunction::kDispatchHandleOffset));
   LoadEntrypointAndParameterCountFromJSDispatchTable(rcx, rbx, r15);
   // Force a safe crash if the parameter count doesn't match.
+  // TODO(412398354): to avoid this runtime check, we should switch all
+  // remaining users to call the function via its dispatch handle instead. See
+  // CallJSDispatchEntry below and crbug.com/412398354 for more details.
   cmpl(rbx, Immediate(argument_count));
   SbxCheck(less_equal, AbortReason::kJSSignatureMismatch);
   call(rcx);
diff --git a/deps/v8/src/common/globals.h b/deps/v8/src/common/globals.h
index 7a90d5d2f20f40..ea76496018c4c6 100644
--- a/deps/v8/src/common/globals.h
+++ b/deps/v8/src/common/globals.h
@@ -255,11 +255,12 @@ const size_t kShortBuiltinCallsOldSpaceSizeThreshold = size_t{2} * GB;
 #define V8_EXTERNAL_CODE_SPACE_BOOL false
 #endif
 
-// Support for builtin jump table disassembly.
-#if defined(V8_ENABLE_BUILTIN_JUMP_TABLE_SWITCH) && defined(ENABLE_DISASSEMBLER)
-#define V8_BUILTIN_JUMP_TABLE_INFO_BOOL true
+// Support for jump table disassembly.
+#if defined(ENABLE_DISASSEMBLER) && \
+    (defined(V8_TARGET_ARCH_ARM64) || defined(V8_TARGET_ARCH_X64))
+#define V8_JUMP_TABLE_INFO_BOOL true
 #else
-#define V8_BUILTIN_JUMP_TABLE_INFO_BOOL false
+#define V8_JUMP_TABLE_INFO_BOOL false
 #endif
 
 // V8_HEAP_USE_PTHREAD_JIT_WRITE_PROTECT controls how V8 sets permissions for
@@ -802,7 +803,7 @@ enum class StoreOrigin { kMaybeKeyed, kNamed };
 
 enum class TypeofMode { kInside, kNotInside };
 
-enum class ContextKind { kDefault, kScriptContext };
+enum class ContextMode { kNoContextCells, kHasContextCells };
 
 // Whether floating point registers should be saved (and restored).
 enum class SaveFPRegsMode { kIgnore, kSave };
@@ -1453,9 +1454,10 @@ enum class GarbageCollectionReason : int {
   kMeasureMemory = 24,
   kBackgroundAllocationFailure = 25,
   kFinalizeConcurrentMinorMS = 26,
-  kCppHeapAllocationFailure = 27,
-  kFrozen = 28,
-  kIdleContextDisposal = 29,
+  kFinalizeMinorMSForMajorGC = 27,
+  kCppHeapAllocationFailure = 28,
+  kFrozen = 29,
+  kIdleContextDisposal = 30,
 
   NUM_REASONS,
 };
@@ -1520,6 +1522,8 @@ constexpr const char* ToString(GarbageCollectionReason reason) {
       return "background allocation failure";
     case GarbageCollectionReason::kFinalizeConcurrentMinorMS:
       return "finalize concurrent MinorMS";
+    case GarbageCollectionReason::kFinalizeMinorMSForMajorGC:
+      return "finalize MinorMS for major GC";
     case GarbageCollectionReason::kCppHeapAllocationFailure:
       return "CppHeap allocation failure";
     case GarbageCollectionReason::kFrozen:
@@ -2911,6 +2915,8 @@ static constexpr ReleaseStoreTag kReleaseStore;
 static constexpr RelaxedStoreTag kRelaxedStore;
 static constexpr SeqCstAccessTag kSeqCstAccess;
 
+static constexpr int kAdd_LhsIsStringConstant_Internalize_CacheSlotOffset = 1;
+
 }  // namespace v8
 
 namespace i = v8::internal;
diff --git a/deps/v8/src/common/ptr-compr-inl.h b/deps/v8/src/common/ptr-compr-inl.h
index f27ae78dfc17f1..0c778b9a43d987 100644
--- a/deps/v8/src/common/ptr-compr-inl.h
+++ b/deps/v8/src/common/ptr-compr-inl.h
@@ -8,9 +8,9 @@
 #include "src/common/ptr-compr.h"
 // Include the non-inl header before the rest of the headers.
 
-#include "include/v8-internal.h"
-#include "src/execution/isolate.h"
-#include "src/execution/local-isolate-inl.h"
+#include "src/common/globals.h"
+#include "src/objects/tagged.h"
+#include "src/utils/utils.h"
 
 #ifdef V8_ENABLE_SANDBOX
 #include "src/sandbox/sandbox.h"
@@ -21,10 +21,11 @@ namespace internal {
 
 #ifdef V8_COMPRESS_POINTERS
 
+// Always return the global/thread local cage base for isolate
 PtrComprCageBase::PtrComprCageBase(const Isolate* isolate)
-    : address_(isolate->cage_base()) {}
+    : address_(V8HeapCompressionScheme::base()) {}
 PtrComprCageBase::PtrComprCageBase(const LocalIsolate* isolate)
-    : address_(isolate->cage_base()) {}
+    : address_(V8HeapCompressionScheme::base()) {}
 
 //
 // V8HeapCompressionSchemeImpl
@@ -108,9 +109,8 @@ Address V8HeapCompressionSchemeImpl<Cage>::DecompressTaggedSigned(
 
 // static
 template <typename Cage>
-template <typename TOnHeapAddress>
 Address V8HeapCompressionSchemeImpl<Cage>::DecompressTagged(
-    TOnHeapAddress on_heap_addr, Tagged_t raw_value) {
+    Tagged_t raw_value) {
 #ifdef V8_COMPRESS_POINTERS
   Address cage_base = base();
 #ifdef V8_COMPRESS_POINTERS_IN_MULTIPLE_CAGES
@@ -130,18 +130,16 @@ Address V8HeapCompressionSchemeImpl<Cage>::DecompressTagged(
 template <typename Cage>
 template <typename ProcessPointerCallback>
 void V8HeapCompressionSchemeImpl<Cage>::ProcessIntermediatePointers(
-    PtrComprCageBase cage_base, Address raw_value,
-    ProcessPointerCallback callback) {
+    Address raw_value, ProcessPointerCallback callback) {
   // If pointer compression is enabled, we may have random compressed pointers
   // on the stack that may be used for subsequent operations.
   // Extract, decompress and trace both halfwords.
   Address decompressed_low =
       V8HeapCompressionSchemeImpl<Cage>::DecompressTagged(
-          cage_base, static_cast<Tagged_t>(raw_value));
+          static_cast<Tagged_t>(raw_value));
   callback(decompressed_low);
   Address decompressed_high =
       V8HeapCompressionSchemeImpl<Cage>::DecompressTagged(
-          cage_base,
           static_cast<Tagged_t>(raw_value >> (sizeof(Tagged_t) * CHAR_BIT)));
   callback(decompressed_high);
 }
@@ -214,35 +212,13 @@ constexpr Tagged_t ExternalCodeCompressionScheme::CompressAny(Address tagged) {
 }
 
 // static
-Address ExternalCodeCompressionScheme::DecompressTaggedSigned(
-    Tagged_t raw_value) {
-  // For runtime code the upper 32-bits of the Smi value do not matter.
-  return static_cast<Address>(raw_value);
-}
-
-// static
-template <typename TOnHeapAddress>
-Address ExternalCodeCompressionScheme::DecompressTagged(
-    TOnHeapAddress on_heap_addr, Tagged_t raw_value) {
-#ifdef V8_ENABLE_CONSERVATIVE_STACK_SCANNING
-  // During conservative stack scanning, if we are trying to decompress a value
-  // that looks like a SMI (i.e., it's not tagged), we always need to add the
-  // cage base.
-#else
-  // Avoid complex decompression code for Smis.
-  if (HAS_SMI_TAG(raw_value)) return DecompressTaggedSigned(raw_value);
-#endif
-
-#ifdef V8_COMPRESS_POINTERS
+Address ExternalCodeCompressionScheme::DecompressTagged(Tagged_t raw_value) {
   Address cage_base = base();
 #ifdef V8_COMPRESS_POINTERS_IN_MULTIPLE_CAGES
   DCHECK_WITH_MSG(cage_base != kNullAddress,
                   "ExternalCodeCompressionScheme::base is not initialized for "
                   "current thread");
 #endif  // V8_COMPRESS_POINTERS_IN_MULTIPLE_CAGES
-#else
-  Address cage_base = GetPtrComprCageBaseAddress(on_heap_addr);
-#endif  // V8_COMPRESS_POINTERS
   V8_ASSUME((cage_base & kMinExpectedOSPageSizeMask) == cage_base);
 
   Address diff = static_cast<Address>(static_cast<uint32_t>(raw_value)) -
@@ -262,16 +238,14 @@ Address ExternalCodeCompressionScheme::DecompressTagged(
 // static
 template <typename ProcessPointerCallback>
 void ExternalCodeCompressionScheme::ProcessIntermediatePointers(
-    PtrComprCageBase cage_base, Address raw_value,
-    ProcessPointerCallback callback) {
+    Address raw_value, ProcessPointerCallback callback) {
   // If pointer compression is enabled, we may have random compressed pointers
   // on the stack that may be used for subsequent operations.
   // Extract, decompress and trace both halfwords.
   Address decompressed_low = ExternalCodeCompressionScheme::DecompressTagged(
-      cage_base, static_cast<Tagged_t>(raw_value));
+      static_cast<Tagged_t>(raw_value));
   callback(decompressed_low);
   Address decompressed_high = ExternalCodeCompressionScheme::DecompressTagged(
-      cage_base,
       static_cast<Tagged_t>(raw_value >> (sizeof(Tagged_t) * CHAR_BIT)));
   callback(decompressed_high);
 }
@@ -330,9 +304,8 @@ Address V8HeapCompressionSchemeImpl<Cage>::DecompressTaggedSigned(
 
 // static
 template <typename Cage>
-template <typename TOnHeapAddress>
 Address V8HeapCompressionSchemeImpl<Cage>::DecompressTagged(
-    TOnHeapAddress on_heap_addr, Tagged_t raw_value) {
+    Tagged_t raw_value) {
   UNREACHABLE();
 }
 
@@ -340,8 +313,7 @@ Address V8HeapCompressionSchemeImpl<Cage>::DecompressTagged(
 template <typename Cage>
 template <typename ProcessPointerCallback>
 void V8HeapCompressionSchemeImpl<Cage>::ProcessIntermediatePointers(
-    PtrComprCageBase cage_base, Address raw_value,
-    ProcessPointerCallback callback) {
+    Address raw_value, ProcessPointerCallback callback) {
   UNREACHABLE();
 }
 
diff --git a/deps/v8/src/common/ptr-compr.h b/deps/v8/src/common/ptr-compr.h
index e83a522e678c5a..1ec4ff4e9022c7 100644
--- a/deps/v8/src/common/ptr-compr.h
+++ b/deps/v8/src/common/ptr-compr.h
@@ -41,9 +41,7 @@ class V8HeapCompressionSchemeImpl {
   V8_INLINE static Address DecompressTaggedSigned(Tagged_t raw_value);
 
   // Decompresses any tagged value, preserving both weak- and smi- tags.
-  template <typename TOnHeapAddress>
-  V8_INLINE static Address DecompressTagged(TOnHeapAddress on_heap_addr,
-                                            Tagged_t raw_value);
+  V8_INLINE static Address DecompressTagged(Tagged_t raw_value);
 
   // Given a 64bit raw value, found on the stack, calls the callback function
   // with all possible pointers that may be "contained" in compressed form in
@@ -51,8 +49,7 @@ class V8HeapCompressionSchemeImpl {
   // (half-computed) results.
   template <typename ProcessPointerCallback>
   V8_INLINE static void ProcessIntermediatePointers(
-      PtrComprCageBase cage_base, Address raw_value,
-      ProcessPointerCallback callback);
+      Address raw_value, ProcessPointerCallback callback);
 
   // Process-wide cage base value used for decompression.
   V8_INLINE static void InitBase(Address base);
@@ -165,13 +162,8 @@ class ExternalCodeCompressionScheme {
   // object, or a marker bit pattern).
   V8_INLINE static constexpr Tagged_t CompressAny(Address tagged);
 
-  // Decompresses smi value.
-  V8_INLINE static Address DecompressTaggedSigned(Tagged_t raw_value);
-
   // Decompresses any tagged value, preserving both weak- and smi- tags.
-  template <typename TOnHeapAddress>
-  V8_INLINE static Address DecompressTagged(TOnHeapAddress on_heap_addr,
-                                            Tagged_t raw_value);
+  V8_INLINE static Address DecompressTagged(Tagged_t raw_value);
 
   // Process-wide cage base value used for decompression.
   V8_INLINE static void InitBase(Address base);
@@ -183,8 +175,7 @@ class ExternalCodeCompressionScheme {
   // (half-computed) results.
   template <typename ProcessPointerCallback>
   V8_INLINE static void ProcessIntermediatePointers(
-      PtrComprCageBase cage_base, Address raw_value,
-      ProcessPointerCallback callback);
+      Address raw_value, ProcessPointerCallback callback);
 
  private:
   // These non-inlined accessors to base_ field are used in component builds
diff --git a/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.cc b/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.cc
index b713acf4e5b3f8..d75e61bfc77e91 100644
--- a/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.cc
+++ b/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.cc
@@ -57,14 +57,15 @@ class OptimizingCompileTaskExecutor::CompileTask : public v8::JobTask {
         DCHECK(local_isolate.heap()->IsParked());
 
         do {
-          RunCompilationJob(isolate, local_isolate, job);
+          task_executor_->RunCompilationJob(task_state, isolate, local_isolate,
+                                            job);
 
           should_yield = delegate->ShouldYield();
           if (should_yield) break;
 
           // Reuse the LocalIsolate if the next worklist item has the same
           // isolate.
-          job = task_executor_->NextInputIfIsolateMatches(isolate);
+          job = task_executor_->NextInputIfIsolateMatches(task_state);
         } while (job);
       }
 
@@ -81,24 +82,6 @@ class OptimizingCompileTaskExecutor::CompileTask : public v8::JobTask {
     DCHECK_NULL(task_state.isolate);
   }
 
-  void RunCompilationJob(Isolate* isolate, LocalIsolate& local_isolate,
-                         TurbofanCompilationJob* job) {
-    TRACE_EVENT_WITH_FLOW0(
-        TRACE_DISABLED_BY_DEFAULT("v8.compile"), "V8.OptimizeBackground",
-        job->trace_id(), TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT);
-    TimerEventScope<TimerEventRecompileConcurrent> timer(isolate);
-
-    if (task_executor_->recompilation_delay_ != 0) {
-      base::OS::Sleep(base::TimeDelta::FromMilliseconds(
-          task_executor_->recompilation_delay_));
-    }
-
-    RCS_SCOPE(&local_isolate,
-              RuntimeCallCounterId::kOptimizeBackgroundTurbofan);
-
-    task_executor_->CompileNext(isolate, local_isolate, job);
-  }
-
   size_t GetMaxConcurrency(size_t worker_count) const override {
     size_t num_tasks = task_executor_->input_queue_.Length() + worker_count;
     return std::min(num_tasks, task_executor_->task_states_.size());
@@ -151,20 +134,34 @@ TurbofanCompilationJob* OptimizingCompileTaskExecutor::NextInput(
 }
 
 TurbofanCompilationJob*
-OptimizingCompileTaskExecutor::NextInputIfIsolateMatches(Isolate* isolate) {
-  return input_queue_.DequeueIfIsolateMatches(isolate);
+OptimizingCompileTaskExecutor::NextInputIfIsolateMatches(
+    OptimizingCompileTaskState& task_state) {
+  return input_queue_.DequeueIfIsolateMatches(task_state);
 }
 
-void OptimizingCompileTaskExecutor::CompileNext(Isolate* isolate,
-                                                LocalIsolate& local_isolate,
-                                                TurbofanCompilationJob* job) {
-  DCHECK_NOT_NULL(job);
+void OptimizingCompileTaskExecutor::RunCompilationJob(
+    OptimizingCompileTaskState& task_state, Isolate* isolate,
+    LocalIsolate& local_isolate, TurbofanCompilationJob* job) {
+  TRACE_EVENT_WITH_FLOW0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
+                         "V8.OptimizeBackground", job->trace_id(),
+                         TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT);
+  TimerEventScope<TimerEventRecompileConcurrent> timer(isolate);
+
+  if (recompilation_delay_ != 0) {
+    base::OS::Sleep(base::TimeDelta::FromMilliseconds(recompilation_delay_));
+  }
+
+  RCS_SCOPE(&local_isolate, RuntimeCallCounterId::kOptimizeBackgroundTurbofan);
 
   // The function may have already been optimized by OSR.  Simply continue.
   CompilationJob::Status status =
       job->ExecuteJob(local_isolate.runtime_call_stats(), &local_isolate);
   USE(status);  // Prevent an unused-variable error.
 
+  // Remove the job first from task_state before adding it to the output queue.
+  // As soon as the job is in the output queue it could be deleted any moment.
+  ResetJob(task_state);
+
   isolate->optimizing_compile_dispatcher()->QueueFinishedJob(job);
 }
 
@@ -192,9 +189,18 @@ void OptimizingCompileTaskExecutor::ClearTaskState(
   base::MutexGuard guard(input_queue_.mutex_);
   DCHECK_NOT_NULL(task_state.isolate);
   task_state.isolate = nullptr;
+  DCHECK_NULL(task_state.job);
   input_queue_.task_finished_.NotifyAll();
 }
 
+void OptimizingCompileTaskExecutor::ResetJob(
+    OptimizingCompileTaskState& task_state) {
+  base::MutexGuard guard(input_queue_.mutex_);
+  DCHECK_NOT_NULL(task_state.isolate);
+  DCHECK_NOT_NULL(task_state.job);
+  task_state.job = nullptr;
+}
+
 bool OptimizingCompileTaskExecutor::TryQueueForOptimization(
     std::unique_ptr<TurbofanCompilationJob>& job) {
   Isolate* isolate = job->isolate();
@@ -227,6 +233,18 @@ void OptimizingCompileTaskExecutor::WaitUntilCompilationJobsDoneForIsolate(
   }
 }
 
+void OptimizingCompileTaskExecutor::CancelCompilationJobsForIsolate(
+    Isolate* isolate) {
+  base::MutexGuard guard(&input_queue_.mutex_);
+  DCHECK(!input_queue_.HasJobForIsolate(isolate));
+
+  for (auto& task_state : task_states_) {
+    if (task_state.isolate == isolate && task_state.job) {
+      task_state.job->Cancel();
+    }
+  }
+}
+
 OptimizingCompileDispatcher::OptimizingCompileDispatcher(
     Isolate* isolate, OptimizingCompileTaskExecutor* task_executor)
     : isolate_(isolate), task_executor_(task_executor) {}
@@ -271,6 +289,7 @@ void OptimizingCompileDispatcher::WaitUntilCompilationJobsDone() {
 void OptimizingCompileDispatcher::FlushQueues(
     BlockingBehavior blocking_behavior) {
   FlushInputQueue();
+  task_executor_->CancelCompilationJobsForIsolate(isolate_);
   if (blocking_behavior == BlockingBehavior::kBlock) {
     WaitUntilCompilationJobsDone();
   }
@@ -290,6 +309,8 @@ void OptimizingCompileDispatcher::Flush(BlockingBehavior blocking_behavior) {
 void OptimizingCompileDispatcher::StartTearDown() {
   HandleScope handle_scope(isolate_);
   FlushInputQueue();
+
+  task_executor_->CancelCompilationJobsForIsolate(isolate_);
 }
 
 void OptimizingCompileDispatcher::InstallOptimizedFunctions() {
@@ -401,16 +422,19 @@ TurbofanCompilationJob* OptimizingCompileInputQueue::Dequeue(
   queue_.pop_front();
   DCHECK_NOT_NULL(job);
   task_state.isolate = job->isolate();
+  task_state.job = job;
   return job;
 }
 
 TurbofanCompilationJob* OptimizingCompileInputQueue::DequeueIfIsolateMatches(
-    Isolate* isolate) {
+    OptimizingCompileTaskState& task_state) {
   base::MutexGuard access(&mutex_);
   if (queue_.empty()) return nullptr;
   TurbofanCompilationJob* job = queue_.front();
   DCHECK_NOT_NULL(job);
-  if (job->isolate() != isolate) return nullptr;
+  if (job->isolate() != task_state.isolate) return nullptr;
+  DCHECK_NULL(task_state.job);
+  task_state.job = job;
   queue_.pop_front();
   return job;
 }
diff --git a/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.h b/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.h
index 959324a05fd84b..c52dd279462911 100644
--- a/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.h
+++ b/deps/v8/src/compiler-dispatcher/optimizing-compile-dispatcher.h
@@ -28,6 +28,7 @@ class SharedFunctionInfo;
 // in OptimizingCompileDispatcher::task_states.
 struct alignas(PROCESSOR_CACHE_LINE_SIZE) OptimizingCompileTaskState {
   Isolate* isolate;
+  TurbofanCompilationJob* job;
 };
 
 // Circular queue of incoming recompilation tasks (including OSR).
@@ -46,7 +47,8 @@ class V8_EXPORT OptimizingCompileInputQueue {
   explicit OptimizingCompileInputQueue(int capacity) : capacity_(capacity) {}
 
   TurbofanCompilationJob* Dequeue(OptimizingCompileTaskState& task_state);
-  TurbofanCompilationJob* DequeueIfIsolateMatches(Isolate* isolate);
+  TurbofanCompilationJob* DequeueIfIsolateMatches(
+      OptimizingCompileTaskState& task_state);
 
   bool Enqueue(std::unique_ptr<TurbofanCompilationJob>& job);
 
@@ -79,15 +81,17 @@ class V8_EXPORT OptimizingCompileTaskExecutor {
   void EnsureInitialized();
 
   // Invokes and runs Turbofan for this particular job.
-  void CompileNext(Isolate* isolate, LocalIsolate& local_isolate,
-                   TurbofanCompilationJob* job);
+  void RunCompilationJob(OptimizingCompileTaskState& task_state,
+                         Isolate* isolate, LocalIsolate& local_isolate,
+                         TurbofanCompilationJob* job);
 
   // Gets the next job from the input queue.
   TurbofanCompilationJob* NextInput(OptimizingCompileTaskState& task_state);
 
   // Gets the next job from the input queue but only if the job is also for the
-  // given isolate.
-  TurbofanCompilationJob* NextInputIfIsolateMatches(Isolate* isolate);
+  // same isolate as in the given `OptimizingCompileTaskState`.
+  TurbofanCompilationJob* NextInputIfIsolateMatches(
+      OptimizingCompileTaskState& task_state);
 
   // Returns true when one of the currently running compilation tasks is
   // operating on the given isolate. If the return value is false, the caller
@@ -100,6 +104,8 @@ class V8_EXPORT OptimizingCompileTaskExecutor {
   // LocalHeap/LocalIsolate for this thread was destroyed as well.
   void ClearTaskState(OptimizingCompileTaskState& task_state);
 
+  void ResetJob(OptimizingCompileTaskState& task_state);
+
   // Tries to append a new compilation job to the input queue. This may fail if
   // the input queue was already full.
   bool TryQueueForOptimization(std::unique_ptr<TurbofanCompilationJob>& job);
@@ -108,6 +114,10 @@ class V8_EXPORT OptimizingCompileTaskExecutor {
   // done.
   void WaitUntilCompilationJobsDoneForIsolate(Isolate* isolate);
 
+  // Cancels all running compilation jobs for this isolate and then waits until
+  // they stop running.
+  void CancelCompilationJobsForIsolate(Isolate* isolate);
+
   // Returns true if there exists a currently running or queued compilation job
   // for this isolate..
   bool HasCompilationJobsForIsolate(Isolate* isolate);
diff --git a/deps/v8/src/compiler/access-builder.cc b/deps/v8/src/compiler/access-builder.cc
index cb94b3b57c8d52..a4daa2f634ddf9 100644
--- a/deps/v8/src/compiler/access-builder.cc
+++ b/deps/v8/src/compiler/access-builder.cc
@@ -53,30 +53,47 @@ FieldAccess AccessBuilder::ForHeapNumberValue() {
 }
 
 // static
-FieldAccess AccessBuilder::ForHeapInt32Value() {
+FieldAccess AccessBuilder::ForContextCellState() {
   FieldAccess access = {
-      kTaggedBase,
-      offsetof(HeapNumber, value_) + kIeeeDoubleMantissaWordOffset,
-      MaybeHandle<Name>(),
-      OptionalMapRef(),
-      TypeCache::Get()->kInt32,
-      MachineType::Int32(),
-      kNoWriteBarrier,
-      "HeapInt32Value"};
+      kTaggedBase,      offsetof(ContextCell, state_), MaybeHandle<Name>(),
+      OptionalMapRef(), TypeCache::Get()->kInt32,      MachineType::Int32(),
+      kNoWriteBarrier,  "ForContextCellState"};
   return access;
 }
 
 // static
-FieldAccess AccessBuilder::ForHeapInt32UpperValue() {
+FieldAccess AccessBuilder::ForContextCellTaggedValue() {
   FieldAccess access = {
-      kTaggedBase,
-      offsetof(HeapNumber, value_) + kIeeeDoubleExponentWordOffset,
-      MaybeHandle<Name>(),
-      OptionalMapRef(),
-      TypeCache::Get()->kInt32,
-      MachineType::Int32(),
-      kNoWriteBarrier,
-      "HeapInt32ValueUpperValue"};
+      kTaggedBase,         offsetof(ContextCell, tagged_value_),
+      MaybeHandle<Name>(), OptionalMapRef(),
+      Type::Any(),         MachineType::AnyTagged(),
+      kFullWriteBarrier,   "ForContextCellTaggedValue"};
+  return access;
+}
+
+// static
+FieldAccess AccessBuilder::ForContextCellInt32Value() {
+  FieldAccess access = {kTaggedBase,
+                        offsetof(ContextCell, double_value_),
+                        MaybeHandle<Name>(),
+                        OptionalMapRef(),
+                        TypeCache::Get()->kInt32,
+                        MachineType::Int32(),
+                        kNoWriteBarrier,
+                        "ForContextCellInt32Value"};
+  return access;
+}
+
+// static
+FieldAccess AccessBuilder::ForContextCellFloat64Value() {
+  FieldAccess access = {kTaggedBase,
+                        offsetof(ContextCell, double_value_),
+                        MaybeHandle<Name>(),
+                        OptionalMapRef(),
+                        TypeCache::Get()->kFloat64,
+                        MachineType::Float64(),
+                        kNoWriteBarrier,
+                        "ContextCellFloat64Value"};
   return access;
 }
 
@@ -1588,16 +1605,6 @@ FieldAccess AccessBuilder::ForWasmDispatchTableLength() {
 }
 #endif  // V8_ENABLE_WEBASSEMBLY
 
-// static
-FieldAccess AccessBuilder::ForContextSideProperty() {
-  FieldAccess access = {
-      kTaggedBase,         ContextSidePropertyCell::kPropertyDetailsRawOffset,
-      MaybeHandle<Name>(), OptionalMapRef(),
-      Type::SignedSmall(), MachineType::TaggedSigned(),
-      kNoWriteBarrier,     "ContextSidePropertyDetails"};
-  return access;
-}
-
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/compiler/access-builder.h b/deps/v8/src/compiler/access-builder.h
index 392089b79296ee..b0a21495d9e93e 100644
--- a/deps/v8/src/compiler/access-builder.h
+++ b/deps/v8/src/compiler/access-builder.h
@@ -36,8 +36,12 @@ class V8_EXPORT_PRIVATE AccessBuilder final
 
   // Provides access to HeapNumber::value() field.
   static FieldAccess ForHeapNumberValue();
-  static FieldAccess ForHeapInt32Value();
-  static FieldAccess ForHeapInt32UpperValue();
+
+  // Provides access to ContextCell fields.
+  static FieldAccess ForContextCellState();
+  static FieldAccess ForContextCellTaggedValue();
+  static FieldAccess ForContextCellInt32Value();
+  static FieldAccess ForContextCellFloat64Value();
 
   // Provides access to HeapNumber::value() and Oddball::to_number_raw() fields.
   // This is the same as ForHeapNumberValue, except it documents (and static
diff --git a/deps/v8/src/compiler/backend/arm/code-generator-arm.cc b/deps/v8/src/compiler/backend/arm/code-generator-arm.cc
index 94ad34242df537..ca6ff95f4ac318 100644
--- a/deps/v8/src/compiler/backend/arm/code-generator-arm.cc
+++ b/deps/v8/src/compiler/backend/arm/code-generator-arm.cc
@@ -919,6 +919,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ mov(i.OutputRegister(), fp);
       }
       break;
+    case kArchRootPointer:
+      __ mov(i.OutputRegister(), kRootRegister);
+      DCHECK_EQ(LeaveCC, i.OutputSBit());
+      break;
 #if V8_ENABLE_WEBASSEMBLY
     case kArchStackPointer:
       // The register allocator expects an allocatable register for the output,
diff --git a/deps/v8/src/compiler/backend/arm/instruction-selector-arm.cc b/deps/v8/src/compiler/backend/arm/instruction-selector-arm.cc
index 32d1bad96f4620..b3d73d2bb98d88 100644
--- a/deps/v8/src/compiler/backend/arm/instruction-selector-arm.cc
+++ b/deps/v8/src/compiler/backend/arm/instruction-selector-arm.cc
@@ -409,8 +409,9 @@ void EmitLoad(InstructionSelectorT* selector, InstructionCode opcode,
 
   const Operation& base_op = selector->Get(base);
   int64_t index_constant;
-  if (base_op.Is<Opmask::kExternalConstant>() &&
-      selector->MatchSignedIntegralConstant(index, &index_constant)) {
+  const bool is_index_constant =
+      selector->MatchSignedIntegralConstant(index, &index_constant);
+  if (base_op.Is<Opmask::kExternalConstant>() && is_index_constant) {
     const ConstantOp& constant_base = base_op.Cast<ConstantOp>();
     if (selector->CanAddressRelativeToRootsRegister(
             constant_base.external_reference())) {
@@ -426,10 +427,11 @@ void EmitLoad(InstructionSelectorT* selector, InstructionCode opcode,
     }
   }
 
-  if (base_op.Is<LoadRootRegisterOp>()) {
+  if (base_op.Is<LoadRootRegisterOp>() && is_index_constant) {
     input_count = 1;
     // This will only work if {index} is a constant.
-    inputs[0] = g.UseImmediate(index);
+    DCHECK(is_int32(index_constant));
+    inputs[0] = g.UseImmediate(static_cast<int32_t>(index_constant));
     opcode |= AddressingModeField::encode(kMode_Root);
     selector->Emit(opcode, 1, output, input_count, inputs);
     return;
@@ -1192,7 +1194,8 @@ void InstructionSelectorT::VisitStackPointerGreaterThan(
   kind = op.kind;
   value = op.stack_limit();
   InstructionCode opcode =
-      kArchStackPointerGreaterThan | MiscField::encode(static_cast<int>(kind));
+      kArchStackPointerGreaterThan |
+      StackCheckField::encode(static_cast<StackCheckKind>(kind));
 
   ArmOperandGeneratorT g(this);
 
diff --git a/deps/v8/src/compiler/backend/arm64/code-generator-arm64.cc b/deps/v8/src/compiler/backend/arm64/code-generator-arm64.cc
index 0185663669004e..0c88aaa5a57cfb 100644
--- a/deps/v8/src/compiler/backend/arm64/code-generator-arm64.cc
+++ b/deps/v8/src/compiler/backend/arm64/code-generator-arm64.cc
@@ -285,7 +285,7 @@ class Arm64OperandConverter final : public InstructionOperandConverter {
     if (offset.from_frame_pointer()) {
       int from_sp = offset.offset() + frame_access_state()->GetSPToFPOffset();
       // Convert FP-offsets to SP-offsets if it results in better code.
-      if (!frame_access_state()->FPRelativeOnly() &&
+      if (!frame_access_state()->frame()->invalidates_sp() &&
           (Assembler::IsImmLSUnscaled(from_sp) ||
            Assembler::IsImmLSScaled(from_sp, 3))) {
         offset = FrameOffset::FromStackPointer(from_sp);
@@ -1169,6 +1169,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ mov(i.OutputRegister(), fp);
       }
       break;
+    case kArchRootPointer:
+      __ mov(i.OutputRegister(), kRootRegister);
+      break;
 #if V8_ENABLE_WEBASSEMBLY
     case kArchStackPointer:
       // The register allocator expects an allocatable register for the output,
@@ -1494,6 +1497,22 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ Mul(i.OutputRegister32(), i.InputRegister32(0), i.InputRegister32(1));
       break;
 #if V8_ENABLE_WEBASSEMBLY
+    case kArm64Bcax: {
+      DCHECK(CpuFeatures::IsSupported(SHA3));
+      CpuFeatureScope scope(masm(), SHA3);
+      __ Bcax(
+          i.OutputSimd128Register().V16B(), i.InputSimd128Register(0).V16B(),
+          i.InputSimd128Register(1).V16B(), i.InputSimd128Register(2).V16B());
+      break;
+    }
+    case kArm64Eor3: {
+      DCHECK(CpuFeatures::IsSupported(SHA3));
+      CpuFeatureScope scope(masm(), SHA3);
+      __ Eor3(
+          i.OutputSimd128Register().V16B(), i.InputSimd128Register(0).V16B(),
+          i.InputSimd128Register(1).V16B(), i.InputSimd128Register(2).V16B());
+      break;
+    }
     case kArm64Sadalp: {
       DCHECK_EQ(i.OutputSimd128Register(), i.InputSimd128Register(0));
       VectorFormat dst_f = VectorFormatFillQ(LaneSizeField::decode(opcode));
@@ -1881,6 +1900,22 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArm64Clz32:
       __ Clz(i.OutputRegister32(), i.InputRegister32(0));
       break;
+    case kArm64Ctz: {
+      DCHECK(CpuFeatures::IsSupported(CSSC));
+
+      CpuFeatureScope scope(masm(), CSSC);
+
+      __ Ctz(i.OutputRegister64(), i.InputRegister64(0));
+      break;
+    }
+    case kArm64Ctz32: {
+      DCHECK(CpuFeatures::IsSupported(CSSC));
+
+      CpuFeatureScope scope(masm(), CSSC);
+
+      __ Ctz(i.OutputRegister32(), i.InputRegister32(0));
+      break;
+    }
     case kArm64Rbit:
       __ Rbit(i.OutputRegister64(), i.InputRegister64(0));
       break;
@@ -1927,7 +1962,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       break;
     case kArm64Float32Cmp:
       if (instr->InputAt(1)->IsFPRegister()) {
-        __ Fcmp(i.InputFloat32Register(0), i.InputFloat32Register(1));
+        __ Fcmp(i.InputFloat32OrFPZeroRegister(0), i.InputFloat32Register(1));
       } else {
         DCHECK(instr->InputAt(1)->IsImmediate());
         // 0.0 is the only immediate supported by fcmp instructions.
@@ -1971,12 +2006,12 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     }
     case kArm64Float64Cmp:
       if (instr->InputAt(1)->IsFPRegister()) {
-        __ Fcmp(i.InputDoubleRegister(0), i.InputDoubleRegister(1));
+        __ Fcmp(i.InputFloat64OrFPZeroRegister(0), i.InputDoubleRegister(1));
       } else {
         DCHECK(instr->InputAt(1)->IsImmediate());
         // 0.0 is the only immediate supported by fcmp instructions.
         DCHECK_EQ(0.0, i.InputDouble(1));
-        __ Fcmp(i.InputDoubleRegister(0), i.InputDouble(1));
+        __ Fcmp(i.InputFloat64Register(0), i.InputDouble(1));
       }
       break;
     case kArm64Float64Add:
@@ -3474,7 +3509,12 @@ void CodeGenerator::AssembleArchBranch(Instruction* instr, BranchInfo* branch) {
     }
   } else {
     Condition cc = FlagsConditionToCondition(condition);
-    __ B(cc, tlabel);
+    if (CpuFeatures::IsSupported(HBC) && branch->hinted) {
+      CpuFeatureScope scope(masm(), HBC);
+      __ Bc(cc, tlabel);
+    } else {
+      __ B(cc, tlabel);
+    }
   }
   if (!branch->fallthru) __ B(flabel);  // no fallthru to flabel.
 }
@@ -3495,7 +3535,13 @@ void CodeGenerator::AssembleArchTrap(Instruction* instr,
   auto ool = zone()->New<WasmOutOfLineTrap>(this, instr);
   Label* tlabel = ool->entry();
   Condition cc = FlagsConditionToCondition(condition);
-  __ B(cc, tlabel);
+  // Assume traps aren't taken, so they're consistent.
+  if (CpuFeatures::IsSupported(HBC)) {
+    CpuFeatureScope scope(masm(), HBC);
+    __ Bc(cc, tlabel);
+  } else {
+    __ B(cc, tlabel);
+  }
 }
 #endif  // V8_ENABLE_WEBASSEMBLY
 
@@ -3512,6 +3558,24 @@ void CodeGenerator::AssembleArchBoolean(Instruction* instr,
   __ Cset(reg, cc);
 }
 
+// Mnemonic  Meaning (INT)           Meaning (FP)            Condition flags
+// EQ        Equal                   Equal                   Z == 1
+// NE        Not equal               Not equal or unordered  Z == 0
+// CS or HS  Carry set               >= or unordered         C == 1
+// CC or LO  Carry clear             <                       C == 0
+// MI        Minus, negative         <                       N == 1
+// PL        Plus, positive or zero  >= or unordered         N == 0
+// VS        Overflow                Unordered               V == 1
+// VC        No overflow             Ordered                 V == 0
+// HI        Unsigned >              > or unordered          C ==1 && Z == 0
+// LS        Unsigned <=             < or equal              !(C ==1 && Z ==0)
+// GE        Signed >=               > or equal              N == V
+// LT        Signed <                < or unordered          N! = V
+// GT        Signed >=               >                       Z == 0 && N == V
+// LE        Signed <=               <= or unordered         !(Z == 0 && N == V)
+// AL        Always                  Always                  Any
+// NV        Always                  Always                  Any
+
 // Given condition, return a value for nzcv which represents it. This is used
 // for the default condition for ccmp.
 inline StatusFlags ConditionToDefaultFlags(Condition condition) {
@@ -3589,11 +3653,21 @@ void AssembleConditionalCompareChain(Instruction* instr, int64_t num_ccmps,
       gen->masm()->Ccmp(i.InputRegister64(compare_lhs_index),
                         i.InputOperand64(compare_rhs_index), default_flags,
                         FlagsConditionToCondition(compare_condition));
-    } else {
-      DCHECK_EQ(code, kArm64Cmp32);
+    } else if (code == kArm64Cmp32) {
       gen->masm()->Ccmp(i.InputRegister32(compare_lhs_index),
                         i.InputOperand32(compare_rhs_index), default_flags,
                         FlagsConditionToCondition(compare_condition));
+    } else if (code == kArm64Float64Cmp) {
+      gen->masm()->Fccmp(i.InputFloat64OrFPZeroRegister(compare_lhs_index),
+                         i.InputFloat64OrFPZeroRegister(compare_rhs_index),
+                         default_flags,
+                         FlagsConditionToCondition(compare_condition));
+    } else {
+      DCHECK_EQ(code, kArm64Float32Cmp);
+      gen->masm()->Fccmp(i.InputFloat32OrFPZeroRegister(compare_lhs_index),
+                         i.InputFloat32OrFPZeroRegister(compare_rhs_index),
+                         default_flags,
+                         FlagsConditionToCondition(compare_condition));
     }
   }
 }
@@ -3719,9 +3793,9 @@ void CodeGenerator::AssembleJumpTable(base::Vector<Label*> targets) {
   const size_t jump_table_size = targets.size() * kInt32Size;
   MacroAssembler::BlockPoolsScope no_pool_inbetween(masm(), jump_table_size);
   int table_pos = __ pc_offset();
-  // Store 32-bit pc-relative offsets.
   for (auto* target : targets) {
-    __ dc32(target->pos() - table_pos);
+    // Store 32-bit pc-relative offsets.
+    __ WriteJumpTableEntry(target, table_pos);
   }
 }
 
diff --git a/deps/v8/src/compiler/backend/arm64/instruction-codes-arm64.h b/deps/v8/src/compiler/backend/arm64/instruction-codes-arm64.h
index 293810bed5d648..cd17cc0510061a 100644
--- a/deps/v8/src/compiler/backend/arm64/instruction-codes-arm64.h
+++ b/deps/v8/src/compiler/backend/arm64/instruction-codes-arm64.h
@@ -226,6 +226,8 @@ namespace compiler {
   V(Arm64Smlal2)                        \
   V(Arm64Sadalp)                        \
   V(Arm64Saddlp)                        \
+  V(Arm64Bcax)                          \
+  V(Arm64Eor3)                          \
   V(Arm64Uadalp)                        \
   V(Arm64Uaddlp)                        \
   V(Arm64Umlal)                         \
@@ -248,6 +250,8 @@ namespace compiler {
   V(Arm64Cnt)                                        \
   V(Arm64Cnt32)                                      \
   V(Arm64Cnt64)                                      \
+  V(Arm64Ctz)                                        \
+  V(Arm64Ctz32)                                      \
   V(Arm64Tst)                                        \
   V(Arm64Tst32)                                      \
   V(Arm64Or)                                         \
diff --git a/deps/v8/src/compiler/backend/arm64/instruction-scheduler-arm64.cc b/deps/v8/src/compiler/backend/arm64/instruction-scheduler-arm64.cc
index b1b995233cc0de..261c1ee658f005 100644
--- a/deps/v8/src/compiler/backend/arm64/instruction-scheduler-arm64.cc
+++ b/deps/v8/src/compiler/backend/arm64/instruction-scheduler-arm64.cc
@@ -21,6 +21,8 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArm64Bic32:
     case kArm64Clz:
     case kArm64Clz32:
+    case kArm64Ctz:
+    case kArm64Ctz32:
     case kArm64Cmp:
     case kArm64Cmp32:
     case kArm64Cmn:
@@ -330,6 +332,8 @@ int InstructionScheduler::GetTargetInstructionFlags(
     case kArm64ISubSatS:
     case kArm64IAddSatU:
     case kArm64ISubSatU:
+    case kArm64Bcax:
+    case kArm64Eor3:
 #endif  // V8_ENABLE_WEBASSEMBLY
     case kArm64TestAndBranch32:
     case kArm64TestAndBranch:
diff --git a/deps/v8/src/compiler/backend/arm64/instruction-selector-arm64.cc b/deps/v8/src/compiler/backend/arm64/instruction-selector-arm64.cc
index baadca1fc90719..e6ceff22b6df36 100644
--- a/deps/v8/src/compiler/backend/arm64/instruction-selector-arm64.cc
+++ b/deps/v8/src/compiler/backend/arm64/instruction-selector-arm64.cc
@@ -564,13 +564,11 @@ void VisitBinopImpl(InstructionSelectorT* selector, OpIndex binop_idx,
                     OpIndex left_node, OpIndex right_node,
                     RegisterRepresentation rep, InstructionCode opcode,
                     ImmediateMode operand_mode, FlagsContinuationT* cont) {
+  DCHECK(!cont->IsConditionalSet() && !cont->IsConditionalBranch());
   Arm64OperandGeneratorT g(selector);
   constexpr uint32_t kMaxFlagSetInputs = 3;
-  constexpr uint32_t kMaxCcmpOperands =
-      FlagsContinuationT::kMaxCompareChainSize * kNumCcmpOperands;
-  constexpr uint32_t kExtraCcmpInputs = 2;
-  constexpr uint32_t kMaxInputs =
-      kMaxFlagSetInputs + kMaxCcmpOperands + kExtraCcmpInputs;
+  constexpr uint32_t kMaxSelectInputs = 2;
+  constexpr uint32_t kMaxInputs = kMaxFlagSetInputs + kMaxSelectInputs;
   InstructionOperand inputs[kMaxInputs];
   size_t input_count = 0;
   InstructionOperand outputs[1];
@@ -581,10 +579,6 @@ void VisitBinopImpl(InstructionSelectorT* selector, OpIndex binop_idx,
   bool must_commute_cond = MustCommuteCondField::decode(properties);
   bool is_add_sub = IsAddSubField::decode(properties);
 
-  // We've already commuted the flags while searching for the pattern.
-  if (cont->IsConditionalSet() || cont->IsConditionalBranch()) {
-    can_commute = false;
-  }
   if (g.CanBeImmediate(right_node, operand_mode)) {
     inputs[input_count++] = g.UseRegister(left_node);
     inputs[input_count++] = g.UseImmediate(right_node);
@@ -635,30 +629,9 @@ void VisitBinopImpl(InstructionSelectorT* selector, OpIndex binop_idx,
     // overwriting the inputs.
     inputs[input_count++] = g.UseRegisterAtEnd(cont->true_value());
     inputs[input_count++] = g.UseRegisterAtEnd(cont->false_value());
-  } else if (cont->IsConditionalSet() || cont->IsConditionalBranch()) {
-    DCHECK_LE(input_count, kMaxInputs);
-    auto& compares = cont->compares();
-    for (unsigned i = 0; i < cont->num_conditional_compares(); ++i) {
-      auto compare = compares[i];
-      inputs[input_count + kCcmpOffsetOfOpcode] = g.TempImmediate(compare.code);
-      inputs[input_count + kCcmpOffsetOfLhs] = g.UseRegisterAtEnd(compare.lhs);
-      if (g.CanBeImmediate(compare.rhs, kConditionalCompareImm)) {
-        inputs[input_count + kCcmpOffsetOfRhs] = g.UseImmediate(compare.rhs);
-      } else {
-        inputs[input_count + kCcmpOffsetOfRhs] =
-            g.UseRegisterAtEnd(compare.rhs);
-      }
-      inputs[input_count + kCcmpOffsetOfDefaultFlags] =
-          g.TempImmediate(compare.default_flags);
-      inputs[input_count + kCcmpOffsetOfCompareCondition] =
-          g.TempImmediate(compare.compare_condition);
-      input_count += kNumCcmpOperands;
-    }
-    inputs[input_count++] = g.TempImmediate(cont->final_condition());
-    inputs[input_count++] =
-        g.TempImmediate(static_cast<int32_t>(cont->num_conditional_compares()));
+  } else if (cont->IsBranch() && cont->hint() != BranchHint::kNone) {
+    opcode |= BranchHintField::encode(true);
   }
-
   DCHECK_NE(0u, input_count);
   DCHECK((output_count != 0) || IsComparisonField::decode(properties));
   DCHECK_GE(arraysize(inputs), input_count);
@@ -749,7 +722,7 @@ int32_t LeftShiftForReducedMultiply(InstructionSelectorT* selector,
 
 // Try to match Add(Mul(x, y), z) and emit Madd(x, y, z) for it.
 template <typename MultiplyOpmaskT>
-bool TryEmitMulitplyAdd(InstructionSelectorT* selector, OpIndex add,
+bool TryEmitMultiplyAdd(InstructionSelectorT* selector, OpIndex add,
                         OpIndex lhs, OpIndex rhs, InstructionCode madd_opcode) {
   const Operation& add_lhs = selector->Get(lhs);
   if (!add_lhs.Is<MultiplyOpmaskT>() || !selector->CanCover(add, lhs)) {
@@ -768,13 +741,13 @@ bool TryEmitMulitplyAdd(InstructionSelectorT* selector, OpIndex add,
 
 bool TryEmitMultiplyAddInt32(InstructionSelectorT* selector, OpIndex add,
                              OpIndex lhs, OpIndex rhs) {
-  return TryEmitMulitplyAdd<Opmask::kWord32Mul>(selector, add, lhs, rhs,
+  return TryEmitMultiplyAdd<Opmask::kWord32Mul>(selector, add, lhs, rhs,
                                                 kArm64Madd32);
 }
 
 bool TryEmitMultiplyAddInt64(InstructionSelectorT* selector, OpIndex add,
                              OpIndex lhs, OpIndex rhs) {
-  return TryEmitMulitplyAdd<Opmask::kWord64Mul>(selector, add, lhs, rhs,
+  return TryEmitMultiplyAdd<Opmask::kWord64Mul>(selector, add, lhs, rhs,
                                                 kArm64Madd);
 }
 
@@ -964,7 +937,7 @@ void EmitLoad(InstructionSelectorT* selector, OpIndex node,
     }
   }
 
-  if (base_op.Is<LoadRootRegisterOp>()) {
+  if (base_op.Is<LoadRootRegisterOp>() && is_index_constant) {
     DCHECK(is_index_constant);
     input_count = 1;
     inputs[0] = g.UseImmediate64(index_constant);
@@ -1468,6 +1441,9 @@ class CompareSequence {
         code, ccmp_condition, default_flags, ccmp_lhs, ccmp_rhs};
     ++num_ccmps_;
   }
+  bool IsFloatCmp() const {
+    return opcode() == kArm64Float32Cmp || opcode() == kArm64Float64Cmp;
+  }
 
  private:
   InstructionCode GetOpcode(RegisterRepresentation rep) const {
@@ -1476,6 +1452,10 @@ class CompareSequence {
         return kArm64Cmp32;
       case RegisterRepresentation::Word64():
         return kArm64Cmp;
+      case RegisterRepresentation::Float32():
+        return kArm64Float32Cmp;
+      case RegisterRepresentation::Float64():
+        return kArm64Float64Cmp;
       default:
         UNREACHABLE();
     }
@@ -1573,6 +1553,18 @@ static std::optional<FlagsCondition> GetFlagsCondition(
         default:
           UNREACHABLE();
       }
+    } else if (comparison->rep == RegisterRepresentation::Float32() ||
+               comparison->rep == RegisterRepresentation::Float64()) {
+      switch (comparison->kind) {
+        case ComparisonOp::Kind::kEqual:
+          return FlagsCondition::kEqual;
+        case ComparisonOp::Kind::kSignedLessThan:
+          return FlagsCondition::kFloatLessThan;
+        case ComparisonOp::Kind::kSignedLessThanOrEqual:
+          return FlagsCondition::kFloatLessThanOrEqual;
+        default:
+          UNREACHABLE();
+      }
     }
   }
   return std::nullopt;
@@ -1831,6 +1823,56 @@ static std::optional<FlagsCondition> TryMatchConditionalCompareChainShared(
   return logic_nodes.back()->user_condition();
 }
 
+static void VisitCompareChain(InstructionSelectorT* selector, OpIndex left_node,
+                              OpIndex right_node, RegisterRepresentation rep,
+                              InstructionCode opcode,
+                              ImmediateMode operand_mode,
+                              FlagsContinuationT* cont) {
+  DCHECK(cont->IsConditionalSet() || cont->IsConditionalBranch());
+  Arm64OperandGeneratorT g(selector);
+  constexpr uint32_t kMaxFlagSetInputs = 2;
+  constexpr uint32_t kMaxCcmpOperands =
+      FlagsContinuationT::kMaxCompareChainSize * kNumCcmpOperands;
+  constexpr uint32_t kExtraCcmpInputs = 2;
+  constexpr uint32_t kMaxInputs =
+      kMaxFlagSetInputs + kMaxCcmpOperands + kExtraCcmpInputs;
+  InstructionOperand inputs[kMaxInputs];
+  size_t input_count = 0;
+
+  if (g.CanBeImmediate(right_node, operand_mode)) {
+    inputs[input_count++] = g.UseRegister(left_node);
+    inputs[input_count++] = g.UseImmediate(right_node);
+  } else {
+    inputs[input_count++] = g.UseRegisterOrImmediateZero(left_node);
+    inputs[input_count++] = g.UseRegister(right_node);
+  }
+
+  auto& compares = cont->compares();
+  for (unsigned i = 0; i < cont->num_conditional_compares(); ++i) {
+    auto compare = compares[i];
+    inputs[input_count + kCcmpOffsetOfOpcode] = g.TempImmediate(compare.code);
+    inputs[input_count + kCcmpOffsetOfLhs] = g.UseRegisterAtEnd(compare.lhs);
+    if ((compare.code == kArm64Cmp32 || compare.code == kArm64Cmp) &&
+        g.CanBeImmediate(compare.rhs, kConditionalCompareImm)) {
+      inputs[input_count + kCcmpOffsetOfRhs] = g.UseImmediate(compare.rhs);
+    } else {
+      inputs[input_count + kCcmpOffsetOfRhs] = g.UseRegisterAtEnd(compare.rhs);
+    }
+    inputs[input_count + kCcmpOffsetOfDefaultFlags] =
+        g.TempImmediate(compare.default_flags);
+    inputs[input_count + kCcmpOffsetOfCompareCondition] =
+        g.TempImmediate(compare.compare_condition);
+    input_count += kNumCcmpOperands;
+  }
+  inputs[input_count++] = g.TempImmediate(cont->final_condition());
+  inputs[input_count++] =
+      g.TempImmediate(static_cast<int32_t>(cont->num_conditional_compares()));
+
+  DCHECK_GE(arraysize(inputs), input_count);
+
+  selector->EmitWithContinuation(opcode, 0, nullptr, input_count, inputs, cont);
+}
+
 static bool TryMatchConditionalCompareChainBranch(
     InstructionSelectorT* selector, Zone* zone, OpIndex node,
     FlagsContinuationT* cont) {
@@ -1848,9 +1890,11 @@ static bool TryMatchConditionalCompareChainBranch(
         sequence.ccmps(), sequence.num_ccmps(), condition, cont->true_block(),
         cont->false_block());
 
-    VisitBinopImpl(selector, sequence.cmp(), sequence.left(), sequence.right(),
-                   selector->Get(sequence.cmp()).Cast<ComparisonOp>().rep,
-                   sequence.opcode(), kArithmeticImm, &new_cont);
+    ImmediateMode imm_mode =
+        sequence.IsFloatCmp() ? kNoImmediate : kArithmeticImm;
+    VisitCompareChain(selector, sequence.left(), sequence.right(),
+                      selector->Get(sequence.cmp()).Cast<ComparisonOp>().rep,
+                      sequence.opcode(), imm_mode, &new_cont);
 
     return true;
   }
@@ -1868,9 +1912,11 @@ static bool TryMatchConditionalCompareChainSet(InstructionSelectorT* selector,
     FlagsContinuationT cont = FlagsContinuationT::ForConditionalSet(
         sequence.ccmps(), sequence.num_ccmps(), final_cond.value(), node);
 
-    VisitBinopImpl(selector, sequence.cmp(), sequence.left(), sequence.right(),
-                   selector->Get(sequence.cmp()).Cast<ComparisonOp>().rep,
-                   sequence.opcode(), kArithmeticImm, &cont);
+    ImmediateMode imm_mode =
+        sequence.IsFloatCmp() ? kNoImmediate : kArithmeticImm;
+    VisitCompareChain(selector, sequence.left(), sequence.right(),
+                      selector->Get(sequence.cmp()).Cast<ComparisonOp>().rep,
+                      sequence.opcode(), imm_mode, &cont);
     return true;
   }
   return false;
@@ -2146,7 +2192,8 @@ void InstructionSelectorT::VisitStackPointerGreaterThan(
   kind = op.kind;
   value = op.stack_limit();
   InstructionCode opcode =
-      kArchStackPointerGreaterThan | MiscField::encode(static_cast<int>(kind));
+      kArchStackPointerGreaterThan |
+      StackCheckField::encode(static_cast<StackCheckKind>(kind));
 
   Arm64OperandGeneratorT g(this);
 
@@ -2477,9 +2524,17 @@ RRR_OP_T_LIST(RRR_VISITOR)
 #undef RRR_VISITOR
 #undef RRR_OP_T_LIST
 
-void InstructionSelectorT::VisitWord32Ctz(OpIndex node) { UNREACHABLE(); }
+void InstructionSelectorT::VisitWord32Ctz(OpIndex node) {
+  DCHECK(CpuFeatures::IsSupported(CSSC));
+
+  VisitRR(this, kArm64Ctz32, node);
+}
 
-void InstructionSelectorT::VisitWord64Ctz(OpIndex node) { UNREACHABLE(); }
+void InstructionSelectorT::VisitWord64Ctz(OpIndex node) {
+  DCHECK(CpuFeatures::IsSupported(CSSC));
+
+  VisitRR(this, kArm64Ctz, node);
+}
 
 void InstructionSelectorT::VisitInt32Add(OpIndex node) {
   const WordBinopOp& add = this->Get(node).Cast<WordBinopOp>();
@@ -3233,6 +3288,10 @@ void EmitBranchOrDeoptimize(InstructionSelectorT* selector,
                             InstructionCode opcode, InstructionOperand value,
                             FlagsContinuationT* cont) {
   DCHECK(cont->IsBranch() || cont->IsDeoptimize());
+  if ((cont->IsBranch() && cont->hint() != BranchHint::kNone) ||
+      cont->IsDeoptimize()) {
+    opcode |= BranchHintField::encode(true);
+  }
   selector->EmitWithContinuation(opcode, value, cont);
 }
 
@@ -4612,8 +4671,7 @@ void InstructionSelectorT::VisitInt64AbsWithOverflow(OpIndex node) {
   V(I16x8RelaxedQ15MulRS, kArm64I16x8Q15MulRSatS) \
   V(I8x16SConvertI16x8, kArm64I8x16SConvertI16x8) \
   V(I8x16UConvertI16x8, kArm64I8x16UConvertI16x8) \
-  V(S128Or, kArm64S128Or)                         \
-  V(S128Xor, kArm64S128Xor)
+  V(S128Or, kArm64S128Or)
 
 #define SIMD_BINOP_LANE_SIZE_LIST(V)                   \
   V(F64x2Min, kArm64FMin, 64)                          \
@@ -5098,8 +5156,38 @@ bool SmlalHelper(InstructionSelectorT* selector, OpIndex node, int lane_size,
   return true;
 }
 
+template <typename OpmaskT>
+bool sha3helper(InstructionSelectorT* selector, OpIndex node,
+                InstructionCode sha3_code) {
+  Arm64OperandGeneratorT g(selector);
+  SimdBinopMatcherTurboshaft m(selector, node);
+  if (!m.InputMatches<OpmaskT>() ||
+      !selector->CanCover(node, m.matched_input())) {
+    return false;
+  }
+  const Operation& matched = selector->Get(m.matched_input());
+  selector->Emit(
+      sha3_code, g.DefineSameAsFirst(node), g.UseRegister(m.other_input()),
+      g.UseRegister(matched.input(0)), g.UseRegister(matched.input(1)));
+  return true;
+}
+
 }  // namespace
 
+void InstructionSelectorT::VisitS128Xor(OpIndex node) {
+  Arm64OperandGeneratorT g(this);
+
+  if (!CpuFeatures::IsSupported(SHA3)) {
+    return VisitRRR(this, kArm64S128Xor, node);
+  }
+
+  if (sha3helper<Opmask::kSimd128AndNot>(this, node, kArm64Bcax) ||
+      sha3helper<Opmask::kSimd128Xor>(this, node, kArm64Eor3))
+    return;
+
+  return VisitRRR(this, kArm64S128Xor, node);
+}
+
 void InstructionSelectorT::VisitI64x2Add(OpIndex node) {
   if (ShraHelper<Opmask::kSimd128I64x2ShrS>(
           this, node, 64, kArm64Ssra, kArm64IAdd | LaneSizeField::encode(64)) ||
@@ -5715,6 +5803,10 @@ InstructionSelector::SupportedMachineOperatorFlags() {
     flags |= MachineOperatorBuilder::kFloat16 |
              MachineOperatorBuilder::kFloat16RawBitsConversion;
   }
+  if (CpuFeatures::IsSupported(CSSC)) {
+    flags |=
+        MachineOperatorBuilder::kWord32Ctz | MachineOperatorBuilder::kWord64Ctz;
+  }
   return flags;
 }
 
diff --git a/deps/v8/src/compiler/backend/code-generator.cc b/deps/v8/src/compiler/backend/code-generator.cc
index 023cee8098e232..b6fa4df98b9864 100644
--- a/deps/v8/src/compiler/backend/code-generator.cc
+++ b/deps/v8/src/compiler/backend/code-generator.cc
@@ -127,7 +127,7 @@ bool CodeGenerator::ShouldApplyOffsetToStackCheck(Instruction* instr,
   DCHECK_EQ(instr->arch_opcode(), kArchStackPointerGreaterThan);
 
   StackCheckKind kind =
-      static_cast<StackCheckKind>(MiscField::decode(instr->opcode()));
+      static_cast<StackCheckKind>(StackCheckField::decode(instr->opcode()));
   if (kind != StackCheckKind::kJSFunctionEntry) return false;
 
   uint32_t stack_check_offset = *offset = GetStackCheckOffset();
@@ -240,20 +240,6 @@ void CodeGenerator::AssembleCode() {
   }
 #endif
 
-#if V8_ENABLE_WEBASSEMBLY
-  if (info->code_kind() == CodeKind::WASM_TO_JS_FUNCTION ||
-      info->builtin() == Builtin::kWasmToJsWrapperCSA ||
-      wasm::BuiltinLookup::IsWasmBuiltinId(info->builtin())) {
-    // By default the code generator can convert slot IDs to SP-relative memory
-    // operands depending on the offset if the encoding is more efficient.
-    // However the SP may switch to the central stack for wasm-to-js wrappers
-    // and wasm builtins, so disable this optimization there.
-    // TODO(thibaudm): Disable this more selectively, only wasm builtins that
-    // call JS builtins can switch, and only around the call site.
-    frame_access_state()->SetFPRelativeOnly(true);
-  }
-#endif
-
   offsets_info_.deopt_check = masm()->pc_offset();
   // We want to bailout only from JS functions, which are the only ones
   // that are optimized.
@@ -321,7 +307,7 @@ void CodeGenerator::AssembleCode() {
     masm()->bind(GetLabel(current_block_));
 
 #ifdef V8_ENABLE_CONTROL_FLOW_INTEGRITY
-    if (block->IsSwitchTarget()) {
+    if (block->IsTableSwitchTarget()) {
       masm()->JumpTarget();
     }
 #endif
@@ -435,7 +421,7 @@ void CodeGenerator::AssembleCode() {
     }
   }
 
-  // The LinuxPerfJitLogger logs code up until here, excluding the safepoint
+  // The PerfJitLogger logs code up until here, excluding the safepoint
   // table. Resolve the unwinding info now so it is aware of the same code
   // size as reported by perf.
   unwinding_info_writer_.Finish(masm()->pc_offset());
@@ -761,6 +747,7 @@ RpoNumber CodeGenerator::ComputeBranchInfo(BranchInfo* branch,
   branch->condition = condition;
   branch->true_label = GetLabel(true_rpo);
   branch->false_label = GetLabel(false_rpo);
+  branch->hinted = static_cast<bool>(BranchHintField::decode(instr->opcode()));
   branch->fallthru = IsNextInAssemblyOrder(false_rpo);
   return RpoNumber::Invalid();
 }
@@ -848,6 +835,7 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleInstruction(
       branch.condition = condition;
       branch.true_label = exit->label();
       branch.false_label = exit->continue_label();
+      branch.hinted = true;
       branch.fallthru = true;
       AssembleArchDeoptBranch(instr, &branch);
       masm()->bind(exit->continue_label());
diff --git a/deps/v8/src/compiler/backend/code-generator.h b/deps/v8/src/compiler/backend/code-generator.h
index da9f56c2a0c6ef..897fc4cf84cc5b 100644
--- a/deps/v8/src/compiler/backend/code-generator.h
+++ b/deps/v8/src/compiler/backend/code-generator.h
@@ -36,6 +36,9 @@ struct BranchInfo {
   FlagsCondition condition;
   Label* true_label;
   Label* false_label;
+  // Whether there a hint that this branch is unlikely to change direction,
+  // such as a WebAssembly hinted branch or a trap.
+  bool hinted;
   bool fallthru;
 };
 
diff --git a/deps/v8/src/compiler/backend/ia32/code-generator-ia32.cc b/deps/v8/src/compiler/backend/ia32/code-generator-ia32.cc
index 74f78731fb1700..9d43ddf79fd3f8 100644
--- a/deps/v8/src/compiler/backend/ia32/code-generator-ia32.cc
+++ b/deps/v8/src/compiler/backend/ia32/code-generator-ia32.cc
@@ -938,6 +938,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ mov(i.OutputRegister(), ebp);
       }
       break;
+    case kArchRootPointer:
+      __ mov(i.OutputRegister(), kRootRegister);
+      break;
 #if V8_ENABLE_WEBASSEMBLY
     case kArchStackPointer:
       __ mov(i.OutputRegister(), esp);
diff --git a/deps/v8/src/compiler/backend/ia32/instruction-selector-ia32.cc b/deps/v8/src/compiler/backend/ia32/instruction-selector-ia32.cc
index 6e9376af00c3e1..06b5e462fe9acd 100644
--- a/deps/v8/src/compiler/backend/ia32/instruction-selector-ia32.cc
+++ b/deps/v8/src/compiler/backend/ia32/instruction-selector-ia32.cc
@@ -501,8 +501,8 @@ class IA32OperandGeneratorT final : public OperandGeneratorT {
     auto m = TryMatchBaseWithScaledIndexAndDisplacement(selector(), node);
     DCHECK(m.has_value());
     if (m->base.valid() &&
-        this->Get(m->base).template Is<LoadRootRegisterOp>()) {
-      DCHECK(!m->index.valid());
+        this->Get(m->base).template Is<LoadRootRegisterOp>() &&
+        !m->index.valid()) {
       DCHECK_EQ(m->scale, 0);
       DCHECK(ValueFitsIntoImmediate(m->displacement));
       inputs[(*input_count)++] =
@@ -590,7 +590,7 @@ ArchOpcode GetLoadOpcode(LoadRepresentation load_rep) {
 
 void VisitRO(InstructionSelectorT* selector, OpIndex node, ArchOpcode opcode) {
   IA32OperandGeneratorT g(selector);
-  OpIndex input = selector->input_at(node, 0);
+  OpIndex input = selector->Get(node).input(0);
   // We have to use a byte register as input to movsxb.
   InstructionOperand input_op =
       opcode == kIA32Movsxbl ? g.UseFixed(input, eax) : g.Use(input);
@@ -600,32 +600,34 @@ void VisitRO(InstructionSelectorT* selector, OpIndex node, ArchOpcode opcode) {
 void VisitROWithTemp(InstructionSelectorT* selector, OpIndex node,
                      ArchOpcode opcode) {
   IA32OperandGeneratorT g(selector);
+  OpIndex input = selector->Get(node).input(0);
   InstructionOperand temps[] = {g.TempRegister()};
-  selector->Emit(opcode, g.DefineAsRegister(node),
-                 g.Use(selector->input_at(node, 0)), arraysize(temps), temps);
+  selector->Emit(opcode, g.DefineAsRegister(node), g.Use(input),
+                 arraysize(temps), temps);
 }
 
 void VisitROWithTempSimd(InstructionSelectorT* selector, OpIndex node,
                          ArchOpcode opcode) {
   IA32OperandGeneratorT g(selector);
+  OpIndex input = selector->Get(node).input(0);
   InstructionOperand temps[] = {g.TempSimd128Register()};
-  selector->Emit(opcode, g.DefineAsRegister(node),
-                 g.UseUniqueRegister(selector->input_at(node, 0)),
+  selector->Emit(opcode, g.DefineAsRegister(node), g.UseUniqueRegister(input),
                  arraysize(temps), temps);
 }
 
 void VisitRR(InstructionSelectorT* selector, OpIndex node,
              InstructionCode opcode) {
   IA32OperandGeneratorT g(selector);
-  selector->Emit(opcode, g.DefineAsRegister(node),
-                 g.UseRegister(selector->input_at(node, 0)));
+  OpIndex input = selector->Get(node).input(0);
+  selector->Emit(opcode, g.DefineAsRegister(node), g.UseRegister(input));
 }
 
 void VisitRROFloat(InstructionSelectorT* selector, OpIndex node,
                    ArchOpcode opcode) {
   IA32OperandGeneratorT g(selector);
-  InstructionOperand operand0 = g.UseRegister(selector->input_at(node, 0));
-  InstructionOperand operand1 = g.Use(selector->input_at(node, 1));
+  const Operation& op = selector->Get(node);
+  InstructionOperand operand0 = g.UseRegister(op.input(0));
+  InstructionOperand operand1 = g.Use(op.input(1));
   if (selector->IsSupported(AVX)) {
     selector->Emit(opcode, g.DefineAsRegister(node), operand0, operand1);
   } else {
@@ -655,7 +657,7 @@ void VisitFloatUnop(InstructionSelectorT* selector, OpIndex node, OpIndex input,
 void VisitRRSimd(InstructionSelectorT* selector, OpIndex node,
                  ArchOpcode avx_opcode, ArchOpcode sse_opcode) {
   IA32OperandGeneratorT g(selector);
-  InstructionOperand operand0 = g.UseRegister(selector->input_at(node, 0));
+  InstructionOperand operand0 = g.UseRegister(selector->Get(node).input(0));
   if (selector->IsSupported(AVX)) {
     selector->Emit(avx_opcode, g.DefineAsRegister(node), operand0);
   } else {
@@ -675,24 +677,26 @@ void VisitRRSimd(InstructionSelectorT* selector, OpIndex node,
 void VisitRROSimd(InstructionSelectorT* selector, OpIndex node,
                   ArchOpcode avx_opcode, ArchOpcode sse_opcode) {
   IA32OperandGeneratorT g(selector);
-  InstructionOperand operand0 = g.UseRegister(selector->input_at(node, 0));
+  const Operation& op = selector->Get(node);
+  InstructionOperand operand0 = g.UseRegister(op.input(0));
   if (selector->IsSupported(AVX)) {
     selector->Emit(avx_opcode, g.DefineAsRegister(node), operand0,
-                   g.UseRegister(selector->input_at(node, 1)));
+                   g.UseRegister(op.input(1)));
   } else {
     selector->Emit(sse_opcode, g.DefineSameAsFirst(node), operand0,
-                   g.UseRegister(selector->input_at(node, 1)));
+                   g.UseRegister(op.input(1)));
   }
 }
 
 void VisitRRRSimd(InstructionSelectorT* selector, OpIndex node,
                   ArchOpcode opcode) {
   IA32OperandGeneratorT g(selector);
+  const Operation& op = selector->Get(node);
   InstructionOperand dst = selector->IsSupported(AVX)
                                ? g.DefineAsRegister(node)
                                : g.DefineSameAsFirst(node);
-  InstructionOperand operand0 = g.UseRegister(selector->input_at(node, 0));
-  InstructionOperand operand1 = g.UseRegister(selector->input_at(node, 1));
+  InstructionOperand operand0 = g.UseRegister(op.input(0));
+  InstructionOperand operand1 = g.UseRegister(op.input(1));
   selector->Emit(opcode, dst, operand0, operand1);
 }
 
@@ -705,7 +709,7 @@ int32_t GetSimdLaneConstant(InstructionSelectorT* selector, OpIndex node) {
 void VisitRRISimd(InstructionSelectorT* selector, OpIndex node,
                   ArchOpcode opcode) {
   IA32OperandGeneratorT g(selector);
-  InstructionOperand operand0 = g.UseRegister(selector->input_at(node, 0));
+  InstructionOperand operand0 = g.UseRegister(selector->Get(node).input(0));
   InstructionOperand operand1 =
       g.UseImmediate(GetSimdLaneConstant(selector, node));
   // 8x16 uses movsx_b on dest to extract a byte, which only works
@@ -719,7 +723,7 @@ void VisitRRISimd(InstructionSelectorT* selector, OpIndex node,
 void VisitRRISimd(InstructionSelectorT* selector, OpIndex node,
                   ArchOpcode avx_opcode, ArchOpcode sse_opcode) {
   IA32OperandGeneratorT g(selector);
-  InstructionOperand operand0 = g.UseRegister(selector->input_at(node, 0));
+  InstructionOperand operand0 = g.UseRegister(selector->Get(node).input(0));
   InstructionOperand operand1 =
       g.UseImmediate(GetSimdLaneConstant(selector, node));
   if (selector->IsSupported(AVX)) {
@@ -732,15 +736,13 @@ void VisitRRISimd(InstructionSelectorT* selector, OpIndex node,
 void VisitRROSimdShift(InstructionSelectorT* selector, OpIndex node,
                        ArchOpcode opcode) {
   IA32OperandGeneratorT g(selector);
-  if (g.CanBeImmediate(selector->input_at(node, 1))) {
+  const Operation& op = selector->Get(node);
+  if (g.CanBeImmediate(op.input(1))) {
     selector->Emit(opcode, g.DefineSameAsFirst(node),
-                   g.UseRegister(selector->input_at(node, 0)),
-                   g.UseImmediate(selector->input_at(node, 1)));
+                   g.UseRegister(op.input(0)), g.UseImmediate(op.input(1)));
   } else {
-    InstructionOperand operand0 =
-        g.UseUniqueRegister(selector->input_at(node, 0));
-    InstructionOperand operand1 =
-        g.UseUniqueRegister(selector->input_at(node, 1));
+    InstructionOperand operand0 = g.UseUniqueRegister(op.input(0));
+    InstructionOperand operand1 = g.UseUniqueRegister(op.input(1));
     InstructionOperand temps[] = {g.TempSimd128Register(), g.TempRegister()};
     selector->Emit(opcode, g.DefineSameAsFirst(node), operand0, operand1,
                    arraysize(temps), temps);
@@ -750,34 +752,31 @@ void VisitRROSimdShift(InstructionSelectorT* selector, OpIndex node,
 void VisitRRRR(InstructionSelectorT* selector, OpIndex node,
                InstructionCode opcode) {
   IA32OperandGeneratorT g(selector);
-  selector->Emit(opcode, g.DefineAsRegister(node),
-                 g.UseRegister(selector->input_at(node, 0)),
-                 g.UseRegister(selector->input_at(node, 1)),
-                 g.UseRegister(selector->input_at(node, 2)));
+  const Operation& op = selector->Get(node);
+  selector->Emit(opcode, g.DefineAsRegister(node), g.UseRegister(op.input(0)),
+                 g.UseRegister(op.input(1)), g.UseRegister(op.input(2)));
 }
 
 void VisitI8x16Shift(InstructionSelectorT* selector, OpIndex node,
                      ArchOpcode opcode) {
   IA32OperandGeneratorT g(selector);
+  const Simd128ShiftOp& op = selector->Cast<Simd128ShiftOp>(node);
   InstructionOperand output = CpuFeatures::IsSupported(AVX)
                                   ? g.UseRegister(node)
                                   : g.DefineSameAsFirst(node);
 
-  if (g.CanBeImmediate(selector->input_at(node, 1))) {
+  if (g.CanBeImmediate(op.shift())) {
     if (opcode == kIA32I8x16ShrS) {
-      selector->Emit(opcode, output, g.UseRegister(selector->input_at(node, 0)),
-                     g.UseImmediate(selector->input_at(node, 1)));
+      selector->Emit(opcode, output, g.UseRegister(op.input()),
+                     g.UseImmediate(op.shift()));
     } else {
       InstructionOperand temps[] = {g.TempRegister()};
-      selector->Emit(opcode, output, g.UseRegister(selector->input_at(node, 0)),
-                     g.UseImmediate(selector->input_at(node, 1)),
-                     arraysize(temps), temps);
+      selector->Emit(opcode, output, g.UseRegister(op.input()),
+                     g.UseImmediate(op.shift()), arraysize(temps), temps);
     }
   } else {
-    InstructionOperand operand0 =
-        g.UseUniqueRegister(selector->input_at(node, 0));
-    InstructionOperand operand1 =
-        g.UseUniqueRegister(selector->input_at(node, 1));
+    InstructionOperand operand0 = g.UseUniqueRegister(op.input());
+    InstructionOperand operand1 = g.UseUniqueRegister(op.shift());
     InstructionOperand temps[] = {g.TempRegister(), g.TempSimd128Register()};
     selector->Emit(opcode, output, operand0, operand1, arraysize(temps), temps);
   }
@@ -798,8 +797,8 @@ void InstructionSelectorT::VisitStackSlot(OpIndex node) {
 
 void InstructionSelectorT::VisitAbortCSADcheck(OpIndex node) {
   IA32OperandGeneratorT g(this);
-  Emit(kArchAbortCSADcheck, g.NoOutput(),
-       g.UseFixed(this->input_at(node, 0), edx));
+  const AbortCSADcheckOp& op = Cast<AbortCSADcheckOp>(node);
+  Emit(kArchAbortCSADcheck, g.NoOutput(), g.UseFixed(op.message(), edx));
 }
 
 #if V8_ENABLE_WEBASSEMBLY
@@ -807,8 +806,7 @@ void InstructionSelectorT::VisitAbortCSADcheck(OpIndex node) {
 void InstructionSelectorT::VisitLoadLane(OpIndex node) {
   InstructionCode opcode;
   int lane;
-  const Simd128LaneMemoryOp& load =
-      this->Get(node).template Cast<Simd128LaneMemoryOp>();
+  const Simd128LaneMemoryOp& load = Cast<Simd128LaneMemoryOp>(node);
   lane = load.lane;
   switch (load.lane_kind) {
     case Simd128LaneMemoryOp::LaneKind::k8:
@@ -845,7 +843,7 @@ void InstructionSelectorT::VisitLoadLane(OpIndex node) {
     InstructionOperand inputs[5];
     size_t input_count = 0;
 
-    inputs[input_count++] = g.UseRegister(this->input_at(node, 2));
+    inputs[input_count++] = g.UseRegister(load.value());
     inputs[input_count++] = g.UseImmediate(lane);
 
     AddressingMode mode =
@@ -988,17 +986,14 @@ ArchOpcode GetSeqCstStoreOpcode(MachineRepresentation rep) {
 void VisitAtomicExchange(InstructionSelectorT* selector, OpIndex node,
                          ArchOpcode opcode, MachineRepresentation rep) {
   IA32OperandGeneratorT g(selector);
-  OpIndex base = selector->input_at(node, 0);
-  OpIndex index = selector->input_at(node, 1);
-  OpIndex value = selector->input_at(node, 2);
-
+  const AtomicRMWOp& op = selector->Cast<AtomicRMWOp>(node);
   AddressingMode addressing_mode;
   InstructionOperand value_operand = (rep == MachineRepresentation::kWord8)
-                                         ? g.UseFixed(value, edx)
-                                         : g.UseUniqueRegister(value);
+                                         ? g.UseFixed(op.value(), edx)
+                                         : g.UseUniqueRegister(op.value());
   InstructionOperand inputs[] = {
-      value_operand, g.UseUniqueRegister(base),
-      g.GetEffectiveIndexOperand(index, &addressing_mode)};
+      value_operand, g.UseUniqueRegister(op.base()),
+      g.GetEffectiveIndexOperand(op.index(), &addressing_mode)};
   InstructionOperand outputs[] = {
       (rep == MachineRepresentation::kWord8)
           // Using DefineSameAsFirst requires the register to be unallocated.
@@ -1118,8 +1113,7 @@ void InstructionSelectorT::VisitStoreLane(OpIndex node) {
   IA32OperandGeneratorT g(this);
   InstructionCode opcode = kArchNop;
   int lane;
-  const Simd128LaneMemoryOp& store =
-      this->Get(node).template Cast<Simd128LaneMemoryOp>();
+  const Simd128LaneMemoryOp& store = Cast<Simd128LaneMemoryOp>(node);
   lane = store.lane;
   switch (store.lane_kind) {
     case Simd128LaneMemoryOp::LaneKind::k8:
@@ -1147,7 +1141,7 @@ void InstructionSelectorT::VisitStoreLane(OpIndex node) {
       g.GetEffectiveAddressMemoryOperand(node, inputs, &input_count);
   opcode |= AddressingModeField::encode(addressing_mode);
 
-  InstructionOperand value_operand = g.UseRegister(this->input_at(node, 2));
+  InstructionOperand value_operand = g.UseRegister(store.value());
   inputs[input_count++] = value_operand;
   inputs[input_count++] = g.UseImmediate(lane);
   DCHECK_GE(4, input_count);
@@ -1167,8 +1161,8 @@ namespace {
 void VisitBinop(InstructionSelectorT* selector, OpIndex node,
                 InstructionCode opcode, FlagsContinuationT* cont) {
   IA32OperandGeneratorT g(selector);
-  auto left = selector->input_at(node, 0);
-  auto right = selector->input_at(node, 1);
+
+  auto [left, right] = selector->Inputs<2>(node);
   InstructionOperand inputs[6];
   size_t input_count = 0;
   InstructionOperand outputs[1];
@@ -1248,11 +1242,11 @@ void InstructionSelectorT::VisitWord32Xor(OpIndex node) {
 
 void InstructionSelectorT::VisitStackPointerGreaterThan(
     OpIndex node, FlagsContinuation* cont) {
-  StackCheckKind kind =
-      this->Get(node).template Cast<StackPointerGreaterThanOp>().kind;
+  const StackPointerGreaterThanOp& op = Cast<StackPointerGreaterThanOp>(node);
   {  // Temporary scope to minimize indentation change churn below.
-    InstructionCode opcode = kArchStackPointerGreaterThan |
-                             MiscField::encode(static_cast<int>(kind));
+    InstructionCode opcode =
+        kArchStackPointerGreaterThan |
+        StackCheckField::encode(static_cast<StackCheckKind>(op.kind));
 
     int effect_level = GetEffectLevel(node, cont);
 
@@ -1266,12 +1260,13 @@ void InstructionSelectorT::VisitStackPointerGreaterThan(
     // are only applied to the first stack check. If applying an offset, we must
     // ensure the input and temp registers do not alias, thus kUniqueRegister.
     InstructionOperand temps[] = {g.TempRegister()};
-    const int temp_count = (kind == StackCheckKind::kJSFunctionEntry) ? 1 : 0;
-    const auto register_mode = (kind == StackCheckKind::kJSFunctionEntry)
+    const int temp_count =
+        (op.kind == StackCheckKind::kJSFunctionEntry) ? 1 : 0;
+    const auto register_mode = (op.kind == StackCheckKind::kJSFunctionEntry)
                                    ? OperandGenerator::kUniqueRegister
                                    : OperandGenerator::kRegister;
 
-    OpIndex value = this->input_at(node, 0);
+    OpIndex value = op.stack_limit();
     if (g.CanBeMemoryOperand(kIA32Cmp, node, value, effect_level)) {
       DCHECK(this->IsLoadOrLoadImmutable(value));
 
@@ -1301,15 +1296,14 @@ void InstructionSelectorT::VisitStackPointerGreaterThan(
 static inline void VisitShift(InstructionSelectorT* selector, OpIndex node,
                               ArchOpcode opcode) {
   IA32OperandGeneratorT g(selector);
-  auto left = selector->input_at(node, 0);
-  auto right = selector->input_at(node, 1);
+  const ShiftOp& op = selector->Cast<ShiftOp>(node);
 
-  if (g.CanBeImmediate(right)) {
-    selector->Emit(opcode, g.DefineSameAsFirst(node), g.UseRegister(left),
-                   g.UseImmediate(right));
+  if (g.CanBeImmediate(op.right())) {
+    selector->Emit(opcode, g.DefineSameAsFirst(node), g.UseRegister(op.left()),
+                   g.UseImmediate(op.right()));
   } else {
-    selector->Emit(opcode, g.DefineSameAsFirst(node), g.UseRegister(left),
-                   g.UseFixed(right, ecx));
+    selector->Emit(opcode, g.DefineSameAsFirst(node), g.UseRegister(op.left()),
+                   g.UseFixed(op.right(), ecx));
   }
 }
 
@@ -1318,29 +1312,26 @@ namespace {
 void VisitMulHigh(InstructionSelectorT* selector, OpIndex node,
                   ArchOpcode opcode) {
   IA32OperandGeneratorT g(selector);
+  const WordBinopOp& op = selector->Cast<WordBinopOp>(node);
   InstructionOperand temps[] = {g.TempRegister(eax)};
-  selector->Emit(opcode, g.DefineAsFixed(node, edx),
-                 g.UseFixed(selector->input_at(node, 0), eax),
-                 g.UseUniqueRegister(selector->input_at(node, 1)),
-                 arraysize(temps), temps);
+  selector->Emit(opcode, g.DefineAsFixed(node, edx), g.UseFixed(op.left(), eax),
+                 g.UseUniqueRegister(op.right()), arraysize(temps), temps);
 }
 
 void VisitDiv(InstructionSelectorT* selector, OpIndex node, ArchOpcode opcode) {
   IA32OperandGeneratorT g(selector);
+  const WordBinopOp& op = selector->Cast<WordBinopOp>(node);
   InstructionOperand temps[] = {g.TempRegister(edx)};
-  selector->Emit(opcode, g.DefineAsFixed(node, eax),
-                 g.UseFixed(selector->input_at(node, 0), eax),
-                 g.UseUnique(selector->input_at(node, 1)), arraysize(temps),
-                 temps);
+  selector->Emit(opcode, g.DefineAsFixed(node, eax), g.UseFixed(op.left(), eax),
+                 g.UseUnique(op.right()), arraysize(temps), temps);
 }
 
 void VisitMod(InstructionSelectorT* selector, OpIndex node, ArchOpcode opcode) {
   IA32OperandGeneratorT g(selector);
+  const WordBinopOp& op = selector->Cast<WordBinopOp>(node);
   InstructionOperand temps[] = {g.TempRegister(eax)};
-  selector->Emit(opcode, g.DefineAsFixed(node, edx),
-                 g.UseFixed(selector->input_at(node, 0), eax),
-                 g.UseUnique(selector->input_at(node, 1)), arraysize(temps),
-                 temps);
+  selector->Emit(opcode, g.DefineAsFixed(node, edx), g.UseFixed(op.left(), eax),
+                 g.UseUnique(op.right()), arraysize(temps), temps);
 }
 
 // {Displacement} is either OpIndex or int32_t.
@@ -1386,16 +1377,16 @@ void InstructionSelectorT::VisitWord32Sar(OpIndex node) {
 
 void InstructionSelectorT::VisitInt32PairAdd(OpIndex node) {
   IA32OperandGeneratorT g(this);
+  const Word32PairBinopOp& op = Cast<Word32PairBinopOp>(node);
 
   OptionalOpIndex projection1 = FindProjection(node, 1);
   if (projection1.valid()) {
     // We use UseUniqueRegister here to avoid register sharing with the temp
     // register.
     InstructionOperand inputs[] = {
-        g.UseRegister(this->input_at(node, 0)),
-        g.UseUniqueRegisterOrSlotOrConstant(this->input_at(node, 1)),
-        g.UseRegister(this->input_at(node, 2)),
-        g.UseUniqueRegister(this->input_at(node, 3))};
+        g.UseRegister(op.left_low()),
+        g.UseUniqueRegisterOrSlotOrConstant(op.left_high()),
+        g.UseRegister(op.right_low()), g.UseUniqueRegister(op.right_high())};
 
     InstructionOperand outputs[] = {g.DefineSameAsFirst(node),
                                     g.DefineAsRegister(projection1.value())};
@@ -1406,24 +1397,23 @@ void InstructionSelectorT::VisitInt32PairAdd(OpIndex node) {
   } else {
     // The high word of the result is not used, so we emit the standard 32 bit
     // instruction.
-    Emit(kIA32Add, g.DefineSameAsFirst(node),
-         g.UseRegister(this->input_at(node, 0)),
-         g.Use(this->input_at(node, 2)));
+    Emit(kIA32Add, g.DefineSameAsFirst(node), g.UseRegister(op.left_low()),
+         g.Use(op.right_low()));
   }
 }
 
 void InstructionSelectorT::VisitInt32PairSub(OpIndex node) {
   IA32OperandGeneratorT g(this);
+  const Word32PairBinopOp& op = Cast<Word32PairBinopOp>(node);
 
   OptionalOpIndex projection1 = FindProjection(node, 1);
   if (projection1.valid()) {
     // We use UseUniqueRegister here to avoid register sharing with the temp
     // register.
     InstructionOperand inputs[] = {
-        g.UseRegister(this->input_at(node, 0)),
-        g.UseUniqueRegisterOrSlotOrConstant(this->input_at(node, 1)),
-        g.UseRegister(this->input_at(node, 2)),
-        g.UseUniqueRegister(this->input_at(node, 3))};
+        g.UseRegister(op.left_low()),
+        g.UseUniqueRegisterOrSlotOrConstant(op.left_high()),
+        g.UseRegister(op.right_low()), g.UseUniqueRegister(op.right_high())};
 
     InstructionOperand outputs[] = {g.DefineSameAsFirst(node),
                                     g.DefineAsRegister(projection1.value())};
@@ -1434,24 +1424,23 @@ void InstructionSelectorT::VisitInt32PairSub(OpIndex node) {
   } else {
     // The high word of the result is not used, so we emit the standard 32 bit
     // instruction.
-    Emit(kIA32Sub, g.DefineSameAsFirst(node),
-         g.UseRegister(this->input_at(node, 0)),
-         g.Use(this->input_at(node, 2)));
+    Emit(kIA32Sub, g.DefineSameAsFirst(node), g.UseRegister(op.left_low()),
+         g.Use(op.right_low()));
   }
 }
 
 void InstructionSelectorT::VisitInt32PairMul(OpIndex node) {
   IA32OperandGeneratorT g(this);
+  const Word32PairBinopOp& op = Cast<Word32PairBinopOp>(node);
 
   OptionalOpIndex projection1 = FindProjection(node, 1);
   if (projection1.valid()) {
     // InputAt(3) explicitly shares ecx with OutputRegister(1) to save one
     // register and one mov instruction.
     InstructionOperand inputs[] = {
-        g.UseUnique(this->input_at(node, 0)),
-        g.UseUniqueRegisterOrSlotOrConstant(this->input_at(node, 1)),
-        g.UseUniqueRegister(this->input_at(node, 2)),
-        g.UseFixed(this->input_at(node, 3), ecx)};
+        g.UseUnique(op.left_low()),
+        g.UseUniqueRegisterOrSlotOrConstant(op.left_high()),
+        g.UseUniqueRegister(op.right_low()), g.UseFixed(op.right_high(), ecx)};
 
     InstructionOperand outputs[] = {g.DefineAsFixed(node, eax),
                                     g.DefineAsFixed(projection1.value(), ecx)};
@@ -1462,25 +1451,25 @@ void InstructionSelectorT::VisitInt32PairMul(OpIndex node) {
   } else {
     // The high word of the result is not used, so we emit the standard 32 bit
     // instruction.
-    Emit(kIA32Imul, g.DefineSameAsFirst(node),
-         g.UseRegister(this->input_at(node, 0)),
-         g.Use(this->input_at(node, 2)));
+    Emit(kIA32Imul, g.DefineSameAsFirst(node), g.UseRegister(op.left_low()),
+         g.Use(op.right_low()));
   }
 }
 
 void VisitWord32PairShift(InstructionSelectorT* selector,
                           InstructionCode opcode, OpIndex node) {
   IA32OperandGeneratorT g(selector);
+  const Word32PairBinopOp& op = selector->Cast<Word32PairBinopOp>(node);
 
-  OpIndex shift = selector->input_at(node, 2);
+  OpIndex shift = op.right_low();
   InstructionOperand shift_operand;
   if (g.CanBeImmediate(shift)) {
     shift_operand = g.UseImmediate(shift);
   } else {
     shift_operand = g.UseFixed(shift, ecx);
   }
-  InstructionOperand inputs[] = {g.UseFixed(selector->input_at(node, 0), eax),
-                                 g.UseFixed(selector->input_at(node, 1), edx),
+  InstructionOperand inputs[] = {g.UseFixed(op.left_low(), eax),
+                                 g.UseFixed(op.left_high(), edx),
                                  shift_operand};
 
   InstructionOperand outputs[2];
@@ -1629,10 +1618,10 @@ RRO_FLOAT_OP_T_LIST(RRO_FLOAT_VISITOR)
 #undef RRO_FLOAT_VISITOR
 #undef RRO_FLOAT_OP_T_LIST
 
-#define FLOAT_UNOP_VISITOR(Name, opcode)                         \
-  void InstructionSelectorT::Visit##Name(OpIndex node) {         \
-    DCHECK_EQ(this->value_input_count(node), 1);                 \
-    VisitFloatUnop(this, node, this->input_at(node, 0), opcode); \
+#define FLOAT_UNOP_VISITOR(Name, opcode)                    \
+  void InstructionSelectorT::Visit##Name(OpIndex node) {    \
+    DCHECK_EQ(Get(node).input_count, 1);                    \
+    VisitFloatUnop(this, node, Get(node).input(0), opcode); \
   }
 FLOAT_UNOP_T_LIST(FLOAT_UNOP_VISITOR)
 #undef FLOAT_UNOP_VISITOR
@@ -1656,9 +1645,8 @@ void InstructionSelectorT::VisitWord64ReverseBytes(OpIndex node) {
 
 void InstructionSelectorT::VisitWord32ReverseBytes(OpIndex node) {
   IA32OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
-  Emit(kIA32Bswap, g.DefineSameAsFirst(node),
-       g.UseRegister(this->input_at(node, 0)));
+  const WordUnaryOp& op = Cast<WordUnaryOp>(node);
+  Emit(kIA32Bswap, g.DefineSameAsFirst(node), g.UseRegister(op.input()));
 }
 
 void InstructionSelectorT::VisitSimd128ReverseBytes(OpIndex node) {
@@ -1700,8 +1688,7 @@ void InstructionSelectorT::VisitInt32Mul(OpIndex node) {
     return;
   }
   IA32OperandGeneratorT g(this);
-  auto left = this->input_at(node, 0);
-  auto right = this->input_at(node, 1);
+  auto [left, right] = Inputs<WordBinopOp>(node);
   if (g.CanBeImmediate(right)) {
     Emit(kIA32Imul, g.DefineAsRegister(node), g.Use(left),
          g.UseImmediate(right));
@@ -1742,47 +1729,47 @@ void InstructionSelectorT::VisitRoundUint32ToFloat32(OpIndex node) {
   IA32OperandGeneratorT g(this);
   InstructionOperand temps[] = {g.TempRegister()};
   Emit(kIA32Uint32ToFloat32, g.DefineAsRegister(node),
-       g.Use(this->input_at(node, 0)), arraysize(temps), temps);
+       g.Use(Cast<ChangeOp>(node).input()), arraysize(temps), temps);
 }
 
 void InstructionSelectorT::VisitFloat64Mod(OpIndex node) {
   IA32OperandGeneratorT g(this);
+  auto [left, right] = Inputs<FloatBinopOp>(node);
   InstructionOperand temps[] = {g.TempRegister(eax), g.TempRegister()};
-  Emit(kIA32Float64Mod, g.DefineSameAsFirst(node),
-       g.UseRegister(this->input_at(node, 0)),
-       g.UseRegister(this->input_at(node, 1)), arraysize(temps), temps);
+  Emit(kIA32Float64Mod, g.DefineSameAsFirst(node), g.UseRegister(left),
+       g.UseRegister(right), arraysize(temps), temps);
 }
 
 void InstructionSelectorT::VisitFloat32Max(OpIndex node) {
   IA32OperandGeneratorT g(this);
+  auto [left, right] = Inputs<FloatBinopOp>(node);
   InstructionOperand temps[] = {g.TempRegister()};
-  Emit(kIA32Float32Max, g.DefineSameAsFirst(node),
-       g.UseRegister(this->input_at(node, 0)), g.Use(this->input_at(node, 1)),
-       arraysize(temps), temps);
+  Emit(kIA32Float32Max, g.DefineSameAsFirst(node), g.UseRegister(left),
+       g.Use(right), arraysize(temps), temps);
 }
 
 void InstructionSelectorT::VisitFloat64Max(OpIndex node) {
   IA32OperandGeneratorT g(this);
+  auto [left, right] = Inputs<FloatBinopOp>(node);
   InstructionOperand temps[] = {g.TempRegister()};
-  Emit(kIA32Float64Max, g.DefineSameAsFirst(node),
-       g.UseRegister(this->input_at(node, 0)), g.Use(this->input_at(node, 1)),
-       arraysize(temps), temps);
+  Emit(kIA32Float64Max, g.DefineSameAsFirst(node), g.UseRegister(left),
+       g.Use(right), arraysize(temps), temps);
 }
 
 void InstructionSelectorT::VisitFloat32Min(OpIndex node) {
   IA32OperandGeneratorT g(this);
+  auto [left, right] = Inputs<FloatBinopOp>(node);
   InstructionOperand temps[] = {g.TempRegister()};
-  Emit(kIA32Float32Min, g.DefineSameAsFirst(node),
-       g.UseRegister(this->input_at(node, 0)), g.Use(this->input_at(node, 1)),
-       arraysize(temps), temps);
+  Emit(kIA32Float32Min, g.DefineSameAsFirst(node), g.UseRegister(left),
+       g.Use(right), arraysize(temps), temps);
 }
 
 void InstructionSelectorT::VisitFloat64Min(OpIndex node) {
   IA32OperandGeneratorT g(this);
+  auto [left, right] = Inputs<FloatBinopOp>(node);
   InstructionOperand temps[] = {g.TempRegister()};
-  Emit(kIA32Float64Min, g.DefineSameAsFirst(node),
-       g.UseRegister(this->input_at(node, 0)), g.Use(this->input_at(node, 1)),
-       arraysize(temps), temps);
+  Emit(kIA32Float64Min, g.DefineSameAsFirst(node), g.UseRegister(left),
+       g.Use(right), arraysize(temps), temps);
 }
 
 void InstructionSelectorT::VisitFloat64RoundTiesAway(OpIndex node) {
@@ -1792,9 +1779,9 @@ void InstructionSelectorT::VisitFloat64RoundTiesAway(OpIndex node) {
 void InstructionSelectorT::VisitFloat64Ieee754Binop(OpIndex node,
                                                     InstructionCode opcode) {
   IA32OperandGeneratorT g(this);
-  Emit(opcode, g.DefineSameAsFirst(node),
-       g.UseRegister(this->input_at(node, 0)),
-       g.UseRegister(this->input_at(node, 1)))
+  auto [left, right] = Inputs<FloatBinopOp>(node);
+  Emit(opcode, g.DefineSameAsFirst(node), g.UseRegister(left),
+       g.UseRegister(right))
       ->MarkAsCall();
 }
 
@@ -1802,7 +1789,7 @@ void InstructionSelectorT::VisitFloat64Ieee754Unop(OpIndex node,
                                                    InstructionCode opcode) {
   IA32OperandGeneratorT g(this);
   Emit(opcode, g.DefineSameAsFirst(node),
-       g.UseRegister(this->input_at(node, 0)))
+       g.UseRegister(Cast<FloatUnaryOp>(node).input()))
       ->MarkAsCall();
 }
 
@@ -2024,16 +2011,14 @@ InstructionCode TryNarrowOpcodeSize(InstructionSelectorT* selector,
 // Shared routine for multiple float32 compare operations (inputs commuted).
 void VisitFloat32Compare(InstructionSelectorT* selector, OpIndex node,
                          FlagsContinuationT* cont) {
-  auto left = selector->input_at(node, 0);
-  auto right = selector->input_at(node, 1);
+  auto [left, right] = selector->Inputs<ComparisonOp>(node);
   VisitCompare(selector, kIA32Float32Cmp, right, left, cont, false);
 }
 
 // Shared routine for multiple float64 compare operations (inputs commuted).
 void VisitFloat64Compare(InstructionSelectorT* selector, OpIndex node,
                          FlagsContinuationT* cont) {
-  auto left = selector->input_at(node, 0);
-  auto right = selector->input_at(node, 1);
+  auto [left, right] = selector->Inputs<ComparisonOp>(node);
   VisitCompare(selector, kIA32Float64Cmp, right, left, cont, false);
 }
 
@@ -2042,8 +2027,7 @@ void VisitWordCompare(InstructionSelectorT* selector, OpIndex node,
                       InstructionCode opcode, FlagsContinuationT* cont) {
   {  // Temporary scope to minimize indentation change churn below.
     IA32OperandGeneratorT g(selector);
-    auto left = selector->input_at(node, 0);
-    auto right = selector->input_at(node, 1);
+    auto [left, right] = selector->Inputs<2>(node);
 
     InstructionCode narrowed_opcode =
         TryNarrowOpcodeSize(selector, opcode, left, right, cont);
@@ -2093,12 +2077,10 @@ void VisitAtomicBinOp(InstructionSelectorT* selector, OpIndex node,
                       ArchOpcode opcode, MachineRepresentation rep) {
   AddressingMode addressing_mode;
   IA32OperandGeneratorT g(selector);
-  OpIndex base = selector->input_at(node, 0);
-  OpIndex index = selector->input_at(node, 1);
-  OpIndex value = selector->input_at(node, 2);
+  const AtomicRMWOp& op = selector->Cast<AtomicRMWOp>(node);
   InstructionOperand inputs[] = {
-      g.UseUniqueRegister(value), g.UseUniqueRegister(base),
-      g.GetEffectiveIndexOperand(index, &addressing_mode)};
+      g.UseUniqueRegister(op.value()), g.UseUniqueRegister(op.base()),
+      g.GetEffectiveIndexOperand(op.index(), &addressing_mode)};
   InstructionOperand outputs[] = {g.DefineAsFixed(node, eax)};
   InstructionOperand temp[] = {(rep == MachineRepresentation::kWord8)
                                    ? g.UseByteRegister(node)
@@ -2111,19 +2093,19 @@ void VisitAtomicBinOp(InstructionSelectorT* selector, OpIndex node,
 void VisitPairAtomicBinOp(InstructionSelectorT* selector, OpIndex node,
                           ArchOpcode opcode) {
   IA32OperandGeneratorT g(selector);
-  OpIndex base = selector->input_at(node, 0);
-  OpIndex index = selector->input_at(node, 1);
-  OpIndex value = selector->input_at(node, 2);
+  const AtomicWord32PairOp& op = selector->Cast<AtomicWord32PairOp>(node);
+  OpIndex index = op.index().value();
   // For Word64 operations, the value input is split into the a high node,
   // and a low node in the int64-lowering phase.
-  OpIndex value_high = selector->input_at(node, 3);
+  OpIndex value_low = op.value_low().value();
+  OpIndex value_high = op.value_high().value();
 
   // Wasm lives in 32-bit address space, so we do not need to worry about
   // base/index lowering. This will need to be fixed for Wasm64.
   AddressingMode addressing_mode;
   InstructionOperand inputs[] = {
-      g.UseUniqueRegisterOrSlotOrConstant(value), g.UseFixed(value_high, ecx),
-      g.UseUniqueRegister(base),
+      g.UseUniqueRegisterOrSlotOrConstant(value_low),
+      g.UseFixed(value_high, ecx), g.UseUniqueRegister(op.base()),
       g.GetEffectiveIndexOperand(index, &addressing_mode)};
   InstructionCode code = opcode | AddressingModeField::encode(addressing_mode);
   OptionalOpIndex projection0 = selector->FindProjection(node, 0);
@@ -2238,7 +2220,8 @@ void InstructionSelectorT::VisitWordCompareZero(OpIndex user, OpIndex value,
 void InstructionSelectorT::VisitSwitch(OpIndex node, const SwitchInfo& sw) {
   {  // Temporary scope to minimize indentation change churn below.
     IA32OperandGeneratorT g(this);
-    InstructionOperand value_operand = g.UseRegister(this->input_at(node, 0));
+    InstructionOperand value_operand =
+        g.UseRegister(Cast<SwitchOp>(node).input());
 
     // Emit either ArchTableSwitch or ArchBinarySearchSwitch.
     if (enable_switch_jump_table_ ==
@@ -2386,7 +2369,7 @@ void InstructionSelectorT::VisitBitcastWord32PairToFloat64(OpIndex node) {
 void InstructionSelectorT::VisitFloat64SilenceNaN(OpIndex node) {
   IA32OperandGeneratorT g(this);
   Emit(kIA32Float64SilenceNaN, g.DefineSameAsFirst(node),
-       g.UseRegister(this->input_at(node, 0)));
+       g.UseRegister(Cast<FloatUnaryOp>(node).input()));
 }
 
 AtomicMemoryOrder AtomicOrder(InstructionSelectorT* selector, OpIndex node) {
@@ -2534,13 +2517,13 @@ void InstructionSelectorT::VisitWord32AtomicPairLoad(OpIndex node) {
   // Both acquire and sequentially consistent loads can emit MOV.
   // https://www.cl.cam.ac.uk/~pes20/cpp/cpp0xmappings.html
   IA32OperandGeneratorT g(this);
+  const AtomicWord32PairOp& op = Cast<AtomicWord32PairOp>(node);
   AddressingMode mode;
-  OpIndex base = this->input_at(node, 0);
-  OpIndex index = this->input_at(node, 1);
+  OpIndex index = op.index().value();
   OptionalOpIndex projection0 = FindProjection(node, 0);
   OptionalOpIndex projection1 = FindProjection(node, 1);
   if (projection0.valid() && projection1.valid()) {
-    InstructionOperand inputs[] = {g.UseUniqueRegister(base),
+    InstructionOperand inputs[] = {g.UseUniqueRegister(op.base()),
                                    g.GetEffectiveIndexOperand(index, &mode)};
     InstructionCode code =
         kIA32Word32AtomicPairLoad | AddressingModeField::encode(mode);
@@ -2559,8 +2542,8 @@ void InstructionSelectorT::VisitWord32AtomicPairLoad(OpIndex node) {
     // {scale = 0} means *1 in the generated code.
     int scale = 0;
     mode = g.GenerateMemoryOperandInputs(
-        index, scale, base, projection0.valid() ? 0 : 4, kPositiveDisplacement,
-        inputs, &input_count);
+        index, scale, op.base(), projection0.valid() ? 0 : 4,
+        kPositiveDisplacement, inputs, &input_count);
     InstructionCode code = opcode | AddressingModeField::encode(mode);
     Emit(code, 1, outputs, input_count, inputs);
   }
@@ -2572,18 +2555,18 @@ void InstructionSelectorT::VisitWord32AtomicPairStore(OpIndex node) {
   // https://www.cl.cam.ac.uk/~pes20/cpp/cpp0xmappings.html
 
   IA32OperandGeneratorT g(this);
-  OpIndex base = this->input_at(node, 0);
-  OpIndex index = this->input_at(node, 1);
-  OpIndex value = this->input_at(node, 2);
-  OpIndex value_high = this->input_at(node, 3);
+  const AtomicWord32PairOp& op = Cast<AtomicWord32PairOp>(node);
+  OpIndex index = op.index().value();
+  OpIndex value_low = op.value_low().value();
+  OpIndex value_high = op.value_high().value();
 
   AtomicMemoryOrder order = AtomicOrder(this, node);
   if (order == AtomicMemoryOrder::kAcqRel) {
     AddressingMode addressing_mode;
     InstructionOperand inputs[] = {
-        g.UseUniqueRegisterOrSlotOrConstant(value),
+        g.UseUniqueRegisterOrSlotOrConstant(value_low),
         g.UseUniqueRegisterOrSlotOrConstant(value_high),
-        g.UseUniqueRegister(base),
+        g.UseUniqueRegister(op.base()),
         g.GetEffectiveIndexOperand(index, &addressing_mode),
     };
     InstructionCode code = kIA32Word32ReleasePairStore |
@@ -2594,8 +2577,8 @@ void InstructionSelectorT::VisitWord32AtomicPairStore(OpIndex node) {
 
     AddressingMode addressing_mode;
     InstructionOperand inputs[] = {
-        g.UseUniqueRegisterOrSlotOrConstant(value), g.UseFixed(value_high, ecx),
-        g.UseUniqueRegister(base),
+        g.UseUniqueRegisterOrSlotOrConstant(value_low),
+        g.UseFixed(value_high, ecx), g.UseUniqueRegister(op.base()),
         g.GetEffectiveIndexOperand(index, &addressing_mode)};
     // Allocating temp registers here as stores are performed using an atomic
     // exchange, the output of which is stored in edx:eax, which should be saved
@@ -2634,20 +2617,19 @@ void InstructionSelectorT::VisitWord32AtomicPairExchange(OpIndex node) {
 
 void InstructionSelectorT::VisitWord32AtomicPairCompareExchange(OpIndex node) {
   IA32OperandGeneratorT g(this);
-  OpIndex index = this->input_at(node, 1);
+  const AtomicWord32PairOp& op = Cast<AtomicWord32PairOp>(node);
+  OpIndex index = op.index().value();
   AddressingMode addressing_mode;
 
-  const size_t expected_offset = 4;
-  const size_t value_offset = 2;
   InstructionOperand inputs[] = {
       // High, Low values of old value
-      g.UseFixed(this->input_at(node, expected_offset), eax),
-      g.UseFixed(this->input_at(node, expected_offset + 1), edx),
+      g.UseFixed(op.expected_low().value(), eax),
+      g.UseFixed(op.expected_high().value(), edx),
       // High, Low values of new value
-      g.UseUniqueRegisterOrSlotOrConstant(this->input_at(node, value_offset)),
-      g.UseFixed(this->input_at(node, value_offset + 1), ecx),
+      g.UseUniqueRegisterOrSlotOrConstant(op.value_low().value()),
+      g.UseFixed(op.value_high().value(), ecx),
       // InputAt(0) => base
-      g.UseUniqueRegister(this->input_at(node, 0)),
+      g.UseUniqueRegister(op.base()),
       g.GetEffectiveIndexOperand(index, &addressing_mode)};
   OptionalOpIndex projection0 = FindProjection(node, 0);
   OptionalOpIndex projection1 = FindProjection(node, 1);
@@ -2851,8 +2833,9 @@ void InstructionSelectorT::VisitS128Const(OpIndex node) {
 
 void InstructionSelectorT::VisitF64x2Min(OpIndex node) {
   IA32OperandGeneratorT g(this);
-  InstructionOperand operand0 = g.UseRegister(this->input_at(node, 0));
-  InstructionOperand operand1 = g.UseRegister(this->input_at(node, 1));
+  auto [left, right] = Inputs<Simd128BinopOp>(node);
+  InstructionOperand operand0 = g.UseRegister(left);
+  InstructionOperand operand1 = g.UseRegister(right);
 
   if (IsSupported(AVX)) {
     Emit(kIA32F64x2Min, g.DefineAsRegister(node), operand0, operand1);
@@ -2863,8 +2846,9 @@ void InstructionSelectorT::VisitF64x2Min(OpIndex node) {
 
 void InstructionSelectorT::VisitF64x2Max(OpIndex node) {
   IA32OperandGeneratorT g(this);
-  InstructionOperand operand0 = g.UseRegister(this->input_at(node, 0));
-  InstructionOperand operand1 = g.UseRegister(this->input_at(node, 1));
+  auto [left, right] = Inputs<Simd128BinopOp>(node);
+  InstructionOperand operand0 = g.UseRegister(left);
+  InstructionOperand operand1 = g.UseRegister(right);
   if (IsSupported(AVX)) {
     Emit(kIA32F64x2Max, g.DefineAsRegister(node), operand0, operand1);
   } else {
@@ -2892,35 +2876,36 @@ void InstructionSelectorT::VisitI64x2ReplaceLaneI32Pair(OpIndex node) {
 
 void InstructionSelectorT::VisitI64x2Neg(OpIndex node) {
   IA32OperandGeneratorT g(this);
+  OpIndex input = Cast<Simd128UnaryOp>(node).input();
   // If AVX unsupported, make sure dst != src to avoid a move.
   InstructionOperand operand0 =
-      IsSupported(AVX) ? g.UseRegister(this->input_at(node, 0))
-                       : g.UseUniqueRegister(this->input_at(node, 0));
+      IsSupported(AVX) ? g.UseRegister(input) : g.UseUniqueRegister(input);
   Emit(kIA32I64x2Neg, g.DefineAsRegister(node), operand0);
 }
 
 void InstructionSelectorT::VisitI64x2ShrS(OpIndex node) {
   IA32OperandGeneratorT g(this);
+  const Simd128ShiftOp& op = Cast<Simd128ShiftOp>(node);
   InstructionOperand dst =
       IsSupported(AVX) ? g.DefineAsRegister(node) : g.DefineSameAsFirst(node);
 
-  if (g.CanBeImmediate(this->input_at(node, 1))) {
-    Emit(kIA32I64x2ShrS, dst, g.UseRegister(this->input_at(node, 0)),
-         g.UseImmediate(this->input_at(node, 1)));
+  if (g.CanBeImmediate(op.shift())) {
+    Emit(kIA32I64x2ShrS, dst, g.UseRegister(op.input()),
+         g.UseImmediate(op.shift()));
   } else {
     InstructionOperand temps[] = {g.TempSimd128Register(), g.TempRegister()};
-    Emit(kIA32I64x2ShrS, dst, g.UseUniqueRegister(this->input_at(node, 0)),
-         g.UseRegister(this->input_at(node, 1)), arraysize(temps), temps);
+    Emit(kIA32I64x2ShrS, dst, g.UseUniqueRegister(op.input()),
+         g.UseRegister(op.shift()), arraysize(temps), temps);
   }
 }
 
 void InstructionSelectorT::VisitI64x2Mul(OpIndex node) {
   IA32OperandGeneratorT g(this);
+  auto [left, right] = Inputs<Simd128BinopOp>(node);
   InstructionOperand temps[] = {g.TempSimd128Register(),
                                 g.TempSimd128Register()};
-  Emit(kIA32I64x2Mul, g.DefineAsRegister(node),
-       g.UseUniqueRegister(this->input_at(node, 0)),
-       g.UseUniqueRegister(this->input_at(node, 1)), arraysize(temps), temps);
+  Emit(kIA32I64x2Mul, g.DefineAsRegister(node), g.UseUniqueRegister(left),
+       g.UseUniqueRegister(right), arraysize(temps), temps);
 }
 
 void InstructionSelectorT::VisitF32x4Splat(OpIndex node) {
@@ -2940,8 +2925,9 @@ void InstructionSelectorT::VisitI32x4SConvertF32x4(OpIndex node) {
   InstructionOperand temps[] = {g.TempRegister()};
   InstructionOperand dst =
       IsSupported(AVX) ? g.DefineAsRegister(node) : g.DefineSameAsFirst(node);
-  Emit(kIA32I32x4SConvertF32x4, dst, g.UseRegister(this->input_at(node, 0)),
-       arraysize(temps), temps);
+  Emit(kIA32I32x4SConvertF32x4, dst,
+       g.UseRegister(Cast<Simd128UnaryOp>(node).input()), arraysize(temps),
+       temps);
 }
 
 void InstructionSelectorT::VisitI32x4UConvertF32x4(OpIndex node) {
@@ -2951,7 +2937,8 @@ void InstructionSelectorT::VisitI32x4UConvertF32x4(OpIndex node) {
   InstructionCode opcode =
       IsSupported(AVX) ? kAVXI32x4UConvertF32x4 : kSSEI32x4UConvertF32x4;
   Emit(opcode, g.DefineSameAsFirst(node),
-       g.UseRegister(this->input_at(node, 0)), arraysize(temps), temps);
+       g.UseRegister(Cast<Simd128UnaryOp>(node).input()), arraysize(temps),
+       temps);
 }
 
 void InstructionSelectorT::VisitS128Zero(OpIndex node) {
@@ -2961,31 +2948,33 @@ void InstructionSelectorT::VisitS128Zero(OpIndex node) {
 
 void InstructionSelectorT::VisitS128Select(OpIndex node) {
   IA32OperandGeneratorT g(this);
+  auto [cond, vtrue, vfalse] = Inputs<Simd128TernaryOp>(node);
   InstructionOperand dst =
       IsSupported(AVX) ? g.DefineAsRegister(node) : g.DefineSameAsFirst(node);
-  Emit(kIA32S128Select, dst, g.UseRegister(this->input_at(node, 0)),
-       g.UseRegister(this->input_at(node, 1)),
-       g.UseRegister(this->input_at(node, 2)));
+  Emit(kIA32S128Select, dst, g.UseRegister(cond), g.UseRegister(vtrue),
+       g.UseRegister(vfalse));
 }
 
 void InstructionSelectorT::VisitS128AndNot(OpIndex node) {
   IA32OperandGeneratorT g(this);
+  const Simd128BinopOp& op = Cast<Simd128BinopOp>(node);
   // andnps a b does ~a & b, but we want a & !b, so flip the input.
   InstructionOperand dst =
       IsSupported(AVX) ? g.DefineAsRegister(node) : g.DefineSameAsFirst(node);
-  Emit(kIA32S128AndNot, dst, g.UseRegister(this->input_at(node, 1)),
-       g.UseRegister(this->input_at(node, 0)));
+  Emit(kIA32S128AndNot, dst, g.UseRegister(op.right()),
+       g.UseRegister(op.left()));
 }
 
-#define VISIT_SIMD_SPLAT(Type)                                        \
-  void InstructionSelectorT::Visit##Type##Splat(OpIndex node) {       \
-    bool set_zero = this->MatchIntegralZero(this->input_at(node, 0)); \
-    if (set_zero) {                                                   \
-      IA32OperandGeneratorT g(this);                                  \
-      Emit(kIA32S128Zero, g.DefineAsRegister(node));                  \
-    } else {                                                          \
-      VisitRO(this, node, kIA32##Type##Splat);                        \
-    }                                                                 \
+#define VISIT_SIMD_SPLAT(Type)                                       \
+  void InstructionSelectorT::Visit##Type##Splat(OpIndex node) {      \
+    bool set_zero =                                                  \
+        this->MatchIntegralZero(Cast<Simd128SplatOp>(node).input()); \
+    if (set_zero) {                                                  \
+      IA32OperandGeneratorT g(this);                                 \
+      Emit(kIA32S128Zero, g.DefineAsRegister(node));                 \
+    } else {                                                         \
+      VisitRO(this, node, kIA32##Type##Splat);                       \
+    }                                                                \
   }
 SIMD_INT_TYPES(VISIT_SIMD_SPLAT)
 #undef SIMD_INT_TYPES
@@ -3031,17 +3020,15 @@ void InstructionSelectorT::VisitF16x8ReplaceLane(OpIndex node) {
 #define VISIT_SIMD_REPLACE_LANE(TYPE, OPCODE)                              \
   void InstructionSelectorT::Visit##TYPE##ReplaceLane(OpIndex node) {      \
     IA32OperandGeneratorT g(this);                                         \
-    const Simd128ReplaceLaneOp& op =                                       \
-        this->Get(node).template Cast<Simd128ReplaceLaneOp>();             \
+    const Simd128ReplaceLaneOp& op = Cast<Simd128ReplaceLaneOp>(node);     \
     int lane = op.lane;                                                    \
-    InstructionOperand operand0 = g.UseRegister(this->input_at(node, 0));  \
+    InstructionOperand operand0 = g.UseRegister(op.into());                \
     InstructionOperand operand1 = g.UseImmediate(lane);                    \
-    auto input1 = this->input_at(node, 1);                                 \
     InstructionOperand operand2;                                           \
     if constexpr (OPCODE == kIA32F64x2ReplaceLane) {                       \
-      operand2 = g.UseRegister(input1);                                    \
+      operand2 = g.UseRegister(op.new_lane());                             \
     } else {                                                               \
-      operand2 = g.Use(input1);                                            \
+      operand2 = g.Use(op.new_lane());                                     \
     }                                                                      \
     /* When no-AVX, define dst == src to save a move. */                   \
     InstructionOperand dst = IsSupported(AVX) ? g.DefineAsRegister(node)   \
@@ -3067,8 +3054,9 @@ SIMD_SHIFT_OPCODES_UNIFED_SSE_AVX(VISIT_SIMD_SHIFT_UNIFIED_SSE_AVX)
 #define VISIT_SIMD_UNOP(Opcode)                            \
   void InstructionSelectorT::Visit##Opcode(OpIndex node) { \
     IA32OperandGeneratorT g(this);                         \
+    DCHECK_EQ(Get(node).input_count, 1);                   \
     Emit(kIA32##Opcode, g.DefineAsRegister(node),          \
-         g.UseRegister(this->input_at(node, 0)));          \
+         g.UseRegister(Get(node).input(0)));               \
   }
 SIMD_UNOP_LIST(VISIT_SIMD_UNOP)
 #undef VISIT_SIMD_UNOP
@@ -3110,7 +3098,8 @@ void InstructionSelectorT::VisitV128AnyTrue(OpIndex node) {
   IA32OperandGeneratorT g(this);
   InstructionOperand temps[] = {g.TempRegister()};
   Emit(kIA32S128AnyTrue, g.DefineAsRegister(node),
-       g.UseRegister(this->input_at(node, 0)), arraysize(temps), temps);
+       g.UseRegister(Cast<Simd128TestOp>(node).input()), arraysize(temps),
+       temps);
 }
 
 #define VISIT_SIMD_ALLTRUE(Opcode)                                            \
@@ -3118,8 +3107,8 @@ void InstructionSelectorT::VisitV128AnyTrue(OpIndex node) {
     IA32OperandGeneratorT g(this);                                            \
     InstructionOperand temps[] = {g.TempRegister(), g.TempSimd128Register()}; \
     Emit(kIA32##Opcode, g.DefineAsRegister(node),                             \
-         g.UseUniqueRegister(this->input_at(node, 0)), arraysize(temps),      \
-         temps);                                                              \
+         g.UseUniqueRegister(Cast<Simd128TestOp>(node).input()),              \
+         arraysize(temps), temps);                                            \
   }
 SIMD_ALLTRUE_LIST(VISIT_SIMD_ALLTRUE)
 #undef VISIT_SIMD_ALLTRUE
@@ -3174,7 +3163,8 @@ void InstructionSelectorT::VisitI16x8BitMask(OpIndex node) {
   IA32OperandGeneratorT g(this);
   InstructionOperand temps[] = {g.TempSimd128Register()};
   Emit(kIA32I16x8BitMask, g.DefineAsRegister(node),
-       g.UseUniqueRegister(this->input_at(node, 0)), arraysize(temps), temps);
+       g.UseUniqueRegister(Cast<Simd128TestOp>(node).input()), arraysize(temps),
+       temps);
 }
 
 void InstructionSelectorT::VisitI8x16Shl(OpIndex node) {
@@ -3497,9 +3487,9 @@ void InstructionSelectorT::VisitI8x16Shuffle(OpIndex node) {
 void InstructionSelectorT::VisitI8x16Swizzle(OpIndex node) {
   InstructionCode op = kIA32I8x16Swizzle;
 
-  OpIndex left = this->input_at(node, 0);
-  OpIndex right = this->input_at(node, 1);
-  const Simd128BinopOp& binop = this->Get(node).template Cast<Simd128BinopOp>();
+  const Simd128BinopOp& binop = Cast<Simd128BinopOp>(node);
+  OpIndex left = binop.left();
+  OpIndex right = binop.right();
   DCHECK(binop.kind == any_of(Simd128BinopOp::Kind::kI8x16Swizzle,
                               Simd128BinopOp::Kind::kI8x16RelaxedSwizzle));
   bool relaxed = binop.kind == Simd128BinopOp::Kind::kI8x16RelaxedSwizzle;
@@ -3527,7 +3517,7 @@ void InstructionSelectorT::VisitI8x16Swizzle(OpIndex node) {
 
 void InstructionSelectorT::VisitSetStackPointer(OpIndex node) {
   OperandGenerator g(this);
-  auto input = g.UseAny(this->input_at(node, 0));
+  auto input = g.UseAny(Cast<SetStackPointerOp>(node).value());
   Emit(kArchSetStackPointer, 0, nullptr, 1, &input);
 }
 
@@ -3538,17 +3528,16 @@ void VisitMinOrMax(InstructionSelectorT* selector, OpIndex node,
   // Due to the way minps/minpd work, we want the dst to be same as the second
   // input: b = pmin(a, b) directly maps to minps b a.
   IA32OperandGeneratorT g(selector);
+  auto [left, right] = selector->Inputs<Simd128BinopOp>(node);
   InstructionOperand dst = selector->IsSupported(AVX)
                                ? g.DefineAsRegister(node)
                                : g.DefineSameAsFirst(node);
   if (flip_inputs) {
     // Due to the way minps/minpd work, we want the dst to be same as the second
     // input: b = pmin(a, b) directly maps to minps b a.
-    selector->Emit(opcode, dst, g.UseRegister(selector->input_at(node, 1)),
-                   g.UseRegister(selector->input_at(node, 0)));
+    selector->Emit(opcode, dst, g.UseRegister(right), g.UseRegister(left));
   } else {
-    selector->Emit(opcode, dst, g.UseRegister(selector->input_at(node, 0)),
-                   g.UseRegister(selector->input_at(node, 1)));
+    selector->Emit(opcode, dst, g.UseRegister(left), g.UseRegister(right));
   }
 }
 }  // namespace
@@ -3590,7 +3579,8 @@ namespace {
 void VisitExtAddPairwise(InstructionSelectorT* selector, OpIndex node,
                          ArchOpcode opcode, bool need_temp) {
   IA32OperandGeneratorT g(selector);
-  InstructionOperand operand0 = g.UseRegister(selector->input_at(node, 0));
+  InstructionOperand operand0 =
+      g.UseRegister(selector->Cast<Simd128UnaryOp>(node).input());
   InstructionOperand dst = (selector->IsSupported(AVX))
                                ? g.DefineAsRegister(node)
                                : g.DefineSameAsFirst(node);
@@ -3625,7 +3615,8 @@ void InstructionSelectorT::VisitI8x16Popcnt(OpIndex node) {
                                ? g.DefineAsRegister(node)
                                : g.DefineAsRegister(node);
   InstructionOperand temps[] = {g.TempSimd128Register(), g.TempRegister()};
-  Emit(kIA32I8x16Popcnt, dst, g.UseUniqueRegister(this->input_at(node, 0)),
+  Emit(kIA32I8x16Popcnt, dst,
+       g.UseUniqueRegister(Cast<Simd128UnaryOp>(node).input()),
        arraysize(temps), temps);
 }
 
@@ -3634,20 +3625,22 @@ void InstructionSelectorT::VisitF64x2ConvertLowI32x4U(OpIndex node) {
   InstructionOperand temps[] = {g.TempRegister()};
   InstructionOperand dst =
       IsSupported(AVX) ? g.DefineAsRegister(node) : g.DefineSameAsFirst(node);
-  Emit(kIA32F64x2ConvertLowI32x4U, dst, g.UseRegister(this->input_at(node, 0)),
-       arraysize(temps), temps);
+  Emit(kIA32F64x2ConvertLowI32x4U, dst,
+       g.UseRegister(Cast<Simd128UnaryOp>(node).input()), arraysize(temps),
+       temps);
 }
 
 void InstructionSelectorT::VisitI32x4TruncSatF64x2SZero(OpIndex node) {
   IA32OperandGeneratorT g(this);
+  const Simd128UnaryOp& op = Cast<Simd128UnaryOp>(node);
   InstructionOperand temps[] = {g.TempRegister()};
   if (IsSupported(AVX)) {
     // Requires dst != src.
     Emit(kIA32I32x4TruncSatF64x2SZero, g.DefineAsRegister(node),
-         g.UseUniqueRegister(this->input_at(node, 0)), arraysize(temps), temps);
+         g.UseUniqueRegister(op.input()), arraysize(temps), temps);
   } else {
     Emit(kIA32I32x4TruncSatF64x2SZero, g.DefineSameAsFirst(node),
-         g.UseRegister(this->input_at(node, 0)), arraysize(temps), temps);
+         g.UseRegister(op.input()), arraysize(temps), temps);
   }
 }
 
@@ -3657,7 +3650,8 @@ void InstructionSelectorT::VisitI32x4TruncSatF64x2UZero(OpIndex node) {
   InstructionOperand dst =
       IsSupported(AVX) ? g.DefineAsRegister(node) : g.DefineSameAsFirst(node);
   Emit(kIA32I32x4TruncSatF64x2UZero, dst,
-       g.UseRegister(this->input_at(node, 0)), arraysize(temps), temps);
+       g.UseRegister(Cast<Simd128UnaryOp>(node).input()), arraysize(temps),
+       temps);
 }
 
 void InstructionSelectorT::VisitI32x4RelaxedTruncF64x2SZero(OpIndex node) {
@@ -3665,7 +3659,7 @@ void InstructionSelectorT::VisitI32x4RelaxedTruncF64x2SZero(OpIndex node) {
 }
 
 void InstructionSelectorT::VisitI32x4RelaxedTruncF64x2UZero(OpIndex node) {
-  VisitFloatUnop(this, node, this->input_at(node, 0),
+  VisitFloatUnop(this, node, Cast<Simd128UnaryOp>(node).input(),
                  kIA32I32x4TruncF64x2UZero);
 }
 
@@ -3675,49 +3669,45 @@ void InstructionSelectorT::VisitI32x4RelaxedTruncF32x4S(OpIndex node) {
 
 void InstructionSelectorT::VisitI32x4RelaxedTruncF32x4U(OpIndex node) {
   IA32OperandGeneratorT g(this);
-  OpIndex input = this->input_at(node, 0);
+  const Simd128UnaryOp& op = Cast<Simd128UnaryOp>(node);
   InstructionOperand temps[] = {g.TempSimd128Register()};
   // No need for unique because inputs are float but temp is general.
   if (IsSupported(AVX)) {
-    Emit(kIA32I32x4TruncF32x4U, g.DefineAsRegister(node), g.UseRegister(input),
-         arraysize(temps), temps);
+    Emit(kIA32I32x4TruncF32x4U, g.DefineAsRegister(node),
+         g.UseRegister(op.input()), arraysize(temps), temps);
   } else {
-    Emit(kIA32I32x4TruncF32x4U, g.DefineSameAsFirst(node), g.UseRegister(input),
-         arraysize(temps), temps);
+    Emit(kIA32I32x4TruncF32x4U, g.DefineSameAsFirst(node),
+         g.UseRegister(op.input()), arraysize(temps), temps);
   }
 }
 
 void InstructionSelectorT::VisitI64x2GtS(OpIndex node) {
   IA32OperandGeneratorT g(this);
+  auto [left, right] = Inputs<Simd128BinopOp>(node);
   if (CpuFeatures::IsSupported(AVX)) {
-    Emit(kIA32I64x2GtS, g.DefineAsRegister(node),
-         g.UseRegister(this->input_at(node, 0)),
-         g.UseRegister(this->input_at(node, 1)));
+    Emit(kIA32I64x2GtS, g.DefineAsRegister(node), g.UseRegister(left),
+         g.UseRegister(right));
   } else if (CpuFeatures::IsSupported(SSE4_2)) {
-    Emit(kIA32I64x2GtS, g.DefineSameAsFirst(node),
-         g.UseRegister(this->input_at(node, 0)),
-         g.UseRegister(this->input_at(node, 1)));
+    Emit(kIA32I64x2GtS, g.DefineSameAsFirst(node), g.UseRegister(left),
+         g.UseRegister(right));
   } else {
-    Emit(kIA32I64x2GtS, g.DefineAsRegister(node),
-         g.UseUniqueRegister(this->input_at(node, 0)),
-         g.UseUniqueRegister(this->input_at(node, 1)));
+    Emit(kIA32I64x2GtS, g.DefineAsRegister(node), g.UseUniqueRegister(left),
+         g.UseUniqueRegister(right));
   }
 }
 
 void InstructionSelectorT::VisitI64x2GeS(OpIndex node) {
   IA32OperandGeneratorT g(this);
+  auto [left, right] = Inputs<Simd128BinopOp>(node);
   if (CpuFeatures::IsSupported(AVX)) {
-    Emit(kIA32I64x2GeS, g.DefineAsRegister(node),
-         g.UseRegister(this->input_at(node, 0)),
-         g.UseRegister(this->input_at(node, 1)));
+    Emit(kIA32I64x2GeS, g.DefineAsRegister(node), g.UseRegister(left),
+         g.UseRegister(right));
   } else if (CpuFeatures::IsSupported(SSE4_2)) {
-    Emit(kIA32I64x2GeS, g.DefineAsRegister(node),
-         g.UseUniqueRegister(this->input_at(node, 0)),
-         g.UseRegister(this->input_at(node, 1)));
+    Emit(kIA32I64x2GeS, g.DefineAsRegister(node), g.UseUniqueRegister(left),
+         g.UseRegister(right));
   } else {
-    Emit(kIA32I64x2GeS, g.DefineAsRegister(node),
-         g.UseUniqueRegister(this->input_at(node, 0)),
-         g.UseUniqueRegister(this->input_at(node, 1)));
+    Emit(kIA32I64x2GeS, g.DefineAsRegister(node), g.UseUniqueRegister(left),
+         g.UseUniqueRegister(right));
   }
 }
 
@@ -3732,7 +3722,7 @@ void InstructionSelectorT::VisitF64x2PromoteLowF32x4(OpIndex node) {
   // that this special case may require adaptions in instruction-selector.cc
   // in `FinishEmittedInstructions`, similar to what exists for TurboFan.
 #if 0
-  OpIndex input = this->input_at(node, 0);
+  OpIndex input = Cast<Simd128UnaryOp>(node).input();
   LoadTransformMatcher m(input);
 
   if (m.Is(LoadTransformation::kS128Load64Zero) && CanCover(node, input)) {
@@ -3754,21 +3744,18 @@ namespace {
 void VisitRelaxedLaneSelect(InstructionSelectorT* selector, OpIndex node,
                             InstructionCode code = kIA32Pblendvb) {
   IA32OperandGeneratorT g(selector);
+  const Simd128TernaryOp& op = selector->Cast<Simd128TernaryOp>(node);
   // pblendvb/blendvps/blendvpd copies src2 when mask is set, opposite from Wasm
   // semantics. node's inputs are: mask, lhs, rhs (determined in
   // wasm-compiler.cc).
   if (selector->IsSupported(AVX)) {
-    selector->Emit(code, g.DefineAsRegister(node),
-                   g.UseRegister(selector->input_at(node, 2)),
-                   g.UseRegister(selector->input_at(node, 1)),
-                   g.UseRegister(selector->input_at(node, 0)));
+    selector->Emit(code, g.DefineAsRegister(node), g.UseRegister(op.third()),
+                   g.UseRegister(op.second()), g.UseRegister(op.first()));
   } else {
     // SSE4.1 pblendvb/blendvps/blendvpd requires xmm0 to hold the mask as an
     // implicit operand.
-    selector->Emit(code, g.DefineSameAsFirst(node),
-                   g.UseRegister(selector->input_at(node, 2)),
-                   g.UseRegister(selector->input_at(node, 1)),
-                   g.UseFixed(selector->input_at(node, 0), xmm0));
+    selector->Emit(code, g.DefineSameAsFirst(node), g.UseRegister(op.third()),
+                   g.UseRegister(op.second()), g.UseFixed(op.first(), xmm0));
   }
 }
 }  // namespace
@@ -3808,18 +3795,18 @@ void InstructionSelectorT::VisitF16x8Qfms(OpIndex node) { UNIMPLEMENTED(); }
 
 void InstructionSelectorT::VisitI16x8DotI8x16I7x16S(OpIndex node) {
   IA32OperandGeneratorT g(this);
+  const Simd128BinopOp& op = Cast<Simd128BinopOp>(node);
   Emit(kIA32I16x8DotI8x16I7x16S, g.DefineAsRegister(node),
-       g.UseUniqueRegister(this->input_at(node, 0)),
-       g.UseRegister(this->input_at(node, 1)));
+       g.UseUniqueRegister(op.left()), g.UseRegister(op.right()));
 }
 
 void InstructionSelectorT::VisitI32x4DotI8x16I7x16AddS(OpIndex node) {
   IA32OperandGeneratorT g(this);
+  const Simd128TernaryOp& op = Cast<Simd128TernaryOp>(node);
   InstructionOperand temps[] = {g.TempSimd128Register()};
   Emit(kIA32I32x4DotI8x16I7x16AddS, g.DefineSameAsInput(node, 2),
-       g.UseUniqueRegister(this->input_at(node, 0)),
-       g.UseUniqueRegister(this->input_at(node, 1)),
-       g.UseUniqueRegister(this->input_at(node, 2)), arraysize(temps), temps);
+       g.UseUniqueRegister(op.first()), g.UseUniqueRegister(op.second()),
+       g.UseUniqueRegister(op.third()), arraysize(temps), temps);
 }
 #endif  // V8_ENABLE_WEBASSEMBLY
 
diff --git a/deps/v8/src/compiler/backend/instruction-codes.h b/deps/v8/src/compiler/backend/instruction-codes.h
index 0a14938ae5de27..47039192f08edf 100644
--- a/deps/v8/src/compiler/backend/instruction-codes.h
+++ b/deps/v8/src/compiler/backend/instruction-codes.h
@@ -31,6 +31,7 @@
 #endif
 #include "src/base/bit-field.h"
 #include "src/codegen/atomic-memory-order.h"
+#include "src/compiler/globals.h"
 #include "src/compiler/write-barrier-kind.h"
 
 namespace v8 {
@@ -151,6 +152,7 @@ inline RecordWriteMode WriteBarrierKindToRecordWriteMode(
   V(ArchDeoptimize)                                                        \
   V(ArchRet)                                                               \
   V(ArchFramePointer)                                                      \
+  V(ArchRootPointer)                                                       \
   IF_WASM(V, ArchStackPointer)                                             \
   IF_WASM(V, ArchSetStackPointer)                                          \
   V(ArchParentFramePointer)                                                \
@@ -303,28 +305,61 @@ using InstructionCode = uint32_t;
 // Helpers for encoding / decoding InstructionCode into the fields needed
 // for code generation. We encode the instruction, addressing mode, flags, and
 // other information into a single InstructionCode which is stored as part of
-// the instruction. Some fields in the layout of InstructionCode overlap as
-// follows:
-//                              ArchOpcodeField
-//                              AddressingModeField
-//                              FlagsModeField
-//                              FlagsConditionField
-// AtomicWidthField                 | RecordWriteModeField | LaneSizeField
-// AtomicMemoryOrderField           |                      | VectorLengthField
-// AtomicStoreRecordWriteModeField  |                      |
-//                              AccessModeField
+// the instruction.
 //
-// or,
+// All instructions have the first five fields, using up the lower 22 bits.
+// The remaining 10 bits are accessible in the MiscField, which the other
+// instructions types can overlay specific data:
+// -- Generic
+// Field                        | Bits
+// ArchOpcode                   | 9
+// AddressingMode               | 5
+// FlagsMode                    | 3
+// FlagsCondition               | 5
+// Misc                         | 10
 //
-//                              ArchOpcodeField
-//                              AddressingModeField
-//                              FlagsModeField
-//                              FlagsConditionField
-// DeoptImmedArgsCountField    | ParamField      | MiscField
-// DeoptFrameStateOffsetField  | FPParamField    |
+// So, the following instruction types use the MiscField in the following ways:
+// -- Atomics
+// Field                        | Bits
+// AtomicWidth                  | 2
+// AtomicMemoryOrder            | 2
+// AtomicStoreRecordWriteMode   | 4
+// AccessMode                   | 2
+//
+// -- Write barriers
+// Field                        | Bits
+// RecordWriteMode              | 4
+// Undefined                    | 4
+// AccessMode                   | 2
+//
+// -- X64 vectors
+// Field                        | Bits
+// LaneSize                     | 2
+// VectorLength                 | 2
+// Undefined                    | 4
+// AccessMode                   | 2
+//
+// -- Everyone else vectors
+// Field                        | Bits
+// LaneSize                     | 8
+// AccessMode                   | 2
+//
+// -- Deopts
+// Field                        | Bits
+// DeoptImmedArgsCount          | 2
+// DeoptFrameStateOffset        | 8
+//
+// -- Non-deopt branches
+// Field                        | Bits
+// StackCheck                   | 2
+// BranchHint                   | 1
+// Undefined                    | 7
+//
+// -- C calls
+// Field                        | Bits
+// Param                        | 5
+// FPParam                      | 5
 //
-// Notably, AccessModeField can follow any of several sequences of fields.
-
 using ArchOpcodeField = base::BitField<ArchOpcode, 0, 9>;
 static_assert(ArchOpcodeField::is_valid(kLastArchOpcode),
               "All opcodes must fit in the 9-bit ArchOpcodeField.");
@@ -417,6 +452,9 @@ using FPParamField = ParamField::Next<int, 5>;
 // direction.
 using MiscField = FlagsConditionField::Next<int, 10>;
 
+using StackCheckField = FlagsConditionField::Next<StackCheckKind, 2>;
+using BranchHintField = StackCheckField::Next<bool, 1>;
+
 // This static assertion serves as an early warning if we are about to exhaust
 // the available opcode space. If we are about to exhaust it, we should start
 // looking into options to compress some opcodes (see
diff --git a/deps/v8/src/compiler/backend/instruction-scheduler.cc b/deps/v8/src/compiler/backend/instruction-scheduler.cc
index 7c43c1e9420fc5..21d24a856a9a1d 100644
--- a/deps/v8/src/compiler/backend/instruction-scheduler.cc
+++ b/deps/v8/src/compiler/backend/instruction-scheduler.cc
@@ -261,6 +261,7 @@ int InstructionScheduler::GetInstructionFlags(const Instruction* instr) const {
     case kArchStackCheckOffset:
     case kArchFramePointer:
     case kArchParentFramePointer:
+    case kArchRootPointer:
     case kArchStackSlot:  // Despite its name this opcode will produce a
                           // reference to a frame slot, so it is not affected
                           // by the arm64 dual stack issues mentioned below.
diff --git a/deps/v8/src/compiler/backend/instruction-selector-adapter.h b/deps/v8/src/compiler/backend/instruction-selector-adapter.h
index cf6c8336420a24..d00f94042cf974 100644
--- a/deps/v8/src/compiler/backend/instruction-selector-adapter.h
+++ b/deps/v8/src/compiler/backend/instruction-selector-adapter.h
@@ -332,14 +332,6 @@ struct TurboshaftAdapter : public turboshaft::OperationMatcher {
     return graph_->OperationIndices(*block);
   }
 
-  bool IsPhi(turboshaft::OpIndex node) const {
-    return graph_->Get(node).Is<turboshaft::PhiOp>();
-  }
-  MachineRepresentation phi_representation_of(turboshaft::OpIndex node) const {
-    DCHECK(IsPhi(node));
-    const turboshaft::PhiOp& phi = graph_->Get(node).Cast<turboshaft::PhiOp>();
-    return phi.rep.machine_representation();
-  }
   bool IsRetain(turboshaft::OpIndex node) const {
     return graph_->Get(node).Is<turboshaft::RetainOp>();
   }
@@ -385,6 +377,7 @@ struct TurboshaftAdapter : public turboshaft::OperationMatcher {
     return LoadView(graph_, node).is_protected(&traps_on_null);
   }
 
+#if !(defined(V8_TARGET_ARCH_X64) || defined(V8_TARGET_ARCH_IA32))
   int value_input_count(turboshaft::OpIndex node) const {
     return graph_->Get(node).input_count;
   }
@@ -398,56 +391,7 @@ struct TurboshaftAdapter : public turboshaft::OperationMatcher {
   turboshaft::Opcode opcode(turboshaft::OpIndex node) const {
     return graph_->Get(node).opcode;
   }
-  bool is_exclusive_user_of(turboshaft::OpIndex user,
-                            turboshaft::OpIndex value) const {
-    DCHECK(user.valid());
-    DCHECK(value.valid());
-    const turboshaft::Operation& value_op = graph_->Get(value);
-    const turboshaft::Operation& user_op = graph_->Get(user);
-    size_t use_count = base::count_if(
-        user_op.inputs(),
-        [value](turboshaft::OpIndex input) { return input == value; });
-    if (V8_UNLIKELY(use_count == 0)) {
-      // We have a special case here:
-      //
-      //         value
-      //           |
-      // TruncateWord64ToWord32
-      //           |
-      //         user
-      //
-      // If emitting user performs the truncation implicitly, we end up calling
-      // CanCover with value and user such that user might have no (direct) uses
-      // of value. There are cases of other unnecessary operations that can lead
-      // to the same situation (e.g. bitwise and, ...). In this case, we still
-      // cover if value has only a single use and this is one of the direct
-      // inputs of user, which also only has a single use (in user).
-      // TODO(nicohartmann@): We might generalize this further if we see use
-      // cases.
-      if (!value_op.saturated_use_count.IsOne()) return false;
-      for (auto input : user_op.inputs()) {
-        const turboshaft::Operation& input_op = graph_->Get(input);
-        const size_t indirect_use_count = base::count_if(
-            input_op.inputs(),
-            [value](turboshaft::OpIndex input) { return input == value; });
-        if (indirect_use_count > 0) {
-          return input_op.saturated_use_count.IsOne();
-        }
-      }
-      return false;
-    }
-    if (value_op.Is<turboshaft::ProjectionOp>()) {
-      // Projections always have a Tuple use, but it shouldn't count as a use as
-      // far as is_exclusive_user_of is concerned, since no instructions are
-      // emitted for the TupleOp, which is just a Turboshaft "meta operation".
-      // We thus increase the use_count by 1, to attribute the TupleOp use to
-      // the current operation.
-      use_count++;
-    }
-    DCHECK_LE(use_count, graph_->Get(value).saturated_use_count.Get());
-    return (value_op.saturated_use_count.Get() == use_count) &&
-           !value_op.saturated_use_count.IsSaturated();
-  }
+#endif
 
   uint32_t id(turboshaft::OpIndex node) const { return node.id(); }
   static turboshaft::OpIndex value(turboshaft::OptionalOpIndex node) {
diff --git a/deps/v8/src/compiler/backend/instruction-selector.cc b/deps/v8/src/compiler/backend/instruction-selector.cc
index 89adb9e42780e5..1edeb0e8f45a46 100644
--- a/deps/v8/src/compiler/backend/instruction-selector.cc
+++ b/deps/v8/src/compiler/backend/instruction-selector.cc
@@ -116,15 +116,16 @@ InstructionSelectorT::InstructionSelectorT(
 
 std::optional<BailoutReason> InstructionSelectorT::SelectInstructions() {
   // Mark the inputs of all phis in loop headers as used.
-  ZoneVector<Block*> blocks = this->rpo_order(schedule());
+  ZoneVector<Block*> blocks = rpo_order(schedule());
   for (const Block* block : blocks) {
-    if (!this->IsLoopHeader(block)) continue;
-    DCHECK_LE(2u, this->PredecessorCount(block));
-    for (OpIndex node : this->nodes(block)) {
-      if (!this->IsPhi(node)) continue;
+    if (!IsLoopHeader(block)) continue;
+    DCHECK_LE(2u, PredecessorCount(block));
+    for (OpIndex node : nodes(block)) {
+      const PhiOp* phi = TryCast<PhiOp>(node);
+      if (!phi) continue;
 
       // Mark all inputs as used.
-      for (OpIndex input : this->inputs(node)) {
+      for (OpIndex input : phi->inputs()) {
         MarkAsUsed(input);
       }
     }
@@ -313,16 +314,66 @@ Instruction* InstructionSelectorT::Emit(Instruction* instr) {
   return instr;
 }
 
+namespace {
+bool is_exclusive_user_of(const Graph* graph, OpIndex user, OpIndex value) {
+  DCHECK(user.valid());
+  DCHECK(value.valid());
+  const Operation& value_op = graph->Get(value);
+  const Operation& user_op = graph->Get(user);
+  size_t use_count = base::count_if(
+      user_op.inputs(), [value](OpIndex input) { return input == value; });
+  if (V8_UNLIKELY(use_count == 0)) {
+    // We have a special case here:
+    //
+    //         value
+    //           |
+    // TruncateWord64ToWord32
+    //           |
+    //         user
+    //
+    // If emitting user performs the truncation implicitly, we end up calling
+    // CanCover with value and user such that user might have no (direct) uses
+    // of value. There are cases of other unnecessary operations that can lead
+    // to the same situation (e.g. bitwise and, ...). In this case, we still
+    // cover if value has only a single use and this is one of the direct
+    // inputs of user, which also only has a single use (in user).
+    // TODO(nicohartmann@): We might generalize this further if we see use
+    // cases.
+    if (!value_op.saturated_use_count.IsOne()) return false;
+    for (auto input : user_op.inputs()) {
+      const Operation& input_op = graph->Get(input);
+      const size_t indirect_use_count = base::count_if(
+          input_op.inputs(), [value](OpIndex input) { return input == value; });
+      if (indirect_use_count > 0) {
+        return input_op.saturated_use_count.IsOne();
+      }
+    }
+    return false;
+  }
+  if (value_op.Is<ProjectionOp>()) {
+    // Projections always have a Tuple use, but it shouldn't count as a use as
+    // far as is_exclusive_user_of is concerned, since no instructions are
+    // emitted for the TupleOp, which is just a Turboshaft "meta operation".
+    // We thus increase the use_count by 1, to attribute the TupleOp use to
+    // the current operation.
+    use_count++;
+  }
+  DCHECK_LE(use_count, graph->Get(value).saturated_use_count.Get());
+  return (value_op.saturated_use_count.Get() == use_count) &&
+         !value_op.saturated_use_count.IsSaturated();
+}
+}  // namespace
+
 bool InstructionSelectorT::CanCover(OpIndex user, OpIndex node) const {
   // 1. Both {user} and {node} must be in the same basic block.
-  if (this->block(schedule(), node) != current_block_) {
+  if (block(schedule(), node) != current_block_) {
     return false;
   }
 
-  const Operation& op = this->Get(node);
+  const Operation& op = Get(node);
   // 2. If node does not produce anything, it can be covered.
   if (op.Effects().produces.bits() == 0) {
-    return this->is_exclusive_user_of(user, node);
+    return is_exclusive_user_of(schedule(), user, node);
   }
 
   // 3. Otherwise, the {node}'s effect level must match the {user}'s.
@@ -331,7 +382,7 @@ bool InstructionSelectorT::CanCover(OpIndex user, OpIndex node) const {
   }
 
   // 4. Only {node} must have value edges pointing to {user}.
-  return this->is_exclusive_user_of(user, node);
+  return is_exclusive_user_of(schedule(), user, node);
 }
 
 bool InstructionSelectorT::CanCoverProtectedLoad(OpIndex user,
@@ -455,7 +506,7 @@ void InstructionSelectorT::SetRename(OpIndex node, OpIndex rename) {
 
 int InstructionSelectorT::GetVirtualRegister(OpIndex node) {
   DCHECK(node.valid());
-  size_t const id = this->id(node);
+  size_t const id = node.id();
   DCHECK_LT(id, virtual_registers_.size());
   int virtual_register = virtual_registers_[id];
   if (virtual_register == InstructionOperand::kInvalidVirtualRegister) {
@@ -479,12 +530,12 @@ InstructionSelectorT::GetVirtualRegistersForTesting() const {
 
 bool InstructionSelectorT::IsDefined(OpIndex node) const {
   DCHECK(node.valid());
-  return defined_.Contains(this->id(node));
+  return defined_.Contains(node.id());
 }
 
 void InstructionSelectorT::MarkAsDefined(OpIndex node) {
   DCHECK(node.valid());
-  defined_.Add(this->id(node));
+  defined_.Add(node.id());
 }
 
 bool InstructionSelectorT::IsUsed(OpIndex node) const {
@@ -493,7 +544,7 @@ bool InstructionSelectorT::IsUsed(OpIndex node) const {
     return false;
   }
   if (Get(node).IsRequiredWhenUnused()) return true;
-  return used_.Contains(this->id(node));
+  return used_.Contains(node.id());
 }
 
 bool InstructionSelectorT::IsReallyUsed(OpIndex node) const {
@@ -501,17 +552,17 @@ bool InstructionSelectorT::IsReallyUsed(OpIndex node) const {
   if (!ShouldSkipOptimizationStep() && ShouldSkipOperation(this->Get(node))) {
     return false;
   }
-  return used_.Contains(this->id(node));
+  return used_.Contains(node.id());
 }
 
 void InstructionSelectorT::MarkAsUsed(OpIndex node) {
   DCHECK(node.valid());
-  used_.Add(this->id(node));
+  used_.Add(node.id());
 }
 
 int InstructionSelectorT::GetEffectLevel(OpIndex node) const {
   DCHECK(node.valid());
-  size_t const id = this->id(node);
+  size_t const id = node.id();
   DCHECK_LT(id, effect_level_.size());
   return effect_level_[id];
 }
@@ -525,7 +576,7 @@ int InstructionSelectorT::GetEffectLevel(OpIndex node,
 
 void InstructionSelectorT::SetEffectLevel(OpIndex node, int effect_level) {
   DCHECK(node.valid());
-  size_t const id = this->id(node);
+  size_t const id = node.id();
   DCHECK_LT(id, effect_level_.size());
   effect_level_[id] = effect_level;
 }
@@ -656,50 +707,6 @@ InstructionOperand OperandForDeopt(Isolate* isolate, OperandGeneratorT* g,
 
 }  // namespace
 
-class TurbofanStateObjectDeduplicator {
- public:
-  explicit TurbofanStateObjectDeduplicator(Zone* zone) : objects_(zone) {}
-  static const size_t kNotDuplicated = SIZE_MAX;
-
-  size_t GetObjectId(Node* node) {
-    DCHECK(node->opcode() == IrOpcode::kTypedObjectState ||
-           node->opcode() == IrOpcode::kObjectId ||
-           node->opcode() == IrOpcode::kArgumentsElementsState);
-    for (size_t i = 0; i < objects_.size(); ++i) {
-      if (objects_[i] == node) return i;
-      // ObjectId nodes are the Turbofan way to express objects with the same
-      // identity in the deopt info. So they should always be mapped to
-      // previously appearing TypedObjectState nodes.
-      if (HasObjectId(objects_[i]) && HasObjectId(node) &&
-          ObjectIdOf(objects_[i]->op()) == ObjectIdOf(node->op())) {
-        return i;
-      }
-    }
-    DCHECK(node->opcode() == IrOpcode::kTypedObjectState ||
-           node->opcode() == IrOpcode::kArgumentsElementsState);
-    return kNotDuplicated;
-  }
-
-  size_t InsertObject(Node* node) {
-    DCHECK(node->opcode() == IrOpcode::kTypedObjectState ||
-           node->opcode() == IrOpcode::kObjectId ||
-           node->opcode() == IrOpcode::kArgumentsElementsState);
-    size_t id = objects_.size();
-    objects_.push_back(node);
-    return id;
-  }
-
-  size_t size() const { return objects_.size(); }
-
- private:
-  static bool HasObjectId(Node* node) {
-    return node->opcode() == IrOpcode::kTypedObjectState ||
-           node->opcode() == IrOpcode::kObjectId;
-  }
-
-  ZoneVector<Node*> objects_;
-};
-
 enum class ObjectType { kRegularObject, kStringConcat };
 
 class TurboshaftStateObjectDeduplicator {
@@ -1365,7 +1372,7 @@ bool InstructionSelectorT::IsSourcePositionUsed(OpIndex node) {
     }
 #endif  // V8_ENABLE_WASM_DEINTERLEAVED_MEM_OPS
 #endif
-    if (additional_protected_instructions_->Contains(this->id(node))) {
+    if (additional_protected_instructions_->Contains(node.id())) {
       return true;
     }
     return false;
@@ -1439,16 +1446,17 @@ void InstructionSelectorT::VisitBlock(const Block* block) {
 
     SourcePosition source_position;
 #if V8_ENABLE_WEBASSEMBLY && V8_TARGET_ARCH_X64
-    if (V8_UNLIKELY(this->Get(node)
-                        .template Is<Opmask::kSimd128F64x2PromoteLowF32x4>())) {
+    if (const Simd128UnaryOp* op =
+            TryCast<Opmask::kSimd128F64x2PromoteLowF32x4>(node);
+        V8_UNLIKELY(op)) {
       // On x64 there exists an optimization that folds
       // `kF64x2PromoteLowF32x4` and `kS128Load64Zero` together into a single
       // instruction. If the instruction causes an out-of-bounds memory
       // access exception, then the stack trace has to show the source
       // position of the `kS128Load64Zero` and not of the
       // `kF64x2PromoteLowF32x4`.
-      if (this->CanOptimizeF64x2PromoteLowF32x4(node)) {
-        node = this->input_at(node, 0);
+      if (CanOptimizeF64x2PromoteLowF32x4(node)) {
+        node = op->input();
       }
     }
 #endif  // V8_ENABLE_WEBASSEMBLY && V8_TARGET_ARCH_X64
@@ -1472,10 +1480,10 @@ void InstructionSelectorT::VisitBlock(const Block* block) {
   for (OpIndex node : base::Reversed(this->nodes(block))) {
     int current_node_end = current_num_instructions();
 
-      if (protected_loads_to_remove_->Contains(this->id(node)) &&
-          !IsReallyUsed(node)) {
-        MarkAsDefined(node);
-      }
+    if (protected_loads_to_remove_->Contains(node.id()) &&
+        !IsReallyUsed(node)) {
+      MarkAsDefined(node);
+    }
 
     if (!IsUsed(node)) {
       // Skip nodes that are unused, while marking them as Defined so that it's
@@ -1490,8 +1498,8 @@ void InstructionSelectorT::VisitBlock(const Block* block) {
       if (!FinishEmittedInstructions(node, current_node_end)) return;
     }
     if (trace_turbo_ == InstructionSelector::kEnableTraceTurboJson) {
-      instr_origins_[this->id(node)] = {current_num_instructions(),
-                                        current_node_end};
+      instr_origins_[node.id()] = {current_num_instructions(),
+                                   current_node_end};
     }
   }
 
@@ -1593,9 +1601,8 @@ void InstructionSelectorT::VisitLoadParentFramePointer(OpIndex node) {
 }
 
 void InstructionSelectorT::VisitLoadRootRegister(OpIndex node) {
-  // Do nothing. Following loads/stores from this operator will use kMode_Root
-  // to load/store from an offset of the root register.
-  UNREACHABLE();
+  OperandGenerator g(this);
+  Emit(kArchRootPointer, g.DefineAsRegister(node));
 }
 
 void InstructionSelectorT::VisitFloat64Acos(OpIndex node) {
@@ -1682,6 +1689,13 @@ void InstructionSelectorT::VisitFloat64Tanh(OpIndex node) {
   VisitFloat64Ieee754Unop(node, kIeee754Float64Tanh);
 }
 
+void InstructionSelectorT::MarkAsTableSwitchTarget(
+    const turboshaft::Block* block) {
+  sequence()
+      ->InstructionBlockAt(this->rpo_number(block))
+      ->set_table_switch_target(true);
+}
+
 void InstructionSelectorT::EmitTableSwitch(
     const SwitchInfo& sw, InstructionOperand const& index_operand) {
   OperandGenerator g(this);
@@ -1697,6 +1711,13 @@ void InstructionSelectorT::EmitTableSwitch(
     DCHECK_LE(0u, value);
     DCHECK_LT(value + 2, input_count);
     inputs[value + 2] = g.Label(c.branch);
+    MarkAsTableSwitchTarget(c.branch);
+  }
+  // If the default operand still exists in the cases, to fill gaps, then we
+  // need to mark the default block as table switch target.
+  if (std::find(&inputs[2], &inputs[input_count], default_operand) !=
+      &inputs[input_count]) {
+    MarkAsTableSwitchTarget(sw.default_branch());
   }
   Emit(kArchTableSwitch, 0, nullptr, input_count, inputs, 0, nullptr);
 }
@@ -1956,16 +1977,16 @@ void InstructionSelectorT::VisitOsrValue(OpIndex node) {
 }
 
 void InstructionSelectorT::VisitPhi(OpIndex node) {
-  const int input_count = this->value_input_count(node);
-  DCHECK_EQ(input_count, this->PredecessorCount(current_block_));
+  const Operation& op = Get(node);
+  DCHECK_EQ(op.input_count, PredecessorCount(current_block_));
   PhiInstruction* phi = instruction_zone()->template New<PhiInstruction>(
       instruction_zone(), GetVirtualRegister(node),
-      static_cast<size_t>(input_count));
-  sequence()->InstructionBlockAt(this->rpo_number(current_block_))->AddPhi(phi);
-  for (int i = 0; i < input_count; ++i) {
-    OpIndex input = this->input_at(node, i);
+      static_cast<size_t>(op.input_count));
+  sequence()->InstructionBlockAt(rpo_number(current_block_))->AddPhi(phi);
+  for (size_t i = 0; i < op.input_count; ++i) {
+    OpIndex input = op.input(i);
     MarkAsUsed(input);
-    phi->SetInput(static_cast<size_t>(i), GetVirtualRegister(input));
+    phi->SetInput(i, GetVirtualRegister(input));
   }
 }
 
@@ -2360,8 +2381,13 @@ void InstructionSelectorT::VisitBranch(OpIndex branch_node, Block* tbranch,
   const BranchOp& branch = Cast<BranchOp>(branch_node);
   TryPrepareScheduleFirstProjection(branch.condition());
 
+#if V8_ENABLE_WEBASSEMBLY
+  FlagsContinuation cont = FlagsContinuation::ForHintedBranch(
+      kNotEqual, tbranch, fbranch, branch.hint);
+#else
   FlagsContinuation cont =
       FlagsContinuation::ForBranch(kNotEqual, tbranch, fbranch);
+#endif  // V8_ENABLE_WEBASSEMBLY
   VisitWordCompareZero(branch_node, branch.condition(), &cont);
 }
 
@@ -2399,16 +2425,16 @@ void InstructionSelectorT::TryPrepareScheduleFirstProjection(
     return;
   }
 
-  DCHECK_EQ(this->value_input_count(maybe_projection), 1);
-  OpIndex node = this->input_at(maybe_projection, 0);
-  if (this->block(schedule_, node) != current_block_) {
+  DCHECK_EQ(projection->input_count, 1);
+  OpIndex node = projection->input();
+  if (block(schedule_, node) != current_block_) {
     // The projection input is not in the current block, so it shouldn't be
     // emitted now, so we don't need to eagerly schedule its Projection[0].
     return;
   }
 
-  auto* binop = this->Get(node).template TryCast<OverflowCheckedBinopOp>();
-  auto* unop = this->Get(node).template TryCast<OverflowCheckedUnaryOp>();
+  auto* binop = TryCast<OverflowCheckedBinopOp>(node);
+  auto* unop = TryCast<OverflowCheckedUnaryOp>(node);
   if (binop == nullptr && unop == nullptr) return;
   if (binop) {
     DCHECK(binop->kind == OverflowCheckedBinopOp::Kind::kSignedAdd ||
@@ -2424,7 +2450,7 @@ void InstructionSelectorT::TryPrepareScheduleFirstProjection(
     return;
   }
 
-  if (this->block(schedule_, result.value()) != current_block_) {
+  if (block(schedule_, result.value()) != current_block_) {
     // {result} wasn't planned to be scheduled in {current_block_}. To
     // avoid adding checks to see if it can still be scheduled now, we
     // just bail out.
@@ -2440,9 +2466,8 @@ void InstructionSelectorT::TryPrepareScheduleFirstProjection(
   for (OpIndex use : turboshaft_uses(result.value())) {
     // We ignore TupleOp uses, since TupleOp don't lead to emitted machine
     // instructions and are just Turboshaft "meta operations".
-    if (!this->Get(use).template Is<TupleOp>() && !IsDefined(use) &&
-        this->block(schedule_, use) == current_block_ &&
-        !this->Get(use).template Is<PhiOp>()) {
+    if (!Is<TupleOp>(use) && !IsDefined(use) &&
+        block(schedule_, use) == current_block_ && !Is<PhiOp>(use)) {
       return;
     }
   }
@@ -2470,34 +2495,33 @@ void InstructionSelectorT::VisitDeoptimizeIf(OpIndex node) {
 }
 
 void InstructionSelectorT::VisitSelect(OpIndex node) {
-  DCHECK_EQ(this->value_input_count(node), 3);
+  const SelectOp& select = Cast<SelectOp>(node);
+  DCHECK_EQ(select.input_count, 3);
   FlagsContinuation cont = FlagsContinuation::ForSelect(
-      kNotEqual, node, this->input_at(node, 1), this->input_at(node, 2));
-  VisitWordCompareZero(node, this->input_at(node, 0), &cont);
+      kNotEqual, node, select.vtrue(), select.vfalse());
+  VisitWordCompareZero(node, select.cond(), &cont);
 }
 
-void InstructionSelectorT::VisitTrapIf(OpIndex node, TrapId trap_id) {
+void InstructionSelectorT::VisitTrapIf(OpIndex node) {
+#if V8_ENABLE_WEBASSEMBLY
+  const TrapIfOp& trap_if = Cast<TrapIfOp>(node);
   // FrameStates are only used for wasm traps inlined in JS. In that case the
   // trap node will be lowered (replaced) before instruction selection.
   // Therefore any TrapIf node has only one input.
-  DCHECK_EQ(this->value_input_count(node), 1);
-  FlagsContinuation cont = FlagsContinuation::ForTrap(kNotEqual, trap_id);
-  VisitWordCompareZero(node, this->input_at(node, 0), &cont);
-}
-
-void InstructionSelectorT::VisitTrapUnless(OpIndex node, TrapId trap_id) {
-  // FrameStates are only used for wasm traps inlined in JS. In that case the
-  // trap node will be lowered (replaced) before instruction selection.
-  // Therefore any TrapUnless node has only one input.
-  DCHECK_EQ(this->value_input_count(node), 1);
-  FlagsContinuation cont = FlagsContinuation::ForTrap(kEqual, trap_id);
-  VisitWordCompareZero(node, this->input_at(node, 0), &cont);
+  DCHECK_EQ(trap_if.input_count, 1);
+  FlagsContinuation cont = FlagsContinuation::ForTrap(
+      trap_if.negated ? kEqual : kNotEqual, trap_if.trap_id);
+  VisitWordCompareZero(node, trap_if.condition(), &cont);
+#else
+  UNREACHABLE();
+#endif
 }
 
 void InstructionSelectorT::EmitIdentity(OpIndex node) {
-  MarkAsUsed(this->input_at(node, 0));
+  const Operation& op = Get(node);
+  MarkAsUsed(op.input(0));
   MarkAsDefined(node);
-  SetRename(node, this->input_at(node, 0));
+  SetRename(node, op.input(0));
 }
 
 void InstructionSelectorT::VisitDeoptimize(DeoptimizeReason reason,
@@ -2525,16 +2549,17 @@ void InstructionSelectorT::VisitUnreachable(OpIndex node) {
 }
 
 void InstructionSelectorT::VisitStaticAssert(OpIndex node) {
-  DCHECK_EQ(this->value_input_count(node), 1);
-  OpIndex asserted = this->input_at(node, 0);
+  const StaticAssertOp& op = Cast<StaticAssertOp>(node);
+  DCHECK_EQ(op.input_count, 1);
+  OpIndex asserted = op.condition();
   UnparkedScopeIfNeeded scope(broker_);
   AllowHandleDereference allow_handle_dereference;
     StdoutStream os;
-    os << this->Get(asserted);
+    os << Get(asserted);
     FATAL(
         "Expected Turbofan static assert to hold, but got non-true input:\n  "
         "%s",
-        this->Get(node).template Cast<StaticAssertOp>().source);
+        op.source);
 }
 
 void InstructionSelectorT::VisitComment(OpIndex node) {
@@ -2549,9 +2574,10 @@ void InstructionSelectorT::VisitComment(OpIndex node) {
 }
 
 void InstructionSelectorT::VisitRetain(OpIndex node) {
+  const RetainOp& retain = Cast<RetainOp>(node);
   OperandGenerator g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
-  Emit(kArchNop, g.NoOutput(), g.UseAny(this->input_at(node, 0)));
+  DCHECK_EQ(retain.input_count, 1);
+  Emit(kArchNop, g.NoOutput(), g.UseAny(retain.retained()));
 }
 
 void InstructionSelectorT::VisitControl(const Block* block) {
@@ -2638,7 +2664,7 @@ void InstructionSelectorT::VisitControl(const Block* block) {
   if (trace_turbo_ == InstructionSelector::kEnableTraceTurboJson) {
     DCHECK(node.valid());
     int instruction_start = static_cast<int>(instructions_.size());
-    instr_origins_[this->id(node)] = {instruction_start, instruction_end};
+    instr_origins_[node.id()] = {instruction_start, instruction_end};
   }
 }
 
@@ -3378,13 +3404,8 @@ void InstructionSelectorT::VisitNode(OpIndex node) {
     case Opcode::kDeoptimizeIf:
       return VisitDeoptimizeIf(node);
 #if V8_ENABLE_WEBASSEMBLY
-    case Opcode::kTrapIf: {
-      const TrapIfOp& trap_if = op.Cast<TrapIfOp>();
-      if (trap_if.negated) {
-        return VisitTrapUnless(node, trap_if.trap_id);
-      }
-      return VisitTrapIf(node, trap_if.trap_id);
-    }
+    case Opcode::kTrapIf:
+      return VisitTrapIf(node);
 #endif  // V8_ENABLE_WEBASSEMBLY
     case Opcode::kCatchBlockBegin:
       MarkAsTagged(node);
@@ -3792,6 +3813,7 @@ void InstructionSelectorT::VisitNode(OpIndex node) {
       return VisitLoadStackPointer(node);
 
     case Opcode::kSetStackPointer:
+      this->frame_->set_invalidates_sp();
       return VisitSetStackPointer(node);
 
 #endif  // V8_ENABLE_WEBASSEMBLY
@@ -3834,7 +3856,7 @@ bool InstructionSelectorT::ZeroExtendsWord32ToWord64(OpIndex node,
   // large functions.
   const int kMaxRecursionDepth = 100;
 
-  if (this->IsPhi(node)) {
+  if (const PhiOp* phi = TryCast<PhiOp>(node)) {
     if (recursion_depth == 0) {
       if (phi_states_.empty()) {
         // This vector is lazily allocated because the majority of compilations
@@ -3844,7 +3866,7 @@ bool InstructionSelectorT::ZeroExtendsWord32ToWord64(OpIndex node,
       }
     }
 
-    Upper32BitsState current = phi_states_[this->id(node)];
+    Upper32BitsState current = phi_states_[node.id()];
     if (current != Upper32BitsState::kNotYetChecked) {
       return current == Upper32BitsState::kZero;
     }
@@ -3858,11 +3880,10 @@ bool InstructionSelectorT::ZeroExtendsWord32ToWord64(OpIndex node,
     // Optimistically mark the current node as zero-extended so that we skip it
     // if we recursively visit it again due to a cycle. If this optimistic guess
     // is wrong, it will be corrected in MarkNodeAsNotZeroExtended.
-    phi_states_[this->id(node)] = Upper32BitsState::kZero;
+    phi_states_[node.id()] = Upper32BitsState::kZero;
 
-    int input_count = this->value_input_count(node);
-    for (int i = 0; i < input_count; ++i) {
-      OpIndex input = this->input_at(node, i);
+    for (int i = 0; i < phi->input_count; ++i) {
+      OpIndex input = phi->input(i);
       if (!ZeroExtendsWord32ToWord64(input, recursion_depth + 1)) {
         MarkNodeAsNotZeroExtended(node);
         return false;
@@ -3875,8 +3896,8 @@ bool InstructionSelectorT::ZeroExtendsWord32ToWord64(OpIndex node,
 }
 
 void InstructionSelectorT::MarkNodeAsNotZeroExtended(OpIndex node) {
-  if (phi_states_[this->id(node)] == Upper32BitsState::kMayBeNonZero) return;
-  phi_states_[this->id(node)] = Upper32BitsState::kMayBeNonZero;
+  if (phi_states_[node.id()] == Upper32BitsState::kMayBeNonZero) return;
+  phi_states_[node.id()] = Upper32BitsState::kMayBeNonZero;
   ZoneVector<OpIndex> worklist(zone_);
   worklist.push_back(node);
   while (!worklist.empty()) {
@@ -3885,8 +3906,8 @@ void InstructionSelectorT::MarkNodeAsNotZeroExtended(OpIndex node) {
     // We may have previously marked some uses of this node as zero-extended,
     // but that optimistic guess was proven incorrect.
     for (OpIndex use : turboshaft_uses(node)) {
-      if (phi_states_[this->id(use)] == Upper32BitsState::kZero) {
-        phi_states_[this->id(use)] = Upper32BitsState::kMayBeNonZero;
+      if (phi_states_[use.id()] == Upper32BitsState::kZero) {
+        phi_states_[use.id()] = Upper32BitsState::kMayBeNonZero;
         worklist.push_back(use);
       }
     }
diff --git a/deps/v8/src/compiler/backend/instruction-selector.h b/deps/v8/src/compiler/backend/instruction-selector.h
index 2059ecf7060ff4..62fee1a191d355 100644
--- a/deps/v8/src/compiler/backend/instruction-selector.h
+++ b/deps/v8/src/compiler/backend/instruction-selector.h
@@ -140,6 +140,14 @@ class FlagsContinuationT final {
                               false_block);
   }
 
+  static FlagsContinuationT ForHintedBranch(FlagsCondition condition,
+                                            turboshaft::Block* true_block,
+                                            turboshaft::Block* false_block,
+                                            BranchHint hint) {
+    return FlagsContinuationT(kFlags_branch, condition, true_block, false_block,
+                              hint);
+  }
+
   // Creates a new flags continuation from the given conditional compare chain
   // and true/false blocks.
   static FlagsContinuationT ForConditionalBranch(
@@ -245,6 +253,10 @@ class FlagsContinuationT final {
     DCHECK(IsBranch() || IsConditionalBranch());
     return false_block_;
   }
+  BranchHint hint() const {
+    DCHECK(IsBranch());
+    return hint_;
+  }
   turboshaft::OpIndex true_value() const {
     DCHECK(IsSelect());
     return true_value_;
@@ -329,6 +341,19 @@ class FlagsContinuationT final {
     DCHECK_NOT_NULL(false_block);
   }
 
+  FlagsContinuationT(FlagsMode mode, FlagsCondition condition,
+                     turboshaft::Block* true_block,
+                     turboshaft::Block* false_block, BranchHint hint)
+      : mode_(mode),
+        condition_(condition),
+        true_block_(true_block),
+        false_block_(false_block),
+        hint_(hint) {
+    DCHECK_EQ(mode, kFlags_branch);
+    DCHECK_NOT_NULL(true_block);
+    DCHECK_NOT_NULL(false_block);
+  }
+
   FlagsContinuationT(compare_chain_t& compares,
                      uint32_t num_conditional_compares,
                      FlagsCondition branch_condition,
@@ -412,6 +437,7 @@ class FlagsContinuationT final {
   TrapId trap_id_;                  // Only valid if mode_ == kFlags_trap.
   turboshaft::OpIndex true_value_;  // Only valid if mode_ == kFlags_select.
   turboshaft::OpIndex false_value_;  // Only valid if mode_ == kFlags_select.
+  BranchHint hint_ = BranchHint::kNone;
 };
 
 // This struct connects nodes of parameters which are going to be pushed on the
@@ -648,6 +674,12 @@ class InstructionSelectorT final : public TurboshaftAdapter {
   auto InputsImpl(const Op& op, std::index_sequence<Is...>) {
     return std::make_tuple(op.input(Is)...);
   }
+  template <size_t InputCount>
+  auto Inputs(turboshaft::OpIndex node) {
+    const turboshaft::Operation& op = Get(node);
+    DCHECK_EQ(InputCount, op.input_count);
+    return InputsImpl(op, std::make_index_sequence<InputCount>());
+  }
 
   // When we want to do branch-if-overflow fusion, we need to be mindful of the
   // 1st projection of the OverflowBinop:
@@ -662,14 +694,14 @@ class InstructionSelectorT final : public TurboshaftAdapter {
   // though it has a required_when_unused effect.
   void SetProtectedLoadToRemove(turboshaft::OpIndex node) {
     DCHECK(this->IsProtectedLoad(node));
-    protected_loads_to_remove_->Add(this->id(node));
+    protected_loads_to_remove_->Add(node.id());
   }
 
   // Records that this node embeds a ProtectedLoad as operand, and so it is
   // itself a "protected" instruction, for which we'll need to record the source
   // position.
   void MarkAsProtected(turboshaft::OpIndex node) {
-    additional_protected_instructions_->Add(this->id(node));
+    additional_protected_instructions_->Add(node.id());
   }
 
   void UpdateSourcePosition(Instruction* instruction, turboshaft::OpIndex node);
@@ -697,6 +729,8 @@ class InstructionSelectorT final : public TurboshaftAdapter {
   void EmitBinarySearchSwitch(const SwitchInfo& sw,
                               InstructionOperand const& value_operand);
 
+  void MarkAsTableSwitchTarget(const turboshaft::Block* block);
+
   void TryRename(InstructionOperand* op);
   int GetRename(int virtual_register);
   void SetRename(turboshaft::OpIndex node, turboshaft::OpIndex rename);
@@ -1053,8 +1087,7 @@ class InstructionSelectorT final : public TurboshaftAdapter {
   void VisitCall(turboshaft::OpIndex call, turboshaft::Block* handler = {});
   void VisitDeoptimizeIf(turboshaft::OpIndex node);
   void VisitDynamicCheckMapsWithDeoptUnless(Node* node);
-  void VisitTrapIf(turboshaft::OpIndex node, TrapId trap_id);
-  void VisitTrapUnless(turboshaft::OpIndex node, TrapId trap_id);
+  void VisitTrapIf(turboshaft::OpIndex node);
   void VisitTailCall(turboshaft::OpIndex call);
   void VisitGoto(turboshaft::Block* target);
   void VisitBranch(turboshaft::OpIndex input, turboshaft::Block* tbranch,
diff --git a/deps/v8/src/compiler/backend/instruction.cc b/deps/v8/src/compiler/backend/instruction.cc
index b1feefe9990edc..81be562bc03639 100644
--- a/deps/v8/src/compiler/backend/instruction.cc
+++ b/deps/v8/src/compiler/backend/instruction.cc
@@ -673,7 +673,7 @@ InstructionBlock::InstructionBlock(Zone* zone, RpoNumber rpo_number,
       dominator_(dominator),
       deferred_(deferred),
       handler_(handler),
-      switch_target_(false),
+      table_switch_target_(false),
       code_target_alignment_(false),
       loop_header_alignment_(false),
       needs_frame_(!v8_flags.turbo_elide_frames),
@@ -730,10 +730,6 @@ static InstructionBlock* InstructionBlockFor(Zone* zone,
   for (BasicBlock* predecessor : block->predecessors()) {
     instr_block->predecessors().push_back(GetRpo(predecessor));
   }
-  if (block->PredecessorCount() == 1 &&
-      block->predecessors()[0]->control() == BasicBlock::Control::kSwitch) {
-    instr_block->set_switch_target(true);
-  }
   return instr_block;
 }
 
@@ -747,13 +743,6 @@ static InstructionBlock* InstructionBlockFor(
   InstructionBlock* instr_block = zone->New<InstructionBlock>(
       zone, GetRpo(block), GetRpo(loop_header), GetLoopEndRpo(block),
       GetRpo(block->GetDominator()), deferred, is_handler);
-  if (block->PredecessorCount() == 1) {
-    const turboshaft::Block* predecessor = block->LastPredecessor();
-    if (V8_UNLIKELY(
-            predecessor->LastOperation(graph).Is<turboshaft::SwitchOp>())) {
-      instr_block->set_switch_target(true);
-    }
-  }
   // Map successors and predecessors.
   base::SmallVector<turboshaft::Block*, 4> succs =
       turboshaft::SuccessorBlocks(block->LastOperation(graph));
@@ -931,7 +920,8 @@ void InstructionSequence::ComputeAssemblyOrder() {
         // Perform loop rotation for non-deferred loops.
         InstructionBlock* loop_end =
             instruction_blocks_->at(block->loop_end().ToSize() - 1);
-        if (loop_end->SuccessorCount() == 1 && /* ends with goto */
+        if (!loop_end->IsDeferred() &&         /* Ignore deferred loop ends */
+            loop_end->SuccessorCount() == 1 && /* ends with goto */
             loop_end != block /* not a degenerate infinite loop */) {
           // If the last block has an unconditional jump back to the header,
           // then move it to be in front of the header in the assembly order.
@@ -946,7 +936,7 @@ void InstructionSequence::ComputeAssemblyOrder() {
       }
       block->set_loop_header_alignment(header_align);
     }
-    if (block->loop_header().IsValid() && block->IsSwitchTarget()) {
+    if (block->loop_header().IsValid() && block->IsTableSwitchTarget()) {
       block->set_code_target_alignment(true);
     }
     block->set_ao_number(RpoNumber::FromInt(ao++));
diff --git a/deps/v8/src/compiler/backend/instruction.h b/deps/v8/src/compiler/backend/instruction.h
index 99d9369bc34718..b6231ca27adda7 100644
--- a/deps/v8/src/compiler/backend/instruction.h
+++ b/deps/v8/src/compiler/backend/instruction.h
@@ -961,6 +961,7 @@ class V8_EXPORT_PRIVATE Instruction final {
   FlagsCondition flags_condition() const {
     return FlagsConditionField::decode(opcode());
   }
+  bool branch_hinted() const { return BranchHintField::decode(opcode()); }
   int misc() const { return MiscField::decode(opcode()); }
   bool HasMemoryAccessMode() const {
     return compiler::HasMemoryAccessMode(arch_opcode());
@@ -1742,7 +1743,7 @@ class V8_EXPORT_PRIVATE InstructionBlock final
     return loop_end_;
   }
   inline bool IsLoopHeader() const { return loop_end_.IsValid(); }
-  inline bool IsSwitchTarget() const { return switch_target_; }
+  inline bool IsTableSwitchTarget() const { return table_switch_target_; }
   inline bool ShouldAlignCodeTarget() const { return code_target_alignment_; }
   inline bool ShouldAlignLoopHeader() const { return loop_header_alignment_; }
   inline bool IsLoopHeaderInAssemblyOrder() const {
@@ -1775,7 +1776,7 @@ class V8_EXPORT_PRIVATE InstructionBlock final
   void set_code_target_alignment(bool val) { code_target_alignment_ = val; }
   void set_loop_header_alignment(bool val) { loop_header_alignment_ = val; }
 
-  void set_switch_target(bool val) { switch_target_ = val; }
+  void set_table_switch_target(bool val) { table_switch_target_ = val; }
 
   bool needs_frame() const { return needs_frame_; }
   void mark_needs_frame() { needs_frame_ = true; }
@@ -1800,7 +1801,8 @@ class V8_EXPORT_PRIVATE InstructionBlock final
   int32_t code_end_ = -1;    // end index of arch-specific code.
   const bool deferred_ : 1;  // Block contains deferred code.
   bool handler_ : 1;         // Block is a handler entry point.
-  bool switch_target_ : 1;
+  bool table_switch_target_ : 1;  // Block is a table switch target, implying an
+                                  //  indirect jump.
   bool code_target_alignment_ : 1;  // insert code target alignment before this
                                     // block
   bool loop_header_alignment_ : 1;  // insert loop header alignment before this
diff --git a/deps/v8/src/compiler/backend/jump-threading.cc b/deps/v8/src/compiler/backend/jump-threading.cc
index 77773c02dabc95..efd6328c6db829 100644
--- a/deps/v8/src/compiler/backend/jump-threading.cc
+++ b/deps/v8/src/compiler/backend/jump-threading.cc
@@ -272,8 +272,8 @@ void JumpThreading::ApplyForwarding(Zone* local_zone,
       if (code->InstructionBlockAt(block_rpo)->IsHandler()) {
         code->InstructionBlockAt(result_rpo)->MarkHandler();
       }
-      if (code->InstructionBlockAt(block_rpo)->IsSwitchTarget()) {
-        code->InstructionBlockAt(result_rpo)->set_switch_target(true);
+      if (code->InstructionBlockAt(block_rpo)->IsTableSwitchTarget()) {
+        code->InstructionBlockAt(result_rpo)->set_table_switch_target(true);
       }
     }
 
@@ -300,7 +300,7 @@ void JumpThreading::ApplyForwarding(Zone* local_zone,
           // If this block was marked as a handler or a switch target, it can be
           // unmarked now.
           code->InstructionBlockAt(block_rpo)->UnmarkHandler();
-          code->InstructionBlockAt(block_rpo)->set_switch_target(false);
+          code->InstructionBlockAt(block_rpo)->set_table_switch_target(false);
           code->InstructionBlockAt(block_rpo)->set_omitted_by_jump_threading();
         }
       }
diff --git a/deps/v8/src/compiler/backend/loong64/code-generator-loong64.cc b/deps/v8/src/compiler/backend/loong64/code-generator-loong64.cc
index b7f4598914f885..19b0cd2fc488c4 100644
--- a/deps/v8/src/compiler/backend/loong64/code-generator-loong64.cc
+++ b/deps/v8/src/compiler/backend/loong64/code-generator-loong64.cc
@@ -942,6 +942,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ mov(i.OutputRegister(), fp);
       }
       break;
+    case kArchRootPointer:
+      __ mov(i.OutputRegister(), kRootRegister);
+      break;
     case kArchTruncateDoubleToI:
       __ TruncateDoubleToI(isolate(), zone(), i.OutputRegister(),
                            i.InputDoubleRegister(0), DetermineStubCallMode());
diff --git a/deps/v8/src/compiler/backend/loong64/instruction-selector-loong64.cc b/deps/v8/src/compiler/backend/loong64/instruction-selector-loong64.cc
index 6c8ba44af0996c..5445a5e7edd1af 100644
--- a/deps/v8/src/compiler/backend/loong64/instruction-selector-loong64.cc
+++ b/deps/v8/src/compiler/backend/loong64/instruction-selector-loong64.cc
@@ -378,14 +378,15 @@ void EmitLoad(InstructionSelectorT* selector, turboshaft::OpIndex node,
   output_op = g.DefineAsRegister(output.valid() ? output : node);
 
   const Operation& base_op = selector->Get(base);
-  int64_t index_value;
-  if (base_op.Is<Opmask::kExternalConstant>() &&
-      selector->MatchSignedIntegralConstant(index, &index_value)) {
+  int64_t index_constant;
+  const bool is_index_constant =
+      selector->MatchSignedIntegralConstant(index, &index_constant);
+  if (base_op.Is<Opmask::kExternalConstant>() && is_index_constant) {
     const ConstantOp& constant_base = base_op.Cast<ConstantOp>();
     if (selector->CanAddressRelativeToRootsRegister(
             constant_base.external_reference())) {
       ptrdiff_t const delta =
-          index_value +
+          index_constant +
           MacroAssemblerBase::RootRegisterOffsetForExternalReference(
               selector->isolate(), constant_base.external_reference());
       input_count = 1;
@@ -400,11 +401,9 @@ void EmitLoad(InstructionSelectorT* selector, turboshaft::OpIndex node,
     }
   }
 
-  if (base_op.Is<LoadRootRegisterOp>()) {
-    int64_t index_value;
-    CHECK(selector->MatchSignedIntegralConstant(index, &index_value));
+  if (base_op.Is<LoadRootRegisterOp>() && is_index_constant) {
     input_count = 1;
-    inputs[0] = g.UseImmediate64(index_value);
+    inputs[0] = g.UseImmediate64(index_constant);
     opcode |= AddressingModeField::encode(kMode_Root);
     selector->Emit(opcode, 1, &output_op, input_count, inputs);
     return;
@@ -1933,7 +1932,8 @@ void InstructionSelectorT::VisitStackPointerGreaterThan(
   kind = op.kind;
   value = op.stack_limit();
   InstructionCode opcode =
-      kArchStackPointerGreaterThan | MiscField::encode(static_cast<int>(kind));
+      kArchStackPointerGreaterThan |
+      StackCheckField::encode(static_cast<StackCheckKind>(kind));
 
   Loong64OperandGeneratorT g(this);
 
diff --git a/deps/v8/src/compiler/backend/mips64/code-generator-mips64.cc b/deps/v8/src/compiler/backend/mips64/code-generator-mips64.cc
index be0350a5e7a1ee..262465ba74ef3e 100644
--- a/deps/v8/src/compiler/backend/mips64/code-generator-mips64.cc
+++ b/deps/v8/src/compiler/backend/mips64/code-generator-mips64.cc
@@ -860,6 +860,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ mov(i.OutputRegister(), fp);
       }
       break;
+    case kArchRootPointer:
+      __ mov(i.OutputRegister(), kRootRegister);
+      break;
     case kArchTruncateDoubleToI:
       __ TruncateDoubleToI(isolate(), zone(), i.OutputRegister(),
                            i.InputDoubleRegister(0), DetermineStubCallMode());
@@ -1076,13 +1079,13 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ And(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
       break;
     case kMips64And32:
-        __ And(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
+      __ And(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
       break;
     case kMips64Or:
       __ Or(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
       break;
     case kMips64Or32:
-        __ Or(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
+      __ Or(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
       break;
     case kMips64Nor:
       if (instr->InputAt(1)->IsRegister()) {
@@ -1104,8 +1107,8 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       __ Xor(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
       break;
     case kMips64Xor32:
-        __ Xor(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
-        __ sll(i.OutputRegister(), i.OutputRegister(), 0x0);
+      __ Xor(i.OutputRegister(), i.InputRegister(0), i.InputOperand(1));
+      __ sll(i.OutputRegister(), i.OutputRegister(), 0x0);
       break;
     case kMips64Clz:
       __ Clz(i.OutputRegister(), i.InputRegister(0));
diff --git a/deps/v8/src/compiler/backend/mips64/instruction-selector-mips64.cc b/deps/v8/src/compiler/backend/mips64/instruction-selector-mips64.cc
index 3549b7c55a3005..24f263a79c8851 100644
--- a/deps/v8/src/compiler/backend/mips64/instruction-selector-mips64.cc
+++ b/deps/v8/src/compiler/backend/mips64/instruction-selector-mips64.cc
@@ -351,14 +351,15 @@ void EmitLoad(InstructionSelectorT* selector, OpIndex node,
   output_op = g.DefineAsRegister(output.valid() ? output : node);
 
   const Operation& base_op = selector->Get(base);
-  int64_t index_value;
-  if (base_op.Is<Opmask::kExternalConstant>() &&
-      selector->MatchSignedIntegralConstant(index, &index_value)) {
+  int64_t index_constant;
+  const bool is_index_constant =
+      selector->MatchSignedIntegralConstant(index, &index_constant);
+  if (base_op.Is<Opmask::kExternalConstant>() && is_index_constant) {
     const ConstantOp& constant_base = base_op.Cast<ConstantOp>();
     if (selector->CanAddressRelativeToRootsRegister(
             constant_base.external_reference())) {
       ptrdiff_t const delta =
-          index_value +
+          index_constant +
           MacroAssemblerBase::RootRegisterOffsetForExternalReference(
               selector->isolate(), constant_base.external_reference());
       input_count = 1;
@@ -373,11 +374,9 @@ void EmitLoad(InstructionSelectorT* selector, OpIndex node,
     }
   }
 
-  if (base_op.Is<LoadRootRegisterOp>()) {
-    int64_t index_value;
-    CHECK(selector->MatchSignedIntegralConstant(index, &index_value));
+  if (base_op.Is<LoadRootRegisterOp>() && is_index_constant) {
     input_count = 1;
-    inputs[0] = g.UseImmediate64(index_value);
+    inputs[0] = g.UseImmediate64(index_constant);
     opcode |= AddressingModeField::encode(kMode_Root);
     selector->Emit(opcode, 1, &output_op, input_count, inputs);
     return;
@@ -1866,7 +1865,8 @@ void InstructionSelectorT::VisitStackPointerGreaterThan(
   kind = op.kind;
   value = op.stack_limit();
   InstructionCode opcode =
-      kArchStackPointerGreaterThan | MiscField::encode(static_cast<int>(kind));
+      kArchStackPointerGreaterThan |
+      StackCheckField::encode(static_cast<StackCheckKind>(kind));
 
   Mips64OperandGeneratorT g(this);
 
diff --git a/deps/v8/src/compiler/backend/ppc/code-generator-ppc.cc b/deps/v8/src/compiler/backend/ppc/code-generator-ppc.cc
index 2190da1d56316e..f3e2bed7053091 100644
--- a/deps/v8/src/compiler/backend/ppc/code-generator-ppc.cc
+++ b/deps/v8/src/compiler/backend/ppc/code-generator-ppc.cc
@@ -1105,6 +1105,10 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ mr(i.OutputRegister(), fp);
       }
       break;
+    case kArchRootPointer:
+      __ mr(i.OutputRegister(), kRootRegister);
+      DCHECK_EQ(LeaveRC, i.OutputRCBit());
+      break;
 #if V8_ENABLE_WEBASSEMBLY
     case kArchStackPointer:
       __ mr(i.OutputRegister(), sp);
diff --git a/deps/v8/src/compiler/backend/ppc/instruction-selector-ppc.cc b/deps/v8/src/compiler/backend/ppc/instruction-selector-ppc.cc
index 7076bcdcf0a887..1a703949c6bdb6 100644
--- a/deps/v8/src/compiler/backend/ppc/instruction-selector-ppc.cc
+++ b/deps/v8/src/compiler/backend/ppc/instruction-selector-ppc.cc
@@ -770,7 +770,8 @@ void InstructionSelectorT::VisitStackPointerGreaterThan(
   kind = op.kind;
   value = op.stack_limit();
   InstructionCode opcode =
-      kArchStackPointerGreaterThan | MiscField::encode(static_cast<int>(kind));
+      kArchStackPointerGreaterThan |
+      StackCheckField::encode(static_cast<StackCheckKind>(kind));
 
   PPCOperandGeneratorT g(this);
 
diff --git a/deps/v8/src/compiler/backend/riscv/code-generator-riscv.cc b/deps/v8/src/compiler/backend/riscv/code-generator-riscv.cc
index d6779482094eef..61133a127b10c2 100644
--- a/deps/v8/src/compiler/backend/riscv/code-generator-riscv.cc
+++ b/deps/v8/src/compiler/backend/riscv/code-generator-riscv.cc
@@ -1044,6 +1044,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ Move(i.OutputRegister(), fp);
       }
       break;
+    case kArchRootPointer:
+      __ mv(i.OutputRegister(), kRootRegister);
+      break;
     case kArchTruncateDoubleToI:
       __ TruncateDoubleToI(isolate(), zone(), i.OutputRegister(),
                            i.InputDoubleRegister(0), DetermineStubCallMode());
@@ -1492,8 +1495,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
           !__ IsSingleZeroRegSet()) {
         __ LoadFPRImmediate(kSingleRegZero, 0.0f);
       }
-      // compare result set to kScratchReg
-      __ CompareF32(kScratchReg, cc, left, right);
+      switch (FlagsModeField::decode(instr->opcode())) {
+        case kFlags_set:
+          __ CompareF32(i.OutputRegister(), cc, left, right);
+          break;
+        default:
+          __ CompareF32(kScratchReg, cc, left, right);
+          break;
+      }
     } break;
     case kRiscvAddS:
       // TODO(plind): add special case: combine mult & add.
@@ -1554,8 +1563,14 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
           !__ IsDoubleZeroRegSet()) {
         __ LoadFPRImmediate(kDoubleRegZero, 0.0);
       }
-      // compare result set to kScratchReg
-      __ CompareF64(kScratchReg, cc, left, right);
+      switch (FlagsModeField::decode(instr->opcode())) {
+        case kFlags_set:
+          __ CompareF64(i.OutputRegister(), cc, left, right);
+          break;
+        default:
+          __ CompareF64(kScratchReg, cc, left, right);
+          break;
+      }
     } break;
 #if V8_TARGET_ARCH_RISCV32
     case kRiscvAddPair:
@@ -4298,29 +4313,12 @@ void CodeGenerator::AssembleArchBoolean(Instruction* instr,
     return;
   } else if (instr->arch_opcode() == kRiscvCmpD ||
              instr->arch_opcode() == kRiscvCmpS) {
-    if (instr->arch_opcode() == kRiscvCmpD) {
-      FPURegister left = i.InputOrZeroDoubleRegister(0);
-      FPURegister right = i.InputOrZeroDoubleRegister(1);
-      if ((left == kDoubleRegZero || right == kDoubleRegZero) &&
-          !__ IsDoubleZeroRegSet()) {
-        __ LoadFPRImmediate(kDoubleRegZero, 0.0);
-      }
-    } else {
-      FPURegister left = i.InputOrZeroSingleRegister(0);
-      FPURegister right = i.InputOrZeroSingleRegister(1);
-      if ((left == kSingleRegZero || right == kSingleRegZero) &&
-          !__ IsSingleZeroRegSet()) {
-        __ LoadFPRImmediate(kSingleRegZero, 0.0f);
-      }
-    }
     bool predicate;
     FlagsConditionToConditionCmpFPU(&predicate, condition);
     // RISCV compare returns 0 or 1, do nothing when predicate; otherwise
-    // toggle kScratchReg (i.e., 0 -> 1, 1 -> 0)
-    if (predicate) {
-      __ Move(result, kScratchReg);
-    } else {
-      __ Xor(result, kScratchReg, 1);
+    // toggle result (i.e., 0 -> 1, 1 -> 0)
+    if (!predicate) {
+      __ Xor(result, result, 1);
     }
     return;
   } else {
diff --git a/deps/v8/src/compiler/backend/riscv/instruction-selector-riscv.h b/deps/v8/src/compiler/backend/riscv/instruction-selector-riscv.h
index 31cb1a38986644..52eec1b834e16a 100644
--- a/deps/v8/src/compiler/backend/riscv/instruction-selector-riscv.h
+++ b/deps/v8/src/compiler/backend/riscv/instruction-selector-riscv.h
@@ -591,13 +591,13 @@ void InstructionSelectorT::VisitFloat32Equal(OpIndex node) {
 }
 
 void InstructionSelectorT::VisitFloat32LessThan(OpIndex node) {
-  FlagsContinuationT cont = FlagsContinuation::ForSet(kUnsignedLessThan, node);
+  FlagsContinuationT cont = FlagsContinuation::ForSet(kFloatLessThan, node);
   VisitFloat32Compare(this, node, &cont);
 }
 
 void InstructionSelectorT::VisitFloat32LessThanOrEqual(OpIndex node) {
   FlagsContinuationT cont =
-      FlagsContinuation::ForSet(kUnsignedLessThanOrEqual, node);
+      FlagsContinuation::ForSet(kFloatLessThanOrEqual, node);
   VisitFloat32Compare(this, node, &cont);
 }
 
@@ -607,13 +607,13 @@ void InstructionSelectorT::VisitFloat64Equal(OpIndex node) {
 }
 
 void InstructionSelectorT::VisitFloat64LessThan(OpIndex node) {
-  FlagsContinuationT cont = FlagsContinuation::ForSet(kUnsignedLessThan, node);
+  FlagsContinuationT cont = FlagsContinuation::ForSet(kFloatLessThan, node);
   VisitFloat64Compare(this, node, &cont);
 }
 
 void InstructionSelectorT::VisitFloat64LessThanOrEqual(OpIndex node) {
   FlagsContinuationT cont =
-      FlagsContinuation::ForSet(kUnsignedLessThanOrEqual, node);
+      FlagsContinuation::ForSet(kFloatLessThanOrEqual, node);
   VisitFloat64Compare(this, node, &cont);
 }
 
diff --git a/deps/v8/src/compiler/backend/riscv/instruction-selector-riscv32.cc b/deps/v8/src/compiler/backend/riscv/instruction-selector-riscv32.cc
index e3aa4b090c410a..701f6e234cca8c 100644
--- a/deps/v8/src/compiler/backend/riscv/instruction-selector-riscv32.cc
+++ b/deps/v8/src/compiler/backend/riscv/instruction-selector-riscv32.cc
@@ -92,8 +92,7 @@ void EmitLoad(InstructionSelectorT* selector, OpIndex node,
     }
   }
 
-  if (base_op.Is<LoadRootRegisterOp>()) {
-    DCHECK(g.IsIntegerConstant(index));
+  if (base_op.Is<LoadRootRegisterOp>() && g.IsIntegerConstant(index)) {
     input_count = 1;
     inputs[0] = g.UseImmediate64(*g.GetOptionalIntegerConstant(index.value()));
     opcode |= AddressingModeField::encode(kMode_Root);
@@ -673,12 +672,14 @@ void InstructionSelectorT::VisitUnalignedLoad(OpIndex node) {
 
 void InstructionSelectorT::VisitUnalignedStore(OpIndex node) {
   RiscvOperandGeneratorT g(this);
-  OpIndex base = this->input_at(node, 0);
-  OpIndex index = this->input_at(node, 1);
-  OpIndex value = this->input_at(node, 2);
-  UnalignedStoreRepresentation rep = UnalignedStoreRepresentationOf(node->op());
+  auto store_view = this->store_view(node);
+  OpIndex base = store_view.base();
+  OpIndex index = this->value(store_view.index());
+  OpIndex value = store_view.value();
+  UnalignedStoreRepresentation store_rep =
+      store_view.stored_rep().representation();
   ArchOpcode opcode;
-  switch (rep) {
+  switch (store_rep) {
     case MachineRepresentation::kFloat32:
       opcode = kRiscvUStoreFloat;
       break;
@@ -823,7 +824,8 @@ void InstructionSelectorT::VisitStackPointerGreaterThan(
   kind = op.kind;
   value = op.stack_limit();
   InstructionCode opcode =
-      kArchStackPointerGreaterThan | MiscField::encode(static_cast<int>(kind));
+      kArchStackPointerGreaterThan |
+      StackCheckField::encode(static_cast<StackCheckKind>(kind));
 
   RiscvOperandGeneratorT g(this);
 
diff --git a/deps/v8/src/compiler/backend/riscv/instruction-selector-riscv64.cc b/deps/v8/src/compiler/backend/riscv/instruction-selector-riscv64.cc
index 12f6ca35194cbc..79853174b1c143 100644
--- a/deps/v8/src/compiler/backend/riscv/instruction-selector-riscv64.cc
+++ b/deps/v8/src/compiler/backend/riscv/instruction-selector-riscv64.cc
@@ -159,15 +159,16 @@ void EmitLoad(InstructionSelectorT* selector, OpIndex node,
   // If output is valid, use that as the output register. This is used when we
   // merge a conversion into the load.
   output_op = g.DefineAsRegister(output.valid() ? output : node);
-  int64_t index_value;
   const Operation& base_op = selector->Get(base);
-  if (base_op.Is<Opmask::kExternalConstant>() &&
-      selector->MatchSignedIntegralConstant(index, &index_value)) {
+  int64_t index_constant;
+  const bool is_index_constant =
+      selector->MatchSignedIntegralConstant(index, &index_constant);
+  if (base_op.Is<Opmask::kExternalConstant>() && is_index_constant) {
     const ConstantOp& constant_base = base_op.Cast<ConstantOp>();
     if (selector->CanAddressRelativeToRootsRegister(
             constant_base.external_reference())) {
       ptrdiff_t const delta =
-          index_value +
+          index_constant +
           MacroAssemblerBase::RootRegisterOffsetForExternalReference(
               selector->isolate(), constant_base.external_reference());
       input_count = 1;
@@ -182,11 +183,10 @@ void EmitLoad(InstructionSelectorT* selector, OpIndex node,
     }
   }
 
-  if (base_op.Is<LoadRootRegisterOp>()) {
-    int64_t index_value;
-    selector->MatchSignedIntegralConstant(index, &index_value);
+  if (base_op.Is<LoadRootRegisterOp>() && is_index_constant) {
+    DCHECK(is_index_constant);
     input_count = 1;
-    inputs[0] = g.UseImmediate64(index_value);
+    inputs[0] = g.UseImmediate64(index_constant);
     opcode |= AddressingModeField::encode(kMode_Root);
     selector->Emit(opcode, 1, &output_op, input_count, inputs);
     return;
@@ -1681,7 +1681,8 @@ void InstructionSelectorT::VisitStackPointerGreaterThan(
   kind = op.kind;
   value = op.stack_limit();
   InstructionCode opcode =
-      kArchStackPointerGreaterThan | MiscField::encode(static_cast<int>(kind));
+      kArchStackPointerGreaterThan |
+      StackCheckField::encode(static_cast<StackCheckKind>(kind));
 
   RiscvOperandGeneratorT g(this);
 
diff --git a/deps/v8/src/compiler/backend/s390/code-generator-s390.cc b/deps/v8/src/compiler/backend/s390/code-generator-s390.cc
index d0f93170f4ee15..1a7a944f79a3a2 100644
--- a/deps/v8/src/compiler/backend/s390/code-generator-s390.cc
+++ b/deps/v8/src/compiler/backend/s390/code-generator-s390.cc
@@ -1369,6 +1369,9 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
         __ mov(i.OutputRegister(), fp);
       }
       break;
+    case kArchRootPointer:
+      __ mov(i.OutputRegister(), kRootRegister);
+      break;
 #if V8_ENABLE_WEBASSEMBLY
     case kArchStackPointer:
       __ mov(i.OutputRegister(), sp);
diff --git a/deps/v8/src/compiler/backend/s390/instruction-selector-s390.cc b/deps/v8/src/compiler/backend/s390/instruction-selector-s390.cc
index 5e415bd688474f..57f29d23f29773 100644
--- a/deps/v8/src/compiler/backend/s390/instruction-selector-s390.cc
+++ b/deps/v8/src/compiler/backend/s390/instruction-selector-s390.cc
@@ -296,8 +296,8 @@ class S390OperandGeneratorT final : public OperandGeneratorT {
     auto m = TryMatchBaseWithScaledIndexAndDisplacement64(selector(), operand);
     DCHECK(m.has_value());
     if (m->base.valid() &&
-        this->Get(m->base).template Is<LoadRootRegisterOp>()) {
-      DCHECK(!m->index.valid());
+        this->Get(m->base).template Is<LoadRootRegisterOp>() &&
+        !m->index.valid()) {
       DCHECK_EQ(m->scale, 0);
       inputs[(*input_count)++] =
           UseImmediate(static_cast<int>(m->displacement));
@@ -1070,7 +1070,8 @@ void InstructionSelectorT::VisitStackPointerGreaterThan(
   kind = op.kind;
   value = op.stack_limit();
   InstructionCode opcode =
-      kArchStackPointerGreaterThan | MiscField::encode(static_cast<int>(kind));
+      kArchStackPointerGreaterThan |
+      StackCheckField::encode(static_cast<StackCheckKind>(kind));
 
   S390OperandGeneratorT g(this);
 
diff --git a/deps/v8/src/compiler/backend/x64/code-generator-x64.cc b/deps/v8/src/compiler/backend/x64/code-generator-x64.cc
index 9fe689db591b4f..582652386f34d4 100644
--- a/deps/v8/src/compiler/backend/x64/code-generator-x64.cc
+++ b/deps/v8/src/compiler/backend/x64/code-generator-x64.cc
@@ -29,6 +29,7 @@
 #include "src/heap/mutable-page-metadata.h"
 #include "src/objects/code-kind.h"
 #include "src/objects/smi.h"
+#include "src/roots/roots-inl.h"
 
 #if V8_ENABLE_WEBASSEMBLY
 #include "src/wasm/wasm-linkage.h"
@@ -1747,6 +1748,16 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
     case kArchFramePointer:
       __ movq(i.OutputRegister(), rbp);
       break;
+    case kArchParentFramePointer:
+      if (frame_access_state()->has_frame()) {
+        __ movq(i.OutputRegister(), Operand(rbp, 0));
+      } else {
+        __ movq(i.OutputRegister(), rbp);
+      }
+      break;
+    case kArchRootPointer:
+      __ movq(i.OutputRegister(), kRootRegister);
+      break;
 #if V8_ENABLE_WEBASSEMBLY
     case kArchStackPointer:
       __ movq(i.OutputRegister(), rsp);
@@ -1759,13 +1770,6 @@ CodeGenerator::CodeGenResult CodeGenerator::AssembleArchInstruction(
       }
       break;
 #endif  // V8_ENABLE_WEBASSEMBLY
-    case kArchParentFramePointer:
-      if (frame_access_state()->has_frame()) {
-        __ movq(i.OutputRegister(), Operand(rbp, 0));
-      } else {
-        __ movq(i.OutputRegister(), rbp);
-      }
-      break;
     case kArchStackPointerGreaterThan: {
       // Potentially apply an offset to the current stack pointer before the
       // comparison to consider the size difference of an optimized frame versus
diff --git a/deps/v8/src/compiler/backend/x64/instruction-selector-x64.cc b/deps/v8/src/compiler/backend/x64/instruction-selector-x64.cc
index 346dc60778cf9e..aafed601dfe964 100644
--- a/deps/v8/src/compiler/backend/x64/instruction-selector-x64.cc
+++ b/deps/v8/src/compiler/backend/x64/instruction-selector-x64.cc
@@ -48,8 +48,8 @@ bool IsCompressed(InstructionSelectorT* selector, OpIndex node) {
   if (selector->is_load(node)) {
     auto load = selector->load_view(node);
     return load.loaded_rep().IsCompressed();
-  } else if (selector->IsPhi(node)) {
-    MachineRepresentation phi_rep = selector->phi_representation_of(node);
+  } else if (const PhiOp* phi = selector->TryCast<PhiOp>(node)) {
+    MachineRepresentation phi_rep = phi->rep.machine_representation();
     return phi_rep == MachineRepresentation::kCompressed ||
            phi_rep == MachineRepresentation::kCompressedPointer;
   }
@@ -802,8 +802,8 @@ AddressingMode X64OperandGeneratorT::GetEffectiveAddressMemoryOperand(
     }
     return mode;
   }
-  if (m->base.valid() && this->Get(m->base).Is<LoadRootRegisterOp>()) {
-    DCHECK(!m->index.valid());
+  if (m->base.valid() && this->Get(m->base).Is<LoadRootRegisterOp>() &&
+      !m->index.valid()) {
     DCHECK_EQ(m->scale, 0);
     DCHECK(ValueFitsIntoImmediate(m->displacement));
     inputs[(*input_count)++] = UseImmediate(static_cast<int>(m->displacement));
@@ -1046,7 +1046,8 @@ template <VectorLength vec_len>
 void VisitMinOrMax(InstructionSelectorT* selector, OpIndex node,
                    ArchOpcode opcode, bool flip_inputs) {
   X64OperandGeneratorT g(selector);
-  DCHECK_EQ(selector->value_input_count(node), 2);
+  const Operation& op = selector->Get(node);
+  DCHECK_EQ(op.input_count, 2);
   InstructionOperand dst = selector->IsSupported(AVX)
                                ? g.DefineAsRegister(node)
                                : g.DefineSameAsFirst(node);
@@ -1054,11 +1055,11 @@ void VisitMinOrMax(InstructionSelectorT* selector, OpIndex node,
   if (flip_inputs) {
     // Due to the way minps/minpd work, we want the dst to be same as the second
     // input: b = pmin(a, b) directly maps to minps b a.
-    selector->Emit(instr_code, dst, g.UseRegister(selector->input_at(node, 1)),
-                   g.UseRegister(selector->input_at(node, 0)));
+    selector->Emit(instr_code, dst, g.UseRegister(op.input(1)),
+                   g.UseRegister(op.input(0)));
   } else {
-    selector->Emit(instr_code, dst, g.UseRegister(selector->input_at(node, 0)),
-                   g.UseRegister(selector->input_at(node, 1)));
+    selector->Emit(instr_code, dst, g.UseRegister(op.input(0)),
+                   g.UseRegister(op.input(1)));
   }
 }
 }  // namespace
@@ -1080,9 +1081,9 @@ void InstructionSelectorT::VisitStackSlot(OpIndex node) {
 
 void InstructionSelectorT::VisitAbortCSADcheck(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
-  Emit(kArchAbortCSADcheck, g.NoOutput(),
-       g.UseFixed(this->input_at(node, 0), rdx));
+  const AbortCSADcheckOp& check = Cast<AbortCSADcheckOp>(node);
+  DCHECK_EQ(check.input_count, 1);
+  Emit(kArchAbortCSADcheck, g.NoOutput(), g.UseFixed(check.message(), rdx));
 }
 
 #ifdef V8_ENABLE_WEBASSEMBLY
@@ -1186,8 +1187,7 @@ void InstructionSelectorT::VisitS256Const(OpIndex node) {
   X64OperandGeneratorT g(this);
   static const int kUint32Immediates = kSimd256Size / sizeof(uint32_t);
   uint32_t val[kUint32Immediates];
-  const Simd256ConstantOp& constant =
-      this->Get(node).template Cast<Simd256ConstantOp>();
+  const Simd256ConstantOp& constant = Cast<Simd256ConstantOp>(node);
   memcpy(val, constant.value, kSimd256Size);
   // If all bytes are zeros or ones, avoid emitting code for generic constants
   bool all_zeros = std::all_of(std::begin(val), std::end(val),
@@ -1608,9 +1608,10 @@ void InstructionSelectorT::VisitStoreLane(OpIndex node) {
 static void VisitBinop(InstructionSelectorT* selector, OpIndex node,
                        InstructionCode opcode, FlagsContinuationT* cont) {
   X64OperandGeneratorT g(selector);
-  DCHECK_EQ(selector->value_input_count(node), 2);
-  auto left = selector->input_at(node, 0);
-  auto right = selector->input_at(node, 1);
+  const Operation& binop = selector->Get(node);
+  DCHECK_EQ(binop.input_count, 2);
+  auto left = binop.input(0);
+  auto right = binop.input(1);
   if (selector->IsCommutative(node)) {
     if (selector->Is<ConstantOp>(left) && !selector->Is<ConstantOp>(right)) {
       std::swap(left, right);
@@ -1732,7 +1733,7 @@ std::optional<uint64_t> TryGetRightWordConstant(InstructionSelectorT* selector,
 void InstructionSelectorT::VisitWord64And(OpIndex node) {
   X64OperandGeneratorT g(this);
   if (std::optional<uint64_t> constant = TryGetRightWordConstant(this, node)) {
-    auto left = this->input_at(node, 0);
+    OpIndex left = Get(node).input(0);
     if (*constant == 0xFF) {
       Emit(kX64Movzxbq, g.DefineAsRegister(node), g.Use(left));
       return;
@@ -1765,7 +1766,7 @@ void InstructionSelectorT::VisitWord32Xor(OpIndex node) {
   if (std::optional<uint64_t> constant = TryGetRightWordConstant(this, node)) {
     if (*constant == static_cast<uint64_t>(-1)) {
       Emit(kX64Not32, g.DefineSameAsFirst(node),
-           g.UseRegister(this->input_at(node, 0)));
+           g.UseRegister(Get(node).input(0)));
       return;
     }
   }
@@ -1777,7 +1778,7 @@ void InstructionSelectorT::VisitWord64Xor(OpIndex node) {
   if (std::optional<uint64_t> constant = TryGetRightWordConstant(this, node)) {
     if (*constant == static_cast<uint64_t>(-1)) {
       Emit(kX64Not, g.DefineSameAsFirst(node),
-           g.UseRegister(this->input_at(node, 0)));
+           g.UseRegister(Get(node).input(0)));
       return;
     }
   }
@@ -1786,15 +1787,15 @@ void InstructionSelectorT::VisitWord64Xor(OpIndex node) {
 
 void InstructionSelectorT::VisitStackPointerGreaterThan(
     OpIndex node, FlagsContinuation* cont) {
-  StackCheckKind kind;
-  kind = this->Get(node).template Cast<StackPointerGreaterThanOp>().kind;
+  const StackPointerGreaterThanOp& op = Cast<StackPointerGreaterThanOp>(node);
   InstructionCode opcode =
-      kArchStackPointerGreaterThan | MiscField::encode(static_cast<int>(kind));
+      kArchStackPointerGreaterThan |
+      StackCheckField::encode(static_cast<StackCheckKind>(op.kind));
 
   int effect_level = GetEffectLevel(node, cont);
 
   X64OperandGeneratorT g(this);
-  OpIndex value = this->input_at(node, 0);
+  OpIndex value = op.stack_limit();
   if (g.CanBeMemoryOperand(kX64Cmp, node, value, effect_level)) {
     DCHECK(this->IsLoadOrLoadImmutable(value));
 
@@ -1821,9 +1822,10 @@ namespace {
 void VisitWord32Shift(InstructionSelectorT* selector, OpIndex node,
                       ArchOpcode opcode) {
   X64OperandGeneratorT g(selector);
-  DCHECK_EQ(selector->value_input_count(node), 2);
-  auto left = selector->input_at(node, 0);
-  auto right = selector->input_at(node, 1);
+  const ShiftOp& op = selector->Cast<ShiftOp>(node);
+  DCHECK_EQ(op.input_count, 2);
+  auto left = op.left();
+  auto right = op.right();
 
   if (V<Word64> left64; selector->MatchTruncateWord64ToWord32(left, &left64)) {
     left = left64;
@@ -1843,9 +1845,10 @@ void VisitWord32Shift(InstructionSelectorT* selector, OpIndex node,
 void VisitWord64Shift(InstructionSelectorT* selector, OpIndex node,
                       ArchOpcode opcode) {
   X64OperandGeneratorT g(selector);
-  DCHECK_EQ(selector->value_input_count(node), 2);
-  auto left = selector->input_at(node, 0);
-  auto right = selector->input_at(node, 1);
+  const ShiftOp& op = selector->Cast<ShiftOp>(node);
+  DCHECK_EQ(op.input_count, 2);
+  auto left = op.left();
+  auto right = op.right();
 
   if (g.CanBeImmediate(right)) {
       // TODO(nicohartmann@): Implement this for Turboshaft.
@@ -1881,9 +1884,10 @@ bool TryVisitWordShift(InstructionSelectorT* selector, OpIndex node, int bits,
                        ArchOpcode opcode, FlagsContinuationT* cont) {
   DCHECK(bits == 32 || bits == 64);
   X64OperandGeneratorT g(selector);
-  DCHECK_EQ(selector->value_input_count(node), 2);
-  auto left = selector->input_at(node, 0);
-  auto right = selector->input_at(node, 1);
+  const ShiftOp& op = selector->Cast<ShiftOp>(node);
+  DCHECK_EQ(op.input_count, 2);
+  auto left = op.left();
+  auto right = op.right();
 
   // If the shift count is 0, the flags are not affected.
   if (!g.CanBeImmediate(right) ||
@@ -2119,16 +2123,16 @@ void InstructionSelectorT::VisitWord64ReverseBits(OpIndex node) {
 
 void InstructionSelectorT::VisitWord64ReverseBytes(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
-  Emit(kX64Bswap, g.DefineSameAsFirst(node),
-       g.UseRegister(this->input_at(node, 0)));
+  const WordUnaryOp& op = Cast<WordUnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
+  Emit(kX64Bswap, g.DefineSameAsFirst(node), g.UseRegister(op.input()));
 }
 
 void InstructionSelectorT::VisitWord32ReverseBytes(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
-  Emit(kX64Bswap32, g.DefineSameAsFirst(node),
-       g.UseRegister(this->input_at(node, 0)));
+  const WordUnaryOp& op = Cast<WordUnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
+  Emit(kX64Bswap32, g.DefineSameAsFirst(node), g.UseRegister(op.input()));
 }
 
 void InstructionSelectorT::VisitSimd128ReverseBytes(OpIndex node) {
@@ -2139,7 +2143,7 @@ void InstructionSelectorT::VisitInt32Add(OpIndex node) {
   X64OperandGeneratorT g(this);
 
   std::optional<BaseWithScaledIndexAndDisplacementMatch> m;
-  const WordBinopOp& add = this->Get(node).template Cast<WordBinopOp>();
+  const WordBinopOp& add = Cast<WordBinopOp>(node);
   OpIndex left = add.left();
   OpIndex right = add.right();
   // No need to truncate the values before Int32Add.
@@ -2406,9 +2410,10 @@ void InstructionSelectorT::VisitUint64MulHigh(OpIndex node) {
 //    Else:
 //      Set Projection(1) := 0;   -- the value was out of range
 void InstructionSelectorT::VisitTryTruncateFloat32ToInt64(OpIndex node) {
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const TryChangeOp& op = Cast<TryChangeOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   X64OperandGeneratorT g(this);
-  InstructionOperand inputs[] = {g.UseRegister(this->input_at(node, 0))};
+  InstructionOperand inputs[] = {g.UseRegister(op.input())};
   InstructionOperand outputs[2];
   InstructionOperand temps[1];
   size_t output_count = 0;
@@ -2433,9 +2438,10 @@ void InstructionSelectorT::VisitTryTruncateFloat32ToInt64(OpIndex node) {
 // negative, but still within range) we restore it and set Projection(1) := 1.
 // In all other cases we set Projection(1) := 0, denoting value out of range.
 void InstructionSelectorT::VisitTryTruncateFloat64ToUint32(OpIndex node) {
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const TryChangeOp& op = Cast<TryChangeOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   X64OperandGeneratorT g(this);
-  InstructionOperand inputs[] = {g.UseRegister(this->input_at(node, 0))};
+  InstructionOperand inputs[] = {g.UseRegister(op.input())};
   InstructionOperand outputs[2];
   size_t output_count = 0;
   outputs[output_count++] = g.DefineAsRegister(node);
@@ -2449,9 +2455,10 @@ void InstructionSelectorT::VisitTryTruncateFloat64ToUint32(OpIndex node) {
 }
 
 void InstructionSelectorT::VisitTryTruncateFloat32ToUint64(OpIndex node) {
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const TryChangeOp& op = Cast<TryChangeOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   X64OperandGeneratorT g(this);
-  InstructionOperand inputs[] = {g.UseRegister(this->input_at(node, 0))};
+  InstructionOperand inputs[] = {g.UseRegister(op.input())};
   InstructionOperand outputs[2];
   size_t output_count = 0;
   outputs[output_count++] = g.DefineAsRegister(node);
@@ -2465,9 +2472,10 @@ void InstructionSelectorT::VisitTryTruncateFloat32ToUint64(OpIndex node) {
 }
 
 void InstructionSelectorT::VisitTryTruncateFloat64ToUint64(OpIndex node) {
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const TryChangeOp& op = Cast<TryChangeOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   X64OperandGeneratorT g(this);
-  InstructionOperand inputs[] = {g.UseRegister(this->input_at(node, 0))};
+  InstructionOperand inputs[] = {g.UseRegister(op.input())};
   InstructionOperand outputs[2];
   size_t output_count = 0;
   outputs[output_count++] = g.DefineAsRegister(node);
@@ -2481,9 +2489,10 @@ void InstructionSelectorT::VisitTryTruncateFloat64ToUint64(OpIndex node) {
 }
 
 void InstructionSelectorT::VisitTryTruncateFloat64ToInt64(OpIndex node) {
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const TryChangeOp& op = Cast<TryChangeOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   X64OperandGeneratorT g(this);
-  InstructionOperand inputs[] = {g.UseRegister(this->input_at(node, 0))};
+  InstructionOperand inputs[] = {g.UseRegister(op.input())};
   InstructionOperand outputs[2];
   InstructionOperand temps[1];
   size_t output_count = 0;
@@ -2500,9 +2509,10 @@ void InstructionSelectorT::VisitTryTruncateFloat64ToInt64(OpIndex node) {
 }
 
 void InstructionSelectorT::VisitTryTruncateFloat64ToInt32(OpIndex node) {
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const TryChangeOp& op = Cast<TryChangeOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   X64OperandGeneratorT g(this);
-  InstructionOperand inputs[] = {g.UseRegister(this->input_at(node, 0))};
+  InstructionOperand inputs[] = {g.UseRegister(op.input())};
   InstructionOperand outputs[2];
   InstructionOperand temps[1];
   size_t output_count = 0;
@@ -2525,10 +2535,11 @@ void InstructionSelectorT::VisitBitcastWord32ToWord64(OpIndex node) {
 }
 
 void InstructionSelectorT::VisitChangeInt32ToInt64(OpIndex node) {
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const ChangeOp& op = Cast<ChangeOp>(node);
+  DCHECK_EQ(op.input_count, 1);
 
   X64OperandGeneratorT g(this);
-  auto value = this->input_at(node, 0);
+  auto value = op.input();
   if (this->IsLoadOrLoadImmutable(value) && CanCover(node, value)) {
     LoadRepresentation load_rep = this->load_view(value).loaded_rep();
     MachineRepresentation rep = load_rep.representation();
@@ -2559,17 +2570,17 @@ void InstructionSelectorT::VisitChangeInt32ToInt64(OpIndex node) {
     InstructionOperand outputs[] = {g.DefineAsRegister(node)};
     size_t input_count = 0;
     InstructionOperand inputs[3];
-    AddressingMode mode = g.GetEffectiveAddressMemoryOperand(
-        this->input_at(node, 0), inputs, &input_count);
+    AddressingMode mode =
+        g.GetEffectiveAddressMemoryOperand(value, inputs, &input_count);
     opcode |= AddressingModeField::encode(mode);
     Emit(opcode, 1, outputs, input_count, inputs);
   } else {
-    Emit(kX64Movsxlq, g.DefineAsRegister(node), g.Use(this->input_at(node, 0)));
+    Emit(kX64Movsxlq, g.DefineAsRegister(node), g.Use(value));
   }
 }
 
 bool InstructionSelectorT::ZeroExtendsWord32ToWord64NoPhis(OpIndex node) {
-  const auto& op = this->Get(node);
+  const Operation& op = Get(node);
   switch (op.opcode) {
     case Opcode::kWordBinop: {
       const auto& binop = op.Cast<WordBinopOp>();
@@ -2652,8 +2663,9 @@ bool InstructionSelectorT::ZeroExtendsWord32ToWord64NoPhis(OpIndex node) {
 
 void InstructionSelectorT::VisitChangeUint32ToUint64(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
-  OpIndex value = this->input_at(node, 0);
+  const ChangeOp& op = Cast<ChangeOp>(node);
+  DCHECK_EQ(op.input_count, 1);
+  OpIndex value = op.input();
   if (ZeroExtendsWord32ToWord64(value)) {
     // These 32-bit operations implicitly zero-extend to 64-bit on x64, so the
     // zero-extension is a no-op.
@@ -2667,32 +2679,35 @@ namespace {
 void VisitRO(InstructionSelectorT* selector, OpIndex node,
              InstructionCode opcode) {
   X64OperandGeneratorT g(selector);
-  DCHECK_EQ(selector->value_input_count(node), 1);
-  selector->Emit(opcode, g.DefineAsRegister(node),
-                 g.Use(selector->input_at(node, 0)));
+  const Operation& op = selector->Get(node);
+  DCHECK_EQ(op.input_count, 1);
+  selector->Emit(opcode, g.DefineAsRegister(node), g.Use(op.input(0)));
 }
 
 void VisitRR(InstructionSelectorT* selector, OpIndex node,
              InstructionCode opcode) {
   X64OperandGeneratorT g(selector);
-  selector->Emit(opcode, g.DefineAsRegister(node),
-                 g.UseRegister(selector->input_at(node, 0)));
+  const Operation& op = selector->Get(node);
+  DCHECK_EQ(op.input_count, 1);
+  selector->Emit(opcode, g.DefineAsRegister(node), g.UseRegister(op.input(0)));
 }
 
 void VisitRRO(InstructionSelectorT* selector, OpIndex node,
               InstructionCode opcode) {
   X64OperandGeneratorT g(selector);
-  selector->Emit(opcode, g.DefineSameAsFirst(node),
-                 g.UseRegister(selector->input_at(node, 0)),
-                 g.Use(selector->input_at(node, 1)));
+  const Operation& op = selector->Get(node);
+  DCHECK_EQ(op.input_count, 2);
+  selector->Emit(opcode, g.DefineSameAsFirst(node), g.UseRegister(op.input(0)),
+                 g.Use(op.input(1)));
 }
 
 void VisitFloatBinop(InstructionSelectorT* selector, OpIndex node,
                      InstructionCode avx_opcode, InstructionCode sse_opcode) {
   X64OperandGeneratorT g(selector);
-  DCHECK_EQ(selector->value_input_count(node), 2);
-  auto left = selector->input_at(node, 0);
-  auto right = selector->input_at(node, 1);
+  const FloatBinopOp& op = selector->Cast<FloatBinopOp>(node);
+  DCHECK_EQ(op.input_count, 2);
+  auto left = op.left();
+  auto right = op.right();
   InstructionOperand inputs[8];
   size_t input_count = 0;
   InstructionOperand outputs[1];
@@ -2868,16 +2883,18 @@ void InstructionSelectorT::VisitTruncateFloat64ToWord32(OpIndex node) {
 
 void InstructionSelectorT::VisitTruncateFloat64ToFloat16RawBits(OpIndex node) {
   X64OperandGeneratorT g(this);
+  const ChangeOp& op = Cast<ChangeOp>(node);
   InstructionOperand temps[] = {g.TempDoubleRegister(), g.TempRegister()};
   Emit(kSSEFloat64ToFloat16RawBits, g.DefineAsRegister(node),
-       g.UseUniqueRegister(this->input_at(node, 0)), arraysize(temps), temps);
+       g.UseUniqueRegister(op.input()), arraysize(temps), temps);
 }
 
 void InstructionSelectorT::VisitChangeFloat16RawBitsToFloat64(OpIndex node) {
   X64OperandGeneratorT g(this);
+  const ChangeOp& op = Cast<ChangeOp>(node);
   InstructionOperand temps[] = {g.TempDoubleRegister()};
   Emit(kSSEFloat16RawBitsToFloat64, g.DefineAsRegister(node),
-       g.UseRegister(this->input_at(node, 0)), arraysize(temps), temps);
+       g.UseRegister(op.input()), arraysize(temps), temps);
 }
 
 void InstructionSelectorT::VisitTruncateInt64ToInt32(OpIndex node) {
@@ -2885,20 +2902,18 @@ void InstructionSelectorT::VisitTruncateInt64ToInt32(OpIndex node) {
   // value (see ZeroExtendsWord32ToWord64). So all code paths here
   // have to satisfy that condition.
   X64OperandGeneratorT g(this);
-
-  OpIndex value = this->input_at(node, 0);
+  const ChangeOp& op = Cast<ChangeOp>(node);
+  OpIndex value = op.input();
   bool can_cover = false;
   if (const TaggedBitcastOp* value_op =
-          this->Get(value)
-              .template TryCast<
-                  Opmask::kBitcastTaggedToWordPtrForTagAndSmiBits>()) {
+          TryCast<Opmask::kBitcastTaggedToWordPtrForTagAndSmiBits>(value)) {
     can_cover = CanCover(node, value) && CanCover(node, value_op->input());
     value = value_op->input();
   } else {
     can_cover = CanCover(node, value);
   }
     if (can_cover) {
-      const Operation& value_op = this->Get(value);
+      const Operation& value_op = Get(value);
       if (const ShiftOp * shift;
           (shift = value_op.TryCast<Opmask::kWord64ShiftRightArithmetic>()) ||
           (shift = value_op.TryCast<Opmask::kWord64ShiftRightLogical>())) {
@@ -2937,8 +2952,9 @@ void InstructionSelectorT::VisitFloat32Div(OpIndex node) {
 }
 
 void InstructionSelectorT::VisitFloat32Abs(OpIndex node) {
-  DCHECK_EQ(this->value_input_count(node), 1);
-  VisitFloatUnop(this, node, this->input_at(node, 0), kX64Float32Abs);
+  const FloatUnaryOp& op = Cast<FloatUnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
+  VisitFloatUnop(this, node, op.input(), kX64Float32Abs);
 }
 
 void InstructionSelectorT::VisitFloat32Max(OpIndex node) {
@@ -2966,12 +2982,12 @@ void InstructionSelectorT::VisitFloat64Div(OpIndex node) {
 }
 
 void InstructionSelectorT::VisitFloat64Mod(OpIndex node) {
-  DCHECK_EQ(this->value_input_count(node), 2);
+  const FloatBinopOp& op = Cast<FloatBinopOp>(node);
+  DCHECK_EQ(op.input_count, 2);
   X64OperandGeneratorT g(this);
   InstructionOperand temps[] = {g.TempRegister(rax)};
-  Emit(kSSEFloat64Mod, g.DefineSameAsFirst(node),
-       g.UseRegister(this->input_at(node, 0)),
-       g.UseRegister(this->input_at(node, 1)), 1, temps);
+  Emit(kSSEFloat64Mod, g.DefineSameAsFirst(node), g.UseRegister(op.left()),
+       g.UseRegister(op.right()), 1, temps);
 }
 
 void InstructionSelectorT::VisitFloat64Max(OpIndex node) {
@@ -2983,8 +2999,9 @@ void InstructionSelectorT::VisitFloat64Min(OpIndex node) {
 }
 
 void InstructionSelectorT::VisitFloat64Abs(OpIndex node) {
-  DCHECK_EQ(this->value_input_count(node), 1);
-  VisitFloatUnop(this, node, this->input_at(node, 0), kX64Float64Abs);
+  const FloatUnaryOp& op = Cast<FloatUnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
+  VisitFloatUnop(this, node, op.input(), kX64Float64Abs);
 }
 
 void InstructionSelectorT::VisitFloat64RoundTiesAway(OpIndex node) {
@@ -2992,31 +3009,33 @@ void InstructionSelectorT::VisitFloat64RoundTiesAway(OpIndex node) {
 }
 
 void InstructionSelectorT::VisitFloat32Neg(OpIndex node) {
-  DCHECK_EQ(this->value_input_count(node), 1);
-  VisitFloatUnop(this, node, this->input_at(node, 0), kX64Float32Neg);
+  const FloatUnaryOp& op = Cast<FloatUnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
+  VisitFloatUnop(this, node, op.input(), kX64Float32Neg);
 }
 
 void InstructionSelectorT::VisitFloat64Neg(OpIndex node) {
-  DCHECK_EQ(this->value_input_count(node), 1);
-  VisitFloatUnop(this, node, this->input_at(node, 0), kX64Float64Neg);
+  const FloatUnaryOp& op = Cast<FloatUnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
+  VisitFloatUnop(this, node, op.input(), kX64Float64Neg);
 }
 
 void InstructionSelectorT::VisitFloat64Ieee754Binop(OpIndex node,
                                                     InstructionCode opcode) {
-  DCHECK_EQ(this->value_input_count(node), 2);
+  const FloatBinopOp& op = Cast<FloatBinopOp>(node);
+  DCHECK_EQ(op.input_count, 2);
   X64OperandGeneratorT g(this);
-  Emit(opcode, g.DefineAsFixed(node, xmm0),
-       g.UseFixed(this->input_at(node, 0), xmm0),
-       g.UseFixed(this->input_at(node, 1), xmm1))
+  Emit(opcode, g.DefineAsFixed(node, xmm0), g.UseFixed(op.left(), xmm0),
+       g.UseFixed(op.right(), xmm1))
       ->MarkAsCall();
 }
 
 void InstructionSelectorT::VisitFloat64Ieee754Unop(OpIndex node,
                                                    InstructionCode opcode) {
+  const FloatUnaryOp& op = Cast<FloatUnaryOp>(node);
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
-  Emit(opcode, g.DefineAsFixed(node, xmm0),
-       g.UseFixed(this->input_at(node, 0), xmm0))
+  DCHECK_EQ(op.input_count, 1);
+  Emit(opcode, g.DefineAsFixed(node, xmm0), g.UseFixed(op.input(), xmm0))
       ->MarkAsCall();
 }
 
@@ -3233,9 +3252,10 @@ bool IsWordAnd(InstructionSelectorT* selector, OpIndex node) {
 MachineType MachineTypeForNarrowWordAnd(InstructionSelectorT* selector,
                                         OpIndex and_node,
                                         OpIndex constant_node) {
-  DCHECK_EQ(selector->value_input_count(and_node), 2);
-  auto and_left = selector->input_at(and_node, 0);
-  auto and_right = selector->input_at(and_node, 1);
+  const WordBinopOp& op = selector->Cast<WordBinopOp>(and_node);
+  DCHECK_EQ(op.input_count, 2);
+  auto and_left = op.left();
+  auto and_right = op.right();
   auto and_constant_node = IsIntConstant(selector, and_right)  ? and_right
                            : IsIntConstant(selector, and_left) ? and_left
                                                                : OpIndex{};
@@ -3361,9 +3381,10 @@ OpIndex RemoveUnnecessaryWordAnd(InstructionSelectorT* selector,
     return and_node;
   }
 
-  DCHECK_EQ(selector->value_input_count(and_node), 2);
-  auto and_left = selector->input_at(and_node, 0);
-  auto and_right = selector->input_at(and_node, 1);
+  const WordBinopOp& op = selector->Cast<WordBinopOp>(and_node);
+  DCHECK_EQ(op.input_count, 2);
+  auto and_left = op.left();
+  auto and_right = op.right();
   auto and_constant_node = OpIndex{};
   auto and_other_node = OpIndex{};
   if (IsIntConstant(selector, and_left)) {
@@ -3386,9 +3407,10 @@ OpIndex RemoveUnnecessaryWordAnd(InstructionSelectorT* selector,
 void VisitWordCompare(InstructionSelectorT* selector, OpIndex node,
                       InstructionCode opcode, FlagsContinuationT* cont) {
   X64OperandGeneratorT g(selector);
-  DCHECK_EQ(selector->value_input_count(node), 2);
-  auto left = selector->input_at(node, 0);
-  auto right = selector->input_at(node, 1);
+  const Operation& op = selector->Get(node);
+  DCHECK_EQ(op.input_count, 2);
+  auto left = op.input(0);
+  auto right = op.input(1);
 
   // The 32-bit comparisons automatically truncate Word64
   // values to Word32 range, no need to do that explicitly.
@@ -3468,7 +3490,7 @@ void VisitWord64EqualImpl(InstructionSelectorT* selector, OpIndex node,
 
 bool MatchHeapObjectEqual(InstructionSelectorT* selector, OpIndex node,
                           OpIndex* left, Handle<HeapObject>* right) {
-  const ComparisonOp& equal = selector->Get(node).Cast<ComparisonOp>();
+  const ComparisonOp& equal = selector->Cast<ComparisonOp>(node);
   DCHECK_EQ(equal.kind, ComparisonOp::Kind::kEqual);
   if (selector->MatchHeapConstant(equal.right(), right)) {
     *left = equal.left();
@@ -3590,21 +3612,19 @@ void VisitCompareZero(InstructionSelectorT* selector, OpIndex user,
 // Shared routine for multiple float32 compare operations (inputs commuted).
 void VisitFloat32Compare(InstructionSelectorT* selector, OpIndex node,
                          FlagsContinuationT* cont) {
-  auto left = selector->input_at(node, 0);
-  auto right = selector->input_at(node, 1);
+  const ComparisonOp& op = selector->Cast<ComparisonOp>(node);
   InstructionCode const opcode =
       selector->IsSupported(AVX) ? kAVXFloat32Cmp : kSSEFloat32Cmp;
-  VisitCompare(selector, opcode, right, left, cont, false);
+  VisitCompare(selector, opcode, op.right(), op.left(), cont, false);
 }
 
 // Shared routine for multiple float64 compare operations (inputs commuted).
 void VisitFloat64Compare(InstructionSelectorT* selector, OpIndex node,
                          FlagsContinuationT* cont) {
-  auto left = selector->input_at(node, 0);
-  auto right = selector->input_at(node, 1);
+  const ComparisonOp& op = selector->Cast<ComparisonOp>(node);
   InstructionCode const opcode =
       selector->IsSupported(AVX) ? kAVXFloat64Cmp : kSSEFloat64Cmp;
-  VisitCompare(selector, opcode, right, left, cont, false);
+  VisitCompare(selector, opcode, op.right(), op.left(), cont, false);
 }
 
 // Shared routine for Word32/Word64 Atomic Binops
@@ -3659,7 +3679,7 @@ void InstructionSelectorT::VisitWordCompareZero(OpIndex user, OpIndex value,
   ConsumeEqualZero(&user, &value, cont);
 
   if (CanCover(user, value)) {
-    const Operation& value_op = this->Get(value);
+    const Operation& value_op = Get(value);
     if (const ComparisonOp* comparison = value_op.TryCast<ComparisonOp>()) {
       if (comparison->kind == ComparisonOp::Kind::kEqual) {
         switch (comparison->rep.MapTaggedToWord().value()) {
@@ -3689,8 +3709,7 @@ void InstructionSelectorT::VisitWordCompareZero(OpIndex user, OpIndex value,
             cont->OverwriteAndNegateIfEqual(kUnorderedEqual);
             return VisitFloat32Compare(this, value, cont);
           case RegisterRepresentation::Float64(): {
-            bool is_self_compare =
-                this->input_at(value, 0) == this->input_at(value, 1);
+            bool is_self_compare = comparison->left() == comparison->right();
             cont->OverwriteAndNegateIfEqual(is_self_compare ? kIsNotNaN
                                                             : kUnorderedEqual);
             return VisitFloat64Compare(this, value, cont);
@@ -3796,8 +3815,9 @@ void InstructionSelectorT::VisitWordCompareZero(OpIndex user, OpIndex value,
 
 void InstructionSelectorT::VisitSwitch(OpIndex node, const SwitchInfo& sw) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
-  InstructionOperand value_operand = g.UseRegister(this->input_at(node, 0));
+  const SwitchOp& op = Cast<SwitchOp>(node);
+  DCHECK_EQ(op.input_count, 1);
+  InstructionOperand value_operand = g.UseRegister(op.input());
 
   // Emit either ArchTableSwitch or ArchBinarySearchSwitch.
   if (enable_switch_jump_table_ ==
@@ -3820,7 +3840,7 @@ void InstructionSelectorT::VisitSwitch(OpIndex node, const SwitchInfo& sw) {
              value_operand, g.TempImmediate(-sw.min_value()));
       } else {
         // Zero extend, because we use it as 64-bit index into the jump table.
-        if (ZeroExtendsWord32ToWord64(this->input_at(node, 0))) {
+        if (ZeroExtendsWord32ToWord64(op.input())) {
           // Input value has already been zero-extended.
           index_operand = value_operand;
         } else {
@@ -3838,7 +3858,7 @@ void InstructionSelectorT::VisitSwitch(OpIndex node, const SwitchInfo& sw) {
 
 void InstructionSelectorT::VisitWord32Equal(OpIndex node) {
   FlagsContinuation cont = FlagsContinuation::ForSet(kEqual, node);
-  const ComparisonOp& equal = this->Get(node).Cast<ComparisonOp>();
+  const ComparisonOp& equal = Cast<ComparisonOp>(node);
   DCHECK_EQ(equal.kind, ComparisonOp::Kind::kEqual);
   DCHECK(equal.rep == RegisterRepresentation::Word32() ||
          equal.rep == RegisterRepresentation::Tagged());
@@ -3872,13 +3892,13 @@ void InstructionSelectorT::VisitUint32LessThanOrEqual(OpIndex node) {
 
 void InstructionSelectorT::VisitWord64Equal(OpIndex node) {
   FlagsContinuation cont = FlagsContinuation::ForSet(kEqual, node);
-  const ComparisonOp& equal = this->Get(node).Cast<ComparisonOp>();
+  const ComparisonOp& equal = Cast<ComparisonOp>(node);
   DCHECK_EQ(equal.kind, ComparisonOp::Kind::kEqual);
   DCHECK(equal.rep == RegisterRepresentation::Word64() ||
          equal.rep == RegisterRepresentation::Tagged());
   if (MatchIntegralZero(equal.right())) {
     if (CanCover(node, equal.left())) {
-      const Operation& left_op = this->Get(equal.left());
+      const Operation& left_op = Get(equal.left());
       if (left_op.Is<Opmask::kWord64Sub>()) {
         return VisitWordCompare(this, equal.left(), kX64Cmp, &cont);
       } else if (left_op.Is<Opmask::kWord64BitwiseAnd>()) {
@@ -3949,7 +3969,8 @@ void InstructionSelectorT::VisitFloat32LessThanOrEqual(OpIndex node) {
 }
 
 void InstructionSelectorT::VisitFloat64Equal(OpIndex node) {
-  bool is_self_compare = this->input_at(node, 0) == this->input_at(node, 1);
+  const ComparisonOp& op = Cast<ComparisonOp>(node);
+  bool is_self_compare = op.left() == op.right();
   FlagsContinuation cont = FlagsContinuation::ForSet(
       is_self_compare ? kIsNotNaN : kUnorderedEqual, node);
   VisitFloat64Compare(this, node, &cont);
@@ -3964,12 +3985,12 @@ void InstructionSelectorT::VisitFloat64LessThan(OpIndex node) {
   // and which evaluates to false if x is 0, -0 or NaN. We can compile
   // this to a simple (v)ucomisd using not_equal flags condition, which
   // avoids the costly Float64Abs.
-  const ComparisonOp& cmp = this->Get(node).template Cast<ComparisonOp>();
+  const ComparisonOp& cmp = Cast<ComparisonOp>(node);
   DCHECK_EQ(cmp.rep, RegisterRepresentation::Float64());
   DCHECK_EQ(cmp.kind, ComparisonOp::Kind::kSignedLessThan);
-  if (this->MatchZero(cmp.left())) {
+  if (MatchZero(cmp.left())) {
     if (const FloatUnaryOp* right_op =
-            this->Get(cmp.right()).template TryCast<Opmask::kFloat64Abs>()) {
+            TryCast<Opmask::kFloat64Abs>(cmp.right())) {
       FlagsContinuation cont = FlagsContinuation::ForSet(kNotEqual, node);
       InstructionCode const opcode =
           IsSupported(AVX) ? kAVXFloat64Cmp : kSSEFloat64Cmp;
@@ -3990,7 +4011,7 @@ void InstructionSelectorT::VisitFloat64LessThanOrEqual(OpIndex node) {
 
 void InstructionSelectorT::VisitBitcastWord32PairToFloat64(OpIndex node) {
   X64OperandGeneratorT g(this);
-  const auto& bitcast = this->Cast<BitcastWord32PairToFloat64Op>(node);
+  const auto& bitcast = Cast<BitcastWord32PairToFloat64Op>(node);
   OpIndex hi = bitcast.high_word32();
   OpIndex lo = bitcast.low_word32();
 
@@ -4003,14 +4024,15 @@ void InstructionSelectorT::VisitBitcastWord32PairToFloat64(OpIndex node) {
 
 void InstructionSelectorT::VisitFloat64SilenceNaN(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const FloatUnaryOp& op = Cast<FloatUnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   Emit(kSSEFloat64SilenceNaN, g.DefineSameAsFirst(node),
-       g.UseRegister(this->input_at(node, 0)));
+       g.UseRegister(op.input()));
 }
 
 void InstructionSelectorT::VisitMemoryBarrier(OpIndex node) {
   AtomicMemoryOrder order;
-  order = this->Get(node).template Cast<MemoryBarrierOp>().memory_order;
+  order = Cast<MemoryBarrierOp>(node).memory_order;
   // x64 is no weaker than release-acquire and only needs to emit an
   // instruction for SeqCst memory barriers.
   if (order == AtomicMemoryOrder::kSeqCst) {
@@ -4063,7 +4085,7 @@ void InstructionSelectorT::VisitWord64AtomicStore(OpIndex node) {
 }
 
 void InstructionSelectorT::VisitWord32AtomicExchange(OpIndex node) {
-  const AtomicRMWOp& atomic_op = this->Get(node).template Cast<AtomicRMWOp>();
+  const AtomicRMWOp& atomic_op = Cast<AtomicRMWOp>(node);
   ArchOpcode opcode;
   if (atomic_op.memory_rep == MemoryRepresentation::Int8()) {
     opcode = kAtomicExchangeInt8;
@@ -4084,7 +4106,7 @@ void InstructionSelectorT::VisitWord32AtomicExchange(OpIndex node) {
 }
 
 void InstructionSelectorT::VisitWord64AtomicExchange(OpIndex node) {
-  const AtomicRMWOp& atomic_op = this->Get(node).template Cast<AtomicRMWOp>();
+  const AtomicRMWOp& atomic_op = Cast<AtomicRMWOp>(node);
   ArchOpcode opcode;
   if (atomic_op.memory_rep == MemoryRepresentation::Uint8()) {
     opcode = kAtomicExchangeUint8;
@@ -4102,7 +4124,7 @@ void InstructionSelectorT::VisitWord64AtomicExchange(OpIndex node) {
 }
 
 void InstructionSelectorT::VisitWord32AtomicCompareExchange(OpIndex node) {
-  const AtomicRMWOp& atomic_op = this->Get(node).template Cast<AtomicRMWOp>();
+  const AtomicRMWOp& atomic_op = Cast<AtomicRMWOp>(node);
   ArchOpcode opcode;
   if (atomic_op.memory_rep == MemoryRepresentation::Int8()) {
     opcode = kAtomicCompareExchangeInt8;
@@ -4123,7 +4145,7 @@ void InstructionSelectorT::VisitWord32AtomicCompareExchange(OpIndex node) {
 }
 
 void InstructionSelectorT::VisitWord64AtomicCompareExchange(OpIndex node) {
-  const AtomicRMWOp& atomic_op = this->Get(node).template Cast<AtomicRMWOp>();
+  const AtomicRMWOp& atomic_op = Cast<AtomicRMWOp>(node);
   ArchOpcode opcode;
   if (atomic_op.memory_rep == MemoryRepresentation::Uint8()) {
     opcode = kAtomicCompareExchangeUint8;
@@ -4143,7 +4165,7 @@ void InstructionSelectorT::VisitWord64AtomicCompareExchange(OpIndex node) {
 void InstructionSelectorT::VisitWord32AtomicBinaryOperation(
     OpIndex node, ArchOpcode int8_op, ArchOpcode uint8_op, ArchOpcode int16_op,
     ArchOpcode uint16_op, ArchOpcode word32_op) {
-  const AtomicRMWOp& atomic_op = this->Get(node).template Cast<AtomicRMWOp>();
+  const AtomicRMWOp& atomic_op = Cast<AtomicRMWOp>(node);
   ArchOpcode opcode;
   if (atomic_op.memory_rep == MemoryRepresentation::Int8()) {
     opcode = int8_op;
@@ -4179,7 +4201,7 @@ VISIT_ATOMIC_BINOP(Xor)
 void InstructionSelectorT::VisitWord64AtomicBinaryOperation(
     OpIndex node, ArchOpcode uint8_op, ArchOpcode uint16_op,
     ArchOpcode uint32_op, ArchOpcode word64_op) {
-  const AtomicRMWOp& atomic_op = this->Get(node).template Cast<AtomicRMWOp>();
+  const AtomicRMWOp& atomic_op = Cast<AtomicRMWOp>(node);
   ArchOpcode opcode;
   if (atomic_op.memory_rep == MemoryRepresentation::Uint8()) {
     opcode = uint8_op;
@@ -4505,8 +4527,7 @@ void InstructionSelectorT::VisitS128Const(OpIndex node) {
   X64OperandGeneratorT g(this);
   static const int kUint32Immediates = kSimd128Size / sizeof(uint32_t);
   uint32_t val[kUint32Immediates];
-  const Simd128ConstantOp& constant =
-      this->Get(node).template Cast<Simd128ConstantOp>();
+  const Simd128ConstantOp& constant = Cast<Simd128ConstantOp>(node);
   memcpy(val, constant.value, kSimd128Size);
   // If all bytes are zeros or ones, avoid emitting code for generic constants
   bool all_zeros = !(val[0] || val[1] || val[2] || val[3]);
@@ -4542,8 +4563,9 @@ void InstructionSelectorT::VisitS128Zero(OpIndex node) {
 #define VISIT_INT_SIMD_SPLAT(Type, LaneSize, VectorLength)                   \
   void InstructionSelectorT::Visit##Type##Splat(OpIndex node) {              \
     X64OperandGeneratorT g(this);                                            \
-    DCHECK_EQ(this->value_input_count(node), 1);                             \
-    OpIndex input = this->input_at(node, 0);                                 \
+    const Operation& op = Get(node);                                         \
+    DCHECK_EQ(op.input_count, 1);                                            \
+    OpIndex input = op.input(0);                                             \
     if (g.CanBeImmediate(input) && g.GetImmediateIntegerValue(input) == 0) { \
       Emit(kX64SZero | VectorLengthField::encode(VectorLength),              \
            g.DefineAsRegister(node));                                        \
@@ -4559,49 +4581,61 @@ SIMD_INT_TYPES_FOR_SPLAT(VISIT_INT_SIMD_SPLAT)
 
 void InstructionSelectorT::VisitF64x2Splat(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd128SplatOp& op = Cast<Simd128SplatOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   Emit(kX64FSplat | LaneSizeField::encode(kL64) |
            VectorLengthField::encode(kV128),
-       g.DefineAsRegister(node), g.Use(this->input_at(node, 0)));
+       g.DefineAsRegister(node), g.Use(op.input()));
 }
 
 void InstructionSelectorT::VisitF32x4Splat(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd128SplatOp& op = Cast<Simd128SplatOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   Emit(kX64FSplat | LaneSizeField::encode(kL32) |
            VectorLengthField::encode(kV128),
-       g.DefineAsRegister(node), g.UseRegister(this->input_at(node, 0)));
+       g.DefineAsRegister(node), g.UseRegister(op.input()));
 }
 
 void InstructionSelectorT::VisitF16x8Splat(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd128SplatOp& op = Cast<Simd128SplatOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   Emit(kX64FSplat | LaneSizeField::encode(kL16) |
            VectorLengthField::encode(kV128),
-       g.DefineAsRegister(node), g.UseRegister(this->input_at(node, 0)));
+       g.DefineAsRegister(node), g.UseRegister(op.input()));
 }
 
 void InstructionSelectorT::VisitF64x4Splat(OpIndex node) {
+#ifdef V8_ENABLE_WASM_SIMD256_REVEC
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd256SplatOp& op = Cast<Simd256SplatOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   Emit(kX64FSplat | LaneSizeField::encode(kL64) |
            VectorLengthField::encode(kV256),
-       g.DefineAsRegister(node), g.UseRegister(this->input_at(node, 0)));
+       g.DefineAsRegister(node), g.UseRegister(op.input()));
+#else
+  UNREACHABLE();
+#endif
 }
 
 void InstructionSelectorT::VisitF32x8Splat(OpIndex node) {
+#ifdef V8_ENABLE_WASM_SIMD256_REVEC
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd256SplatOp& op = Cast<Simd256SplatOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   Emit(kX64FSplat | LaneSizeField::encode(kL32) |
            VectorLengthField::encode(kV256),
-       g.DefineAsRegister(node), g.UseRegister(this->input_at(node, 0)));
+       g.DefineAsRegister(node), g.UseRegister(op.input()));
+#else
+  UNREACHABLE();
+#endif
 }
 
 #define SIMD_VISIT_EXTRACT_LANE(IF, Type, Sign, LaneSize, VectorLength)     \
   void InstructionSelectorT::Visit##Type##ExtractLane##Sign(OpIndex node) { \
     X64OperandGeneratorT g(this);                                           \
-    const Simd128ExtractLaneOp& op =                                        \
-        this->Get(node).template Cast<Simd128ExtractLaneOp>();              \
+    const Simd128ExtractLaneOp& op = Cast<Simd128ExtractLaneOp>(node);      \
     int32_t lane = op.lane;                                                 \
     Emit(kX64##IF##ExtractLane##Sign | LaneSizeField::encode(LaneSize) |    \
              VectorLengthField::encode(VectorLength),                       \
@@ -4620,23 +4654,21 @@ SIMD_VISIT_EXTRACT_LANE(I, I8x16, S, kL8, kV128)
 
 void InstructionSelectorT::VisitI16x8ExtractLaneU(OpIndex node) {
   X64OperandGeneratorT g(this);
-  const Simd128ExtractLaneOp& op =
-      this->Get(node).template Cast<Simd128ExtractLaneOp>();
+  const Simd128ExtractLaneOp& op = Cast<Simd128ExtractLaneOp>(node);
   Emit(kX64Pextrw, g.DefineAsRegister(node), g.UseRegister(op.input()),
        g.UseImmediate(static_cast<int32_t>(op.lane)));
 }
 
 void InstructionSelectorT::VisitI8x16ExtractLaneU(OpIndex node) {
   X64OperandGeneratorT g(this);
-  const Simd128ExtractLaneOp& op =
-      this->Get(node).template Cast<Simd128ExtractLaneOp>();
+  const Simd128ExtractLaneOp& op = Cast<Simd128ExtractLaneOp>(node);
   Emit(kX64Pextrb, g.DefineAsRegister(node), g.UseRegister(op.input()),
        g.UseImmediate(op.lane));
 }
 
 void InstructionSelectorT::VisitF16x8ReplaceLane(OpIndex node) {
   X64OperandGeneratorT g(this);
-  auto& op = this->Get(node).template Cast<Simd128ReplaceLaneOp>();
+  auto& op = Cast<Simd128ReplaceLaneOp>(node);
   Emit(kX64FReplaceLane | LaneSizeField::encode(kL16) |
            VectorLengthField::encode(kV128),
        g.DefineSameAsFirst(node), g.UseRegister(op.into()),
@@ -4645,8 +4677,7 @@ void InstructionSelectorT::VisitF16x8ReplaceLane(OpIndex node) {
 
 void InstructionSelectorT::VisitF32x4ReplaceLane(OpIndex node) {
   X64OperandGeneratorT g(this);
-  const Simd128ReplaceLaneOp& op =
-      this->Get(node).template Cast<Simd128ReplaceLaneOp>();
+  const Simd128ReplaceLaneOp& op = Cast<Simd128ReplaceLaneOp>(node);
   Emit(kX64FReplaceLane | LaneSizeField::encode(kL32) |
            VectorLengthField::encode(kV128),
        g.DefineSameAsFirst(node), g.UseRegister(op.into()),
@@ -4658,21 +4689,19 @@ void InstructionSelectorT::VisitF64x2ReplaceLane(OpIndex node) {
   // When no-AVX, define dst == src to save a move.
   InstructionOperand dst =
       IsSupported(AVX) ? g.DefineAsRegister(node) : g.DefineSameAsFirst(node);
-  const Simd128ReplaceLaneOp& op =
-      this->Get(node).template Cast<Simd128ReplaceLaneOp>();
+  const Simd128ReplaceLaneOp& op = Cast<Simd128ReplaceLaneOp>(node);
   Emit(kX64FReplaceLane | LaneSizeField::encode(kL64) |
            VectorLengthField::encode(kV128),
        dst, g.UseRegister(op.into()), g.UseImmediate(op.lane),
        g.UseRegister(op.new_lane()));
 }
 
-#define VISIT_SIMD_REPLACE_LANE(TYPE, OPCODE)                         \
-  void InstructionSelectorT::Visit##TYPE##ReplaceLane(OpIndex node) { \
-    X64OperandGeneratorT g(this);                                     \
-    const Simd128ReplaceLaneOp& op =                                  \
-        this->Get(node).template Cast<Simd128ReplaceLaneOp>();        \
-    Emit(OPCODE, g.DefineAsRegister(node), g.UseRegister(op.into()),  \
-         g.UseImmediate(op.lane), g.Use(op.new_lane()));              \
+#define VISIT_SIMD_REPLACE_LANE(TYPE, OPCODE)                          \
+  void InstructionSelectorT::Visit##TYPE##ReplaceLane(OpIndex node) {  \
+    X64OperandGeneratorT g(this);                                      \
+    const Simd128ReplaceLaneOp& op = Cast<Simd128ReplaceLaneOp>(node); \
+    Emit(OPCODE, g.DefineAsRegister(node), g.UseRegister(op.into()),   \
+         g.UseImmediate(op.lane), g.Use(op.new_lane()));               \
   }
 
 #define SIMD_TYPES_FOR_REPLACE_LANE(V) \
@@ -4689,19 +4718,18 @@ SIMD_TYPES_FOR_REPLACE_LANE(VISIT_SIMD_REPLACE_LANE)
     Name, Opcode, LaneSize, VectorLength)                                  \
   void InstructionSelectorT::Visit##Name(OpIndex node) {                   \
     X64OperandGeneratorT g(this);                                          \
-    DCHECK_EQ(this->value_input_count(node), 2);                           \
+    const Operation& op = Get(node);                                       \
+    DCHECK_EQ(op.input_count, 2);                                          \
     InstructionOperand dst = IsSupported(AVX) ? g.DefineAsRegister(node)   \
                                               : g.DefineSameAsFirst(node); \
-    if (g.CanBeImmediate(this->input_at(node, 1))) {                       \
+    if (g.CanBeImmediate(op.input(1))) {                                   \
       Emit(kX64##Opcode | LaneSizeField::encode(LaneSize) |                \
                VectorLengthField::encode(VectorLength),                    \
-           dst, g.UseRegister(this->input_at(node, 0)),                    \
-           g.UseImmediate(this->input_at(node, 1)));                       \
+           dst, g.UseRegister(op.input(0)), g.UseImmediate(op.input(1)));  \
     } else {                                                               \
       Emit(kX64##Opcode | LaneSizeField::encode(LaneSize) |                \
                VectorLengthField::encode(VectorLength),                    \
-           dst, g.UseRegister(this->input_at(node, 0)),                    \
-           g.UseRegister(this->input_at(node, 1)));                        \
+           dst, g.UseRegister(op.input(0)), g.UseRegister(op.input(1)));   \
     }                                                                      \
   }
 SIMD_SHIFT_LANE_SIZE_VECTOR_LENGTH_OPCODES(
@@ -4710,51 +4738,51 @@ SIMD_SHIFT_LANE_SIZE_VECTOR_LENGTH_OPCODES(
 #undef VISIT_SIMD_SHIFT_LANE_SIZE_VECTOR_LENGTH_OPCODES
 #undef SIMD_SHIFT_LANE_SIZE_VECTOR_LENGTH_OPCODES
 
-#define VISIT_SIMD_NARROW_SHIFT_LANE_SIZE_VECTOR_LENGTH_OPCODES(            \
-    Name, Opcode, LaneSize, VectorLength)                                   \
-  void InstructionSelectorT::Visit##Name(OpIndex node) {                    \
-    X64OperandGeneratorT g(this);                                           \
-    DCHECK_EQ(this->value_input_count(node), 2);                            \
-    InstructionOperand output =                                             \
-        IsSupported(AVX) ? g.UseRegister(node) : g.DefineSameAsFirst(node); \
-    if (g.CanBeImmediate(this->input_at(node, 1))) {                        \
-      Emit(kX64##Opcode | LaneSizeField::encode(LaneSize) |                 \
-               VectorLengthField::encode(VectorLength),                     \
-           output, g.UseRegister(this->input_at(node, 0)),                  \
-           g.UseImmediate(this->input_at(node, 1)));                        \
-    } else {                                                                \
-      InstructionOperand temps[] = {g.TempSimd128Register()};               \
-      Emit(kX64##Opcode | LaneSizeField::encode(LaneSize) |                 \
-               VectorLengthField::encode(VectorLength),                     \
-           output, g.UseUniqueRegister(this->input_at(node, 0)),            \
-           g.UseUniqueRegister(this->input_at(node, 1)), arraysize(temps),  \
-           temps);                                                          \
-    }                                                                       \
+#define VISIT_SIMD_NARROW_SHIFT_LANE_SIZE_VECTOR_LENGTH_OPCODES(             \
+    Name, Opcode, LaneSize, VectorLength)                                    \
+  void InstructionSelectorT::Visit##Name(OpIndex node) {                     \
+    X64OperandGeneratorT g(this);                                            \
+    const Operation& op = Get(node);                                         \
+    DCHECK_EQ(op.input_count, 2);                                            \
+    InstructionOperand output =                                              \
+        IsSupported(AVX) ? g.UseRegister(node) : g.DefineSameAsFirst(node);  \
+    if (g.CanBeImmediate(op.input(1))) {                                     \
+      Emit(kX64##Opcode | LaneSizeField::encode(LaneSize) |                  \
+               VectorLengthField::encode(VectorLength),                      \
+           output, g.UseRegister(op.input(0)), g.UseImmediate(op.input(1))); \
+    } else {                                                                 \
+      InstructionOperand temps[] = {g.TempSimd128Register()};                \
+      Emit(kX64##Opcode | LaneSizeField::encode(LaneSize) |                  \
+               VectorLengthField::encode(VectorLength),                      \
+           output, g.UseUniqueRegister(op.input(0)),                         \
+           g.UseUniqueRegister(op.input(1)), arraysize(temps), temps);       \
+    }                                                                        \
   }
 SIMD_NARROW_SHIFT_LANE_SIZE_VECTOR_LENGTH_OPCODES(
     VISIT_SIMD_NARROW_SHIFT_LANE_SIZE_VECTOR_LENGTH_OPCODES)
 #undef VISIT_SIMD_NARROW_SHIFT_LANE_SIZE_VECTOR_LENGTH_OPCODES
 #undef SIMD_NARROW_SHIFT_LANE_SIZE_VECTOR_LENGTH_OPCODES
 
-#define VISIT_SIMD_UNOP(Opcode)                            \
-  void InstructionSelectorT::Visit##Opcode(OpIndex node) { \
-    X64OperandGeneratorT g(this);                          \
-    DCHECK_EQ(this->value_input_count(node), 1);           \
-    Emit(kX64##Opcode, g.DefineAsRegister(node),           \
-         g.UseRegister(this->input_at(node, 0)));          \
+#define VISIT_SIMD_UNOP(Opcode)                                               \
+  void InstructionSelectorT::Visit##Opcode(OpIndex node) {                    \
+    X64OperandGeneratorT g(this);                                             \
+    const Operation& op = Get(node);                                          \
+    DCHECK_EQ(op.input_count, 1);                                             \
+    Emit(kX64##Opcode, g.DefineAsRegister(node), g.UseRegister(op.input(0))); \
   }
 SIMD_UNOP_LIST(VISIT_SIMD_UNOP)
 #undef VISIT_SIMD_UNOP
 #undef SIMD_UNOP_LIST
 
-#define VISIT_SIMD_UNOP_LANE_SIZE_VECTOR_LENGTH(Name, Opcode, LaneSize,     \
-                                                VectorLength)               \
-  void InstructionSelectorT::Visit##Name(OpIndex node) {                    \
-    X64OperandGeneratorT g(this);                                           \
-    DCHECK_EQ(this->value_input_count(node), 1);                            \
-    Emit(kX64##Opcode | LaneSizeField::encode(LaneSize) |                   \
-             VectorLengthField::encode(VectorLength),                       \
-         g.DefineAsRegister(node), g.UseRegister(this->input_at(node, 0))); \
+#define VISIT_SIMD_UNOP_LANE_SIZE_VECTOR_LENGTH(Name, Opcode, LaneSize, \
+                                                VectorLength)           \
+  void InstructionSelectorT::Visit##Name(OpIndex node) {                \
+    X64OperandGeneratorT g(this);                                       \
+    const Operation& op = Get(node);                                    \
+    DCHECK_EQ(op.input_count, 1);                                       \
+    Emit(kX64##Opcode | LaneSizeField::encode(LaneSize) |               \
+             VectorLengthField::encode(VectorLength),                   \
+         g.DefineAsRegister(node), g.UseRegister(op.input(0)));         \
   }
 
 SIMD_UNOP_LANE_SIZE_VECTOR_LENGTH_LIST(VISIT_SIMD_UNOP_LANE_SIZE_VECTOR_LENGTH)
@@ -4762,15 +4790,16 @@ SIMD_UNOP_LANE_SIZE_VECTOR_LENGTH_LIST(VISIT_SIMD_UNOP_LANE_SIZE_VECTOR_LENGTH)
 #undef VISIT_SIMD_UNOP_LANE_SIZE_VECTOR_LENGTH
 #undef SIMD_UNOP_LANE_SIZE_VECTOR_LENGTH_LIST
 
-#define VISIT_SIMD_BINOP_LANE_SIZE_VECTOR_LENGTH(Name, Opcode, LaneSize,    \
-                                                 VectorLength)              \
-  void InstructionSelectorT::Visit##Name(OpIndex node) {                    \
-    X64OperandGeneratorT g(this);                                           \
-    DCHECK_EQ(this->value_input_count(node), 2);                            \
-    Emit(kX64##Opcode | LaneSizeField::encode(LaneSize) |                   \
-             VectorLengthField::encode(VectorLength),                       \
-         g.DefineSameAsFirst(node), g.UseRegister(this->input_at(node, 0)), \
-         g.UseRegister(this->input_at(node, 1)));                           \
+#define VISIT_SIMD_BINOP_LANE_SIZE_VECTOR_LENGTH(Name, Opcode, LaneSize, \
+                                                 VectorLength)           \
+  void InstructionSelectorT::Visit##Name(OpIndex node) {                 \
+    X64OperandGeneratorT g(this);                                        \
+    const Operation& op = Get(node);                                     \
+    DCHECK_EQ(op.input_count, 2);                                        \
+    Emit(kX64##Opcode | LaneSizeField::encode(LaneSize) |                \
+             VectorLengthField::encode(VectorLength),                    \
+         g.DefineSameAsFirst(node), g.UseRegister(op.input(0)),          \
+         g.UseRegister(op.input(1)));                                    \
   }
 
 SIMD_BINOP_LANE_SIZE_VECTOR_LENGTH_LIST(
@@ -4779,41 +4808,41 @@ SIMD_BINOP_LANE_SIZE_VECTOR_LENGTH_LIST(
 #undef VISIT_SIMD_BINOP_LANE_SIZE_VECTOR_LENGTH
 #undef SIMD_BINOP_LANE_SIZE_VECTOR_LENGTH_LIST
 
-#define VISIT_SIMD_BINOP(Opcode)                           \
-  void InstructionSelectorT::Visit##Opcode(OpIndex node) { \
-    X64OperandGeneratorT g(this);                          \
-    DCHECK_EQ(this->value_input_count(node), 2);           \
-    if (IsSupported(AVX)) {                                \
-      Emit(kX64##Opcode, g.DefineAsRegister(node),         \
-           g.UseRegister(this->input_at(node, 0)),         \
-           g.UseRegister(this->input_at(node, 1)));        \
-    } else {                                               \
-      Emit(kX64##Opcode, g.DefineSameAsFirst(node),        \
-           g.UseRegister(this->input_at(node, 0)),         \
-           g.UseRegister(this->input_at(node, 1)));        \
-    }                                                      \
+#define VISIT_SIMD_BINOP(Opcode)                                               \
+  void InstructionSelectorT::Visit##Opcode(OpIndex node) {                     \
+    X64OperandGeneratorT g(this);                                              \
+    const Operation& op = Get(node);                                           \
+    DCHECK_EQ(op.input_count, 2);                                              \
+    if (IsSupported(AVX)) {                                                    \
+      Emit(kX64##Opcode, g.DefineAsRegister(node), g.UseRegister(op.input(0)), \
+           g.UseRegister(op.input(1)));                                        \
+    } else {                                                                   \
+      Emit(kX64##Opcode, g.DefineSameAsFirst(node),                            \
+           g.UseRegister(op.input(0)), g.UseRegister(op.input(1)));            \
+    }                                                                          \
   }
 
 SIMD_BINOP_SSE_AVX_LIST(VISIT_SIMD_BINOP)
 #undef VISIT_SIMD_BINOP
 #undef SIMD_BINOP_SSE_AVX_LIST
 
-#define VISIT_SIMD_BINOP_LANE_SIZE_VECTOR_LENGTH(Name, Opcode, LaneSize,      \
-                                                 VectorLength)                \
-  void InstructionSelectorT::Visit##Name(OpIndex node) {                      \
-    X64OperandGeneratorT g(this);                                             \
-    DCHECK_EQ(this->value_input_count(node), 2);                              \
-    if (IsSupported(AVX)) {                                                   \
-      Emit(kX64##Opcode | LaneSizeField::encode(LaneSize) |                   \
-               VectorLengthField::encode(VectorLength),                       \
-           g.DefineAsRegister(node), g.UseRegister(this->input_at(node, 0)),  \
-           g.UseRegister(this->input_at(node, 1)));                           \
-    } else {                                                                  \
-      Emit(kX64##Opcode | LaneSizeField::encode(LaneSize) |                   \
-               VectorLengthField::encode(VectorLength),                       \
-           g.DefineSameAsFirst(node), g.UseRegister(this->input_at(node, 0)), \
-           g.UseRegister(this->input_at(node, 1)));                           \
-    }                                                                         \
+#define VISIT_SIMD_BINOP_LANE_SIZE_VECTOR_LENGTH(Name, Opcode, LaneSize, \
+                                                 VectorLength)           \
+  void InstructionSelectorT::Visit##Name(OpIndex node) {                 \
+    X64OperandGeneratorT g(this);                                        \
+    const Operation& op = Get(node);                                     \
+    DCHECK_EQ(op.input_count, 2);                                        \
+    if (IsSupported(AVX)) {                                              \
+      Emit(kX64##Opcode | LaneSizeField::encode(LaneSize) |              \
+               VectorLengthField::encode(VectorLength),                  \
+           g.DefineAsRegister(node), g.UseRegister(op.input(0)),         \
+           g.UseRegister(op.input(1)));                                  \
+    } else {                                                             \
+      Emit(kX64##Opcode | LaneSizeField::encode(LaneSize) |              \
+               VectorLengthField::encode(VectorLength),                  \
+           g.DefineSameAsFirst(node), g.UseRegister(op.input(0)),        \
+           g.UseRegister(op.input(1)));                                  \
+    }                                                                    \
   }
 
 SIMD_BINOP_SSE_AVX_LANE_SIZE_VECTOR_LENGTH_LIST(
@@ -4821,18 +4850,18 @@ SIMD_BINOP_SSE_AVX_LANE_SIZE_VECTOR_LENGTH_LIST(
 #undef VISIT_SIMD_BINOP_LANE_SIZE_VECTOR_LENGTH
 #undef SIMD_BINOP_SSE_AVX_LANE_SIZE_VECTOR_LENGTH_LIST
 
-#define VISIT_SIMD_F16x8_BINOP(Name, Opcode)                               \
-  void InstructionSelectorT::Visit##Name(OpIndex node) {                   \
-    X64OperandGeneratorT g(this);                                          \
-    DCHECK_EQ(this->value_input_count(node), 2);                           \
-    InstructionOperand temps[] = {g.TempSimd256Register(),                 \
-                                  g.TempSimd256Register()};                \
-    size_t temp_count = arraysize(temps);                                  \
-    Emit(kX64##Opcode | LaneSizeField::encode(kL16) |                      \
-             VectorLengthField::encode(kV128),                             \
-         g.DefineAsRegister(node),                                         \
-         g.UseUniqueRegister(this->input_at(node, 0)),                     \
-         g.UseUniqueRegister(this->input_at(node, 1)), temp_count, temps); \
+#define VISIT_SIMD_F16x8_BINOP(Name, Opcode)                         \
+  void InstructionSelectorT::Visit##Name(OpIndex node) {             \
+    X64OperandGeneratorT g(this);                                    \
+    const Operation& op = Get(node);                                 \
+    DCHECK_EQ(op.input_count, 2);                                    \
+    InstructionOperand temps[] = {g.TempSimd256Register(),           \
+                                  g.TempSimd256Register()};          \
+    size_t temp_count = arraysize(temps);                            \
+    Emit(kX64##Opcode | LaneSizeField::encode(kL16) |                \
+             VectorLengthField::encode(kV128),                       \
+         g.DefineAsRegister(node), g.UseUniqueRegister(op.input(0)), \
+         g.UseUniqueRegister(op.input(1)), temp_count, temps);       \
   }
 
 SIMD_F16x8_BINOP_LIST(VISIT_SIMD_F16x8_BINOP)
@@ -4841,9 +4870,10 @@ SIMD_F16x8_BINOP_LIST(VISIT_SIMD_F16x8_BINOP)
 
     void InstructionSelectorT::VisitV128AnyTrue(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd128TestOp& op = Cast<Simd128TestOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   Emit(kX64V128AnyTrue, g.DefineAsRegister(node),
-       g.UseUniqueRegister(this->input_at(node, 0)));
+       g.UseUniqueRegister(op.input()));
 }
 
 namespace {
@@ -4871,74 +4901,83 @@ static bool MatchSimd128Constant(InstructionSelectorT* selector, OpIndex node,
 
 void InstructionSelectorT::VisitS128Select(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 3);
+  const Simd128TernaryOp& op = Cast<Simd128TernaryOp>(node);
+  DCHECK_EQ(op.input_count, 3);
 
   InstructionOperand dst =
       IsSupported(AVX) ? g.DefineAsRegister(node) : g.DefineSameAsFirst(node);
-  if (IsV128ZeroConst(this, this->input_at(node, 2))) {
+  if (IsV128ZeroConst(this, op.input(2))) {
     // select(cond, input1, 0) -> and(cond, input1)
     Emit(kX64SAnd | VectorLengthField::encode(kV128), dst,
-         g.UseRegister(this->input_at(node, 0)),
-         g.UseRegister(this->input_at(node, 1)));
-  } else if (IsV128ZeroConst(this, this->input_at(node, 1))) {
+         g.UseRegister(op.input(0)), g.UseRegister(op.input(1)));
+  } else if (IsV128ZeroConst(this, op.input(1))) {
     // select(cond, 0, input2) -> and(not(cond), input2)
     Emit(kX64SAndNot | VectorLengthField::encode(kV128), dst,
-         g.UseRegister(this->input_at(node, 0)),
-         g.UseRegister(this->input_at(node, 2)));
+         g.UseRegister(op.input(0)), g.UseRegister(op.input(2)));
   } else {
     Emit(kX64SSelect | VectorLengthField::encode(kV128), dst,
-         g.UseRegister(this->input_at(node, 0)),
-         g.UseRegister(this->input_at(node, 1)),
-         g.UseRegister(this->input_at(node, 2)));
+         g.UseRegister(op.input(0)), g.UseRegister(op.input(1)),
+         g.UseRegister(op.input(2)));
   }
 }
 
 void InstructionSelectorT::VisitS256Select(OpIndex node) {
+#ifdef V8_ENABLE_WASM_SIMD256_REVEC
   X64OperandGeneratorT g(this);
+  const Simd256TernaryOp& op = Cast<Simd256TernaryOp>(node);
   Emit(kX64SSelect | VectorLengthField::encode(kV256), g.DefineAsRegister(node),
-       g.UseRegister(this->input_at(node, 0)),
-       g.UseRegister(this->input_at(node, 1)),
-       g.UseRegister(this->input_at(node, 2)));
+       g.UseRegister(op.input(0)), g.UseRegister(op.input(1)),
+       g.UseRegister(op.input(2)));
+#else
+  UNREACHABLE();
+#endif
 }
 
 void InstructionSelectorT::VisitS128AndNot(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 2);
+  const Simd128BinopOp& op = Cast<Simd128BinopOp>(node);
+  DCHECK_EQ(op.input_count, 2);
   // andnps a b does ~a & b, but we want a & !b, so flip the input.
   Emit(kX64SAndNot | VectorLengthField::encode(kV128),
        IsSupported(AVX) ? g.DefineAsRegister(node) : g.DefineSameAsFirst(node),
-       g.UseRegister(this->input_at(node, 1)),
-       g.UseRegister(this->input_at(node, 0)));
+       g.UseRegister(op.right()), g.UseRegister(op.left()));
 }
 
 void InstructionSelectorT::VisitS256AndNot(OpIndex node) {
+#ifdef V8_ENABLE_WASM_SIMD256_REVEC
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 2);
+  const Simd256BinopOp& op = Cast<Simd256BinopOp>(node);
+  DCHECK_EQ(op.input_count, 2);
   // andnps a b does ~a & b, but we want a & !b, so flip the input.
   Emit(kX64SAndNot | VectorLengthField::encode(kV256),
        IsSupported(AVX) ? g.DefineAsRegister(node) : g.DefineSameAsFirst(node),
-       g.UseRegister(this->input_at(node, 1)),
-       g.UseRegister(this->input_at(node, 0)));
+       g.UseRegister(op.right()), g.UseRegister(op.left()));
+#else
+  UNREACHABLE();
+#endif
 }
 
 void InstructionSelectorT::VisitF64x2Abs(OpIndex node) {
-  DCHECK_EQ(this->value_input_count(node), 1);
-  VisitFloatUnop(this, node, this->input_at(node, 0),
+  const Simd128UnaryOp& op = Cast<Simd128UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
+  VisitFloatUnop(this, node, op.input(),
                  kX64FAbs | LaneSizeField::encode(kL64) |
                      VectorLengthField::encode(kV128));
 }
 
 void InstructionSelectorT::VisitF64x2Neg(OpIndex node) {
-  DCHECK_EQ(this->value_input_count(node), 1);
-  VisitFloatUnop(this, node, this->input_at(node, 0),
+  const Simd128UnaryOp& op = Cast<Simd128UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
+  VisitFloatUnop(this, node, op.input(),
                  kX64FNeg | LaneSizeField::encode(kL64) |
                      VectorLengthField::encode(kV128));
 }
 
 void InstructionSelectorT::VisitF32x4UConvertI32x4(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
-  OpIndex value = this->input_at(node, 0);
+  const Simd128UnaryOp& op = Cast<Simd128UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
+  OpIndex value = op.input();
 
   // F32x4SConvertI32x4 is more efficient than F32x4UConvertI32x4 on x64,
   // if the u32x4 input can fit into i32x4, we can use F32x4SConvertI32x4
@@ -4955,21 +4994,20 @@ void InstructionSelectorT::VisitF32x4UConvertI32x4(OpIndex node) {
 
   if (can_use_sign_convert) {
     Emit(kX64F32x4SConvertI32x4, g.DefineAsRegister(node),
-         g.UseRegister(this->input_at(node, 0)));
+         g.UseRegister(op.input()));
   } else {
     Emit(kX64F32x4UConvertI32x4, g.DefineSameAsFirst(node),
-         g.UseRegister(this->input_at(node, 0)));
+         g.UseRegister(op.input()));
   }
 }
 
-#define VISIT_SIMD_QFMOP(Opcode)                           \
-  void InstructionSelectorT::Visit##Opcode(OpIndex node) { \
-    X64OperandGeneratorT g(this);                          \
-    DCHECK_EQ(this->value_input_count(node), 3);           \
-    Emit(kX64##Opcode, g.UseRegister(node),                \
-         g.UseRegister(this->input_at(node, 0)),           \
-         g.UseRegister(this->input_at(node, 1)),           \
-         g.UseRegister(this->input_at(node, 2)));          \
+#define VISIT_SIMD_QFMOP(Opcode)                                        \
+  void InstructionSelectorT::Visit##Opcode(OpIndex node) {              \
+    X64OperandGeneratorT g(this);                                       \
+    const Operation& op = Get(node);                                    \
+    DCHECK_EQ(op.input_count, 3);                                       \
+    Emit(kX64##Opcode, g.UseRegister(node), g.UseRegister(op.input(0)), \
+         g.UseRegister(op.input(1)), g.UseRegister(op.input(2)));       \
   }
 VISIT_SIMD_QFMOP(F64x2Qfma)
 VISIT_SIMD_QFMOP(F64x2Qfms)
@@ -4984,17 +5022,16 @@ VISIT_SIMD_QFMOP(F32x8Qfms)
 #endif  // V8_ENABLE_WASM_SIMD256_REVEC
 #undef VISIT_SIMD_QFMOP
 
-#define VISIT_SIMD_F16x8_QFMOP(Opcode)                                   \
-  void InstructionSelectorT::Visit##Opcode(OpIndex node) {               \
-    X64OperandGeneratorT g(this);                                        \
-    DCHECK_EQ(this->value_input_count(node), 3);                         \
-    InstructionOperand temps[] = {g.TempSimd256Register(),               \
-                                  g.TempSimd256Register()};              \
-    Emit(kX64##Opcode, g.UseRegister(node),                              \
-         g.UseUniqueRegister(this->input_at(node, 0)),                   \
-         g.UseUniqueRegister(this->input_at(node, 1)),                   \
-         g.UseUniqueRegister(this->input_at(node, 2)), arraysize(temps), \
-         temps);                                                         \
+#define VISIT_SIMD_F16x8_QFMOP(Opcode)                                        \
+  void InstructionSelectorT::Visit##Opcode(OpIndex node) {                    \
+    X64OperandGeneratorT g(this);                                             \
+    const Operation& op = Get(node);                                          \
+    DCHECK_EQ(op.input_count, 3);                                             \
+    InstructionOperand temps[] = {g.TempSimd256Register(),                    \
+                                  g.TempSimd256Register()};                   \
+    Emit(kX64##Opcode, g.UseRegister(node), g.UseUniqueRegister(op.input(0)), \
+         g.UseUniqueRegister(op.input(1)), g.UseUniqueRegister(op.input(2)),  \
+         arraysize(temps), temps);                                            \
   }
 
 VISIT_SIMD_F16x8_QFMOP(F16x8Qfma) VISIT_SIMD_F16x8_QFMOP(F16x8Qfms)
@@ -5002,11 +5039,12 @@ VISIT_SIMD_F16x8_QFMOP(F16x8Qfma) VISIT_SIMD_F16x8_QFMOP(F16x8Qfms)
 
     void InstructionSelectorT::VisitI64x2Neg(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd128UnaryOp& op = Cast<Simd128UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   // If AVX unsupported, make sure dst != src to avoid a move.
-  InstructionOperand operand0 =
-      IsSupported(AVX) ? g.UseRegister(this->input_at(node, 0))
-                       : g.UseUniqueRegister(this->input_at(node, 0));
+  InstructionOperand operand0 = IsSupported(AVX)
+                                    ? g.UseRegister(op.input())
+                                    : g.UseUniqueRegister(op.input());
   Emit(
       kX64INeg | LaneSizeField::encode(kL64) | VectorLengthField::encode(kV128),
       g.DefineAsRegister(node), operand0);
@@ -5014,103 +5052,121 @@ VISIT_SIMD_F16x8_QFMOP(F16x8Qfma) VISIT_SIMD_F16x8_QFMOP(F16x8Qfms)
 
 void InstructionSelectorT::VisitI64x2ShrS(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 2);
+  const Simd128ShiftOp& op = Cast<Simd128ShiftOp>(node);
+  DCHECK_EQ(op.input_count, 2);
   InstructionOperand dst =
       IsSupported(AVX) ? g.DefineAsRegister(node) : g.DefineSameAsFirst(node);
 
-  if (g.CanBeImmediate(this->input_at(node, 1))) {
+  if (g.CanBeImmediate(op.shift())) {
     Emit(kX64IShrS | LaneSizeField::encode(kL64) |
              VectorLengthField::encode(kV128),
-         dst, g.UseRegister(this->input_at(node, 0)),
-         g.UseImmediate(this->input_at(node, 1)));
+         dst, g.UseRegister(op.input()), g.UseImmediate(op.shift()));
   } else {
     InstructionOperand temps[] = {g.TempSimd128Register()};
     Emit(kX64IShrS | LaneSizeField::encode(kL64) |
              VectorLengthField::encode(kV128),
-         dst, g.UseUniqueRegister(this->input_at(node, 0)),
-         g.UseRegister(this->input_at(node, 1)), arraysize(temps), temps);
+         dst, g.UseUniqueRegister(op.input()), g.UseRegister(op.shift()),
+         arraysize(temps), temps);
   }
 }
 
 void InstructionSelectorT::VisitI64x2Mul(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 2);
+  const Simd128BinopOp& op = Cast<Simd128BinopOp>(node);
+  DCHECK_EQ(op.input_count, 2);
   InstructionOperand temps[] = {g.TempSimd128Register()};
   Emit(
       kX64IMul | LaneSizeField::encode(kL64) | VectorLengthField::encode(kV128),
-      g.DefineAsRegister(node), g.UseUniqueRegister(this->input_at(node, 0)),
-      g.UseUniqueRegister(this->input_at(node, 1)), arraysize(temps), temps);
+      g.DefineAsRegister(node), g.UseUniqueRegister(op.left()),
+      g.UseUniqueRegister(op.right()), arraysize(temps), temps);
 }
 
 void InstructionSelectorT::VisitI64x4Mul(OpIndex node) {
+#ifdef V8_ENABLE_WASM_SIMD256_REVEC
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 2);
+  const Simd256BinopOp& op = Cast<Simd256BinopOp>(node);
+  DCHECK_EQ(op.input_count, 2);
   InstructionOperand temps[] = {g.TempSimd256Register()};
   Emit(
       kX64IMul | LaneSizeField::encode(kL64) | VectorLengthField::encode(kV256),
-      g.DefineAsRegister(node), g.UseUniqueRegister(this->input_at(node, 0)),
-      g.UseUniqueRegister(this->input_at(node, 1)), arraysize(temps), temps);
+      g.DefineAsRegister(node), g.UseUniqueRegister(op.left()),
+      g.UseUniqueRegister(op.right()), arraysize(temps), temps);
+#else
+  UNREACHABLE();
+#endif
 }
 
 void InstructionSelectorT::VisitI32x4SConvertF32x4(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd128UnaryOp& op = Cast<Simd128UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   Emit(kX64I32x4SConvertF32x4,
        IsSupported(AVX) ? g.DefineAsRegister(node) : g.DefineSameAsFirst(node),
-       g.UseRegister(this->input_at(node, 0)));
+       g.UseRegister(op.input()));
 }
 
 void InstructionSelectorT::VisitI32x8SConvertF32x8(OpIndex node) {
+#ifdef V8_ENABLE_WASM_SIMD256_REVEC
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd256UnaryOp& op = Cast<Simd256UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   Emit(kX64I32x8SConvertF32x8, g.DefineAsRegister(node),
-       g.UseRegister(this->input_at(node, 0)));
+       g.UseRegister(op.input()));
+#else
+  UNREACHABLE();
+#endif
 }
 
 void InstructionSelectorT::VisitI32x4UConvertF32x4(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd128UnaryOp& op = Cast<Simd128UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   InstructionOperand temps[] = {g.TempSimd128Register(),
                                 g.TempSimd128Register()};
   Emit(kX64I32x4UConvertF32x4, g.DefineSameAsFirst(node),
-       g.UseRegister(this->input_at(node, 0)), arraysize(temps), temps);
+       g.UseRegister(op.input()), arraysize(temps), temps);
 }
 
 void InstructionSelectorT::VisitI32x8UConvertF32x8(OpIndex node) {
+#ifdef V8_ENABLE_WASM_SIMD256_REVEC
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd256UnaryOp& op = Cast<Simd256UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   InstructionOperand temps[] = {g.TempSimd256Register(),
                                 g.TempSimd256Register()};
   Emit(kX64I32x8UConvertF32x8, g.DefineSameAsFirst(node),
-       g.UseRegister(this->input_at(node, 0)), arraysize(temps), temps);
+       g.UseRegister(op.input()), arraysize(temps), temps);
+#else
+  UNREACHABLE();
+#endif
 }
 
 #if V8_ENABLE_WASM_SIMD256_REVEC
 void InstructionSelectorT::VisitF32x8UConvertI32x8(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd256UnaryOp& op = Cast<Simd256UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
 
-  OpIndex value = this->input_at(node, 0);
+  OpIndex value = op.input();
 
   // F32x8SConvertI32x8 is more efficient than F32x8UConvertI32x8 on x64.
   bool can_use_sign_convert = false;
-  if (this->Get(value).template Is<Opmask::kSimd256I32x8UConvertI16x8>()) {
+  if (Is<Opmask::kSimd256I32x8UConvertI16x8>(value)) {
     can_use_sign_convert = true;
   }
 
   if (can_use_sign_convert) {
     Emit(kX64F32x8SConvertI32x8, g.DefineAsRegister(node),
-         g.UseRegister(this->input_at(node, 0)));
+         g.UseRegister(op.input()));
   } else {
     Emit(kX64F32x8UConvertI32x8, g.DefineSameAsFirst(node),
-         g.UseRegister(this->input_at(node, 0)));
+         g.UseRegister(op.input()));
   }
 }
 
 void InstructionSelectorT::VisitExtractF128(OpIndex node) {
   X64OperandGeneratorT g(this);
-  const Simd256Extract128LaneOp& op =
-      this->Get(node).template Cast<Simd256Extract128LaneOp>();
+  const Simd256Extract128LaneOp& op = Cast<Simd256Extract128LaneOp>(node);
   if (op.lane == 0) {
     EmitIdentity(node);
   } else {
@@ -5370,31 +5426,30 @@ void InstructionSelectorT::VisitI8x16Shuffle(OpIndex node) {
 }
 
 void InstructionSelectorT::VisitI8x16Swizzle(OpIndex node) {
-  InstructionCode op = kX64I8x16Swizzle;
-  DCHECK_EQ(this->value_input_count(node), 2);
-  OpIndex left = this->input_at(node, 0);
-  OpIndex right = this->input_at(node, 1);
-
-  bool relaxed;
-  const Simd128BinopOp& binop = this->Get(node).template Cast<Simd128BinopOp>();
+  InstructionCode opcode = kX64I8x16Swizzle;
+  const Simd128BinopOp& binop = Cast<Simd128BinopOp>(node);
+  DCHECK_EQ(binop.input_count, 2);
   DCHECK(binop.kind == any_of(Simd128BinopOp::Kind::kI8x16Swizzle,
                               Simd128BinopOp::Kind::kI8x16RelaxedSwizzle));
-  relaxed = binop.kind == Simd128BinopOp::Kind::kI8x16RelaxedSwizzle;
+  bool relaxed = binop.kind == Simd128BinopOp::Kind::kI8x16RelaxedSwizzle;
+  OpIndex left = binop.left();
+  OpIndex right = binop.right();
 
   if (relaxed) {
-    op |= MiscField::encode(true);
+    opcode |= MiscField::encode(true);
   } else {
     std::array<uint8_t, kSimd128Size> imms;
     if (MatchSimd128Constant(this, right, &imms)) {
       // If the indices vector is a const, check if they are in range, or if the
       // top bit is set, then we can avoid the paddusb in the codegen and simply
       // emit a pshufb.
-      op |= MiscField::encode(wasm::SimdSwizzle::AllInRangeOrTopBitSet(imms));
+      opcode |=
+          MiscField::encode(wasm::SimdSwizzle::AllInRangeOrTopBitSet(imms));
     }
   }
 
   X64OperandGeneratorT g(this);
-  Emit(op,
+  Emit(opcode,
        IsSupported(AVX) ? g.DefineAsRegister(node) : g.DefineSameAsFirst(node),
        g.UseRegister(left), g.UseRegister(right));
 }
@@ -5403,22 +5458,19 @@ namespace {
 void VisitRelaxedLaneSelect(InstructionSelectorT* selector, OpIndex node,
                             InstructionCode code) {
   X64OperandGeneratorT g(selector);
-  DCHECK_EQ(selector->value_input_count(node), 3);
+  const Operation& op = selector->Get(node);
+  DCHECK_EQ(op.input_count, 3);
   // pblendvb/blendvps/blendvpd copies src2 when mask is set, opposite from Wasm
   // semantics. Node's inputs are: mask, lhs, rhs (determined in
   // wasm-compiler.cc).
   if (selector->IsSupported(AVX)) {
-    selector->Emit(code, g.DefineAsRegister(node),
-                   g.UseRegister(selector->input_at(node, 2)),
-                   g.UseRegister(selector->input_at(node, 1)),
-                   g.UseRegister(selector->input_at(node, 0)));
+    selector->Emit(code, g.DefineAsRegister(node), g.UseRegister(op.input(2)),
+                   g.UseRegister(op.input(1)), g.UseRegister(op.input(0)));
   } else {
     // SSE4.1 pblendvb/blendvps/blendvpd requires xmm0 to hold the mask as an
     // implicit operand.
-    selector->Emit(code, g.DefineSameAsFirst(node),
-                   g.UseRegister(selector->input_at(node, 2)),
-                   g.UseRegister(selector->input_at(node, 1)),
-                   g.UseFixed(selector->input_at(node, 0), xmm0));
+    selector->Emit(code, g.DefineSameAsFirst(node), g.UseRegister(op.input(2)),
+                   g.UseRegister(op.input(1)), g.UseFixed(op.input(0), xmm0));
   }
 }
 }  // namespace
@@ -5464,39 +5516,42 @@ void InstructionSelectorT::VisitI64x4RelaxedLaneSelect(OpIndex node) {
 
 void InstructionSelectorT::VisitF16x8Pmin(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 2);
+  const Simd128BinopOp& op = Cast<Simd128BinopOp>(node);
+  DCHECK_EQ(op.input_count, 2);
   InstructionOperand dst = g.DefineAsRegister(node);
   InstructionCode instr_code = kX64Minph | VectorLengthField::encode(kV128);
   InstructionOperand temps[] = {g.TempSimd256Register(),
                                 g.TempSimd256Register()};
   size_t temp_count = arraysize(temps);
 
-  Emit(instr_code, dst, g.UseUniqueRegister(this->input_at(node, 1)),
-       g.UseUniqueRegister(this->input_at(node, 0)), temp_count, temps);
+  Emit(instr_code, dst, g.UseUniqueRegister(op.right()),
+       g.UseUniqueRegister(op.left()), temp_count, temps);
 }
 
 void InstructionSelectorT::VisitF16x8Pmax(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 2);
+  const Simd128BinopOp& op = Cast<Simd128BinopOp>(node);
+  DCHECK_EQ(op.input_count, 2);
   InstructionOperand dst = g.DefineAsRegister(node);
   InstructionCode instr_code = kX64Maxph | VectorLengthField::encode(kV128);
   InstructionOperand temps[] = {g.TempSimd256Register(),
                                 g.TempSimd256Register()};
   size_t temp_count = arraysize(temps);
 
-  Emit(instr_code, dst, g.UseUniqueRegister(this->input_at(node, 1)),
-       g.UseUniqueRegister(this->input_at(node, 0)), temp_count, temps);
+  Emit(instr_code, dst, g.UseUniqueRegister(op.right()),
+       g.UseUniqueRegister(op.left()), temp_count, temps);
 }
 
 void InstructionSelectorT::VisitF16x8DemoteF64x2Zero(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd128UnaryOp& op = Cast<Simd128UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   InstructionOperand temps[] = {g.TempRegister(), g.TempSimd128Register(),
                                 g.TempSimd128Register()};
   size_t temp_count = arraysize(temps);
 
   Emit(kX64F16x8DemoteF64x2Zero, g.DefineAsRegister(node),
-       g.UseUniqueRegister(this->input_at(node, 0)), temp_count, temps);
+       g.UseUniqueRegister(op.input()), temp_count, temps);
 }
 
 void InstructionSelectorT::VisitF32x4Pmin(OpIndex node) {
@@ -5549,236 +5604,280 @@ void InstructionSelectorT::VisitF64x2RelaxedMax(OpIndex node) {
 
 void InstructionSelectorT::VisitI32x4ExtAddPairwiseI16x8S(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd128UnaryOp& op = Cast<Simd128UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   InstructionOperand dst = CpuFeatures::IsSupported(AVX)
                                ? g.DefineAsRegister(node)
                                : g.DefineSameAsFirst(node);
-  Emit(kX64I32x4ExtAddPairwiseI16x8S, dst,
-       g.UseRegister(this->input_at(node, 0)));
+  Emit(kX64I32x4ExtAddPairwiseI16x8S, dst, g.UseRegister(op.input()));
 }
 
 void InstructionSelectorT::VisitI32x8ExtAddPairwiseI16x16S(OpIndex node) {
+#ifdef V8_ENABLE_WASM_SIMD256_REVEC
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd256UnaryOp& op = Cast<Simd256UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   Emit(kX64I32x8ExtAddPairwiseI16x16S, g.DefineAsRegister(node),
-       g.UseRegister(this->input_at(node, 0)));
+       g.UseRegister(op.input()));
+#else
+  UNREACHABLE();
+#endif
 }
 
 void InstructionSelectorT::VisitI32x4ExtAddPairwiseI16x8U(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd128UnaryOp& op = Cast<Simd128UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   InstructionOperand dst = CpuFeatures::IsSupported(AVX)
                                ? g.DefineAsRegister(node)
                                : g.DefineSameAsFirst(node);
-  Emit(kX64I32x4ExtAddPairwiseI16x8U, dst,
-       g.UseRegister(this->input_at(node, 0)));
+  Emit(kX64I32x4ExtAddPairwiseI16x8U, dst, g.UseRegister(op.input()));
 }
 
 void InstructionSelectorT::VisitI32x8ExtAddPairwiseI16x16U(OpIndex node) {
+#ifdef V8_ENABLE_WASM_SIMD256_REVEC
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd256UnaryOp& op = Cast<Simd256UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   Emit(kX64I32x8ExtAddPairwiseI16x16U, g.DefineAsRegister(node),
-       g.UseRegister(this->input_at(node, 0)));
+       g.UseRegister(op.input()));
+#else
+  UNREACHABLE();
+#endif
 }
 
 void InstructionSelectorT::VisitI16x8ExtAddPairwiseI8x16S(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd128UnaryOp& op = Cast<Simd128UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   // Codegen depends on dst != src.
   Emit(kX64I16x8ExtAddPairwiseI8x16S, g.DefineAsRegister(node),
-       g.UseUniqueRegister(this->input_at(node, 0)));
+       g.UseUniqueRegister(op.input()));
 }
 
 void InstructionSelectorT::VisitI16x16ExtAddPairwiseI8x32S(OpIndex node) {
+#ifdef V8_ENABLE_WASM_SIMD256_REVEC
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd256UnaryOp& op = Cast<Simd256UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   Emit(kX64I16x16ExtAddPairwiseI8x32S, g.DefineAsRegister(node),
-       g.UseUniqueRegister(this->input_at(node, 0)));
+       g.UseUniqueRegister(op.input()));
+#else
+  UNREACHABLE();
+#endif
 }
 
 void InstructionSelectorT::VisitI16x8ExtAddPairwiseI8x16U(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd128UnaryOp& op = Cast<Simd128UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   InstructionOperand dst = CpuFeatures::IsSupported(AVX)
                                ? g.DefineAsRegister(node)
                                : g.DefineSameAsFirst(node);
-  Emit(kX64I16x8ExtAddPairwiseI8x16U, dst,
-       g.UseRegister(this->input_at(node, 0)));
+  Emit(kX64I16x8ExtAddPairwiseI8x16U, dst, g.UseRegister(op.input()));
 }
 
 void InstructionSelectorT::VisitI16x16ExtAddPairwiseI8x32U(OpIndex node) {
-  DCHECK_EQ(this->value_input_count(node), 1);
+#ifdef V8_ENABLE_WASM_SIMD256_REVEC
+  const Simd256UnaryOp& op = Cast<Simd256UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   X64OperandGeneratorT g(this);
   Emit(kX64I16x16ExtAddPairwiseI8x32U, g.DefineAsRegister(node),
-       g.UseUniqueRegister(this->input_at(node, 0)));
+       g.UseUniqueRegister(op.input()));
+#else
+  UNREACHABLE();
+#endif
 }
 
 void InstructionSelectorT::VisitI8x16Popcnt(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd128UnaryOp& op = Cast<Simd128UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   InstructionOperand temps[] = {g.TempSimd128Register()};
   Emit(kX64I8x16Popcnt, g.DefineAsRegister(node),
-       g.UseUniqueRegister(this->input_at(node, 0)), arraysize(temps), temps);
+       g.UseUniqueRegister(op.input()), arraysize(temps), temps);
 }
 
 void InstructionSelectorT::VisitF64x2ConvertLowI32x4U(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd128UnaryOp& op = Cast<Simd128UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   InstructionOperand dst =
       IsSupported(AVX) ? g.DefineAsRegister(node) : g.DefineSameAsFirst(node);
-  Emit(kX64F64x2ConvertLowI32x4U, dst, g.UseRegister(this->input_at(node, 0)));
+  Emit(kX64F64x2ConvertLowI32x4U, dst, g.UseRegister(op.input()));
 }
 
 void InstructionSelectorT::VisitI32x4TruncSatF64x2SZero(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd128UnaryOp& op = Cast<Simd128UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   if (CpuFeatures::IsSupported(AVX)) {
     // Requires dst != src.
     Emit(kX64I32x4TruncSatF64x2SZero, g.DefineAsRegister(node),
-         g.UseUniqueRegister(this->input_at(node, 0)));
+         g.UseUniqueRegister(op.input()));
   } else {
     Emit(kX64I32x4TruncSatF64x2SZero, g.DefineSameAsFirst(node),
-         g.UseRegister(this->input_at(node, 0)));
+         g.UseRegister(op.input()));
   }
 }
 
 void InstructionSelectorT::VisitI32x4TruncSatF64x2UZero(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd128UnaryOp& op = Cast<Simd128UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   InstructionOperand dst = CpuFeatures::IsSupported(AVX)
                                ? g.DefineAsRegister(node)
                                : g.DefineSameAsFirst(node);
-  Emit(kX64I32x4TruncSatF64x2UZero, dst,
-       g.UseRegister(this->input_at(node, 0)));
+  Emit(kX64I32x4TruncSatF64x2UZero, dst, g.UseRegister(op.input()));
 }
 
 void InstructionSelectorT::VisitI32x4RelaxedTruncF64x2SZero(OpIndex node) {
-  DCHECK_EQ(this->value_input_count(node), 1);
-  VisitFloatUnop(this, node, this->input_at(node, 0), kX64Cvttpd2dq);
+  const Simd128UnaryOp& op = Cast<Simd128UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
+  VisitFloatUnop(this, node, op.input(), kX64Cvttpd2dq);
 }
 
 void InstructionSelectorT::VisitI32x4RelaxedTruncF64x2UZero(OpIndex node) {
-  DCHECK_EQ(this->value_input_count(node), 1);
-  VisitFloatUnop(this, node, this->input_at(node, 0), kX64I32x4TruncF64x2UZero);
+  const Simd128UnaryOp& op = Cast<Simd128UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
+  VisitFloatUnop(this, node, op.input(), kX64I32x4TruncF64x2UZero);
 }
 
 void InstructionSelectorT::VisitI32x4RelaxedTruncF32x4S(OpIndex node) {
-  DCHECK_EQ(this->value_input_count(node), 1);
-  VisitFloatUnop(this, node, this->input_at(node, 0), kX64Cvttps2dq);
+  const Simd128UnaryOp& op = Cast<Simd128UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
+  VisitFloatUnop(this, node, op.input(), kX64Cvttps2dq);
 }
 
 void InstructionSelectorT::VisitI32x4RelaxedTruncF32x4U(OpIndex node) {
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd128UnaryOp& op = Cast<Simd128UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   X64OperandGeneratorT g(this);
-  OpIndex input = this->input_at(node, 0);
   InstructionOperand temps[] = {g.TempSimd128Register()};
   if (IsSupported(AVX)) {
-    Emit(kX64I32x4TruncF32x4U, g.DefineAsRegister(node), g.UseRegister(input),
-         arraysize(temps), temps);
+    Emit(kX64I32x4TruncF32x4U, g.DefineAsRegister(node),
+         g.UseRegister(op.input()), arraysize(temps), temps);
   } else {
-    Emit(kX64I32x4TruncF32x4U, g.DefineSameAsFirst(node), g.UseRegister(input),
-         arraysize(temps), temps);
+    Emit(kX64I32x4TruncF32x4U, g.DefineSameAsFirst(node),
+         g.UseRegister(op.input()), arraysize(temps), temps);
   }
 }
 
 void InstructionSelectorT::VisitI32x8RelaxedTruncF32x8S(OpIndex node) {
-  DCHECK_EQ(this->value_input_count(node), 1);
-  VisitFloatUnop(this, node, this->input_at(node, 0),
+#ifdef V8_ENABLE_WASM_SIMD256_REVEC
+  const Simd256UnaryOp& op = Cast<Simd256UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
+  VisitFloatUnop(this, node, op.input(),
                  kX64Cvttps2dq | VectorLengthField::encode(kV256));
+#else
+  UNREACHABLE();
+#endif
 }
 
 void InstructionSelectorT::VisitI32x8RelaxedTruncF32x8U(OpIndex node) {
-  DCHECK_EQ(this->value_input_count(node), 1);
+#ifdef V8_ENABLE_WASM_SIMD256_REVEC
+  const Simd256UnaryOp& op = Cast<Simd256UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   DCHECK(CpuFeatures::IsSupported(AVX) && CpuFeatures::IsSupported(AVX2));
   X64OperandGeneratorT g(this);
-  OpIndex input = this->input_at(node, 0);
   InstructionOperand temps[] = {g.TempSimd256Register()};
-  Emit(kX64I32x8TruncF32x8U, g.DefineAsRegister(node), g.UseRegister(input),
-       arraysize(temps), temps);
+  Emit(kX64I32x8TruncF32x8U, g.DefineAsRegister(node),
+       g.UseRegister(op.input()), arraysize(temps), temps);
+#else
+  UNREACHABLE();
+#endif
 }
 
 void InstructionSelectorT::VisitI64x2GtS(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 2);
+  const Simd128BinopOp& op = Cast<Simd128BinopOp>(node);
+  DCHECK_EQ(op.input_count, 2);
   if (CpuFeatures::IsSupported(AVX)) {
     Emit(kX64IGtS | LaneSizeField::encode(kL64) |
              VectorLengthField::encode(kV128),
-         g.DefineAsRegister(node), g.UseRegister(this->input_at(node, 0)),
-         g.UseRegister(this->input_at(node, 1)));
+         g.DefineAsRegister(node), g.UseRegister(op.left()),
+         g.UseRegister(op.right()));
   } else if (CpuFeatures::IsSupported(SSE4_2)) {
     Emit(kX64IGtS | LaneSizeField::encode(kL64) |
              VectorLengthField::encode(kV128),
-         g.DefineSameAsFirst(node), g.UseRegister(this->input_at(node, 0)),
-         g.UseRegister(this->input_at(node, 1)));
+         g.DefineSameAsFirst(node), g.UseRegister(op.left()),
+         g.UseRegister(op.right()));
   } else {
     Emit(kX64IGtS | LaneSizeField::encode(kL64) |
              VectorLengthField::encode(kV128),
-         g.DefineAsRegister(node), g.UseUniqueRegister(this->input_at(node, 0)),
-         g.UseUniqueRegister(this->input_at(node, 1)));
+         g.DefineAsRegister(node), g.UseUniqueRegister(op.left()),
+         g.UseUniqueRegister(op.right()));
   }
 }
 
 void InstructionSelectorT::VisitI64x2GeS(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 2);
+  const Simd128BinopOp& op = Cast<Simd128BinopOp>(node);
+  DCHECK_EQ(op.input_count, 2);
   if (CpuFeatures::IsSupported(AVX)) {
     Emit(kX64IGeS | LaneSizeField::encode(kL64) |
              VectorLengthField::encode(kV128),
-         g.DefineAsRegister(node), g.UseRegister(this->input_at(node, 0)),
-         g.UseRegister(this->input_at(node, 1)));
+         g.DefineAsRegister(node), g.UseRegister(op.left()),
+         g.UseRegister(op.right()));
   } else if (CpuFeatures::IsSupported(SSE4_2)) {
     Emit(kX64IGeS | LaneSizeField::encode(kL64) |
              VectorLengthField::encode(kV128),
-         g.DefineAsRegister(node), g.UseUniqueRegister(this->input_at(node, 0)),
-         g.UseRegister(this->input_at(node, 1)));
+         g.DefineAsRegister(node), g.UseUniqueRegister(op.left()),
+         g.UseRegister(op.right()));
   } else {
     Emit(kX64IGeS | LaneSizeField::encode(kL64) |
              VectorLengthField::encode(kV128),
-         g.DefineAsRegister(node), g.UseUniqueRegister(this->input_at(node, 0)),
-         g.UseUniqueRegister(this->input_at(node, 1)));
+         g.DefineAsRegister(node), g.UseUniqueRegister(op.left()),
+         g.UseUniqueRegister(op.right()));
   }
 }
 
 void InstructionSelectorT::VisitI64x4GeS(OpIndex node) {
+#ifdef V8_ENABLE_WASM_SIMD256_REVEC
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 2);
+  const Simd256BinopOp& op = Cast<Simd256BinopOp>(node);
+  DCHECK_EQ(op.input_count, 2);
   DCHECK(CpuFeatures::IsSupported(AVX2));
   Emit(
       kX64IGeS | LaneSizeField::encode(kL64) | VectorLengthField::encode(kV256),
-      g.DefineAsRegister(node), g.UseRegister(this->input_at(node, 0)),
-      g.UseRegister(this->input_at(node, 1)));
+      g.DefineAsRegister(node), g.UseRegister(op.left()),
+      g.UseRegister(op.right()));
+#else
+  UNREACHABLE();
+#endif
 }
 
 void InstructionSelectorT::VisitI64x2Abs(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd128UnaryOp& op = Cast<Simd128UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   if (CpuFeatures::IsSupported(AVX)) {
     Emit(kX64IAbs | LaneSizeField::encode(kL64) |
              VectorLengthField::encode(kV128),
-         g.DefineAsRegister(node),
-         g.UseUniqueRegister(this->input_at(node, 0)));
+         g.DefineAsRegister(node), g.UseUniqueRegister(op.input()));
   } else {
     Emit(kX64IAbs | LaneSizeField::encode(kL64) |
              VectorLengthField::encode(kV128),
-         g.DefineSameAsFirst(node), g.UseRegister(this->input_at(node, 0)));
+         g.DefineSameAsFirst(node), g.UseRegister(op.input()));
   }
 }
 
 bool InstructionSelectorT::CanOptimizeF64x2PromoteLowF32x4(OpIndex node) {
-  DCHECK(this->Get(node).Is<Opmask::kSimd128F64x2PromoteLowF32x4>());
-  V<Simd128> input = this->input_at(node, 0);
-  return this->Get(input).template Is<Opmask::kSimd128LoadTransform64Zero>() &&
+  const Simd128UnaryOp& op = Cast<Opmask::kSimd128F64x2PromoteLowF32x4>(node);
+  V<Simd128> input = op.input();
+  return Is<Opmask::kSimd128LoadTransform64Zero>(input) &&
          CanCover(node, input);
 }
 
 void InstructionSelectorT::VisitF64x2PromoteLowF32x4(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
+  const Simd128UnaryOp& op = Cast<Simd128UnaryOp>(node);
+  DCHECK_EQ(op.input_count, 1);
   InstructionCode code = kX64F64x2PromoteLowF32x4;
   if (CanOptimizeF64x2PromoteLowF32x4(node)) {
-    V<Simd128> input = this->input_at(node, 0);
+    V<Simd128> input = op.input();
     const Simd128LoadTransformOp& load_transform =
-        this->Get(input).template Cast<Simd128LoadTransformOp>();
+        Cast<Simd128LoadTransformOp>(input);
     if (load_transform.load_kind.with_trap_handler) {
       code |= AccessModeField::encode(kMemoryAccessProtectedMemOutOfBounds);
     }
@@ -5794,60 +5893,59 @@ void InstructionSelectorT::VisitF64x2PromoteLowF32x4(OpIndex node) {
 
 void InstructionSelectorT::VisitI16x8DotI8x16I7x16S(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 2);
+  const Simd128BinopOp& op = Cast<Simd128BinopOp>(node);
+  DCHECK_EQ(op.input_count, 2);
   Emit(kX64I16x8DotI8x16I7x16S, g.DefineAsRegister(node),
-       g.UseUniqueRegister(this->input_at(node, 0)),
-       g.UseRegister(this->input_at(node, 1)));
+       g.UseUniqueRegister(op.left()), g.UseRegister(op.right()));
 }
 
 void InstructionSelectorT::VisitI32x4DotI8x16I7x16AddS(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 3);
+  const Simd128TernaryOp& op = Cast<Simd128TernaryOp>(node);
+  DCHECK_EQ(op.input_count, 3);
   if (CpuFeatures::IsSupported(AVX_VNNI)) {
     Emit(kX64I32x4DotI8x16I7x16AddS, g.DefineSameAsInput(node, 2),
-         g.UseRegister(this->input_at(node, 0)),
-         g.UseRegister(this->input_at(node, 1)),
-         g.UseRegister(this->input_at(node, 2)));
+         g.UseRegister(op.input(0)), g.UseRegister(op.input(1)),
+         g.UseRegister(op.input(2)));
   } else {
     InstructionOperand temps[] = {g.TempSimd128Register()};
     Emit(kX64I32x4DotI8x16I7x16AddS, g.DefineSameAsInput(node, 2),
-         g.UseUniqueRegister(this->input_at(node, 0)),
-         g.UseUniqueRegister(this->input_at(node, 1)),
-         g.UseUniqueRegister(this->input_at(node, 2)), arraysize(temps), temps);
+         g.UseUniqueRegister(op.input(0)), g.UseUniqueRegister(op.input(1)),
+         g.UseUniqueRegister(op.input(2)), arraysize(temps), temps);
   }
 }
 
 #ifdef V8_ENABLE_WASM_SIMD256_REVEC
 void InstructionSelectorT::VisitI16x16DotI8x32I7x32S(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 2);
+  const Simd256BinopOp& op = Cast<Simd256BinopOp>(node);
+  DCHECK_EQ(op.input_count, 2);
   Emit(kX64I16x16DotI8x32I7x32S, g.DefineAsRegister(node),
-       g.UseUniqueRegister(this->input_at(node, 0)),
-       g.UseRegister(this->input_at(node, 1)));
+       g.UseUniqueRegister(op.left()), g.UseRegister(op.right()));
 }
 
 void InstructionSelectorT::VisitI32x8DotI8x32I7x32AddS(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 3);
+  const Simd256TernaryOp& op = Cast<Simd256TernaryOp>(node);
+  DCHECK_EQ(op.input_count, 3);
   if (CpuFeatures::IsSupported(AVX_VNNI)) {
     Emit(kX64I32x8DotI8x32I7x32AddS, g.DefineSameAsInput(node, 2),
-         g.UseRegister(this->input_at(node, 0)),
-         g.UseRegister(this->input_at(node, 1)),
-         g.UseRegister(this->input_at(node, 2)));
+         g.UseRegister(op.input(0)), g.UseRegister(op.input(1)),
+         g.UseRegister(op.input(2)));
   } else {
     InstructionOperand temps[] = {g.TempSimd256Register()};
     Emit(kX64I32x8DotI8x32I7x32AddS, g.DefineSameAsInput(node, 2),
-         g.UseUniqueRegister(this->input_at(node, 0)),
-         g.UseUniqueRegister(this->input_at(node, 1)),
-         g.UseUniqueRegister(this->input_at(node, 2)), arraysize(temps), temps);
+         g.UseUniqueRegister(op.input(0)), g.UseUniqueRegister(op.input(1)),
+         g.UseUniqueRegister(op.input(2)), arraysize(temps), temps);
   }
 }
 #endif
 
 void InstructionSelectorT::VisitSetStackPointer(OpIndex node) {
   X64OperandGeneratorT g(this);
-  DCHECK_EQ(this->value_input_count(node), 1);
-  auto input = g.UseAny(this->input_at(node, 0));
+  const SetStackPointerOp& op = Cast<SetStackPointerOp>(node);
+  DCHECK_EQ(op.input_count, 1);
+  auto input = g.UseAny(op.value());
   Emit(kArchSetStackPointer, 0, nullptr, 1, &input);
 }
 
diff --git a/deps/v8/src/compiler/bytecode-graph-builder.cc b/deps/v8/src/compiler/bytecode-graph-builder.cc
index 2b4df09a6cd7c8..5e06c029c0048d 100644
--- a/deps/v8/src/compiler/bytecode-graph-builder.cc
+++ b/deps/v8/src/compiler/bytecode-graph-builder.cc
@@ -236,7 +236,7 @@ class BytecodeGraphBuilder {
   };
   void BuildNamedStore(NamedStoreMode store_mode);
   void BuildLdaLookupSlot(TypeofMode typeof_mode);
-  void BuildLdaLookupContextSlot(ContextKind context_kind,
+  void BuildLdaLookupContextSlot(ContextMode context_mode,
                                  TypeofMode typeof_mode);
   void BuildLdaLookupGlobalSlot(TypeofMode typeof_mode);
   void BuildCallVarArgs(ConvertReceiverMode receiver_mode);
@@ -1149,7 +1149,7 @@ void BytecodeGraphBuilder::CreateNativeContextNode() {
 }
 
 Node* BytecodeGraphBuilder::BuildLoadNativeContextField(int index) {
-  Node* result = NewNode(javascript()->LoadContext(0, index, true));
+  Node* result = NewNode(javascript()->LoadContextNoCell(0, index, true));
   NodeProperties::ReplaceContextInput(result, native_context_node());
   return result;
 }
@@ -1689,8 +1689,8 @@ void BytecodeGraphBuilder::VisitDefineKeyedOwnPropertyInLiteral() {
   environment()->RecordAfterState(node, Environment::kAttachFrameState);
 }
 
-void BytecodeGraphBuilder::VisitLdaContextSlot() {
-  const Operator* op = javascript()->LoadContext(
+void BytecodeGraphBuilder::VisitLdaContextSlotNoCell() {
+  const Operator* op = javascript()->LoadContextNoCell(
       bytecode_iterator().GetUnsignedImmediateOperand(2),
       bytecode_iterator().GetIndexOperand(1), false);
   Node* node = NewNode(op);
@@ -1700,8 +1700,8 @@ void BytecodeGraphBuilder::VisitLdaContextSlot() {
   environment()->BindAccumulator(node);
 }
 
-void BytecodeGraphBuilder::VisitLdaScriptContextSlot() {
-  const Operator* op = javascript()->LoadScriptContext(
+void BytecodeGraphBuilder::VisitLdaContextSlot() {
+  const Operator* op = javascript()->LoadContext(
       bytecode_iterator().GetUnsignedImmediateOperand(2),
       bytecode_iterator().GetIndexOperand(1));
   Node* node = NewNode(op);
@@ -1712,7 +1712,7 @@ void BytecodeGraphBuilder::VisitLdaScriptContextSlot() {
 }
 
 void BytecodeGraphBuilder::VisitLdaImmutableContextSlot() {
-  const Operator* op = javascript()->LoadContext(
+  const Operator* op = javascript()->LoadContextNoCell(
       bytecode_iterator().GetUnsignedImmediateOperand(2),
       bytecode_iterator().GetIndexOperand(1), true);
   Node* node = NewNode(op);
@@ -1722,29 +1722,29 @@ void BytecodeGraphBuilder::VisitLdaImmutableContextSlot() {
   environment()->BindAccumulator(node);
 }
 
-void BytecodeGraphBuilder::VisitLdaCurrentContextSlot() {
-  const Operator* op = javascript()->LoadContext(
+void BytecodeGraphBuilder::VisitLdaCurrentContextSlotNoCell() {
+  const Operator* op = javascript()->LoadContextNoCell(
       0, bytecode_iterator().GetIndexOperand(0), false);
   Node* node = NewNode(op);
   environment()->BindAccumulator(node);
 }
 
-void BytecodeGraphBuilder::VisitLdaCurrentScriptContextSlot() {
-  const Operator* op = javascript()->LoadScriptContext(
-      0, bytecode_iterator().GetIndexOperand(0));
+void BytecodeGraphBuilder::VisitLdaCurrentContextSlot() {
+  const Operator* op =
+      javascript()->LoadContext(0, bytecode_iterator().GetIndexOperand(0));
   Node* node = NewNode(op);
   environment()->BindAccumulator(node);
 }
 
 void BytecodeGraphBuilder::VisitLdaImmutableCurrentContextSlot() {
-  const Operator* op = javascript()->LoadContext(
+  const Operator* op = javascript()->LoadContextNoCell(
       0, bytecode_iterator().GetIndexOperand(0), true);
   Node* node = NewNode(op);
   environment()->BindAccumulator(node);
 }
 
-void BytecodeGraphBuilder::VisitStaContextSlot() {
-  const Operator* op = javascript()->StoreContext(
+void BytecodeGraphBuilder::VisitStaContextSlotNoCell() {
+  const Operator* op = javascript()->StoreContextNoCell(
       bytecode_iterator().GetUnsignedImmediateOperand(2),
       bytecode_iterator().GetIndexOperand(1));
   Node* value = environment()->LookupAccumulator();
@@ -1754,16 +1754,16 @@ void BytecodeGraphBuilder::VisitStaContextSlot() {
   NodeProperties::ReplaceContextInput(node, context);
 }
 
-void BytecodeGraphBuilder::VisitStaCurrentContextSlot() {
-  const Operator* op =
-      javascript()->StoreContext(0, bytecode_iterator().GetIndexOperand(0));
+void BytecodeGraphBuilder::VisitStaCurrentContextSlotNoCell() {
+  const Operator* op = javascript()->StoreContextNoCell(
+      0, bytecode_iterator().GetIndexOperand(0));
   Node* value = environment()->LookupAccumulator();
   NewNode(op, value);
 }
 
-void BytecodeGraphBuilder::VisitStaScriptContextSlot() {
+void BytecodeGraphBuilder::VisitStaContextSlot() {
   PrepareEagerCheckpoint();
-  const Operator* op = javascript()->StoreScriptContext(
+  const Operator* op = javascript()->StoreContext(
       bytecode_iterator().GetUnsignedImmediateOperand(2),
       bytecode_iterator().GetIndexOperand(1));
   Node* value = environment()->LookupAccumulator();
@@ -1773,10 +1773,10 @@ void BytecodeGraphBuilder::VisitStaScriptContextSlot() {
   NodeProperties::ReplaceContextInput(node, context);
 }
 
-void BytecodeGraphBuilder::VisitStaCurrentScriptContextSlot() {
+void BytecodeGraphBuilder::VisitStaCurrentContextSlot() {
   PrepareEagerCheckpoint();
-  const Operator* op = javascript()->StoreScriptContext(
-      0, bytecode_iterator().GetIndexOperand(0));
+  const Operator* op =
+      javascript()->StoreContext(0, bytecode_iterator().GetIndexOperand(0));
   Node* value = environment()->LookupAccumulator();
   NewNode(op, value);
 }
@@ -1805,7 +1805,7 @@ BytecodeGraphBuilder::Environment*
 BytecodeGraphBuilder::CheckContextExtensionAtDepth(
     Environment* slow_environment, uint32_t depth) {
   Node* extension_slot = NewNode(
-      javascript()->LoadContext(depth, Context::EXTENSION_INDEX, false));
+      javascript()->LoadContextNoCell(depth, Context::EXTENSION_INDEX, false));
   Node* check_no_extension =
       NewNode(simplified()->ReferenceEqual(), extension_slot,
               jsgraph()->UndefinedConstant());
@@ -1863,12 +1863,6 @@ BytecodeGraphBuilder::Environment* BytecodeGraphBuilder::CheckContextExtensions(
   // in the same scope as the variable itself has no way of shadowing it.
   Environment* slow_environment = nullptr;
   for (uint32_t d = 0; d < depth; d++) {
-    // Const tracking let data is stored in the extension slot of a
-    // ScriptContext - however, it's unrelated to the sloppy eval variable
-    // extension. We should never iterate through a ScriptContext here.
-    DCHECK_NE(scope_info.scope_type(), ScopeType::SCRIPT_SCOPE);
-    DCHECK_NE(scope_info.scope_type(), ScopeType::REPL_MODE_SCOPE);
-
     if (scope_info.HasContextExtensionSlot() &&
         !broker()->dependencies()->DependOnEmptyContextExtension(scope_info)) {
       // Using EmptyContextExtension dependency is not possible for this
@@ -1922,7 +1916,7 @@ BytecodeGraphBuilder::CheckContextExtensionsSlowPath(uint32_t depth) {
   return slow_environment;
 }
 
-void BytecodeGraphBuilder::BuildLdaLookupContextSlot(ContextKind context_kind,
+void BytecodeGraphBuilder::BuildLdaLookupContextSlot(ContextMode context_mode,
                                                      TypeofMode typeof_mode) {
   uint32_t depth = bytecode_iterator().GetUnsignedImmediateOperand(2);
 
@@ -1934,9 +1928,9 @@ void BytecodeGraphBuilder::BuildLdaLookupContextSlot(ContextKind context_kind,
     uint32_t slot_index = bytecode_iterator().GetIndexOperand(1);
 
     const Operator* op =
-        context_kind == ContextKind::kScriptContext
-            ? javascript()->LoadScriptContext(depth, slot_index)
-            : javascript()->LoadContext(depth, slot_index, false);
+        context_mode == ContextMode::kHasContextCells
+            ? javascript()->LoadContext(depth, slot_index)
+            : javascript()->LoadContextNoCell(depth, slot_index, false);
     environment()->BindAccumulator(NewNode(op));
   }
   if (!slow_environment) {
@@ -1969,21 +1963,22 @@ void BytecodeGraphBuilder::BuildLdaLookupContextSlot(ContextKind context_kind,
   mark_as_needing_eager_checkpoint(true);
 }
 
-void BytecodeGraphBuilder::VisitLdaLookupContextSlot() {
-  BuildLdaLookupContextSlot(ContextKind::kDefault, TypeofMode::kNotInside);
+void BytecodeGraphBuilder::VisitLdaLookupContextSlotNoCell() {
+  BuildLdaLookupContextSlot(ContextMode::kNoContextCells,
+                            TypeofMode::kNotInside);
 }
 
-void BytecodeGraphBuilder::VisitLdaLookupScriptContextSlot() {
-  BuildLdaLookupContextSlot(ContextKind::kScriptContext,
+void BytecodeGraphBuilder::VisitLdaLookupContextSlot() {
+  BuildLdaLookupContextSlot(ContextMode::kHasContextCells,
                             TypeofMode::kNotInside);
 }
 
-void BytecodeGraphBuilder::VisitLdaLookupContextSlotInsideTypeof() {
-  BuildLdaLookupContextSlot(ContextKind::kDefault, TypeofMode::kInside);
+void BytecodeGraphBuilder::VisitLdaLookupContextSlotNoCellInsideTypeof() {
+  BuildLdaLookupContextSlot(ContextMode::kNoContextCells, TypeofMode::kInside);
 }
 
-void BytecodeGraphBuilder::VisitLdaLookupScriptContextSlotInsideTypeof() {
-  BuildLdaLookupContextSlot(ContextKind::kScriptContext, TypeofMode::kInside);
+void BytecodeGraphBuilder::VisitLdaLookupContextSlotInsideTypeof() {
+  BuildLdaLookupContextSlot(ContextMode::kHasContextCells, TypeofMode::kInside);
 }
 
 void BytecodeGraphBuilder::BuildLdaLookupGlobalSlot(TypeofMode typeof_mode) {
@@ -2276,8 +2271,8 @@ void BytecodeGraphBuilder::VisitDefineKeyedOwnProperty() {
 void BytecodeGraphBuilder::VisitLdaModuleVariable() {
   int32_t cell_index = bytecode_iterator().GetImmediateOperand(0);
   uint32_t depth = bytecode_iterator().GetUnsignedImmediateOperand(1);
-  Node* module =
-      NewNode(javascript()->LoadContext(depth, Context::EXTENSION_INDEX, true));
+  Node* module = NewNode(
+      javascript()->LoadContextNoCell(depth, Context::EXTENSION_INDEX, true));
   Node* value = NewNode(javascript()->LoadModule(cell_index), module);
   environment()->BindAccumulator(value);
 }
@@ -2285,8 +2280,8 @@ void BytecodeGraphBuilder::VisitLdaModuleVariable() {
 void BytecodeGraphBuilder::VisitStaModuleVariable() {
   int32_t cell_index = bytecode_iterator().GetImmediateOperand(0);
   uint32_t depth = bytecode_iterator().GetUnsignedImmediateOperand(1);
-  Node* module =
-      NewNode(javascript()->LoadContext(depth, Context::EXTENSION_INDEX, true));
+  Node* module = NewNode(
+      javascript()->LoadContextNoCell(depth, Context::EXTENSION_INDEX, true));
   Node* value = environment()->LookupAccumulator();
   NewNode(javascript()->StoreModule(cell_index), module, value);
 }
@@ -3166,6 +3161,21 @@ void BytecodeGraphBuilder::VisitAdd() {
   BuildBinaryOp(javascript()->Add(feedback));
 }
 
+void BytecodeGraphBuilder::VisitAdd_LhsIsStringConstant_Internalize() {
+  Node* left =
+      environment()->LookupRegister(bytecode_iterator().GetRegisterOperand(0));
+  Node* right = environment()->LookupAccumulator();
+  Node* slot = jsgraph()->SmiConstant(
+      bytecode_iterator().GetSlotOperand(kBinaryOperationHintIndex).ToInt());
+
+  // Lowered by js-intrinsic-lowering to call a builtin.
+  const Operator* op = javascript()->CallRuntime(
+      Runtime::kInlineAddLhsIsStringConstantInternalize);
+  Node* node = NewNode(op, left, right, slot, feedback_vector_node());
+
+  environment()->BindAccumulator(node, Environment::kAttachFrameState);
+}
+
 void BytecodeGraphBuilder::VisitSub() {
   FeedbackSource feedback = CreateFeedbackSource(
       bytecode_iterator().GetSlotOperand(kBinaryOperationHintIndex));
@@ -3998,7 +4008,7 @@ void BytecodeGraphBuilder::VisitSwitchOnGeneratorState() {
     environment()->BindGeneratorState(generator_state);
 
     Node* generator_context =
-        NewNode(javascript()->GeneratorRestoreContext(), generator);
+        NewNode(javascript()->GeneratorRestoreContextNoCell(), generator);
     environment()->SetContext(generator_context);
 
     BuildSwitchOnGeneratorState(bytecode_analysis().resume_jump_targets(),
diff --git a/deps/v8/src/compiler/code-assembler.cc b/deps/v8/src/compiler/code-assembler.cc
index 37990f85ecf8c8..c60a846de83a35 100644
--- a/deps/v8/src/compiler/code-assembler.cc
+++ b/deps/v8/src/compiler/code-assembler.cc
@@ -714,6 +714,10 @@ void CodeAssembler::SetStackPointer(TNode<RawPtrT> ptr) {
 }
 #endif
 
+TNode<Object> CodeAssembler::LoadTaggedFromRootRegister(TNode<IntPtrT> offset) {
+  return BitcastWordToTagged(LoadPointerFromRootRegister(offset));
+}
+
 TNode<RawPtrT> CodeAssembler::LoadPointerFromRootRegister(
     TNode<IntPtrT> offset) {
   return UncheckedCast<RawPtrT>(
diff --git a/deps/v8/src/compiler/code-assembler.h b/deps/v8/src/compiler/code-assembler.h
index 589b35b4b8420f..fe560593ab469b 100644
--- a/deps/v8/src/compiler/code-assembler.h
+++ b/deps/v8/src/compiler/code-assembler.h
@@ -855,6 +855,7 @@ class V8_EXPORT_PRIVATE CodeAssembler {
   void SetStackPointer(TNode<RawPtrT> ptr);
 #endif  // V8_ENABLE_WEBASSEMBLY
 
+  TNode<Object> LoadTaggedFromRootRegister(TNode<IntPtrT> offset);
   TNode<RawPtrT> LoadPointerFromRootRegister(TNode<IntPtrT> offset);
   TNode<Uint8T> LoadUint8FromRootRegister(TNode<IntPtrT> offset);
 
@@ -1380,6 +1381,13 @@ class V8_EXPORT_PRIVATE CodeAssembler {
   void TailCallBuiltin(Builtin id, TNode<Object> context, TArgs... args) {
     DCHECK_WITH_MSG(!Builtins::HasJSLinkage(id),
                     "Use TailCallJSBuiltin instead");
+#if V8_ENABLE_WEBASSEMBLY
+    // Tail calling from a wasm builtin to a non-wasm builtin is not supported
+    // because of stack switching. Use a call instead so that we switch to the
+    // central stack and back if needed.
+    DCHECK(!wasm::BuiltinLookup::IsWasmBuiltinId(builtin()) ||
+           wasm::BuiltinLookup::IsWasmBuiltinId(id));
+#endif
     Callable callable = Builtins::CallableFor(isolate(), id);
     TNode<Code> target = HeapConstantNoHole(callable.code());
     TailCallStub(callable.descriptor(), target, context, args...);
@@ -1433,6 +1441,12 @@ class V8_EXPORT_PRIVATE CodeAssembler {
     DCHECK(Builtins::HasJSLinkage(builtin));
     // The receiver is also passed on the stack so needs to be included.
     DCHECK_EQ(Builtins::GetStackParameterCount(builtin), 1 + sizeof...(args));
+#if V8_ENABLE_WEBASSEMBLY
+    // Unimplemented. Add code for switching to the central stack here if
+    // needed. See {CallBuiltin} for example.
+    DCHECK(!wasm::BuiltinLookup::IsWasmBuiltinId(this->builtin()) ||
+           wasm::BuiltinLookup::IsWasmBuiltinId(builtin));
+#endif
     Callable callable = Builtins::CallableFor(isolate(), builtin);
     int argc = JSParameterCount(static_cast<int>(sizeof...(args)));
     TNode<Int32T> arity = Int32Constant(argc);
@@ -1451,6 +1465,13 @@ class V8_EXPORT_PRIVATE CodeAssembler {
                          TNode<Int32T> arg_count,
                          TNode<JSDispatchHandleT> dispatch_handle) {
     DCHECK(Builtins::HasJSLinkage(id));
+#if V8_ENABLE_WEBASSEMBLY
+    // Tail calling from a wasm builtin to a JS builtin is not supported because
+    // of stack switching. Use a call instead so that we switch to the central
+    // stack and back if needed.
+    DCHECK(!wasm::BuiltinLookup::IsWasmBuiltinId(builtin()) ||
+           wasm::BuiltinLookup::IsWasmBuiltinId(id));
+#endif
     Callable callable = Builtins::CallableFor(isolate(), id);
     TNode<Code> target = HeapConstantNoHole(callable.code());
 #ifdef V8_JS_LINKAGE_INCLUDES_DISPATCH_HANDLE
@@ -1468,6 +1489,12 @@ class V8_EXPORT_PRIVATE CodeAssembler {
                       TNode<Object> function, TNode<JSAny> receiver,
                       TArgs... args) {
     DCHECK(Builtins::IsAnyCall(builtin));
+#if V8_ENABLE_WEBASSEMBLY
+    // Unimplemented. Add code for switching to the central stack here if
+    // needed. See {CallBuiltin} for example.
+    DCHECK(!wasm::BuiltinLookup::IsWasmBuiltinId(this->builtin()) ||
+           wasm::BuiltinLookup::IsWasmBuiltinId(builtin));
+#endif
     Callable callable = Builtins::CallableFor(isolate(), builtin);
     int argc = JSParameterCount(static_cast<int>(sizeof...(args)));
     TNode<Int32T> arity = Int32Constant(argc);
diff --git a/deps/v8/src/compiler/compilation-dependencies.cc b/deps/v8/src/compiler/compilation-dependencies.cc
index f6ecd1f49c8fcc..83a2c9f9568c92 100644
--- a/deps/v8/src/compiler/compilation-dependencies.cc
+++ b/deps/v8/src/compiler/compilation-dependencies.cc
@@ -12,6 +12,7 @@
 #include "src/handles/handles-inl.h"
 #include "src/heap/heap-layout-inl.h"
 #include "src/objects/allocation-site-inl.h"
+#include "src/objects/contexts.h"
 #include "src/objects/internal-index.h"
 #include "src/objects/js-array-inl.h"
 #include "src/objects/js-function-inl.h"
@@ -41,7 +42,7 @@ namespace compiler {
   V(PretenureMode)                      \
   V(Protector)                          \
   V(PrototypeProperty)                  \
-  V(ScriptContextSlotProperty)          \
+  V(ContextCell)                        \
   V(StableMap)                          \
   V(Transition)                         \
   V(ObjectSlotValue)
@@ -254,7 +255,9 @@ class PrototypePropertyDependency final : public CompilationDependency {
   void PrepareInstall(JSHeapBroker* broker) const override {
     SLOW_DCHECK(IsValid(broker));
     DirectHandle<JSFunction> function = function_.object();
-    if (!function->has_initial_map()) JSFunction::EnsureHasInitialMap(function);
+    if (!function->has_initial_map()) {
+      JSFunction::EnsureHasInitialMap(broker->isolate(), function);
+    }
   }
 
   void Install(JSHeapBroker* broker, PendingDependencies* deps) const override {
@@ -906,50 +909,35 @@ class GlobalPropertyDependency final : public CompilationDependency {
   const bool read_only_;
 };
 
-class ScriptContextSlotPropertyDependency final : public CompilationDependency {
+class ContextCellDependency final : public CompilationDependency {
  public:
-  ScriptContextSlotPropertyDependency(
-      ContextRef script_context, size_t index,
-      ContextSidePropertyCell::Property property)
-      : CompilationDependency(kScriptContextSlotProperty),
-        script_context_(script_context),
-        index_(index),
-        property_(property) {
-    DCHECK(v8_flags.script_context_mutable_heap_number ||
-           v8_flags.const_tracking_let);
+  ContextCellDependency(ContextCellRef slot, ContextCell::State state)
+      : CompilationDependency(kContextCell), slot_(slot), state_(state) {
+    DCHECK(v8_flags.script_context_cells);
   }
 
   bool IsValid(JSHeapBroker* broker) const override {
-    return script_context_.object()->GetScriptContextSideProperty(index_) ==
-           property_;
+    return slot_.state() == state_;
   }
 
   void Install(JSHeapBroker* broker, PendingDependencies* deps) const override {
     SLOW_DCHECK(IsValid(broker));
-    Isolate* isolate = broker->isolate();
-    deps->Register(
-        handle(Context::GetOrCreateContextSidePropertyCell(
-                   script_context_.object(), index_, property_, isolate),
-               isolate),
-        DependentCode::kScriptContextSlotPropertyChangedGroup);
+    deps->Register(slot_.object(), DependentCode::kContextCellChangedGroup);
   }
 
  private:
   size_t Hash() const override {
     ObjectRef::Hash h;
-    return base::hash_combine(h(script_context_), index_);
+    return base::hash_combine(h(slot_), state_);
   }
 
   bool Equals(const CompilationDependency* that) const override {
-    const ScriptContextSlotPropertyDependency* const zat =
-        that->AsScriptContextSlotProperty();
-    return script_context_.equals(zat->script_context_) &&
-           index_ == zat->index_ && property_ == zat->property_;
+    const ContextCellDependency* const zat = that->AsContextCell();
+    return slot_.equals(zat->slot_) && state_ == zat->state_;
   }
 
-  const ContextRef script_context_;
-  size_t index_;
-  ContextSidePropertyCell::Property property_;
+  const ContextCellRef slot_;
+  const ContextCell::State state_;
 };
 
 class EmptyContextExtensionDependency final : public CompilationDependency {
@@ -1184,7 +1172,8 @@ class InitialMapInstanceSizePredictionDependency final
 
   void PrepareInstall(JSHeapBroker* broker) const override {
     SLOW_DCHECK(IsValid(broker));
-    function_.object()->CompleteInobjectSlackTrackingIfActive();
+    function_.object()->CompleteInobjectSlackTrackingIfActive(
+        broker->isolate());
   }
 
   void Install(JSHeapBroker* broker, PendingDependencies* deps) const override {
@@ -1302,19 +1291,25 @@ void CompilationDependencies::DependOnGlobalProperty(PropertyCellRef cell) {
   RecordDependency(zone_->New<GlobalPropertyDependency>(cell, type, read_only));
 }
 
-bool CompilationDependencies::DependOnScriptContextSlotProperty(
-    ContextRef script_context, size_t index,
-    ContextSidePropertyCell::Property property, JSHeapBroker* broker) {
-  if ((v8_flags.const_tracking_let ||
-       v8_flags.script_context_mutable_heap_number) &&
-      script_context.object()->IsScriptContext() &&
-      script_context.object()->GetScriptContextSideProperty(index) ==
-          property) {
-    RecordDependency(zone_->New<ScriptContextSlotPropertyDependency>(
-        script_context, index, property));
-    return true;
+bool CompilationDependencies::DependOnContextCell(ContextRef script_context,
+                                                  size_t index,
+                                                  ContextCell::State state,
+                                                  JSHeapBroker* broker) {
+  if (!script_context.object()->HasContextCells()) return false;
+  auto value = script_context.get(broker, static_cast<int>(index));
+  if (!value || !value->IsContextCell()) {
+    return false;
   }
-  return false;
+  auto slot = value->AsContextCell();
+  RecordDependency(zone_->New<ContextCellDependency>(slot, state));
+  return true;
+}
+
+bool CompilationDependencies::DependOnContextCell(ContextCellRef slot,
+                                                  ContextCell::State state) {
+  DCHECK(v8_flags.script_context_cells);
+  RecordDependency(zone_->New<ContextCellDependency>(slot, state));
+  return true;
 }
 
 bool CompilationDependencies::DependOnEmptyContextExtension(
diff --git a/deps/v8/src/compiler/compilation-dependencies.h b/deps/v8/src/compiler/compilation-dependencies.h
index 13d1cb86d5fcd0..86854173720ba7 100644
--- a/deps/v8/src/compiler/compilation-dependencies.h
+++ b/deps/v8/src/compiler/compilation-dependencies.h
@@ -6,6 +6,7 @@
 #define V8_COMPILER_COMPILATION_DEPENDENCIES_H_
 
 #include "src/compiler/js-heap-broker.h"
+#include "src/objects/contexts.h"
 #include "src/objects/property-cell.h"
 #include "src/zone/zone-containers.h"
 
@@ -86,9 +87,9 @@ class V8_EXPORT CompilationDependencies : public ZoneObject {
   void DependOnGlobalProperty(PropertyCellRef cell);
 
   // Record a property assumption in the script context slot.
-  bool DependOnScriptContextSlotProperty(
-      ContextRef script_context, size_t index,
-      ContextSidePropertyCell::Property property, JSHeapBroker* broker);
+  bool DependOnContextCell(ContextRef script_context, size_t index,
+                           ContextCell::State state, JSHeapBroker* broker);
+  bool DependOnContextCell(ContextCellRef slot, ContextCell::State state);
 
   // Record the assumption that respective contexts do not have context
   // extension, if true.
diff --git a/deps/v8/src/compiler/frame-states.h b/deps/v8/src/compiler/frame-states.h
index db1e99f82b4fe2..53e16c3e3b4243 100644
--- a/deps/v8/src/compiler/frame-states.h
+++ b/deps/v8/src/compiler/frame-states.h
@@ -110,6 +110,10 @@ class FrameStateFunctionInfo {
 
   int local_count() const { return local_count_; }
   uint16_t parameter_count() const { return parameter_count_; }
+  uint16_t parameter_count_without_receiver() const {
+    DCHECK_GT(parameter_count_, 0);
+    return parameter_count_ - 1;
+  }
   uint16_t max_arguments() const { return max_arguments_; }
   IndirectHandle<SharedFunctionInfo> shared_info() const {
     return shared_info_;
@@ -194,13 +198,20 @@ class FrameStateInfo final {
                             : info_->bytecode_array();
   }
   uint16_t parameter_count() const {
-    return info_ == nullptr ? 0 : info_->parameter_count();
+    DCHECK_NOT_NULL(info_);
+    return info_->parameter_count();
+  }
+  uint16_t parameter_count_without_receiver() const {
+    DCHECK_NOT_NULL(info_);
+    return info_->parameter_count_without_receiver();
   }
   uint16_t max_arguments() const {
-    return info_ == nullptr ? 0 : info_->max_arguments();
+    DCHECK_NOT_NULL(info_);
+    return info_->max_arguments();
   }
   int local_count() const {
-    return info_ == nullptr ? 0 : info_->local_count();
+    DCHECK_NOT_NULL(info_);
+    return info_->local_count();
   }
   int stack_count() const {
     return type() == FrameStateType::kUnoptimizedFunction ? 1 : 0;
diff --git a/deps/v8/src/compiler/frame.cc b/deps/v8/src/compiler/frame.cc
index 7dc7a87ad654cc..3681201761187e 100644
--- a/deps/v8/src/compiler/frame.cc
+++ b/deps/v8/src/compiler/frame.cc
@@ -46,10 +46,6 @@ void FrameAccessState::MarkHasFrame(bool state) {
   SetFrameAccessToDefault();
 }
 
-void FrameAccessState::SetFPRelativeOnly(bool state) {
-  fp_relative_only_ = state;
-}
-
 void FrameAccessState::SetFrameAccessToDefault() {
   if (has_frame()) {
     SetFrameAccessToFP();
diff --git a/deps/v8/src/compiler/frame.h b/deps/v8/src/compiler/frame.h
index 6786698f6da660..3e008816c84795 100644
--- a/deps/v8/src/compiler/frame.h
+++ b/deps/v8/src/compiler/frame.h
@@ -187,6 +187,9 @@ class V8_EXPORT_PRIVATE Frame : public ZoneObject {
 
   const GrowableBitVector& tagged_slots() const { return tagged_slots_bits_; }
 
+  bool invalidates_sp() const { return invalidates_sp_; }
+  void set_invalidates_sp() { invalidates_sp_ = true; }
+
  private:
   int fixed_slot_count_;
   int spill_slot_count_ = 0;
@@ -198,6 +201,7 @@ class V8_EXPORT_PRIVATE Frame : public ZoneObject {
   BitVector* allocated_double_registers_;
   Zone* zone_;
   GrowableBitVector tagged_slots_bits_;
+  bool invalidates_sp_ = false;
 #if DEBUG
   bool spill_slots_finished_ = false;
   bool frame_aligned_ = false;
@@ -237,14 +241,11 @@ class FrameAccessState : public ZoneObject {
   explicit FrameAccessState(const Frame* const frame)
       : frame_(frame),
         access_frame_with_fp_(false),
-        fp_relative_only_(false),
         sp_delta_(0),
         has_frame_(false) {}
 
   const Frame* frame() const { return frame_; }
   V8_EXPORT_PRIVATE void MarkHasFrame(bool state);
-  void SetFPRelativeOnly(bool state);
-  bool FPRelativeOnly() { return fp_relative_only_; }
 
   int sp_delta() const { return sp_delta_; }
   void ClearSPDelta() { sp_delta_ = 0; }
@@ -279,7 +280,6 @@ class FrameAccessState : public ZoneObject {
  private:
   const Frame* const frame_;
   bool access_frame_with_fp_;
-  bool fp_relative_only_;
   int sp_delta_;
   bool has_frame_;
 };
diff --git a/deps/v8/src/compiler/graph-assembler.cc b/deps/v8/src/compiler/graph-assembler.cc
index cb7ea59c71cb08..31cabc8d57fa35 100644
--- a/deps/v8/src/compiler/graph-assembler.cc
+++ b/deps/v8/src/compiler/graph-assembler.cc
@@ -17,6 +17,7 @@
 #include "src/compiler/linkage.h"
 #include "src/compiler/type-cache.h"
 // For TNode types.
+#include "src/compiler/allocation-builder-inl.h"
 #include "src/deoptimizer/deoptimize-reason.h"
 #include "src/objects/elements-kind.h"
 #include "src/objects/heap-number.h"
@@ -154,6 +155,16 @@ Node* GraphAssembler::SetStackPointer(Node* node) {
 }
 #endif
 
+TNode<HeapNumber> JSGraphAssembler::AllocateHeapNumber(Node* value) {
+  AllocationBuilder a(jsgraph(), broker(), effect(), control());
+  a.Allocate(sizeof(HeapNumber), AllocationType::kYoung, Type::OtherInternal());
+  a.Store(AccessBuilder::ForMap(), broker()->heap_number_map());
+  a.Store(AccessBuilder::ForHeapNumberValue(), value);
+  Node* new_heap_number = a.Finish();
+  UpdateEffectControlWith(new_heap_number);
+  return TNode<HeapNumber>::UncheckedCast(new_heap_number);
+}
+
 Node* GraphAssembler::LoadHeapNumberValue(Node* heap_number) {
   return Load(MachineType::Float64(), heap_number,
               IntPtrConstant(offsetof(HeapNumber, value_) - kHeapObjectTag));
diff --git a/deps/v8/src/compiler/graph-assembler.h b/deps/v8/src/compiler/graph-assembler.h
index 467ca07dc2177f..61dd6947628c80 100644
--- a/deps/v8/src/compiler/graph-assembler.h
+++ b/deps/v8/src/compiler/graph-assembler.h
@@ -142,6 +142,7 @@ class Reducer;
   V(FixedArrayMap, Map)                                            \
   V(FixedDoubleArrayMap, Map)                                      \
   V(WeakFixedArrayMap, Map)                                        \
+  V(ContextCellMap, Map)                                           \
   V(HeapNumberMap, Map)                                            \
   V(MinusOne, Number)                                              \
   V(NaN, Number)                                                   \
@@ -983,6 +984,8 @@ class V8_EXPORT_PRIVATE JSGraphAssembler : public GraphAssembler {
 #undef SINGLETON_CONST_TEST_DECL
 
   Node* Allocate(AllocationType allocation, Node* size);
+  TNode<HeapNumber> AllocateHeapNumber(Node* value);
+
   TNode<Map> LoadMap(TNode<HeapObject> object);
   Node* LoadField(FieldAccess const&, Node* object);
   template <typename T>
@@ -1245,9 +1248,10 @@ class V8_EXPORT_PRIVATE JSGraphAssembler : public GraphAssembler {
   // separate classes. If, in the future, we encounter additional use cases that
   // return more than 1 value, we should merge these back into a single variadic
   // implementation.
+  template <typename Cond>
   class IfBuilder0 final {
    public:
-    IfBuilder0(JSGraphAssembler* gasm, TNode<Boolean> cond, bool negate_cond)
+    IfBuilder0(JSGraphAssembler* gasm, TNode<Cond> cond, bool negate_cond)
         : gasm_(gasm),
           cond_(cond),
           negate_cond_(negate_cond),
@@ -1291,7 +1295,16 @@ class V8_EXPORT_PRIVATE JSGraphAssembler : public GraphAssembler {
       auto if_false = (hint_ == BranchHint::kTrue) ? gasm_->MakeDeferredLabel()
                                                    : gasm_->MakeLabel();
       auto merge = gasm_->MakeLabel();
-      gasm_->Branch(cond_, &if_true, &if_false);
+      if constexpr (std::is_same_v<Cond, Word32T>) {
+        gasm_->MachineBranch(cond_, &if_true, &if_false, hint_);
+      } else {
+        static_assert(std::is_same_v<Cond, Boolean>);
+        if (hint_ != BranchHint::kNone) {
+          gasm_->BranchWithHint(cond_, &if_true, &if_false, hint_);
+        } else {
+          gasm_->Branch(cond_, &if_true, &if_false);
+        }
+      }
 
       gasm_->Bind(&if_true);
       if (then_body_) then_body_();
@@ -1309,7 +1322,7 @@ class V8_EXPORT_PRIVATE JSGraphAssembler : public GraphAssembler {
 
    private:
     JSGraphAssembler* const gasm_;
-    const TNode<Boolean> cond_;
+    const TNode<Cond> cond_;
     const bool negate_cond_;
     const Effect initial_effect_;
     const Control initial_control_;
@@ -1318,8 +1331,12 @@ class V8_EXPORT_PRIVATE JSGraphAssembler : public GraphAssembler {
     VoidGenerator0 else_body_;
   };
 
-  IfBuilder0 If(TNode<Boolean> cond) { return {this, cond, false}; }
-  IfBuilder0 IfNot(TNode<Boolean> cond) { return {this, cond, true}; }
+  IfBuilder0<Boolean> If(TNode<Boolean> cond) { return {this, cond, false}; }
+  IfBuilder0<Boolean> IfNot(TNode<Boolean> cond) { return {this, cond, true}; }
+
+  IfBuilder0<Word32T> MachineIf(TNode<Word32T> cond) {
+    return {this, cond, false};
+  }
 
   template <typename T, typename Cond>
   class IfBuilder1 {
diff --git a/deps/v8/src/compiler/heap-refs.cc b/deps/v8/src/compiler/heap-refs.cc
index 7a470132d7fcbd..3edb331de27f15 100644
--- a/deps/v8/src/compiler/heap-refs.cc
+++ b/deps/v8/src/compiler/heap-refs.cc
@@ -1002,28 +1002,7 @@ OptionalObjectRef ContextRef::get(JSHeapBroker* broker, int index) const {
   CHECK_LE(0, index);
   // Length is immutable after initialization.
   if (index >= object()->length(kRelaxedLoad)) return {};
-  return TryMakeRef(broker, object()->get(index));
-}
-
-OptionalObjectRef ContextRef::TryGetSideData(JSHeapBroker* broker,
-                                             int index) const {
-  if (!object()->IsScriptContext()) {
-    return {};
-  }
-
-  // No side data for slots which are not variables in the context.
-  if (index < Context::MIN_CONTEXT_EXTENDED_SLOTS) {
-    return {};
-  }
-
-  OptionalObjectRef maybe_side_data =
-      get(broker, Context::CONTEXT_SIDE_TABLE_PROPERTY_INDEX);
-  if (!maybe_side_data.has_value()) return {};
-  // The FixedArray itself will stay constant, but its contents may change while
-  // we compile in the background.
-  FixedArrayRef side_data_fixed_array = maybe_side_data.value().AsFixedArray();
-  return side_data_fixed_array.TryGet(
-      broker, index - Context::MIN_CONTEXT_EXTENDED_SLOTS);
+  return TryMakeRef(broker, object()->get(index, kRelaxedLoad));
 }
 
 void JSHeapBroker::InitializeAndStartSerializing(
@@ -1039,8 +1018,6 @@ void JSHeapBroker::InitializeAndStartSerializing(
   refs_ =
       zone()->New<RefsMap>(kInitialRefsBucketCount, AddressMatcher(), zone());
 
-  CollectArrayAndObjectPrototypes();
-
   SetTargetNativeContextRef(target_native_context);
 }
 
@@ -1163,9 +1140,16 @@ bool MapRef::IsBooleanMap(JSHeapBroker* broker) const {
 }
 
 bool MapRef::IsThinStringMap() const {
+  // The check below only works for string maps.
+  DCHECK(IsStringMap());
   return InstanceTypeChecker::IsThinString(instance_type());
 }
 
+bool MapRef::IsStringWrapperMap() const {
+  return IsJSPrimitiveWrapperMap() &&
+         IsStringWrapperElementsKind(elements_kind());
+}
+
 bool MapRef::IsTwoByteStringMap() const {
   return InstanceTypeChecker::IsTwoByteString(instance_type());
 }
@@ -1599,6 +1583,12 @@ uint64_t HeapNumberRef::value_as_bits() const {
   return object()->value_as_bits();
 }
 
+HEAP_ACCESSOR_C(ContextCell, ContextCell::State, state)
+
+OptionalObjectRef ContextCellRef::tagged_value(JSHeapBroker* broker) const {
+  return TryMakeRef(broker, object()->tagged_value());
+}
+
 JSReceiverRef JSBoundFunctionRef::bound_target_function(
     JSHeapBroker* broker) const {
   // Immutable after initialization.
@@ -1819,8 +1809,7 @@ bool JSTypedArrayRef::is_on_heap() const {
 }
 
 size_t JSTypedArrayRef::length() const {
-  CHECK(!is_on_heap());
-  // Immutable after initialization.
+  // Immutable after initialization (since this is not used for RAB/GSAB).
   return object()->length();
 }
 
@@ -1911,7 +1900,7 @@ MapRef NativeContextRef::GetFunctionMapFromIndex(JSHeapBroker* broker,
   DCHECK_LE(index, Context::LAST_FUNCTION_MAP_INDEX);
   CHECK_LT(index, object()->length());
   return MakeRefAssumeMemoryFence(
-      broker, Cast<Map>(object()->get(index, kAcquireLoad)));
+      broker, Cast<Map>(object()->GetNoCell(index, kAcquireLoad)));
 }
 
 MapRef NativeContextRef::GetInitialJSArrayMap(JSHeapBroker* broker,
@@ -2444,6 +2433,16 @@ ScopeInfoRef SharedFunctionInfoRef::scope_info(JSHeapBroker* broker) const {
   return MakeRefAssumeMemoryFence(broker, object()->scope_info(kAcquireLoad));
 }
 
+int SharedFunctionInfoRef::
+    internal_formal_parameter_count_with_receiver_deprecated() const {
+  return object()->internal_formal_parameter_count_with_receiver();
+}
+
+int SharedFunctionInfoRef::
+    internal_formal_parameter_count_without_receiver_deprecated() const {
+  return object()->internal_formal_parameter_count_without_receiver();
+}
+
 OptionalMapRef JSObjectRef::GetObjectCreateMap(JSHeapBroker* broker) const {
   DirectHandle<Map> map_handle = Cast<Map>(map(broker).object());
   // Note: implemented as an acquire-load.
diff --git a/deps/v8/src/compiler/heap-refs.h b/deps/v8/src/compiler/heap-refs.h
index cdf57451546e98..219ff7d6b2c7ff 100644
--- a/deps/v8/src/compiler/heap-refs.h
+++ b/deps/v8/src/compiler/heap-refs.h
@@ -137,6 +137,7 @@ enum class RefSerializationKind {
   BACKGROUND_SERIALIZED(FixedArrayBase)                                       \
   NEVER_SERIALIZED(FunctionTemplateInfo)                                      \
   NEVER_SERIALIZED(HeapNumber)                                                \
+  NEVER_SERIALIZED(ContextCell)                                               \
   BACKGROUND_SERIALIZED(JSReceiver)                                           \
   BACKGROUND_SERIALIZED(Map)                                                  \
   NEVER_SERIALIZED(Name)                                                      \
@@ -700,6 +701,16 @@ class HeapNumberRef : public HeapObjectRef {
   uint64_t value_as_bits() const;
 };
 
+class ContextCellRef : public HeapObjectRef {
+ public:
+  DEFINE_REF_CONSTRUCTOR(ContextCell, HeapObjectRef)
+
+  IndirectHandle<ContextCell> object() const;
+
+  ContextCell::State state() const;
+  OptionalObjectRef tagged_value(JSHeapBroker* broker) const;
+};
+
 class ContextRef : public HeapObjectRef {
  public:
   DEFINE_REF_CONSTRUCTOR(Context, HeapObjectRef)
@@ -715,9 +726,6 @@ class ContextRef : public HeapObjectRef {
   OptionalObjectRef get(JSHeapBroker* broker, int index) const;
 
   ScopeInfoRef scope_info(JSHeapBroker* broker) const;
-
-  // Only returns a value if the index is valid for this ContextRef.
-  OptionalObjectRef TryGetSideData(JSHeapBroker* broker, int index) const;
 };
 
 #define BROKER_NATIVE_CONTEXT_FIELDS(V)          \
@@ -904,6 +912,7 @@ class V8_EXPORT_PRIVATE MapRef : public HeapObjectRef {
   bool is_abandoned_prototype_map() const;
   bool IsTwoByteStringMap() const;
   bool IsThinStringMap() const;
+  bool IsStringWrapperMap() const;
 
   OddballType oddball_type(JSHeapBroker* broker) const;
 
@@ -1098,9 +1107,6 @@ class ScopeInfoRef : public HeapObjectRef {
 };
 
 #define BROKER_SFI_FIELDS(V)                               \
-  V(int, internal_formal_parameter_count_with_receiver)    \
-  V(int, internal_formal_parameter_count_without_receiver) \
-  V(bool, IsDontAdaptArguments)                            \
   V(bool, has_simple_parameters)                           \
   V(bool, has_duplicate_parameters)                        \
   V(int, function_map_index)                               \
@@ -1132,6 +1138,13 @@ class V8_EXPORT_PRIVATE SharedFunctionInfoRef : public HeapObjectRef {
       JSHeapBroker* broker) const;
   ScopeInfoRef scope_info(JSHeapBroker* broker) const;
 
+  // TODO(370343328): The compiler should not rely on the parameter count
+  // stored on the SFI but instead use the parameter count from the
+  // BytecodeArray or JSDispatchTable. Once remaining uses of the field are
+  // gone, these accessors should probably be removed.
+  int internal_formal_parameter_count_with_receiver_deprecated() const;
+  int internal_formal_parameter_count_without_receiver_deprecated() const;
+
 #define DECL_ACCESSOR(type, name) type name() const;
   BROKER_SFI_FIELDS(DECL_ACCESSOR)
 #undef DECL_ACCESSOR
@@ -1193,6 +1206,11 @@ class JSTypedArrayRef : public JSObjectRef {
   ElementsKind elements_kind(JSHeapBroker* broker) const;
   void* data_ptr() const;
   HeapObjectRef buffer(JSHeapBroker* broker) const;
+
+  bool is_off_heap_non_rab_gsab(JSHeapBroker* broker) const {
+    return !is_on_heap() &&
+           !IsRabGsabTypedArrayElementsKind(elements_kind(broker));
+  }
 };
 
 class JSPrimitiveWrapperRef : public JSObjectRef {
diff --git a/deps/v8/src/compiler/js-call-reducer.cc b/deps/v8/src/compiler/js-call-reducer.cc
index 0577f9cafeeee7..63024398e711ad 100644
--- a/deps/v8/src/compiler/js-call-reducer.cc
+++ b/deps/v8/src/compiler/js-call-reducer.cc
@@ -575,8 +575,8 @@ class PromiseBuiltinReducerAssembler : public JSCallReducerAssembler {
         outer_context, effect(), control()));
   }
 
-  void StoreContextSlot(TNode<Context> context, size_t slot_index,
-                        TNode<Object> value) {
+  void StoreContextNoCellSlot(TNode<Context> context, size_t slot_index,
+                              TNode<Object> value) {
     StoreField(AccessBuilder::ForContextSlot(slot_index), context, value);
   }
 
@@ -2354,7 +2354,8 @@ FrameState PromiseConstructorFrameState(
     const PromiseCtorFrameStateParams& params, CommonOperatorBuilder* common,
     TFGraph* graph) {
   DCHECK_EQ(1,
-            params.shared.internal_formal_parameter_count_without_receiver());
+            params.shared
+                .internal_formal_parameter_count_without_receiver_deprecated());
   return CreateConstructInvokeStubFrameState(
       params.node_ptr, params.outer_frame_state, params.shared, params.context,
       common, graph);
@@ -2440,11 +2441,12 @@ TNode<Object> PromiseBuiltinReducerAssembler::ReducePromiseConstructor(
   // Allocate a promise context for the closures below.
   TNode<Context> promise_context = CreateFunctionContext(
       native_context, context, PromiseBuiltins::kPromiseContextLength);
-  StoreContextSlot(promise_context, PromiseBuiltins::kPromiseSlot, promise);
-  StoreContextSlot(promise_context, PromiseBuiltins::kAlreadyResolvedSlot,
-                   FalseConstant());
-  StoreContextSlot(promise_context, PromiseBuiltins::kDebugEventSlot,
-                   TrueConstant());
+  StoreContextNoCellSlot(promise_context, PromiseBuiltins::kPromiseSlot,
+                         promise);
+  StoreContextNoCellSlot(promise_context, PromiseBuiltins::kAlreadyResolvedSlot,
+                         FalseConstant());
+  StoreContextNoCellSlot(promise_context, PromiseBuiltins::kDebugEventSlot,
+                         TrueConstant());
 
   // Allocate closures for the resolve and reject cases.
   SharedFunctionInfoRef resolve_sfi =
@@ -4324,7 +4326,7 @@ JSCallReducer::ReduceCallOrConstructWithArrayLikeOrSpreadOfCreateArguments(
     }
     formal_parameter_count =
         MakeRef(broker(), shared)
-            .internal_formal_parameter_count_without_receiver();
+            .internal_formal_parameter_count_without_receiver_deprecated();
   }
 
   if (type == CreateArgumentsType::kMappedArguments) {
@@ -4465,7 +4467,6 @@ Reduction JSCallReducer::ReduceCallOrConstructWithArrayLikeOrSpread(
   }
 
   DCHECK_EQ(arguments_list->opcode(), IrOpcode::kJSCreateLiteralArray);
-  int new_argument_count;
 
   // Find array length and elements' kind from the feedback's allocation
   // site's boilerplate JSArray.
@@ -4482,13 +4483,15 @@ Reduction JSCallReducer::ReduceCallOrConstructWithArrayLikeOrSpread(
   JSArrayRef boilerplate_array = site.boilerplate(broker())->AsJSArray();
   int const array_length =
       boilerplate_array.GetBoilerplateLength(broker()).AsSmi();
+  SBXCHECK_GE(array_length, 0);
 
   // We'll replace the arguments_list input with {array_length} element loads.
-  new_argument_count = argument_count - 1 + array_length;
+  uint32_t new_argument_count =
+      static_cast<uint32_t>(array_length) + argument_count - 1;
 
   // Do not optimize calls with a large number of arguments.
   // Arbitrarily sets the limit to 32 arguments.
-  const int kMaxArityForOptimizedFunctionApply = 32;
+  const uint32_t kMaxArityForOptimizedFunctionApply = 32;
   if (new_argument_count > kMaxArityForOptimizedFunctionApply) {
     return NoChange();
   }
@@ -4544,10 +4547,10 @@ Reduction JSCallReducer::ReduceCallOrConstructWithArrayLikeOrSpread(
   }
 
   NodeProperties::ChangeOp(
-      node,
-      javascript()->Call(JSCallNode::ArityForArgc(new_argument_count),
-                         frequency, feedback_source, ConvertReceiverMode::kAny,
-                         speculation_mode, CallFeedbackRelation::kUnrelated));
+      node, javascript()->Call(
+                JSCallNode::ArityForArgc(static_cast<int>(new_argument_count)),
+                frequency, feedback_source, ConvertReceiverMode::kAny,
+                speculation_mode, CallFeedbackRelation::kUnrelated));
   NodeProperties::ReplaceEffectInput(node, effect);
   return Changed(node).FollowedBy(ReduceJSCall(node));
 }
diff --git a/deps/v8/src/compiler/js-context-specialization.cc b/deps/v8/src/compiler/js-context-specialization.cc
index 14531adaeb678e..e29d35199db466 100644
--- a/deps/v8/src/compiler/js-context-specialization.cc
+++ b/deps/v8/src/compiler/js-context-specialization.cc
@@ -18,6 +18,7 @@
 #include "src/compiler/simplified-operator.h"
 #include "src/deoptimizer/deoptimize-reason.h"
 #include "src/objects/contexts-inl.h"
+#include "src/objects/contexts.h"
 #include "src/objects/property-cell.h"
 
 namespace v8 {
@@ -28,14 +29,14 @@ Reduction JSContextSpecialization::Reduce(Node* node) {
   switch (node->opcode()) {
     case IrOpcode::kParameter:
       return ReduceParameter(node);
+    case IrOpcode::kJSLoadContextNoCell:
+      return ReduceJSLoadContextNoCell(node);
     case IrOpcode::kJSLoadContext:
       return ReduceJSLoadContext(node);
-    case IrOpcode::kJSLoadScriptContext:
-      return ReduceJSLoadScriptContext(node);
+    case IrOpcode::kJSStoreContextNoCell:
+      return ReduceJSStoreContextNoCell(node);
     case IrOpcode::kJSStoreContext:
       return ReduceJSStoreContext(node);
-    case IrOpcode::kJSStoreScriptContext:
-      return ReduceJSStoreScriptContext(node);
     case IrOpcode::kJSGetImportMeta:
       return ReduceJSGetImportMeta(node);
     default:
@@ -59,10 +60,9 @@ Reduction JSContextSpecialization::ReduceParameter(Node* node) {
   return NoChange();
 }
 
-Reduction JSContextSpecialization::SimplifyJSLoadContext(Node* node,
-                                                         Node* new_context,
-                                                         size_t new_depth) {
-  DCHECK_EQ(IrOpcode::kJSLoadContext, node->opcode());
+Reduction JSContextSpecialization::SimplifyJSLoadContextNoCell(
+    Node* node, Node* new_context, size_t new_depth) {
+  DCHECK_EQ(IrOpcode::kJSLoadContextNoCell, node->opcode());
   const ContextAccess& access = ContextAccessOf(node->op());
   DCHECK_LE(new_depth, access.depth());
 
@@ -71,16 +71,17 @@ Reduction JSContextSpecialization::SimplifyJSLoadContext(Node* node,
     return NoChange();
   }
 
-  const Operator* op = jsgraph_->javascript()->LoadContext(
+  const Operator* op = jsgraph_->javascript()->LoadContextNoCell(
       new_depth, access.index(), access.immutable());
   NodeProperties::ReplaceContextInput(node, new_context);
   NodeProperties::ChangeOp(node, op);
   return Changed(node);
 }
 
-Reduction JSContextSpecialization::SimplifyJSLoadScriptContext(
-    Node* node, Node* new_context, size_t new_depth) {
-  DCHECK_EQ(IrOpcode::kJSLoadScriptContext, node->opcode());
+Reduction JSContextSpecialization::SimplifyJSLoadContext(Node* node,
+                                                         Node* new_context,
+                                                         size_t new_depth) {
+  DCHECK_EQ(IrOpcode::kJSLoadContext, node->opcode());
   const ContextAccess& access = ContextAccessOf(node->op());
   DCHECK_LE(new_depth, access.depth());
 
@@ -90,16 +91,15 @@ Reduction JSContextSpecialization::SimplifyJSLoadScriptContext(
   }
 
   const Operator* op =
-      jsgraph_->javascript()->LoadScriptContext(new_depth, access.index());
+      jsgraph_->javascript()->LoadContext(new_depth, access.index());
   NodeProperties::ReplaceContextInput(node, new_context);
   NodeProperties::ChangeOp(node, op);
   return Changed(node);
 }
 
-Reduction JSContextSpecialization::SimplifyJSStoreContext(Node* node,
-                                                          Node* new_context,
-                                                          size_t new_depth) {
-  DCHECK_EQ(IrOpcode::kJSStoreContext, node->opcode());
+Reduction JSContextSpecialization::SimplifyJSStoreContextNoCell(
+    Node* node, Node* new_context, size_t new_depth) {
+  DCHECK_EQ(IrOpcode::kJSStoreContextNoCell, node->opcode());
   const ContextAccess& access = ContextAccessOf(node->op());
   DCHECK_LE(new_depth, access.depth());
 
@@ -109,15 +109,16 @@ Reduction JSContextSpecialization::SimplifyJSStoreContext(Node* node,
   }
 
   const Operator* op =
-      jsgraph_->javascript()->StoreContext(new_depth, access.index());
+      jsgraph_->javascript()->StoreContextNoCell(new_depth, access.index());
   NodeProperties::ReplaceContextInput(node, new_context);
   NodeProperties::ChangeOp(node, op);
   return Changed(node);
 }
 
-Reduction JSContextSpecialization::SimplifyJSStoreScriptContext(
-    Node* node, Node* new_context, size_t new_depth) {
-  DCHECK_EQ(IrOpcode::kJSStoreScriptContext, node->opcode());
+Reduction JSContextSpecialization::SimplifyJSStoreContext(Node* node,
+                                                          Node* new_context,
+                                                          size_t new_depth) {
+  DCHECK_EQ(IrOpcode::kJSStoreContext, node->opcode());
   const ContextAccess& access = ContextAccessOf(node->op());
   DCHECK_LE(new_depth, access.depth());
 
@@ -127,7 +128,7 @@ Reduction JSContextSpecialization::SimplifyJSStoreScriptContext(
   }
 
   const Operator* op =
-      jsgraph_->javascript()->StoreScriptContext(new_depth, access.index());
+      jsgraph_->javascript()->StoreContext(new_depth, access.index());
   NodeProperties::ReplaceContextInput(node, new_context);
   NodeProperties::ChangeOp(node, op);
   return Changed(node);
@@ -181,8 +182,8 @@ OptionalContextRef GetSpecializationContext(JSHeapBroker* broker, Node* node,
 
 }  // anonymous namespace
 
-Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSLoadContext, node->opcode());
+Reduction JSContextSpecialization::ReduceJSLoadContextNoCell(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSLoadContextNoCell, node->opcode());
 
   const ContextAccess& access = ContextAccessOf(node->op());
   size_t depth = access.depth();
@@ -195,7 +196,7 @@ Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
   if (!maybe_concrete.has_value()) {
     // We do not have a concrete context object, so we can only partially reduce
     // the load by folding-in the outer context node.
-    return SimplifyJSLoadContext(node, context, depth);
+    return SimplifyJSLoadContextNoCell(node, context, depth);
   }
 
   // Now walk up the concrete context chain for the remaining depth.
@@ -203,17 +204,16 @@ Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
   concrete = concrete.previous(broker(), &depth);
   if (depth > 0) {
     TRACE_BROKER_MISSING(broker(), "previous value for context " << concrete);
-    return SimplifyJSLoadContext(
+    return SimplifyJSLoadContextNoCell(
         node, jsgraph()->ConstantNoHole(concrete, broker()), depth);
   }
 
   if (!access.immutable() &&
-      !broker()->dependencies()->DependOnScriptContextSlotProperty(
-          concrete, access.index(), ContextSidePropertyCell::kConst,
-          broker())) {
+      !broker()->dependencies()->DependOnContextCell(
+          concrete, access.index(), ContextCell::kConst, broker())) {
     // We found the requested context object but since the context slot is
     // mutable we can only partially reduce the load.
-    return SimplifyJSLoadContext(
+    return SimplifyJSLoadContextNoCell(
         node, jsgraph()->ConstantNoHole(concrete, broker()), depth);
   }
 
@@ -225,7 +225,7 @@ Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
     TRACE_BROKER_MISSING(broker(), "slot value " << access.index()
                                                  << " for context "
                                                  << concrete);
-    return SimplifyJSLoadContext(
+    return SimplifyJSLoadContextNoCell(
         node, jsgraph()->ConstantNoHole(concrete, broker()), depth);
   }
 
@@ -235,7 +235,7 @@ Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
   // the hole or undefined. Only if it is neither of these, can we be sure
   // that it won't change anymore.
   if (maybe_value->IsUndefined() || maybe_value->IsTheHole()) {
-    return SimplifyJSLoadContext(
+    return SimplifyJSLoadContextNoCell(
         node, jsgraph()->ConstantNoHole(concrete, broker()), depth);
   }
 
@@ -245,8 +245,8 @@ Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
   return Replace(constant);
 }
 
-Reduction JSContextSpecialization::ReduceJSLoadScriptContext(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSLoadScriptContext, node->opcode());
+Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSLoadContext, node->opcode());
 
   const ContextAccess& access = ContextAccessOf(node->op());
   DCHECK(!access.immutable());
@@ -262,7 +262,7 @@ Reduction JSContextSpecialization::ReduceJSLoadScriptContext(Node* node) {
   if (!maybe_concrete.has_value()) {
     // We do not have a concrete context object, so we can only partially reduce
     // the load by folding-in the outer context node.
-    return SimplifyJSLoadScriptContext(node, context, depth);
+    return SimplifyJSLoadContext(node, context, depth);
   }
 
   // Now walk up the concrete context chain for the remaining depth.
@@ -270,98 +270,69 @@ Reduction JSContextSpecialization::ReduceJSLoadScriptContext(Node* node) {
   concrete = concrete.previous(broker(), &depth);
   if (depth > 0) {
     TRACE_BROKER_MISSING(broker(), "previous value for context " << concrete);
-    return SimplifyJSLoadScriptContext(
+    return SimplifyJSLoadContext(
         node, jsgraph()->ConstantNoHole(concrete, broker()), depth);
   }
 
-  DCHECK(concrete.object()->IsScriptContext());
-  auto maybe_property =
-      concrete.object()->GetScriptContextSideProperty(access.index());
-  if (!maybe_property) {
-    return SimplifyJSLoadScriptContext(
+  auto maybe_value = concrete.get(broker(), static_cast<int>(access.index()));
+  if (!maybe_value || maybe_value->IsTheHole()) {
+    return SimplifyJSLoadContext(
         node, jsgraph()->ConstantNoHole(concrete, broker()), depth);
   }
-  auto property = maybe_property.value();
-  switch (property) {
-    case ContextSidePropertyCell::kConst: {
-      OptionalObjectRef maybe_value =
-          concrete.get(broker(), static_cast<int>(access.index()));
-      if (!maybe_value.has_value()) {
-        TRACE_BROKER_MISSING(broker(), "slot value " << access.index()
-                                                     << " for context "
-                                                     << concrete);
-        return SimplifyJSLoadScriptContext(
+  if (!maybe_value->IsContextCell()) {
+    // Do a normal context load.
+    Node* load = effect = jsgraph_->graph()->NewNode(
+        jsgraph_->simplified()->LoadField(
+            AccessBuilder::ForContextSlot(access.index())),
+        jsgraph_->ConstantNoHole(concrete, broker()), effect, control);
+    ReplaceWithValue(node, load, effect, control);
+    return Changed(node);
+  }
+  DCHECK(concrete.object()->HasContextCells());
+
+  compiler::ContextCellRef slot_ref = maybe_value->AsContextCell();
+  // TODO(victorgomes): Make DependOnContextCell return the state instead.
+  ContextCell::State state = slot_ref.state();
+  switch (state) {
+    case ContextCell::kConst: {
+      auto constant = slot_ref.tagged_value(broker());
+      if (!constant.has_value()) {
+        return SimplifyJSLoadContext(
             node, jsgraph()->ConstantNoHole(concrete, broker()), depth);
       }
-      broker()->dependencies()->DependOnScriptContextSlotProperty(
-          concrete, access.index(), property, broker());
-      Node* constant = jsgraph_->ConstantNoHole(*maybe_value, broker());
-      ReplaceWithValue(node, constant, effect, control);
+      broker()->dependencies()->DependOnContextCell(slot_ref, state);
+      ReplaceWithValue(node, jsgraph_->ConstantNoHole(*constant, broker()),
+                       effect, control);
       return Changed(node);
     }
-    case ContextSidePropertyCell::kSmi: {
-      broker()->dependencies()->DependOnScriptContextSlotProperty(
-          concrete, access.index(), property, broker());
+    case ContextCell::kSmi: {
+      broker()->dependencies()->DependOnContextCell(slot_ref, state);
       Node* load = effect = jsgraph_->graph()->NewNode(
           jsgraph_->simplified()->LoadField(
-              AccessBuilder::ForContextSlotSmi(access.index())),
-          jsgraph_->ConstantNoHole(concrete, broker()), effect, control);
+              AccessBuilder::ForContextCellTaggedValue()),
+          jsgraph_->ConstantNoHole(slot_ref, broker()), effect, control);
       ReplaceWithValue(node, load, effect, control);
       return Changed(node);
     }
-    case ContextSidePropertyCell::kMutableInt32: {
-      Node* mutable_heap_number;
-      if (auto concrete_heap_number =
-              concrete.get(broker(), static_cast<int>(access.index()))) {
-        if (!concrete_heap_number->IsHeapNumber()) {
-          // TODO(victorgomes): In case the tag is out of date by now we could
-          // retry this reduction.
-          return NoChange();
-        }
-        mutable_heap_number = jsgraph_->ConstantMutableHeapNumber(
-            concrete_heap_number->AsHeapNumber(), broker());
-      } else {
-        mutable_heap_number = effect = jsgraph_->graph()->NewNode(
-            jsgraph_->simplified()->LoadField(
-                AccessBuilder::ForContextSlot(access.index())),
-            jsgraph_->ConstantNoHole(concrete, broker()), effect, control);
-      }
-      broker()->dependencies()->DependOnScriptContextSlotProperty(
-          concrete, access.index(), property, broker());
+    case ContextCell::kInt32: {
+      broker()->dependencies()->DependOnContextCell(slot_ref, state);
       Node* int32_load = effect = jsgraph_->graph()->NewNode(
-          jsgraph_->simplified()->LoadField(AccessBuilder::ForHeapInt32Value()),
-          mutable_heap_number, effect, control);
+          jsgraph_->simplified()->LoadField(
+              AccessBuilder::ForContextCellInt32Value()),
+          jsgraph_->ConstantNoHole(slot_ref, broker()), effect, control);
       ReplaceWithValue(node, int32_load, effect, control);
       return Changed(node);
     }
-    case ContextSidePropertyCell::kMutableHeapNumber: {
-      Node* mutable_heap_number;
-      if (auto concrete_heap_number =
-              concrete.get(broker(), static_cast<int>(access.index()))) {
-        if (!concrete_heap_number->IsHeapNumber()) {
-          // TODO(victorgomes): In case the tag is out of date by now we could
-          // retry this reduction.
-          return NoChange();
-        }
-        mutable_heap_number = jsgraph_->ConstantMutableHeapNumber(
-            concrete_heap_number->AsHeapNumber(), broker());
-      } else {
-        mutable_heap_number = effect = jsgraph_->graph()->NewNode(
-            jsgraph_->simplified()->LoadField(
-                AccessBuilder::ForContextSlot(access.index())),
-            jsgraph_->ConstantNoHole(concrete, broker()), effect, control);
-      }
-      broker()->dependencies()->DependOnScriptContextSlotProperty(
-          concrete, access.index(), property, broker());
-      Node* double_load = effect =
-          jsgraph_->graph()->NewNode(jsgraph_->simplified()->LoadField(
-                                         AccessBuilder::ForHeapNumberValue()),
-                                     mutable_heap_number, effect, control);
+    case ContextCell::kFloat64: {
+      broker()->dependencies()->DependOnContextCell(slot_ref, state);
+      Node* double_load = effect = jsgraph_->graph()->NewNode(
+          jsgraph_->simplified()->LoadField(
+              AccessBuilder::ForContextCellFloat64Value()),
+          jsgraph_->ConstantNoHole(slot_ref, broker()), effect, control);
       ReplaceWithValue(node, double_load, effect, control);
       return Changed(node);
     }
-    case ContextSidePropertyCell::kOther: {
-      // Do a normal context load.
+    case ContextCell::kDetached: {
       Node* load = effect = jsgraph_->graph()->NewNode(
           jsgraph_->simplified()->LoadField(
               AccessBuilder::ForContextSlot(access.index())),
@@ -369,13 +340,12 @@ Reduction JSContextSpecialization::ReduceJSLoadScriptContext(Node* node) {
       ReplaceWithValue(node, load, effect, control);
       return Changed(node);
     }
-    default:
-      UNREACHABLE();
   }
+  UNREACHABLE();
 }
 
-Reduction JSContextSpecialization::ReduceJSStoreContext(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSStoreContext, node->opcode());
+Reduction JSContextSpecialization::ReduceJSStoreContextNoCell(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSStoreContextNoCell, node->opcode());
 
   const ContextAccess& access = ContextAccessOf(node->op());
   size_t depth = access.depth();
@@ -389,7 +359,7 @@ Reduction JSContextSpecialization::ReduceJSStoreContext(Node* node) {
   if (!maybe_concrete.has_value()) {
     // We do not have a concrete context object, so we can only partially reduce
     // the load by folding-in the outer context node.
-    return SimplifyJSStoreContext(node, context, depth);
+    return SimplifyJSStoreContextNoCell(node, context, depth);
   }
 
   // Now walk up the concrete context chain for the remaining depth.
@@ -397,18 +367,17 @@ Reduction JSContextSpecialization::ReduceJSStoreContext(Node* node) {
   concrete = concrete.previous(broker(), &depth);
   if (depth > 0) {
     TRACE_BROKER_MISSING(broker(), "previous value for context " << concrete);
-    return SimplifyJSStoreContext(
+    return SimplifyJSStoreContextNoCell(
         node, jsgraph()->ConstantNoHole(concrete, broker()), depth);
   }
 
-  return SimplifyJSStoreContext(
+  return SimplifyJSStoreContextNoCell(
       node, jsgraph()->ConstantNoHole(concrete, broker()), depth);
 }
 
-Reduction JSContextSpecialization::ReduceJSStoreScriptContext(Node* node) {
-  DCHECK(v8_flags.script_context_mutable_heap_number ||
-         v8_flags.const_tracking_let);
-  DCHECK_EQ(IrOpcode::kJSStoreScriptContext, node->opcode());
+Reduction JSContextSpecialization::ReduceJSStoreContext(Node* node) {
+  DCHECK(v8_flags.script_context_cells);
+  DCHECK_EQ(IrOpcode::kJSStoreContext, node->opcode());
 
   const ContextAccess& access = ContextAccessOf(node->op());
   size_t depth = access.depth();
@@ -425,7 +394,7 @@ Reduction JSContextSpecialization::ReduceJSStoreScriptContext(Node* node) {
   if (!maybe_concrete.has_value()) {
     // We do not have a concrete context object, so we can only partially reduce
     // the load by folding-in the outer context node.
-    return SimplifyJSStoreScriptContext(node, context, depth);
+    return SimplifyJSStoreContext(node, context, depth);
   }
 
   // Now walk up the concrete context chain for the remaining depth.
@@ -433,34 +402,16 @@ Reduction JSContextSpecialization::ReduceJSStoreScriptContext(Node* node) {
   concrete = concrete.previous(broker(), &depth);
   if (depth > 0) {
     TRACE_BROKER_MISSING(broker(), "previous value for context " << concrete);
-    return SimplifyJSStoreScriptContext(
+    return SimplifyJSStoreContext(
         node, jsgraph()->ConstantNoHole(concrete, broker()), depth);
   }
-  DCHECK(concrete.object()->IsScriptContext());
-  auto maybe_property =
-      concrete.object()->GetScriptContextSideProperty(access.index());
-  if (!maybe_property) {
-    return SimplifyJSStoreScriptContext(
+
+  auto maybe_value = concrete.get(broker(), static_cast<int>(access.index()));
+  if (!maybe_value || maybe_value->IsTheHole()) {
+    return SimplifyJSStoreContext(
         node, jsgraph()->ConstantNoHole(concrete, broker()), depth);
   }
-  auto property = maybe_property.value();
-  PropertyAccessBuilder access_builder(jsgraph(), broker());
-  if (property == ContextSidePropertyCell::kConst) {
-    compiler::OptionalObjectRef constant =
-        concrete.get(broker(), static_cast<int>(access.index()));
-    if (!constant.has_value() ||
-        (constant->IsString() && !constant->IsInternalizedString())) {
-      return SimplifyJSStoreScriptContext(
-          node, jsgraph()->ConstantNoHole(concrete, broker()), depth);
-    }
-    broker()->dependencies()->DependOnScriptContextSlotProperty(
-        concrete, access.index(), property, broker());
-    access_builder.BuildCheckValue(value, &effect, control, *constant);
-    ReplaceWithValue(node, effect, effect, control);
-    return Changed(node);
-  }
-
-  if (!v8_flags.script_context_mutable_heap_number) {
+  if (!maybe_value->IsContextCell()) {
     // Do a normal context store.
     Node* store = jsgraph()->graph()->NewNode(
         jsgraph()->simplified()->StoreField(
@@ -469,80 +420,61 @@ Reduction JSContextSpecialization::ReduceJSStoreScriptContext(Node* node) {
     ReplaceWithValue(node, store, store, control);
     return Changed(node);
   }
+  DCHECK(concrete.object()->HasContextCells());
+
+  compiler::ContextCellRef slot_ref = maybe_value->AsContextCell();
+  PropertyAccessBuilder access_builder(jsgraph(), broker());
 
-  switch (property) {
-    case ContextSidePropertyCell::kConst:
-      UNREACHABLE();
-    case ContextSidePropertyCell::kSmi: {
-      broker()->dependencies()->DependOnScriptContextSlotProperty(
-          concrete, access.index(), property, broker());
+  ContextCell::State state = slot_ref.state();
+  switch (state) {
+    case ContextCell::kConst: {
+      auto constant = slot_ref.tagged_value(broker());
+      if (!constant.has_value() ||
+          (constant->IsString() && !constant->IsInternalizedString())) {
+        return SimplifyJSStoreContext(
+            node, jsgraph()->ConstantNoHole(concrete, broker()), depth);
+      }
+      broker()->dependencies()->DependOnContextCell(slot_ref, state);
+      access_builder.BuildCheckValue(value, &effect, control, *constant);
+      ReplaceWithValue(node, effect, effect, control);
+      return Changed(node);
+    }
+    case ContextCell::kSmi: {
+      broker()->dependencies()->DependOnContextCell(slot_ref, state);
       Node* smi_value = access_builder.BuildCheckSmi(value, &effect, control);
       Node* smi_store = jsgraph()->graph()->NewNode(
           jsgraph()->simplified()->StoreField(
-              AccessBuilder::ForContextSlotSmi(access.index())),
-          jsgraph()->ConstantNoHole(concrete, broker()), smi_value, effect,
+              AccessBuilder::ForContextCellTaggedValue()),
+          jsgraph()->ConstantNoHole(slot_ref, broker()), smi_value, effect,
           control);
       ReplaceWithValue(node, smi_store, smi_store, control);
       return Changed(node);
     }
-    case ContextSidePropertyCell::kMutableInt32: {
-      Node* mutable_heap_number;
-      if (auto concrete_heap_number =
-              concrete.get(broker(), static_cast<int>(access.index()))) {
-        if (!concrete_heap_number->IsHeapNumber()) {
-          // TODO(victorgomes): In case the tag is out of date by now we could
-          // retry this reduction.
-          return NoChange();
-        }
-        mutable_heap_number = jsgraph_->ConstantMutableHeapNumber(
-            concrete_heap_number->AsHeapNumber(), broker());
-      } else {
-        mutable_heap_number = effect = jsgraph_->graph()->NewNode(
-            jsgraph_->simplified()->LoadField(
-                AccessBuilder::ForContextSlot(access.index())),
-            jsgraph_->ConstantNoHole(concrete, broker()), effect, control);
-      }
-      broker()->dependencies()->DependOnScriptContextSlotProperty(
-          concrete, access.index(), property, broker());
+    case ContextCell::kInt32: {
+      broker()->dependencies()->DependOnContextCell(slot_ref, state);
       Node* input_number =
           access_builder.BuildCheckNumberFitsInt32(value, &effect, control);
       Node* double_store = jsgraph()->graph()->NewNode(
           jsgraph()->simplified()->StoreField(
-              AccessBuilder::ForHeapInt32Value()),
-          mutable_heap_number, input_number, effect, control);
+              AccessBuilder::ForContextCellInt32Value()),
+          jsgraph_->ConstantNoHole(slot_ref, broker()), input_number, effect,
+          control);
       ReplaceWithValue(node, double_store, double_store, control);
       return Changed(node);
     }
-    case ContextSidePropertyCell::kMutableHeapNumber: {
-      Node* mutable_heap_number;
-      if (auto concrete_heap_number =
-              concrete.get(broker(), static_cast<int>(access.index()))) {
-        if (!concrete_heap_number->IsHeapNumber()) {
-          // TODO(victorgomes): In case the tag is out of date by now we could
-          // retry this reduction.
-          return NoChange();
-        }
-        mutable_heap_number = jsgraph_->ConstantMutableHeapNumber(
-            concrete_heap_number->AsHeapNumber(), broker());
-      } else {
-        mutable_heap_number = effect = jsgraph_->graph()->NewNode(
-            jsgraph_->simplified()->LoadField(
-                AccessBuilder::ForContextSlot(access.index())),
-            jsgraph_->ConstantNoHole(concrete, broker()), effect, control);
-      }
-      broker()->dependencies()->DependOnScriptContextSlotProperty(
-          concrete, access.index(), property, broker());
+    case ContextCell::kFloat64: {
+      broker()->dependencies()->DependOnContextCell(slot_ref, state);
       Node* input_number =
           access_builder.BuildCheckNumber(value, &effect, control);
       Node* double_store = jsgraph()->graph()->NewNode(
           jsgraph()->simplified()->StoreField(
-              AccessBuilder::ForHeapNumberValue()),
-          mutable_heap_number, input_number, effect, control);
+              AccessBuilder::ForContextCellFloat64Value()),
+          jsgraph_->ConstantNoHole(slot_ref, broker()), input_number, effect,
+          control);
       ReplaceWithValue(node, double_store, double_store, control);
       return Changed(node);
     }
-    case ContextSidePropertyCell::kOther: {
-      // Do a normal context store.
+    case ContextCell::kDetached: {
       Node* store = jsgraph()->graph()->NewNode(
           jsgraph()->simplified()->StoreField(
               AccessBuilder::ForContextSlot(access.index())),
@@ -551,9 +483,8 @@ Reduction JSContextSpecialization::ReduceJSStoreScriptContext(Node* node) {
       ReplaceWithValue(node, store, store, control);
       return Changed(node);
     }
-    default:
-      UNREACHABLE();
   }
+  UNREACHABLE();
 }
 
 OptionalContextRef GetModuleContext(JSHeapBroker* broker, Node* node,
diff --git a/deps/v8/src/compiler/js-context-specialization.h b/deps/v8/src/compiler/js-context-specialization.h
index 1125912ad264bb..8e44ca79b89f77 100644
--- a/deps/v8/src/compiler/js-context-specialization.h
+++ b/deps/v8/src/compiler/js-context-specialization.h
@@ -27,10 +27,10 @@ struct OuterContext {
 };
 
 // Specializes a given JSGraph to a given context, potentially constant folding
-// some {LoadContext} nodes or strength reducing some {StoreContext} nodes.
-// Additionally, constant-folds the function parameter if {closure} is given,
-// and constant-folds import.meta loads if the corresponding object already
-// exists.
+// some {LoadContextNoCell} nodes or strength reducing some {StoreContextNoCell}
+// nodes. Additionally, constant-folds the function parameter if {closure} is
+// given, and constant-folds import.meta loads if the corresponding object
+// already exists.
 //
 // The context can be the incoming function context or any outer context
 // thereof, as indicated by {outer}'s {distance}.
@@ -55,20 +55,20 @@ class V8_EXPORT_PRIVATE JSContextSpecialization final : public AdvancedReducer {
 
  private:
   Reduction ReduceParameter(Node* node);
+  Reduction ReduceJSLoadContextNoCell(Node* node);
   Reduction ReduceJSLoadContext(Node* node);
-  Reduction ReduceJSLoadScriptContext(Node* node);
+  Reduction ReduceJSStoreContextNoCell(Node* node);
   Reduction ReduceJSStoreContext(Node* node);
-  Reduction ReduceJSStoreScriptContext(Node* node);
   Reduction ReduceJSGetImportMeta(Node* node);
 
+  Reduction SimplifyJSLoadContextNoCell(Node* node, Node* new_context,
+                                        size_t new_depth);
   Reduction SimplifyJSLoadContext(Node* node, Node* new_context,
                                   size_t new_depth);
-  Reduction SimplifyJSLoadScriptContext(Node* node, Node* new_context,
-                                        size_t new_depth);
+  Reduction SimplifyJSStoreContextNoCell(Node* node, Node* new_context,
+                                         size_t new_depth);
   Reduction SimplifyJSStoreContext(Node* node, Node* new_context,
                                    size_t new_depth);
-  Reduction SimplifyJSStoreScriptContext(Node* node, Node* new_context,
-                                         size_t new_depth);
 
   Isolate* isolate() const;
   JSGraph* jsgraph() const { return jsgraph_; }
diff --git a/deps/v8/src/compiler/js-create-lowering.cc b/deps/v8/src/compiler/js-create-lowering.cc
index e33979b014fe87..c3725194083d46 100644
--- a/deps/v8/src/compiler/js-create-lowering.cc
+++ b/deps/v8/src/compiler/js-create-lowering.cc
@@ -199,11 +199,14 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
         Node* const arguments_length =
             graph()->NewNode(simplified()->ArgumentsLength());
         // Allocate the elements backing store.
-        Node* const elements = effect = graph()->NewNode(
-            simplified()->NewArgumentsElements(
-                CreateArgumentsType::kUnmappedArguments,
-                shared.internal_formal_parameter_count_without_receiver()),
-            arguments_length, effect);
+        int parameter_count_without_receiver =
+            shared
+                .internal_formal_parameter_count_without_receiver_deprecated();
+        Node* const elements = effect =
+            graph()->NewNode(simplified()->NewArgumentsElements(
+                                 CreateArgumentsType::kUnmappedArguments,
+                                 parameter_count_without_receiver),
+                             arguments_length, effect);
         // Load the arguments object map.
         Node* const arguments_map = jsgraph()->ConstantNoHole(
             native_context().strict_arguments_map(broker()), broker());
@@ -225,13 +228,16 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
         Node* const arguments_length =
             graph()->NewNode(simplified()->ArgumentsLength());
         Node* const rest_length = graph()->NewNode(simplified()->RestLength(
-            shared.internal_formal_parameter_count_without_receiver()));
+            state_info.parameter_count_without_receiver()));
         // Allocate the elements backing store.
-        Node* const elements = effect = graph()->NewNode(
-            simplified()->NewArgumentsElements(
-                CreateArgumentsType::kRestParameter,
-                shared.internal_formal_parameter_count_without_receiver()),
-            arguments_length, effect);
+        int parameter_count_without_receiver =
+            shared
+                .internal_formal_parameter_count_without_receiver_deprecated();
+        Node* const elements = effect =
+            graph()->NewNode(simplified()->NewArgumentsElements(
+                                 CreateArgumentsType::kRestParameter,
+                                 parameter_count_without_receiver),
+                             arguments_length, effect);
         // Load the JSArray object map.
         Node* const jsarray_map = jsgraph()->ConstantNoHole(
             native_context().js_array_packed_elements_map(broker()), broker());
@@ -272,7 +278,7 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
         return NoChange();
       }
       FrameStateInfo args_state_info = args_state.frame_state_info();
-      int length = args_state_info.parameter_count() - 1;  // Minus receiver.
+      int length = args_state_info.parameter_count_without_receiver();
       // Prepare element backing store to be used by arguments object.
       bool has_aliased_arguments = false;
       Node* const elements = TryAllocateAliasedArguments(
@@ -315,7 +321,7 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
         return NoChange();
       }
       FrameStateInfo args_state_info = args_state.frame_state_info();
-      int length = args_state_info.parameter_count() - 1;  // Minus receiver.
+      int length = args_state_info.parameter_count_without_receiver();
       // Prepare element backing store to be used by arguments object.
       Node* const elements = TryAllocateArguments(effect, control, args_state);
       if (elements == nullptr) return NoChange();
@@ -339,7 +345,7 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
     }
     case CreateArgumentsType::kRestParameter: {
       int start_index =
-          shared.internal_formal_parameter_count_without_receiver();
+          shared.internal_formal_parameter_count_without_receiver_deprecated();
       // Use inline allocation for all unmapped arguments objects within inlined
       // (i.e. non-outermost) frames, independent of the object size.
       Node* effect = NodeProperties::GetEffectInput(node);
@@ -365,8 +371,7 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
       // Actually allocate and initialize the jsarray.
       AllocationBuilder a(jsgraph(), broker(), effect, control);
 
-      // -1 to minus receiver
-      int argument_count = args_state_info.parameter_count() - 1;
+      int argument_count = args_state_info.parameter_count_without_receiver();
       int length = std::max(0, argument_count - start_index);
       static_assert(JSArray::kHeaderSize == 4 * kTaggedSize);
       a.Allocate(ALIGN_TO_ALLOCATION_ALIGNMENT(JSArray::kHeaderSize));
@@ -409,7 +414,7 @@ Reduction JSCreateLowering::ReduceJSCreateGeneratorObject(Node* node) {
     SharedFunctionInfoRef shared = js_function.shared(broker());
     DCHECK(shared.HasBytecodeArray());
     int parameter_count_no_receiver =
-        shared.internal_formal_parameter_count_without_receiver();
+        shared.internal_formal_parameter_count_without_receiver_deprecated();
     int length = parameter_count_no_receiver +
                  shared.GetBytecodeArray(broker()).register_count();
     MapRef fixed_array_map = broker()->fixed_array_map();
@@ -1494,7 +1499,7 @@ Reduction JSCreateLowering::ReduceJSCreateStringWrapper(Node* node) {
 Node* JSCreateLowering::TryAllocateArguments(Node* effect, Node* control,
                                              FrameState frame_state) {
   FrameStateInfo state_info = frame_state.frame_state_info();
-  int argument_count = state_info.parameter_count() - 1;  // Minus receiver.
+  int argument_count = state_info.parameter_count_without_receiver();
   if (argument_count == 0) return jsgraph()->EmptyFixedArrayConstant();
 
   // Prepare an iterator over argument values recorded in the frame state.
@@ -1523,7 +1528,7 @@ Node* JSCreateLowering::TryAllocateRestArguments(Node* effect, Node* control,
                                                  FrameState frame_state,
                                                  int start_index) {
   FrameStateInfo state_info = frame_state.frame_state_info();
-  int argument_count = state_info.parameter_count() - 1;  // Minus receiver.
+  int argument_count = state_info.parameter_count_without_receiver();
   int num_elements = std::max(0, argument_count - start_index);
   if (num_elements == 0) return jsgraph()->EmptyFixedArrayConstant();
 
@@ -1555,13 +1560,13 @@ Node* JSCreateLowering::TryAllocateAliasedArguments(
     Node* effect, Node* control, FrameState frame_state, Node* context,
     SharedFunctionInfoRef shared, bool* has_aliased_arguments) {
   FrameStateInfo state_info = frame_state.frame_state_info();
-  int argument_count = state_info.parameter_count() - 1;  // Minus receiver.
+  int argument_count = state_info.parameter_count_without_receiver();
   if (argument_count == 0) return jsgraph()->EmptyFixedArrayConstant();
 
   // If there is no aliasing, the arguments object elements are not special in
   // any way, we can just return an unmapped backing store instead.
   int parameter_count =
-      shared.internal_formal_parameter_count_without_receiver();
+      shared.internal_formal_parameter_count_without_receiver_deprecated();
   if (parameter_count == 0) {
     return TryAllocateArguments(effect, control, frame_state);
   }
@@ -1628,7 +1633,7 @@ Node* JSCreateLowering::TryAllocateAliasedArguments(
   // If there is no aliasing, the arguments object elements are not
   // special in any way, we can just return an unmapped backing store.
   int parameter_count =
-      shared.internal_formal_parameter_count_without_receiver();
+      shared.internal_formal_parameter_count_without_receiver_deprecated();
   if (parameter_count == 0) {
     return graph()->NewNode(
         simplified()->NewArgumentsElements(
diff --git a/deps/v8/src/compiler/js-generic-lowering.cc b/deps/v8/src/compiler/js-generic-lowering.cc
index d679b34558a04c..5fd766a67e4ee6 100644
--- a/deps/v8/src/compiler/js-generic-lowering.cc
+++ b/deps/v8/src/compiler/js-generic-lowering.cc
@@ -591,19 +591,19 @@ void JSGenericLowering::LowerJSHasContextExtension(Node* node) {
   UNREACHABLE();  // Eliminated in typed lowering.
 }
 
-void JSGenericLowering::LowerJSLoadContext(Node* node) {
+void JSGenericLowering::LowerJSLoadContextNoCell(Node* node) {
   UNREACHABLE();  // Eliminated in typed lowering.
 }
 
-void JSGenericLowering::LowerJSLoadScriptContext(Node* node) {
+void JSGenericLowering::LowerJSLoadContext(Node* node) {
   UNREACHABLE();  // Eliminated in typed lowering.
 }
 
-void JSGenericLowering::LowerJSStoreContext(Node* node) {
+void JSGenericLowering::LowerJSStoreContextNoCell(Node* node) {
   UNREACHABLE();  // Eliminated in typed lowering.
 }
 
-void JSGenericLowering::LowerJSStoreScriptContext(Node* node) {
+void JSGenericLowering::LowerJSStoreContext(Node* node) {
   UNREACHABLE();  // Eliminated in context specialization.
 }
 
@@ -1168,7 +1168,7 @@ void JSGenericLowering::LowerJSGeneratorRestoreContinuation(Node* node) {
   UNREACHABLE();  // Eliminated in typed lowering.
 }
 
-void JSGenericLowering::LowerJSGeneratorRestoreContext(Node* node) {
+void JSGenericLowering::LowerJSGeneratorRestoreContextNoCell(Node* node) {
   UNREACHABLE();  // Eliminated in typed lowering.
 }
 
diff --git a/deps/v8/src/compiler/js-graph.cc b/deps/v8/src/compiler/js-graph.cc
index 9fb0d11c0faeb1..99a5fa658b3a29 100644
--- a/deps/v8/src/compiler/js-graph.cc
+++ b/deps/v8/src/compiler/js-graph.cc
@@ -297,6 +297,9 @@ DEFINE_GETTER(
 DEFINE_GETTER(ExternalObjectMapConstant, Map,
               HeapConstantNoHole(factory()->external_map()))
 
+DEFINE_GETTER(ContextCellMapConstant, Map,
+              HeapConstantNoHole(factory()->context_cell_map()))
+
 #undef DEFINE_GETTER
 #undef GET_CACHED_FIELD
 
diff --git a/deps/v8/src/compiler/js-graph.h b/deps/v8/src/compiler/js-graph.h
index 24506194cd51ac..51cf9deed1ea00 100644
--- a/deps/v8/src/compiler/js-graph.h
+++ b/deps/v8/src/compiler/js-graph.h
@@ -145,7 +145,8 @@ class V8_EXPORT_PRIVATE JSGraph : public MachineGraph {
   V(NaNConstant, Number)                                      \
   V(EmptyStateValues, UntaggedT)                              \
   V(SingleDeadTypedStateValues, UntaggedT)                    \
-  V(ExternalObjectMapConstant, Map)
+  V(ExternalObjectMapConstant, Map)                           \
+  V(ContextCellMapConstant, Map)
 
 // Cached global node accessor methods.
 #define DECLARE_GETTER(name, Type) TNode<Type> name();
diff --git a/deps/v8/src/compiler/js-heap-broker.cc b/deps/v8/src/compiler/js-heap-broker.cc
index 3a7949ce8e433d..ec442573678653 100644
--- a/deps/v8/src/compiler/js-heap-broker.cc
+++ b/deps/v8/src/compiler/js-heap-broker.cc
@@ -47,7 +47,6 @@ JSHeapBroker::JSHeapBroker(Isolate* isolate, Zone* broker_zone,
       refs_(zone()->New<RefsMap>(kMinimalRefsBucketCount, AddressMatcher(),
                                  zone())),
       root_index_map_(isolate),
-      array_and_object_prototypes_(zone()),
       tracing_enabled_(tracing_enabled),
       code_kind_(code_kind),
       feedback_(zone()),
@@ -118,28 +117,6 @@ void JSHeapBroker::SetTargetNativeContextRef(
   target_native_context_ = MakeRef(this, *native_context);
 }
 
-void JSHeapBroker::CollectArrayAndObjectPrototypes() {
-  DisallowGarbageCollection no_gc;
-  CHECK_EQ(mode(), kSerializing);
-  CHECK(array_and_object_prototypes_.empty());
-
-  Tagged<Object> maybe_context = isolate()->heap()->native_contexts_list();
-  while (!IsUndefined(maybe_context, isolate())) {
-    Tagged<Context> context = Cast<Context>(maybe_context);
-    Tagged<Object> array_prot =
-        context->get(Context::INITIAL_ARRAY_PROTOTYPE_INDEX);
-    Tagged<Object> object_prot =
-        context->get(Context::INITIAL_OBJECT_PROTOTYPE_INDEX);
-    array_and_object_prototypes_.emplace(
-        CanonicalPersistentHandle(Cast<JSObject>(array_prot)));
-    array_and_object_prototypes_.emplace(
-        CanonicalPersistentHandle(Cast<JSObject>(object_prot)));
-    maybe_context = context->next_context_link();
-  }
-
-  CHECK(!array_and_object_prototypes_.empty());
-}
-
 StringRef JSHeapBroker::GetTypedArrayStringTag(ElementsKind kind) {
   DCHECK(IsTypedArrayOrRabGsabTypedArrayElementsKind(kind));
   switch (kind) {
@@ -159,19 +136,9 @@ bool JSHeapBroker::IsArrayOrObjectPrototype(JSObjectRef object) const {
 }
 
 bool JSHeapBroker::IsArrayOrObjectPrototype(Handle<JSObject> object) const {
-  if (mode() == kDisabled) {
-    return isolate()->IsInCreationContext(
-               *object, Context::INITIAL_ARRAY_PROTOTYPE_INDEX) ||
-           object->map(isolate_)->instance_type() == JS_OBJECT_PROTOTYPE_TYPE;
-  }
-  CHECK(!array_and_object_prototypes_.empty());
-  return array_and_object_prototypes_.find(object) !=
-         array_and_object_prototypes_.end();
-}
-
-ObjectData* JSHeapBroker::TryGetOrCreateData(Tagged<Object> object,
-                                             GetOrCreateDataFlags flags) {
-  return TryGetOrCreateData(CanonicalPersistentHandle(object), flags);
+  return isolate()->IsInCreationContext(
+             *object, Context::INITIAL_ARRAY_PROTOTYPE_INDEX) ||
+         object->map(isolate_)->instance_type() == JS_OBJECT_PROTOTYPE_TYPE;
 }
 
 ObjectData* JSHeapBroker::GetOrCreateData(Handle<Object> object,
@@ -181,11 +148,6 @@ ObjectData* JSHeapBroker::GetOrCreateData(Handle<Object> object,
   return return_value;
 }
 
-ObjectData* JSHeapBroker::GetOrCreateData(Tagged<Object> object,
-                                          GetOrCreateDataFlags flags) {
-  return GetOrCreateData(CanonicalPersistentHandle(object), flags);
-}
-
 bool JSHeapBroker::StackHasOverflowed() const {
   DCHECK_IMPLIES(local_isolate_ == nullptr,
                  ThreadId::Current() == isolate_->thread_id());
@@ -905,7 +867,7 @@ ElementAccessFeedback const& JSHeapBroker::ProcessFeedbackMapsForElementAccess(
 
   ElementAccessFeedback* result =
       zone()->New<ElementAccessFeedback>(zone(), keyed_mode, slot_kind);
-  for (auto entry : transition_groups) {
+  for (auto& entry : transition_groups) {
     result->AddGroup(std::move(entry.second));
   }
 
diff --git a/deps/v8/src/compiler/js-heap-broker.h b/deps/v8/src/compiler/js-heap-broker.h
index 52677f517f5e49..ab3c362cc2938d 100644
--- a/deps/v8/src/compiler/js-heap-broker.h
+++ b/deps/v8/src/compiler/js-heap-broker.h
@@ -182,15 +182,21 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
   // Never returns nullptr.
   ObjectData* GetOrCreateData(Handle<Object> object,
                               GetOrCreateDataFlags flags = {});
-  ObjectData* GetOrCreateData(Tagged<Object> object,
-                              GetOrCreateDataFlags flags = {});
+  template <typename T>
+  ObjectData* GetOrCreateData(Tagged<T> object,
+                              GetOrCreateDataFlags flags = {}) {
+    return GetOrCreateData(CanonicalPersistentHandle(object), flags);
+  }
 
   // Gets data only if we have it. However, thin wrappers will be created for
   // smis, read-only objects and never-serialized objects.
   ObjectData* TryGetOrCreateData(Handle<Object> object,
                                  GetOrCreateDataFlags flags = {});
-  ObjectData* TryGetOrCreateData(Tagged<Object> object,
-                                 GetOrCreateDataFlags flags = {});
+  template <typename T>
+  ObjectData* TryGetOrCreateData(Tagged<T> object,
+                                 GetOrCreateDataFlags flags = {}) {
+    return TryGetOrCreateData(CanonicalPersistentHandle(object), flags);
+  }
 
   // Check if {object} is any native context's %ArrayPrototype% or
   // %ObjectPrototype%.
@@ -285,13 +291,13 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
     if (Tagged<HeapObject> heap_object;
         TryCast<HeapObject>(object, &heap_object)) {
       RootIndex root_index;
-      // CollectArrayAndObjectPrototypes calls this function often with T equal
-      // to JSObject. The root index map only contains immortal, immutable
-      // objects; it never contains any instances of type JSObject, since
-      // JSObjects must exist within a NativeContext, and NativeContexts can be
-      // created and destroyed. Thus, we can skip the lookup in the root index
-      // map for those values and save a little time.
-      if constexpr (std::is_convertible_v<T, JSObject>) {
+      // The root index map only contains immortal, immutable objects; it never
+      // contains any instances of type JSObject, since JSObjects must exist
+      // within a NativeContext, and NativeContexts can be created and
+      // destroyed. Thus, we can skip the lookup in the root index map for those
+      // values and save a little time.
+      if constexpr (std::is_convertible_v<T, JSObject> ||
+                    std::is_convertible_v<T, Context>) {
         DCHECK(!root_index_map_.Lookup(heap_object, &root_index));
       } else if (root_index_map_.Lookup(heap_object, &root_index)) {
         return Handle<T>(isolate_->root_handle(root_index).location());
@@ -428,8 +434,6 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
   ProcessedFeedback const& ReadFeedbackForTemplateObject(
       FeedbackSource const& source);
 
-  void CollectArrayAndObjectPrototypes();
-
   void set_persistent_handles(
       std::unique_ptr<PersistentHandles> persistent_handles) {
     DCHECK_NULL(ph_);
@@ -457,9 +461,6 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
   OptionalNativeContextRef target_native_context_;
   RefsMap* refs_;
   RootIndexMap root_index_map_;
-  ZoneUnorderedSet<IndirectHandle<JSObject>, IndirectHandle<JSObject>::hash,
-                   IndirectHandle<JSObject>::equal_to>
-      array_and_object_prototypes_;
   BrokerMode mode_ = kDisabled;
   bool const tracing_enabled_;
   CodeKind const code_kind_;
diff --git a/deps/v8/src/compiler/js-inlining-heuristic.cc b/deps/v8/src/compiler/js-inlining-heuristic.cc
index dbf835d5200435..f4f72afa68cd19 100644
--- a/deps/v8/src/compiler/js-inlining-heuristic.cc
+++ b/deps/v8/src/compiler/js-inlining-heuristic.cc
@@ -9,7 +9,7 @@
 #include "src/compiler/js-heap-broker.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/simplified-operator.h"
-#include "src/numbers/conversions.h"
+#include "src/numbers/conversions-inl.h"
 
 namespace v8 {
 namespace internal {
@@ -99,6 +99,18 @@ JSInliningHeuristic::Candidate JSInliningHeuristic::CollectFunctions(
     if (CanConsiderForInlining(broker(), function)) {
       out.bytecode[0] = function.shared(broker()).GetBytecodeArray(broker());
       out.num_functions = 1;
+
+      int input_count = node->InputCount();
+      for (int j = 2; j < input_count; ++j) {
+        Node* input = node->InputAt(j);
+        if (input->opcode() == IrOpcode::kNumberConstant) {
+          double value = OpParameter<double>(input->op());
+          if (!IsSmiDouble(value)) {
+            out.has_heapnumber_params = true;
+            break;
+          }
+        }
+      }
       return out;
     }
   }
@@ -299,7 +311,11 @@ void JSInliningHeuristic::Finalize() {
         candidate.total_size * v8_flags.reserve_inline_budget_scale_factor;
     int total_size =
         total_inlined_bytecode_size_ + static_cast<int>(size_of_candidate);
-    if (total_size > max_inlined_bytecode_size_cumulative_) {
+
+    // If the candidate requires boxing heap numbers, inline it more
+    // aggressively.
+    if (!candidate.has_heapnumber_params &&
+        total_size > max_inlined_bytecode_size_cumulative_) {
       info_->set_could_not_inline_all_candidates();
       // Try if any smaller functions are available to inline.
       continue;
@@ -705,13 +721,20 @@ Reduction JSInliningHeuristic::InlineCandidate(Candidate const& candidate,
                                                bool small_function) {
   int num_calls = candidate.num_functions;
   Node* const node = candidate.node;
+
+  // If the candidate has heapnumber parameters, don't count its size in
+  // total_inlined_bytecode_size_.
+  const bool ignore_size = candidate.has_heapnumber_params;
+
 #if V8_ENABLE_WEBASSEMBLY
   DCHECK_NE(node->opcode(), IrOpcode::kJSWasmCall);
 #endif  // V8_ENABLE_WEBASSEMBLY
   if (num_calls == 1) {
     Reduction const reduction = inliner_.ReduceJSCall(node);
     if (reduction.Changed()) {
-      total_inlined_bytecode_size_ += candidate.bytecode[0].value().length();
+      if (!ignore_size) {
+        total_inlined_bytecode_size_ += candidate.bytecode[0].value().length();
+      }
     }
     return reduction;
   }
@@ -778,7 +801,9 @@ Reduction JSInliningHeuristic::InlineCandidate(Candidate const& candidate,
       Node* call = calls[i];
       Reduction const reduction = inliner_.ReduceJSCall(call);
       if (reduction.Changed()) {
-        total_inlined_bytecode_size_ += candidate.bytecode[i]->length();
+        if (!ignore_size) {
+          total_inlined_bytecode_size_ += candidate.bytecode[i]->length();
+        }
         // Killing the call node is not strictly necessary, but it is safer to
         // make sure we do not resurrect the node.
         call->Kill();
@@ -792,6 +817,12 @@ Reduction JSInliningHeuristic::InlineCandidate(Candidate const& candidate,
 bool JSInliningHeuristic::CandidateCompare::operator()(
     const Candidate& left, const Candidate& right) const {
   constexpr bool kInlineLeftFirst = true, kInlineRightFirst = false;
+  if (left.has_heapnumber_params && !right.has_heapnumber_params) {
+    return kInlineLeftFirst;
+  } else if (right.has_heapnumber_params) {
+    return kInlineRightFirst;
+  }
+
   if (right.frequency.IsUnknown()) {
     if (left.frequency.IsUnknown()) {
       // If left and right are both unknown then the ordering is indeterminate,
diff --git a/deps/v8/src/compiler/js-inlining-heuristic.h b/deps/v8/src/compiler/js-inlining-heuristic.h
index a5ba51100a9013..c170d5effbb519 100644
--- a/deps/v8/src/compiler/js-inlining-heuristic.h
+++ b/deps/v8/src/compiler/js-inlining-heuristic.h
@@ -82,6 +82,7 @@ class JSInliningHeuristic final : public AdvancedReducer {
     Node* node = nullptr;     // The call site at which to inline.
     CallFrequency frequency;  // Relative frequency of this call site.
     int total_size = 0;
+    bool has_heapnumber_params = false;
   };
 
   // Comparator for candidates.
diff --git a/deps/v8/src/compiler/js-inlining.cc b/deps/v8/src/compiler/js-inlining.cc
index bf7d2d96bd44d0..3f172d5c134e20 100644
--- a/deps/v8/src/compiler/js-inlining.cc
+++ b/deps/v8/src/compiler/js-inlining.cc
@@ -950,8 +950,10 @@ Reduction JSInliner::ReduceJSCall(Node* node) {
   // Insert inlined extra arguments if required. The callees formal parameter
   // count have to match the number of arguments passed to the call.
   int parameter_count = bytecode_array.parameter_count_without_receiver();
-  DCHECK_EQ(parameter_count,
-            shared_info->internal_formal_parameter_count_without_receiver());
+  DCHECK_EQ(
+      parameter_count,
+      shared_info
+          ->internal_formal_parameter_count_without_receiver_deprecated());
   DCHECK_EQ(parameter_count, start.FormalParameterCountWithoutReceiver());
   if (call.argument_count() != parameter_count) {
     frame_state = CreateArtificialFrameState(
diff --git a/deps/v8/src/compiler/js-intrinsic-lowering.cc b/deps/v8/src/compiler/js-intrinsic-lowering.cc
index cc8bb83c24156c..2d519d84527f10 100644
--- a/deps/v8/src/compiler/js-intrinsic-lowering.cc
+++ b/deps/v8/src/compiler/js-intrinsic-lowering.cc
@@ -74,6 +74,8 @@ Reduction JSIntrinsicLowering::Reduce(Node* node) {
       return ReduceGeneratorGetResumeMode(node);
     case Runtime::kInlineIncBlockCounter:
       return ReduceIncBlockCounter(node);
+    case Runtime::kInlineAddLhsIsStringConstantInternalize:
+      return ReduceAddLhsIsStringConstantInternalize(node);
     case Runtime::kInlineGetImportMetaObject:
       return ReduceGetImportMetaObject(node);
     default:
@@ -355,6 +357,12 @@ Reduction JSIntrinsicLowering::ReduceIncBlockCounter(Node* node) {
                 kDoesNotNeedFrameState);
 }
 
+Reduction JSIntrinsicLowering::ReduceAddLhsIsStringConstantInternalize(
+    Node* node) {
+  auto builtin = Builtin::kAddLhsIsStringConstantInternalizeWithVector;
+  return Change(node, Builtins::CallableFor(isolate(), builtin), 0);
+}
+
 Reduction JSIntrinsicLowering::ReduceGetImportMetaObject(Node* node) {
   NodeProperties::ChangeOp(node, javascript()->GetImportMeta());
   return Changed(node);
diff --git a/deps/v8/src/compiler/js-intrinsic-lowering.h b/deps/v8/src/compiler/js-intrinsic-lowering.h
index 842c9d11e08e48..cfd33d337dff95 100644
--- a/deps/v8/src/compiler/js-intrinsic-lowering.h
+++ b/deps/v8/src/compiler/js-intrinsic-lowering.h
@@ -64,6 +64,7 @@ class V8_EXPORT_PRIVATE JSIntrinsicLowering final
   Reduction ReduceToString(Node* node);
   Reduction ReduceCall(Node* node);
   Reduction ReduceIncBlockCounter(Node* node);
+  Reduction ReduceAddLhsIsStringConstantInternalize(Node* node);
   Reduction ReduceGetImportMetaObject(Node* node);
 
   Reduction Change(Node* node, const Operator* op);
diff --git a/deps/v8/src/compiler/js-native-context-specialization.cc b/deps/v8/src/compiler/js-native-context-specialization.cc
index e7a2abed27daef..73b9e6978857e8 100644
--- a/deps/v8/src/compiler/js-native-context-specialization.cc
+++ b/deps/v8/src/compiler/js-native-context-specialization.cc
@@ -258,15 +258,17 @@ Reduction JSNativeContextSpecialization::ReduceJSAsyncFunctionEnter(
   Node* promise = effect =
       graph()->NewNode(javascript()->CreatePromise(), context, effect);
 
-  // Create the JSAsyncFunctionObject based on the SharedFunctionInfo
+  // Create the JSAsyncFunctionObject based on the BytecodeArray
   // extracted from the top-most frame in {frame_state}.
-  SharedFunctionInfoRef shared = MakeRef(
-      broker(),
-      FrameStateInfoOf(frame_state->op()).shared_info().ToHandleChecked());
-  DCHECK(shared.is_compiled());
-  int register_count =
-      shared.internal_formal_parameter_count_without_receiver() +
-      shared.GetBytecodeArray(broker()).register_count();
+  FrameStateInfo state_info = FrameStateInfoOf(frame_state->op());
+  Handle<BytecodeArray> bytecode_array =
+      state_info.bytecode_array().ToHandleChecked();
+  DCHECK_EQ(state_info.shared_info()
+                .ToHandleChecked()
+                ->internal_formal_parameter_count_without_receiver(),
+            bytecode_array->parameter_count_without_receiver());
+  int register_count = bytecode_array->parameter_count_without_receiver() +
+                       bytecode_array->register_count();
   MapRef fixed_array_map = broker()->fixed_array_map();
   AllocationBuilder ab(jsgraph(), broker(), effect, control);
   if (!ab.CanAllocateArray(register_count, fixed_array_map)) {
@@ -1329,17 +1331,15 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadGlobal(Node* node) {
     Node* script_context =
         jsgraph()->ConstantNoHole(feedback.script_context(), broker());
     Node* value;
-    if ((v8_flags.script_context_mutable_heap_number ||
-         v8_flags.const_tracking_let) &&
-        !feedback.immutable()) {
+    if (v8_flags.script_context_cells && !feedback.immutable()) {
       // We collect feedback only for mutable context slots.
-      value = effect = graph()->NewNode(
-          javascript()->LoadScriptContext(0, feedback.slot_index()),
-          script_context, effect, control);
+      value = effect = control =
+          graph()->NewNode(javascript()->LoadContext(0, feedback.slot_index()),
+                           script_context, effect, control);
     } else {
       value = effect =
-          graph()->NewNode(javascript()->LoadContext(0, feedback.slot_index(),
-                                                     feedback.immutable()),
+          graph()->NewNode(javascript()->LoadContextNoCell(
+                               0, feedback.slot_index(), feedback.immutable()),
                            script_context, effect);
     }
     ReplaceWithValue(node, value, effect, control);
@@ -1371,15 +1371,14 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreGlobal(Node* node) {
     Node* control = n.control();
     Node* script_context =
         jsgraph()->ConstantNoHole(feedback.script_context(), broker());
-    if (v8_flags.script_context_mutable_heap_number ||
-        v8_flags.const_tracking_let) {
-      effect = control = graph()->NewNode(
-          javascript()->StoreScriptContext(0, feedback.slot_index()), value,
-          script_context, effect, control);
-    } else {
-      effect =
+    if (v8_flags.script_context_cells) {
+      effect = control =
           graph()->NewNode(javascript()->StoreContext(0, feedback.slot_index()),
                            value, script_context, effect, control);
+    } else {
+      effect = graph()->NewNode(
+          javascript()->StoreContextNoCell(0, feedback.slot_index()), value,
+          script_context, effect, control);
     }
     ReplaceWithValue(node, value, effect, control);
     return Replace(value);
diff --git a/deps/v8/src/compiler/js-operator.cc b/deps/v8/src/compiler/js-operator.cc
index 99e18cf8312363..6c0916fdd23b0f 100644
--- a/deps/v8/src/compiler/js-operator.cc
+++ b/deps/v8/src/compiler/js-operator.cc
@@ -180,10 +180,10 @@ std::ostream& operator<<(std::ostream& os, ContextAccess const& access) {
 
 
 ContextAccess const& ContextAccessOf(Operator const* op) {
-  DCHECK(op->opcode() == IrOpcode::kJSLoadContext ||
-         op->opcode() == IrOpcode::kJSLoadScriptContext ||
-         op->opcode() == IrOpcode::kJSStoreContext ||
-         op->opcode() == IrOpcode::kJSStoreScriptContext);
+  DCHECK(op->opcode() == IrOpcode::kJSLoadContextNoCell ||
+         op->opcode() == IrOpcode::kJSLoadContext ||
+         op->opcode() == IrOpcode::kJSStoreContextNoCell ||
+         op->opcode() == IrOpcode::kJSStoreContext);
   return OpParameter<ContextAccess>(op);
 }
 
@@ -772,7 +772,7 @@ Type JSWasmCallNode::TypeForWasmReturnType(wasm::CanonicalValueType type) {
   V(LoadMessage, Operator::kNoThrow | Operator::kNoWrite, 0, 1)          \
   V(StoreMessage, Operator::kNoRead | Operator::kNoThrow, 1, 0)          \
   V(GeneratorRestoreContinuation, Operator::kNoThrow, 1, 1)              \
-  V(GeneratorRestoreContext, Operator::kNoThrow, 1, 1)                   \
+  V(GeneratorRestoreContextNoCell, Operator::kNoThrow, 1, 1)             \
   V(GeneratorRestoreInputOrDebugPos, Operator::kNoThrow, 1, 1)           \
   V(Debugger, Operator::kNoProperties, 0, 0)                             \
   V(FulfillPromise, Operator::kNoDeopt | Operator::kNoThrow, 2, 1)       \
@@ -1229,45 +1229,44 @@ const Operator* JSOperatorBuilder::HasContextExtension(size_t depth) {
       depth);                                   // parameter
 }
 
-const Operator* JSOperatorBuilder::LoadContext(size_t depth, size_t index,
-                                               bool immutable) {
+const Operator* JSOperatorBuilder::LoadContextNoCell(size_t depth, size_t index,
+                                                     bool immutable) {
   ContextAccess access(depth, index, immutable);
   return zone()->New<Operator1<ContextAccess>>(  // --
-      IrOpcode::kJSLoadContext,                  // opcode
+      IrOpcode::kJSLoadContextNoCell,            // opcode
       Operator::kNoWrite | Operator::kNoThrow,   // flags
-      "JSLoadContext",                           // name
+      "JSLoadContextNoCell",                     // name
       0, 1, 0, 1, 1, 0,                          // counts
       access);                                   // parameter
 }
 
-const Operator* JSOperatorBuilder::LoadScriptContext(size_t depth,
-                                                     size_t index) {
+const Operator* JSOperatorBuilder::LoadContext(size_t depth, size_t index) {
   ContextAccess access(depth, index, false);
   return zone()->New<Operator1<ContextAccess>>(  // --
-      IrOpcode::kJSLoadScriptContext,            // opcode
+      IrOpcode::kJSLoadContext,                  // opcode
       Operator::kNoWrite | Operator::kNoThrow,   // flags
-      "JSLoadScriptContext",                     // name
+      "JSLoadContext",                           // name
       0, 1, 1, 1, 1, 1,                          // counts
       access);                                   // parameter
 }
 
-const Operator* JSOperatorBuilder::StoreContext(size_t depth, size_t index) {
+const Operator* JSOperatorBuilder::StoreContextNoCell(size_t depth,
+                                                      size_t index) {
   ContextAccess access(depth, index, false);
   return zone()->New<Operator1<ContextAccess>>(  // --
-      IrOpcode::kJSStoreContext,                 // opcode
+      IrOpcode::kJSStoreContextNoCell,           // opcode
       Operator::kNoRead | Operator::kNoThrow,    // flags
-      "JSStoreContext",                          // name
+      "JSStoreContextNoCell",                    // name
       1, 1, 1, 0, 1, 0,                          // counts
       access);                                   // parameter
 }
 
-const Operator* JSOperatorBuilder::StoreScriptContext(size_t depth,
-                                                      size_t index) {
+const Operator* JSOperatorBuilder::StoreContext(size_t depth, size_t index) {
   ContextAccess access(depth, index, false);
   return zone()->New<Operator1<ContextAccess>>(  // --
-      IrOpcode::kJSStoreScriptContext,           // opcode
+      IrOpcode::kJSStoreContext,                 // opcode
       Operator::kNoRead | Operator::kNoThrow,    // flags
-      "JSStoreScriptContext",                    // name
+      "JSStoreContext",                          // name
       1, 1, 1, 0, 1, 1,                          // counts
       access);                                   // parameter
 }
diff --git a/deps/v8/src/compiler/js-operator.h b/deps/v8/src/compiler/js-operator.h
index 554704840e74f8..890933e5ac48c4 100644
--- a/deps/v8/src/compiler/js-operator.h
+++ b/deps/v8/src/compiler/js-operator.h
@@ -336,8 +336,9 @@ V8_EXPORT_PRIVATE const CallRuntimeParameters& CallRuntimeParametersOf(
     const Operator* op);
 
 // Defines the location of a context slot relative to a specific scope. This is
-// used as a parameter by JSLoadContext and JSStoreContext operators and allows
-// accessing a context-allocated variable without keeping track of the scope.
+// used as a parameter by JSLoadContextNoCell and JSStoreContextNoCell operators
+// and allows accessing a context-allocated variable without keeping track of
+// the scope.
 class ContextAccess final {
  public:
   ContextAccess(size_t depth, size_t index, bool immutable);
@@ -1064,10 +1065,10 @@ class V8_EXPORT_PRIVATE JSOperatorBuilder final
                               const FeedbackSource& feedback);
 
   const Operator* HasContextExtension(size_t depth);
-  const Operator* LoadContext(size_t depth, size_t index, bool immutable);
-  const Operator* LoadScriptContext(size_t depth, size_t index);
+  const Operator* LoadContextNoCell(size_t depth, size_t index, bool immutable);
+  const Operator* LoadContext(size_t depth, size_t index);
+  const Operator* StoreContextNoCell(size_t depth, size_t index);
   const Operator* StoreContext(size_t depth, size_t index);
-  const Operator* StoreScriptContext(size_t depth, size_t index);
 
   const Operator* LoadModule(int32_t cell_index);
   const Operator* StoreModule(int32_t cell_index);
@@ -1094,7 +1095,7 @@ class V8_EXPORT_PRIVATE JSOperatorBuilder final
 
   // Used to implement Ignition's SwitchOnGeneratorState bytecode.
   const Operator* GeneratorRestoreContinuation();
-  const Operator* GeneratorRestoreContext();
+  const Operator* GeneratorRestoreContextNoCell();
 
   // Used to implement Ignition's ResumeGenerator bytecode.
   const Operator* GeneratorRestoreRegister(int index);
diff --git a/deps/v8/src/compiler/js-type-hint-lowering.cc b/deps/v8/src/compiler/js-type-hint-lowering.cc
index 229202ad4c0784..3df256d2f23216 100644
--- a/deps/v8/src/compiler/js-type-hint-lowering.cc
+++ b/deps/v8/src/compiler/js-type-hint-lowering.cc
@@ -292,6 +292,11 @@ class JSSpeculativeBinopBuilder final {
   Node* TryBuildNumberCompare() {
     NumberOperationHint hint;
     if (GetCompareNumberOperationHint(&hint)) {
+      // Equality doesn't not perform ToNumber conversions on Oddballs.
+      if (hint == NumberOperationHint::kNumberOrOddball &&
+          op_->opcode() == IrOpcode::kJSEqual) {
+        return nullptr;
+      }
       const Operator* op = SpeculativeNumberCompareOp(hint);
       Node* node = BuildSpeculativeOperation(op);
       return node;
diff --git a/deps/v8/src/compiler/js-typed-lowering.cc b/deps/v8/src/compiler/js-typed-lowering.cc
index 7346de6a762ece..d72b3686c2add6 100644
--- a/deps/v8/src/compiler/js-typed-lowering.cc
+++ b/deps/v8/src/compiler/js-typed-lowering.cc
@@ -7,6 +7,7 @@
 #include <optional>
 
 #include "src/ast/modules.h"
+#include "src/base/logging.h"
 #include "src/builtins/builtins-inl.h"
 #include "src/builtins/builtins-utils.h"
 #include "src/codegen/code-factory.h"
@@ -33,7 +34,9 @@
 #include "src/execution/protectors.h"
 #include "src/flags/flags.h"
 #include "src/objects/casting.h"
+#include "src/objects/contexts.h"
 #include "src/objects/heap-number.h"
+#include "src/objects/heap-object.h"
 #include "src/objects/js-generator.h"
 #include "src/objects/module-inl.h"
 #include "src/objects/objects-inl.h"
@@ -1539,26 +1542,6 @@ Reduction JSTypedLowering::ReduceJSHasContextExtension(Node* node) {
   gasm.InitializeEffectControl(effect, control);
 
   for (size_t i = 0; i < depth; ++i) {
-#if DEBUG
-    // Const tracking let data is stored in the extension slot of a
-    // ScriptContext - however, it's unrelated to the sloppy eval variable
-    // extension. We should never iterate through a ScriptContext here.
-
-    TNode<ScopeInfo> scope_info = gasm.LoadField<ScopeInfo>(
-        AccessBuilder::ForContextSlot(Context::SCOPE_INFO_INDEX), context);
-    TNode<Word32T> scope_info_flags = gasm.EnterMachineGraph<Word32T>(
-        gasm.LoadField<Word32T>(AccessBuilder::ForScopeInfoFlags(), scope_info),
-        UseInfo::TruncatingWord32());
-    TNode<Word32T> scope_type = gasm.Word32And(
-        scope_info_flags, gasm.Uint32Constant(ScopeInfo::ScopeTypeBits::kMask));
-    TNode<Word32T> is_script_scope = gasm.Word32Equal(
-        scope_type, gasm.Uint32Constant(ScopeType::SCRIPT_SCOPE));
-    TNode<Word32T> is_not_script_scope =
-        gasm.Word32Equal(is_script_scope, gasm.Uint32Constant(0));
-    gasm.Assert(is_not_script_scope, "we should no see a ScriptContext here",
-                __FILE__, __LINE__);
-#endif
-
     context = gasm.LoadField<Context>(
         AccessBuilder::ForContextSlotKnownPointer(Context::PREVIOUS_INDEX),
         context);
@@ -1582,8 +1565,8 @@ Reduction JSTypedLowering::ReduceJSHasContextExtension(Node* node) {
   return Changed(node);
 }
 
-Reduction JSTypedLowering::ReduceJSLoadContext(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSLoadContext, node->opcode());
+Reduction JSTypedLowering::ReduceJSLoadContextNoCell(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSLoadContextNoCell, node->opcode());
   ContextAccess const& access = ContextAccessOf(node->op());
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* context = NodeProperties::GetContextInput(node);
@@ -1603,8 +1586,8 @@ Reduction JSTypedLowering::ReduceJSLoadContext(Node* node) {
   return Changed(node);
 }
 
-Reduction JSTypedLowering::ReduceJSLoadScriptContext(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSLoadScriptContext, node->opcode());
+Reduction JSTypedLowering::ReduceJSLoadContext(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSLoadContext, node->opcode());
   ContextAccess const& access = ContextAccessOf(node->op());
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
@@ -1628,99 +1611,39 @@ Reduction JSTypedLowering::ReduceJSLoadScriptContext(Node* node) {
           .Else([&] {
             TNode<Map> value_map =
                 gasm.LoadMap(TNode<HeapObject>::UncheckedCast(value));
-            return gasm.SelectIf<Object>(gasm.IsHeapNumberMap(value_map))
+            return gasm.SelectIf<Object>(gasm.IsContextCellMap(value_map))
                 .Then([&] {
-                  size_t side_data_index =
-                      access.index() - Context::MIN_CONTEXT_EXTENDED_SLOTS;
-                  TNode<FixedArray> side_data = gasm.LoadField<FixedArray>(
-                      AccessBuilder::ForContextSlot(
-                          Context::CONTEXT_SIDE_TABLE_PROPERTY_INDEX),
-                      context);
-                  TNode<Object> data = gasm.LoadField<Object>(
-                      AccessBuilder::ForFixedArraySlot(side_data_index),
-                      side_data);
-                  TNode<Object> property =
-                      gasm.SelectIf<Object>(gasm.ObjectIsSmi(data))
-                          .Then([&] { return data; })
-                          .Else([&] {
-                            return gasm.LoadField<Object>(
-                                AccessBuilder::ForContextSideProperty(),
-                                TNode<HeapObject>::UncheckedCast(data));
-                          })
-                          .Value();
-                  if (v8_flags.script_context_mutable_heap_int32) {
-                    return gasm
-                        .SelectIf<Object>(gasm.ReferenceEqual(
-                            property,
-                            TNode<Object>::UncheckedCast(gasm.SmiConstant(
-                                ContextSidePropertyCell::kMutableInt32))))
-                        .Then([&] {
-                          Node* number = gasm.LoadField(
-                              AccessBuilder::ForHeapInt32Value(), value);
-                          // Allocate a new HeapNumber.
-                          AllocationBuilder a(jsgraph(), broker(),
-                                              gasm.effect(), gasm.control());
-                          a.Allocate(sizeof(HeapNumber), AllocationType::kYoung,
-                                     Type::OtherInternal());
-                          a.Store(AccessBuilder::ForMap(),
-                                  broker()->heap_number_map());
-                          a.Store(AccessBuilder::ForHeapNumberValue(), number);
-                          Node* new_heap_number = a.Finish();
-                          gasm.UpdateEffectControlWith(new_heap_number);
-                          return TNode<Object>::UncheckedCast(new_heap_number);
-                        })
-                        .Else([&] {
-                          return gasm
-                              .SelectIf<Object>(gasm.ReferenceEqual(
-                                  property,
-                                  TNode<Object>::UncheckedCast(gasm.SmiConstant(
-                                      ContextSidePropertyCell::
-                                          kMutableHeapNumber))))
-                              .Then([&] {
-                                Node* number = gasm.LoadHeapNumberValue(value);
-                                // Allocate a new HeapNumber.
-                                AllocationBuilder a(jsgraph(), broker(),
-                                                    gasm.effect(),
-                                                    gasm.control());
-                                a.Allocate(sizeof(HeapNumber),
-                                           AllocationType::kYoung,
-                                           Type::OtherInternal());
-                                a.Store(AccessBuilder::ForMap(),
-                                        broker()->heap_number_map());
-                                a.Store(AccessBuilder::ForHeapNumberValue(),
-                                        number);
-                                Node* new_heap_number = a.Finish();
-                                gasm.UpdateEffectControlWith(new_heap_number);
-                                return TNode<Object>::UncheckedCast(
-                                    new_heap_number);
-                              })
-                              .Else([&] { return value; })
-                              .Value();
-                        })
-                        .Value();
-                  } else {
-                    return gasm
-                        .SelectIf<Object>(gasm.ReferenceEqual(
-                            property,
-                            TNode<Object>::UncheckedCast(gasm.SmiConstant(
-                                ContextSidePropertyCell::kMutableHeapNumber))))
-                        .Then([&] {
-                          Node* number = gasm.LoadHeapNumberValue(value);
-                          // Allocate a new HeapNumber.
-                          AllocationBuilder a(jsgraph(), broker(),
-                                              gasm.effect(), gasm.control());
-                          a.Allocate(sizeof(HeapNumber), AllocationType::kYoung,
-                                     Type::OtherInternal());
-                          a.Store(AccessBuilder::ForMap(),
-                                  broker()->heap_number_map());
-                          a.Store(AccessBuilder::ForHeapNumberValue(), number);
-                          Node* new_heap_number = a.Finish();
-                          gasm.UpdateEffectControlWith(new_heap_number);
-                          return TNode<Object>::UncheckedCast(new_heap_number);
-                        })
-                        .Else([&] { return value; })
-                        .Value();
-                  }
+                  TNode<HeapObject> heap_value =
+                      TNode<HeapObject>::UncheckedCast(value);
+                  TNode<Int32T> state = gasm.LoadField<Int32T>(
+                      AccessBuilder::ForContextCellState(), heap_value);
+                  static_assert(ContextCell::State::kConst == 0);
+                  static_assert(ContextCell::State::kSmi == 1);
+                  return gasm
+                      .MachineSelectIf<Object>(gasm.Int32LessThanOrEqual(
+                          state, gasm.Int32Constant(ContextCell::kSmi)))
+                      .Then([&] {
+                        return gasm.LoadField<Object>(
+                            AccessBuilder::ForContextCellTaggedValue(),
+                            heap_value);
+                      })
+                      .Else([&] {
+                        return gasm
+                            .MachineSelectIf<Object>(gasm.Word32Equal(
+                                state, gasm.Int32Constant(ContextCell::kInt32)))
+                            .Then([&] {
+                              return gasm.AllocateHeapNumber(gasm.LoadField(
+                                  AccessBuilder::ForContextCellInt32Value(),
+                                  value));
+                            })
+                            .Else([&] {
+                              return gasm.AllocateHeapNumber(gasm.LoadField(
+                                  AccessBuilder::ForContextCellFloat64Value(),
+                                  value));
+                            })
+                            .Value();
+                      })
+                      .Value();
                 })
                 .Else([&] { return value; })
                 .ExpectFalse()
@@ -1732,8 +1655,8 @@ Reduction JSTypedLowering::ReduceJSLoadScriptContext(Node* node) {
   return Changed(node);
 }
 
-Reduction JSTypedLowering::ReduceJSStoreContext(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSStoreContext, node->opcode());
+Reduction JSTypedLowering::ReduceJSStoreContextNoCell(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSStoreContextNoCell, node->opcode());
   ContextAccess const& access = ContextAccessOf(node->op());
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* context = NodeProperties::GetContextInput(node);
@@ -1754,8 +1677,8 @@ Reduction JSTypedLowering::ReduceJSStoreContext(Node* node) {
   return Changed(node);
 }
 
-Reduction JSTypedLowering::ReduceJSStoreScriptContext(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSStoreScriptContext, node->opcode());
+Reduction JSTypedLowering::ReduceJSStoreContext(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSStoreContext, node->opcode());
   ContextAccess const& access = ContextAccessOf(node->op());
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
@@ -1776,87 +1699,68 @@ Reduction JSTypedLowering::ReduceJSStoreScriptContext(Node* node) {
   TNode<Object> new_value =
       TNode<Object>::UncheckedCast(NodeProperties::GetValueInput(node, 0));
 
-  gasm.IfNot(gasm.ReferenceEqual(old_value, new_value)).Then([&] {
-    size_t side_data_index =
-        access.index() - Context::MIN_CONTEXT_EXTENDED_SLOTS;
-    TNode<FixedArray> side_data = gasm.LoadField<FixedArray>(
-        AccessBuilder::ForContextSlot(
-            Context::CONTEXT_SIDE_TABLE_PROPERTY_INDEX),
-        context);
-    TNode<Object> data = gasm.LoadField<Object>(
-        AccessBuilder::ForFixedArraySlot(side_data_index), side_data);
-
-    TNode<Boolean> is_other = gasm.ReferenceEqual(
-        data, TNode<Object>::UncheckedCast(
-                  gasm.SmiConstant(ContextSidePropertyCell::kOther)));
-    gasm.If(is_other)
-        .Then([&] {
-          gasm.StoreField(AccessBuilder::ForContextSlot(access.index()),
-                          context, new_value);
-        })
-        .Else([&] {
-          gasm.CheckIf(gasm.BooleanNot(gasm.IsUndefined(data)),
-                       DeoptimizeReason::kWrongValue);
-          TNode<Object> property =
-              gasm.SelectIf<Object>(gasm.ObjectIsSmi(data))
-                  .Then([&] { return data; })
-                  .Else([&] {
-                    return gasm.LoadField<Object>(
-                        AccessBuilder::ForContextSideProperty(),
-                        TNode<HeapObject>::UncheckedCast(data));
+  gasm.If(gasm.ObjectIsSmi(old_value))
+      .Then([&] {
+        gasm.StoreField(AccessBuilder::ForContextSlot(access.index()), context,
+                        new_value);
+      })
+      .Else([&] {
+        TNode<Map> old_value_map =
+            gasm.LoadMap(TNode<HeapObject>::UncheckedCast(old_value));
+        gasm.If(gasm.IsContextCellMap(old_value_map))
+            .Then([&] {
+              TNode<ContextCell> cell =
+                  TNode<ContextCell>::UncheckedCast(old_value);
+              TNode<Int32T> state = gasm.LoadField<Int32T>(
+                  AccessBuilder::ForContextCellState(), cell);
+              gasm
+                  .MachineIf(gasm.Word32Equal(
+                      state, gasm.Int32Constant(ContextCell::kFloat64)))
+                  .Then([&] {
+                    Node* number_value = gasm.CheckNumber(new_value);
+                    gasm.StoreField(AccessBuilder::ForContextCellFloat64Value(),
+                                    cell, number_value);
                   })
-                  .Value();
-          TNode<Boolean> is_const = gasm.ReferenceEqual(
-              property, TNode<Object>::UncheckedCast(
-                            gasm.SmiConstant(ContextSidePropertyCell::kConst)));
-          gasm.CheckIf(gasm.BooleanNot(is_const),
-                       DeoptimizeReason::kWrongValue);
-          if (v8_flags.script_context_mutable_heap_number) {
-            TNode<Boolean> is_smi_marker = gasm.ReferenceEqual(
-                property, TNode<Object>::UncheckedCast(
-                              gasm.SmiConstant(ContextSidePropertyCell::kSmi)));
-            gasm.If(is_smi_marker)
-                .Then([&] {
-                  Node* smi_value = gasm.CheckSmi(new_value);
-                  gasm.StoreField(
-                      AccessBuilder::ForContextSlotSmi(access.index()), context,
-                      smi_value);
-                })
-                .Else([&] {
-                  if (v8_flags.script_context_mutable_heap_int32) {
-                    TNode<Boolean> is_mutable_int32 = gasm.ReferenceEqual(
-                        property, TNode<Object>::UncheckedCast(gasm.SmiConstant(
-                                      ContextSidePropertyCell::kMutableInt32)));
-                    gasm.If(is_mutable_int32)
+                  .Else([&] {
+                    gasm
+                        .MachineIf(gasm.Word32Equal(
+                            state, gasm.Int32Constant(ContextCell::kInt32)))
                         .Then([&] {
-                          // It is a mutable int32 number.
                           Node* number_value =
                               gasm.CheckNumberFitsInt32(new_value);
-                          gasm.StoreField(AccessBuilder::ForHeapInt32Value(),
-                                          old_value, number_value);
+                          gasm.StoreField(
+                              AccessBuilder::ForContextCellInt32Value(), cell,
+                              number_value);
                         })
                         .Else([&] {
-                          // It must be a mutable heap number in this case.
-                          Node* number_value = gasm.CheckNumber(new_value);
-                          gasm.StoreField(AccessBuilder::ForHeapNumberValue(),
-                                          old_value, number_value);
+                          gasm
+                              .MachineIf(gasm.Word32Equal(
+                                  state, gasm.Int32Constant(ContextCell::kSmi)))
+                              .Then([&] {
+                                Node* smi_value = gasm.CheckSmi(new_value);
+                                gasm.StoreField(
+                                    AccessBuilder::ForContextCellTaggedValue(),
+                                    cell, smi_value);
+                              })
+                              .Else([&] {
+                                TNode<Object> tagged_value = gasm.LoadField<
+                                    Object>(
+                                    AccessBuilder::ForContextCellTaggedValue(),
+                                    cell);
+                                gasm.CheckIf(gasm.ReferenceEqual(tagged_value,
+                                                                 new_value),
+                                             DeoptimizeReason::kWrongValue);
+                              });
                         });
+                  });
+            })
+            .Else([&] {
+              gasm.StoreField(AccessBuilder::ForContextSlot(access.index()),
+                              context, new_value);
+            })
+            .ExpectFalse();
+      });
 
-                  } else {
-                    // It must be a mutable heap number in this case.
-                    Node* number_value = gasm.CheckNumber(new_value);
-                    gasm.StoreField(AccessBuilder::ForHeapNumberValue(),
-                                    old_value, number_value);
-                  }
-                });
-
-          } else {
-            gasm.StoreField(AccessBuilder::ForContextSlot(access.index()),
-                            context, new_value);
-          }
-        })
-        .ExpectTrue();
-  });
   ReplaceWithValue(node, gasm.effect(), gasm.effect(), gasm.control());
   return Changed(node);
 }
@@ -2203,8 +2107,9 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
     CallDescriptor::Flags flags = CallDescriptor::kNeedsFrameState;
     Node* new_target = jsgraph()->UndefinedConstant();
 
+    // TODO(412398354): use the dispatch handle here to avoid a runtime check.
     int formal_count =
-        shared->internal_formal_parameter_count_without_receiver();
+        shared->internal_formal_parameter_count_without_receiver_deprecated();
     if (formal_count > arity) {
       node->RemoveInput(n.FeedbackVectorIndex());
       // Underapplication. Massage the arguments to match the expected number of
@@ -2642,8 +2547,8 @@ Reduction JSTypedLowering::ReduceJSGeneratorRestoreContinuation(Node* node) {
   return Changed(continuation);
 }
 
-Reduction JSTypedLowering::ReduceJSGeneratorRestoreContext(Node* node) {
-  DCHECK_EQ(IrOpcode::kJSGeneratorRestoreContext, node->opcode());
+Reduction JSTypedLowering::ReduceJSGeneratorRestoreContextNoCell(Node* node) {
+  DCHECK_EQ(IrOpcode::kJSGeneratorRestoreContextNoCell, node->opcode());
 
   const Operator* new_op =
       simplified()->LoadField(AccessBuilder::ForJSGeneratorObjectContext());
@@ -2893,14 +2798,14 @@ Reduction JSTypedLowering::Reduce(Node* node) {
       return ReduceJSToObject(node);
     case IrOpcode::kJSLoadNamed:
       return ReduceJSLoadNamed(node);
+    case IrOpcode::kJSLoadContextNoCell:
+      return ReduceJSLoadContextNoCell(node);
     case IrOpcode::kJSLoadContext:
       return ReduceJSLoadContext(node);
-    case IrOpcode::kJSLoadScriptContext:
-      return ReduceJSLoadScriptContext(node);
+    case IrOpcode::kJSStoreContextNoCell:
+      return ReduceJSStoreContextNoCell(node);
     case IrOpcode::kJSStoreContext:
       return ReduceJSStoreContext(node);
-    case IrOpcode::kJSStoreScriptContext:
-      return ReduceJSStoreScriptContext(node);
     case IrOpcode::kJSLoadModule:
       return ReduceJSLoadModule(node);
     case IrOpcode::kJSStoreModule:
@@ -2927,8 +2832,8 @@ Reduction JSTypedLowering::Reduce(Node* node) {
       return ReduceJSGeneratorStore(node);
     case IrOpcode::kJSGeneratorRestoreContinuation:
       return ReduceJSGeneratorRestoreContinuation(node);
-    case IrOpcode::kJSGeneratorRestoreContext:
-      return ReduceJSGeneratorRestoreContext(node);
+    case IrOpcode::kJSGeneratorRestoreContextNoCell:
+      return ReduceJSGeneratorRestoreContextNoCell(node);
     case IrOpcode::kJSGeneratorRestoreRegister:
       return ReduceJSGeneratorRestoreRegister(node);
     case IrOpcode::kJSGeneratorRestoreInputOrDebugPos:
diff --git a/deps/v8/src/compiler/js-typed-lowering.h b/deps/v8/src/compiler/js-typed-lowering.h
index d72bd0c06ac1f6..38cd20f3d8039b 100644
--- a/deps/v8/src/compiler/js-typed-lowering.h
+++ b/deps/v8/src/compiler/js-typed-lowering.h
@@ -51,10 +51,10 @@ class V8_EXPORT_PRIVATE JSTypedLowering final
   Reduction ReduceJSHasInPrototypeChain(Node* node);
   Reduction ReduceJSOrdinaryHasInstance(Node* node);
   Reduction ReduceJSHasContextExtension(Node* node);
+  Reduction ReduceJSLoadContextNoCell(Node* node);
   Reduction ReduceJSLoadContext(Node* node);
-  Reduction ReduceJSLoadScriptContext(Node* node);
+  Reduction ReduceJSStoreContextNoCell(Node* node);
   Reduction ReduceJSStoreContext(Node* node);
-  Reduction ReduceJSStoreScriptContext(Node* node);
   Reduction ReduceJSLoadModule(Node* node);
   Reduction ReduceJSStoreModule(Node* node);
   Reduction ReduceJSEqual(Node* node);
@@ -79,7 +79,7 @@ class V8_EXPORT_PRIVATE JSTypedLowering final
   Reduction ReduceJSStoreMessage(Node* node);
   Reduction ReduceJSGeneratorStore(Node* node);
   Reduction ReduceJSGeneratorRestoreContinuation(Node* node);
-  Reduction ReduceJSGeneratorRestoreContext(Node* node);
+  Reduction ReduceJSGeneratorRestoreContextNoCell(Node* node);
   Reduction ReduceJSGeneratorRestoreRegister(Node* node);
   Reduction ReduceJSGeneratorRestoreInputOrDebugPos(Node* node);
   Reduction ReduceNumberBinop(Node* node);
diff --git a/deps/v8/src/compiler/machine-operator.cc b/deps/v8/src/compiler/machine-operator.cc
index 2b7607485a3b7f..52a53ca5ac95e7 100644
--- a/deps/v8/src/compiler/machine-operator.cc
+++ b/deps/v8/src/compiler/machine-operator.cc
@@ -869,7 +869,7 @@ std::ostream& operator<<(std::ostream& os, TruncateKind kind) {
   V(Float64InsertHighWord32, Operator::kNoProperties, 2, 0, 1)             \
   V(LoadStackCheckOffset, Operator::kNoProperties, 0, 0, 1)                \
   V(LoadFramePointer, Operator::kNoProperties, 0, 0, 1)                    \
-  V(LoadRootRegister, Operator::kNoProperties, 0, 0, 1)                    \
+  V(LoadRootRegister, Operator::kPure, 0, 0, 1)                            \
   V(LoadParentFramePointer, Operator::kNoProperties, 0, 0, 1)              \
   V(Int32PairAdd, Operator::kNoProperties, 4, 0, 2)                        \
   V(Int32PairSub, Operator::kNoProperties, 4, 0, 2)                        \
diff --git a/deps/v8/src/compiler/opcodes.h b/deps/v8/src/compiler/opcodes.h
index 6491cb60c4872c..04d0c024e808b5 100644
--- a/deps/v8/src/compiler/opcodes.h
+++ b/deps/v8/src/compiler/opcodes.h
@@ -200,10 +200,10 @@
 
 #define JS_CONTEXT_OP_LIST(V) \
   V(JSHasContextExtension)    \
+  V(JSLoadContextNoCell)      \
   V(JSLoadContext)            \
-  V(JSLoadScriptContext)      \
+  V(JSStoreContextNoCell)     \
   V(JSStoreContext)           \
-  V(JSStoreScriptContext)     \
   V(JSCreateFunctionContext)  \
   V(JSCreateCatchContext)     \
   V(JSCreateWithContext)      \
@@ -241,7 +241,7 @@
   V(JSGetImportMeta)                   \
   V(JSGeneratorStore)                  \
   V(JSGeneratorRestoreContinuation)    \
-  V(JSGeneratorRestoreContext)         \
+  V(JSGeneratorRestoreContextNoCell)   \
   V(JSGeneratorRestoreRegister)        \
   V(JSGeneratorRestoreInputOrDebugPos) \
   V(JSFulfillPromise)                  \
diff --git a/deps/v8/src/compiler/operator-properties.cc b/deps/v8/src/compiler/operator-properties.cc
index 3a44223ce188e9..6cd6207b77d47c 100644
--- a/deps/v8/src/compiler/operator-properties.cc
+++ b/deps/v8/src/compiler/operator-properties.cc
@@ -45,7 +45,7 @@ bool OperatorProperties::NeedsExactContext(const Operator* op) {
     case IrOpcode::kJSForInEnumerate:
     case IrOpcode::kJSForInNext:
     case IrOpcode::kJSForInPrepare:
-    case IrOpcode::kJSGeneratorRestoreContext:
+    case IrOpcode::kJSGeneratorRestoreContextNoCell:
     case IrOpcode::kJSGeneratorRestoreContinuation:
     case IrOpcode::kJSGeneratorRestoreInputOrDebugPos:
     case IrOpcode::kJSGeneratorRestoreRegister:
@@ -78,14 +78,14 @@ bool OperatorProperties::NeedsExactContext(const Operator* op) {
     case IrOpcode::kJSGetImportMeta:
     case IrOpcode::kJSHasProperty:
     case IrOpcode::kJSHasContextExtension:
+    case IrOpcode::kJSLoadContextNoCell:
     case IrOpcode::kJSLoadContext:
-    case IrOpcode::kJSLoadScriptContext:
     case IrOpcode::kJSLoadModule:
     case IrOpcode::kJSLoadNamed:
     case IrOpcode::kJSLoadNamedFromSuper:
     case IrOpcode::kJSLoadProperty:
+    case IrOpcode::kJSStoreContextNoCell:
     case IrOpcode::kJSStoreContext:
-    case IrOpcode::kJSStoreScriptContext:
     case IrOpcode::kJSDefineKeyedOwnPropertyInLiteral:
     case IrOpcode::kJSStoreGlobal:
     case IrOpcode::kJSStoreInArrayLiteral:
diff --git a/deps/v8/src/compiler/pipeline.cc b/deps/v8/src/compiler/pipeline.cc
index 29f17cac8bb14d..3c3485e28353a5 100644
--- a/deps/v8/src/compiler/pipeline.cc
+++ b/deps/v8/src/compiler/pipeline.cc
@@ -10,6 +10,7 @@
 #include <optional>
 #include <sstream>
 
+#include "src/base/macros.h"
 #include "src/builtins/builtins.h"
 #include "src/builtins/profile-data-reader.h"
 #include "src/codegen/bailout-reason.h"
@@ -36,6 +37,7 @@
 #include "src/compiler/code-assembler.h"
 #include "src/compiler/common-operator-reducer.h"
 #include "src/compiler/common-operator.h"
+#include "src/compiler/compilation-dependencies.h"
 #include "src/compiler/compiler-source-position-table.h"
 #include "src/compiler/constant-folding-reducer.h"
 #include "src/compiler/csa-load-elimination.h"
@@ -147,49 +149,47 @@ namespace compiler {
 static constexpr char kPipelineCompilationJobZoneName[] =
     "pipeline-compilation-job-zone";
 
+#define RUN_MAYBE_ABORT(phase, ...) \
+  if (V8_UNLIKELY(!Run<phase>(__VA_ARGS__))) return {};
+
+#define PIPELINE_RUN_MAYBE_ABORT(pipeline, phase, ...) \
+  if (V8_UNLIKELY(!(pipeline).Run<phase>(__VA_ARGS__))) return {};
+
 class PipelineImpl final {
  public:
   explicit PipelineImpl(TFPipelineData* data) : data_(data) {}
 
   // Helpers for executing pipeline phases.
   template <turboshaft::TurbofanPhase Phase, typename... Args>
-  auto Run(Args&&... args);
+  V8_WARN_UNUSED_RESULT bool Run(Args&&... args);
 
   // Step A.1. Initialize the heap broker.
-  void InitializeHeapBroker();
+  V8_WARN_UNUSED_RESULT bool InitializeHeapBroker();
 
   // Step A.2. Run the graph creation and initial optimization passes.
-  bool CreateGraph(Linkage* linkage);
+  V8_WARN_UNUSED_RESULT bool CreateGraph(Linkage* linkage);
 
   // Step B. Run the concurrent optimization passes.
   bool OptimizeTurbofanGraph(Linkage* linkage);
 
   // Substep B.1. Produce a scheduled graph.
-  void ComputeScheduledGraph();
+  V8_WARN_UNUSED_RESULT bool ComputeScheduledGraph();
 
 #if V8_ENABLE_WASM_SIMD256_REVEC
-  void Revectorize();
+  V8_WARN_UNUSED_RESULT bool Revectorize();
 #endif  // V8_ENABLE_WASM_SIMD256_REVEC
 
   // Substep B.3. Run register allocation on the instruction sequence.
-  bool AllocateRegisters(CallDescriptor* call_descriptor,
-                         bool has_dummy_end_block);
+  V8_WARN_UNUSED_RESULT bool AllocateRegisters(CallDescriptor* call_descriptor,
+                                               bool has_dummy_end_block);
 
-  // Step C. Run the code assembly pass.
-  void AssembleCode(Linkage* linkage);
-
-  // Step D. Run the code finalization pass.
+  // Step C. Run the code finalization pass.
   MaybeDirectHandle<Code> FinalizeCode(bool retire_broker = true);
 
-  // Step E. Ensure all embedded maps are non-deprecated using
-  // CheckNoDeprecatedMaps.
-
-  // Step F. Install any code dependencies.
+  // Step D. Install any code dependencies.
   bool CommitDependencies(Handle<Code> code);
 
   void RunPrintAndVerify(const char* phase, bool untyped = false);
-  void AllocateRegisters(const RegisterConfiguration* config,
-                         CallDescriptor* call_descriptor, bool run_verifier);
 
   TFPipelineData* data() const { return data_; }
   OptimizedCompilationInfo* info() const;
@@ -486,13 +486,18 @@ TurbofanPipelineStatistics* CreatePipelineStatistics(
   turboshaft::PipelineData* turboshaft_data = turboshaft_pipeline.data();
   turboshaft_data->InitializeCodegenComponent(osr_helper);
   // Run Turboshaft instruction selection.
-  turboshaft_pipeline.PrepareForInstructionSelection();
+  if (!turboshaft_pipeline.PrepareForInstructionSelection()) return false;
   if (!turboshaft_pipeline.SelectInstructions(linkage)) return false;
   // We can release the graph now.
   turboshaft_data->ClearGraphComponent();
 
-  turboshaft_pipeline.AllocateRegisters(linkage->GetIncomingDescriptor());
-  turboshaft_pipeline.AssembleCode(linkage);
+  if (!turboshaft_pipeline.AllocateRegisters(
+          linkage->GetIncomingDescriptor())) {
+    return false;
+  }
+  if (!turboshaft_pipeline.AssembleCode(linkage)) {
+    return false;
+  }
   return true;
 }
 
@@ -746,7 +751,9 @@ PipelineCompilationJob::Status PipelineCompilationJob::PrepareJobImpl(
   // IsPendingAllocation.
   isolate->heap()->PublishMainThreadPendingAllocations();
 
-  pipeline_.InitializeHeapBroker();
+  if (!pipeline_.InitializeHeapBroker()) {
+    return FAILED;
+  }
 
   // Serialization may have allocated.
   isolate->heap()->PublishMainThreadPendingAllocations();
@@ -765,6 +772,9 @@ PipelineCompilationJob::Status PipelineCompilationJob::ExecuteJobImpl(
   turboshaft_data_.InitializeBrokerAndDependencies(data_.broker_ptr(),
                                                    data_.dependencies());
   turboshaft::Pipeline turboshaft_pipeline(&turboshaft_data_);
+  if (compilation_info_.was_cancelled()) {
+    return AbortOptimization(BailoutReason::kCancelled);
+  }
 
   if (V8_UNLIKELY(v8_flags.turbolev)) {
     if (!turboshaft_pipeline.CreateGraphWithMaglev(linkage_)) {
@@ -828,7 +838,7 @@ PipelineCompilationJob::Status PipelineCompilationJob::FinalizeJobImpl(
 }
 
 template <turboshaft::TurbofanPhase Phase, typename... Args>
-auto PipelineImpl::Run(Args&&... args) {
+bool PipelineImpl::Run(Args&&... args) {
 #ifdef V8_RUNTIME_CALL_STATS
   PipelineRunScope scope(this->data_, Phase::phase_name(),
                          Phase::kRuntimeCallCounterId, Phase::kCounterMode);
@@ -837,7 +847,8 @@ auto PipelineImpl::Run(Args&&... args) {
 #endif
   Phase phase;
   static_assert(Phase::kKind == PhaseKind::kTurbofan);
-  return phase.Run(this->data_, scope.zone(), std::forward<Args>(args)...);
+  phase.Run(this->data_, scope.zone(), std::forward<Args>(args)...);
+  return !info()->was_cancelled();
 }
 
 struct GraphBuilderPhase {
@@ -1791,8 +1802,8 @@ CompilationJob::Status WasmHeapStubCompilationJob::ExecuteJobImpl(
   }
   TraceWrapperCompilation("Turbofan", &info_, &data_);
   pipeline_.RunPrintAndVerify("V8.WasmMachineCode", true);
-  pipeline_.Run<MemoryOptimizationPhase>();
-  pipeline_.ComputeScheduledGraph();
+  if (!pipeline_.Run<MemoryOptimizationPhase>()) return FAILED;
+  if (!pipeline_.ComputeScheduledGraph()) return FAILED;
 
   turboshaft::Pipeline turboshaft_pipeline(&turboshaft_data_);
 
@@ -1804,7 +1815,9 @@ CompilationJob::Status WasmHeapStubCompilationJob::ExecuteJobImpl(
 
   // We need to run simplification to normalize some patterns for instruction
   // selection (e.g. loads and stores).
-  turboshaft_pipeline.RunSimplificationAndNormalizationPhase();
+  if (!turboshaft_pipeline.RunSimplificationAndNormalizationPhase()) {
+    return FAILED;
+  }
 
   const bool success = GenerateCodeFromTurboshaftGraph(
       &linkage, turboshaft_pipeline, &pipeline_, data_.osr_helper_ptr());
@@ -1858,26 +1871,36 @@ CompilationJob::Status WasmTurboshaftWrapperCompilationJob::ExecuteJobImpl(
   // wrappers.
   // TODO(14108): Do we need value numbering if wasm_opt is turned off?
   if (v8_flags.wasm_opt) {
-    turboshaft_pipeline.Run<turboshaft::WasmOptimizePhase>();
+    if (!turboshaft_pipeline.Run<turboshaft::WasmOptimizePhase>()) {
+      return FAILED;
+    }
   }
 #if DEBUG
   if (!v8_flags.wasm_opt) {
     // We still need to lower allocation operations even with optimizations
     // being turned off.
-    turboshaft_pipeline.Run<turboshaft::WasmDebugMemoryLoweringPhase>();
+    if (!turboshaft_pipeline.Run<turboshaft::WasmDebugMemoryLoweringPhase>()) {
+      return FAILED;
+    }
   }
 #endif
 
   if (!Is64()) {
-    turboshaft_pipeline.Run<turboshaft::Int64LoweringPhase>();
+    if (!turboshaft_pipeline.Run<turboshaft::Int64LoweringPhase>()) {
+      return FAILED;
+    }
   }
 
-  turboshaft_pipeline.Run<turboshaft::WasmDeadCodeEliminationPhase>();
+  if (!turboshaft_pipeline.Run<turboshaft::WasmDeadCodeEliminationPhase>()) {
+    return FAILED;
+  }
 
   if (V8_UNLIKELY(v8_flags.turboshaft_enable_debug_features)) {
     // This phase has to run very late to allow all previous phases to use
     // debug features.
-    turboshaft_pipeline.Run<turboshaft::DebugFeatureLoweringPhase>();
+    if (!turboshaft_pipeline.Run<turboshaft::DebugFeatureLoweringPhase>()) {
+      return FAILED;
+    }
   }
 
   turboshaft_pipeline.BeginPhaseKind("V8.InstructionSelection");
@@ -1898,14 +1921,14 @@ CompilationJob::Status WasmTurboshaftWrapperCompilationJob::FinalizeJobImpl(
 
 void PipelineImpl::RunPrintAndVerify(const char* phase, bool untyped) {
   if (info()->trace_turbo_json() || info()->trace_turbo_graph()) {
-    Run<PrintGraphPhase>(phase);
+    USE(Run<PrintGraphPhase>(phase));
   }
   if (v8_flags.turbo_verify) {
-    Run<VerifyGraphPhase>(untyped);
+    USE(Run<VerifyGraphPhase>(untyped));
   }
 }
 
-void PipelineImpl::InitializeHeapBroker() {
+bool PipelineImpl::InitializeHeapBroker() {
   TFPipelineData* data = data_;
 
   data->BeginPhaseKind("V8.TFBrokerInitAndSerialization");
@@ -1932,9 +1955,10 @@ void PipelineImpl::InitializeHeapBroker() {
     data->node_origins()->AddDecorator();
   }
 
-  Run<HeapBrokerInitializationPhase>();
+  RUN_MAYBE_ABORT(HeapBrokerInitializationPhase);
   data->broker()->StopSerializing();
   data->EndPhaseKind();
+  return !info()->was_cancelled();
 }
 
 bool PipelineImpl::CreateGraph(Linkage* linkage) {
@@ -1944,11 +1968,11 @@ bool PipelineImpl::CreateGraph(Linkage* linkage) {
 
   data->BeginPhaseKind("V8.TFGraphCreation");
 
-  Run<GraphBuilderPhase>(linkage);
+  RUN_MAYBE_ABORT(GraphBuilderPhase, linkage);
   RunPrintAndVerify(GraphBuilderPhase::phase_name(), true);
 
   // Perform function context specialization and inlining (if enabled).
-  Run<InliningPhase>();
+  RUN_MAYBE_ABORT(InliningPhase);
   RunPrintAndVerify(InliningPhase::phase_name(), true);
 
   // Determine the Typer operation flags.
@@ -1968,7 +1992,7 @@ bool PipelineImpl::CreateGraph(Linkage* linkage) {
 
   data->EndPhaseKind();
 
-  return true;
+  return !info()->was_cancelled();
 }
 
 bool PipelineImpl::OptimizeTurbofanGraph(Linkage* linkage) {
@@ -1978,65 +2002,68 @@ bool PipelineImpl::OptimizeTurbofanGraph(Linkage* linkage) {
   data->BeginPhaseKind("V8.TFLowering");
 
   // Trim the graph before typing to ensure all nodes are typed.
-  Run<EarlyGraphTrimmingPhase>();
+  RUN_MAYBE_ABORT(EarlyGraphTrimmingPhase);
   RunPrintAndVerify(EarlyGraphTrimmingPhase::phase_name(), true);
 
   // Type the graph and keep the Typer running such that new nodes get
   // automatically typed when they are created.
-  Run<TyperPhase>(data->CreateTyper());
+  RUN_MAYBE_ABORT(TyperPhase, data->CreateTyper());
   RunPrintAndVerify(TyperPhase::phase_name());
 
-  Run<TypedLoweringPhase>();
+  RUN_MAYBE_ABORT(TypedLoweringPhase);
   RunPrintAndVerify(TypedLoweringPhase::phase_name());
 
   if (data->info()->loop_peeling()) {
-    Run<LoopPeelingPhase>();
+    RUN_MAYBE_ABORT(LoopPeelingPhase);
     RunPrintAndVerify(LoopPeelingPhase::phase_name(), true);
   } else {
-    Run<LoopExitEliminationPhase>();
+    RUN_MAYBE_ABORT(LoopExitEliminationPhase);
     RunPrintAndVerify(LoopExitEliminationPhase::phase_name(), true);
   }
 
   if (v8_flags.turbo_load_elimination) {
-    Run<LoadEliminationPhase>();
+    RUN_MAYBE_ABORT(LoadEliminationPhase);
     RunPrintAndVerify(LoadEliminationPhase::phase_name());
   }
   data->DeleteTyper();
 
   if (v8_flags.turbo_escape) {
-    Run<EscapeAnalysisPhase>();
+    RUN_MAYBE_ABORT(EscapeAnalysisPhase);
     RunPrintAndVerify(EscapeAnalysisPhase::phase_name());
   }
 
   if (v8_flags.assert_types) {
-    Run<TypeAssertionsPhase>();
+    RUN_MAYBE_ABORT(TypeAssertionsPhase);
     RunPrintAndVerify(TypeAssertionsPhase::phase_name());
   }
 
   // Perform simplified lowering. This has to run w/o the Typer decorator,
   // because we cannot compute meaningful types anyways, and the computed
   // types might even conflict with the representation/truncation logic.
-  Run<SimplifiedLoweringPhase>(linkage);
+  RUN_MAYBE_ABORT(SimplifiedLoweringPhase, linkage);
   RunPrintAndVerify(SimplifiedLoweringPhase::phase_name(), true);
 
 #if V8_ENABLE_WEBASSEMBLY
   if (data->has_js_wasm_calls()) {
     DCHECK(data->info()->inline_js_wasm_calls());
-    Run<JSWasmInliningPhase>();
+    RUN_MAYBE_ABORT(JSWasmInliningPhase);
     RunPrintAndVerify(JSWasmInliningPhase::phase_name(), true);
-    Run<WasmTypingPhase>(-1);
+
+    RUN_MAYBE_ABORT(WasmTypingPhase, -1);
     RunPrintAndVerify(WasmTypingPhase::phase_name(), true);
+
     if (v8_flags.wasm_opt) {
-      Run<WasmGCOptimizationPhase>(data->wasm_module_for_inlining(),
-                                   data->jsgraph());
+      RUN_MAYBE_ABORT(WasmGCOptimizationPhase, data->wasm_module_for_inlining(),
+                      data->jsgraph());
       RunPrintAndVerify(WasmGCOptimizationPhase::phase_name(), true);
     }
-    Run<JSWasmLoweringPhase>();
+    RUN_MAYBE_ABORT(JSWasmLoweringPhase);
     RunPrintAndVerify(JSWasmLoweringPhase::phase_name(), true);
+
     if (v8_flags.turbo_optimize_inlined_js_wasm_wrappers && v8_flags.wasm_opt) {
       wasm::WasmDetectedFeatures detected({wasm::WasmDetectedFeature::gc});
-      Run<WasmOptimizationPhase>(MachineOperatorReducer::kSilenceSignallingNan,
-                                 detected);
+      RUN_MAYBE_ABORT(WasmOptimizationPhase,
+                      MachineOperatorReducer::kSilenceSignallingNan, detected);
       RunPrintAndVerify(WasmOptimizationPhase::phase_name(), true);
     }
   }
@@ -2051,12 +2078,12 @@ bool PipelineImpl::OptimizeTurbofanGraph(Linkage* linkage) {
   // In order to catch bugs related to type access after this point, we now
   // remove the types from the nodes (currently only in Debug builds).
 #ifdef DEBUG
-  Run<UntyperPhase>();
+  RUN_MAYBE_ABORT(UntyperPhase);
   RunPrintAndVerify(UntyperPhase::phase_name(), true);
 #endif
 
   // Run generic lowering pass.
-  Run<GenericLoweringPhase>();
+  RUN_MAYBE_ABORT(GenericLoweringPhase);
   RunPrintAndVerify(GenericLoweringPhase::phase_name(), true);
 
   data->BeginPhaseKind("V8.TFBlockBuilding");
@@ -2064,7 +2091,7 @@ bool PipelineImpl::OptimizeTurbofanGraph(Linkage* linkage) {
   data->InitializeFrameData(linkage->GetIncomingDescriptor());
 
   // Run early optimization pass.
-  Run<EarlyOptimizationPhase>();
+  RUN_MAYBE_ABORT(EarlyOptimizationPhase);
   RunPrintAndVerify(EarlyOptimizationPhase::phase_name(), true);
 
   data->source_positions()->RemoveDecorator();
@@ -2072,9 +2099,9 @@ bool PipelineImpl::OptimizeTurbofanGraph(Linkage* linkage) {
     data->node_origins()->RemoveDecorator();
   }
 
-  ComputeScheduledGraph();
+  if (!ComputeScheduledGraph()) return false;
 
-  return true;
+  return !info()->was_cancelled();
 }
 
 namespace {
@@ -2312,7 +2339,7 @@ PipelineCompilationJob::Status CodeAssemblerCompilationJob::PrepareJobImpl(
                               DirectHandle<SharedFunctionInfo>());
       json_of << ",\n\"phases\":[";
     }
-    pipeline->Run<PrintGraphPhase>("V8.TFMachineCode");
+    if (!pipeline->Run<PrintGraphPhase>("V8.TFMachineCode")) return FAILED;
   }
 
   // Validate pgo profile.
@@ -2386,7 +2413,7 @@ PipelineImpl* CodeAssemblerTurboshaftCompilationJob::EmplacePipeline(
 PipelineCompilationJob::Status
 CodeAssemblerTurboshaftCompilationJob::ExecuteJobImpl(
     RuntimeCallStats* stats, LocalIsolate* local_isolate) {
-  pipeline_->pipeline.ComputeScheduledGraph();
+  if (!pipeline_->pipeline.ComputeScheduledGraph()) return FAILED;
   DCHECK_NULL(pipeline_->data.frame());
   DCHECK_NOT_NULL(pipeline_->data.schedule());
 
@@ -2627,10 +2654,10 @@ wasm::WasmCompilationResult Pipeline::GenerateCodeForWasmNativeStub(
   PipelineImpl pipeline(&data);
   pipeline.RunPrintAndVerify("V8.WasmNativeStubMachineCode", true);
 
-  pipeline.Run<MemoryOptimizationPhase>();
+  CHECK(pipeline.Run<MemoryOptimizationPhase>());
   pipeline.RunPrintAndVerify(MemoryOptimizationPhase::phase_name(), true);
 
-  pipeline.ComputeScheduledGraph();
+  CHECK(pipeline.ComputeScheduledGraph());
 
   Linkage linkage(call_descriptor);
 
@@ -2642,7 +2669,7 @@ wasm::WasmCompilationResult Pipeline::GenerateCodeForWasmNativeStub(
   CHECK(turboshaft_pipeline.CreateGraphFromTurbofan(&data, &linkage));
   // We need to run simplification to normalize some patterns for instruction
   // selection (e.g. loads and stores).
-  turboshaft_pipeline.RunSimplificationAndNormalizationPhase();
+  CHECK(turboshaft_pipeline.RunSimplificationAndNormalizationPhase());
 
   CHECK(GenerateCodeFromTurboshaftGraph(&linkage, turboshaft_pipeline,
                                         &pipeline, data.osr_helper_ptr()));
@@ -2718,26 +2745,27 @@ Pipeline::GenerateCodeForWasmNativeStubFromTurboshaft(
     // TODO(14108): Do we need value numbering if wasm_opt is turned off?
     turboshaft::Pipeline turboshaft_pipeline(&turboshaft_data);
     if (v8_flags.wasm_opt) {
-      turboshaft_pipeline.Run<turboshaft::WasmOptimizePhase>();
+      CHECK(turboshaft_pipeline.Run<turboshaft::WasmOptimizePhase>());
     }
 #if DEBUG
     if (!v8_flags.wasm_opt) {
       // We still need to lower allocation operations even with optimizations
       // being turned off.
-      turboshaft_pipeline.Run<turboshaft::WasmDebugMemoryLoweringPhase>();
+      CHECK(
+          turboshaft_pipeline.Run<turboshaft::WasmDebugMemoryLoweringPhase>());
     }
 #endif
 
     if (!Is64()) {
-      turboshaft_pipeline.Run<turboshaft::Int64LoweringPhase>();
+      CHECK(turboshaft_pipeline.Run<turboshaft::Int64LoweringPhase>());
     }
 
-    turboshaft_pipeline.Run<turboshaft::WasmDeadCodeEliminationPhase>();
+    CHECK(turboshaft_pipeline.Run<turboshaft::WasmDeadCodeEliminationPhase>());
 
     if (V8_UNLIKELY(v8_flags.turboshaft_enable_debug_features)) {
       // This phase has to run very late to allow all previous phases to use
       // debug features.
-      turboshaft_pipeline.Run<turboshaft::DebugFeatureLoweringPhase>();
+      CHECK(turboshaft_pipeline.Run<turboshaft::DebugFeatureLoweringPhase>());
     }
 
     data.BeginPhaseKind("V8.InstructionSelection");
@@ -2897,7 +2925,7 @@ wasm::WasmCompilationResult Pipeline::GenerateWasmCode(
         std::cout << "Begin revec function "
                   << data.info()->GetDebugName().get() << std::endl;
       }
-      turboshaft_pipeline.Run<turboshaft::WasmRevecPhase>();
+      CHECK(turboshaft_pipeline.Run<turboshaft::WasmRevecPhase>());
       if (v8_flags.trace_wasm_revectorize) {
         std::cout << "Finished revec function "
                   << data.info()->GetDebugName().get() << std::endl;
@@ -2911,17 +2939,17 @@ wasm::WasmCompilationResult Pipeline::GenerateWasmCode(
       detected->has_stringref() || detected->has_imported_strings() ||
       detected->has_imported_strings_utf8();
   if (v8_flags.wasm_loop_peeling && uses_wasm_gc_features) {
-    turboshaft_pipeline.Run<turboshaft::LoopPeelingPhase>();
+    CHECK(turboshaft_pipeline.Run<turboshaft::LoopPeelingPhase>());
   }
 
   if (v8_flags.wasm_loop_unrolling) {
     // TODO(384870251): Note that if we don't run this, subsequent analyses and
     // optimizations (DCE, decompression optimization) can run much slower.
-    turboshaft_pipeline.Run<turboshaft::LoopUnrollingPhase>();
+    CHECK(turboshaft_pipeline.Run<turboshaft::LoopUnrollingPhase>());
   }
 
   if (v8_flags.wasm_opt && uses_wasm_gc_features) {
-    turboshaft_pipeline.Run<turboshaft::WasmGCOptimizePhase>();
+    CHECK(turboshaft_pipeline.Run<turboshaft::WasmGCOptimizePhase>());
   }
 
   // TODO(mliedtke): This phase could be merged with the WasmGCOptimizePhase
@@ -2929,18 +2957,18 @@ wasm::WasmCompilationResult Pipeline::GenerateWasmCode(
   // size increase.
   // TODO(384870251,dmercardier): Run a CopyingPhase with LoopFinder to
   // improve block ordering, independent of loop unrolling.
-  turboshaft_pipeline.Run<turboshaft::WasmLoweringPhase>();
+  CHECK(turboshaft_pipeline.Run<turboshaft::WasmLoweringPhase>());
 
   // TODO(14108): Do we need value numbering if wasm_opt is turned off?
   const bool is_asm_js = is_asmjs_module(module);
   if (v8_flags.wasm_opt || is_asm_js) {
-    turboshaft_pipeline.Run<turboshaft::WasmOptimizePhase>();
+    CHECK(turboshaft_pipeline.Run<turboshaft::WasmOptimizePhase>());
   }
 
 #if V8_TARGET_ARCH_ARM64
   if (v8_flags.experimental_wasm_simd_opt && v8_flags.wasm_opt &&
       detected->has_simd()) {
-    turboshaft_pipeline.Run<turboshaft::WasmSimdPhase>();
+    CHECK(turboshaft_pipeline.Run<turboshaft::WasmSimdPhase>());
   }
 #endif  // V8_TARGET_ARCH_ARM64
 
@@ -2948,20 +2976,20 @@ wasm::WasmCompilationResult Pipeline::GenerateWasmCode(
   if (!v8_flags.wasm_opt) {
     // We still need to lower allocation operations even with optimizations
     // being turned off.
-    turboshaft_pipeline.Run<turboshaft::WasmDebugMemoryLoweringPhase>();
+    CHECK(turboshaft_pipeline.Run<turboshaft::WasmDebugMemoryLoweringPhase>());
   }
 #endif
 
   if (mcgraph->machine()->Is32()) {
-    turboshaft_pipeline.Run<turboshaft::Int64LoweringPhase>();
+    CHECK(turboshaft_pipeline.Run<turboshaft::Int64LoweringPhase>());
   }
 
-  turboshaft_pipeline.Run<turboshaft::WasmDeadCodeEliminationPhase>();
+  CHECK(turboshaft_pipeline.Run<turboshaft::WasmDeadCodeEliminationPhase>());
 
   if (V8_UNLIKELY(v8_flags.turboshaft_enable_debug_features)) {
     // This phase has to run very late to allow all previous phases to use
     // debug features.
-    turboshaft_pipeline.Run<turboshaft::DebugFeatureLoweringPhase>();
+    CHECK(turboshaft_pipeline.Run<turboshaft::DebugFeatureLoweringPhase>());
   }
 
   data.BeginPhaseKind("V8.InstructionSelection");
@@ -3085,7 +3113,7 @@ MaybeHandle<Code> Pipeline::GenerateCodeForTesting(
   {
     CompilationHandleScope compilation_scope(isolate, info);
     info->ReopenAndCanonicalizeHandlesInNewScope(isolate);
-    pipeline.InitializeHeapBroker();
+    if (!pipeline.InitializeHeapBroker()) return {};
   }
 
   {
@@ -3168,7 +3196,7 @@ MaybeHandle<Code> Pipeline::GenerateCodeForTesting(
 
   // Ensure we have a schedule.
   if (data.schedule() == nullptr) {
-    pipeline.ComputeScheduledGraph();
+    CHECK(pipeline.ComputeScheduledGraph());
   }
 
   Linkage linkage(call_descriptor);
@@ -3180,7 +3208,9 @@ MaybeHandle<Code> Pipeline::GenerateCodeForTesting(
 
   // We need to run simplification to normalize some patterns for instruction
   // selection (e.g. loads and stores).
-  turboshaft_pipeline.RunSimplificationAndNormalizationPhase();
+  if (!turboshaft_pipeline.RunSimplificationAndNormalizationPhase()) {
+    return {};
+  }
 
   if (!GenerateCodeFromTurboshaftGraph(&linkage, turboshaft_pipeline, nullptr,
                                        data.osr_helper_ptr())) {
@@ -3248,18 +3278,19 @@ std::unique_ptr<TurbofanCompilationJob> Pipeline::NewCompilationJob(
                                                   osr_offset, code_kind);
 }
 
-void PipelineImpl::ComputeScheduledGraph() {
+bool PipelineImpl::ComputeScheduledGraph() {
   TFPipelineData* data = this->data_;
 
   // We should only schedule the graph if it is not scheduled yet.
   DCHECK_NULL(data->schedule());
 
-  Run<ComputeSchedulePhase>();
+  RUN_MAYBE_ABORT(ComputeSchedulePhase);
   TraceScheduleAndVerify(data->info(), data, data->schedule(), "schedule");
+  return true;
 }
 
 #if V8_ENABLE_WASM_SIMD256_REVEC
-void PipelineImpl::Revectorize() { Run<RevectorizePhase>(); }
+bool PipelineImpl::Revectorize() { return Run<RevectorizePhase>(); }
 #endif  // V8_ENABLE_WASM_SIMD256_REVEC
 
 OptimizedCompilationInfo* PipelineImpl::info() const { return data_->info(); }
diff --git a/deps/v8/src/compiler/representation-change.cc b/deps/v8/src/compiler/representation-change.cc
index f0d4f59c762510..7419e2b80f9d80 100644
--- a/deps/v8/src/compiler/representation-change.cc
+++ b/deps/v8/src/compiler/representation-change.cc
@@ -6,7 +6,7 @@
 
 #include <sstream>
 
-#include "src/base/safe_conversions.h"
+#include "src/base/numerics/safe_conversions.h"
 #include "src/compiler/js-heap-broker.h"
 #include "src/compiler/machine-operator.h"
 #include "src/compiler/node-matchers.h"
@@ -922,6 +922,7 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
       if (use_info.type_check() == TypeCheckKind::kNone ||
           ((use_info.type_check() == TypeCheckKind::kSignedSmall ||
             use_info.type_check() == TypeCheckKind::kSigned32 ||
+            use_info.type_check() == TypeCheckKind::kAdditiveSafeInteger ||
             use_info.type_check() == TypeCheckKind::kNumber ||
             use_info.type_check() == TypeCheckKind::kNumberOrOddball ||
             use_info.type_check() == TypeCheckKind::kArrayIndex) &&
@@ -970,7 +971,17 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
     } else if (output_type.Is(Type::Unsigned32())) {
       op = machine()->ChangeFloat64ToUint32();
     } else if (use_info.truncation().IsUsedAsWord32()) {
-      op = machine()->TruncateFloat64ToWord32();
+      if (use_info.type_check() == TypeCheckKind::kAdditiveSafeInteger) {
+        op = simplified()->CheckedFloat64ToAdditiveSafeInteger(
+            output_type.Maybe(Type::MinusZero())
+                ? use_info.minus_zero_check()
+                : CheckForMinusZeroMode::kDontCheckForMinusZero,
+            use_info.feedback());
+        node = InsertConversion(node, op, use_node);
+        op = machine()->TruncateInt64ToInt32();
+      } else {
+        op = machine()->TruncateFloat64ToWord32();
+      }
     } else {
       return TypeError(node, output_rep, output_type,
                        MachineRepresentation::kWord32);
@@ -990,7 +1001,17 @@ Node* RepresentationChanger::GetWord32RepresentationFor(
     } else if (output_type.Is(Type::Unsigned32())) {
       op = machine()->ChangeFloat64ToUint32();
     } else if (use_info.truncation().IsUsedAsWord32()) {
-      op = machine()->TruncateFloat64ToWord32();
+      if (use_info.type_check() == TypeCheckKind::kAdditiveSafeInteger) {
+        op = simplified()->CheckedFloat64ToAdditiveSafeInteger(
+            output_type.Maybe(Type::MinusZero())
+                ? use_info.minus_zero_check()
+                : CheckForMinusZeroMode::kDontCheckForMinusZero,
+            use_info.feedback());
+        node = InsertConversion(node, op, use_node);
+        op = machine()->TruncateInt64ToInt32();
+      } else {
+        op = machine()->TruncateFloat64ToWord32();
+      }
     } else {
       return TypeError(node, output_rep, output_type,
                        MachineRepresentation::kWord32);
diff --git a/deps/v8/src/compiler/simplified-lowering-verifier.cc b/deps/v8/src/compiler/simplified-lowering-verifier.cc
index 55de8be61e5406..586d591541b6e7 100644
--- a/deps/v8/src/compiler/simplified-lowering-verifier.cc
+++ b/deps/v8/src/compiler/simplified-lowering-verifier.cc
@@ -725,7 +725,7 @@ void SimplifiedLoweringVerifier::VisitNode(Node* node,
       CASE(JSGetImportMeta)
       CASE(JSGeneratorStore)
       CASE(JSGeneratorRestoreContinuation)
-      CASE(JSGeneratorRestoreContext)
+      CASE(JSGeneratorRestoreContextNoCell)
       CASE(JSGeneratorRestoreRegister)
       CASE(JSGeneratorRestoreInputOrDebugPos)
       CASE(JSFulfillPromise)
diff --git a/deps/v8/src/compiler/simplified-lowering.cc b/deps/v8/src/compiler/simplified-lowering.cc
index e2a9dc51eb67df..96e0a8d1152d5e 100644
--- a/deps/v8/src/compiler/simplified-lowering.cc
+++ b/deps/v8/src/compiler/simplified-lowering.cc
@@ -2435,6 +2435,24 @@ class RepresentationSelector {
         }
       } else {
         InsertUnreachableIfNecessary<T>(node);
+        if (node->op()->ValueOutputCount() > 0 &&
+            node->op()->ControlOutputCount() == 0 &&
+            node->opcode() != IrOpcode::kPhi &&
+            node->opcode() != IrOpcode::kStateValues &&
+            node->opcode() != IrOpcode::kFrameState) {
+          for (int i = 0; i < node->op()->ValueInputCount(); i++) {
+            Node* input = node->InputAt(i);
+            // If one of the node's inputs produces a None-type, we don't need
+            // to lower the node.
+            if (TypeOf(input).IsNone()) {
+              DeferReplacement(
+                  node, graph()->NewNode(common()->DeadValue(
+                                             GetInfo(node)->representation()),
+                                         input));
+              return;
+            }
+          }
+        }
       }
     }
 
@@ -2742,8 +2760,7 @@ class RepresentationSelector {
         } else if (lhs_type.Is(Type::Boolean()) &&
                    rhs_type.Is(Type::Boolean())) {
           VisitBinop<T>(node, UseInfo::Bool(), MachineRepresentation::kBit);
-          if (lower<T>())
-            ChangeToPureOp(node, lowering->machine()->Word32Equal());
+          if (lower<T>()) ChangeToPureOp(node, Int32Op(node));
           return;
         }
         // Try to use type feedback.
diff --git a/deps/v8/src/compiler/turbofan-graph-visualizer.cc b/deps/v8/src/compiler/turbofan-graph-visualizer.cc
index d556aa239d538d..1c2d9020e844c6 100644
--- a/deps/v8/src/compiler/turbofan-graph-visualizer.cc
+++ b/deps/v8/src/compiler/turbofan-graph-visualizer.cc
@@ -341,6 +341,12 @@ std::unique_ptr<char[]> GetVisualizerLogFileName(OptimizedCompilationInfo* info,
                '_');
   std::replace(filename.begin(), filename.begin() + filename.length(), ':',
                '-');
+#if V8_OS_WIN
+  std::replace(filename.begin(), filename.begin() + filename.length(), '<',
+               '{');
+  std::replace(filename.begin(), filename.begin() + filename.length(), '>',
+               '}');
+#endif  // V8_OS_WIN
 
   base::EmbeddedVector<char, 256> base_dir;
   if (optional_base_dir != nullptr) {
diff --git a/deps/v8/src/compiler/turbofan-typer.cc b/deps/v8/src/compiler/turbofan-typer.cc
index 62d4a3aba5db2c..e0ff4cace8aee6 100644
--- a/deps/v8/src/compiler/turbofan-typer.cc
+++ b/deps/v8/src/compiler/turbofan-typer.cc
@@ -722,7 +722,9 @@ Type Typer::Visitor::ObjectIsArrayBufferView(Type type, Typer* t) {
   // TODO(turbofan): Introduce a Type::ArrayBufferView?
   CHECK(!type.IsNone());
   if (type.Is(Type::TypedArray())) return t->singleton_true_;
-  if (!type.Maybe(Type::TypedArray())) return t->singleton_false_;
+  if (!type.Maybe(Type::TypedArray()) && !type.Maybe(Type::OtherObject())) {
+    return t->singleton_false_;
+  }
   return Type::Boolean();
 }
 
@@ -1764,7 +1766,7 @@ Type Typer::Visitor::TypeJSHasContextExtension(Node* node) {
   return Type::Boolean();
 }
 
-Type Typer::Visitor::TypeJSLoadContext(Node* node) {
+Type Typer::Visitor::TypeJSLoadContextNoCell(Node* node) {
   ContextAccess const& access = ContextAccessOf(node->op());
   switch (access.index()) {
     case Context::PREVIOUS_INDEX:
@@ -1775,21 +1777,20 @@ Type Typer::Visitor::TypeJSLoadContext(Node* node) {
   }
 }
 
-Type Typer::Visitor::TypeJSLoadScriptContext(Node* node) {
+Type Typer::Visitor::TypeJSLoadContext(Node* node) {
   ContextAccess const& access = ContextAccessOf(node->op());
   switch (access.index()) {
     case Context::PREVIOUS_INDEX:
     case Context::SCOPE_INFO_INDEX:
-    case Context::CONTEXT_SIDE_TABLE_PROPERTY_INDEX:
       return Type::OtherInternal();
     default:
       return Type::Any();
   }
 }
 
-Type Typer::Visitor::TypeJSStoreContext(Node* node) { UNREACHABLE(); }
+Type Typer::Visitor::TypeJSStoreContextNoCell(Node* node) { UNREACHABLE(); }
 
-Type Typer::Visitor::TypeJSStoreScriptContext(Node* node) { UNREACHABLE(); }
+Type Typer::Visitor::TypeJSStoreContext(Node* node) { UNREACHABLE(); }
 
 Type Typer::Visitor::TypeJSCreateFunctionContext(Node* node) {
   return Type::OtherInternal();
@@ -2203,7 +2204,7 @@ Type Typer::Visitor::TypeJSGeneratorRestoreContinuation(Node* node) {
   return Type::SignedSmall();
 }
 
-Type Typer::Visitor::TypeJSGeneratorRestoreContext(Node* node) {
+Type Typer::Visitor::TypeJSGeneratorRestoreContextNoCell(Node* node) {
   return Type::Any();
 }
 
diff --git a/deps/v8/src/compiler/turbofan-types.cc b/deps/v8/src/compiler/turbofan-types.cc
index d943548456bf8b..5a567128854098 100644
--- a/deps/v8/src/compiler/turbofan-types.cc
+++ b/deps/v8/src/compiler/turbofan-types.cc
@@ -195,6 +195,7 @@ Type::bitset BitsetType::Lub(MapRefLike map, JSHeapBroker* broker) {
       UNREACHABLE();
     case HEAP_NUMBER_TYPE:
       return kNumber;
+    case CPP_HEAP_EXTERNAL_OBJECT_TYPE:
     case JS_ARRAY_ITERATOR_PROTOTYPE_TYPE:
     case JS_ITERATOR_PROTOTYPE_TYPE:
     case JS_MAP_ITERATOR_PROTOTYPE_TYPE:
@@ -403,7 +404,6 @@ Type::bitset BitsetType::Lub(MapRefLike map, JSHeapBroker* broker) {
     case INSTRUCTION_STREAM_TYPE:
     case CODE_TYPE:
     case PROPERTY_CELL_TYPE:
-    case CONTEXT_SIDE_PROPERTY_CELL_TYPE:
     case SOURCE_TEXT_MODULE_TYPE:
     case SOURCE_TEXT_MODULE_INFO_ENTRY_TYPE:
     case SYNTHETIC_MODULE_TYPE:
@@ -415,6 +415,7 @@ Type::bitset BitsetType::Lub(MapRefLike map, JSHeapBroker* broker) {
     case REG_EXP_DATA_TYPE:
     case ATOM_REG_EXP_DATA_TYPE:
     case IR_REG_EXP_DATA_TYPE:
+    case CONTEXT_CELL_TYPE:
 #if V8_ENABLE_WEBASSEMBLY
     case WASM_TYPE_INFO_TYPE:
 #endif  // V8_ENABLE_WEBASSEMBLY
diff --git a/deps/v8/src/compiler/turboshaft/access-builder.h b/deps/v8/src/compiler/turboshaft/access-builder.h
index bea39cf35eb33b..cad1debc9a1826 100644
--- a/deps/v8/src/compiler/turboshaft/access-builder.h
+++ b/deps/v8/src/compiler/turboshaft/access-builder.h
@@ -57,7 +57,6 @@ class AccessBuilderTS : public AllStatic {
   TF_FIELD_ACCESS(String, Word32, ForStringLength)
   TF_FIELD_ACCESS(Name, Word32, ForNameRawHashField)
   TF_FIELD_ACCESS(HeapNumber, Float64, ForHeapNumberValue)
-  TF_FIELD_ACCESS(HeapNumber, Word32, ForHeapInt32Value)
   using HeapNumberOrOddballOrHole = Union<HeapNumber, Oddball, Hole>;
   TF_FIELD_ACCESS(HeapNumberOrOddballOrHole, Float64,
                   ForHeapNumberOrOddballOrHoleValue)
diff --git a/deps/v8/src/compiler/turboshaft/assembler.h b/deps/v8/src/compiler/turboshaft/assembler.h
index 1491c6e67036d8..ef1ccb5c6f13cc 100644
--- a/deps/v8/src/compiler/turboshaft/assembler.h
+++ b/deps/v8/src/compiler/turboshaft/assembler.h
@@ -2661,6 +2661,17 @@ class TurboshaftAssemblerOpInterface
         BitcastSmiToWordPtr(input), kSmiShiftBits));
   }
 
+  V<WordPtr> LoadPageFlags(V<HeapObject> object) {
+    V<WordPtr> header = MemoryChunkFromAddress(BitcastTaggedToWordPtr(object));
+    return Load(header, {}, LoadOp::Kind::RawAligned(),
+                MemoryRepresentation::UintPtr(), MemoryChunk::FlagsOffset());
+  }
+
+  V<WordPtr> MemoryChunkFromAddress(V<WordPtr> address) {
+    return WordPtrBitwiseAnd(address,
+                             ~MemoryChunk::GetAlignmentMaskForAssembler());
+  }
+
   OpIndex AtomicRMW(V<WordPtr> base, V<WordPtr> index, OpIndex value,
                     AtomicRMWOp::BinOp bin_op,
                     RegisterRepresentation in_out_rep,
@@ -2984,11 +2995,6 @@ class TurboshaftAssemblerOpInterface
         heap_number, AccessBuilderTS::ForHeapNumberValue());
   }
 
-  V<Word32> LoadHeapInt32Value(V<HeapNumber> heap_number) {
-    return __ template LoadField<HeapNumber, HeapNumber, Word32>(
-        heap_number, AccessBuilderTS::ForHeapInt32Value());
-  }
-
   template <typename Type = Object>
   V<Type> LoadTaggedField(V<Object> object, int field_offset)
     requires(is_subtype_v<Type, Object>)
@@ -4939,13 +4945,16 @@ class TurboshaftAssemblerOpInterface
   }
 
   V<WasmArray> WasmAllocateArray(V<Map> rtt, ConstOrV<Word32> length,
-                                 const wasm::ArrayType* array_type) {
-    return ReduceIfReachableWasmAllocateArray(rtt, resolve(length), array_type);
+                                 const wasm::ArrayType* array_type,
+                                 bool is_shared) {
+    return ReduceIfReachableWasmAllocateArray(rtt, resolve(length), array_type,
+                                              is_shared);
   }
 
   V<WasmStruct> WasmAllocateStruct(V<Map> rtt,
-                                   const wasm::StructType* struct_type) {
-    return ReduceIfReachableWasmAllocateStruct(rtt, struct_type);
+                                   const wasm::StructType* struct_type,
+                                   bool is_shared) {
+    return ReduceIfReachableWasmAllocateStruct(rtt, struct_type, is_shared);
   }
 
   V<WasmFuncRef> WasmRefFunc(V<Object> wasm_instance, uint32_t function_index) {
diff --git a/deps/v8/src/compiler/turboshaft/builtin-call-descriptors.h b/deps/v8/src/compiler/turboshaft/builtin-call-descriptors.h
index d6cda628f4ad5e..ab603a39f8a5ca 100644
--- a/deps/v8/src/compiler/turboshaft/builtin-call-descriptors.h
+++ b/deps/v8/src/compiler/turboshaft/builtin-call-descriptors.h
@@ -343,6 +343,23 @@ struct BuiltinCallDescriptor {
         base_effects.CanReadMemory().CanAllocateWithoutIdentity();
   };
 
+#if V8_ENABLE_WEBASSEMBLY
+  struct WasmStringAdd_CheckNone : public Descriptor<WasmStringAdd_CheckNone> {
+    static constexpr auto kFunction = Builtin::kWasmStringAdd_CheckNone;
+    using arguments_t = std::tuple<V<String>, V<String>>;
+    using results_t = std::tuple<V<String>>;
+
+    static constexpr bool kNeedsFrameState = false;
+    static constexpr bool kNeedsContext = true;
+    static constexpr Operator::Properties kProperties =
+        Operator::kNoDeopt | Operator::kNoWrite;
+    // This will only write in a fresh object, so the writes are not visible
+    // from Turboshaft, and CanAllocate is enough.
+    static constexpr OpEffects kEffects =
+        base_effects.CanReadMemory().CanAllocateWithoutIdentity();
+  };
+#endif
+
   struct StringEqual : public Descriptor<StringEqual> {
     static constexpr auto kFunction = Builtin::kStringEqual;
     using arguments_t = std::tuple<V<String>, V<String>, V<WordPtr>>;
@@ -438,6 +455,64 @@ struct BuiltinCallDescriptor {
   };
 #endif  // V8_INTL_SUPPORT
 
+#if V8_ENABLE_WEBASSEMBLY
+  struct WasmJSStringEqual : public Descriptor<WasmJSStringEqual> {
+    static constexpr auto kFunction = Builtin::kWasmJSStringEqual;
+    using arguments_t = std::tuple<V<String>, V<String>, V<WordPtr>>;
+    using results_t = std::tuple<V<Boolean>>;
+
+    static constexpr bool kNeedsFrameState = false;
+    static constexpr bool kNeedsContext = false;
+    static constexpr Operator::Properties kProperties = Operator::kEliminatable;
+    // If the strings aren't flat, StringEqual could flatten them, which will
+    // allocate new strings.
+    static constexpr OpEffects kEffects =
+        base_effects.CanReadMemory().CanAllocateWithoutIdentity();
+  };
+
+  struct WasmStringCompare : public Descriptor<WasmStringCompare> {
+    static constexpr auto kFunction = Builtin::kWasmStringCompare;
+    using arguments_t = std::tuple<V<String>, V<String>>;
+    using results_t = std::tuple<V<Smi>>;
+
+    static constexpr bool kNeedsFrameState = false;
+    static constexpr bool kNeedsContext = false;
+    static constexpr Operator::Properties kProperties = Operator::kEliminatable;
+    static constexpr OpEffects kEffects =
+        base_effects.CanReadMemory().CanAllocateWithoutIdentity();
+  };
+
+  struct WasmStringIndexOf : public Descriptor<WasmStringIndexOf> {
+    static constexpr auto kFunction = Builtin::kWasmStringIndexOf;
+    using arguments_t = std::tuple<V<String>, V<String>, V<Smi>>;
+    using results_t = std::tuple<V<Smi>>;
+
+    static constexpr bool kNeedsFrameState = false;
+    static constexpr bool kNeedsContext = false;
+    static constexpr Operator::Properties kProperties = Operator::kEliminatable;
+    // StringIndexOf does a ToString on the receiver, which can allocate a new
+    // string.
+    static constexpr OpEffects kEffects =
+        base_effects.CanReadMemory().CanAllocateWithoutIdentity();
+  };
+
+#ifdef V8_INTL_SUPPORT
+  struct WasmStringToLowerCaseIntl
+      : public Descriptor<WasmStringToLowerCaseIntl> {
+    static constexpr auto kFunction = Builtin::kWasmStringToLowerCaseIntl;
+    using arguments_t = std::tuple<V<String>>;
+    using results_t = std::tuple<V<String>>;
+
+    static constexpr bool kNeedsFrameState = false;
+    static constexpr bool kNeedsContext = true;
+    static constexpr Operator::Properties kProperties =
+        Operator::kNoDeopt | Operator::kNoThrow;
+    static constexpr OpEffects kEffects =
+        base_effects.CanReadMemory().CanAllocateWithoutIdentity();
+  };
+#endif
+#endif
+
   struct StringToNumber : public Descriptor<StringToNumber> {
     static constexpr auto kFunction = Builtin::kStringToNumber;
     using arguments_t = std::tuple<V<String>>;
@@ -615,7 +690,7 @@ struct BuiltinCallDescriptor {
   struct WasmAllocateDescriptorStruct
       : public Descriptor<WasmAllocateDescriptorStruct> {
     static constexpr auto kFunction = Builtin::kWasmAllocateDescriptorStruct;
-    using arguments_t = std::tuple<V<Map>, V<Word32>>;
+    using arguments_t = std::tuple<V<Map>, V<Word32>, V<Object>>;
     using results_t = std::tuple<V<WasmStruct>>;
 
     static constexpr bool kNeedsFrameState = false;
diff --git a/deps/v8/src/compiler/turboshaft/graph-builder.cc b/deps/v8/src/compiler/turboshaft/graph-builder.cc
index 0724dc3c51dba6..1213e59daa4149 100644
--- a/deps/v8/src/compiler/turboshaft/graph-builder.cc
+++ b/deps/v8/src/compiler/turboshaft/graph-builder.cc
@@ -11,7 +11,7 @@
 
 #include "src/base/container-utils.h"
 #include "src/base/logging.h"
-#include "src/base/safe_conversions.h"
+#include "src/base/numerics/safe_conversions.h"
 #include "src/base/small-vector.h"
 #include "src/base/vector.h"
 #include "src/codegen/bailout-reason.h"
diff --git a/deps/v8/src/compiler/turboshaft/machine-lowering-reducer-inl.h b/deps/v8/src/compiler/turboshaft/machine-lowering-reducer-inl.h
index 51a1e50d109c13..6cf3c1702c3ad0 100644
--- a/deps/v8/src/compiler/turboshaft/machine-lowering-reducer-inl.h
+++ b/deps/v8/src/compiler/turboshaft/machine-lowering-reducer-inl.h
@@ -3475,16 +3475,12 @@ class MachineLoweringReducer : public Next {
 
     // Check if the {code} is a one byte character.
     IF (LIKELY(__ Uint32LessThanOrEqual(code, String::kMaxOneByteCharCode))) {
-      // Load the isolate wide single character string table.
-      V<FixedArray> table = __ SingleCharacterStringTableConstant();
-
-      // Compute the {table} index for {code}.
+      // Load the string for the {code} directly from the roots table.
       V<WordPtr> index = __ ChangeUint32ToUintPtr(code);
-
-      // Load the string for the {code} from the single character string
-      // table.
-      V<String> entry = __ LoadElement(
-          table, AccessBuilderTS::ForFixedArrayElement<String>(), index);
+      V<String> entry = __ LoadOffHeap(
+          __ LoadRootRegister(), index,
+          IsolateData::root_slot_offset(RootIndex::kFirstSingleCharacterString),
+          MemoryRepresentation::UncompressedTaggedPointer());
 
       // Use the {entry} from the {table}.
       GOTO(done, entry);
diff --git a/deps/v8/src/compiler/turboshaft/machine-optimization-reducer.h b/deps/v8/src/compiler/turboshaft/machine-optimization-reducer.h
index 45276849a4c848..bd496d5b0f7516 100644
--- a/deps/v8/src/compiler/turboshaft/machine-optimization-reducer.h
+++ b/deps/v8/src/compiler/turboshaft/machine-optimization-reducer.h
@@ -2068,12 +2068,11 @@ class MachineOptimizationReducer : public Next {
         break;
     }
 
-    auto MatchUnaryShuffle =
+    auto MatchShuffle =
         [this](V<Simd128> maybe_shuffle) -> const Simd128ShuffleOp* {
       if (const Simd128ShuffleOp* shuffle =
               matcher_.TryCast<Simd128ShuffleOp>(maybe_shuffle)) {
-        if (shuffle->kind == Simd128ShuffleOp::Kind::kI8x16 &&
-            shuffle->left() == shuffle->right()) {
+        if (shuffle->kind == Simd128ShuffleOp::Kind::kI8x16) {
           return shuffle;
         }
       }
@@ -2117,11 +2116,11 @@ class MachineOptimizationReducer : public Next {
       V<Simd128> operands[2] = {binop->left(), binop->right()};
       for (unsigned i = 0; i < 2; ++i) {
         V<Simd128> operand = operands[i];
-        if (const Simd128ShuffleOp* shuffle = MatchUnaryShuffle(operand)) {
+        if (const Simd128ShuffleOp* shuffle = MatchShuffle(operand)) {
           // Ensure that the input to the shuffle is also the other input to
-          // current binop.
+          // current binop. We take the left input because all of the shuffle
+          // pattern matching is specified, and will test, for it.
           V<Simd128> shuffle_in = shuffle->left();
-          DCHECK_EQ(shuffle_in, shuffle->right());
           V<Simd128> other_operand = operands[i ^ 1];
           if (shuffle_in != other_operand) {
             break;
diff --git a/deps/v8/src/compiler/turboshaft/maglev-early-lowering-reducer-inl.h b/deps/v8/src/compiler/turboshaft/maglev-early-lowering-reducer-inl.h
index 5088e884657077..36d85661cf7ead 100644
--- a/deps/v8/src/compiler/turboshaft/maglev-early-lowering-reducer-inl.h
+++ b/deps/v8/src/compiler/turboshaft/maglev-early-lowering-reducer-inl.h
@@ -121,118 +121,6 @@ class MaglevEarlyLoweringReducer : public Next {
     }
   }
 
-  V<Object> LoadScriptContextSideData(V<Context> script_context, int index) {
-    V<FixedArray> side_table = __ template LoadTaggedField<FixedArray>(
-        script_context,
-        Context::OffsetOfElementAt(Context::CONTEXT_SIDE_TABLE_PROPERTY_INDEX));
-    return __ LoadTaggedField(side_table,
-                              FixedArray::OffsetOfElementAt(
-                                  index - Context::MIN_CONTEXT_EXTENDED_SLOTS));
-  }
-
-  V<Object> LoadScriptContextPropertyFromSideData(V<Object> side_data) {
-    ScopedVar<Object> property(this, side_data);
-    IF_NOT (__ IsSmi(side_data)) {
-      property = __ LoadTaggedField(
-          side_data, ContextSidePropertyCell::kPropertyDetailsRawOffset);
-    }
-    return property;
-  }
-
-  V<Object> LoadHeapNumberFromScriptContext(V<Context> script_context,
-                                            int index,
-                                            V<HeapNumber> heap_number) {
-    V<Object> data = __ LoadScriptContextSideData(script_context, index);
-    V<Object> property = __ LoadScriptContextPropertyFromSideData(data);
-    ScopedVar<HeapNumber> result(this, heap_number);
-    Label<> done(this);
-    if (v8_flags.script_context_mutable_heap_int32) {
-      IF (__ TaggedEqual(
-              property,
-              __ SmiConstant(ContextSidePropertyCell::MutableInt32()))) {
-        result = __ AllocateHeapNumberWithValue(
-            __ ChangeInt32ToFloat64(__ LoadHeapInt32Value(heap_number)),
-            isolate_->factory());
-        GOTO(done);
-      }
-    }
-    IF (__ TaggedEqual(
-            property,
-            __ SmiConstant(ContextSidePropertyCell::MutableHeapNumber()))) {
-      result = __ AllocateHeapNumberWithValue(
-          __ LoadHeapNumberValue(heap_number), isolate_->factory());
-    }
-    GOTO(done);
-    BIND(done);
-    return result;
-  }
-
-  void StoreScriptContextSlowPath(V<Context> script_context,
-                                  V<Object> old_value, V<Object> new_value,
-                                  V<Object> side_data,
-                                  V<FrameState> frame_state,
-                                  const FeedbackSource& feedback,
-                                  Label<>& done) {
-    // Check if Undefined.
-    __ DeoptimizeIf(
-        __ RootEqual(side_data, RootIndex::kUndefinedValue, isolate_),
-        frame_state, DeoptimizeReason::kWrongValue, feedback);
-    V<Object> property = __ LoadScriptContextPropertyFromSideData(side_data);
-    // Check for const case.
-    __ DeoptimizeIf(
-        __ TaggedEqual(property,
-                       __ SmiConstant(ContextSidePropertyCell::Const())),
-        frame_state, DeoptimizeReason::kWrongValue, feedback);
-    if (v8_flags.script_context_mutable_heap_number) {
-      // Check for smi case.
-      IF (__ TaggedEqual(
-              property, __ SmiConstant(ContextSidePropertyCell::SmiMarker()))) {
-        __ DeoptimizeIfNot(__ IsSmi(new_value), frame_state,
-                           DeoptimizeReason::kWrongValue, feedback);
-      } ELSE {
-        if (v8_flags.script_context_mutable_heap_int32) {
-          // Check for mutable heap int32 case.
-          IF (__ TaggedEqual(
-                  property,
-                  __ SmiConstant(ContextSidePropertyCell::MutableInt32()))) {
-            ScopedVar<Word32> number_value(this);
-            IF (__ IsSmi(new_value)) {
-              number_value = __ UntagSmi(V<Smi>::Cast(new_value));
-            } ELSE {
-              V<i::Map> map = __ LoadMapField(new_value);
-              __ DeoptimizeIfNot(
-                  __ TaggedEqual(map,
-                                 __ HeapConstant(factory_->heap_number_map())),
-                  frame_state, DeoptimizeReason::kWrongValue, feedback);
-              number_value = __ ChangeFloat64ToInt32OrDeopt(
-                  __ LoadHeapNumberValue(V<HeapNumber>::Cast(new_value)),
-                  frame_state, CheckForMinusZeroMode::kCheckForMinusZero,
-                  feedback);
-            }
-            __ StoreField(old_value, AccessBuilder::ForHeapInt32Value(),
-                          number_value);
-            GOTO(done);
-          }
-        }
-        // It must be a mutable heap number case.
-        ScopedVar<Float64> number_value(this);
-        IF (__ IsSmi(new_value)) {
-          number_value =
-              __ ChangeInt32ToFloat64(__ UntagSmi(V<Smi>::Cast(new_value)));
-        } ELSE {
-          V<i::Map> map = __ LoadMapField(new_value);
-          __ DeoptimizeIfNot(
-              __ TaggedEqual(map, __ HeapConstant(factory_->heap_number_map())),
-              frame_state, DeoptimizeReason::kWrongValue, feedback);
-          number_value = __ LoadHeapNumberValue(V<HeapNumber>::Cast(new_value));
-        }
-        __ StoreField(old_value, AccessBuilder::ForHeapNumberValue(),
-                      number_value);
-        GOTO(done);
-      }
-    }
-  }
-
   V<Object> CheckConstructResult(V<Object> construct_result,
                                  V<Object> implicit_receiver) {
     // If the result is an object (in the ECMA sense), we should get rid
diff --git a/deps/v8/src/compiler/turboshaft/memory-optimization-reducer.cc b/deps/v8/src/compiler/turboshaft/memory-optimization-reducer.cc
index 5c903ce02aa21e..0f8744cb573725 100644
--- a/deps/v8/src/compiler/turboshaft/memory-optimization-reducer.cc
+++ b/deps/v8/src/compiler/turboshaft/memory-optimization-reducer.cc
@@ -115,6 +115,7 @@ void MemoryAnalyzer::ProcessAllocation(const AllocateOp& alloc) {
       state.last_allocation && new_size.has_value() &&
       state.reserved_size.has_value() &&
       alloc.type == state.last_allocation->type &&
+      alloc.type != AllocationType::kSharedOld &&
       *new_size <= kMaxRegularHeapObjectSize - *state.reserved_size) {
     state.reserved_size =
         static_cast<uint32_t>(*state.reserved_size + *new_size);
diff --git a/deps/v8/src/compiler/turboshaft/memory-optimization-reducer.h b/deps/v8/src/compiler/turboshaft/memory-optimization-reducer.h
index 9c73720415a471..255165605900df 100644
--- a/deps/v8/src/compiler/turboshaft/memory-optimization-reducer.h
+++ b/deps/v8/src/compiler/turboshaft/memory-optimization-reducer.h
@@ -222,7 +222,21 @@ class MemoryOptimizationReducer : public Next {
   }
 
   V<HeapObject> REDUCE(Allocate)(V<WordPtr> size, AllocationType type) {
-    DCHECK_EQ(type, any_of(AllocationType::kYoung, AllocationType::kOld));
+    DCHECK_EQ(type, any_of(AllocationType::kYoung, AllocationType::kOld,
+                           AllocationType::kSharedOld));
+
+#if V8_ENABLE_WEBASSEMBLY
+    if (type == AllocationType::kSharedOld) {
+      DCHECK_EQ(isolate_, nullptr);  // Only possible in wasm.
+      DCHECK(analyzer_->is_wasm);
+      static_assert(std::is_same<Smi, BuiltinPtr>(), "BuiltinPtr must be Smi");
+      OpIndex allocate_builtin = __ NumberConstant(
+          static_cast<int>(Builtin::kWasmAllocateInSharedHeap));
+      OpIndex allocated =
+          __ Call(allocate_builtin, {size}, AllocateBuiltinDescriptor());
+      return allocated;
+    }
+#endif
 
     if (v8_flags.single_generation && type == AllocationType::kYoung) {
       type = AllocationType::kOld;
diff --git a/deps/v8/src/compiler/turboshaft/operations.cc b/deps/v8/src/compiler/turboshaft/operations.cc
index 3b487a8d21008b..dafbc9546a82b9 100644
--- a/deps/v8/src/compiler/turboshaft/operations.cc
+++ b/deps/v8/src/compiler/turboshaft/operations.cc
@@ -1951,7 +1951,8 @@ std::ostream& operator<<(std::ostream& os, Simd256UnpackOp::Kind kind) {
 #endif  // V8_ENABLE_WASM_SIMD256_REVEC
 
 void WasmAllocateArrayOp::PrintOptions(std::ostream& os) const {
-  os << '[' << array_type->element_type() << ']';
+  os << '[' << array_type->element_type()
+     << ", is_shared: " << (is_shared ? "true" : "false") << "]";
 }
 
 void ArrayGetOp::PrintOptions(std::ostream& os) const {
diff --git a/deps/v8/src/compiler/turboshaft/operations.h b/deps/v8/src/compiler/turboshaft/operations.h
index 6b2ea3f1d558c4..29b0b2bfd64cc4 100644
--- a/deps/v8/src/compiler/turboshaft/operations.h
+++ b/deps/v8/src/compiler/turboshaft/operations.h
@@ -7261,10 +7261,12 @@ struct WasmAllocateArrayOp : FixedArityOperationT<2, WasmAllocateArrayOp> {
       OpEffects().CanAllocate().CanLeaveCurrentFunction();
 
   const wasm::ArrayType* array_type;
+  bool is_shared;
 
   explicit WasmAllocateArrayOp(V<Map> rtt, V<Word32> length,
-                               const wasm::ArrayType* array_type)
-      : Base(rtt, length), array_type(array_type) {}
+                               const wasm::ArrayType* array_type,
+                               bool is_shared)
+      : Base(rtt, length), array_type(array_type), is_shared(is_shared) {}
 
   V<Map> rtt() const { return Base::input<Map>(0); }
   V<Word32> length() const { return Base::input<Word32>(1); }
@@ -7279,7 +7281,7 @@ struct WasmAllocateArrayOp : FixedArityOperationT<2, WasmAllocateArrayOp> {
                           MaybeRegisterRepresentation::Word32()>();
   }
 
-  auto options() const { return std::tuple{array_type}; }
+  auto options() const { return std::tuple{array_type, is_shared}; }
   void PrintOptions(std::ostream& os) const;
 };
 
@@ -7288,9 +7290,11 @@ struct WasmAllocateStructOp : FixedArityOperationT<1, WasmAllocateStructOp> {
       OpEffects().CanAllocate().CanLeaveCurrentFunction();
 
   const wasm::StructType* struct_type;
+  bool is_shared;
 
-  explicit WasmAllocateStructOp(V<Map> rtt, const wasm::StructType* struct_type)
-      : Base(rtt), struct_type(struct_type) {}
+  explicit WasmAllocateStructOp(V<Map> rtt, const wasm::StructType* struct_type,
+                                bool is_shared)
+      : Base(rtt), struct_type(struct_type), is_shared(is_shared) {}
 
   V<Map> rtt() const { return Base::input<Map>(0); }
 
@@ -7303,7 +7307,7 @@ struct WasmAllocateStructOp : FixedArityOperationT<1, WasmAllocateStructOp> {
     return MaybeRepVector<MaybeRegisterRepresentation::Tagged()>();
   }
 
-  auto options() const { return std::tuple{struct_type}; }
+  auto options() const { return std::tuple{struct_type, is_shared}; }
 };
 
 struct WasmRefFuncOp : FixedArityOperationT<1, WasmRefFuncOp> {
@@ -7579,6 +7583,8 @@ struct Simd128BinopOp : FixedArityOperationT<2, Simd128BinopOp> {
       case Kind::kI16x8Mul:
       case Kind::kF64x2Mul:
       case Kind::kF32x4Mul:
+
+      case Kind::kS128Xor:
         return true;
       default:
         return false;
diff --git a/deps/v8/src/compiler/turboshaft/opmasks.h b/deps/v8/src/compiler/turboshaft/opmasks.h
index cd5796fea326a7..fb2415e8988c0e 100644
--- a/deps/v8/src/compiler/turboshaft/opmasks.h
+++ b/deps/v8/src/compiler/turboshaft/opmasks.h
@@ -325,6 +325,8 @@ using Simd128BinopMask =
     MaskBuilder<Simd128BinopOp, FIELD(Simd128BinopOp, kind)>;
 using kSimd128I32x4Mul = Simd128BinopMask::For<Simd128BinopOp::Kind::kI32x4Mul>;
 using kSimd128I16x8Mul = Simd128BinopMask::For<Simd128BinopOp::Kind::kI16x8Mul>;
+using kSimd128AndNot = Simd128BinopMask::For<Simd128BinopOp::Kind::kS128AndNot>;
+using kSimd128Xor = Simd128BinopMask::For<Simd128BinopOp::Kind::kS128Xor>;
 
 #define SIMD_SIGN_EXTENSION_BINOP_MASK(kind) \
   using kSimd128##kind = Simd128BinopMask::For<Simd128BinopOp::Kind::k##kind>;
diff --git a/deps/v8/src/compiler/turboshaft/pipelines.cc b/deps/v8/src/compiler/turboshaft/pipelines.cc
index 0131e7b7c6cff0..f25eb4c9b5ef24 100644
--- a/deps/v8/src/compiler/turboshaft/pipelines.cc
+++ b/deps/v8/src/compiler/turboshaft/pipelines.cc
@@ -13,13 +13,16 @@
 
 namespace v8::internal::compiler::turboshaft {
 
+#define RUN_MAYBE_ABORT(phase, ...) \
+  if (V8_UNLIKELY(!Run<phase>(__VA_ARGS__))) return {};
+
 void SimplificationAndNormalizationPhase::Run(PipelineData* data,
                                               Zone* temp_zone) {
   CopyingPhase<LoadStoreSimplificationReducer,
                InstructionSelectionNormalizationReducer>::Run(data, temp_zone);
 }
 
-void Pipeline::AllocateRegisters(const RegisterConfiguration* config,
+bool Pipeline::AllocateRegisters(const RegisterConfiguration* config,
                                  CallDescriptor* call_descriptor,
                                  bool run_verifier) {
   // Don't track usage for this zone in compiler stats.
@@ -42,10 +45,10 @@ void Pipeline::AllocateRegisters(const RegisterConfiguration* config,
 
   data_->InitializeRegisterComponent(config, call_descriptor);
 
-  Run<MeetRegisterConstraintsPhase>();
-  Run<ResolvePhisPhase>();
-  Run<BuildLiveRangesPhase>();
-  Run<BuildLiveRangeBundlesPhase>();
+  RUN_MAYBE_ABORT(MeetRegisterConstraintsPhase);
+  RUN_MAYBE_ABORT(ResolvePhisPhase);
+  RUN_MAYBE_ABORT(BuildLiveRangesPhase);
+  RUN_MAYBE_ABORT(BuildLiveRangeBundlesPhase);
 
   TraceSequence("before register allocation");
   if (verifier != nullptr) {
@@ -60,20 +63,20 @@ void Pipeline::AllocateRegisters(const RegisterConfiguration* config,
                                        data_->register_allocation_data());
   }
 
-  Run<AllocateGeneralRegistersPhase<LinearScanAllocator>>();
+  RUN_MAYBE_ABORT(AllocateGeneralRegistersPhase<LinearScanAllocator>);
 
   if (data_->sequence()->HasFPVirtualRegisters()) {
-    Run<AllocateFPRegistersPhase<LinearScanAllocator>>();
+    RUN_MAYBE_ABORT(AllocateFPRegistersPhase<LinearScanAllocator>);
   }
 
   if (data_->sequence()->HasSimd128VirtualRegisters() &&
       (kFPAliasing == AliasingKind::kIndependent)) {
-    Run<AllocateSimd128RegistersPhase<LinearScanAllocator>>();
+    RUN_MAYBE_ABORT(AllocateSimd128RegistersPhase<LinearScanAllocator>);
   }
 
-  Run<DecideSpillingModePhase>();
-  Run<AssignSpillSlotsPhase>();
-  Run<CommitAssignmentPhase>();
+  RUN_MAYBE_ABORT(DecideSpillingModePhase);
+  RUN_MAYBE_ABORT(AssignSpillSlotsPhase);
+  RUN_MAYBE_ABORT(CommitAssignmentPhase);
 
   // TODO(chromium:725559): remove this check once
   // we understand the cause of the bug. We keep just the
@@ -82,14 +85,14 @@ void Pipeline::AllocateRegisters(const RegisterConfiguration* config,
     verifier->VerifyAssignment("Immediately after CommitAssignmentPhase.");
   }
 
-  Run<ConnectRangesPhase>();
+  RUN_MAYBE_ABORT(ConnectRangesPhase);
 
-  Run<ResolveControlFlowPhase>();
+  RUN_MAYBE_ABORT(ResolveControlFlowPhase);
 
-  Run<PopulateReferenceMapsPhase>();
+  RUN_MAYBE_ABORT(PopulateReferenceMapsPhase);
 
   if (v8_flags.turbo_move_optimization) {
-    Run<OptimizeMovesPhase>();
+    RUN_MAYBE_ABORT(OptimizeMovesPhase);
   }
 
   TraceSequence("after register allocation");
@@ -106,6 +109,7 @@ void Pipeline::AllocateRegisters(const RegisterConfiguration* config,
   }
 
   data()->ClearRegisterComponent();
+  return true;
 }
 
 [[nodiscard]] bool Pipeline::GenerateCode(
@@ -116,10 +120,10 @@ void Pipeline::AllocateRegisters(const RegisterConfiguration* config,
   data()->InitializeCodegenComponent(osr_helper, jump_optimization_info);
 
   // Perform instruction selection and register allocation.
-  PrepareForInstructionSelection(profile);
-  CHECK(SelectInstructions(linkage));
-  CHECK(AllocateRegisters(linkage->GetIncomingDescriptor()));
-  AssembleCode(linkage);
+  if (!PrepareForInstructionSelection(profile)) return false;
+  if (!SelectInstructions(linkage)) return false;
+  if (!AllocateRegisters(linkage->GetIncomingDescriptor())) return false;
+  if (!AssembleCode(linkage)) return false;
 
   if (v8_flags.turbo_profiling) {
     info()->profiler_data()->SetHash(initial_graph_hash);
@@ -135,9 +139,9 @@ void Pipeline::AllocateRegisters(const RegisterConfiguration* config,
     if (!SelectInstructions(linkage)) {
       return false;
     }
-    AllocateRegisters(linkage->GetIncomingDescriptor());
+    if (!AllocateRegisters(linkage->GetIncomingDescriptor())) return false;
     // Generate the final machine code.
-    AssembleCode(linkage);
+    if (!AssembleCode(linkage)) return false;
   }
   return true;
 }
@@ -145,17 +149,17 @@ void Pipeline::AllocateRegisters(const RegisterConfiguration* config,
 void BuiltinPipeline::OptimizeBuiltin() {
   Tracing::Scope tracing_scope(data()->info());
 
-  Run<CsaEarlyMachineOptimizationPhase>();
-  Run<CsaLoadEliminationPhase>();
-  Run<CsaLateEscapeAnalysisPhase>();
-  Run<CsaBranchEliminationPhase>();
-  Run<CsaOptimizePhase>();
+  CHECK(Run<CsaEarlyMachineOptimizationPhase>());
+  CHECK(Run<CsaLoadEliminationPhase>());
+  CHECK(Run<CsaLateEscapeAnalysisPhase>());
+  CHECK(Run<CsaBranchEliminationPhase>());
+  CHECK(Run<CsaOptimizePhase>());
 
   if (v8_flags.turboshaft_enable_debug_features) {
-    Run<DebugFeatureLoweringPhase>();
+    CHECK(Run<DebugFeatureLoweringPhase>());
   }
 
-  Run<CodeEliminationAndSimplificationPhase>();
+  CHECK(Run<CodeEliminationAndSimplificationPhase>());
 }
 
 }  // namespace v8::internal::compiler::turboshaft
diff --git a/deps/v8/src/compiler/turboshaft/pipelines.h b/deps/v8/src/compiler/turboshaft/pipelines.h
index dd925e6cbb74a6..7fec54984a5f93 100644
--- a/deps/v8/src/compiler/turboshaft/pipelines.h
+++ b/deps/v8/src/compiler/turboshaft/pipelines.h
@@ -39,6 +39,9 @@ namespace v8::internal::compiler::turboshaft {
 
 inline constexpr char kTempZoneName[] = "temp-zone";
 
+#define RUN_MAYBE_ABORT(phase, ...) \
+  if (V8_UNLIKELY(!Run<phase>(__VA_ARGS__))) return {};
+
 struct SimplificationAndNormalizationPhase {
   DECL_TURBOSHAFT_PHASE_CONSTANTS(SimplificationAndNormalization)
 
@@ -62,7 +65,7 @@ class V8_EXPORT_PRIVATE Pipeline {
   }
 
   template <TurboshaftPhase Phase, typename... Args>
-  auto Run(Args&&... args) {
+  V8_WARN_UNUSED_RESULT auto Run(Args&&... args) {
     // Setup run scope.
     PhaseScope phase_scope(data_->pipeline_statistics(), Phase::phase_name());
     ZoneWithName<Phase::kPhaseName> temp_zone(data_->zone_stats(),
@@ -83,13 +86,15 @@ class V8_EXPORT_PRIVATE Pipeline {
       if constexpr (produces_printable_graph<Phase>::value) {
         PrintGraph(temp_zone, Phase::phase_name());
       }
-      return;
+      return !data_->info()->was_cancelled();
     } else {
+      static_assert(std::is_same_v<result_t, std::optional<BailoutReason>>);
       auto result = phase.Run(data_, temp_zone, std::forward<Args>(args)...);
       if constexpr (produces_printable_graph<Phase>::value) {
         PrintGraph(temp_zone, Phase::phase_name());
       }
-      return result;
+      return data_->info()->was_cancelled() ? BailoutReason::kCancelled
+                                            : result;
     }
     UNREACHABLE();
   }
@@ -180,56 +185,57 @@ class V8_EXPORT_PRIVATE Pipeline {
     // `MachineLoweringPhase` since we can reuse the `DataViewLoweringReducer`
     // there and avoid a separate phase.
     if (v8_flags.turboshaft_wasm_in_js_inlining) {
-      Run<turboshaft::WasmInJSInliningPhase>();
+      RUN_MAYBE_ABORT(turboshaft::WasmInJSInliningPhase);
     }
 #endif  // !V8_ENABLE_WEBASSEMBLY
 
-    Run<turboshaft::MachineLoweringPhase>();
+    RUN_MAYBE_ABORT(turboshaft::MachineLoweringPhase);
 
     if (v8_flags.turboshaft_loop_unrolling) {
-      Run<turboshaft::LoopUnrollingPhase>();
+      RUN_MAYBE_ABORT(turboshaft::LoopUnrollingPhase);
     }
 
     if (v8_flags.turbo_store_elimination) {
-      Run<turboshaft::StoreStoreEliminationPhase>();
+      RUN_MAYBE_ABORT(turboshaft::StoreStoreEliminationPhase);
     }
 
-    Run<turboshaft::OptimizePhase>();
+    RUN_MAYBE_ABORT(turboshaft::OptimizePhase);
 
     if (v8_flags.turboshaft_typed_optimizations) {
-      Run<turboshaft::TypedOptimizationsPhase>();
+      RUN_MAYBE_ABORT(turboshaft::TypedOptimizationsPhase);
     }
 
     if (v8_flags.turboshaft_assert_types) {
-      Run<turboshaft::TypeAssertionsPhase>();
+      RUN_MAYBE_ABORT(turboshaft::TypeAssertionsPhase);
     }
 
     // Perform dead code elimination, reduce stack checks, simplify loads on
     // platforms where required, ...
-    Run<turboshaft::CodeEliminationAndSimplificationPhase>();
+    RUN_MAYBE_ABORT(turboshaft::CodeEliminationAndSimplificationPhase);
 
 #ifdef V8_ENABLE_DEBUG_CODE
     if (V8_UNLIKELY(v8_flags.turboshaft_enable_debug_features)) {
       // This phase has to run very late to allow all previous phases to use
       // debug features.
-      Run<turboshaft::DebugFeatureLoweringPhase>();
+      RUN_MAYBE_ABORT(turboshaft::DebugFeatureLoweringPhase);
     }
 #endif  // V8_ENABLE_DEBUG_CODE
 
     return true;
   }
 
-  void RunSimplificationAndNormalizationPhase() {
-    Run<SimplificationAndNormalizationPhase>();
+  V8_WARN_UNUSED_RESULT bool RunSimplificationAndNormalizationPhase() {
+    RUN_MAYBE_ABORT(SimplificationAndNormalizationPhase);
+    return true;
   }
 
-  void PrepareForInstructionSelection(
+  V8_WARN_UNUSED_RESULT bool PrepareForInstructionSelection(
       const ProfileDataFromFile* profile = nullptr) {
     if (V8_UNLIKELY(data()->pipeline_kind() == TurboshaftPipelineKind::kCSA ||
                     data()->pipeline_kind() ==
                         TurboshaftPipelineKind::kTSABuiltin)) {
       if (profile) {
-        Run<ProfileApplicationPhase>(profile);
+        RUN_MAYBE_ABORT(ProfileApplicationPhase, profile);
       }
 
       if (v8_flags.reorder_builtins &&
@@ -259,7 +265,7 @@ class V8_EXPORT_PRIVATE Pipeline {
 
         info()->set_profiler_data(profiler_data);
 
-        Run<BlockInstrumentationPhase>();
+        RUN_MAYBE_ABORT(BlockInstrumentationPhase);
       } else {
         // We run an empty copying phase to make sure that we have the same
         // control flow as when taking the profile.
@@ -272,9 +278,9 @@ class V8_EXPORT_PRIVATE Pipeline {
     // DecompressionOptimization has to run as the last phase because it
     // constructs an (slightly) invalid graph that mixes Tagged and Compressed
     // representations.
-    Run<DecompressionOptimizationPhase>();
+    RUN_MAYBE_ABORT(DecompressionOptimizationPhase);
 
-    Run<SpecialRPOSchedulingPhase>();
+    return Run<SpecialRPOSchedulingPhase>();
   }
 
   [[nodiscard]] bool SelectInstructions(Linkage* linkage) {
@@ -326,7 +332,8 @@ class V8_EXPORT_PRIVATE Pipeline {
     // }
   }
 
-  bool AllocateRegisters(CallDescriptor* call_descriptor) {
+  V8_WARN_UNUSED_RESULT bool AllocateRegisters(
+      CallDescriptor* call_descriptor) {
     BeginPhaseKind("V8.TFRegisterAllocation");
 
     bool run_verifier = v8_flags.turbo_verify_allocation;
@@ -341,24 +348,24 @@ class V8_EXPORT_PRIVATE Pipeline {
           RegisterConfiguration::RestrictGeneralRegisters(registers));
       config = restricted_config.get();
     }
-    AllocateRegisters(config, call_descriptor, run_verifier);
+    if (!AllocateRegisters(config, call_descriptor, run_verifier)) return false;
 
     // Verify the instruction sequence has the same hash in two stages.
     VerifyGeneratedCodeIsIdempotent();
 
-    Run<FrameElisionPhase>();
+    RUN_MAYBE_ABORT(FrameElisionPhase);
 
     // TODO(mtrofin): move this off to the register allocator.
     bool generate_frame_at_start =
         data_->sequence()->instruction_blocks().front()->must_construct_frame();
     // Optimimize jumps.
     if (v8_flags.turbo_jt) {
-      Run<JumpThreadingPhase>(generate_frame_at_start);
+      RUN_MAYBE_ABORT(JumpThreadingPhase, generate_frame_at_start);
     }
 
     EndPhaseKind();
 
-    return true;
+    return !info()->was_cancelled();
   }
 
   bool MayHaveUnverifiableGraph() const {
@@ -389,16 +396,17 @@ class V8_EXPORT_PRIVATE Pipeline {
     }
   }
 
-  void AllocateRegisters(const RegisterConfiguration* config,
-                         CallDescriptor* call_descriptor, bool run_verifier);
+  V8_WARN_UNUSED_RESULT bool AllocateRegisters(
+      const RegisterConfiguration* config, CallDescriptor* call_descriptor,
+      bool run_verifier);
 
-  void AssembleCode(Linkage* linkage) {
+  V8_WARN_UNUSED_RESULT bool AssembleCode(Linkage* linkage) {
     BeginPhaseKind("V8.TFCodeGeneration");
     data()->InitializeCodeGenerator(linkage);
 
     UnparkedScopeIfNeeded unparked_scope(data()->broker());
 
-    Run<AssembleCodePhase>();
+    RUN_MAYBE_ABORT(AssembleCodePhase);
     if (info()->trace_turbo_json()) {
       TurboJsonFile json_of(info(), std::ios_base::app);
       json_of
@@ -411,16 +419,17 @@ class V8_EXPORT_PRIVATE Pipeline {
 
     data()->ClearInstructionComponent();
     EndPhaseKind();
+    return !info()->was_cancelled();
   }
 
   MaybeHandle<Code> GenerateCode(CallDescriptor* call_descriptor) {
     Linkage linkage(call_descriptor);
-    PrepareForInstructionSelection();
+    if (!PrepareForInstructionSelection()) return {};
     if (!SelectInstructions(&linkage)) {
       return MaybeHandle<Code>();
     }
-    AllocateRegisters(linkage.GetIncomingDescriptor());
-    AssembleCode(&linkage);
+    if (!AllocateRegisters(linkage.GetIncomingDescriptor())) return {};
+    if (!AssembleCode(&linkage)) return {};
     return FinalizeCode();
   }
 
@@ -436,7 +445,7 @@ class V8_EXPORT_PRIVATE Pipeline {
     if (data_->broker() && retire_broker) {
       data_->broker()->Retire();
     }
-    Run<FinalizeCodePhase>();
+    RUN_MAYBE_ABORT(FinalizeCodePhase);
 
     MaybeIndirectHandle<Code> maybe_code = data_->code();
     IndirectHandle<Code> code;
@@ -520,6 +529,8 @@ class BuiltinPipeline : public Pipeline {
 #endif
 };
 
+#undef RUN_MAYBE_ABORT
+
 }  // namespace v8::internal::compiler::turboshaft
 
 #endif  // V8_COMPILER_TURBOSHAFT_PIPELINES_H_
diff --git a/deps/v8/src/compiler/turboshaft/turbolev-graph-builder.cc b/deps/v8/src/compiler/turboshaft/turbolev-graph-builder.cc
index 12c5a287eb58af..849c1d0d9c2fb3 100644
--- a/deps/v8/src/compiler/turboshaft/turbolev-graph-builder.cc
+++ b/deps/v8/src/compiler/turboshaft/turbolev-graph-builder.cc
@@ -52,6 +52,7 @@
 #include "src/maglev/maglev-ir.h"
 #include "src/maglev/maglev-phi-representation-selector.h"
 #include "src/maglev/maglev-post-hoc-optimizations-processors.h"
+#include "src/objects/contexts.h"
 #include "src/objects/elements-kind.h"
 #include "src/objects/heap-object.h"
 #include "src/objects/js-array-buffer.h"
@@ -1072,6 +1073,13 @@ class GraphBuildingNodeProcessor {
     SetMap(node, __ Word32SignHintUnsigned(__ Word32Constant(node->value())));
     return maglev::ProcessResult::kContinue;
   }
+
+  maglev::ProcessResult Process(maglev::IntPtrConstant* node,
+                                const maglev::ProcessingState& state) {
+    SetMap(node, __ WordPtrConstant(node->value()));
+    return maglev::ProcessResult::kContinue;
+  }
+
   maglev::ProcessResult Process(maglev::Float64Constant* node,
                                 const maglev::ProcessingState& state) {
     SetMap(node, __ Float64Constant(node->value()));
@@ -2912,10 +2920,29 @@ class GraphBuildingNodeProcessor {
     IF_NOT (__ IsSmi(value)) {
       V<i::Map> value_map = __ LoadMapField(value);
       IF (UNLIKELY(__ TaggedEqual(
-              value_map, __ HeapConstant(local_factory_->heap_number_map())))) {
-        V<HeapNumber> heap_number = V<HeapNumber>::Cast(value);
-        result = __ LoadHeapNumberFromScriptContext(script_context,
-                                                    node->index(), heap_number);
+              value_map,
+              __ HeapConstant(local_factory_->context_cell_map())))) {
+        V<ContextCell> slot = V<ContextCell>::Cast(value);
+        V<Word32> slot_state =
+            __ LoadField<Word32>(slot, AccessBuilder::ForContextCellState());
+        static_assert(ContextCell::State::kConst == 0);
+        static_assert(ContextCell::State::kSmi == 1);
+        IF (__ Int32LessThanOrEqual(slot_state,
+                                    __ Word32Constant(ContextCell::kSmi))) {
+          result = __ LoadField<Object>(
+              slot, AccessBuilder::ForContextCellTaggedValue());
+        } ELSE {
+          ScopedVar<Float64, AssemblerT> number(this);
+          IF (__ Word32Equal(slot_state,
+                             __ Word32Constant(ContextCell::kInt32))) {
+            number = __ ChangeInt32ToFloat64(__ LoadField<Word32>(
+                slot, AccessBuilder::ForContextCellInt32Value()));
+          } ELSE {
+            number = __ LoadField<Float64>(
+                slot, AccessBuilder::ForContextCellFloat64Value());
+          }
+          result = __ AllocateHeapNumberWithValue(number, isolate_->factory());
+        }
       }
     }
     SetMap(node, result);
@@ -2940,13 +2967,6 @@ class GraphBuildingNodeProcessor {
                          MemoryRepresentation::Int32(), node->offset()));
     return maglev::ProcessResult::kContinue;
   }
-  maglev::ProcessResult Process(maglev::LoadHeapInt32* node,
-                                const maglev::ProcessingState& state) {
-    V<HeapNumber> field = __ LoadTaggedField<HeapNumber>(
-        Map(node->object_input()), node->offset());
-    SetMap(node, __ LoadHeapInt32Value(field));
-    return maglev::ProcessResult::kContinue;
-  }
   maglev::ProcessResult Process(maglev::LoadFixedArrayElement* node,
                                 const maglev::ProcessingState& state) {
     SetMap(node, __ LoadFixedArrayElement(
@@ -2998,30 +3018,80 @@ class GraphBuildingNodeProcessor {
              node->initializing_or_transitioning());
     return maglev::ProcessResult::kContinue;
   }
-  maglev::ProcessResult Process(
-      maglev::StoreScriptContextSlotWithWriteBarrier* node,
-      const maglev::ProcessingState& state) {
-    Label<> done(this);
+  maglev::ProcessResult Process(maglev::StoreContextSlotWithWriteBarrier* node,
+                                const maglev::ProcessingState& state) {
     V<Context> context = V<i::Context>::Cast(Map(node->context_input()));
     V<Object> new_value = Map(node->new_value_input());
     V<Object> old_value = __ LoadTaggedField(context, node->offset());
-    IF_NOT (__ TaggedEqual(old_value, new_value)) {
-      V<Object> side_data =
-          __ LoadScriptContextSideData(context, node->index());
-      IF_NOT (UNLIKELY(__ TaggedEqual(
-                  side_data,
-                  __ SmiConstant(ContextSidePropertyCell::Other())))) {
-        GET_FRAME_STATE_MAYBE_ABORT(frame_state, node->eager_deopt_info());
-        __ StoreScriptContextSlowPath(
-            context, old_value, new_value, side_data, frame_state,
-            node->eager_deopt_info()->feedback_to_update(), done);
-      }
+    IF (__ IsSmi(old_value)) {
       __ Store(context, new_value, StoreOp::Kind::TaggedBase(),
                MemoryRepresentation::AnyTagged(),
                WriteBarrierKind::kFullWriteBarrier, node->offset(), false);
+    } ELSE {
+      V<i::Map> value_map = __ LoadMapField(old_value);
+      IF (UNLIKELY(__ TaggedEqual(
+              value_map,
+              __ HeapConstant(local_factory_->context_cell_map())))) {
+        V<ContextCell> slot = V<ContextCell>::Cast(old_value);
+        V<Word32> slot_state =
+            __ LoadField<Word32>(slot, AccessBuilder::ForContextCellState());
+        GET_FRAME_STATE_MAYBE_ABORT(frame_state, node->eager_deopt_info());
+        IF (__ Word32Equal(slot_state,
+                           __ Word32Constant(ContextCell::kFloat64))) {
+          ScopedVar<Float64, AssemblerT> number(this);
+          IF (__ IsSmi(new_value)) {
+            number =
+                __ ChangeInt32ToFloat64(__ UntagSmi(V<Smi>::Cast(new_value)));
+          } ELSE {
+            V<i::Map> map = __ LoadMapField(new_value);
+            __ DeoptimizeIfNot(
+                __ TaggedEqual(
+                    map, __ HeapConstant(local_factory_->heap_number_map())),
+                frame_state, DeoptimizeReason::kWrongValue,
+                node->eager_deopt_info()->feedback_to_update());
+            number = __ LoadHeapNumberValue(V<HeapNumber>::Cast(new_value));
+          }
+          __ StoreField(slot, AccessBuilder::ForContextCellFloat64Value(),
+                        number);
+        } ELSE IF (__ Word32Equal(slot_state,
+                                 __ Word32Constant(ContextCell::kInt32))) {
+          ScopedVar<Word32, AssemblerT> number(this);
+          IF (__ IsSmi(new_value)) {
+            number = __ UntagSmi(V<Smi>::Cast(new_value));
+          } ELSE {
+            V<i::Map> map = __ LoadMapField(new_value);
+            __ DeoptimizeIfNot(
+                __ TaggedEqual(
+                    map, __ HeapConstant(local_factory_->heap_number_map())),
+                frame_state, DeoptimizeReason::kWrongValue,
+                node->eager_deopt_info()->feedback_to_update());
+            number = __ ChangeFloat64ToInt32OrDeopt(
+                __ LoadHeapNumberValue(V<HeapNumber>::Cast(new_value)),
+                frame_state, CheckForMinusZeroMode::kCheckForMinusZero,
+                node->eager_deopt_info()->feedback_to_update());
+          }
+          __ StoreField(slot, AccessBuilder::ForContextCellInt32Value(),
+                        number);
+        } ELSE IF (__ Word32Equal(slot_state,
+                                 __ Word32Constant(ContextCell::kSmi))) {
+          __ DeoptimizeIfNot(__ IsSmi(new_value), frame_state,
+                             DeoptimizeReason::kWrongValue,
+                             node->eager_deopt_info()->feedback_to_update());
+          __ StoreField(slot, AccessBuilder::ForContextCellTaggedValue(),
+                        new_value);
+        } ELSE {
+          V<Object> tagged_value = __ LoadField<Object>(
+              slot, AccessBuilder::ForContextCellTaggedValue());
+          __ DeoptimizeIfNot(__ TaggedEqual(new_value, tagged_value),
+                             frame_state, DeoptimizeReason::kWrongValue,
+                             node->eager_deopt_info()->feedback_to_update());
+        }
+      } ELSE {
+        __ Store(context, new_value, StoreOp::Kind::TaggedBase(),
+                 MemoryRepresentation::AnyTagged(),
+                 WriteBarrierKind::kFullWriteBarrier, node->offset(), false);
+      }
     }
-    GOTO(done);
-    BIND(done);
     return maglev::ProcessResult::kContinue;
   }
   maglev::ProcessResult Process(maglev::StoreDoubleField* node,
@@ -3032,14 +3102,6 @@ class GraphBuildingNodeProcessor {
                   Map(node->value_input()));
     return maglev::ProcessResult::kContinue;
   }
-  maglev::ProcessResult Process(maglev::StoreHeapInt32* node,
-                                const maglev::ProcessingState& state) {
-    V<HeapNumber> field = __ LoadTaggedField<HeapNumber>(
-        Map(node->object_input()), node->offset());
-    __ StoreField(field, AccessBuilder::ForHeapInt32Value(),
-                  Map(node->value_input()));
-    return maglev::ProcessResult::kContinue;
-  }
   maglev::ProcessResult Process(
       maglev::StoreTrustedPointerFieldWithWriteBarrier* node,
       const maglev::ProcessingState& state) {
@@ -3189,6 +3251,36 @@ class GraphBuildingNodeProcessor {
     SetMap(node, value);
     return maglev::ProcessResult::kContinue;
   }
+  maglev::ProcessResult Process(
+      maglev::LoadUnsignedIntConstantTypedArrayElement* node,
+      const maglev::ProcessingState& state) {
+    SetMap(node, BuildConstantTypedArrayLoad(node->typed_array(),
+                                             Map<Word32>(node->index_input()),
+                                             node->elements_kind()));
+    return maglev::ProcessResult::kContinue;
+  }
+  maglev::ProcessResult Process(
+      maglev::LoadSignedIntConstantTypedArrayElement* node,
+      const maglev::ProcessingState& state) {
+    SetMap(node, BuildConstantTypedArrayLoad(node->typed_array(),
+                                             Map<Word32>(node->index_input()),
+                                             node->elements_kind()));
+    return maglev::ProcessResult::kContinue;
+  }
+  maglev::ProcessResult Process(
+      maglev::LoadDoubleConstantTypedArrayElement* node,
+      const maglev::ProcessingState& state) {
+    DCHECK_EQ(node->elements_kind(),
+              any_of(FLOAT32_ELEMENTS, FLOAT64_ELEMENTS));
+    V<Float> value = V<Float>::Cast(BuildConstantTypedArrayLoad(
+        node->typed_array(), Map<Word32>(node->index_input()),
+        node->elements_kind()));
+    if (node->elements_kind() == FLOAT32_ELEMENTS) {
+      value = __ ChangeFloat32ToFloat64(V<Float32>::Cast(value));
+    }
+    SetMap(node, value);
+    return maglev::ProcessResult::kContinue;
+  }
 
   maglev::ProcessResult Process(maglev::StoreIntTypedArrayElement* node,
                                 const maglev::ProcessingState& state) {
@@ -3212,6 +3304,28 @@ class GraphBuildingNodeProcessor {
     return maglev::ProcessResult::kContinue;
   }
 
+  maglev::ProcessResult Process(maglev::StoreIntConstantTypedArrayElement* node,
+                                const maglev::ProcessingState& state) {
+    BuildConstantTypedArrayStore(
+        node->typed_array(), Map<Word32>(node->index_input()),
+        Map<Untagged>(node->value_input()), node->elements_kind());
+    return maglev::ProcessResult::kContinue;
+  }
+  maglev::ProcessResult Process(
+      maglev::StoreDoubleConstantTypedArrayElement* node,
+      const maglev::ProcessingState& state) {
+    DCHECK_EQ(node->elements_kind(),
+              any_of(FLOAT32_ELEMENTS, FLOAT64_ELEMENTS));
+    V<Float> value = Map<Float>(node->value_input());
+    if (node->elements_kind() == FLOAT32_ELEMENTS) {
+      value = __ TruncateFloat64ToFloat32(Map(node->value_input()));
+    }
+    BuildConstantTypedArrayStore(node->typed_array(),
+                                 Map<Word32>(node->index_input()), value,
+                                 node->elements_kind());
+    return maglev::ProcessResult::kContinue;
+  }
+
   maglev::ProcessResult Process(maglev::CheckJSDataViewBounds* node,
                                 const maglev::ProcessingState& state) {
     GET_FRAME_STATE_MAYBE_ABORT(frame_state, node->eager_deopt_info());
@@ -5161,6 +5275,12 @@ class GraphBuildingNodeProcessor {
                                value->Cast<maglev::Uint32Constant>()->value()));
           break;
 
+        case maglev::Opcode::kIntPtrConstant:
+          builder.AddInput(MachineType::AnyTagged(),
+                           __ NumberConstant(
+                               value->Cast<maglev::IntPtrConstant>()->value()));
+          break;
+
         case maglev::Opcode::kRootConstant:
           builder.AddInput(
               MachineType::AnyTagged(),
@@ -5476,6 +5596,18 @@ class GraphBuildingNodeProcessor {
                                __ ChangeUint32ToUintPtr(index),
                                GetArrayTypeFromElementsKind(kind));
   }
+
+  V<Untagged> BuildConstantTypedArrayLoad(compiler::JSTypedArrayRef typed_array,
+                                          V<Word32> index, ElementsKind kind) {
+    // Using the 0 as the base pointer is fine, since the typed array is not on
+    // the heap.
+    DCHECK(!typed_array.is_on_heap());
+    return __ LoadTypedElement(
+        __ HeapConstant(typed_array.object()), __ SmiConstant(Smi::zero()),
+        __ WordPtrConstant(reinterpret_cast<uintptr_t>(typed_array.data_ptr())),
+        __ ChangeUint32ToUintPtr(index), GetArrayTypeFromElementsKind(kind));
+  }
+
   void BuildTypedArrayStore(V<JSTypedArray> typed_array, V<Word32> index,
                             V<Untagged> value, ElementsKind kind) {
     auto [data_pointer, base_pointer] =
@@ -5485,6 +5617,19 @@ class GraphBuildingNodeProcessor {
                          GetArrayTypeFromElementsKind(kind));
   }
 
+  void BuildConstantTypedArrayStore(compiler::JSTypedArrayRef typed_array,
+                                    V<Word32> index, V<Untagged> value,
+                                    ElementsKind kind) {
+    // Using the 0 as the base pointer is fine, since the typed array is not on
+    // the heap.
+    DCHECK(!typed_array.is_on_heap());
+    __ StoreTypedElement(
+        __ HeapConstant(typed_array.object()), __ SmiConstant(Smi::zero()),
+        __ WordPtrConstant(reinterpret_cast<uintptr_t>(typed_array.data_ptr())),
+        __ ChangeUint32ToUintPtr(index), value,
+        GetArrayTypeFromElementsKind(kind));
+  }
+
   V<Number> Float64ToTagged(
       V<Float64> input,
       maglev::Float64ToTagged::ConversionMode conversion_mode) {
diff --git a/deps/v8/src/compiler/turboshaft/wasm-in-js-inlining-reducer-inl.h b/deps/v8/src/compiler/turboshaft/wasm-in-js-inlining-reducer-inl.h
index e173e260ef3be7..b73e8c38516215 100644
--- a/deps/v8/src/compiler/turboshaft/wasm-in-js-inlining-reducer-inl.h
+++ b/deps/v8/src/compiler/turboshaft/wasm-in-js-inlining-reducer-inl.h
@@ -658,6 +658,46 @@ class WasmInJsInliningInterface {
   }
   void ThrowRef(FullDecoder* decoder, Value* value) { Bailout(decoder); }
 
+  void ContNew(FullDecoder* decoder, const wasm::ContIndexImmediate& imm,
+               const Value& func_ref, Value* result) {
+    Bailout(decoder);
+  }
+
+  void ContBind(FullDecoder* decoder, const wasm::ContIndexImmediate& orig_imm,
+                Value input_cont, const Value args[],
+                const wasm::ContIndexImmediate& new_imm, Value* result) {
+    Bailout(decoder);
+  }
+
+  void Resume(FullDecoder* decoder, const wasm::ContIndexImmediate& imm,
+              base::Vector<wasm::HandlerCase> handlers, const Value args[],
+              const Value returns[]) {
+    Bailout(decoder);
+  }
+
+  void ResumeThrow(FullDecoder* decoder,
+                   const wasm::ContIndexImmediate& cont_imm,
+                   const TagIndexImmediate& exc_imm,
+                   base::Vector<wasm::HandlerCase> handlers, const Value args[],
+                   const Value returns[]) {
+    Bailout(decoder);
+  }
+
+  void Switch(FullDecoder* decoder, const TagIndexImmediate& tag_imm,
+              const wasm::ContIndexImmediate& con_imm, const Value& cont_ref,
+              const Value args[], Value returns[]) {
+    Bailout(decoder);
+  }
+
+  void Suspend(FullDecoder* decoder, const TagIndexImmediate& imm,
+               const Value args[], const Value returns[]) {
+    Bailout(decoder);
+  }
+
+  void EffectHandlerTable(FullDecoder* decoder, Control* block) {
+    Bailout(decoder);
+  }
+
   // TODO(dlehmann,353475584): Support traps in the inlinee.
 
   void Trap(FullDecoder* decoder, wasm::TrapReason reason) { Bailout(decoder); }
@@ -928,6 +968,12 @@ class WasmInJsInliningInterface {
                 bool null_succeeds) {
     Bailout(decoder);
   }
+  void BrOnCastDesc(FullDecoder* decoder, wasm::HeapType target_type,
+                    const Value& object, const Value& descriptor,
+                    Value* value_on_branch, uint32_t br_depth,
+                    bool null_succeeds) {
+    Bailout(decoder);
+  }
   void BrOnCastAbstract(FullDecoder* decoder, const Value& object,
                         wasm::HeapType type, Value* value_on_branch,
                         uint32_t br_depth, bool null_succeeds) {
@@ -938,6 +984,12 @@ class WasmInJsInliningInterface {
                     uint32_t br_depth, bool null_succeeds) {
     Bailout(decoder);
   }
+  void BrOnCastDescFail(FullDecoder* decoder, wasm::HeapType target_type,
+                        const Value& object, const Value& descriptor,
+                        Value* value_on_fallthrough, uint32_t br_depth,
+                        bool null_succeeds) {
+    Bailout(decoder);
+  }
   void BrOnCastFailAbstract(FullDecoder* decoder, const Value& object,
                             wasm::HeapType type, Value* value_on_fallthrough,
                             uint32_t br_depth, bool null_succeeds) {
diff --git a/deps/v8/src/compiler/turboshaft/wasm-load-elimination-reducer.h b/deps/v8/src/compiler/turboshaft/wasm-load-elimination-reducer.h
index 2b9d29c38f0896..b60da48d01c318 100644
--- a/deps/v8/src/compiler/turboshaft/wasm-load-elimination-reducer.h
+++ b/deps/v8/src/compiler/turboshaft/wasm-load-elimination-reducer.h
@@ -637,6 +637,7 @@ void WasmLoadEliminationAnalyzer::ProcessBlock(const Block& block,
       case Opcode::kSimd128LaneMemory:
       case Opcode::kGlobalSet:
       case Opcode::kParameter:
+      case Opcode::kSetStackPointer:
         // We explicitly break for those operations that have can_write effects
         // but don't actually write, or cannot interfere with load elimination.
         break;
diff --git a/deps/v8/src/compiler/turboshaft/wasm-lowering-reducer.h b/deps/v8/src/compiler/turboshaft/wasm-lowering-reducer.h
index d8c4251788ede4..1f120191a6d69d 100644
--- a/deps/v8/src/compiler/turboshaft/wasm-lowering-reducer.h
+++ b/deps/v8/src/compiler/turboshaft/wasm-lowering-reducer.h
@@ -324,7 +324,8 @@ class WasmLoweringReducer : public Next {
   }
 
   V<WasmArray> REDUCE(WasmAllocateArray)(V<Map> rtt, V<Word32> length,
-                                         const wasm::ArrayType* array_type) {
+                                         const wasm::ArrayType* array_type,
+                                         bool is_shared) {
     __ TrapIfNot(
         __ Uint32LessThanOrEqual(
             length, __ Word32Constant(WasmArray::MaxLength(array_type))),
@@ -342,12 +343,15 @@ class WasmLoweringReducer : public Next {
     Uninitialized<WasmArray> a = __ template Allocate<WasmArray>(
         __ ChangeUint32ToUintPtr(__ Word32Add(
             padded_length, __ Word32Constant(WasmArray::kHeaderSize))),
-        AllocationType::kYoung);
+        is_shared ? AllocationType::kSharedOld : AllocationType::kYoung);
 
     // TODO(14108): The map and empty fixed array initialization should be an
     // immutable store.
-    __ InitializeField(a, AccessBuilder::ForMap(compiler::kNoWriteBarrier),
-                       rtt);
+    __ InitializeField(
+        a,
+        AccessBuilder::ForMap(is_shared ? compiler::kMapWriteBarrier
+                                        : compiler::kNoWriteBarrier),
+        rtt);
     __ InitializeField(a, AccessBuilder::ForJSObjectPropertiesOrHash(),
                        LOAD_ROOT(EmptyFixedArray));
     __ InitializeField(a, AccessBuilder::ForWasmArrayLength(), length);
@@ -358,13 +362,18 @@ class WasmLoweringReducer : public Next {
     return array;
   }
 
-  V<WasmStruct> REDUCE(WasmAllocateStruct)(
-      V<Map> rtt, const wasm::StructType* struct_type) {
+  V<WasmStruct> REDUCE(WasmAllocateStruct)(V<Map> rtt,
+                                           const wasm::StructType* struct_type,
+                                           bool is_shared) {
     int size = WasmStruct::Size(struct_type);
-    Uninitialized<WasmStruct> s =
-        __ template Allocate<WasmStruct>(size, AllocationType::kYoung);
-    __ InitializeField(s, AccessBuilder::ForMap(compiler::kNoWriteBarrier),
-                       rtt);
+    Uninitialized<WasmStruct> s = __ template Allocate<WasmStruct>(
+        size, is_shared ? AllocationType::kSharedOld : AllocationType::kYoung);
+    // Objects allocated into old-space need a write barrier for initialization.
+    __ InitializeField(
+        s,
+        AccessBuilder::ForMap(is_shared ? compiler::kMapWriteBarrier
+                                        : compiler::kNoWriteBarrier),
+        rtt);
     __ InitializeField(s, AccessBuilder::ForJSObjectPropertiesOrHash(),
                        LOAD_ROOT(EmptyFixedArray));
     // Note: Struct initialization isn't finished here, the user defined fields
diff --git a/deps/v8/src/compiler/turboshaft/wasm-revec-reducer.cc b/deps/v8/src/compiler/turboshaft/wasm-revec-reducer.cc
index 109955b0566314..9f9f328c093d75 100644
--- a/deps/v8/src/compiler/turboshaft/wasm-revec-reducer.cc
+++ b/deps/v8/src/compiler/turboshaft/wasm-revec-reducer.cc
@@ -235,8 +235,8 @@ void ForEach(FunctionType callback,
              const ZoneUnorderedMap<OpIndex, ZoneVector<PackNode*>>& node_map) {
   absl::flat_hash_set<PackNode const*> visited;
 
-  for (auto entry : node_map) {
-    for (auto pnode : entry.second) {
+  for (const auto& entry : node_map) {
+    for (auto* pnode : entry.second) {
       if (visited.find(pnode) != visited.end()) {
         continue;
       }
diff --git a/deps/v8/src/compiler/turboshaft/wasm-revec-reducer.h b/deps/v8/src/compiler/turboshaft/wasm-revec-reducer.h
index 8184ead5754868..c469e832920001 100644
--- a/deps/v8/src/compiler/turboshaft/wasm-revec-reducer.h
+++ b/deps/v8/src/compiler/turboshaft/wasm-revec-reducer.h
@@ -11,7 +11,7 @@
 
 #include <algorithm>
 
-#include "src/base/safe_conversions.h"
+#include "src/base/numerics/safe_conversions.h"
 #include "src/compiler/turboshaft/assembler.h"
 #include "src/compiler/turboshaft/operations.h"
 #include "src/compiler/turboshaft/phase.h"
diff --git a/deps/v8/src/compiler/verifier.cc b/deps/v8/src/compiler/verifier.cc
index 7a69a2dbf310c0..d1bcb92a942855 100644
--- a/deps/v8/src/compiler/verifier.cc
+++ b/deps/v8/src/compiler/verifier.cc
@@ -850,12 +850,12 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kJSHasContextExtension:
       CheckTypeIs(node, Type::Boolean());
       break;
+    case IrOpcode::kJSLoadContextNoCell:
     case IrOpcode::kJSLoadContext:
-    case IrOpcode::kJSLoadScriptContext:
       CheckTypeIs(node, Type::Any());
       break;
+    case IrOpcode::kJSStoreContextNoCell:
     case IrOpcode::kJSStoreContext:
-    case IrOpcode::kJSStoreScriptContext:
       CheckNotTyped(node);
       break;
     case IrOpcode::kJSCreateFunctionContext:
@@ -919,7 +919,7 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckTypeIs(node, Type::SignedSmall());
       break;
 
-    case IrOpcode::kJSGeneratorRestoreContext:
+    case IrOpcode::kJSGeneratorRestoreContextNoCell:
       CheckTypeIs(node, Type::Any());
       break;
 
diff --git a/deps/v8/src/compiler/wasm-compiler.cc b/deps/v8/src/compiler/wasm-compiler.cc
index 87a194b5c289ed..0cb0161449d1fa 100644
--- a/deps/v8/src/compiler/wasm-compiler.cc
+++ b/deps/v8/src/compiler/wasm-compiler.cc
@@ -847,6 +847,66 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
                         global_proxy);
   }
 
+  template <typename... Args>
+  Node* BuildCCall(MachineSignature* sig, Node* function, Args... args) {
+    DCHECK_LE(sig->return_count(), 1);
+    DCHECK_EQ(sizeof...(args), sig->parameter_count());
+    Node* call_args[] = {function, args..., effect(), control()};
+
+    auto call_descriptor =
+        Linkage::GetSimplifiedCDescriptor(mcgraph()->zone(), sig);
+
+    return gasm_->Call(call_descriptor, arraysize(call_args), call_args);
+  }
+
+  Node* BuildSwitchToTheCentralStack() {
+    Node* do_switch = gasm_->ExternalConstant(
+        ExternalReference::wasm_switch_to_the_central_stack_for_js());
+    MachineType reps[] = {MachineType::Pointer(), MachineType::Pointer(),
+                          MachineType::Pointer()};
+    MachineSignature sig(1, 2, reps);
+
+    Node* central_stack_sp = BuildCCall(
+        &sig, do_switch,
+        gasm_->ExternalConstant(ExternalReference::isolate_address()),
+        gasm_->LoadFramePointer());
+    Node* old_sp = gasm_->LoadStackPointer();
+    // Temporarily disallow sp-relative offsets.
+    gasm_->SetStackPointer(central_stack_sp);
+    return old_sp;
+  }
+
+  void BuildSwitchBackFromCentralStack(Node* old_sp) {
+    auto skip = gasm_->MakeLabel();
+    gasm_->GotoIf(gasm_->IntPtrEqual(old_sp, gasm_->IntPtrConstant(0)), &skip);
+    Node* do_switch = gasm_->ExternalConstant(
+        ExternalReference::wasm_switch_from_the_central_stack_for_js());
+    MachineType reps[] = {MachineType::Pointer()};
+    MachineSignature sig(0, 1, reps);
+    BuildCCall(&sig, do_switch,
+               gasm_->ExternalConstant(ExternalReference::isolate_address()));
+    gasm_->SetStackPointer(old_sp);
+    gasm_->Goto(&skip);
+    gasm_->Bind(&skip);
+  }
+
+  Node* BuildSwitchToTheCentralStackIfNeeded() {
+    // If the current stack is a secondary stack, switch to the central stack.
+    auto end = gasm_->MakeLabel(MachineType::PointerRepresentation());
+    Node* isolate_root = BuildLoadIsolateRoot();
+    Node* is_on_central_stack_flag =
+        gasm_->Load(MachineType::Uint8(), isolate_root,
+                    IsolateData::is_on_central_stack_flag_offset());
+    gasm_->GotoIf(is_on_central_stack_flag, &end, BranchHint::kTrue,
+                  gasm_->IntPtrConstant(0));
+
+    Node* old_sp = BuildSwitchToTheCentralStack();
+    gasm_->Goto(&end, old_sp);
+
+    gasm_->Bind(&end);
+    return end.PhiAt(0);
+  }
+
   void BuildJSFastApiCallWrapper(DirectHandle<JSReceiver> callable) {
     // Here 'callable_node' must be equal to 'callable' but we cannot pass a
     // HeapConstant(callable) because WasmCode::Validate() fails with
@@ -917,6 +977,7 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
                         FunctionTemplateInfo::kCallbackDataOffset));
 
     FastApiCallFunction c_function{c_address, c_signature};
+    Node* old_sp = BuildSwitchToTheCentralStackIfNeeded();
     Node* call = fast_api_call::BuildFastApiCall(
         target->GetIsolate(), graph(), gasm_.get(), c_function,
         api_data_argument,
@@ -945,6 +1006,7 @@ class WasmWrapperGraphBuilder : public WasmGraphBuilder {
           // is not used.
           UNREACHABLE();
         });
+    BuildSwitchBackFromCentralStack(old_sp);
 
     BuildModifyThreadInWasmFlag(true);
 
diff --git a/deps/v8/src/compiler/wasm-graph-assembler.cc b/deps/v8/src/compiler/wasm-graph-assembler.cc
index 4022f60656a21d..635cd877403ada 100644
--- a/deps/v8/src/compiler/wasm-graph-assembler.cc
+++ b/deps/v8/src/compiler/wasm-graph-assembler.cc
@@ -436,7 +436,7 @@ Node* WasmGraphAssembler::LoadSharedFunctionInfo(Node* js_function) {
       MachineType::TaggedPointer(), js_function,
       wasm::ObjectAccess::SharedFunctionInfoOffsetInTaggedJSFunction());
 }
-Node* WasmGraphAssembler::LoadContextFromJSFunction(Node* js_function) {
+Node* WasmGraphAssembler::LoadContextNoCellFromJSFunction(Node* js_function) {
   return LoadFromObject(MachineType::TaggedPointer(), js_function,
                         wasm::ObjectAccess::ContextOffsetInTaggedJSFunction());
 }
diff --git a/deps/v8/src/compiler/wasm-graph-assembler.h b/deps/v8/src/compiler/wasm-graph-assembler.h
index 5c85f818458777..96b457cbcce2a6 100644
--- a/deps/v8/src/compiler/wasm-graph-assembler.h
+++ b/deps/v8/src/compiler/wasm-graph-assembler.h
@@ -250,7 +250,7 @@ class WasmGraphAssembler : public GraphAssembler {
 
   Node* LoadSharedFunctionInfo(Node* js_function);
 
-  Node* LoadContextFromJSFunction(Node* js_function);
+  Node* LoadContextNoCellFromJSFunction(Node* js_function);
 
   Node* LoadFunctionDataFromJSFunction(Node* js_function);
 
diff --git a/deps/v8/src/compiler/wasm-inlining-into-js.cc b/deps/v8/src/compiler/wasm-inlining-into-js.cc
index 19f57061068dec..76b8e398d61aef 100644
--- a/deps/v8/src/compiler/wasm-inlining-into-js.cc
+++ b/deps/v8/src/compiler/wasm-inlining-into-js.cc
@@ -236,6 +236,7 @@ class WasmIntoJSInlinerImpl : private wasm::Decoder {
     SetSourcePosition(gasm_.effect());
   }
 
+  // TODO(14616): Implement for shared types.
   Value ParseRefCast(Value input, bool null_succeeds) {
     auto [heap_index, length] = read_i33v<ValidationTag>(pc_);
     pc_ += length;
diff --git a/deps/v8/src/d8/d8.cc b/deps/v8/src/d8/d8.cc
index 38810cacee66fb..d660640bb978b6 100644
--- a/deps/v8/src/d8/d8.cc
+++ b/deps/v8/src/d8/d8.cc
@@ -1027,7 +1027,8 @@ bool Shell::ExecuteString(Isolate* isolate, Local<String> source,
   MaybeLocal<Value> maybe_result = script->Run(realm);
 
   if (options.code_cache_options ==
-      ShellOptions::CodeCacheOptions::kProduceCacheAfterExecute) {
+          ShellOptions::CodeCacheOptions::kProduceCacheAfterExecute &&
+      !isolate->IsExecutionTerminating()) {
     // Serialize and store it in memory for the next execution.
     ScriptCompiler::CachedData* cached_data =
         ScriptCompiler::CreateCodeCache(script->GetUnboundScript());
@@ -3595,20 +3596,42 @@ void Shell::QuitOnce(v8::FunctionCallbackInfo<v8::Value>* info) {
   base::OS::ExitProcess(exit_code);
 }
 
-void Shell::Terminate(const v8::FunctionCallbackInfo<v8::Value>& info) {
-  DCHECK(i::ValidateCallbackInfo(info));
+namespace {
+
+bool SkipTerminationForFuzzing() {
   // Triggering termination from JS can cause some non-determinism thus we
   // skip it for correctness fuzzing.
+  if (i::v8_flags.correctness_fuzzer_suppressions) return true;
   // Termination also currently breaks Fuzzilli's REPRL mechanism as the
   // scheduled termination will prevent the next testcase sent by Fuzzilli from
   // being processed. This will in turn desynchronize the communication
   // between d8 and Fuzzilli, leading to a crash.
-  if (!i::v8_flags.correctness_fuzzer_suppressions && !fuzzilli_reprl) {
-    auto v8_isolate = info.GetIsolate();
-    if (!v8_isolate->IsExecutionTerminating()) v8_isolate->TerminateExecution();
+  if (fuzzilli_reprl) return true;
+  return false;
+}
+
+}  // namespace
+
+void Shell::TerminateNow(const v8::FunctionCallbackInfo<v8::Value>& info) {
+  DCHECK(i::ValidateCallbackInfo(info));
+  if (SkipTerminationForFuzzing()) return;
+  auto v8_isolate = info.GetIsolate();
+  if (!v8_isolate->IsExecutionTerminating()) {
+    // Force a termination exception for immediate termination.
+    i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(info.GetIsolate());
+    i_isolate->TerminateExecution();
   }
 }
 
+void Shell::ScheduleTermination(
+    const v8::FunctionCallbackInfo<v8::Value>& info) {
+  DCHECK(i::ValidateCallbackInfo(info));
+  if (SkipTerminationForFuzzing()) return;
+  auto v8_isolate = info.GetIsolate();
+  // Schedule a termination request, handled by an interrupt later.
+  if (!v8_isolate->IsExecutionTerminating()) v8_isolate->TerminateExecution();
+}
+
 void Shell::Quit(const v8::FunctionCallbackInfo<v8::Value>& info) {
   DCHECK(i::ValidateCallbackInfo(info));
   base::CallOnce(&quit_once_, &QuitOnce,
@@ -4163,8 +4186,10 @@ Local<ObjectTemplate> Shell::CreateD8Template(Isolate* isolate) {
       isolate, "getContinuationPreservedEmbedderDataViaAPIForTesting",
       FunctionTemplate::New(isolate, GetContinuationPreservedEmbedderData));
 #endif  // V8_ENABLE_CONTINUATION_PRESERVED_EMBEDDER_DATA
+  d8_template->Set(isolate, "terminateNow",
+                   FunctionTemplate::New(isolate, TerminateNow));
   d8_template->Set(isolate, "terminate",
-                   FunctionTemplate::New(isolate, Terminate));
+                   FunctionTemplate::New(isolate, ScheduleTermination));
   d8_template->Set(isolate, "getExtrasBindingObject",
                    FunctionTemplate::New(isolate, GetExtrasBindingObject));
   if (!options.omit_quit) {
diff --git a/deps/v8/src/d8/d8.h b/deps/v8/src/d8/d8.h
index 6fb139446e38ba..e7360c28ebb390 100644
--- a/deps/v8/src/d8/d8.h
+++ b/deps/v8/src/d8/d8.h
@@ -646,7 +646,9 @@ class Shell : public i::AllStatic {
   static void NotifyDone(const v8::FunctionCallbackInfo<v8::Value>& info);
   static void QuitOnce(v8::FunctionCallbackInfo<v8::Value>* info);
   static void Quit(const v8::FunctionCallbackInfo<v8::Value>& info);
-  static void Terminate(const v8::FunctionCallbackInfo<v8::Value>& info);
+  static void TerminateNow(const v8::FunctionCallbackInfo<v8::Value>& info);
+  static void ScheduleTermination(
+      const v8::FunctionCallbackInfo<v8::Value>& info);
   static void Version(const v8::FunctionCallbackInfo<v8::Value>& info);
   static void WriteFile(const v8::FunctionCallbackInfo<v8::Value>& info);
   static void ReadFile(const v8::FunctionCallbackInfo<v8::Value>& info);
diff --git a/deps/v8/src/debug/debug-evaluate.cc b/deps/v8/src/debug/debug-evaluate.cc
index 9d3114f9216d85..cc77e007a39c29 100644
--- a/deps/v8/src/debug/debug-evaluate.cc
+++ b/deps/v8/src/debug/debug-evaluate.cc
@@ -179,7 +179,7 @@ MaybeDirectHandle<Object> DebugEvaluate::Evaluate(
   DirectHandle<JSFunction> eval_fun;
   ASSIGN_RETURN_ON_EXCEPTION(
       isolate, eval_fun,
-      Compiler::GetFunctionFromEval(source, outer_info, context,
+      Compiler::GetFunctionFromEval(isolate, source, outer_info, context,
                                     LanguageMode::kSloppy, NO_PARSE_RESTRICTION,
                                     kNoSourcePosition, kNoSourcePosition,
                                     ParsingWhileDebugging::kYes));
@@ -1067,7 +1067,7 @@ bool BytecodeRequiresRuntimeCheck(interpreter::Bytecode bytecode) {
     case Bytecode::kSetKeyedProperty:
     case Bytecode::kStaInArrayLiteral:
     case Bytecode::kDefineKeyedOwnPropertyInLiteral:
-    case Bytecode::kStaCurrentContextSlot:
+    case Bytecode::kStaCurrentContextSlotNoCell:
       return true;
     default:
       return interpreter::Bytecodes::IsCallRuntime(bytecode);
diff --git a/deps/v8/src/debug/debug-frames.cc b/deps/v8/src/debug/debug-frames.cc
index 3c010ea996eb9e..6e1136066335ca 100644
--- a/deps/v8/src/debug/debug-frames.cc
+++ b/deps/v8/src/debug/debug-frames.cc
@@ -93,7 +93,7 @@ DirectHandle<String> FrameInspector::GetFunctionName() {
                                     wasm_frame->function_index());
   }
 #endif  // V8_ENABLE_WEBASSEMBLY
-  return JSFunction::GetDebugName(function_);
+  return JSFunction::GetDebugName(isolate_, function_);
 }
 
 #if V8_ENABLE_WEBASSEMBLY
@@ -109,7 +109,7 @@ bool FrameInspector::IsJavaScript() { return frame_->is_javascript(); }
 
 bool FrameInspector::ParameterIsShadowedByContextLocal(
     DirectHandle<ScopeInfo> info, DirectHandle<String> parameter_name) {
-  return info->ContextSlotIndex(parameter_name) != -1;
+  return info->ContextSlotIndex(*parameter_name) != -1;
 }
 
 RedirectActiveFunctions::RedirectActiveFunctions(
diff --git a/deps/v8/src/debug/debug-interface.cc b/deps/v8/src/debug/debug-interface.cc
index 951a2c82993486..ede16d39c2d237 100644
--- a/deps/v8/src/debug/debug-interface.cc
+++ b/deps/v8/src/debug/debug-interface.cc
@@ -137,8 +137,8 @@ Local<String> GetFunctionDescription(Local<Function> function) {
   auto i_isolate = receiver->GetIsolate();
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(i_isolate);
   if (IsJSBoundFunction(*receiver)) {
-    return Utils::ToLocal(
-        i::JSBoundFunction::ToString(i::Cast<i::JSBoundFunction>(receiver)));
+    return Utils::ToLocal(i::JSBoundFunction::ToString(
+        i_isolate, i::Cast<i::JSBoundFunction>(receiver)));
   }
   if (IsJSFunction(*receiver)) {
     auto js_function = i::Cast<i::JSFunction>(receiver);
@@ -162,7 +162,7 @@ Local<String> GetFunctionDescription(Local<Function> function) {
       }
     }
 #endif  // V8_ENABLE_WEBASSEMBLY
-    return Utils::ToLocal(i::JSFunction::ToString(js_function));
+    return Utils::ToLocal(i::JSFunction::ToString(i_isolate, js_function));
   }
   return Utils::ToLocal(
       receiver->GetIsolate()->factory()->function_native_code_string());
@@ -216,7 +216,7 @@ void ForEachContextLocal(i::Isolate* isolate,
       continue;
     }
     int context_index = scope_info->ContextHeaderLength() + it->index();
-    i::Handle<i::Object> slot_value(context->get(context_index), isolate);
+    i::Handle<i::Object> slot_value(context->GetNoCell(context_index), isolate);
     context_local_it(mode, name, slot_value);
   }
 }
@@ -555,6 +555,14 @@ MaybeLocal<String> Script::SourceMappingURL() const {
   return Utils::ToLocal(i::Cast<i::String>(value));
 }
 
+MaybeLocal<String> Script::DebugId() const {
+  auto script = Utils::OpenDirectHandle(this);
+  i::Isolate* isolate = script->GetIsolate();
+  i::DirectHandle<i::Object> value(script->debug_id(), isolate);
+  if (!IsString(*value)) return MaybeLocal<String>();
+  return Utils::ToLocal(i::Cast<i::String>(value));
+}
+
 MaybeLocal<String> Script::GetSha256Hash() const {
   i::DirectHandle<i::Script> script = Utils::OpenDirectHandle(this);
   i::Isolate* isolate = script->GetIsolate();
diff --git a/deps/v8/src/debug/debug-interface.h b/deps/v8/src/debug/debug-interface.h
index 863e0fdd86120d..277009fd0e105e 100644
--- a/deps/v8/src/debug/debug-interface.h
+++ b/deps/v8/src/debug/debug-interface.h
@@ -218,6 +218,7 @@ class V8_EXPORT_PRIVATE Script {
   MaybeLocal<String> Name() const;
   MaybeLocal<String> SourceURL() const;
   MaybeLocal<String> SourceMappingURL() const;
+  MaybeLocal<String> DebugId() const;
   MaybeLocal<String> GetSha256Hash() const;
   Maybe<int> ContextId() const;
   Local<ScriptSource> Source() const;
diff --git a/deps/v8/src/debug/debug-scopes.cc b/deps/v8/src/debug/debug-scopes.cc
index 1d6ceb72a0a108..fdba6112c4994b 100644
--- a/deps/v8/src/debug/debug-scopes.cc
+++ b/deps/v8/src/debug/debug-scopes.cc
@@ -8,7 +8,6 @@
 
 #include "src/ast/ast.h"
 #include "src/ast/scopes.h"
-#include "src/common/globals.h"
 #include "src/debug/debug.h"
 #include "src/execution/frames-inl.h"
 #include "src/objects/js-generator-inl.h"
@@ -45,7 +44,8 @@ ScopeIterator::ScopeIterator(Isolate* isolate, FrameInspector* frame_inspector,
 ScopeIterator::~ScopeIterator() = default;
 
 DirectHandle<Object> ScopeIterator::GetFunctionDebugName() const {
-  if (!function_.is_null()) return JSFunction::GetDebugName(function_);
+  if (!function_.is_null())
+    return JSFunction::GetDebugName(isolate_, function_);
 
   if (!IsNativeContext(*context_)) {
     DisallowGarbageCollection no_gc;
@@ -364,7 +364,7 @@ void ScopeIterator::UnwrapEvaluationContext() {
   if (!context_->IsDebugEvaluateContext()) return;
   Tagged<Context> current = *context_;
   do {
-    Tagged<Object> wrapped = current->get(Context::WRAPPED_CONTEXT_INDEX);
+    Tagged<Object> wrapped = current->GetNoCell(Context::WRAPPED_CONTEXT_INDEX);
     if (IsContext(wrapped)) {
       current = Cast<Context>(wrapped);
     } else {
@@ -764,7 +764,7 @@ void ScopeIterator::DebugPrint() {
     case ScopeIterator::ScopeTypeCatch:
       os << "Catch:\n";
       Print(context_->extension(), os);
-      Print(context_->get(Context::THROWN_OBJECT_INDEX), os);
+      Print(context_->GetNoCell(Context::THROWN_OBJECT_INDEX), os);
       break;
 
     case ScopeIterator::ScopeTypeClosure:
@@ -851,13 +851,8 @@ bool ScopeIterator::VisitContextLocals(const Visitor& visitor,
     Handle<String> name(it->name(), isolate_);
     if (ScopeInfo::VariableIsSynthetic(*name)) continue;
     int context_index = scope_info->ContextHeaderLength() + it->index();
-    Handle<Object> value(context->get(context_index), isolate_);
-    if (v8_flags.script_context_mutable_heap_number &&
-        context->IsScriptContext()) {
-      value = indirect_handle(Context::LoadScriptContextElement(
-                                  context, context_index, value, isolate_),
-                              isolate_);
-    }
+    Handle<Object> value = indirect_handle(
+        Context::Get(context, context_index, isolate_), isolate_);
     if (visitor(name, value, scope_type)) return true;
   }
   return false;
@@ -873,7 +868,7 @@ bool ScopeIterator::VisitLocals(const Visitor& visitor, Mode mode,
     auto this_var = current_scope_->AsDeclarationScope()->receiver();
     Handle<Object> receiver =
         this_var->location() == VariableLocation::CONTEXT
-            ? handle(context_->get(this_var->index()), isolate_)
+            ? handle(context_->GetNoCell(this_var->index()), isolate_)
         : frame_inspector_ == nullptr ? handle(generator_->receiver(), isolate_)
                                       : frame_inspector_->GetReceiver();
     if (visitor(isolate_->factory()->this_string(), receiver, scope_type))
@@ -963,16 +958,10 @@ bool ScopeIterator::VisitLocals(const Visitor& visitor, Mode mode,
       case VariableLocation::CONTEXT:
         if (mode == Mode::STACK) continue;
         DCHECK(var->IsContextSlot());
-
-        DCHECK_EQ(context_->scope_info()->ContextSlotIndex(var->name()), index);
-        value = handle(context_->get(index), isolate_);
-
-        if (v8_flags.script_context_mutable_heap_number &&
-            context_->IsScriptContext()) {
-          value = indirect_handle(Context::LoadScriptContextElement(
-                                      context_, index, value, isolate_),
-                                  isolate_);
-        }
+        DCHECK_EQ(context_->scope_info()->ContextSlotIndex(*var->name()),
+                  index);
+        value =
+            indirect_handle(Context::Get(context_, index, isolate_), isolate_);
         break;
 
       case VariableLocation::MODULE: {
@@ -1128,19 +1117,11 @@ bool ScopeIterator::SetLocalVariableValue(DirectHandle<String> variable_name,
           // don't match (https://crbug.com/753338).
           // Skip the write if the context's ScopeInfo doesn't know anything
           // about this variable.
-          if (context_->scope_info()->ContextSlotIndex(variable_name) !=
+          if (context_->scope_info()->ContextSlotIndex(*variable_name) !=
               index) {
             return false;
           }
-          if ((v8_flags.script_context_mutable_heap_number ||
-               v8_flags.const_tracking_let) &&
-              context_->IsScriptContext()) {
-            Context::StoreScriptContextAndUpdateSlotProperty(
-                context_, index, new_value, isolate_);
-          } else {
-            context_->set(index, *new_value);
-          }
-
+          Context::Set(context_, index, new_value, isolate_);
           return true;
 
         case VariableLocation::MODULE:
@@ -1173,9 +1154,9 @@ bool ScopeIterator::SetContextExtensionValue(DirectHandle<String> variable_name,
 
 bool ScopeIterator::SetContextVariableValue(DirectHandle<String> variable_name,
                                             DirectHandle<Object> new_value) {
-  int slot_index = context_->scope_info()->ContextSlotIndex(variable_name);
+  int slot_index = context_->scope_info()->ContextSlotIndex(*variable_name);
   if (slot_index < 0) return false;
-  context_->set(slot_index, *new_value);
+  context_->SetNoCell(slot_index, *new_value);
   return true;
 }
 
@@ -1208,13 +1189,7 @@ bool ScopeIterator::SetScriptVariableValue(DirectHandle<String> variable_name,
   if (script_contexts->Lookup(variable_name, &lookup_result)) {
     DirectHandle<Context> script_context(
         script_contexts->get(lookup_result.context_index), isolate_);
-    if (v8_flags.script_context_mutable_heap_number ||
-        v8_flags.const_tracking_let) {
-      Context::StoreScriptContextAndUpdateSlotProperty(
-          script_context, lookup_result.slot_index, new_value, isolate_);
-    } else {
-      script_context->set(lookup_result.slot_index, *new_value);
-    }
+    Context::Set(script_context, lookup_result.slot_index, new_value, isolate_);
     return true;
   }
 
diff --git a/deps/v8/src/debug/debug-stack-trace-iterator.cc b/deps/v8/src/debug/debug-stack-trace-iterator.cc
index e7d63303c954f9..664c9cd61326bc 100644
--- a/deps/v8/src/debug/debug-stack-trace-iterator.cc
+++ b/deps/v8/src/debug/debug-stack-trace-iterator.cc
@@ -101,9 +101,9 @@ v8::MaybeLocal<v8::Value> DebugStackTraceIterator::GetReceiver() const {
     }
     DisallowGarbageCollection no_gc;
     int slot_index = context->scope_info()->ContextSlotIndex(
-        isolate_->factory()->this_string());
+        *isolate_->factory()->this_string());
     if (slot_index < 0) return v8::MaybeLocal<v8::Value>();
-    DirectHandle<Object> value(context->get(slot_index), isolate_);
+    DirectHandle<Object> value(context->GetNoCell(slot_index), isolate_);
     if (IsTheHole(*value, isolate_)) return v8::MaybeLocal<v8::Value>();
     return Utils::ToLocal(value);
   }
diff --git a/deps/v8/src/debug/debug.cc b/deps/v8/src/debug/debug.cc
index 72f9e5b90c14fc..73df455e5d4bee 100644
--- a/deps/v8/src/debug/debug.cc
+++ b/deps/v8/src/debug/debug.cc
@@ -1757,7 +1757,7 @@ void Debug::DiscardBaselineCode(Tagged<SharedFunctionInfo> shared) {
     if (IsJSFunction(obj)) {
       Tagged<JSFunction> fun = Cast<JSFunction>(obj);
       if (fun->shared() == shared && fun->ActiveTierIsBaseline(isolate_)) {
-        fun->UpdateCode(*trampoline);
+        fun->UpdateCode(isolate_, *trampoline);
       }
     }
   }
@@ -1775,7 +1775,7 @@ void Debug::DiscardAllBaselineCode() {
     if (IsJSFunction(obj)) {
       Tagged<JSFunction> fun = Cast<JSFunction>(obj);
       if (fun->ActiveTierIsBaseline(isolate_)) {
-        fun->UpdateCode(*trampoline);
+        fun->UpdateCode(isolate_, *trampoline);
       }
     } else if (IsSharedFunctionInfo(obj)) {
       Tagged<SharedFunctionInfo> shared = Cast<SharedFunctionInfo>(obj);
@@ -1896,7 +1896,7 @@ void Debug::InstallDebugBreakTrampoline() {
         if (!fun->is_compiled(isolate_)) {
           needs_compile.push_back(handle(fun, isolate_));
         } else {
-          fun->UpdateCode(*trampoline);
+          fun->UpdateCode(isolate_, *trampoline);
         }
       } else if (IsJSObject(obj)) {
         Tagged<JSObject> object = Cast<JSObject>(obj);
@@ -1933,13 +1933,13 @@ void Debug::InstallDebugBreakTrampoline() {
     DirectHandle<Object> getter = AccessorPair::GetComponent(
         isolate_, native_context, accessor_pair, ACCESSOR_GETTER);
     if (IsJSFunctionAndNeedsTrampoline(isolate_, *getter)) {
-      Cast<JSFunction>(getter)->UpdateCode(*trampoline);
+      Cast<JSFunction>(getter)->UpdateCode(isolate_, *trampoline);
     }
 
     DirectHandle<Object> setter = AccessorPair::GetComponent(
         isolate_, native_context, accessor_pair, ACCESSOR_SETTER);
     if (IsJSFunctionAndNeedsTrampoline(isolate_, *setter)) {
-      Cast<JSFunction>(setter)->UpdateCode(*trampoline);
+      Cast<JSFunction>(setter)->UpdateCode(isolate_, *trampoline);
     }
   }
 
@@ -1950,7 +1950,7 @@ void Debug::InstallDebugBreakTrampoline() {
     Compiler::Compile(isolate_, fun, Compiler::CLEAR_EXCEPTION,
                       &is_compiled_scope);
     DCHECK(is_compiled_scope.is_compiled());
-    fun->UpdateCode(*trampoline);
+    fun->UpdateCode(isolate_, *trampoline);
   }
 }
 
@@ -3320,7 +3320,7 @@ bool Debug::PerformSideEffectCheckAtBytecode(InterpretedFrame* frame) {
   }
   interpreter::Register reg;
   switch (bytecode) {
-    case Bytecode::kStaCurrentContextSlot:
+    case Bytecode::kStaCurrentContextSlotNoCell:
       reg = interpreter::Register::current_context();
       break;
     default:
diff --git a/deps/v8/src/debug/liveedit.cc b/deps/v8/src/debug/liveedit.cc
index d7ff7dda24d0b8..e77ca1a41045cd 100644
--- a/deps/v8/src/debug/liveedit.cc
+++ b/deps/v8/src/debug/liveedit.cc
@@ -970,6 +970,7 @@ void LiveEdit::PatchScript(Isolate* isolate, Handle<Script> script,
       constants->set(i, *new_sfi);
     }
   }
+  isolate->LocalsBlockListCacheRehash();
   for (const auto& mapping : changed) {
     FunctionData* data = nullptr;
     if (!function_data_map.Lookup(new_script, mapping.second, &data)) continue;
diff --git a/deps/v8/src/deoptimizer/deoptimize-reason.h b/deps/v8/src/deoptimizer/deoptimize-reason.h
index 79c4c4480e4bcf..ba38a3e979b250 100644
--- a/deps/v8/src/deoptimizer/deoptimize-reason.h
+++ b/deps/v8/src/deoptimizer/deoptimize-reason.h
@@ -115,8 +115,7 @@ enum class DeoptimizeReason : uint8_t {
     "dependent allocation site tenuring changed")                             \
   V(AllocationSiteTransitionChange,                                           \
     "dependent allocation site transition changed")                           \
-  V(ScriptContextSlotPropertyChange,                                          \
-    "dependent script context slot property changed")                         \
+  V(ContextCellChange, "dependent context cell state changed")                \
   V(EmptyContextExtensionChange, "dependent empty context extension changed") \
   V(WeakObjects, "embedded weak objects cleared")                             \
   V(Debugger, "JS debugger attached")                                         \
diff --git a/deps/v8/src/deoptimizer/deoptimizer.cc b/deps/v8/src/deoptimizer/deoptimizer.cc
index 44304637137c6e..dd1d0fb138e94e 100644
--- a/deps/v8/src/deoptimizer/deoptimizer.cc
+++ b/deps/v8/src/deoptimizer/deoptimizer.cc
@@ -342,8 +342,7 @@ class ActivationsFinder : public ThreadVisitor {
   // for the trampoline to the deoptimizer call respective to each code, and use
   // it to replace the current pc on the stack.
   void VisitThread(Isolate* isolate, ThreadLocalTop* top) override {
-    for (StackFrameIterator it(isolate, top, StackFrameIterator::NoHandles{});
-         !it.done(); it.Advance()) {
+    for (StackFrameIterator it(isolate, top); !it.done(); it.Advance()) {
       if (it.frame()->is_optimized_js()) {
         Tagged<GcSafeCode> code = it.frame()->GcSafeLookupCode();
         if (CodeKindCanDeoptimize(code->kind()) &&
@@ -403,9 +402,8 @@ void Deoptimizer::DeoptimizeMarkedCode(Isolate* isolate) {
   // Make sure all activations of optimized code can deopt at their current PC.
   // The topmost optimized code has special handling because it cannot be
   // deoptimized due to weak object dependency.
-  for (StackFrameIterator it(isolate, isolate->thread_local_top(),
-                             StackFrameIterator::NoHandles{});
-       !it.done(); it.Advance()) {
+  for (StackFrameIterator it(isolate, isolate->thread_local_top()); !it.done();
+       it.Advance()) {
     if (it.frame()->is_optimized_js()) {
       Tagged<GcSafeCode> code = it.frame()->GcSafeLookupCode();
       Tagged<JSFunction> function =
@@ -1707,7 +1705,7 @@ void Deoptimizer::DoComputeOutputFrames() {
     // there is already one running. In particular it helps to squeeze in a
     // maglev compilation when there is a long running turbofan one that was
     // started right before the deopt.
-    function_->SetTieringInProgress(false);
+    function_->SetTieringInProgress(isolate_, false);
     function_->SetInterruptBudget(isolate_, BudgetModification::kReset,
                                   CodeKind::INTERPRETED_FUNCTION);
     function_->feedback_vector()->set_was_once_deoptimized();
diff --git a/deps/v8/src/deoptimizer/translated-state.cc b/deps/v8/src/deoptimizer/translated-state.cc
index 020fbcf72f10cf..26e8be86128010 100644
--- a/deps/v8/src/deoptimizer/translated-state.cc
+++ b/deps/v8/src/deoptimizer/translated-state.cc
@@ -63,11 +63,11 @@ void DeoptimizationFrameTranslationPrintSingleOpcode(
       int return_value_offset = 0;
       int return_value_count = 0;
       if (opcode == TranslationOpcode::INTERPRETED_FRAME_WITH_RETURN) {
-        DCHECK_EQ(TranslationOpcodeOperandCount(opcode), 5);
+        DCHECK_EQ(TranslationOpcodeOperandCount(opcode), 6);
         return_value_offset = iterator.NextOperand();
         return_value_count = iterator.NextOperand();
       } else {
-        DCHECK_EQ(TranslationOpcodeOperandCount(opcode), 3);
+        DCHECK_EQ(TranslationOpcodeOperandCount(opcode), 4);
       }
       Tagged<Object> shared_info = literal_array->get(shared_info_id);
       Tagged<Object> bytecode_array =
@@ -1875,7 +1875,7 @@ Address TranslatedState::DecompressIfNeeded(intptr_t value) {
       static_cast<uintptr_t>(value) <= std::numeric_limits<uint32_t>::max()) {
 #endif
     return V8HeapCompressionScheme::DecompressTagged(
-        isolate(), static_cast<uint32_t>(value));
+        static_cast<uint32_t>(value));
   } else {
     return value;
   }
@@ -2703,7 +2703,6 @@ TranslatedFrame* TranslatedState::GetArgumentsInfoFromJSFrameIndex(
         // be shown in a stack trace.
         if (frames_[i].kind() ==
             TranslatedFrame::kJavaScriptBuiltinContinuation) {
-          DCHECK(frames_[i].shared_info()->IsDontAdaptArguments());
           DCHECK(frames_[i].shared_info()->IsApiFunction());
 
           // The argument count for this special case is always the second
diff --git a/deps/v8/src/diagnostics/arm64/disasm-arm64.cc b/deps/v8/src/diagnostics/arm64/disasm-arm64.cc
index 14274001b2c5db..8e7ce85861db02 100644
--- a/deps/v8/src/diagnostics/arm64/disasm-arm64.cc
+++ b/deps/v8/src/diagnostics/arm64/disasm-arm64.cc
@@ -566,6 +566,9 @@ void DisassemblingDecoder::VisitConditionalBranch(Instruction* instr) {
     case B_cond:
       Format(instr, "b.'CBrn", "'TImmCond");
       break;
+    case BC_cond:
+      Format(instr, "bc.'CBrn", "'TImmCond");
+      break;
     default:
       UNREACHABLE();
   }
@@ -628,6 +631,9 @@ void DisassemblingDecoder::VisitDataProcessing1Source(Instruction* instr) {
     FORMAT(REV, "rev");
     FORMAT(CLZ, "clz");
     FORMAT(CLS, "cls");
+    FORMAT(CTZ, "ctz");
+    FORMAT(CNT, "cnt");
+    FORMAT(ABS, "abs");
 #undef FORMAT
     case REV32_x:
       mnemonic = "rev32";
@@ -3039,6 +3045,24 @@ void DisassemblingDecoder::VisitNEONModifiedImmediate(Instruction* instr) {
   Format(instr, mnemonic, nfd.Substitute(form));
 }
 
+void DisassemblingDecoder::VisitNEONSHA3(Instruction* instr) {
+  const char* mnemonic = "unimplemented";
+  const char* form = "'Vd.%s, 'Vn.%s, 'Vm.%s, 'Va.%s";
+  NEONFormatDecoder nfd(instr);
+
+  switch (instr->Mask(NEONSHA3Mask)) {
+    case NEON_BCAX:
+      mnemonic = "bcax";
+      break;
+    case NEON_EOR3:
+      mnemonic = "eor3";
+      break;
+    default:
+      form = "(NEONSHA3)";
+  }
+  Format(instr, mnemonic, nfd.Substitute(form));
+}
+
 void DisassemblingDecoder::VisitNEONPerm(Instruction* instr) {
   const char* mnemonic = "unimplemented";
   const char* form = "'Vd.%s, 'Vn.%s, 'Vm.%s";
diff --git a/deps/v8/src/diagnostics/disassembler.cc b/deps/v8/src/diagnostics/disassembler.cc
index d86743c33bc471..df19ed42359c86 100644
--- a/deps/v8/src/diagnostics/disassembler.cc
+++ b/deps/v8/src/diagnostics/disassembler.cc
@@ -18,6 +18,7 @@
 #include "src/codegen/code-comments.h"
 #include "src/codegen/code-reference.h"
 #include "src/codegen/external-reference-encoder.h"
+#include "src/codegen/jump-table-info.h"
 #include "src/codegen/macro-assembler.h"
 #include "src/debug/debug.h"
 #include "src/deoptimizer/deoptimizer.h"
@@ -29,10 +30,6 @@
 #include "src/snapshot/embedded/embedded-data.h"
 #include "src/strings/string-stream.h"
 
-#ifdef V8_TARGET_ARCH_X64
-#include "src/codegen/x64/builtin-jump-table-info-x64.h"
-#endif  // V8_TARGET_ARCH_X64
-
 #if V8_ENABLE_WEBASSEMBLY
 #include "src/wasm/wasm-code-manager.h"
 #include "src/wasm/wasm-engine.h"
@@ -311,14 +308,21 @@ static int DecodeIt(Isolate* isolate, ExternalReferenceEncoder* ref_encoder,
   RelocIterator rit(code);
   CodeCommentsIterator cit(code.code_comments(), code.code_comments_size());
 
-#ifdef V8_TARGET_ARCH_X64
-  std::unique_ptr<BuiltinJumpTableInfoIterator> table_info_it = nullptr;
-  if (code.is_code() && code.as_code()->has_builtin_jump_table_info()) {
-    table_info_it = std::make_unique<BuiltinJumpTableInfoIterator>(
-        code.as_code()->builtin_jump_table_info(),
-        code.as_code()->builtin_jump_table_info_size());
+  std::unique_ptr<JumpTableInfoIterator> table_info_it = nullptr;
+  if constexpr (V8_JUMP_TABLE_INFO_BOOL) {
+    if (code.is_code() && code.as_code()->has_jump_table_info()) {
+      table_info_it = std::make_unique<JumpTableInfoIterator>(
+          code.as_code()->jump_table_info(),
+          code.as_code()->jump_table_info_size());
+#if V8_ENABLE_WEBASSEMBLY
+    } else if (code.is_wasm_code() &&
+               code.as_wasm_code()->has_jump_table_info()) {
+      table_info_it = std::make_unique<JumpTableInfoIterator>(
+          code.as_wasm_code()->jump_table_info(),
+          code.as_wasm_code()->jump_table_info_size());
+#endif  // V8_ENABLE_WEBASSEMBLY
+    }
   }
-#endif  // V8_TARGET_ARCH_X64
 
   int constants = -1;  // no constants being decoded at the start
 
@@ -351,17 +355,15 @@ static int DecodeIt(Isolate* isolate, ExternalReferenceEncoder* ref_encoder,
                  reinterpret_cast<intptr_t>(ptr),
                  static_cast<size_t>(ptr - begin));
         pc += sizeof(ptr);
-#ifdef V8_TARGET_ARCH_X64
       } else if (table_info_it && table_info_it->HasCurrent() &&
                  table_info_it->GetPCOffset() ==
                      static_cast<uint32_t>(pc - begin)) {
         int32_t target_pc_offset = table_info_it->GetTarget();
         static_assert(sizeof(target_pc_offset) ==
-                      BuiltinJumpTableInfoEntry::kTargetSize);
+                      JumpTableInfoEntry::kTargetSize);
         SNPrintF(decode_buffer, "jump table entry %08x", target_pc_offset);
-        pc += BuiltinJumpTableInfoEntry::kTargetSize;
+        pc += JumpTableInfoEntry::kTargetSize;
         table_info_it->Next();
-#endif  // V8_TARGET_ARCH_X64
       } else {
         decode_buffer[0] = '\0';
         pc += d.InstructionDecode(decode_buffer, pc);
diff --git a/deps/v8/src/diagnostics/objects-debug.cc b/deps/v8/src/diagnostics/objects-debug.cc
index 1f0d0f46acae8a..5aa9847fd8334b 100644
--- a/deps/v8/src/diagnostics/objects-debug.cc
+++ b/deps/v8/src/diagnostics/objects-debug.cc
@@ -21,6 +21,7 @@
 #include "src/objects/call-site-info-inl.h"
 #include "src/objects/cell-inl.h"
 #include "src/objects/code-inl.h"
+#include "src/objects/contexts.h"
 #include "src/objects/data-handler-inl.h"
 #include "src/objects/debug-objects-inl.h"
 #include "src/objects/elements.h"
@@ -177,7 +178,7 @@ void Object::VerifyMaybeObjectPointer(Isolate* isolate, Tagged<MaybeObject> p) {
 
 // static
 void Smi::SmiVerify(Tagged<Smi> obj, Isolate* isolate) {
-  CHECK(IsSmi(obj));
+  CHECK(IsSmi(Tagged<Object>(obj)));
   CHECK(!IsCallable(obj));
   CHECK(!IsConstructor(obj));
 }
@@ -227,6 +228,7 @@ void HeapObject::HeapObjectVerify(Isolate* isolate) {
     case NAME_DICTIONARY_TYPE:
     case GLOBAL_DICTIONARY_TYPE:
     case NUMBER_DICTIONARY_TYPE:
+    case SIMPLE_NAME_DICTIONARY_TYPE:
     case SIMPLE_NUMBER_DICTIONARY_TYPE:
     case EPHEMERON_HASH_TABLE_TYPE:
       Cast<FixedArray>(*this)->FixedArrayVerify(isolate);
@@ -314,6 +316,18 @@ void HeapObject::HeapObjectVerify(Isolate* isolate) {
       TORQUE_INSTANCE_CHECKERS_MULTIPLE_FULLY_DEFINED(MAKE_TORQUE_CASE)
 #undef MAKE_TORQUE_CASE
 
+    case TUPLE2_TYPE:
+      Cast<Tuple2>(*this)->Tuple2Verify(isolate);
+      break;
+
+    case CLASS_POSITIONS_TYPE:
+      Cast<ClassPositions>(*this)->ClassPositionsVerify(isolate);
+      break;
+
+    case ACCESSOR_PAIR_TYPE:
+      Cast<AccessorPair>(*this)->AccessorPairVerify(isolate);
+      break;
+
     case ALLOCATION_SITE_TYPE:
       Cast<AllocationSite>(*this)->AllocationSiteVerify(isolate);
       break;
@@ -563,6 +577,11 @@ void Map::MapVerify(Isolate* isolate) {
   CHECK(instance_size() == kVariableSizeSentinel ||
         (kTaggedSize <= instance_size() &&
          static_cast<size_t>(instance_size()) < heap->Capacity()));
+#if V8_ENABLE_WEBASSEMBLY
+  bool is_wasm_struct = InstanceTypeChecker::IsWasmStruct(instance_type());
+#else
+  constexpr bool is_wasm_struct = false;
+#endif  // V8_ENABLE_WEBASSEMBLY
   if (IsContextMap(*this)) {
     // The map for the NativeContext is allocated before the NativeContext
     // itself, so it may happen that during a GC the native_context() is still
@@ -573,10 +592,12 @@ void Map::MapVerify(Isolate* isolate) {
     CHECK_EQ(native_context_or_null(), map()->native_context_or_null());
   } else {
     if (IsUndefined(GetBackPointer(), isolate)) {
-      // Root maps must not have descriptors in the descriptor array that do not
-      // belong to the map.
-      CHECK_EQ(NumberOfOwnDescriptors(),
-               instance_descriptors(isolate)->number_of_descriptors());
+      if (!is_wasm_struct) {
+        // Root maps must not have descriptors in the descriptor array that do
+        // not belong to the map.
+        CHECK_EQ(NumberOfOwnDescriptors(),
+                 instance_descriptors(isolate)->number_of_descriptors());
+      }
     } else {
       // If there is a parent map it must be non-stable.
       Tagged<Map> parent = Cast<Map>(GetBackPointer());
@@ -604,7 +625,9 @@ void Map::MapVerify(Isolate* isolate) {
       }
     }
   }
-  SLOW_DCHECK(instance_descriptors(isolate)->IsSortedNoDuplicates());
+  if (!is_wasm_struct) {
+    SLOW_DCHECK(instance_descriptors(isolate)->IsSortedNoDuplicates());
+  }
   SLOW_DCHECK(TransitionsAccessor(isolate, *this).IsSortedNoDuplicates());
   SLOW_DCHECK(
       TransitionsAccessor(isolate, *this).IsConsistentWithBackPointers());
@@ -642,6 +665,17 @@ void Map::MapVerify(Isolate* isolate) {
     CHECK_EQ(map(), GetReadOnlyRoots().meta_map());
   }
 
+#if V8_ENABLE_WEBASSEMBLY
+  if (instance_type() == WASM_STRUCT_TYPE ||
+      instance_type() == WASM_ARRAY_TYPE) {
+    // Wasm structs are sometimes shared. In this case, the meta map of this map
+    // has to be the context-free RO meta map.
+    if (HeapLayout::InAnySharedSpace(*this)) {
+      CHECK_EQ(map(), GetReadOnlyRoots().meta_map());
+    }
+  }
+#endif
+
   if (IsJSObjectMap(*this)) {
     int header_end_offset = JSObject::GetHeaderSize(*this);
     int inobject_fields_start_offset = GetInObjectPropertyOffset(0);
@@ -699,7 +733,7 @@ void Map::MapVerify(Isolate* isolate) {
       CHECK(IsJSFunction(maybe_constructor) ||
             IsFunctionTemplateInfo(maybe_constructor) ||
             // The above check might fail until empty function setup is done.
-            IsUndefined(isolate->raw_native_context()->get(
+            IsUndefined(isolate->raw_native_context()->GetNoCell(
                 Context::EMPTY_FUNCTION_INDEX)));
     }
   }
@@ -924,28 +958,6 @@ void Context::ContextVerify(Isolate* isolate) {
   for (int i = 0; i < length(); i++) {
     VerifyObjectField(isolate, OffsetOfElementAt(i));
   }
-  if (IsScriptContext()) {
-    Tagged<Object> side_data = get(CONTEXT_SIDE_TABLE_PROPERTY_INDEX);
-    CHECK(IsFixedArray(side_data));
-    Tagged<FixedArray> side_data_array = Cast<FixedArray>(side_data);
-    // The array might not be empty if the script context is deserialized from
-    // snapshot. However, as long as the flags are enabled the feedback slots
-    // must be initialized properly.
-    if (v8_flags.script_context_mutable_heap_number ||
-        v8_flags.const_tracking_let) {
-      for (int i = 0; i < side_data_array->length(); i++) {
-        Tagged<Object> element = side_data_array->get(i);
-        if (IsSmi(element)) {
-          int value = element.ToSmi().value();
-          CHECK(ContextSidePropertyCell::kOther <= value);
-          CHECK(value <= ContextSidePropertyCell::kMutableHeapNumber);
-        } else {
-          // The slot contains `undefined` before the variable is initialized.
-          CHECK(IsUndefined(element) || IsContextSidePropertyCell(element));
-        }
-      }
-    }
-  }
 }
 
 void NativeContext::NativeContextVerify(Isolate* isolate) {
@@ -955,6 +967,17 @@ void NativeContext::NativeContextVerify(Isolate* isolate) {
   CHECK_EQ(kVariableSizeSentinel, map()->instance_size());
 }
 
+void ContextCell::ContextCellVerify(Isolate* isolate) {
+  Tagged<Object> dep_code = dependent_code();
+  Tagged<JSAny> tagged = tagged_value();
+  int state_as_int = static_cast<int>(state());
+  CHECK_GE(state_as_int, static_cast<int>(kConst));
+  CHECK_LE(state_as_int, static_cast<int>(kDetached));
+  CHECK(IsDependentCode(dep_code));
+  Object::VerifyPointer(isolate, dep_code);
+  Object::VerifyPointer(isolate, tagged);
+}
+
 void FeedbackMetadata::FeedbackMetadataVerify(Isolate* isolate) {
   if (slot_count() == 0 && create_closure_slot_count() == 0) {
     CHECK_EQ(ReadOnlyRoots(isolate).empty_feedback_metadata(), *this);
@@ -1108,18 +1131,18 @@ void SloppyArgumentsElementsVerify(Isolate* isolate,
       if (!is_fast) continue;
       // Fast sloppy arguments elements are never holey. Either the element is
       // context-mapped or present in the arguments elements.
-      CHECK(accessor->HasElement(holder, i, arg_elements));
+      CHECK(accessor->HasElement(isolate, holder, i, arg_elements));
       continue;
     }
     int mappedIndex = Smi::ToInt(mapped);
     nofMappedParameters++;
     CHECK_LE(maxMappedIndex, mappedIndex);
     maxMappedIndex = mappedIndex;
-    Tagged<Object> value = context_object->get(mappedIndex);
+    Tagged<Object> value = context_object->GetNoCell(mappedIndex);
     CHECK(IsObject(value));
     // None of the context-mapped entries should exist in the arguments
     // elements.
-    CHECK(!accessor->HasElement(holder, i, arg_elements));
+    CHECK(!accessor->HasElement(isolate, holder, i, arg_elements));
   }
   CHECK_LE(nofMappedParameters, context_object->length());
   CHECK_LE(nofMappedParameters, arg_elements->length());
@@ -1135,13 +1158,15 @@ void JSArgumentsObject::JSArgumentsObjectVerify(Isolate* isolate) {
         isolate, Cast<SloppyArgumentsElements>(elements()), *this);
   }
   Tagged<NativeContext> native_context = map()->map()->native_context();
-  if (map() == native_context->get(Context::SLOPPY_ARGUMENTS_MAP_INDEX) ||
-      map() == native_context->get(Context::SLOW_ALIASED_ARGUMENTS_MAP_INDEX) ||
-      map() == native_context->get(Context::FAST_ALIASED_ARGUMENTS_MAP_INDEX)) {
+  if (map() == native_context->GetNoCell(Context::SLOPPY_ARGUMENTS_MAP_INDEX) ||
+      map() == native_context->GetNoCell(
+                   Context::SLOW_ALIASED_ARGUMENTS_MAP_INDEX) ||
+      map() == native_context->GetNoCell(
+                   Context::FAST_ALIASED_ARGUMENTS_MAP_INDEX)) {
     VerifyObjectField(isolate, JSSloppyArgumentsObject::kLengthOffset);
     VerifyObjectField(isolate, JSSloppyArgumentsObject::kCalleeOffset);
   } else if (map() ==
-             native_context->get(Context::STRICT_ARGUMENTS_MAP_INDEX)) {
+             native_context->GetNoCell(Context::STRICT_ARGUMENTS_MAP_INDEX)) {
     VerifyObjectField(isolate, JSStrictArgumentsObject::kLengthOffset);
   }
 }
@@ -1392,7 +1417,7 @@ void SharedFunctionInfo::SharedFunctionInfoVerify(LocalIsolate* isolate) {
     CHECK(IsFeedbackMetadata(feedback_metadata()));
   }
 
-  if (HasBytecodeArray() && !IsDontAdaptArguments()) {
+  if (HasBytecodeArray()) {
     CHECK_EQ(GetBytecodeArray(isolate)->parameter_count(),
              internal_formal_parameter_count_with_receiver());
   }
@@ -1525,10 +1550,6 @@ void PropertyCell::PropertyCellVerify(Isolate* isolate) {
   CheckDataIsCompatible(property_details(), value());
 }
 
-void ContextSidePropertyCell::ContextSidePropertyCellVerify(Isolate* isolate) {
-  TorqueGeneratedClassVerifiers::ContextSidePropertyCellVerify(*this, isolate);
-}
-
 void TrustedObject::TrustedObjectVerify(Isolate* isolate) {
 #if defined(V8_ENABLE_SANDBOX)
   // All trusted objects must live in trusted space.
@@ -1547,7 +1568,9 @@ void ExposedTrustedObject::ExposedTrustedObjectVerify(Isolate* isolate) {
   // Check that the self indirect pointer is consistent, i.e. points back to
   // this object.
   InstanceType instance_type = map()->instance_type();
-  IndirectPointerTag tag = IndirectPointerTagFromInstanceType(instance_type);
+  bool shared = HeapLayout::InAnySharedSpace(*this);
+  IndirectPointerTag tag =
+      IndirectPointerTagFromInstanceType(instance_type, shared);
   // We can't use ReadIndirectPointerField here because the tag is not a
   // compile-time constant.
   IndirectPointerSlot slot =
@@ -2524,30 +2547,41 @@ void WasmExportedFunctionData::WasmExportedFunctionDataVerify(
 
 #endif  // V8_ENABLE_WEBASSEMBLY
 
-void DataHandler::DataHandlerVerify(Isolate* isolate) {
-  // Don't call TorqueGeneratedClassVerifiers::DataHandlerVerify because the
-  // Torque definition of this class includes all of the optional fields.
+void StructLayout::StructVerify(Isolate* isolate) {
+  Cast<Struct>(this)->StructVerify(isolate);
+}
 
-  // This assertion exists to encourage updating this verification function if
-  // new fields are added in the Torque class layout definition.
-  static_assert(DataHandler::kHeaderSize == 6 * kTaggedSize);
+void Tuple2::Tuple2Verify(Isolate* isolate) {
+  StructVerify(isolate);
+  CHECK(IsTuple2(this));
+  Object::VerifyPointer(isolate, value1_.load());
+  Object::VerifyPointer(isolate, value2_.load());
+}
+
+void AccessorPair::AccessorPairVerify(Isolate* isolate) {
+  StructVerify(isolate);
+  CHECK(IsAccessorPair(this));
+  Object::VerifyPointer(isolate, getter_.load());
+  Object::VerifyPointer(isolate, setter_.load());
+}
 
+void ClassPositions::ClassPositionsVerify(Isolate* isolate) {
   StructVerify(isolate);
-  CHECK(IsDataHandler(*this));
-  Object::VerifyPointer(isolate, smi_handler(isolate));
+  CHECK(IsClassPositions(this));
+  CHECK(IsSmi(Tagged<Object>(start_.load())));
+  CHECK(IsSmi(Tagged<Object>(end_.load())));
+}
+
+void DataHandler::DataHandlerVerify(Isolate* isolate) {
+  StructVerify(isolate);
+  CHECK(IsDataHandler(this));
+  Object::VerifyPointer(isolate, smi_handler());
   CHECK_IMPLIES(!IsSmi(smi_handler()),
-                IsStoreHandler(*this) && IsCode(smi_handler()));
-  Object::VerifyPointer(isolate, validity_cell(isolate));
+                IsStoreHandler(this) && IsCode(smi_handler()));
+  Object::VerifyPointer(isolate, validity_cell());
   CHECK(IsSmi(validity_cell()) || IsCell(validity_cell()));
-  int data_count = data_field_count();
-  if (data_count >= 1) {
-    VerifyMaybeObjectField(isolate, kData1Offset);
-  }
-  if (data_count >= 2) {
-    VerifyMaybeObjectField(isolate, kData2Offset);
-  }
-  if (data_count >= 3) {
-    VerifyMaybeObjectField(isolate, kData3Offset);
+  for (int i = 0; i < data_field_count(); ++i) {
+    Object::VerifyMaybeObjectPointer(isolate, data()[i].load());
   }
 }
 
@@ -2562,13 +2596,22 @@ void StoreHandler::StoreHandlerVerify(Isolate* isolate) {
 }
 
 void AllocationSite::AllocationSiteVerify(Isolate* isolate) {
-  CHECK(IsAllocationSite(*this));
+  CHECK(IsAllocationSite(this));
   CHECK(IsDependentCode(dependent_code()));
-  CHECK(IsSmi(transition_info_or_boilerplate()) ||
-        IsJSObject(transition_info_or_boilerplate()));
+  if (PointsToLiteral()) {
+    CHECK(IsJSObject(transition_info_or_boilerplate_.load()));
+  } else {
+    CHECK(IsSmi(transition_info_or_boilerplate_.load()));
+  }
   CHECK(IsAllocationSite(nested_site()) || nested_site() == Smi::zero());
 }
 
+void AllocationMemento::AllocationMementoVerify(Isolate* isolate) {
+  StructVerify(isolate);
+  CHECK(IsAllocationMemento(this));
+  CHECK(IsAllocationSite(allocation_site_.load()));
+}
+
 void Script::ScriptVerify(Isolate* isolate) {
   TorqueGeneratedClassVerifiers::ScriptVerify(*this, isolate);
 #if V8_ENABLE_WEBASSEMBLY
diff --git a/deps/v8/src/diagnostics/objects-printer.cc b/deps/v8/src/diagnostics/objects-printer.cc
index d3e5ec68657f77..1914ea45c94141 100644
--- a/deps/v8/src/diagnostics/objects-printer.cc
+++ b/deps/v8/src/diagnostics/objects-printer.cc
@@ -22,10 +22,14 @@
 #include "src/init/bootstrapper.h"
 #include "src/interpreter/bytecodes.h"
 #include "src/objects/all-objects-inl.h"
+#include "src/objects/allocation-site.h"
 #include "src/objects/code-kind.h"
+#include "src/objects/contexts.h"
+#include "src/objects/cpp-heap-object-wrapper-inl.h"
 #include "src/objects/instance-type.h"
 #include "src/objects/js-function-inl.h"
 #include "src/objects/js-objects.h"
+#include "src/objects/struct.h"
 #include "src/regexp/regexp.h"
 #include "src/sandbox/isolate.h"
 #include "src/sandbox/js-dispatch-table.h"
@@ -166,6 +170,10 @@ void PrintHeapObjectHeaderWithoutMap(Tagged<HeapObject> object,
   os << "]";
   if (ReadOnlyHeap::Contains(object)) {
     os << " in ReadOnlySpace";
+  } else if (Isolate::Current()->heap()->InOldSpace(object)) {
+    os << " in OldSpace";
+  } else if (HeapLayout::InAnySharedSpace(object)) {
+    os << " in SharedSpace";
   }
 }
 
@@ -269,6 +277,9 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {
     case GLOBAL_DICTIONARY_TYPE:
       Cast<GlobalDictionary>(*this)->GlobalDictionaryPrint(os);
       break;
+    case SIMPLE_NAME_DICTIONARY_TYPE:
+      Cast<FixedArray>(*this)->FixedArrayPrint(os);
+      break;
     case SIMPLE_NUMBER_DICTIONARY_TYPE:
       Cast<FixedArray>(*this)->FixedArrayPrint(os);
       break;
@@ -342,6 +353,15 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {
       TORQUE_INSTANCE_CHECKERS_MULTIPLE_FULLY_DEFINED(MAKE_TORQUE_CASE)
 #undef MAKE_TORQUE_CASE
 
+    case TUPLE2_TYPE:
+      Cast<Tuple2>(*this)->Tuple2Print(os);
+      break;
+    case CLASS_POSITIONS_TYPE:
+      Cast<ClassPositions>(*this)->ClassPositionsPrint(os);
+      break;
+    case ACCESSOR_PAIR_TYPE:
+      Cast<AccessorPair>(*this)->AccessorPairPrint(os);
+      break;
     case ALLOCATION_SITE_TYPE:
       Cast<AllocationSite>(*this)->AllocationSitePrint(os);
       break;
@@ -814,6 +834,16 @@ void JSExternalObject::JSExternalObjectPrint(std::ostream& os) {
   JSObjectPrintBody(os, *this);
 }
 
+void CppHeapExternalObject::CppHeapExternalObjectPrint(std::ostream& os) {
+  if (i::Isolate* isolate = i::Isolate::TryGetCurrent()) {
+    os << "\n - cpp_heap_wrappable: "
+       << CppHeapObjectWrapper(*this).GetCppHeapWrappable(isolate,
+                                                          kAnyCppHeapPointer);
+  } else {
+    os << "\n - cpp_heap_wrappable: <object>";
+  }
+}
+
 void JSGeneratorObject::JSGeneratorObjectPrint(std::ostream& os) {
   JSObjectPrintHeader(os, *this, "JSGeneratorObject");
   os << "\n - function: " << Brief(function());
@@ -1000,6 +1030,18 @@ void DescriptorArray::DescriptorArrayPrint(std::ostream& os) {
      << DescriptorArrayMarkingState::Epoch::decode(raw) << ", marked "
      << DescriptorArrayMarkingState::Marked::decode(raw) << ", delta "
      << DescriptorArrayMarkingState::Delta::decode(raw);
+  os << "\n - fast iterable state: ";
+  switch (fast_iterable()) {
+    case FastIterableState::kJsonFast:
+      os << "JSON fast";
+      break;
+    case FastIterableState::kJsonSlow:
+      os << "JSON slow";
+      break;
+    case FastIterableState::kUnknown:
+      os << "unknown";
+      break;
+  }
   PrintDescriptors(os);
 }
 
@@ -1164,6 +1206,8 @@ const char* SideEffectType2String(SideEffectType type) {
 }
 }  // namespace
 
+#define AS_PTR(x) reinterpret_cast<void*>(x)
+
 void AccessorInfo::AccessorInfoPrint(std::ostream& os) {
   TorqueGeneratedAccessorInfo<AccessorInfo, HeapObject>::AccessorInfoPrint(os);
   os << " - is_sloppy: " << is_sloppy();
@@ -1175,12 +1219,12 @@ void AccessorInfo::AccessorInfoPrint(std::ostream& os) {
   os << "\n - initial_attributes: " << initial_property_attributes();
   Isolate* isolate;
   if (GetIsolateFromHeapObject(*this, &isolate)) {
-    os << "\n - getter: " << reinterpret_cast<void*>(getter(isolate));
+    os << "\n - getter: " << AS_PTR(getter(isolate));
     if (USE_SIMULATOR_BOOL) {
       os << "\n - maybe_redirected_getter: "
-         << reinterpret_cast<void*>(maybe_redirected_getter(isolate));
+         << AS_PTR(maybe_redirected_getter(isolate));
     }
-    os << "\n - setter: " << reinterpret_cast<void*>(setter(isolate));
+    os << "\n - setter: " << AS_PTR(setter(isolate));
   } else {
     os << "\n - getter: " << kUnavailableString;
     os << "\n - maybe_redirected_getter: " << kUnavailableString;
@@ -1189,6 +1233,38 @@ void AccessorInfo::AccessorInfoPrint(std::ostream& os) {
   os << '\n';
 }
 
+void InterceptorInfo::InterceptorInfoPrint(std::ostream& os) {
+  TorqueGeneratedInterceptorInfo<InterceptorInfo,
+                                 HeapObject>::InterceptorInfoPrint(os);
+  IsolateForSandbox isolate = GetCurrentIsolateForSandbox();
+  if (is_named()) {
+    os << " - getter: " << AS_PTR(named_getter(isolate));
+    os << "\n - setter: " << AS_PTR(named_setter(isolate));
+    os << "\n - query: " << AS_PTR(named_query(isolate));
+    os << "\n - descriptor: " << AS_PTR(named_descriptor(isolate));
+    os << "\n - deleter: " << AS_PTR(named_deleter(isolate));
+    os << "\n - enumerator: " << AS_PTR(named_enumerator(isolate));
+    os << "\n - definer: " << AS_PTR(named_definer(isolate));
+  } else {
+    os << " - getter: " << AS_PTR(indexed_getter(isolate));
+    os << "\n - setter: " << AS_PTR(indexed_setter(isolate));
+    os << "\n - query: " << AS_PTR(indexed_query(isolate));
+    os << "\n - descriptor: " << AS_PTR(indexed_descriptor(isolate));
+    os << "\n - deleter: " << AS_PTR(indexed_deleter(isolate));
+    os << "\n - enumerator: " << AS_PTR(indexed_enumerator(isolate));
+    os << "\n - definer: " << AS_PTR(indexed_definer(isolate));
+  }
+
+  os << "\n --- flags: ";
+  if (can_intercept_symbols()) os << "\n - can_intercept_symbols";
+  if (non_masking()) os << "\n - non_masking";
+  if (is_named()) os << "\n - is_named";
+  if (has_no_side_effect()) os << "\n - has_no_side_effect";
+  os << '\n';
+}
+
+#undef AS_PTR
+
 void FunctionTemplateInfo::FunctionTemplateInfoPrint(std::ostream& os) {
   TorqueGeneratedFunctionTemplateInfo<
       FunctionTemplateInfo,
@@ -1249,7 +1325,9 @@ void PrintContextWithHeader(std::ostream& os, Tagged<Context> context,
   }
   os << "\n - length: " << context->length();
   os << "\n - elements:";
-  PrintFixedArrayElements(os, context);
+  PrintFixedArrayElements<Context>(
+      os, context, context->length(),
+      [](Tagged<Context> xs, int i) { return Cast<Object>(xs->GetNoCell(i)); });
   os << "\n";
 }
 }  // namespace
@@ -1263,6 +1341,30 @@ void NativeContext::NativeContextPrint(std::ostream& os) {
   os << " - microtask_queue: " << microtask_queue() << "\n";
 }
 
+void ContextCell::ContextCellPrint(std::ostream& os) {
+  PrintHeader(os, "ContextCell");
+  os << "\n - state: " << state()
+     << "\n - dependent_code: " << Brief(dependent_code());
+  switch (state()) {
+    case kConst:
+      os << "\n - tagged_value (const): " << Brief(tagged_value());
+      break;
+    case kSmi:
+      os << "\n - tagged_value (smi): " << Brief(tagged_value());
+      break;
+    case kInt32:
+      os << "\n - int32_value: " << int32_value();
+      break;
+    case kFloat64:
+      os << "\n - float64_value: " << float64_value();
+      break;
+    case kDetached:
+      os << "\n - detached";
+      break;
+  }
+  os << "\n";
+}
+
 namespace {
 using DataPrinter = std::function<void(InternalIndex)>;
 
@@ -1824,6 +1926,11 @@ void FeedbackNexus::Print(std::ostream& os) {
     case FeedbackSlotKind::kJumpLoop:
       os << "JumpLoop";
       break;
+    case FeedbackSlotKind::kStringAddAndInternalize: {
+      os << "StringAddAndInternalize:" << GetBinaryOperationFeedback()
+         << " with cache " << Brief(Cast<Object>(GetFeedbackExtra()));
+      break;
+    }
     case FeedbackSlotKind::kInvalid:
       UNREACHABLE();
   }
@@ -2423,13 +2530,6 @@ void PropertyCell::PropertyCellPrint(std::ostream& os) {
   os << "\n";
 }
 
-void ContextSidePropertyCell::ContextSidePropertyCellPrint(std::ostream& os) {
-  PrintHeader(os, "ContextSidePropertyCell");
-  os << "\n - dependent code: " << dependent_code();
-  os << "\n - cell_type: " << context_side_property_raw(kAcquireLoad);
-  os << "\n";
-}
-
 void InstructionStream::InstructionStreamPrint(std::ostream& os) {
   code(kAcquireLoad)->CodePrint(os);
 }
@@ -2644,7 +2744,7 @@ void WasmStruct::WasmStructPrint(std::ostream& os) {
       case wasm::kRefNull: {
         Tagged_t raw = base::ReadUnalignedValue<Tagged_t>(field_address);
 #if V8_COMPRESS_POINTERS
-        Address obj = V8HeapCompressionScheme::DecompressTagged(address(), raw);
+        Address obj = V8HeapCompressionScheme::DecompressTagged(raw);
 #else
         Address obj = raw;
 #endif
@@ -2752,16 +2852,9 @@ void WasmArray::WasmArrayPrint(std::ostream& os) {
   os << "\n";
 }
 
-void WasmContinuationObject::WasmContinuationObjectPrint(std::ostream& os) {
-  PrintHeader(os, "WasmContinuationObject");
-  os << "\n - parent: " << parent();
-  os << "\n - stack: " << stack();
-  os << "\n";
-}
-
 void WasmSuspenderObject::WasmSuspenderObjectPrint(std::ostream& os) {
   PrintHeader(os, "WasmSuspenderObject");
-  os << "\n - continuation: " << continuation();
+  os << "\n - stack: " << (stack() == nullptr ? -1 : stack()->id());
   os << "\n - parent: " << parent();
   os << "\n - promise: " << promise();
   os << "\n - resume: " << resume();
@@ -2798,7 +2891,7 @@ void WasmTrustedInstanceData::WasmTrustedInstanceDataPrint(std::ostream& os) {
 
   PrintHeader(os, "WasmTrustedInstanceData");
   PRINT_OPTIONAL_WASM_INSTANCE_FIELD(instance_object, Brief);
-  PRINT_WASM_INSTANCE_FIELD(native_context, Brief);
+  PRINT_OPTIONAL_WASM_INSTANCE_FIELD(native_context, Brief);
   PRINT_WASM_INSTANCE_FIELD(shared_part, Brief);
   PRINT_WASM_INSTANCE_FIELD(memory_objects, Brief);
   PRINT_OPTIONAL_WASM_INSTANCE_FIELD(untagged_globals_buffer, Brief);
@@ -2944,6 +3037,12 @@ void WasmExceptionPackage::WasmExceptionPackagePrint(std::ostream& os) {
   os << "\n";
 }
 
+void WasmDescriptorOptions::WasmDescriptorOptionsPrint(std::ostream& os) {
+  PrintHeader(os, "WasmDescriptorOptions");
+  os << "\n - prototype: " << Brief(prototype());
+  os << "\n";
+}
+
 void WasmModuleObject::WasmModuleObjectPrint(std::ostream& os) {
   PrintHeader(os, "WasmModuleObject");
   os << "\n - module: " << module();
@@ -2974,6 +3073,27 @@ void WasmValueObject::WasmValueObjectPrint(std::ostream& os) {
 }
 #endif  // V8_ENABLE_WEBASSEMBLY
 
+void Tuple2::Tuple2Print(std::ostream& os) {
+  this->PrintHeader(os, "Tuple2");
+  os << "\n - value1: " << Brief(this->value1());
+  os << "\n - value2: " << Brief(this->value2());
+  os << '\n';
+}
+
+void AccessorPair::AccessorPairPrint(std::ostream& os) {
+  this->PrintHeader(os, "AccessorPair");
+  os << "\n - getter: " << Brief(this->getter());
+  os << "\n - setter: " << Brief(this->setter());
+  os << '\n';
+}
+
+void ClassPositions::ClassPositionsPrint(std::ostream& os) {
+  this->PrintHeader(os, "ClassPositions");
+  os << "\n - start: " << this->start();
+  os << "\n - end: " << this->end();
+  os << '\n';
+}
+
 void LoadHandler::LoadHandlerPrint(std::ostream& os) {
   PrintHeader(os, "LoadHandler");
   // TODO(ishell): implement printing based on handler kind
@@ -3012,7 +3132,9 @@ void StoreHandler::StoreHandlerPrint(std::ostream& os) {
 
 void AllocationSite::AllocationSitePrint(std::ostream& os) {
   PrintHeader(os, "AllocationSite");
-  if (this->HasWeakNext()) os << "\n - weak_next: " << Brief(weak_next());
+  if (this->HasWeakNext())
+    os << "\n - weak_next: "
+       << Brief(Cast<AllocationSiteWithWeakNext>(this)->weak_next());
   os << "\n - dependent code: " << Brief(dependent_code());
   os << "\n - nested site: " << Brief(nested_site());
   os << "\n - memento found count: "
@@ -3535,6 +3657,26 @@ void HeapObject::HeapObjectShortPrint(std::ostream& os) {
     case PROPERTY_ARRAY_TYPE:
       os << "<PropertyArray[" << Cast<PropertyArray>(*this)->length() << "]>";
       break;
+    case CONTEXT_CELL_TYPE: {
+      auto cell = Cast<ContextCell>(*this);
+      os << "<ContextCell[" << cell->state();
+      switch (cell->state()) {
+        case ContextCell::kConst:
+        case ContextCell::kSmi:
+          os << "=" << Brief(cell->tagged_value());
+          break;
+        case ContextCell::kInt32:
+          os << "=" << cell->int32_value();
+          break;
+        case ContextCell::kFloat64:
+          os << "=" << cell->float64_value();
+          break;
+        case ContextCell::kDetached:
+          break;
+      }
+      os << "]>";
+      break;
+    }
     case FEEDBACK_CELL_TYPE: {
       {
         ReadOnlyRoots roots = GetReadOnlyRoots();
@@ -3609,9 +3751,7 @@ void HeapObject::HeapObjectShortPrint(std::ostream& os) {
       STRUCT_LIST(MAKE_STRUCT_CASE)
 #undef MAKE_STRUCT_CASE
     case ALLOCATION_SITE_TYPE: {
-      os << "<AllocationSite";
-      Cast<AllocationSite>(*this)->BriefPrintDetails(os);
-      os << ">";
+      os << "<AllocationSite>";
       break;
     }
     case SCOPE_INFO_TYPE: {
@@ -3710,10 +3850,6 @@ void HeapObject::HeapObjectShortPrint(std::ostream& os) {
       os << '>';
       break;
     }
-    case CONTEXT_SIDE_PROPERTY_CELL_TYPE: {
-      os << "<ContextSidePropertyCell>";
-      break;
-    }
     case ACCESSOR_INFO_TYPE: {
       Tagged<AccessorInfo> info = Cast<AccessorInfo>(*this);
       os << "<AccessorInfo ";
@@ -3882,7 +4018,9 @@ void Map::MapPrint(std::ostream& os) {
   // Read-only maps can't have transitions, which is fortunate because we need
   // the isolate to iterate over the transitions.
   if (!HeapLayout::InReadOnlySpace(*this)) {
-    Isolate* isolate = GetIsolateFromWritableObject(*this);
+    Isolate* isolate = HeapLayout::InWritableSharedSpace(*this)
+                           ? Isolate::Current()->shared_space_isolate()
+                           : GetIsolateFromWritableObject(*this);
     TransitionsAccessor transitions(isolate, *this);
     int nof_transitions = transitions.NumberOfTransitions();
     if (nof_transitions > 0 || transitions.HasPrototypeTransitions() ||
@@ -4155,11 +4293,10 @@ inline i::Tagged<i::Object> GetObjectFromRaw(void* object) {
     i::Isolate* isolate = i::Isolate::TryGetCurrent();
     if (isolate != nullptr) {
       object_ptr = i::V8HeapCompressionScheme::DecompressTagged(
-          isolate, static_cast<i::Tagged_t>(object_ptr));
+          static_cast<i::Tagged_t>(object_ptr));
     } else {
-      i::PtrComprCageBase cage_base = i::GetPtrComprCageBase();
       object_ptr = i::V8HeapCompressionScheme::DecompressTagged(
-          cage_base, static_cast<i::Tagged_t>(object_ptr));
+          static_cast<i::Tagged_t>(object_ptr));
     }
   }
 #endif
diff --git a/deps/v8/src/diagnostics/perf-jit.cc b/deps/v8/src/diagnostics/perf-jit.cc
index 6af13fe8cf29c4..c509e4220c8e16 100644
--- a/deps/v8/src/diagnostics/perf-jit.cc
+++ b/deps/v8/src/diagnostics/perf-jit.cc
@@ -30,8 +30,8 @@
 #include "src/common/assert-scope.h"
 #include "src/flags/flags.h"
 
-// Only compile the {LinuxPerfJitLogger} on Linux.
-#if V8_OS_LINUX
+// Only compile the {PerfJitLogger} on Linux & Darwin.
+#if V8_OS_LINUX || V8_OS_DARWIN
 
 #include <fcntl.h>
 #include <sys/mman.h>
@@ -118,22 +118,22 @@ struct PerfJitCodeUnwindingInfo : PerfJitBase {
   // Followed by size_ - sizeof(PerfJitCodeUnwindingInfo) bytes of data.
 };
 
-const char LinuxPerfJitLogger::kFilenameFormatString[] = "%s/jit-%d.dump";
+const char PerfJitLogger::kFilenameFormatString[] = "%s/jit-%d.dump";
 
 // Extra padding for the PID in the filename
-const int LinuxPerfJitLogger::kFilenameBufferPadding = 16;
+const int PerfJitLogger::kFilenameBufferPadding = 16;
 
 static const char kStringTerminator[] = {'\0'};
 
 // The following static variables are protected by
 // GetFileMutex().
-int LinuxPerfJitLogger::process_id_ = 0;
-uint64_t LinuxPerfJitLogger::reference_count_ = 0;
-void* LinuxPerfJitLogger::marker_address_ = nullptr;
-uint64_t LinuxPerfJitLogger::code_index_ = 0;
-FILE* LinuxPerfJitLogger::perf_output_handle_ = nullptr;
+int PerfJitLogger::process_id_ = 0;
+uint64_t PerfJitLogger::reference_count_ = 0;
+void* PerfJitLogger::marker_address_ = nullptr;
+uint64_t PerfJitLogger::code_index_ = 0;
+FILE* PerfJitLogger::perf_output_handle_ = nullptr;
 
-void LinuxPerfJitLogger::OpenJitDumpFile() {
+void PerfJitLogger::OpenJitDumpFile() {
   // Open the perf JIT dump file.
   perf_output_handle_ = nullptr;
 
@@ -153,8 +153,17 @@ void LinuxPerfJitLogger::OpenJitDumpFile() {
   if (v8_flags.perf_prof_delete_file)
     CHECK_EQ(0, unlink(perf_dump_name.begin()));
 
+  // On Linux, call OpenMarkerFile so that perf knows about the file path via
+  // an MMAP record.
+  // On macOS, don't call OpenMarkerFile because samply has already detected
+  // the file path during the call to `open` above (it interposes `open` with
+  // a preloaded library), and because the mmap call can be slow.
+#if V8_OS_DARWIN
+  marker_address_ = nullptr;
+#else
   marker_address_ = OpenMarkerFile(fd);
   if (marker_address_ == nullptr) return;
+#endif
 
   perf_output_handle_ = fdopen(fd, "w+");
   if (perf_output_handle_ == nullptr) return;
@@ -162,13 +171,13 @@ void LinuxPerfJitLogger::OpenJitDumpFile() {
   setvbuf(perf_output_handle_, nullptr, _IOFBF, kLogBufferSize);
 }
 
-void LinuxPerfJitLogger::CloseJitDumpFile() {
+void PerfJitLogger::CloseJitDumpFile() {
   if (perf_output_handle_ == nullptr) return;
   base::Fclose(perf_output_handle_);
   perf_output_handle_ = nullptr;
 }
 
-void* LinuxPerfJitLogger::OpenMarkerFile(int fd) {
+void* PerfJitLogger::OpenMarkerFile(int fd) {
   long page_size = sysconf(_SC_PAGESIZE);  // NOLINT(runtime/int)
   if (page_size == -1) return nullptr;
 
@@ -180,15 +189,14 @@ void* LinuxPerfJitLogger::OpenMarkerFile(int fd) {
   return (marker_address == MAP_FAILED) ? nullptr : marker_address;
 }
 
-void LinuxPerfJitLogger::CloseMarkerFile(void* marker_address) {
+void PerfJitLogger::CloseMarkerFile(void* marker_address) {
   if (marker_address == nullptr) return;
   long page_size = sysconf(_SC_PAGESIZE);  // NOLINT(runtime/int)
   if (page_size == -1) return;
   munmap(marker_address, page_size);
 }
 
-LinuxPerfJitLogger::LinuxPerfJitLogger(Isolate* isolate)
-    : CodeEventLogger(isolate) {
+PerfJitLogger::PerfJitLogger(Isolate* isolate) : CodeEventLogger(isolate) {
   base::LockGuard<base::RecursiveMutex> guard_file(GetFileMutex().Pointer());
   process_id_ = base::OS::GetCurrentProcessId();
 
@@ -201,7 +209,7 @@ LinuxPerfJitLogger::LinuxPerfJitLogger(Isolate* isolate)
   }
 }
 
-LinuxPerfJitLogger::~LinuxPerfJitLogger() {
+PerfJitLogger::~PerfJitLogger() {
   base::LockGuard<base::RecursiveMutex> guard_file(GetFileMutex().Pointer());
 
   reference_count_--;
@@ -211,16 +219,11 @@ LinuxPerfJitLogger::~LinuxPerfJitLogger() {
   }
 }
 
-uint64_t LinuxPerfJitLogger::GetTimestamp() {
-  struct timespec ts;
-  int result = clock_gettime(CLOCK_MONOTONIC, &ts);
-  DCHECK_EQ(0, result);
-  USE(result);
-  static const uint64_t kNsecPerSec = 1000000000;
-  return (ts.tv_sec * kNsecPerSec) + ts.tv_nsec;
+uint64_t PerfJitLogger::GetTimestamp() {
+  return base::TimeTicks::Now().since_origin().InNanoseconds();
 }
 
-void LinuxPerfJitLogger::LogRecordedBuffer(
+void PerfJitLogger::LogRecordedBuffer(
     Tagged<AbstractCode> abstract_code,
     MaybeDirectHandle<SharedFunctionInfo> maybe_sfi, const char* name,
     size_t length) {
@@ -264,8 +267,8 @@ void LinuxPerfJitLogger::LogRecordedBuffer(
 }
 
 #if V8_ENABLE_WEBASSEMBLY
-void LinuxPerfJitLogger::LogRecordedBuffer(const wasm::WasmCode* code,
-                                           const char* name, size_t length) {
+void PerfJitLogger::LogRecordedBuffer(const wasm::WasmCode* code,
+                                      const char* name, size_t length) {
   base::LockGuard<base::RecursiveMutex> guard_file(GetFileMutex().Pointer());
 
   if (perf_output_handle_ == nullptr) return;
@@ -277,10 +280,9 @@ void LinuxPerfJitLogger::LogRecordedBuffer(const wasm::WasmCode* code,
 }
 #endif  // V8_ENABLE_WEBASSEMBLY
 
-void LinuxPerfJitLogger::WriteJitCodeLoadEntry(const uint8_t* code_pointer,
-                                               uint32_t code_size,
-                                               const char* name,
-                                               size_t name_length) {
+void PerfJitLogger::WriteJitCodeLoadEntry(const uint8_t* code_pointer,
+                                          uint32_t code_size, const char* name,
+                                          size_t name_length) {
   PerfJitCodeLoad code_load;
   code_load.event_ = PerfJitCodeLoad::kLoad;
   code_load.size_ =
@@ -342,8 +344,8 @@ SourcePositionInfo GetSourcePositionInfo(
 
 }  // namespace
 
-void LinuxPerfJitLogger::LogWriteDebugInfo(
-    Tagged<Code> code, DirectHandle<SharedFunctionInfo> shared) {
+void PerfJitLogger::LogWriteDebugInfo(Tagged<Code> code,
+                                      DirectHandle<SharedFunctionInfo> shared) {
   // Line ends of all scripts have been initialized prior to this.
   DisallowGarbageCollection no_gc;
   // The WasmToJS wrapper stubs have source position entries.
@@ -425,7 +427,7 @@ void LinuxPerfJitLogger::LogWriteDebugInfo(
 }
 
 #if V8_ENABLE_WEBASSEMBLY
-void LinuxPerfJitLogger::LogWriteDebugInfo(const wasm::WasmCode* code) {
+void PerfJitLogger::LogWriteDebugInfo(const wasm::WasmCode* code) {
   if (code->IsAnonymous()) {
     return;
   }
@@ -497,7 +499,7 @@ void LinuxPerfJitLogger::LogWriteDebugInfo(const wasm::WasmCode* code) {
 }
 #endif  // V8_ENABLE_WEBASSEMBLY
 
-void LinuxPerfJitLogger::LogWriteUnwindingInfo(Tagged<Code> code) {
+void PerfJitLogger::LogWriteUnwindingInfo(Tagged<Code> code) {
   PerfJitCodeUnwindingInfo unwinding_info_header;
   unwinding_info_header.event_ = PerfJitCodeLoad::kUnwindingInfo;
   unwinding_info_header.time_stamp_ = GetTimestamp();
@@ -532,13 +534,13 @@ void LinuxPerfJitLogger::LogWriteUnwindingInfo(Tagged<Code> code) {
   LogWriteBytes(padding_bytes, padding_size);
 }
 
-void LinuxPerfJitLogger::LogWriteBytes(const char* bytes, size_t size) {
+void PerfJitLogger::LogWriteBytes(const char* bytes, size_t size) {
   size_t rv = fwrite(bytes, 1, size, perf_output_handle_);
   DCHECK_EQ(size, rv);
   USE(rv);
 }
 
-void LinuxPerfJitLogger::LogWriteHeader() {
+void PerfJitLogger::LogWriteHeader() {
   DCHECK_NOT_NULL(perf_output_handle_);
   PerfJitHeader header;
 
@@ -559,4 +561,4 @@ void LinuxPerfJitLogger::LogWriteHeader() {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_OS_LINUX
+#endif  // V8_OS_LINUX || V8_OS_DARWIN
diff --git a/deps/v8/src/diagnostics/perf-jit.h b/deps/v8/src/diagnostics/perf-jit.h
index 84f669ca3f9869..e95c3bb6fe0f44 100644
--- a/deps/v8/src/diagnostics/perf-jit.h
+++ b/deps/v8/src/diagnostics/perf-jit.h
@@ -30,8 +30,8 @@
 
 #include "include/v8config.h"
 
-// {LinuxPerfJitLogger} is only implemented on Linux.
-#if V8_OS_LINUX
+// {PerfJitLogger} is only implemented on Linux & Darwin.
+#if V8_OS_LINUX || V8_OS_DARWIN
 
 #include "src/logging/log.h"
 
@@ -39,10 +39,10 @@ namespace v8 {
 namespace internal {
 
 // Linux perf tool logging support.
-class LinuxPerfJitLogger : public CodeEventLogger {
+class PerfJitLogger : public CodeEventLogger {
  public:
-  explicit LinuxPerfJitLogger(Isolate* isolate);
-  ~LinuxPerfJitLogger() override;
+  explicit PerfJitLogger(Isolate* isolate);
+  ~PerfJitLogger() override;
 
   void CodeMoveEvent(Tagged<InstructionStream> from,
                      Tagged<InstructionStream> to) override {
@@ -143,6 +143,6 @@ class LinuxPerfJitLogger : public CodeEventLogger {
 }  // namespace internal
 }  // namespace v8
 
-#endif  // V8_OS_LINUX
+#endif  // V8_OS_LINUX || V8_OS_DARWIN
 
 #endif  // V8_DIAGNOSTICS_PERF_JIT_H_
diff --git a/deps/v8/src/execution/arguments.h b/deps/v8/src/execution/arguments.h
index 100e4d6e3087bc..b7ee609dfc1296 100644
--- a/deps/v8/src/execution/arguments.h
+++ b/deps/v8/src/execution/arguments.h
@@ -142,6 +142,7 @@ FullObjectSlot Arguments<T>::slot_from_address_at(int index, int offset) const {
   RUNTIME_ENTRY_WITH_RCS(Type, InternalType, Convert, Name)                \
   Type Name(int args_length, Address* args_object, Isolate* isolate) {     \
     DCHECK(isolate->context().is_null() || IsContext(isolate->context())); \
+    DCHECK(isolate->IsOnCentralStack());                                   \
     CLOBBER_DOUBLE_REGISTERS();                                            \
     TEST_AND_CALL_RCS(Name)                                                \
     RuntimeArguments args(args_length, args_object);                       \
diff --git a/deps/v8/src/execution/arm64/simulator-arm64.cc b/deps/v8/src/execution/arm64/simulator-arm64.cc
index 4c733a71168b45..8010cafbe7fef0 100644
--- a/deps/v8/src/execution/arm64/simulator-arm64.cc
+++ b/deps/v8/src/execution/arm64/simulator-arm64.cc
@@ -1833,7 +1833,8 @@ void Simulator::VisitUnconditionalBranch(Instruction* instr) {
 }
 
 void Simulator::VisitConditionalBranch(Instruction* instr) {
-  DCHECK(instr->Mask(ConditionalBranchMask) == B_cond);
+  DCHECK(instr->Mask(ConditionalBranchMask) == B_cond ||
+         instr->Mask(ConditionalBranchMask) == BC_cond);
   if (ConditionPassed(static_cast<Condition>(instr->ConditionBranch()))) {
     set_pc(instr->ImmPCOffsetTarget());
   }
@@ -3095,6 +3096,24 @@ void Simulator::VisitDataProcessing1Source(Instruction* instr) {
       set_xreg(dst, CountLeadingSignBits(xreg(src), kXRegSizeInBits));
       break;
     }
+    case CTZ_w:
+      set_wreg(dst, CountTrailingZeros(wreg(src), kWRegSizeInBits));
+      break;
+    case CTZ_x:
+      set_xreg(dst, CountTrailingZeros(xreg(src), kXRegSizeInBits));
+      break;
+    case CNT_w:
+      set_wreg(dst, CountSetBits(wreg(src), kWRegSizeInBits));
+      break;
+    case CNT_x:
+      set_xreg(dst, CountSetBits(xreg(src), kXRegSizeInBits));
+      break;
+    case ABS_w:
+      set_wreg(dst, Abs(wreg(src)));
+      break;
+    case ABS_x:
+      set_xreg(dst, Abs(xreg(src)));
+      break;
     default:
       UNIMPLEMENTED();
   }
@@ -5503,7 +5522,7 @@ void Simulator::NEONLoadStoreMultiStructHelper(const Instruction* instr,
     // The immediate is implied by the number of vector registers used.
     addr_base +=
         (rm == 31) ? RegisterSizeInBytesFromFormat(vf) * count : xreg(rm);
-    set_xreg(instr->Rn(), addr_base);
+    set_xreg(instr->Rn(), addr_base, Reg31IsStackPointer);
   } else {
     DCHECK_EQ(addr_mode, Offset);
   }
@@ -5741,7 +5760,8 @@ void Simulator::NEONLoadStoreSingleStructHelper(const Instruction* instr,
   if (addr_mode == PostIndex) {
     int rm = instr->Rm();
     int lane_size = LaneSizeInBytesFromFormat(vf);
-    set_xreg(instr->Rn(), addr + ((rm == 31) ? (scale * lane_size) : xreg(rm)));
+    set_xreg(instr->Rn(), addr + ((rm == 31) ? (scale * lane_size) : xreg(rm)),
+             Reg31IsStackPointer);
   }
 }
 
@@ -6542,6 +6562,29 @@ void Simulator::VisitNEONTable(Instruction* instr) {
   }
 }
 
+void Simulator::VisitNEONSHA3(Instruction* instr) {
+  NEONFormatDecoder nfd(instr);
+  VectorFormat vf = nfd.GetVectorFormat();
+
+  SimVRegister& rd = vreg(instr->Rd());
+  SimVRegister& rn = vreg(instr->Rn());
+  SimVRegister& rm = vreg(instr->Rm());
+  SimVRegister& ra = vreg(instr->Ra());
+  SimVRegister temp;
+
+  switch (instr->Mask(NEONSHA3Mask)) {
+    case NEON_BCAX:
+      bic(vf, temp, rm, ra);
+      eor(vf, rd, rn, temp);
+      break;
+    case NEON_EOR3:
+      eor(vf, temp, rm, ra);
+      eor(vf, rd, rn, temp);
+      break;
+    default:
+      UNIMPLEMENTED();
+  }
+}
 void Simulator::VisitNEONPerm(Instruction* instr) {
   NEONFormatDecoder nfd(instr);
   VectorFormat vf = nfd.GetVectorFormat();
diff --git a/deps/v8/src/execution/arm64/simulator-arm64.h b/deps/v8/src/execution/arm64/simulator-arm64.h
index fd5d5c0dcfcc10..3067beab186251 100644
--- a/deps/v8/src/execution/arm64/simulator-arm64.h
+++ b/deps/v8/src/execution/arm64/simulator-arm64.h
@@ -698,9 +698,6 @@ class Simulator : public DecoderVisitor, public SimulatorBase {
     }
 
     explicit CallArgument(float argument) {
-      // TODO(all): CallArgument(float) is untested, remove this check once
-      //            tested.
-      UNIMPLEMENTED();
       // Make the D register a NaN to try to trap errors if the callee expects a
       // double. If it expects a float, the callee should ignore the top word.
       DCHECK(sizeof(kFP64SignallingNaN) == sizeof(bits_));
diff --git a/deps/v8/src/execution/frame-constants.h b/deps/v8/src/execution/frame-constants.h
index 0cc0efaf5c3ac4..4d4f3ad5ba4af8 100644
--- a/deps/v8/src/execution/frame-constants.h
+++ b/deps/v8/src/execution/frame-constants.h
@@ -292,6 +292,9 @@ class WasmToJSInterpreterFrameConstants : public TypedFrameConstants {
 
   // The stack pointer at the moment of the JS function call.
   static constexpr int kGCSPOffset = TYPED_FRAME_PUSHED_VALUE_OFFSET(1);
+
+  // Returned for a successful completion of the WasmToJS call (no exception).
+  static constexpr int kSuccess = 1;
 };
 
 class WasmInterpreterCWasmEntryConstants : public TypedFrameConstants {
diff --git a/deps/v8/src/execution/frames.cc b/deps/v8/src/execution/frames.cc
index 8588e71521ee4a..2b93457521da09 100644
--- a/deps/v8/src/execution/frames.cc
+++ b/deps/v8/src/execution/frames.cc
@@ -143,13 +143,6 @@ StackFrameIterator::StackFrameIterator(Isolate* isolate, ThreadLocalTop* t)
 }
 
 #if V8_ENABLE_WEBASSEMBLY
-StackFrameIterator::StackFrameIterator(Isolate* isolate, ThreadLocalTop* t,
-                                       NoHandles)
-    : StackFrameIteratorBase(isolate) {
-  no_gc_.emplace();
-  Reset(t);
-}
-
 StackFrameIterator::StackFrameIterator(Isolate* isolate, ThreadLocalTop* t,
                                        FirstStackOnly)
     : StackFrameIteratorBase(isolate) {
@@ -163,12 +156,6 @@ StackFrameIterator::StackFrameIterator(Isolate* isolate,
   first_stack_only_ = true;
   Reset(isolate->thread_local_top(), stack);
 }
-#else
-StackFrameIterator::StackFrameIterator(Isolate* isolate, ThreadLocalTop* t,
-                                       NoHandles)
-    : StackFrameIteratorBase(isolate) {
-  Reset(t);
-}
 #endif
 
 void StackFrameIterator::Advance() {
@@ -190,11 +177,8 @@ void StackFrameIterator::Advance() {
     // the "caller" frame (top frame of the parent stack) have frame type
     // STACK_SWITCH. We use the caller FP to distinguish them: the callee frame
     // does not have a caller fp.
-    auto parent = continuation()->parent();
-    CHECK(!IsUndefined(parent));
-    set_continuation(
-        GCSafeCast<WasmContinuationObject>(parent, isolate_->heap()));
-    wasm_stack_ = reinterpret_cast<wasm::StackMemory*>(continuation()->stack());
+    wasm_stack_ = wasm_stack()->jmpbuf()->parent;
+    CHECK_NOT_NULL(wasm_stack_);
     CHECK_EQ(wasm_stack_->jmpbuf()->state, wasm::JumpBuffer::Inactive);
     StackSwitchFrame::GetStateForJumpBuffer(wasm_stack_->jmpbuf(), &state);
     SetNewFrame(StackFrame::STACK_SWITCH, &state);
@@ -284,15 +268,7 @@ void StackFrameIterator::Reset(ThreadLocalTop* top) {
     type = ExitFrame::GetStateForFramePointer(Isolate::c_entry_fp(top), &state);
   }
 #if V8_ENABLE_WEBASSEMBLY
-  auto active_continuation = isolate_->root(RootIndex::kActiveContinuation);
-  if (!IsUndefined(active_continuation, isolate_)) {
-    auto continuation = GCSafeCast<WasmContinuationObject>(active_continuation,
-                                                           isolate_->heap());
-    if (!first_stack_only_) {
-      set_continuation(continuation);
-    }
-    wasm_stack_ = reinterpret_cast<wasm::StackMemory*>(continuation->stack());
-  }
+  wasm_stack_ = isolate_->isolate_data()->active_stack();
 #endif
   handler_ = StackHandler::FromAddress(Isolate::handler(top));
   SetNewFrame(type, &state);
@@ -338,21 +314,6 @@ void StackFrameIteratorBase::SetNewFrame(StackFrame::Type type) {
   frame_ = nullptr;
 }
 
-#if V8_ENABLE_WEBASSEMBLY
-Tagged<WasmContinuationObject> StackFrameIterator::continuation() {
-  return no_gc_.has_value() ? continuation_.obj_ : *continuation_.handle_;
-}
-
-void StackFrameIterator::set_continuation(
-    Tagged<WasmContinuationObject> continuation) {
-  if (no_gc_.has_value()) {
-    continuation_.obj_ = continuation;
-  } else {
-    continuation_.handle_ = handle(continuation, isolate_);
-  }
-}
-#endif
-
 // -------------------------------------------------------------------------
 
 void TypedFrameWithJSLinkage::Iterate(RootVisitor* v) const {
@@ -396,19 +357,6 @@ DebuggableStackFrameIterator::DebuggableStackFrameIterator(Isolate* isolate,
   while (!done() && frame()->id() != id) Advance();
 }
 
-DebuggableStackFrameIterator::DebuggableStackFrameIterator(
-    Isolate* isolate, StackFrameIterator::NoHandles)
-    : iterator_(isolate, isolate->thread_local_top(),
-                StackFrameIterator::NoHandles{}) {
-  if (!done() && !IsValidFrame(iterator_.frame())) Advance();
-}
-
-DebuggableStackFrameIterator::DebuggableStackFrameIterator(
-    Isolate* isolate, StackFrameId id, StackFrameIterator::NoHandles)
-    : DebuggableStackFrameIterator(isolate, StackFrameIterator::NoHandles{}) {
-  while (!done() && frame()->id() != id) Advance();
-}
-
 void DebuggableStackFrameIterator::Advance() {
   do {
     iterator_.Advance();
@@ -1596,7 +1544,7 @@ void VisitSpillSlot(Isolate* isolate, RootVisitor* v,
       // We don't need to update smi values or full pointers.
       was_compressed = true;
       *spill_slot.location() = V8HeapCompressionScheme::DecompressTagged(
-          cage_base, static_cast<Tagged_t>(value));
+          static_cast<Tagged_t>(value));
       if (DEBUG_BOOL) {
         // Ensure that the spill slot contains correct heap object.
         Tagged<HeapObject> raw =
@@ -1631,8 +1579,8 @@ void VisitSpillSlot(Isolate* isolate, RootVisitor* v,
     if (!HAS_SMI_TAG(compressed_value)) {
       was_compressed = slot_contents <= 0xFFFFFFFF;
       // We don't need to update smi values.
-      *spill_slot.location() = V8HeapCompressionScheme::DecompressTagged(
-          cage_base, compressed_value);
+      *spill_slot.location() =
+          V8HeapCompressionScheme::DecompressTagged(compressed_value);
     }
   }
 #endif
@@ -2811,7 +2759,8 @@ DirectHandle<StackFrameInfo>
 FrameSummary::JavaScriptFrameSummary::CreateStackFrameInfo() const {
   DirectHandle<SharedFunctionInfo> shared(function_->shared(), isolate());
   DirectHandle<Script> script(Cast<Script>(shared->script()), isolate());
-  DirectHandle<String> function_name = JSFunction::GetDebugName(function_);
+  DirectHandle<String> function_name =
+      JSFunction::GetDebugName(isolate(), function_);
   if (function_name->length() == 0 &&
       script->compilation_type() == Script::CompilationType::kEval) {
     function_name = isolate()->factory()->eval_string();
@@ -4112,7 +4061,7 @@ void JavaScriptFrame::Print(StringStream* accumulator, PrintMode mode,
     if (!context.is_null()) {
       int slot_index = Context::MIN_CONTEXT_SLOTS + it->index();
       if (slot_index < context->length()) {
-        accumulator->Add("%o", context->get(slot_index));
+        accumulator->Add("%o", context->get(slot_index, kRelaxedLoad));
       } else {
         accumulator->Add(
             "// warning: missing context slot - inconsistent frame?");
diff --git a/deps/v8/src/execution/frames.h b/deps/v8/src/execution/frames.h
index d105cf614dbb9b..d005ec6b699664 100644
--- a/deps/v8/src/execution/frames.h
+++ b/deps/v8/src/execution/frames.h
@@ -1683,12 +1683,6 @@ class StackFrameIteratorBase {
   bool first_stack_only_ = false;
   // // Current wasm stack being iterated.
   wasm::StackMemory* wasm_stack_ = nullptr;
-  // See {StackFrameIterator::NoHandles}.
-  std::optional<DisallowGarbageCollection> no_gc_;
-  union {
-    Handle<WasmContinuationObject> handle_;
-    Tagged<WasmContinuationObject> obj_;
-  } continuation_{Handle<WasmContinuationObject>::null()};
 #endif
 
   StackHandler* handler() const {
@@ -1711,12 +1705,6 @@ class StackFrameIterator : public StackFrameIteratorBase {
   V8_EXPORT_PRIVATE explicit StackFrameIterator(Isolate* isolate);
   // An iterator that iterates over a given thread's stack.
   V8_EXPORT_PRIVATE StackFrameIterator(Isolate* isolate, ThreadLocalTop* t);
-  // Use this constructor to use the stack frame iterator without a handle
-  // scope. This sets the {no_gc_} scope, and if the {continuation_} object is
-  // used, it is unhandlified.
-  struct NoHandles {};
-  V8_EXPORT_PRIVATE StackFrameIterator(Isolate* isolate, ThreadLocalTop* top,
-                                       NoHandles);
 #if V8_ENABLE_WEBASSEMBLY
   // Depending on the use case, users of the StackFrameIterator should either:
   // - Use the default constructor, which iterates the active stack and its
@@ -1745,8 +1733,6 @@ class StackFrameIterator : public StackFrameIteratorBase {
 #if V8_ENABLE_WEBASSEMBLY
   // Go to the first frame of this stack.
   void Reset(ThreadLocalTop* top, wasm::StackMemory* stack);
-  Tagged<WasmContinuationObject> continuation();
-  void set_continuation(Tagged<WasmContinuationObject> continuation);
 #endif
 
 #ifdef DEBUG
@@ -1792,10 +1778,6 @@ class V8_EXPORT_PRIVATE DebuggableStackFrameIterator {
   explicit DebuggableStackFrameIterator(Isolate* isolate);
   // Skip frames until the frame with the given id is reached.
   DebuggableStackFrameIterator(Isolate* isolate, StackFrameId id);
-  // Overloads to be used in scopes without a HandleScope.
-  DebuggableStackFrameIterator(Isolate* isolate, StackFrameIterator::NoHandles);
-  DebuggableStackFrameIterator(Isolate* isolate, StackFrameId id,
-                               StackFrameIterator::NoHandles);
 
   bool done() const { return iterator_.done(); }
   void Advance();
diff --git a/deps/v8/src/execution/isolate-data.h b/deps/v8/src/execution/isolate-data.h
index 37477a5ee6b874..4767f4c46205cd 100644
--- a/deps/v8/src/execution/isolate-data.h
+++ b/deps/v8/src/execution/isolate-data.h
@@ -26,6 +26,10 @@ namespace internal {
 class Isolate;
 class TrustedPointerPublishingScope;
 
+namespace wasm {
+class StackMemory;
+}
+
 #if V8_HOST_ARCH_64_BIT
 // In kSystemPointerSize.
 static constexpr int kFastCCallAlignmentPaddingCount = 5;
@@ -156,6 +160,7 @@ struct JSBuiltinDispatchHandleRoot {
   V(BuiltinEntryTable, Builtins::kBuiltinCount* kSystemPointerSize,            \
     builtin_entry_table)                                                       \
   V(BuiltinTable, Builtins::kBuiltinCount* kSystemPointerSize, builtin_table)  \
+  V(ActiveStack, kSystemPointerSize, active_stack)                             \
   ISOLATE_DATA_FIELDS_LEAPTIERING(V)
 
 #ifdef V8_COMPRESS_POINTERS
@@ -327,6 +332,8 @@ class IsolateData final {
   ThreadLocalTop const& thread_local_top() const { return thread_local_top_; }
   Address* builtin_entry_table() { return builtin_entry_table_; }
   Address* builtin_table() { return builtin_table_; }
+  wasm::StackMemory* active_stack() { return active_stack_; }
+  void set_active_stack(wasm::StackMemory* stack) { active_stack_ = stack; }
 #if V8_ENABLE_LEAPTIERING_BOOL && !V8_STATIC_DISPATCH_HANDLES_BOOL
   JSDispatchHandle builtin_dispatch_handle(Builtin builtin) {
     return builtin_dispatch_table_[JSBuiltinDispatchHandleRoot::to_idx(
@@ -524,6 +531,8 @@ class IsolateData final {
   // The entries in this array are tagged pointers to Code objects.
   Address builtin_table_[Builtins::kBuiltinCount] = {};
 
+  wasm::StackMemory* active_stack_ = nullptr;
+
 #if V8_ENABLE_LEAPTIERING_BOOL && !V8_STATIC_DISPATCH_HANDLES_BOOL
   // The entries in this array are dispatch handles for builtins with SFI's.
   JSDispatchHandle* builtin_dispatch_table() { return builtin_dispatch_table_; }
diff --git a/deps/v8/src/execution/isolate-utils-inl.h b/deps/v8/src/execution/isolate-utils-inl.h
index 2503339350fe04..c998134dd27b4c 100644
--- a/deps/v8/src/execution/isolate-utils-inl.h
+++ b/deps/v8/src/execution/isolate-utils-inl.h
@@ -26,8 +26,8 @@ V8_INLINE Heap* GetHeapFromWritableObject(Tagged<HeapObject> object) {
   // with `isolate->shared_space_isolate()` if needed.
   DCHECK(!chunk->InWritableSharedSpace());
   Heap* heap = chunk->GetHeap();
-  // TODO(396607238): Make this a `SBXCHECK`.
-  DCHECK_EQ(heap->isolate(), Isolate::TryGetCurrent());
+  // See the TODO above: The heap/isolate returned here must match TLS.
+  CHECK_EQ(heap->isolate(), Isolate::TryGetCurrent());
   return heap;
 }
 
diff --git a/deps/v8/src/execution/isolate.cc b/deps/v8/src/execution/isolate.cc
index 960132fe5532ec..526eb368c43ece 100644
--- a/deps/v8/src/execution/isolate.cc
+++ b/deps/v8/src/execution/isolate.cc
@@ -499,8 +499,8 @@ size_t Isolate::HashIsolateForEmbeddedBlob() {
     static_assert(Code::kConstantPoolOffsetOffsetEnd + 1 ==
                   Code::kCodeCommentsOffsetOffset);
     static_assert(Code::kCodeCommentsOffsetOffsetEnd + 1 ==
-                  Code::kBuiltinJumpTableInfoOffsetOffset);
-    static_assert(Code::kBuiltinJumpTableInfoOffsetOffsetEnd + 1 ==
+                  Code::kJumpTableInfoOffsetOffset);
+    static_assert(Code::kJumpTableInfoOffsetOffsetEnd + 1 ==
                   Code::kParameterCountOffset);
     static_assert(Code::kParameterCountOffsetEnd + 1 == Code::kBuiltinIdOffset);
     static_assert(Code::kBuiltinIdOffsetEnd + 1 == Code::kUnalignedSize);
@@ -1175,7 +1175,7 @@ void CaptureAsyncStackTrace(Isolate* isolate, DirectHandle<JSPromise> promise,
       int const index =
           PromiseBuiltins::kPromiseAllResolveElementCapabilitySlot;
       DirectHandle<PromiseCapability> capability(
-          Cast<PromiseCapability>(context->get(index)), isolate);
+          Cast<PromiseCapability>(context->GetNoCell(index)), isolate);
       if (!IsJSPromise(capability->promise())) return;
       promise = direct_handle(Cast<JSPromise>(capability->promise()), isolate);
     } else if (IsBuiltinFunction(
@@ -1200,7 +1200,7 @@ void CaptureAsyncStackTrace(Isolate* isolate, DirectHandle<JSPromise> promise,
       int const index =
           PromiseBuiltins::kPromiseAllResolveElementCapabilitySlot;
       DirectHandle<PromiseCapability> capability(
-          Cast<PromiseCapability>(context->get(index)), isolate);
+          Cast<PromiseCapability>(context->GetNoCell(index)), isolate);
       if (!IsJSPromise(capability->promise())) return;
       promise = direct_handle(Cast<JSPromise>(capability->promise()), isolate);
     } else if (IsBuiltinFunction(isolate, reaction->reject_handler(),
@@ -1223,7 +1223,7 @@ void CaptureAsyncStackTrace(Isolate* isolate, DirectHandle<JSPromise> promise,
       // the concurrent promises resolve.
       int const index = PromiseBuiltins::kPromiseAnyRejectElementCapabilitySlot;
       DirectHandle<PromiseCapability> capability(
-          Cast<PromiseCapability>(context->get(index)), isolate);
+          Cast<PromiseCapability>(context->GetNoCell(index)), isolate);
       if (!IsJSPromise(capability->promise())) return;
       promise = direct_handle(Cast<JSPromise>(capability->promise()), isolate);
     } else if (IsBuiltinFunction(isolate, reaction->fulfill_handler(),
@@ -1232,7 +1232,7 @@ void CaptureAsyncStackTrace(Isolate* isolate, DirectHandle<JSPromise> promise,
           Cast<JSFunction>(reaction->fulfill_handler()), isolate);
       DirectHandle<Context> context(function->context(), isolate);
       promise = direct_handle(
-          Cast<JSPromise>(context->get(PromiseBuiltins::kPromiseSlot)),
+          Cast<JSPromise>(context->GetNoCell(PromiseBuiltins::kPromiseSlot)),
           isolate);
     } else {
       // We have some generic promise chain here, so try to
@@ -2090,9 +2090,18 @@ DirectHandle<JSMessageObject> Isolate::CreateMessageOrAbort(
 
 Tagged<Object> Isolate::Throw(Tagged<Object> raw_exception,
                               MessageLocation* location) {
-  DCHECK(!has_exception());
+  if (has_exception()) {
+    // A termination exception may have been thrown while preparing
+    // {raw_exception}, e.g. by the near heap limit callback
+    // (crbug.com/409487530).
+    // In this case ignore the current error and propagate the termination
+    // exception instead. Any other kind of exception is unexpected.
+    DCHECK(IsTerminationException(exception()));
+    return ReadOnlyRoots(heap()).exception();
+  }
   DCHECK_IMPLIES(IsHole(raw_exception),
                  raw_exception == ReadOnlyRoots{this}.termination_exception());
+  CHECK(IsOnCentralStack());
 #if V8_ENABLE_WEBASSEMBLY
   trap_handler::AssertThreadNotInWasm();
 #endif
@@ -2272,26 +2281,20 @@ Tagged<Object> Isolate::UnwindAndFindHandler() {
     // intermediate stack switches.
     // This cannot be done during unwinding because the stack switching state
     // must stay consistent with the thread local top (see crbug.com/406053619).
-    Tagged<Object> maybe_continuation = root(RootIndex::kActiveContinuation);
-    if (!IsUndefined(maybe_continuation)) {
-      auto continuation = Cast<WasmContinuationObject>(maybe_continuation);
-      wasm::StackMemory* stack = nullptr;
-      while (continuation != iter.continuation()) {
-        auto parent = Cast<WasmContinuationObject>(continuation->parent());
-        stack = reinterpret_cast<wasm::StackMemory*>(parent->stack());
-        SBXCHECK_EQ(stack->jmpbuf()->state, wasm::JumpBuffer::Inactive);
-        SwitchStacks(continuation, parent);
-        stack->jmpbuf()->state = wasm::JumpBuffer::Active;
-        RetireWasmStack(continuation);
-        continuation = parent;
+    wasm::StackMemory* active_stack = isolate_data_.active_stack();
+    if (active_stack != nullptr) {
+      wasm::StackMemory* parent = nullptr;
+      while (active_stack != iter.wasm_stack()) {
+        parent = active_stack->jmpbuf()->parent;
+        SBXCHECK_EQ(parent->jmpbuf()->state, wasm::JumpBuffer::Inactive);
+        SwitchStacks(active_stack, parent);
+        parent->jmpbuf()->state = wasm::JumpBuffer::Active;
+        RetireWasmStack(active_stack);
+        active_stack = parent;
       }
-      if (stack) {
+      if (parent) {
         // We switched at least once, update the active continuation.
-        roots_table().slot(RootIndex::kActiveContinuation).store(continuation);
-#if USE_SIMULATOR_BOOL && V8_TARGET_ARCH_ARM64
-        Simulator::current(this)->SetStackLimit(
-            reinterpret_cast<uintptr_t>(stack->jmpbuf()->stack_limit));
-#endif
+        isolate_data_.set_active_stack(active_stack);
       }
     }
     // The unwinder is running on the central stack. If the target frame is in a
@@ -2300,16 +2303,16 @@ Tagged<Object> Isolate::UnwindAndFindHandler() {
         handler_sp != kNullAddress ? handler_sp : handler_fp;
     if (!IsOnCentralStack(stack_address)) {
       thread_local_top()->is_on_central_stack_flag_ = false;
+      iter.wasm_stack()->ShrinkTo(stack_address);
       uintptr_t limit =
           reinterpret_cast<uintptr_t>(iter.wasm_stack()->jslimit());
       stack_guard()->SetStackLimitForStackSwitching(limit);
-      thread_local_top()->secondary_stack_limit_ = 0;
-      thread_local_top()->secondary_stack_sp_ = 0;
-#if USE_SIMULATOR_BOOL && V8_TARGET_ARCH_ARM64
-      Simulator::current(this)->SetStackLimit(limit);
-#endif
       iter.wasm_stack()->clear_stack_switch_info();
     }
+    // Regardless of the stack that the handler belongs to, these fields should
+    // be cleared.
+    thread_local_top()->secondary_stack_limit_ = 0;
+    thread_local_top()->secondary_stack_sp_ = 0;
 #endif
 
     // Return and clear exception. The contract is that:
@@ -2337,9 +2340,8 @@ Tagged<Object> Isolate::UnwindAndFindHandler() {
   // Compute handler and stack unwinding information by performing a full walk
   // over the stack and dispatching according to the frame type.
   int visited_frames = 0;
-  for (StackFrameIterator iter(this, thread_local_top(),
-                               StackFrameIterator::NoHandles{});
-       ; iter.Advance(), visited_frames++) {
+  for (StackFrameIterator iter(this, thread_local_top());;
+       iter.Advance(), visited_frames++) {
 #if V8_ENABLE_WEBASSEMBLY
     if (iter.frame()->type() == StackFrame::STACK_SWITCH) {
       if (catchable_by_js && iter.frame()->LookupCode()->builtin_id() !=
@@ -3210,7 +3212,7 @@ bool WalkPromiseTreeInternal(
                 int const index =
                     PromiseBuiltins::PromiseFinallyContextSlot::kOnFinallySlot;
                 fulfill_handler = direct_handle(
-                    Cast<JSReceiver>(context->get(index)), isolate);
+                    Cast<JSReceiver>(context->GetNoCell(index)), isolate);
               }
               if (IsJSFunction(*fulfill_handler)) {
                 callback({Cast<JSFunction>(fulfill_handler)->shared(), true});
@@ -3338,32 +3340,32 @@ bool CallsCatchMethod(Isolate* isolate, Handle<BytecodeArray> bytecode_array,
     if (iterator.done()) {
       return false;
     }
-    if (iterator.current_bytecode() == Bytecode::kStaCurrentContextSlot) {
+    if (iterator.current_bytecode() == Bytecode::kStaCurrentContextSlotNoCell) {
       // Step over patterns like:
-      //     StaCurrentContextSlot [x]
+      //     StaCurrentContextSlotNoCell [x]
       //     LdaImmutableCurrentContextSlot [x]
       unsigned int slot = iterator.GetIndexOperand(0);
       iterator.Advance();
-      if (!iterator.done() &&
-          (iterator.current_bytecode() ==
-               Bytecode::kLdaImmutableCurrentContextSlot ||
-           iterator.current_bytecode() == Bytecode::kLdaCurrentContextSlot)) {
+      if (!iterator.done() && (iterator.current_bytecode() ==
+                                   Bytecode::kLdaImmutableCurrentContextSlot ||
+                               iterator.current_bytecode() ==
+                                   Bytecode::kLdaCurrentContextSlotNoCell)) {
         if (iterator.GetIndexOperand(0) != slot) {
           return false;
         }
         iterator.Advance();
       }
-    } else if (iterator.current_bytecode() == Bytecode::kStaContextSlot) {
+    } else if (iterator.current_bytecode() == Bytecode::kStaContextSlotNoCell) {
       // Step over patterns like:
-      //     StaContextSlot r_x [y] [z]
-      //     LdaContextSlot r_x [y] [z]
+      //     StaContextSlotNoCell r_x [y] [z]
+      //     LdaContextSlotNoCell r_x [y] [z]
       int context = iterator.GetRegisterOperand(0).index();
       unsigned int slot = iterator.GetIndexOperand(1);
       unsigned int depth = iterator.GetUnsignedImmediateOperand(2);
       iterator.Advance();
       if (!iterator.done() &&
           (iterator.current_bytecode() == Bytecode::kLdaImmutableContextSlot ||
-           iterator.current_bytecode() == Bytecode::kLdaContextSlot)) {
+           iterator.current_bytecode() == Bytecode::kLdaContextSlotNoCell)) {
         if (iterator.GetRegisterOperand(0).index() != context ||
             iterator.GetIndexOperand(1) != slot ||
             iterator.GetUnsignedImmediateOperand(2) != depth) {
@@ -3672,6 +3674,8 @@ bool Isolate::IsWasmStringRefEnabled(DirectHandle<NativeContext> context) {
 
 bool Isolate::IsWasmJSPIRequested(DirectHandle<NativeContext> context) {
 #ifdef V8_ENABLE_WEBASSEMBLY
+  if (v8_flags.wasm_jitless) return false;
+
   v8::WasmJSPIEnabledCallback jspi_callback = wasm_jspi_enabled_callback();
   if (jspi_callback) {
     v8::Local<v8::Context> api_context = v8::Utils::ToLocal(context);
@@ -3843,8 +3847,7 @@ void Isolate::AddSharedWasmMemory(
   heap()->set_shared_wasm_memories(*shared_wasm_memories);
 }
 
-void Isolate::SwitchStacks(Tagged<WasmContinuationObject> source_continuation,
-                           Tagged<WasmContinuationObject> target_continuation) {
+void Isolate::SwitchStacks(wasm::StackMemory* from, wasm::StackMemory* to) {
   // Synchronize the stack limit with the active continuation for
   // stack-switching. This can be done before or after changing the stack
   // pointer itself, as long as we update both before the next stack check.
@@ -3854,66 +3857,49 @@ void Isolate::SwitchStacks(Tagged<WasmContinuationObject> source_continuation,
   // preserved and handled at the next stack check.
 
   DisallowGarbageCollection no_gc;
-  wasm::StackMemory* target_stack =
-      reinterpret_cast<wasm::StackMemory*>(target_continuation->stack());
-  wasm::StackMemory* source_stack =
-      reinterpret_cast<wasm::StackMemory*>(source_continuation->stack());
   if (v8_flags.trace_wasm_stack_switching) {
-    if (source_stack->jmpbuf()->state == wasm::JumpBuffer::Suspended) {
-      PrintF("Switch from stack %d to %d (resume/start)\n", source_stack->id(),
-             target_stack->id());
-    } else if (target_stack->jmpbuf()->state == wasm::JumpBuffer::Inactive) {
-      PrintF("Switch from stack %d to %d (suspend/return)\n",
-             source_stack->id(), target_stack->id());
+    if (to->jmpbuf()->state == wasm::JumpBuffer::Suspended) {
+      PrintF("Switch from stack %d to %d (resume/start)\n", from->id(),
+             to->id());
+    } else if (to->jmpbuf()->state == wasm::JumpBuffer::Inactive) {
+      PrintF("Switch from stack %d to %d (suspend/return)\n", from->id(),
+             to->id());
     } else {
       UNREACHABLE();
     }
   }
-#if V8_ENABLE_SANDBOX
-  // The logic below essentially duplicates the WasmContinuationObject linked
-  // list outside of the sandbox as a JumpBuffer linked list, and uses it to
-  // validate the potentially corrupted parent pointer on return/suspend.
-  // TODO(thibaudm): Investigate whether we can deduplicate the linked list by
-  // moving WasmContinuationObjects to trusted space and removing this one, or
-  // by removing the WasmContinuationObjects and only keeping a linked list of
-  // wasm::StackMemories.
-  // TODO(fgm): Adapt the logic to core stack-switching. Returning from a stack
-  // should still return to the immediate parent, but suspension can target an
-  // arbitrary ancestor. We need to validate each link from the source to
-  // the target, and check that we are not skipping central stack frames.
-  if (target_stack->jmpbuf()->state == wasm::JumpBuffer::Suspended) {
-    target_stack->jmpbuf()->caller = source_stack->jmpbuf();
+  if (to->jmpbuf()->state == wasm::JumpBuffer::Suspended) {
+    to->jmpbuf()->parent = from;
   } else {
-    DCHECK_EQ(target_stack->jmpbuf()->state, wasm::JumpBuffer::Inactive);
-    SBXCHECK_EQ(source_stack->jmpbuf()->caller, target_stack->jmpbuf());
+    DCHECK_EQ(to->jmpbuf()->state, wasm::JumpBuffer::Inactive);
+    // TODO(388533754): This check won't hold anymore with core stack-switching.
+    // Instead, we will need to validate all the intermediate stacks and also
+    // check that they don't hold central stack frames.
+    DCHECK_EQ(from->jmpbuf()->parent, to);
   }
-#endif
-  uintptr_t limit =
-      reinterpret_cast<uintptr_t>(target_stack->jmpbuf()->stack_limit);
+  uintptr_t limit = reinterpret_cast<uintptr_t>(to->jmpbuf()->stack_limit);
   stack_guard()->SetStackLimitForStackSwitching(limit);
   // Update the central stack info.
-  if (target_stack->jmpbuf()->state == wasm::JumpBuffer::Inactive) {
+  if (to->jmpbuf()->state == wasm::JumpBuffer::Inactive) {
     // When returning/suspending from a stack, the parent must be on
     // the central stack.
     // TODO(388533754): This assumption will not hold anymore with core
     // stack-switching, so we will need to revisit this.
-    DCHECK(IsOnCentralStack(target_stack->jmpbuf()->sp));
+    DCHECK(IsOnCentralStack(to->jmpbuf()->sp));
     thread_local_top()->is_on_central_stack_flag_ = true;
-    thread_local_top()->central_stack_sp_ = target_stack->jmpbuf()->sp;
+    thread_local_top()->central_stack_sp_ = to->jmpbuf()->sp;
     thread_local_top()->central_stack_limit_ =
-        reinterpret_cast<Address>(target_stack->jmpbuf()->stack_limit);
+        reinterpret_cast<Address>(to->jmpbuf()->stack_limit);
   } else {
     // A suspended stack cannot hold central stack frames.
     thread_local_top()->is_on_central_stack_flag_ = false;
-    thread_local_top()->central_stack_sp_ = source_stack->jmpbuf()->sp;
+    thread_local_top()->central_stack_sp_ = from->jmpbuf()->sp;
     thread_local_top()->central_stack_limit_ =
-        reinterpret_cast<Address>(source_stack->jmpbuf()->stack_limit);
+        reinterpret_cast<Address>(from->jmpbuf()->stack_limit);
   }
 }
 
-void Isolate::RetireWasmStack(Tagged<WasmContinuationObject> continuation) {
-  wasm::StackMemory* stack =
-      reinterpret_cast<wasm::StackMemory*>(continuation->stack());
+void Isolate::RetireWasmStack(wasm::StackMemory* stack) {
   stack->jmpbuf()->state = wasm::JumpBuffer::Retired;
   size_t index = stack->index();
   // We can only return from a stack that was still in the global list.
@@ -3929,9 +3915,6 @@ void Isolate::RetireWasmStack(Tagged<WasmContinuationObject> continuation) {
   for (size_t i = 0; i < wasm_stacks().size(); ++i) {
     SLOW_DCHECK(wasm_stacks()[i]->index() == i);
   }
-#if V8_ENABLE_SANDBOX
-  continuation->set_stack(this, kNullAddress);
-#endif
   stack_pool().Add(std::move(stack_ptr));
 }
 
@@ -3973,7 +3956,8 @@ void Isolate::ThreadDataTable::RemoveAllThreads() {
 
 class TracingAccountingAllocator : public AccountingAllocator {
  public:
-  explicit TracingAccountingAllocator(Isolate* isolate) : isolate_(isolate) {}
+  explicit TracingAccountingAllocator(Isolate* isolate)
+      : AccountingAllocator(isolate) {}
   ~TracingAccountingAllocator() = default;
 
  protected:
@@ -4050,8 +4034,8 @@ class TracingAccountingAllocator : public AccountingAllocator {
   void Dump(std::ostringstream& out, bool dump_details) {
     // Note: Neither isolate nor zones are locked, so be careful with accesses
     // as the allocator is potentially used on a concurrent thread.
-    double time = isolate_->time_millis_since_init();
-    out << "{" << "\"isolate\": \"" << reinterpret_cast<void*>(isolate_)
+    double time = isolate()->time_millis_since_init();
+    out << "{" << "\"isolate\": \"" << reinterpret_cast<void*>(isolate())
         << "\", " << "\"time\": " << time << ", ";
     size_t total_segment_bytes_allocated = 0;
     size_t total_zone_allocation_size = 0;
@@ -4092,7 +4076,6 @@ class TracingAccountingAllocator : public AccountingAllocator {
         << "\"freed\": " << total_zone_freed_size << "}";
   }
 
-  Isolate* const isolate_;
   std::atomic<size_t> nesting_depth_{0};
 
   base::Mutex mutex_;
@@ -4567,6 +4550,11 @@ void Isolate::Deinit() {
   // updated anymore.
   DumpAndResetStats();
 
+  // Contains zones that should be released to the page pool before the heap is
+  // torn down.
+  delete ast_string_constants_;
+  ast_string_constants_ = nullptr;
+
   heap_.TearDown();
   isolate_group()->RemoveIsolate(this);
 
@@ -4597,9 +4585,6 @@ void Isolate::Deinit() {
   delete interpreter_;
   interpreter_ = nullptr;
 
-  delete ast_string_constants_;
-  ast_string_constants_ = nullptr;
-
   delete logger_;
   logger_ = nullptr;
 
@@ -5370,8 +5355,7 @@ void Isolate::VerifyStaticRoots() {
   RootIndex idx = RootIndex::kFirstReadOnlyRoot;
   for (Tagged_t cmp_ptr : StaticReadOnlyRootsPointerTable) {
     Address the_root = roots[idx];
-    Address ptr =
-        V8HeapCompressionScheme::DecompressTagged(cage_base(), cmp_ptr);
+    Address ptr = V8HeapCompressionScheme::DecompressTagged(cmp_ptr);
     CHECK_WITH_MSG(the_root == ptr, STATIC_ROOTS_FAILED_MSG);
     ++idx;
   }
@@ -5675,13 +5659,12 @@ bool Isolate::Init(SnapshotData* startup_snapshot_data,
     Address last = base + code_cage->size() - kTaggedSize;
     Address upper_bound = base + kPtrComprCageReservationSize - kTaggedSize;
     PtrComprCageBase code_cage_base{code_cage_base_};
-    CHECK_EQ(base, ComprScheme::DecompressTagged(
-                       code_cage_base, ComprScheme::CompressAny(base)));
-    CHECK_EQ(last, ComprScheme::DecompressTagged(
-                       code_cage_base, ComprScheme::CompressAny(last)));
-    CHECK_EQ(upper_bound,
-             ComprScheme::DecompressTagged(
-                 code_cage_base, ComprScheme::CompressAny(upper_bound)));
+    CHECK_EQ(base,
+             ComprScheme::DecompressTagged(ComprScheme::CompressAny(base)));
+    CHECK_EQ(last,
+             ComprScheme::DecompressTagged(ComprScheme::CompressAny(last)));
+    CHECK_EQ(upper_bound, ComprScheme::DecompressTagged(
+                              ComprScheme::CompressAny(upper_bound)));
   }
 #endif  // V8_EXTERNAL_CODE_SPACE
 
@@ -6262,7 +6245,7 @@ bool Isolate::IsInCreationContext(Tagged<JSObject> object, uint32_t index) {
   // Filter out native-context independent objects.
   if (metamap == ReadOnlyRoots(this).meta_map()) return false;
   Tagged<NativeContext> native_context = metamap->native_context();
-  return native_context->get(index) == object;
+  return native_context->GetNoCell(index) == object;
 }
 
 void Isolate::UpdateNoElementsProtectorOnSetElement(
@@ -6475,8 +6458,11 @@ void Isolate::FireCallCompletedCallbackInternal(
 
 #ifdef V8_ENABLE_WEBASSEMBLY
 void Isolate::WasmInitJSPIFeature() {
-  if (IsUndefined(root(RootIndex::kActiveContinuation))) {
+  if (v8_flags.wasm_jitless) return;
+
+  if (isolate_data_.active_stack() == nullptr) {
     wasm::StackMemory* stack(wasm::StackMemory::GetCentralStackView(this));
+    stack->jmpbuf()->state = wasm::JumpBuffer::Active;
     this->wasm_stacks().emplace_back(stack);
     stack->set_index(0);
     if (v8_flags.trace_wasm_stack_switching) {
@@ -6484,13 +6470,7 @@ void Isolate::WasmInitJSPIFeature() {
              stack->jslimit(), reinterpret_cast<void*>(stack->base()));
     }
     HandleScope scope(this);
-    DirectHandle<WasmContinuationObject> continuation =
-        WasmContinuationObject::New(this, stack, wasm::JumpBuffer::Active,
-                                    AllocationType::kOld);
-    heap()
-        ->roots_table()
-        .slot(RootIndex::kActiveContinuation)
-        .store(*continuation);
+    isolate_data_.set_active_stack(stack);
   }
 }
 #endif
@@ -6540,10 +6520,23 @@ MaybeDirectHandle<JSPromise> Isolate::RunHostImportModuleDynamicallyCallback(
     MaybeDirectHandle<Object> maybe_import_options_argument) {
   DCHECK(!is_execution_terminating());
   v8::Local<v8::Context> api_context = v8::Utils::ToLocal(native_context());
-  if (host_import_module_dynamically_callback_ == nullptr) {
-    DirectHandle<Object> exception =
-        factory()->NewError(error_function(), MessageTemplate::kUnsupported);
-    return NewRejectedPromise(this, api_context, exception);
+
+  switch (phase) {
+    case ModuleImportPhase::kEvaluation:
+      if (host_import_module_dynamically_callback_ == nullptr &&
+          host_import_module_with_phase_dynamically_callback_ == nullptr) {
+        DirectHandle<Object> exception = factory()->NewError(
+            error_function(), MessageTemplate::kUnsupported);
+        return NewRejectedPromise(this, api_context, exception);
+      }
+      break;
+    case ModuleImportPhase::kSource:
+      if (host_import_module_with_phase_dynamically_callback_ == nullptr) {
+        DirectHandle<Object> exception = factory()->NewError(
+            error_function(), MessageTemplate::kUnsupported);
+        return NewRejectedPromise(this, api_context, exception);
+      }
+      break;
   }
 
   DirectHandle<String> specifier_str;
@@ -6585,14 +6578,25 @@ MaybeDirectHandle<JSPromise> Isolate::RunHostImportModuleDynamicallyCallback(
     case ModuleImportPhase::kEvaluation:
       // TODO(42204365): Deprecate HostImportModuleDynamicallyCallback once
       // HostImportModuleWithPhaseDynamicallyCallback is stable.
-      API_ASSIGN_RETURN_ON_EXCEPTION_VALUE(
-          this, promise,
-          host_import_module_dynamically_callback_(
-              api_context, v8::Utils::ToLocal(host_defined_options),
-              v8::Utils::ToLocal(resource_name),
-              v8::Utils::ToLocal(specifier_str),
-              ToApiHandle<v8::FixedArray>(import_attributes_array)),
-          MaybeDirectHandle<JSPromise>());
+      if (host_import_module_with_phase_dynamically_callback_ != nullptr) {
+        API_ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+            this, promise,
+            host_import_module_with_phase_dynamically_callback_(
+                api_context, v8::Utils::ToLocal(host_defined_options),
+                v8::Utils::ToLocal(resource_name),
+                v8::Utils::ToLocal(specifier_str), phase,
+                ToApiHandle<v8::FixedArray>(import_attributes_array)),
+            MaybeDirectHandle<JSPromise>());
+      } else {
+        API_ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+            this, promise,
+            host_import_module_dynamically_callback_(
+                api_context, v8::Utils::ToLocal(host_defined_options),
+                v8::Utils::ToLocal(resource_name),
+                v8::Utils::ToLocal(specifier_str),
+                ToApiHandle<v8::FixedArray>(import_attributes_array)),
+            MaybeDirectHandle<JSPromise>());
+      }
       break;
     case ModuleImportPhase::kSource:
       CHECK(v8_flags.js_source_phase_imports);
@@ -7589,6 +7593,13 @@ Address Isolate::store_to_stack_count_address(const char* function_name) {
   return reinterpret_cast<Address>(&map[name].second);
 }
 
+void Isolate::LocalsBlockListCacheRehash() {
+  if (IsEphemeronHashTable(heap()->locals_block_list_cache())) {
+    Tagged<EphemeronHashTable> cache =
+        Cast<EphemeronHashTable>(heap()->locals_block_list_cache());
+    cache->Rehash(this);
+  }
+}
 void Isolate::LocalsBlockListCacheSet(
     DirectHandle<ScopeInfo> scope_info,
     DirectHandle<ScopeInfo> outer_scope_info,
diff --git a/deps/v8/src/execution/isolate.h b/deps/v8/src/execution/isolate.h
index deacb7501bd9fc..ee37c5c6b689f2 100644
--- a/deps/v8/src/execution/isolate.h
+++ b/deps/v8/src/execution/isolate.h
@@ -528,8 +528,6 @@ using DebugObjectCache = std::vector<Handle<HeapObject>>;
   V(WasmLoadSourceMapCallback, wasm_load_source_map_callback, nullptr)      \
   V(WasmImportedStringsEnabledCallback,                                     \
     wasm_imported_strings_enabled_callback, nullptr)                        \
-  V(JavaScriptCompileHintsMagicEnabledCallback,                             \
-    compile_hints_magic_enabled_callback, nullptr)                          \
   V(WasmJSPIEnabledCallback, wasm_jspi_enabled_callback, nullptr)           \
   V(IsJSApiWrapperNativeErrorCallback,                                      \
     is_js_api_wrapper_native_error_callback, nullptr)                       \
@@ -2338,17 +2336,15 @@ class V8_EXPORT_PRIVATE Isolate final : private HiddenFactory {
     return wasm_stacks_;
   }
 
-  // Sets the new stack limit, updates the central stack info and checks the
-  // validity of the switch.
-  void SwitchStacks(Tagged<WasmContinuationObject> source_continuation,
-                    Tagged<WasmContinuationObject> target_continuation);
+  // Updates the stack limit, parent pointer and central stack info.
+  void SwitchStacks(wasm::StackMemory* from, wasm::StackMemory* to);
 
   // Retires the stack owned by {continuation}, to be called when returning or
   // throwing from this continuation.
   // This updates the {StackMemory} state, removes it from the global
   // {wasm_stacks_} vector and nulls the EPT entry. This does not update the
   // {ActiveContinuation} root or the stack limit.
-  void RetireWasmStack(Tagged<WasmContinuationObject> continuation);
+  void RetireWasmStack(wasm::StackMemory* stack);
 #else
   bool IsOnCentralStack() { return true; }
 #endif
@@ -2357,6 +2353,7 @@ class V8_EXPORT_PRIVATE Isolate final : private HiddenFactory {
   // allocated variables per ScopeInfo for debug-evaluate.
   // We also store a strong reference to the outer ScopeInfo to keep all
   // blocklists along a scope chain alive.
+  void LocalsBlockListCacheRehash();
   void LocalsBlockListCacheSet(DirectHandle<ScopeInfo> scope_info,
                                DirectHandle<ScopeInfo> outer_scope_info,
                                DirectHandle<StringSet> locals_blocklist);
diff --git a/deps/v8/src/execution/loong64/simulator-loong64.h b/deps/v8/src/execution/loong64/simulator-loong64.h
index 2adb4ea973779d..1197d559493128 100644
--- a/deps/v8/src/execution/loong64/simulator-loong64.h
+++ b/deps/v8/src/execution/loong64/simulator-loong64.h
@@ -300,8 +300,16 @@ class Simulator : public SimulatorBase {
     }
 
     explicit CallArgument(float argument) {
-      // TODO(all): CallArgument(float) is untested.
-      UNIMPLEMENTED();
+      // Make the FPU register a NaN to try to trap errors if the callee expects
+      // a double. If it expects a float, the callee should ignore the top word.
+      double sNaN = std::numeric_limits<double>::signaling_NaN();
+      DCHECK(sizeof(sNaN) == sizeof(bits_));
+      memcpy(&bits_, &sNaN, sizeof(sNaN));
+
+      // Write the float payload to the FPU register.
+      DCHECK(sizeof(argument) <= sizeof(bits_));
+      memcpy(&bits_, &argument, sizeof(argument));
+      type_ = FP_ARG;
     }
 
     // This indicates the end of the arguments list, so that CallArgument
diff --git a/deps/v8/src/execution/messages.cc b/deps/v8/src/execution/messages.cc
index de64c5d75e0192..507ee906057ab1 100644
--- a/deps/v8/src/execution/messages.cc
+++ b/deps/v8/src/execution/messages.cc
@@ -168,8 +168,9 @@ void MessageHandler::ReportMessageNoExceptions(
       if (!(message_levels & error_level)) {
         continue;
       }
-      v8::MessageCallback callback = FUNCTION_CAST<v8::MessageCallback>(
-          callback_obj->foreign_address<kMessageListenerTag>());
+      v8::MessageCallback callback =
+          v8::ToCData<v8::MessageCallback, kMessageListenerTag>(isolate,
+                                                                callback_obj);
       DirectHandle<Object> callback_data(listener->get(1), isolate);
       {
         RCS_SCOPE(isolate, RuntimeCallCounterId::kMessageListenerCallback);
diff --git a/deps/v8/src/execution/mips64/simulator-mips64.h b/deps/v8/src/execution/mips64/simulator-mips64.h
index ec371a2dd780a6..e93afda1e9c7e3 100644
--- a/deps/v8/src/execution/mips64/simulator-mips64.h
+++ b/deps/v8/src/execution/mips64/simulator-mips64.h
@@ -329,8 +329,16 @@ class Simulator : public SimulatorBase {
     }
 
     explicit CallArgument(float argument) {
-      // TODO(all): CallArgument(float) is untested.
-      UNIMPLEMENTED();
+      // Make the FPU register a NaN to try to trap errors if the callee expects
+      // a double. If it expects a float, the callee should ignore the top word.
+      double sNaN = std::numeric_limits<double>::signaling_NaN();
+      DCHECK(sizeof(sNaN) == sizeof(bits_));
+      memcpy(&bits_, &sNaN, sizeof(sNaN));
+
+      // Write the float payload to the FPU register.
+      DCHECK(sizeof(argument) <= sizeof(bits_));
+      memcpy(&bits_, &argument, sizeof(argument));
+      type_ = FP_ARG;
     }
 
     // This indicates the end of the arguments list, so that CallArgument
diff --git a/deps/v8/src/execution/riscv/simulator-riscv.cc b/deps/v8/src/execution/riscv/simulator-riscv.cc
index 4df2c1e4c5eacc..b130ff684a90e1 100644
--- a/deps/v8/src/execution/riscv/simulator-riscv.cc
+++ b/deps/v8/src/execution/riscv/simulator-riscv.cc
@@ -8377,7 +8377,12 @@ void Simulator::CallImpl(Address entry, CallArgument* args) {
               << " a2 (func/target) = 0x" << get_register(a2)
               << " a3 (receiver) = 0x" << get_register(a3) << " a4 (argc) = 0x"
               << get_register(a4) << " a5 (argv) = 0x" << get_register(a5)
-              << std::endl;
+              << " fa0 = 0x" << get_fpu_register(fa0) << " fa1 = 0x"
+              << get_fpu_register(fa1) << " fa2 = 0x" << get_fpu_register(fa2)
+              << " fa3 = 0x" << get_fpu_register(fa3) << " fa4 = 0x"
+              << get_fpu_register(fa4) << " fa5 = 0x" << get_fpu_register(fa5)
+              << " fa6 = 0x" << get_fpu_register(fa6) << " fa7 = 0x"
+              << get_fpu_register(fa7) << std::endl;
   }
   // Remaining arguments passed on stack.
   int64_t original_stack = get_register(sp);
diff --git a/deps/v8/src/execution/riscv/simulator-riscv.h b/deps/v8/src/execution/riscv/simulator-riscv.h
index 0ec51ff3db967c..b37411049a4d32 100644
--- a/deps/v8/src/execution/riscv/simulator-riscv.h
+++ b/deps/v8/src/execution/riscv/simulator-riscv.h
@@ -538,6 +538,7 @@ class Simulator : public SimulatorBase {
   // Return central stack view, without additional safety margins.
   // Users, for example wasm::StackMemory, can add their own.
   base::Vector<uint8_t> GetCentralStackView() const;
+  static constexpr int JSStackLimitMargin() { return kAdditionalStackMargin; }
 
   void IterateRegistersAndStack(::heap::base::StackVisitor* visitor);
 
@@ -563,8 +564,9 @@ class Simulator : public SimulatorBase {
       type_ = FP_ARG;
     }
     explicit CallArgument(float argument) {
-      // TODO(all): CallArgument(float) is untested.
-      UNIMPLEMENTED();
+      auto arg = box_float(argument);
+      memcpy(&bits_, &arg, sizeof(arg));
+      type_ = FP_ARG;
     }
     // This indicates the end of the arguments list, so that CallArgument
     // objects can be passed into varargs functions.
diff --git a/deps/v8/src/extensions/externalize-string-extension.cc b/deps/v8/src/extensions/externalize-string-extension.cc
index 83fbe4045cd455..314cfb23f86116 100644
--- a/deps/v8/src/extensions/externalize-string-extension.cc
+++ b/deps/v8/src/extensions/externalize-string-extension.cc
@@ -121,18 +121,19 @@ void ExternalizeStringExtension::Externalize(
     }
     return;
   }
+  uint32_t length = string->length();
   if (externalize_as_one_byte) {
-    uint8_t* data = new uint8_t[string->length()];
-    String::WriteToFlat(*string, data, 0, string->length());
-    SimpleOneByteStringResource* resource = new SimpleOneByteStringResource(
-        reinterpret_cast<char*>(data), string->length());
+    uint8_t* data = new uint8_t[length];
+    String::WriteToFlat(*string, data, 0, length);
+    SimpleOneByteStringResource* resource =
+        new SimpleOneByteStringResource(reinterpret_cast<char*>(data), length);
     result = Utils::ToLocal(string)->MakeExternal(info.GetIsolate(), resource);
     if (!result) delete resource;
   } else {
-    base::uc16* data = new base::uc16[string->length()];
-    String::WriteToFlat(*string, data, 0, string->length());
-    SimpleTwoByteStringResource* resource = new SimpleTwoByteStringResource(
-        data, string->length());
+    base::uc16* data = new base::uc16[length];
+    String::WriteToFlat(*string, data, 0, length);
+    SimpleTwoByteStringResource* resource =
+        new SimpleTwoByteStringResource(data, length);
     result = Utils::ToLocal(string)->MakeExternal(info.GetIsolate(), resource);
     if (!result) delete resource;
   }
diff --git a/deps/v8/src/flags/flag-definitions.h b/deps/v8/src/flags/flag-definitions.h
index 68affded4e1342..4a314d5d48dd53 100644
--- a/deps/v8/src/flags/flag-definitions.h
+++ b/deps/v8/src/flags/flag-definitions.h
@@ -460,14 +460,14 @@ DEFINE_BOOL_READONLY(
     single_generation, V8_SINGLE_GENERATION_BOOL,
     "allocate all objects from young generation to old generation")
 
-#ifdef V8_ENABLE_CONSERVATIVE_STACK_SCANNING
-#define V8_ENABLE_CONSERVATIVE_STACK_SCANNING_BOOL true
-#else
-#define V8_ENABLE_CONSERVATIVE_STACK_SCANNING_BOOL false
-#endif
-DEFINE_BOOL_READONLY(conservative_stack_scanning,
-                     V8_ENABLE_CONSERVATIVE_STACK_SCANNING_BOOL,
+#ifdef V8_ENABLE_DIRECT_HANDLE
+// Direct handles require conservative stack scanning.
+DEFINE_BOOL_READONLY(conservative_stack_scanning, true,
                      "use conservative stack scanning")
+#else
+DEFINE_EXPERIMENTAL_FEATURE(conservative_stack_scanning,
+                            "use conservative stack scanning")
+#endif  // V8_ENABLE_DIRECT_HANDLE
 DEFINE_IMPLICATION(conservative_stack_scanning,
                    scavenger_conservative_object_pinning)
 DEFINE_NEG_IMPLICATION(conservative_stack_scanning, compact_with_stack)
@@ -483,11 +483,10 @@ DEFINE_BOOL_READONLY(direct_handle, V8_ENABLE_DIRECT_HANDLE_BOOL,
 // break the correctness of the GC.
 DEFINE_NEG_NEG_IMPLICATION(conservative_stack_scanning, direct_handle)
 
-DEFINE_EXPERIMENTAL_FEATURE(scavenger_conservative_object_pinning,
-                            "Objects reachable from the native stack during "
-                            "scavenge will be pinned and "
-                            "won't move.")
-DEFINE_IMPLICATION(scavenger_conservative_object_pinning, separate_gc_phases)
+DEFINE_BOOL(scavenger_conservative_object_pinning, false,
+            "Objects reachable from the native stack during "
+            "scavenge will be pinned and "
+            "won't move.")
 DEFINE_BOOL(
     stress_scavenger_conservative_object_pinning, false,
     "Treat some precise references as conservative references to stress "
@@ -508,7 +507,6 @@ DEFINE_IMPLICATION(stress_scavenger_conservative_object_pinning_random,
 DEFINE_BOOL(scavenger_precise_object_pinning, false,
             "Objects reachable from handles during scavenge "
             "will be pinned and won't move.")
-DEFINE_IMPLICATION(scavenger_precise_object_pinning, separate_gc_phases)
 
 DEFINE_BOOL(
     precise_object_pinning, false,
@@ -721,6 +719,9 @@ DEFINE_WEAK_IMPLICATION(future, flush_baseline_code)
 DEFINE_BOOL(additive_safe_int_feedback, false,
             "Enable the use of AdditiveSafeInteger feedback")
 DEFINE_WEAK_IMPLICATION(future, additive_safe_int_feedback)
+// Additive safe ints are only used by TurboFan.
+DEFINE_NEG_IMPLICATION(jitless, additive_safe_int_feedback)
+DEFINE_NEG_IMPLICATION(disable_optimizing_compilers, additive_safe_int_feedback)
 #else
 DEFINE_BOOL_READONLY(additive_safe_int_feedback, false,
                      "Enable the use of AdditiveSafeInteger feedback")
@@ -734,22 +735,9 @@ DEFINE_BOOL_READONLY(dict_property_const_tracking,
                      V8_DICT_PROPERTY_CONST_TRACKING_BOOL,
                      "Use const tracking on dictionary properties")
 
-DEFINE_BOOL(const_tracking_let, true,
-            "Use const tracking on top-level `let` variables")
-
-DEFINE_BOOL(script_context_mutable_heap_number, true,
-            "Use mutable heap numbers in script contexts")
-
-#if defined(V8_31BIT_SMIS_ON_64BIT_ARCH) || defined(V8_TARGET_ARCH_32_BIT)
-#define SUPPORT_SCRIPT_CONTEXT_MUTABLE_HEAP_INT32
-DEFINE_BOOL(script_context_mutable_heap_int32, true,
-            "Use mutable heap int32 number in script contexts")
-DEFINE_WEAK_IMPLICATION(script_context_mutable_heap_int32,
-                        script_context_mutable_heap_number)
-#else
-DEFINE_BOOL_READONLY(script_context_mutable_heap_int32, false,
-                     "Use mutable heap int32 number in script contexts")
-#endif
+DEFINE_BOOL(script_context_cells, true,
+            "Use context cells in script contexts, ie, const tracking let and "
+            "mutable numbers")
 
 DEFINE_BOOL(empty_context_extension_dep, true,
             "Use compilation dependency to avoid dynamic checks for "
@@ -758,6 +746,10 @@ DEFINE_BOOL(empty_context_extension_dep, true,
 DEFINE_BOOL(json_stringify_fast_path, false, "Enable JSON.stringify fast-path")
 DEFINE_WEAK_IMPLICATION(future, json_stringify_fast_path)
 
+DEFINE_BOOL(cache_property_key_string_adds, false,
+            "Enable caching property keys created by concatenating strings")
+DEFINE_WEAK_IMPLICATION(future, cache_property_key_string_adds)
+
 #ifdef V8_ENABLE_EXTENSIBLE_RO_SNAPSHOT
 DEFINE_BOOL(extensible_ro_snapshot, true,
             "Whether custom embedder snapshots may extend ReadOnlySpace")
@@ -827,7 +819,7 @@ DEFINE_BOOL(jitless, V8_LITE_MODE_BOOL,
 // Jitless V8 has a few implications:
 // Field type tracking is only used by TurboFan.
 DEFINE_NEG_IMPLICATION(jitless, track_field_types)
-DEFINE_NEG_IMPLICATION(jitless, script_context_mutable_heap_number)
+DEFINE_NEG_IMPLICATION(jitless, script_context_cells)
 // No code generation at runtime.
 DEFINE_IMPLICATION(jitless, regexp_interpret_all)
 DEFINE_NEG_IMPLICATION(jitless, turbofan)
@@ -859,8 +851,7 @@ DEFINE_NEG_IMPLICATION(disable_optimizing_compilers, validate_asm)
 #endif  // V8_ENABLE_WEBASSEMBLY
 // Field type tracking is only used by TurboFan, so can be disabled.
 DEFINE_NEG_IMPLICATION(disable_optimizing_compilers, track_field_types)
-DEFINE_NEG_IMPLICATION(disable_optimizing_compilers,
-                       script_context_mutable_heap_number)
+DEFINE_NEG_IMPLICATION(disable_optimizing_compilers, script_context_cells)
 
 DEFINE_BOOL(memory_protection_keys, true,
             "protect code memory with PKU if available")
@@ -932,6 +923,7 @@ DEFINE_BOOL(trace_pretenuring, false,
             "trace pretenuring decisions of HAllocate instructions")
 DEFINE_BOOL(trace_pretenuring_statistics, false,
             "trace allocation site pretenuring statistics")
+DEFINE_BOOL(trace_resize_large_object, false, "trace resizing of large objects")
 DEFINE_BOOL(track_field_types, true, "track field types")
 DEFINE_BOOL(trace_block_coverage, false,
             "trace collected block coverage information")
@@ -1581,7 +1573,7 @@ DEFINE_BOOL(
 DEFINE_WEAK_IMPLICATION(future, typed_array_length_loading)
 
 #if V8_ENABLE_WEBASSEMBLY
-DEFINE_NEG_IMPLICATION(experimental_wasm_shared, liftoff)
+DEFINE_IMPLICATION(experimental_wasm_shared, shared_heap)
 #endif
 
 #ifdef DEBUG
@@ -1782,14 +1774,21 @@ DEFINE_EXPERIMENTAL_FEATURE(
     "Enable direct calls from wasm to fast API functions with bound "
     "call function to pass the the receiver as first parameter")
 
-DEFINE_BOOL(wasm_deopt, false, "enable deopts in optimized wasm functions")
-DEFINE_WEAK_IMPLICATION(future, wasm_deopt)
+#if V8_TARGET_ARCH_RISCV32 || V8_TARGET_ARCH_RISCV64 || \
+    V8_TARGET_ARCH_PPC64 || V8_TARGET_ARCH_S390X ||     \
+    (V8_TARGET_ARCH_MIPS64 && V8_TARGET_BIG_ENDIAN)
+DEFINE_EXPERIMENTAL_FEATURE(wasm_deopt,
+                            "enable deopts in optimized wasm functions")
+#else
+DEFINE_BOOL(wasm_deopt, true, "enable deopts in optimized wasm functions")
+#endif
+
 // Deopt only works in combination with feedback.
 DEFINE_NEG_NEG_IMPLICATION(liftoff, wasm_deopt)
 
 // Note that this limit doesn't guarantee an upper bound, as e.g. with multiple
 // frames of the same function on the stack, many more deopts can happen.
-DEFINE_SIZE_T(wasm_deopts_per_function_limit, 50,
+DEFINE_SIZE_T(wasm_deopts_per_function_limit, 10,
               "limit of wasm deopts for a single function after which no "
               "further deopt points are emitted in Turbofan")
 
@@ -1831,6 +1830,14 @@ DEFINE_EXPERIMENTAL_FEATURE(
 DEFINE_EXPERIMENTAL_FEATURE(experimental_wasm_skip_bounds_checks,
                             "skip array bounds checks (unsafe)")
 
+// Experimental variants of the Custom Descriptors prototype implementation.
+DEFINE_BOOL(wasm_explicit_prototypes, true,
+            "enable support for JS Prototypes as first field on Descriptor "
+            "structs (only with --experimental-wasm-custom-descriptors)")
+DEFINE_BOOL(wasm_implicit_prototypes, true,
+            "enable support for engine-created 'invisible' JS Prototypes "
+            "(only with --experimental-wasm-custom-descriptors)")
+
 DEFINE_BOOL(wasm_staging, false, "enable staged wasm features")
 
 #define WASM_STAGING_IMPLICATION(feat, desc, val) \
@@ -1851,7 +1858,7 @@ DEFINE_NEG_NEG_IMPLICATION(wasm_bounds_checks, wasm_enforce_bounds_checks)
 DEFINE_BOOL(wasm_math_intrinsics, true,
             "intrinsify some Math imports into wasm")
 
-DEFINE_BOOL(wasm_inlining_call_indirect, false,
+DEFINE_BOOL(wasm_inlining_call_indirect, true,
             "enable speculative inlining of Wasm indirect calls")
 DEFINE_WEAK_IMPLICATION(future, wasm_inlining_call_indirect)
 // This doesn't make sense without and requires  the basic inlining machinery,
@@ -2041,6 +2048,13 @@ DEFINE_BOOL_READONLY(wasm_jitless, false,
 DEFINE_BOOL(wasm_jitless_if_available_for_testing, false, "")
 #endif  // V8_ENABLE_DRUMBRAKE
 
+DEFINE_BOOL(wasm_allow_mixed_eh_for_testing, false,
+            "Allow mixed legacy and new exception handling instructions in the "
+            "same wasm module")
+// %WasmGenerateRandomModule() can generate modules with a mix of old and new EH
+// instructions, and crashes if the module does not compile.
+// So always allow mixing old and new EH for fuzzing.
+DEFINE_IMPLICATION(fuzzing, wasm_allow_mixed_eh_for_testing)
 #endif  // V8_ENABLE_WEBASSEMBLY
 
 DEFINE_INT(stress_sampling_allocation_profiler, 0,
@@ -2066,8 +2080,6 @@ DEFINE_SIZE_T(
     "All three flags cannot be specified at the same time.")
 DEFINE_SIZE_T(initial_heap_size, 0, "initial size of the heap (in Mbytes)")
 DEFINE_SIZE_T(initial_old_space_size, 0, "initial old space size (in Mbytes)")
-DEFINE_BOOL(separate_gc_phases, true,
-            "young and full garbage collection phases are not overlapping")
 DEFINE_BOOL(gc_global, false, "always perform global GCs")
 
 // TODO(12950): The next three flags only have an effect if
@@ -2272,13 +2284,13 @@ DEFINE_NEG_NEG_IMPLICATION(compact_with_stack, compact_code_space_with_stack)
 DEFINE_BOOL(shortcut_strings_with_stack, true,
             "Shortcut Strings during GC with stack")
 DEFINE_BOOL(stress_compaction, false,
-            "Stress GC compaction to flush out bugs (implies "
-            "--force_marking_deque_overflows)")
+            "Stress GC compaction to flush out bugs with moving objects")
+DEFINE_BOOL(resize_large_object, true, "Support resizing of large objects")
 DEFINE_BOOL(stress_compaction_random, false,
             "Stress GC compaction by selecting random percent of pages as "
             "evacuation candidates. Overrides stress_compaction.")
-DEFINE_IMPLICATION(stress_compaction, force_marking_deque_overflows)
 DEFINE_IMPLICATION(stress_compaction, gc_global)
+DEFINE_NEG_IMPLICATION(stress_compaction, resize_large_object)
 DEFINE_VALUE_IMPLICATION(stress_compaction, max_semi_space_size, (size_t)1)
 DEFINE_BOOL(flush_baseline_code, false,
             "flush of baseline code when it has not been executed recently")
@@ -2297,12 +2309,12 @@ DEFINE_BOOL(use_marking_progress_bar, true,
             "incremental marking is active.")
 DEFINE_BOOL(stress_per_context_marking_worklist, false,
             "Use per-context worklist for marking")
-DEFINE_BOOL(force_marking_deque_overflows, false,
-            "force overflows of marking deque by reducing it's size "
-            "to 64 words")
 DEFINE_BOOL(stress_incremental_marking, false,
             "force incremental marking for small heaps and run it more often")
 
+DEFINE_BOOL(managed_zone_memory, false,
+            "Manage zone memory in V8 instead of using malloc().")
+
 DEFINE_BOOL(fuzzer_gc_analysis, false,
             "prints number of allocations and enables analysis mode for gc "
             "fuzz testing, e.g. --stress-marking, --stress-scavenge")
@@ -2319,6 +2331,9 @@ DEFINE_BOOL(
     "reclaim otherwise unreachable unmodified wrapper objects when possible")
 DEFINE_BOOL(parallel_reclaim_unmodified_wrappers, true,
             "reclaim wrapper objects in parallel")
+DEFINE_BOOL(discard_memory_pool_before_memory_pressure_gcs, false,
+            "discard the memory pool before invoking the GC on memory pressure "
+            "or last resort GCs")
 
 // These flags will be removed after experiments. Do not rely on them.
 DEFINE_BOOL(gc_experiment_less_compaction, false,
@@ -3042,7 +3057,6 @@ DEFINE_NEG_NEG_IMPLICATION(text_is_readable, partial_constant_pool)
 DEFINE_BOOL(trace_minor_ms_parallel_marking, false,
             "trace parallel marking for the young generation")
 DEFINE_BOOL(minor_ms, false, "perform young generation mark sweep GCs")
-DEFINE_IMPLICATION(minor_ms, separate_gc_phases)
 DEFINE_IMPLICATION(minor_ms, page_promotion)
 
 DEFINE_BOOL(concurrent_minor_ms_marking, true,
@@ -3262,7 +3276,7 @@ DEFINE_IMPLICATION(prof, log_code)
 
 DEFINE_BOOL(ll_prof, false, "Enable low-level linux profiler.")
 
-#if V8_OS_LINUX
+#if V8_OS_LINUX || V8_OS_DARWIN
 #define DEFINE_PERF_PROF_BOOL(nam, cmt) DEFINE_BOOL(nam, false, cmt)
 #define DEFINE_PERF_PROF_IMPLICATION DEFINE_IMPLICATION
 #else
@@ -3279,7 +3293,7 @@ DEFINE_BOOL(ll_prof, false, "Enable low-level linux profiler.")
 #endif
 
 DEFINE_PERF_PROF_BOOL(perf_basic_prof,
-                      "Enable perf linux profiler (basic support).")
+                      "Enable basic support for perf profiler.")
 DEFINE_NEG_IMPLICATION(perf_basic_prof, compact_code_space)
 DEFINE_STRING(perf_basic_prof_path, DEFAULT_PERF_BASIC_PROF_PATH,
               "directory to write perf-<pid>.map symbol file to")
@@ -3288,8 +3302,8 @@ DEFINE_PERF_PROF_BOOL(
     "Only report function code ranges to perf (i.e. no stubs).")
 DEFINE_PERF_PROF_IMPLICATION(perf_basic_prof_only_functions, perf_basic_prof)
 
-DEFINE_PERF_PROF_BOOL(
-    perf_prof, "Enable perf linux profiler (experimental annotate support).")
+DEFINE_PERF_PROF_BOOL(perf_prof,
+                      "Enable experimental annotate support for perf profiler.")
 DEFINE_STRING(perf_prof_path, DEFAULT_PERF_PROF_PATH,
               "directory to write jit-<pid>.dump symbol file to")
 DEFINE_PERF_PROF_BOOL(
@@ -3475,11 +3489,6 @@ DEFINE_BOOL(parallel_pause_for_gc_in_background, true,
 DEFINE_BOOL(incremental_marking_for_gc_in_background, true,
             "Use parallel threads in the atomic pause for background GCs")
 
-DEFINE_BOOL(update_allocation_limits_after_loading, true,
-            "force recomputation of allocation limites when leaving the "
-            "loading RAIL mode (either on a RAIL mode change or incremental "
-            "marking start).")
-
 DEFINE_EXPERIMENTAL_FEATURE(shared_heap,
                             "Enables a shared heap between isolates.")
 
diff --git a/deps/v8/src/handles/handles.h b/deps/v8/src/handles/handles.h
index db59692820ef48..e21ce32ef455d7 100644
--- a/deps/v8/src/handles/handles.h
+++ b/deps/v8/src/handles/handles.h
@@ -394,7 +394,7 @@ static constexpr bool is_direct_handle_v = is_direct_handle<T>::value;
 
 // Direct handles should not be used without conservative stack scanning,
 // as this would break the correctness of the GC.
-static_assert(V8_ENABLE_CONSERVATIVE_STACK_SCANNING_BOOL);
+static_assert(v8_flags.conservative_stack_scanning.value());
 
 // ----------------------------------------------------------------------------
 // Base class for DirectHandle instantiations. Don't use directly.
diff --git a/deps/v8/src/handles/persistent-handles.cc b/deps/v8/src/handles/persistent-handles.cc
index 05b3da38f0db28..1a142038a75b0b 100644
--- a/deps/v8/src/handles/persistent-handles.cc
+++ b/deps/v8/src/handles/persistent-handles.cc
@@ -124,7 +124,6 @@ void PersistentHandlesList::Remove(PersistentHandles* persistent_handles) {
 
 void PersistentHandlesList::Iterate(RootVisitor* visitor, Isolate* isolate) {
   isolate->heap()->safepoint()->AssertActive();
-  base::MutexGuard guard(&persistent_handles_mutex_);
   for (PersistentHandles* current = persistent_handles_head_; current;
        current = current->next_) {
     current->Iterate(visitor);
diff --git a/deps/v8/src/handles/traced-handles.cc b/deps/v8/src/handles/traced-handles.cc
index 54d65fc51fb490..6fa44e814b48b5 100644
--- a/deps/v8/src/handles/traced-handles.cc
+++ b/deps/v8/src/handles/traced-handles.cc
@@ -179,9 +179,7 @@ void TracedHandles::Destroy(TracedNodeBlock& node_block, TracedNode& node) {
   }
 
   if (is_marking_) {
-    // Incremental/concurrent marking is running. This also covers the scavenge
-    // case which prohibits eagerly reclaiming nodes when marking is on during a
-    // scavenge.
+    // Incremental/concurrent marking is running.
     //
     // On-heap traced nodes are released in the atomic pause in
     // `ResetDeadNodes()` when they are discovered as not marked. Eagerly clear
@@ -371,18 +369,13 @@ void TracedHandles::ResetYoungDeadNodes(
 }
 
 bool TracedHandles::SupportsClearingWeakNonLiveWrappers() {
+  DCHECK(!is_marking_);
   if (!v8_flags.reclaim_unmodified_wrappers) {
     return false;
   }
   if (!isolate_->heap()->GetEmbedderRootsHandler()) {
     return false;
   }
-  // Treat all objects as roots during incremental marking to avoid corrupting
-  // marking worklists.
-  DCHECK_IMPLIES(v8_flags.minor_ms, !is_marking_);
-  if (is_marking_) {
-    return false;
-  }
   return true;
 }
 
@@ -709,6 +702,7 @@ void TracedHandles::IterateYoung(RootVisitor* visitor) {
 }
 
 void TracedHandles::IterateYoungRoots(RootVisitor* visitor) {
+  DCHECK(!is_marking_);
   for (auto* block : young_blocks_) {
     DCHECK(block->InYoungList());
 
@@ -716,8 +710,6 @@ void TracedHandles::IterateYoungRoots(RootVisitor* visitor) {
       if (!node->is_in_young_list()) continue;
       DCHECK(node->is_in_use());
 
-      CHECK_IMPLIES(is_marking_, !node->is_weak());
-
       if (node->is_weak()) continue;
 
       visitor->VisitRootPointer(Root::kTracedHandles, nullptr,
@@ -727,14 +719,13 @@ void TracedHandles::IterateYoungRoots(RootVisitor* visitor) {
 }
 
 void TracedHandles::IterateAndMarkYoungRootsWithOldHosts(RootVisitor* visitor) {
+  DCHECK(!is_marking_);
   for (auto* block : young_blocks_) {
     for (auto* node : *block) {
       if (!node->is_in_young_list()) continue;
       DCHECK(node->is_in_use());
       if (!node->has_old_host()) continue;
 
-      CHECK_IMPLIES(is_marking_, !node->is_weak());
-
       if (node->is_weak()) continue;
 
       node->set_markbit();
@@ -747,14 +738,13 @@ void TracedHandles::IterateAndMarkYoungRootsWithOldHosts(RootVisitor* visitor) {
 
 void TracedHandles::IterateYoungRootsWithOldHostsForTesting(
     RootVisitor* visitor) {
+  DCHECK(!is_marking_);
   for (auto* block : young_blocks_) {
     for (auto* node : *block) {
       if (!node->is_in_young_list()) continue;
       DCHECK(node->is_in_use());
       if (!node->has_old_host()) continue;
 
-      CHECK_IMPLIES(is_marking_, !node->is_weak());
-
       if (node->is_weak()) continue;
 
       visitor->VisitRootPointer(Root::kTracedHandles, nullptr,
diff --git a/deps/v8/src/heap/base/incremental-marking-schedule.cc b/deps/v8/src/heap/base/incremental-marking-schedule.cc
index aabe7ffbfdefe6..1f34edab93ba0a 100644
--- a/deps/v8/src/heap/base/incremental-marking-schedule.cc
+++ b/deps/v8/src/heap/base/incremental-marking-schedule.cc
@@ -64,12 +64,6 @@ void IncrementalMarkingSchedule::AddMutatorThreadMarkedBytes(
   mutator_thread_marked_bytes_ += marked_bytes;
 }
 
-void IncrementalMarkingSchedule::RemoveMutatorThreadMarkedBytes(
-    size_t marked_bytes) {
-  DCHECK_GE(mutator_thread_marked_bytes_, marked_bytes);
-  mutator_thread_marked_bytes_ -= marked_bytes;
-}
-
 void IncrementalMarkingSchedule::AddConcurrentlyMarkedBytes(
     size_t marked_bytes) {
   concurrently_marked_bytes_.fetch_add(marked_bytes, std::memory_order_relaxed);
diff --git a/deps/v8/src/heap/base/incremental-marking-schedule.h b/deps/v8/src/heap/base/incremental-marking-schedule.h
index 5f37507fd66929..f4eee8d9b1f1a6 100644
--- a/deps/v8/src/heap/base/incremental-marking-schedule.h
+++ b/deps/v8/src/heap/base/incremental-marking-schedule.h
@@ -77,7 +77,6 @@ class V8_EXPORT_PRIVATE IncrementalMarkingSchedule final {
   // thread owning the schedule. The schedule supports marked bytes being
   // adjusted downwards, i.e., going backwards in the schedule.
   void AddMutatorThreadMarkedBytes(size_t);
-  void RemoveMutatorThreadMarkedBytes(size_t);
 
   // Adds concurrently marked bytes. May be called from any thread. Not required
   // to be complete, i.e., it is okay to not report bytes already marked for the
diff --git a/deps/v8/src/heap/code-range.cc b/deps/v8/src/heap/code-range.cc
index 81093487822d72..f46af5ff0ea5b7 100644
--- a/deps/v8/src/heap/code-range.cc
+++ b/deps/v8/src/heap/code-range.cc
@@ -103,10 +103,19 @@ bool CodeRange::InitReservation(v8::PageAllocator* page_allocator,
     params.page_freeing_mode = base::PageFreeingMode::kDiscard;
   }
 
-#if defined(V8_TARGET_OS_IOS)
+#if defined(V8_TARGET_OS_IOS) || defined(V8_TARGET_OS_CHROMEOS)
+  // iOS:
   // We only get one shot at doing MAP_JIT on iOS. So we need to make it
   // the least restrictive so it succeeds otherwise we will terminate the
   // process on the failed allocation.
+  // ChromeOS:
+  // Chrome on ChromeOS uses libgcc unwinding library which seems to work an
+  // order of magnitude slower if we allocate CodeRange closer to the binary.
+  // In non-official builds Chrome collects a lot of stack traces just in case,
+  // so the slowdown of a single backtrace() call results in a noticeable
+  // increase of test times. As a workaround, do a one shot allocation without
+  // providing a hint.
+  // TODO(https://crbug.com/40096218): investigate this ChromeOS issue.
   params.requested_start_hint = kNullAddress;
   if (!VirtualMemoryCage::InitReservation(params)) return false;
 #else
@@ -178,7 +187,7 @@ bool CodeRange::InitReservation(v8::PageAllocator* page_allocator,
     // We didn't manage to allocate the code range close enough.
     FATAL("Failed to allocate code range close to the .text section");
   }
-#endif  // defined(V8_TARGET_OS_IOS)
+#endif  // defined(V8_TARGET_OS_IOS) || defined(V8_TARGET_OS_CHROMEOS)
 
   // On some platforms, specifically Win64, we need to reserve some pages at
   // the beginning of an executable space. See
diff --git a/deps/v8/src/heap/concurrent-marking.cc b/deps/v8/src/heap/concurrent-marking.cc
index 0a50da1202ccf6..53adcf023f0196 100644
--- a/deps/v8/src/heap/concurrent-marking.cc
+++ b/deps/v8/src/heap/concurrent-marking.cc
@@ -863,14 +863,6 @@ void ConcurrentMarking::FlushMemoryChunkData() {
   total_marked_bytes_ = 0;
 }
 
-void ConcurrentMarking::ClearMemoryChunkData(MutablePageMetadata* chunk) {
-  DCHECK(!job_handle_ || !job_handle_->IsValid());
-  for (auto& task_state : task_state_) {
-    task_state->memory_chunk_live_bytes_map.Erase(chunk);
-    DCHECK(!task_state->memory_chunk_typed_slots_map.contains(chunk));
-  }
-}
-
 size_t ConcurrentMarking::TotalMarkedBytes() {
   size_t result = 0;
   for (size_t i = 1; i < task_state_.size(); i++) {
@@ -881,21 +873,5 @@ size_t ConcurrentMarking::TotalMarkedBytes() {
   return result;
 }
 
-ConcurrentMarking::PauseScope::PauseScope(ConcurrentMarking* concurrent_marking)
-    : concurrent_marking_(concurrent_marking),
-      resume_on_exit_(v8_flags.concurrent_marking &&
-                      concurrent_marking_->Pause()) {
-  DCHECK(!v8_flags.minor_ms);
-  DCHECK_IMPLIES(resume_on_exit_, v8_flags.concurrent_marking);
-}
-
-ConcurrentMarking::PauseScope::~PauseScope() {
-  if (resume_on_exit_) {
-    DCHECK_EQ(concurrent_marking_->garbage_collector_,
-              GarbageCollector::MARK_COMPACTOR);
-    concurrent_marking_->Resume();
-  }
-}
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/heap/concurrent-marking.h b/deps/v8/src/heap/concurrent-marking.h
index f5162aeae59b81..88741bee87b4d7 100644
--- a/deps/v8/src/heap/concurrent-marking.h
+++ b/deps/v8/src/heap/concurrent-marking.h
@@ -34,19 +34,6 @@ class WeakObjects;
 
 class V8_EXPORT_PRIVATE ConcurrentMarking {
  public:
-  // When the scope is entered, the concurrent marking tasks
-  // are preempted and are not looking at the heap objects, concurrent marking
-  // is resumed when the scope is exited.
-  class V8_NODISCARD PauseScope {
-   public:
-    explicit PauseScope(ConcurrentMarking* concurrent_marking);
-    ~PauseScope();
-
-   private:
-    ConcurrentMarking* const concurrent_marking_;
-    const bool resume_on_exit_;
-  };
-
   ConcurrentMarking(Heap* heap, WeakObjects* weak_objects);
   ~ConcurrentMarking();
 
@@ -76,9 +63,6 @@ class V8_EXPORT_PRIVATE ConcurrentMarking {
   void FlushNativeContexts(NativeContextStats* main_stats);
   // Flushes memory chunk data.
   void FlushMemoryChunkData();
-  // This function is called for a new space page that was cleared after
-  // scavenge and is going to be reused.
-  void ClearMemoryChunkData(MutablePageMetadata* chunk);
   // Flushes pretenuring feedback.
   void FlushPretenuringFeedback();
 
diff --git a/deps/v8/src/heap/conservative-stack-visitor-inl.h b/deps/v8/src/heap/conservative-stack-visitor-inl.h
index c54f14239c4ec9..3d4bb838afa7f9 100644
--- a/deps/v8/src/heap/conservative-stack-visitor-inl.h
+++ b/deps/v8/src/heap/conservative-stack-visitor-inl.h
@@ -128,20 +128,20 @@ void ConservativeStackVisitorBase<ConcreteVisitor>::VisitPointer(
   auto address = reinterpret_cast<Address>(const_cast<void*>(pointer));
 #ifdef V8_COMPRESS_POINTERS
   V8HeapCompressionScheme::ProcessIntermediatePointers(
-      cage_base_, address,
+      address,
       [this](Address ptr) { VisitConservativelyIfPointer(ptr, cage_base_); });
   if constexpr (ConcreteVisitor::kOnlyVisitMainV8Cage) {
     return;
   }
 #ifdef V8_EXTERNAL_CODE_SPACE
   ExternalCodeCompressionScheme::ProcessIntermediatePointers(
-      code_cage_base_, address, [this](Address ptr) {
+      address, [this](Address ptr) {
         VisitConservativelyIfPointer(ptr, code_cage_base_);
       });
 #endif  // V8_EXTERNAL_CODE_SPACE
 #ifdef V8_ENABLE_SANDBOX
   TrustedSpaceCompressionScheme::ProcessIntermediatePointers(
-      trusted_cage_base_, address, [this](Address ptr) {
+      address, [this](Address ptr) {
         VisitConservativelyIfPointer(ptr, trusted_cage_base_);
       });
 #endif  // V8_ENABLE_SANDBOX
diff --git a/deps/v8/src/heap/cppgc-js/cpp-heap.cc b/deps/v8/src/heap/cppgc-js/cpp-heap.cc
index 6c11bda9e5199b..af73ea782780db 100644
--- a/deps/v8/src/heap/cppgc-js/cpp-heap.cc
+++ b/deps/v8/src/heap/cppgc-js/cpp-heap.cc
@@ -1270,13 +1270,6 @@ CppHeap::CreateCppMarkingStateForMutatorThread() {
       marker()->To<UnifiedHeapMarker>().GetMutatorMarkingState());
 }
 
-CppHeap::PauseConcurrentMarkingScope::PauseConcurrentMarkingScope(
-    CppHeap* cpp_heap) {
-  if (cpp_heap && cpp_heap->marker()) {
-    pause_scope_.emplace(*cpp_heap->marker());
-  }
-}
-
 void CppHeap::CollectGarbage(cppgc::internal::GCConfig config) {
   if (!IsGCAllowed()) {
     return;
diff --git a/deps/v8/src/heap/cppgc-js/cpp-heap.h b/deps/v8/src/heap/cppgc-js/cpp-heap.h
index cd35cf1b2c67aa..5ea4a1ba8abdb4 100644
--- a/deps/v8/src/heap/cppgc-js/cpp-heap.h
+++ b/deps/v8/src/heap/cppgc-js/cpp-heap.h
@@ -23,6 +23,7 @@ static_assert(
 #include "src/heap/cppgc/marker.h"
 #include "src/heap/cppgc/stats-collector.h"
 #include "src/logging/metrics.h"
+#include "src/objects/cpp-heap-object-wrapper.h"
 #include "src/objects/js-objects.h"
 
 namespace v8 {
@@ -97,15 +98,6 @@ class V8_EXPORT_PRIVATE CppHeap final
         last_incremental_mark_event_;
   };
 
-  class PauseConcurrentMarkingScope final {
-   public:
-    explicit PauseConcurrentMarkingScope(CppHeap*);
-
-   private:
-    std::optional<cppgc::internal::MarkerBase::PauseConcurrentMarkingScope>
-        pause_scope_;
-  };
-
   static void InitializeOncePerProcess();
 
   static CppHeap* From(v8::CppHeap* heap) {
@@ -200,7 +192,8 @@ class V8_EXPORT_PRIVATE CppHeap final
 #endif  // V8_ENABLE_ALLOCATION_TIMEOUT
 
   V8_INLINE void RememberCrossHeapReferenceIfNeeded(
-      v8::internal::Tagged<v8::internal::JSObject> host_obj, void* value);
+      v8::internal::Tagged<v8::internal::CppHeapPointerWrapperObjectT> host_obj,
+      void* value);
   template <typename F>
   inline void VisitCrossHeapRememberedSetIfNeeded(F f);
   void ResetCrossHeapRememberedSet();
@@ -286,7 +279,8 @@ class V8_EXPORT_PRIVATE CppHeap final
 };
 
 void CppHeap::RememberCrossHeapReferenceIfNeeded(
-    v8::internal::Tagged<v8::internal::JSObject> host_obj, void* value) {
+    v8::internal::Tagged<v8::internal::CppHeapPointerWrapperObjectT> host_obj,
+    void* value) {
   if (!generational_gc_supported()) return;
   DCHECK(isolate_);
   cross_heap_remembered_set_.RememberReferenceIfNeeded(*isolate_, host_obj,
diff --git a/deps/v8/src/heap/cppgc-js/cpp-snapshot.cc b/deps/v8/src/heap/cppgc-js/cpp-snapshot.cc
index 452c362fa558f6..dfa67737dc03d3 100644
--- a/deps/v8/src/heap/cppgc-js/cpp-snapshot.cc
+++ b/deps/v8/src/heap/cppgc-js/cpp-snapshot.cc
@@ -21,6 +21,7 @@
 #include "src/heap/cppgc/heap-visitor.h"
 #include "src/heap/cppgc/visitor.h"
 #include "src/heap/mark-compact.h"
+#include "src/objects/cpp-heap-object-wrapper-inl.h"
 #include "src/objects/js-objects.h"
 #include "src/objects/objects-inl.h"
 #include "src/profiler/heap-profiler.h"
@@ -68,11 +69,11 @@ class EmbedderNode : public v8::EmbedderGraph::Node {
 
   // Edge names are passed to V8 but are required to be held alive from the
   // embedder until the snapshot is compiled.
-  const char* InternalizeEdgeName(std::string edge_name) {
+  const char* InternalizeEdgeName(std::string_view edge_name) {
     const size_t edge_name_len = edge_name.length();
     named_edges_.emplace_back(std::make_unique<char[]>(edge_name_len + 1));
     char* named_edge_str = named_edges_.back().get();
-    snprintf(named_edge_str, edge_name_len + 1, "%s", edge_name.c_str());
+    snprintf(named_edge_str, edge_name_len + 1, "%s", edge_name.data());
     return named_edge_str;
   }
 
@@ -394,7 +395,7 @@ void* ExtractEmbedderDataBackref(Isolate* isolate, CppHeap& cpp_heap,
     return nullptr;
   }
   // Wrapper using cpp_heap_wrappable field.
-  return JSApiWrapper(*js_object)
+  return CppHeapObjectWrapper(*js_object)
       .GetCppHeapWrappable(isolate, kAnyCppHeapPointer);
 }
 
@@ -477,7 +478,7 @@ class CppGraphBuilderImpl final {
   }
 
   void AddEdge(State& parent, const HeapObjectHeader& header,
-               const std::string& edge_name) {
+               std::string_view edge_name) {
     DCHECK(parent.IsVisibleNotDependent());
     auto& current = states_.GetExistingState(header);
     if (!current.IsVisibleNotDependent()) return;
@@ -500,7 +501,7 @@ class CppGraphBuilderImpl final {
   }
 
   void AddEdge(State& parent, const TracedReferenceBase& ref,
-               const std::string& edge_name) {
+               std::string_view edge_name) {
     DCHECK(parent.IsVisibleNotDependent());
     v8::Local<v8::Data> v8_data =
         ref.Get(reinterpret_cast<v8::Isolate*>(cpp_heap_.isolate()));
@@ -776,9 +777,7 @@ class GraphBuildingVisitor final : public JSVisitor {
                            edge_name_);
   }
 
-  void set_edge_name(std::string edge_name) {
-    edge_name_ = std::move(edge_name);
-  }
+  void set_edge_name(std::string_view edge_name) { edge_name_ = edge_name; }
 
  private:
   CppGraphBuilderImpl& graph_builder_;
@@ -989,6 +988,9 @@ class GraphBuildingStackVisitor
   GraphBuildingRootVisitor& root_visitor_;
 };
 
+constexpr std::string_view kEphemeronEdgeName =
+    "part of key -> value pair in ephemeron table";
+
 }  // namespace
 
 void CppGraphBuilderImpl::Run() {
@@ -1023,10 +1025,9 @@ void CppGraphBuilderImpl::Run() {
       state.header()->TraceImpl(&object_visitor);
     }
     state.ForAllEphemeronEdges([this, &state](const HeapObjectHeader& value) {
-      AddEdge(state, value, "part of key -> value pair in ephemeron table");
+      AddEdge(state, value, kEphemeronEdgeName);
     });
-    object_visitor.set_edge_name(
-        "part of key -> value pair in ephemeron table");
+    object_visitor.set_edge_name(kEphemeronEdgeName);
     state.ForAllEagerEphemeronEdges(
         [&object_visitor](const void* value, cppgc::TraceCallback callback) {
           callback(&object_visitor, value);
diff --git a/deps/v8/src/heap/cppgc-js/cross-heap-remembered-set.cc b/deps/v8/src/heap/cppgc-js/cross-heap-remembered-set.cc
index 926e27b4121ceb..bcc9c77a363e5b 100644
--- a/deps/v8/src/heap/cppgc-js/cross-heap-remembered-set.cc
+++ b/deps/v8/src/heap/cppgc-js/cross-heap-remembered-set.cc
@@ -11,7 +11,8 @@
 namespace v8::internal {
 
 void CrossHeapRememberedSet::RememberReferenceIfNeeded(
-    Isolate& isolate, Tagged<JSObject> host_obj, void* cppgc_object) {
+    Isolate& isolate, Tagged<CppHeapPointerWrapperObjectT> host_obj,
+    void* cppgc_object) {
   DCHECK_NOT_NULL(cppgc_object);
   // Any in-cage pointer must point to a vaild, not freed cppgc object.
   auto* page =
diff --git a/deps/v8/src/heap/cppgc-js/cross-heap-remembered-set.h b/deps/v8/src/heap/cppgc-js/cross-heap-remembered-set.h
index 1a533150f3e189..ff409b3de7cc14 100644
--- a/deps/v8/src/heap/cppgc-js/cross-heap-remembered-set.h
+++ b/deps/v8/src/heap/cppgc-js/cross-heap-remembered-set.h
@@ -9,6 +9,7 @@
 
 #include "src/base/macros.h"
 #include "src/handles/handles.h"
+#include "src/objects/cpp-heap-object-wrapper.h"
 #include "src/objects/tagged.h"
 
 namespace cppgc::internal {
@@ -17,8 +18,6 @@ class HeapBase;
 
 namespace v8::internal {
 
-class JSObject;
-
 // The class is used to remember V8 to Oilpan references.
 class V8_EXPORT_PRIVATE CrossHeapRememberedSet final {
  public:
@@ -28,7 +27,8 @@ class V8_EXPORT_PRIVATE CrossHeapRememberedSet final {
   CrossHeapRememberedSet(const CrossHeapRememberedSet&) = delete;
   CrossHeapRememberedSet(CrossHeapRememberedSet&&) = delete;
 
-  void RememberReferenceIfNeeded(Isolate& isolate, Tagged<JSObject> host_obj,
+  void RememberReferenceIfNeeded(Isolate& isolate,
+                                 Tagged<CppHeapPointerWrapperObjectT> host_obj,
                                  void* cppgc_object);
   void Reset(Isolate& isolate);
 
@@ -41,7 +41,8 @@ class V8_EXPORT_PRIVATE CrossHeapRememberedSet final {
   cppgc::internal::HeapBase& heap_base_;
   // The vector keeps handles to remembered V8 objects that have outgoing
   // references to the cppgc heap. Please note that the handles are global.
-  std::vector<IndirectHandle<JSObject>> remembered_v8_to_cppgc_references_;
+  std::vector<IndirectHandle<CppHeapPointerWrapperObjectT>>
+      remembered_v8_to_cppgc_references_;
 };
 
 template <typename F>
diff --git a/deps/v8/src/heap/cppgc/pointer-policies.cc b/deps/v8/src/heap/cppgc/pointer-policies.cc
index c0fbef84cf824c..2c8eddb9e10220 100644
--- a/deps/v8/src/heap/cppgc/pointer-policies.cc
+++ b/deps/v8/src/heap/cppgc/pointer-policies.cc
@@ -4,6 +4,7 @@
 
 #include "include/cppgc/internal/pointer-policies.h"
 
+#include "include/cppgc/garbage-collected.h"
 #include "include/cppgc/internal/persistent-node.h"
 #include "src/base/logging.h"
 #include "src/base/macros.h"
@@ -66,14 +67,18 @@ void SameThreadEnabledCheckingPolicyBase::CheckPointerImpl(
   // Header checks.
   const HeapObjectHeader* header = nullptr;
   if (points_to_payload) {
-    header = &HeapObjectHeader::FromObject(ptr);
+    // Unmask the alignment bits for the tagged pointer.
+    const void* untagged = reinterpret_cast<const void*>(
+        reinterpret_cast<uintptr_t>(ptr) & ~kAllocationMask);
+    header = &HeapObjectHeader::FromObject(untagged);
     DCHECK_EQ(
         header,
         &base_page->ObjectHeaderFromInnerAddress<AccessMode::kAtomic>(ptr));
   } else {
     // Mixin case. Access the ObjectStartBitmap atomically since sweeping can be
     // in progress.
-    header = &base_page->ObjectHeaderFromInnerAddress<AccessMode::kAtomic>(ptr);
+    header =
+        &base_page->ObjectHeaderFromInnerAddress<AccessMode::kAtomic>(ptr);
     DCHECK_LE(header->ObjectStart(), ptr);
     DCHECK_GT(header->ObjectEnd<AccessMode::kAtomic>(), ptr);
   }
diff --git a/deps/v8/src/heap/cppgc/sweeper.cc b/deps/v8/src/heap/cppgc/sweeper.cc
index 4990477f7e6717..8971253f671467 100644
--- a/deps/v8/src/heap/cppgc/sweeper.cc
+++ b/deps/v8/src/heap/cppgc/sweeper.cc
@@ -989,6 +989,16 @@ class Sweeper::SweeperImpl final {
       // Having a low priority runner implies having a regular runner as well.
       CHECK_IMPLIES(low_priority_foreground_task_runner_.get(),
                     foreground_task_runner_.get());
+      const auto supports_non_nestable_tasks =
+          [](const std::shared_ptr<TaskRunner>& runner) {
+            return runner && runner->NonNestableTasksEnabled() &&
+                   runner->NonNestableDelayedTasksEnabled();
+          };
+      if (!supports_non_nestable_tasks(foreground_task_runner_) ||
+          !supports_non_nestable_tasks(low_priority_foreground_task_runner_)) {
+        foreground_task_runner_.reset();
+        low_priority_foreground_task_runner_.reset();
+      }
     }
 
     // Verify bitmap for all spaces regardless of |compactable_space_handling|.
@@ -1447,9 +1457,10 @@ class Sweeper::SweeperImpl final {
       auto task = std::make_unique<IncrementalSweepTask>(sweeper, priority);
       auto handle = task->handle_;
       if (delay.has_value()) {
-        runner->PostDelayedTask(std::move(task), delay->InSecondsF());
+        runner->PostNonNestableDelayedTask(std::move(task),
+                                           delay->InSecondsF());
       } else {
-        runner->PostTask(std::move(task));
+        runner->PostNonNestableTask(std::move(task));
       }
       return handle;
     }
diff --git a/deps/v8/src/heap/factory-base-inl.h b/deps/v8/src/heap/factory-base-inl.h
index 6f943b75b91744..42eb2e02d2edae 100644
--- a/deps/v8/src/heap/factory-base-inl.h
+++ b/deps/v8/src/heap/factory-base-inl.h
@@ -8,6 +8,9 @@
 #include "src/heap/factory-base.h"
 // Include the non-inl header before the rest of the headers.
 
+#include <type_traits>
+
+#include "src/execution/local-isolate-inl.h"
 #include "src/heap/local-heap-inl.h"
 #include "src/numbers/conversions.h"
 #include "src/objects/heap-number.h"
@@ -131,7 +134,12 @@ Tagged<StructType> FactoryBase<Impl>::NewStructInternal(
     InstanceType type, AllocationType allocation) {
   ReadOnlyRoots roots = read_only_roots();
   Tagged<Map> map = Map::GetMapFor(roots, type);
-  int size = StructType::kSize;
+  int size;
+  if constexpr (std::is_base_of_v<StructLayout, StructType>) {
+    size = sizeof(StructType);
+  } else {
+    size = StructType::kSize;
+  }
   return Cast<StructType>(NewStructInternal(roots, map, size, allocation));
 }
 
diff --git a/deps/v8/src/heap/factory-base.cc b/deps/v8/src/heap/factory-base.cc
index dc43757deda701..ce4e565534f99e 100644
--- a/deps/v8/src/heap/factory-base.cc
+++ b/deps/v8/src/heap/factory-base.cc
@@ -99,8 +99,7 @@ Handle<Code> FactoryBase<Impl>::NewCode(const NewCodeOptions& options) {
   code->set_handler_table_offset(options.handler_table_offset);
   code->set_constant_pool_offset(options.constant_pool_offset);
   code->set_code_comments_offset(options.code_comments_offset);
-  code->set_builtin_jump_table_info_offset(
-      options.builtin_jump_table_info_offset);
+  code->set_jump_table_info_offset(options.jump_table_info_offset);
   code->set_unwinding_info_offset(options.unwinding_info_offset);
   code->set_parameter_count(options.parameter_count);
 #ifdef V8_ENABLE_LEAPTIERING
@@ -195,9 +194,9 @@ Handle<TrustedFixedArray> FactoryBase<Impl>::NewTrustedFixedArray(
 
 template <typename Impl>
 Handle<ProtectedFixedArray> FactoryBase<Impl>::NewProtectedFixedArray(
-    int length) {
+    int length, bool shared) {
   if (length == 0) return empty_protected_fixed_array();
-  return ProtectedFixedArray::New(isolate(), length);
+  return ProtectedFixedArray::New(isolate(), length, shared);
 }
 
 template <typename Impl>
diff --git a/deps/v8/src/heap/factory-base.h b/deps/v8/src/heap/factory-base.h
index 0edc4189a6ecf8..9a3b27aaf89d4f 100644
--- a/deps/v8/src/heap/factory-base.h
+++ b/deps/v8/src/heap/factory-base.h
@@ -86,7 +86,7 @@ struct NewCodeOptions {
   int handler_table_offset;
   int constant_pool_offset;
   int code_comments_offset;
-  int32_t builtin_jump_table_info_offset;
+  int32_t jump_table_info_offset;
   int32_t unwinding_info_offset;
   MaybeHandle<TrustedObject> bytecode_or_interpreter_data;
   MaybeHandle<DeoptimizationData> deoptimization_data;
@@ -153,7 +153,8 @@ class FactoryBase : public TorqueGeneratedFactory<Impl> {
       int length, AllocationType allocation = AllocationType::kTrusted);
 
   // Allocates a protected fixed array in trusted space, initialized with zeros.
-  Handle<ProtectedFixedArray> NewProtectedFixedArray(int length);
+  Handle<ProtectedFixedArray> NewProtectedFixedArray(int length,
+                                                     bool shared = false);
 
   // Allocates a fixed array-like object with given map and initialized with
   // undefined values.
diff --git a/deps/v8/src/heap/factory.cc b/deps/v8/src/heap/factory.cc
index 64580597d6b4a9..4c3786845463c9 100644
--- a/deps/v8/src/heap/factory.cc
+++ b/deps/v8/src/heap/factory.cc
@@ -45,6 +45,7 @@
 #include "src/objects/bigint.h"
 #include "src/objects/call-site-info-inl.h"
 #include "src/objects/cell-inl.h"
+#include "src/objects/cpp-heap-object-wrapper-inl.h"
 #include "src/objects/debug-objects-inl.h"
 #include "src/objects/embedder-data-array-inl.h"
 #include "src/objects/feedback-cell-inl.h"
@@ -83,6 +84,7 @@
 #include "src/objects/transitions-inl.h"
 #include "src/roots/roots-inl.h"
 #include "src/roots/roots.h"
+#include "src/sandbox/isolate.h"
 #include "src/strings/unicode-inl.h"
 #if V8_ENABLE_WEBASSEMBLY
 #include "src/wasm/module-decoder-impl.h"
@@ -182,7 +184,7 @@ MaybeHandle<Code> Factory::CodeBuilder::BuildInternal(
         code_desc_.handler_table_offset_relative(),
         code_desc_.constant_pool_offset_relative(),
         code_desc_.code_comments_offset_relative(),
-        code_desc_.builtin_jump_table_info_offset_relative(),
+        code_desc_.jump_table_info_offset_relative(),
         code_desc_.unwinding_info_offset_relative(),
         interpreter_data_,
         deoptimization_data_,
@@ -307,7 +309,7 @@ Tagged<HeapObject> Factory::AllocateRawWithAllocationSite(
   const int allocation_size =
       should_allocate_memento
           ? instance_size +
-                ALIGN_TO_ALLOCATION_ALIGNMENT(AllocationMemento::kSize)
+                ALIGN_TO_ALLOCATION_ALIGNMENT(sizeof(AllocationMemento))
           : instance_size;
   Tagged<HeapObject> result =
       allocator()->AllocateRawWith<HeapAllocator::kRetryOrFail>(allocation_size,
@@ -1335,14 +1337,6 @@ DirectHandle<Context> Factory::NewScriptContext(
     DirectHandle<NativeContext> outer, DirectHandle<ScopeInfo> scope_info) {
   DCHECK(scope_info->is_script_scope());
   int variadic_part_length = scope_info->ContextLength();
-
-  DirectHandle<FixedArray> side_data;
-  if (v8_flags.const_tracking_let ||
-      v8_flags.script_context_mutable_heap_number) {
-    side_data = NewFixedArray(scope_info->ContextLocalCount());
-  } else {
-    side_data = empty_fixed_array();
-  }
   Tagged<Context> context =
       NewContextInternal(direct_handle(outer->script_context_map(), isolate()),
                          Context::SizeFor(variadic_part_length),
@@ -1350,7 +1344,6 @@ DirectHandle<Context> Factory::NewScriptContext(
   DisallowGarbageCollection no_gc;
   context->set_scope_info(*scope_info);
   context->set_previous(*outer);
-  context->set(Context::CONTEXT_SIDE_TABLE_PROPERTY_INDEX, *side_data);
   DCHECK(context->IsScriptContext());
   return direct_handle(context, isolate());
 }
@@ -1425,8 +1418,8 @@ DirectHandle<Context> Factory::NewCatchContext(
   DCHECK_NEWLY_ALLOCATED_OBJECT_IS_YOUNG(isolate(), context);
   context->set_scope_info(*scope_info, SKIP_WRITE_BARRIER);
   context->set_previous(*previous, SKIP_WRITE_BARRIER);
-  context->set(Context::THROWN_OBJECT_INDEX, *thrown_object,
-               SKIP_WRITE_BARRIER);
+  context->SetNoCell(Context::THROWN_OBJECT_INDEX, *thrown_object,
+                     SKIP_WRITE_BARRIER);
   return direct_handle(context, isolate());
 }
 
@@ -1449,7 +1442,8 @@ Handle<Context> Factory::NewDebugEvaluateContext(
   context->set_previous(*previous, SKIP_WRITE_BARRIER);
   context->set_extension(*ext, SKIP_WRITE_BARRIER);
   if (!wrapped.is_null()) {
-    context->set(Context::WRAPPED_CONTEXT_INDEX, *wrapped, SKIP_WRITE_BARRIER);
+    context->SetNoCell(Context::WRAPPED_CONTEXT_INDEX, *wrapped,
+                       SKIP_WRITE_BARRIER);
   }
   return handle(context, isolate());
 }
@@ -1500,6 +1494,21 @@ DirectHandle<Context> Factory::NewBuiltinContext(
   return direct_handle(context, isolate());
 }
 
+DirectHandle<ContextCell> Factory::NewContextCell(
+    DirectHandle<JSAny> value, AllocationType allocation_type) {
+  Tagged<ContextCell> cell =
+      Cast<ContextCell>(New(context_cell_map(), allocation_type));
+  DisallowGarbageCollection no_gc;
+  cell->set_tagged_value(*value, SKIP_WRITE_BARRIER);
+  cell->set_dependent_code(
+      DependentCode::empty_dependent_code(ReadOnlyRoots(isolate())),
+      SKIP_WRITE_BARRIER);
+  cell->set_float64_value(0);
+  cell->set_state(ContextCell::kConst);
+  cell->clear_padding();
+  return direct_handle(cell, isolate());
+}
+
 DirectHandle<AliasedArgumentsEntry> Factory::NewAliasedArgumentsEntry(
     int aliased_context_slot) {
   auto entry = NewStructInternal<AliasedArgumentsEntry>(
@@ -1526,6 +1535,25 @@ DirectHandle<AccessorInfo> Factory::NewAccessorInfo() {
   return direct_handle(info, isolate());
 }
 
+DirectHandle<InterceptorInfo> Factory::NewInterceptorInfo(
+    AllocationType allocation) {
+  Tagged<InterceptorInfo> info =
+      Cast<InterceptorInfo>(New(interceptor_info_map(), allocation));
+  DisallowGarbageCollection no_gc;
+  info->set_data(*undefined_value());
+  info->set_flags(0);
+  info->clear_padding();
+
+  // Initialization of these lazy-initialized callback fields is the same
+  // for named and indexed versions.
+#define INIT_CALLBACK_FIELD(Name, name) info->init_named_##name();
+
+  INTERCEPTOR_INFO_CALLBACK_LIST(INIT_CALLBACK_FIELD)
+#undef INIT_CALLBACK_FIELD
+
+  return direct_handle(info, isolate());
+}
+
 DirectHandle<ErrorStackData> Factory::NewErrorStackData(
     DirectHandle<UnionOf<JSAny, FixedArray>> call_site_infos_or_formatted_stack,
     DirectHandle<StackTraceInfo> stack_trace) {
@@ -1645,10 +1673,12 @@ Factory::NewPromiseResolveThenableJobTask(
 
 #if V8_ENABLE_WEBASSEMBLY
 
-DirectHandle<WasmTrustedInstanceData> Factory::NewWasmTrustedInstanceData() {
+DirectHandle<WasmTrustedInstanceData> Factory::NewWasmTrustedInstanceData(
+    bool shared) {
   Tagged<WasmTrustedInstanceData> result =
       Cast<WasmTrustedInstanceData>(AllocateRawWithImmortalMap(
-          WasmTrustedInstanceData::kSize, AllocationType::kTrusted,
+          WasmTrustedInstanceData::kSize,
+          shared ? AllocationType::kSharedTrusted : AllocationType::kTrusted,
           read_only_roots().wasm_trusted_instance_data_map()));
   DisallowGarbageCollection no_gc;
   result->init_self_indirect_pointer(isolate());
@@ -1660,7 +1690,7 @@ DirectHandle<WasmTrustedInstanceData> Factory::NewWasmTrustedInstanceData() {
 }
 
 DirectHandle<WasmDispatchTable> Factory::NewWasmDispatchTable(
-    int length, wasm::CanonicalValueType table_type) {
+    int length, wasm::CanonicalValueType table_type, bool shared) {
   CHECK_LE(length, WasmDispatchTable::kMaxLength);
 
   // TODO(jkummerow): Any chance to get a better estimate?
@@ -1668,12 +1698,14 @@ DirectHandle<WasmDispatchTable> Factory::NewWasmDispatchTable(
   DirectHandle<TrustedManaged<WasmDispatchTableData>> offheap_data =
       TrustedManaged<WasmDispatchTableData>::From(
           isolate(), estimated_offheap_size,
-          std::make_shared<WasmDispatchTableData>());
+          std::make_shared<WasmDispatchTableData>(), shared);
 
   int bytes = WasmDispatchTable::SizeFor(length);
-  Tagged<WasmDispatchTable> result = UncheckedCast<WasmDispatchTable>(
-      AllocateRawWithImmortalMap(bytes, AllocationType::kTrusted,
-                                 read_only_roots().wasm_dispatch_table_map()));
+  Tagged<WasmDispatchTable> result =
+      UncheckedCast<WasmDispatchTable>(AllocateRawWithImmortalMap(
+          bytes,
+          shared ? AllocationType::kSharedTrusted : AllocationType::kTrusted,
+          read_only_roots().wasm_dispatch_table_map()));
   DisallowGarbageCollection no_gc;
   result->init_self_indirect_pointer(isolate());
   result->WriteField<int>(WasmDispatchTable::kLengthOffset, length);
@@ -1690,7 +1722,7 @@ DirectHandle<WasmDispatchTable> Factory::NewWasmDispatchTable(
 
 DirectHandle<WasmTypeInfo> Factory::NewWasmTypeInfo(
     wasm::CanonicalValueType type, wasm::CanonicalValueType element_type,
-    DirectHandle<Map> opt_parent) {
+    DirectHandle<Map> opt_parent, bool shared) {
   // We pretenure WasmTypeInfo objects for two reasons:
   // (1) They are referenced by Maps, which are assumed to be long-lived,
   //     so pretenuring the WTI is a bit more efficient.
@@ -1721,7 +1753,7 @@ DirectHandle<WasmTypeInfo> Factory::NewWasmTypeInfo(
   Tagged<Map> map = *wasm_type_info_map();
   Tagged<WasmTypeInfo> result = Cast<WasmTypeInfo>(AllocateRawWithImmortalMap(
       WasmTypeInfo::SizeFor(static_cast<int>(supertypes.size())),
-      AllocationType::kOld, map));
+      shared ? AllocationType::kSharedOld : AllocationType::kOld, map));
   DisallowGarbageCollection no_gc;
   result->set_supertypes_length(static_cast<int>(supertypes.size()));
   for (size_t i = 0; i < supertypes.size(); i++) {
@@ -1735,10 +1767,11 @@ DirectHandle<WasmTypeInfo> Factory::NewWasmTypeInfo(
 DirectHandle<WasmImportData> Factory::NewWasmImportData(
     DirectHandle<HeapObject> callable, wasm::Suspend suspend,
     MaybeDirectHandle<WasmTrustedInstanceData> instance_data,
-    const wasm::CanonicalSig* sig) {
+    const wasm::CanonicalSig* sig, bool shared) {
   Tagged<Map> map = *wasm_import_data_map();
   auto result = Cast<WasmImportData>(AllocateRawWithImmortalMap(
-      map->instance_size(), AllocationType::kTrusted, map));
+      map->instance_size(),
+      shared ? AllocationType::kSharedTrusted : AllocationType::kTrusted, map));
   DisallowGarbageCollection no_gc;
   result->set_native_context(*isolate()->native_context());
   result->set_callable(Cast<UnionOf<Undefined, JSReceiver>>(*callable));
@@ -1758,11 +1791,11 @@ DirectHandle<WasmImportData> Factory::NewWasmImportData(
 }
 
 DirectHandle<WasmImportData> Factory::NewWasmImportData(
-    DirectHandle<WasmImportData> import_data) {
-  return NewWasmImportData(
-      direct_handle(import_data->callable(), isolate()), import_data->suspend(),
-      direct_handle(import_data->instance_data(), isolate()),
-      import_data->sig());
+    DirectHandle<WasmImportData> import_data, bool shared) {
+  return NewWasmImportData(handle(import_data->callable(), isolate()),
+                           import_data->suspend(),
+                           handle(import_data->instance_data(), isolate()),
+                           import_data->sig(), shared);
 }
 
 DirectHandle<WasmFastApiCallData> Factory::NewWasmFastApiCallData(
@@ -1777,10 +1810,11 @@ DirectHandle<WasmFastApiCallData> Factory::NewWasmFastApiCallData(
 }
 
 DirectHandle<WasmInternalFunction> Factory::NewWasmInternalFunction(
-    DirectHandle<TrustedObject> implicit_arg, int function_index) {
+    DirectHandle<TrustedObject> implicit_arg, int function_index, bool shared) {
   Tagged<WasmInternalFunction> internal =
       Cast<WasmInternalFunction>(AllocateRawWithImmortalMap(
-          WasmInternalFunction::kSize, AllocationType::kTrusted,
+          WasmInternalFunction::kSize,
+          shared ? AllocationType::kSharedTrusted : AllocationType::kTrusted,
           *wasm_internal_function_map()));
   internal->init_self_indirect_pointer(isolate());
   {
@@ -1798,10 +1832,11 @@ DirectHandle<WasmInternalFunction> Factory::NewWasmInternalFunction(
 }
 
 DirectHandle<WasmFuncRef> Factory::NewWasmFuncRef(
-    DirectHandle<WasmInternalFunction> internal_function,
-    DirectHandle<Map> rtt) {
+    DirectHandle<WasmInternalFunction> internal_function, DirectHandle<Map> rtt,
+    bool shared) {
   Tagged<HeapObject> raw =
-      AllocateRaw(WasmFuncRef::kSize, AllocationType::kOld);
+      AllocateRaw(WasmFuncRef::kSize,
+                  shared ? AllocationType::kSharedOld : AllocationType::kOld);
   DisallowGarbageCollection no_gc;
   DCHECK_EQ(WASM_FUNC_REF_TYPE, rtt->instance_type());
   DCHECK_EQ(WasmFuncRef::kSize, rtt->instance_size());
@@ -1818,20 +1853,23 @@ DirectHandle<WasmJSFunctionData> Factory::NewWasmJSFunctionData(
   // TODO(clemensb): Should this be passed instead of looked up here?
   const wasm::CanonicalSig* sig =
       wasm::GetTypeCanonicalizer()->LookupFunctionSignature(sig_index);
+  constexpr bool kShared = false;
   DirectHandle<WasmImportData> import_data = NewWasmImportData(
-      callable, suspend, DirectHandle<WasmTrustedInstanceData>(), sig);
+      callable, suspend, DirectHandle<WasmTrustedInstanceData>(), sig, kShared);
 
   // Rough guess for a wrapper that may be shared with other users of it.
   constexpr size_t kOffheapDataSizeEstimate = 100;
+  constexpr bool shared = false;
   DirectHandle<TrustedManaged<WasmJSFunctionData::OffheapData>> offheap_data =
       TrustedManaged<WasmJSFunctionData::OffheapData>::From(
           isolate(), kOffheapDataSizeEstimate,
           std::make_shared<WasmJSFunctionData::OffheapData>(
-              sig->signature_hash()));
+              sig->signature_hash()),
+          shared);
 
   DirectHandle<WasmInternalFunction> internal =
-      NewWasmInternalFunction(import_data, -1);
-  DirectHandle<WasmFuncRef> func_ref = NewWasmFuncRef(internal, rtt);
+      NewWasmInternalFunction(import_data, -1, kShared);
+  DirectHandle<WasmFuncRef> func_ref = NewWasmFuncRef(internal, rtt, kShared);
   import_data->SetFuncRefAsCallOrigin(*internal);
   Tagged<Map> map = *wasm_js_function_data_map();
   Tagged<WasmJSFunctionData> result =
@@ -1869,7 +1907,7 @@ DirectHandle<WasmSuspenderObject> Factory::NewWasmSuspenderObject() {
           map->instance_size(), AllocationType::kOld, map));
   auto suspender = handle(obj, isolate());
   // Ensure that all properties are initialized before the allocation below.
-  suspender->set_continuation(*undefined_value());
+  suspender->init_stack(IsolateForSandbox(isolate()), nullptr);
   suspender->set_parent(*undefined_value());
   suspender->set_promise(*promise);
   suspender->set_resume(*undefined_value());
@@ -1934,12 +1972,13 @@ DirectHandle<WasmCapiFunctionData> Factory::NewWasmCapiFunctionData(
     Address call_target, DirectHandle<Foreign> embedder_data,
     DirectHandle<Code> wrapper_code, DirectHandle<Map> rtt,
     wasm::CanonicalTypeIndex sig_index, const wasm::CanonicalSig* sig) {
+  constexpr bool kShared = false;
   DirectHandle<WasmImportData> import_data =
       NewWasmImportData(undefined_value(), wasm::kNoSuspend,
-                        DirectHandle<WasmTrustedInstanceData>(), sig);
+                        DirectHandle<WasmTrustedInstanceData>(), sig, kShared);
   DirectHandle<WasmInternalFunction> internal =
-      NewWasmInternalFunction(import_data, -1);
-  DirectHandle<WasmFuncRef> func_ref = NewWasmFuncRef(internal, rtt);
+      NewWasmInternalFunction(import_data, -1, kShared);
+  DirectHandle<WasmFuncRef> func_ref = NewWasmFuncRef(internal, rtt, kShared);
   // We have no generic wrappers for C-API functions, so we don't need to
   // set any call origin on {import_data}.
   internal->set_call_target(
@@ -1965,8 +2004,10 @@ DirectHandle<WasmCapiFunctionData> Factory::NewWasmCapiFunctionData(
 
 Tagged<WasmArray> Factory::NewWasmArrayUninitialized(uint32_t length,
                                                      DirectHandle<Map> map) {
-  Tagged<HeapObject> raw =
-      AllocateRaw(WasmArray::SizeFor(*map, length), AllocationType::kYoung);
+  Tagged<HeapObject> raw = AllocateRaw(WasmArray::SizeFor(*map, length),
+                                       HeapLayout::InAnySharedSpace(*map)
+                                           ? AllocationType::kSharedOld
+                                           : AllocationType::kYoung);
   DisallowGarbageCollection no_gc;
   raw->set_map_after_allocation(isolate(), *map);
   Tagged<WasmArray> result = Cast<WasmArray>(raw);
@@ -2066,9 +2107,11 @@ DirectHandle<Object> Factory::NewWasmArrayFromElementSegment(
   Tagged<WasmArray> result = NewWasmArrayUninitialized(length, map);
   DisallowGarbageCollection no_gc;
   if (length > 0) {
-    isolate()->heap()->CopyRange(result, result->ElementSlot(0),
-                                 elements->RawFieldOfElementAt(start_offset),
-                                 length, SKIP_WRITE_BARRIER);
+    isolate()->heap()->CopyRange(
+        result, result->ElementSlot(0),
+        elements->RawFieldOfElementAt(start_offset), length,
+        HeapLayout::InAnySharedSpace(result) ? UPDATE_WRITE_BARRIER
+                                             : SKIP_WRITE_BARRIER);
   }
   return direct_handle(result, isolate());
 }
@@ -2087,7 +2130,9 @@ DirectHandle<WasmStruct> Factory::NewWasmStruct(const wasm::StructType* type,
                                                 wasm::WasmValue* args,
                                                 DirectHandle<Map> map) {
   Tagged<HeapObject> raw =
-      AllocateRaw(WasmStruct::Size(type), AllocationType::kYoung);
+      AllocateRaw(WasmStruct::Size(type), HeapLayout::InAnySharedSpace(*map)
+                                              ? AllocationType::kSharedOld
+                                              : AllocationType::kYoung);
   raw->set_map_after_allocation(isolate(), *map);
   Tagged<WasmStruct> result = Cast<WasmStruct>(raw);
   result->set_raw_properties_or_hash(*empty_fixed_array(), kRelaxedStore);
@@ -2106,17 +2151,6 @@ DirectHandle<WasmStruct> Factory::NewWasmStruct(const wasm::StructType* type,
   return direct_handle(result, isolate());
 }
 
-DirectHandle<WasmContinuationObject> Factory::NewWasmContinuationObject(
-    wasm::StackMemory* stack, DirectHandle<HeapObject> parent,
-    AllocationType allocation) {
-  Tagged<Map> map = *wasm_continuation_object_map();
-  auto result = Cast<WasmContinuationObject>(
-      AllocateRawWithImmortalMap(map->instance_size(), allocation, map));
-  result->init_stack(isolate(), reinterpret_cast<Address>(stack));
-  result->set_parent(Cast<UnionOf<Undefined, WasmContinuationObject>>(*parent));
-  return direct_handle(result, isolate());
-}
-
 DirectHandle<SharedFunctionInfo>
 Factory::NewSharedFunctionInfoForWasmExportedFunction(
     DirectHandle<String> name, DirectHandle<WasmExportedFunctionData> data,
@@ -2225,20 +2259,6 @@ Handle<PropertyCell> Factory::NewPropertyCell(DirectHandle<Name> name,
   return handle(cell, isolate());
 }
 
-DirectHandle<ContextSidePropertyCell> Factory::NewContextSidePropertyCell(
-    ContextSidePropertyCell::Property property, AllocationType allocation) {
-  static_assert(ContextSidePropertyCell::kSize <= kMaxRegularHeapObjectSize);
-  Tagged<ContextSidePropertyCell> cell = Cast<ContextSidePropertyCell>(
-      AllocateRawWithImmortalMap(ContextSidePropertyCell::kSize, allocation,
-                                 *global_context_side_property_cell_map()));
-  DisallowGarbageCollection no_gc;
-  cell->set_context_side_property_raw(Smi::FromInt(property), kReleaseStore);
-  cell->set_dependent_code(
-      DependentCode::empty_dependent_code(ReadOnlyRoots(isolate())),
-      SKIP_WRITE_BARRIER);
-  return direct_handle(cell, isolate());
-}
-
 DirectHandle<PropertyCell> Factory::NewProtector() {
   return NewPropertyCell(
       empty_string(), PropertyDetails::Empty(PropertyCellType::kConstantType),
@@ -2277,8 +2297,11 @@ Handle<AllocationSite> Factory::NewAllocationSite(bool with_weak_next) {
 
   if (with_weak_next) {
     // Link the site
-    site->set_weak_next(isolate()->heap()->allocation_sites_list());
-    isolate()->heap()->set_allocation_sites_list(*site);
+    Cast<AllocationSiteWithWeakNext>(site)->set_weak_next(
+        Cast<UnionOf<Undefined, AllocationSiteWithWeakNext>>(
+            isolate()->heap()->allocation_sites_list()));
+    isolate()->heap()->set_allocation_sites_list(
+        *Cast<AllocationSiteWithWeakNext>(site));
   }
   return site;
 }
@@ -2407,6 +2430,7 @@ DirectHandle<Map> Factory::NewContextfulMap(
     DirectHandle<JSReceiver> creation_context_holder, InstanceType type,
     int instance_size, ElementsKind elements_kind, int inobject_properties,
     AllocationType allocation_type) {
+  // TODO(ishell): There should probably be a DCHECK(IsNCSpecific(type)) here.
   auto meta_map_provider = [creation_context_holder] {
     // Tie new map to the creation context of given |creation_context_holder|
     // object.
@@ -2425,6 +2449,9 @@ DirectHandle<Map> Factory::NewContextfulMap(
     int instance_size, ElementsKind elements_kind, int inobject_properties,
     AllocationType allocation_type) {
   DCHECK(InstanceTypeChecker::IsNativeContextSpecific(type) ||
+#if V8_ENABLE_WEBASSEMBLY
+         InstanceTypeChecker::IsWasmStruct(type) ||
+#endif  // V8_ENABLE_WEBASSEMBLY
          InstanceTypeChecker::IsMap(type));
   auto meta_map_provider = [native_context] {
     // Tie new map to given native context.
@@ -2504,7 +2531,7 @@ Handle<JSObject> Factory::CopyJSObjectWithAllocationSite(
   if (!site.is_null()) {
     DCHECK(V8_ALLOCATION_SITE_TRACKING_BOOL);
     adjusted_object_size +=
-        ALIGN_TO_ALLOCATION_ALIGNMENT(AllocationMemento::kSize);
+        ALIGN_TO_ALLOCATION_ALIGNMENT(sizeof(AllocationMemento));
   }
   Tagged<HeapObject> raw_clone =
       allocator()->AllocateRawWith<HeapAllocator::kRetryOrFail>(
@@ -2891,6 +2918,15 @@ Handle<JSObject> Factory::NewExternal(void* value,
   return external;
 }
 
+Handle<CppHeapExternalObject> Factory::NewCppHeapExternal(
+    AllocationType allocation_type) {
+  Tagged<CppHeapExternalObject> external = Cast<CppHeapExternalObject>(
+      AllocateRawWithAllocationSite(cpp_heap_external_map(), allocation_type,
+                                    DirectHandle<AllocationSite>::null()));
+  CppHeapObjectWrapper(external).InitializeCppHeapWrapper();
+  return handle(external, isolate());
+}
+
 DirectHandle<Code> Factory::NewCodeObjectForEmbeddedBuiltin(
     DirectHandle<Code> code, Address off_heap_entry) {
   CHECK_NOT_NULL(isolate()->embedded_blob_code());
@@ -2924,7 +2960,7 @@ DirectHandle<Code> Factory::NewCodeObjectForEmbeddedBuiltin(
       code->handler_table_offset(),
       code->constant_pool_offset(),
       code->code_comments_offset(),
-      code->builtin_jump_table_info_offset(),
+      code->jump_table_info_offset(),
       code->unwinding_info_offset(),
       MaybeHandle<TrustedObject>{},
       MaybeHandle<DeoptimizationData>{},
@@ -2969,7 +3005,7 @@ DirectHandle<BytecodeArray> Factory::CopyBytecodeArray(
 Handle<JSObject> Factory::NewJSObject(DirectHandle<JSFunction> constructor,
                                       AllocationType allocation,
                                       NewJSObjectType new_js_object_type) {
-  JSFunction::EnsureHasInitialMap(constructor);
+  JSFunction::EnsureHasInitialMap(isolate(), constructor);
   DirectHandle<Map> map(constructor->initial_map(), isolate());
   // NewJSObjectFromMap does not support creating dictionary mode objects. Need
   // to use NewSlowJSObjectFromMap instead.
@@ -3058,15 +3094,6 @@ Handle<JSGlobalObject> Factory::NewJSGlobalObject(
   return global;
 }
 
-void Factory::InitializeCppHeapWrapper(Tagged<JSObject> obj) {
-  DCHECK(IsJSApiWrapperObject(obj));
-  DCHECK(IsJSAPIObjectWithEmbedderSlots(obj) || IsJSSpecialObject(obj));
-  static_assert(JSSpecialObject::kCppHeapWrappableOffset ==
-                JSAPIObjectWithEmbedderSlots::kCppHeapWrappableOffset);
-  obj->SetupLazilyInitializedCppHeapPointerField(
-      JSAPIObjectWithEmbedderSlots::kCppHeapWrappableOffset);
-}
-
 void Factory::InitializeJSObjectFromMap(Tagged<JSObject> obj,
                                         Tagged<Object> properties,
                                         Tagged<Map> map,
@@ -3081,14 +3108,14 @@ void Factory::InitializeJSObjectFromMap(Tagged<JSObject> obj,
   // fixed array (e.g. Heap::empty_fixed_array()).  Currently, the object
   // verification code has to cope with (temporarily) invalid objects.  See
   // for example, JSArray::JSArrayVerify).
-  DCHECK_EQ(IsJSApiWrapperObject(map),
+  DCHECK_EQ(IsJSApiWrapperObjectMap(map),
             new_js_object_type == NewJSObjectType::kAPIWrapper);
   InitializeJSObjectBody(obj, map,
                          new_js_object_type == NewJSObjectType::kNoAPIWrapper
                              ? JSObject::kHeaderSize
                              : JSAPIObjectWithEmbedderSlots::kHeaderSize);
   if (new_js_object_type == NewJSObjectType::kAPIWrapper) {
-    InitializeCppHeapWrapper(obj);
+    CppHeapObjectWrapper(obj).InitializeCppHeapWrapper();
   }
 }
 
@@ -3184,8 +3211,8 @@ DirectHandle<JSObject> Factory::NewSlowJSObjectWithPropertiesAndElements(
   object->set_raw_properties_or_hash(*properties);
   if (*elements != read_only_roots().empty_fixed_array()) {
     DCHECK(IsNumberDictionary(*elements));
-    object_map =
-        JSObject::GetElementsTransitionMap(object, DICTIONARY_ELEMENTS);
+    object_map = JSObject::GetElementsTransitionMap(isolate(), object,
+                                                    DICTIONARY_ELEMENTS);
     JSObject::MigrateToMap(isolate(), object, object_map);
     object->set_elements(*elements);
   }
@@ -3215,7 +3242,7 @@ Handle<JSArray> Factory::NewJSArrayWithElements(
   Handle<JSArray> array = NewJSArrayWithUnverifiedElements(
       elements, elements_kind, length, allocation);
 #ifdef ENABLE_SLOW_DCHECKS
-  JSObject::ValidateElements(*array);
+  JSObject::ValidateElements(isolate(), *array);
 #endif
   return array;
 }
@@ -3349,9 +3376,9 @@ DirectHandle<JSModuleNamespace> Factory::NewJSModuleNamespace() {
 DirectHandle<JSWrappedFunction> Factory::NewJSWrappedFunction(
     DirectHandle<NativeContext> creation_context, DirectHandle<Object> target) {
   DCHECK(IsCallable(*target));
-  DirectHandle<Map> map(
-      Cast<Map>(creation_context->get(Context::WRAPPED_FUNCTION_MAP_INDEX)),
-      isolate());
+  DirectHandle<Map> map(Cast<Map>(creation_context->GetNoCell(
+                            Context::WRAPPED_FUNCTION_MAP_INDEX)),
+                        isolate());
   // 2. Let wrapped be ! MakeBasicObject(internalSlotsList).
   // 3. Set wrapped.[[Prototype]] to
   // callerRealm.[[Intrinsics]].[[%Function->prototype%]].
@@ -3370,7 +3397,7 @@ DirectHandle<JSWrappedFunction> Factory::NewJSWrappedFunction(
 DirectHandle<JSGeneratorObject> Factory::NewJSGeneratorObject(
     DirectHandle<JSFunction> function) {
   DCHECK(IsResumableFunction(function->shared()->kind()));
-  JSFunction::EnsureHasInitialMap(function);
+  JSFunction::EnsureHasInitialMap(isolate(), function);
   DirectHandle<Map> map(function->initial_map(), isolate());
 
   DCHECK(map->instance_type() == JS_GENERATOR_OBJECT_TYPE ||
@@ -3708,6 +3735,20 @@ Handle<JSDataViewOrRabGsabDataView> Factory::NewJSDataViewOrRabGsabDataView(
   return obj;
 }
 
+DirectHandle<JSUint8ArraySetFromResult> Factory::NewJSUint8ArraySetFromResult(
+    DirectHandle<Number> read, DirectHandle<Number> written) {
+  DirectHandle<Map> map(
+      isolate()->native_context()->set_unit8_array_result_map(), isolate());
+  DirectHandle<JSUint8ArraySetFromResult> js_uint8_array_set_from_result =
+      Cast<JSUint8ArraySetFromResult>(
+          NewJSObjectFromMap(map, AllocationType::kYoung));
+  DisallowGarbageCollection no_gc;
+  Tagged<JSUint8ArraySetFromResult> raw = *js_uint8_array_set_from_result;
+  raw->set_read(*read, SKIP_WRITE_BARRIER);
+  raw->set_written(*written, SKIP_WRITE_BARRIER);
+  return js_uint8_array_set_from_result;
+}
+
 MaybeDirectHandle<JSBoundFunction> Factory::NewJSBoundFunction(
     DirectHandle<JSReceiver> target_function, DirectHandle<JSAny> bound_this,
     base::Vector<DirectHandle<Object>> bound_args,
@@ -4305,8 +4346,8 @@ DirectHandle<Map> Factory::CreateSloppyFunctionMap(
   } else {
     // |maybe_empty_function| is allowed to be empty only during empty function
     // creation.
-    DCHECK(IsUndefined(
-        isolate()->raw_native_context()->get(Context::EMPTY_FUNCTION_INDEX)));
+    DCHECK(IsUndefined(isolate()->raw_native_context()->GetNoCell(
+        Context::EMPTY_FUNCTION_INDEX)));
   }
 
   //
@@ -4696,13 +4737,15 @@ DirectHandle<DictionaryTemplateInfo> Factory::NewDictionaryTemplateInfo(
   return direct_handle(obj, isolate());
 }
 
-Handle<TrustedForeign> Factory::NewTrustedForeign(Address addr) {
+Handle<TrustedForeign> Factory::NewTrustedForeign(Address addr, bool shared) {
   // Statically ensure that it is safe to allocate foreigns in paged spaces.
   static_assert(TrustedForeign::kSize <= kMaxRegularHeapObjectSize);
   Tagged<Map> map = *trusted_foreign_map();
   Tagged<TrustedForeign> foreign =
       Cast<TrustedForeign>(AllocateRawWithImmortalMap(
-          map->instance_size(), AllocationType::kTrusted, map));
+          map->instance_size(),
+          shared ? AllocationType::kSharedTrusted : AllocationType::kTrusted,
+          map));
   DisallowGarbageCollection no_gc;
   foreign->set_foreign_address(addr);
   return handle(foreign, isolate());
@@ -4738,9 +4781,9 @@ Handle<JSFunction> Factory::JSFunctionBuilder::BuildRaw(
   DirectHandle<Map> map;
   if (!maybe_map_.ToHandle(&map)) {
     // No specific map requested, use the default.
-    map = direct_handle(
-        Cast<Map>(context_->native_context()->get(sfi_->function_map_index())),
-        isolate_);
+    map = direct_handle(Cast<Map>(context_->native_context()->GetNoCell(
+                            sfi_->function_map_index())),
+                        isolate_);
   }
   DCHECK(InstanceTypeChecker::IsJSFunction(*map));
 
@@ -4828,7 +4871,7 @@ Handle<JSFunction> Factory::JSFunctionBuilder::BuildRaw(
     }
 #else
     USE(cell_transition, many_closures_cell);
-    function->UpdateCode(*code, mode);
+    function->UpdateCode(isolate, *code, mode);
 #endif  // V8_ENABLE_LEAPTIERING
 
     if (function->has_prototype_slot()) {
diff --git a/deps/v8/src/heap/factory.h b/deps/v8/src/heap/factory.h
index b282f3893fc55f..6d40f2c38ca268 100644
--- a/deps/v8/src/heap/factory.h
+++ b/deps/v8/src/heap/factory.h
@@ -437,6 +437,11 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
   DirectHandle<Context> NewBlockContext(DirectHandle<Context> previous,
                                         DirectHandle<ScopeInfo> scope_info);
 
+  // Create a context cell with a const value.
+  DirectHandle<ContextCell> NewContextCell(
+      DirectHandle<JSAny> value,
+      AllocationType allocation_type = AllocationType::kYoung);
+
   // Create a context that's used by builtin functions.
   //
   // These are similar to function context but don't have a previous
@@ -450,6 +455,9 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
 
   DirectHandle<AccessorInfo> NewAccessorInfo();
 
+  DirectHandle<InterceptorInfo> NewInterceptorInfo(
+      AllocationType allocation = AllocationType::kOld);
+
   DirectHandle<ErrorStackData> NewErrorStackData(
       DirectHandle<UnionOf<JSAny, FixedArray>>
           call_site_infos_or_formatted_stack,
@@ -487,7 +495,7 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
   Handle<Foreign> NewForeign(
       Address addr, AllocationType allocation_type = AllocationType::kYoung);
 
-  Handle<TrustedForeign> NewTrustedForeign(Address addr);
+  Handle<TrustedForeign> NewTrustedForeign(Address addr, bool shared);
 
   Handle<Cell> NewCell(Tagged<Smi> value);
   Handle<Cell> NewCell();
@@ -496,9 +504,6 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
       DirectHandle<Name> name, PropertyDetails details,
       DirectHandle<Object> value,
       AllocationType allocation = AllocationType::kOld);
-  DirectHandle<ContextSidePropertyCell> NewContextSidePropertyCell(
-      ContextSidePropertyCell::Property property,
-      AllocationType allocation = AllocationType::kOld);
   DirectHandle<PropertyCell> NewProtector();
 
   DirectHandle<FeedbackCell> NewNoClosuresCell();
@@ -733,17 +738,17 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
       DirectHandle<Map> map);
 
 #if V8_ENABLE_WEBASSEMBLY
-  DirectHandle<WasmTrustedInstanceData> NewWasmTrustedInstanceData();
+  DirectHandle<WasmTrustedInstanceData> NewWasmTrustedInstanceData(bool shared);
   DirectHandle<WasmDispatchTable> NewWasmDispatchTable(
-      int length, wasm::CanonicalValueType table_type);
+      int length, wasm::CanonicalValueType table_type, bool shared);
   DirectHandle<WasmTypeInfo> NewWasmTypeInfo(
       wasm::CanonicalValueType type, wasm::CanonicalValueType element_type,
-      DirectHandle<Map> opt_parent);
+      DirectHandle<Map> opt_parent, bool shared);
   DirectHandle<WasmInternalFunction> NewWasmInternalFunction(
-      DirectHandle<TrustedObject> ref, int function_index);
+      DirectHandle<TrustedObject> ref, int function_index, bool shared);
   DirectHandle<WasmFuncRef> NewWasmFuncRef(
       DirectHandle<WasmInternalFunction> internal_function,
-      DirectHandle<Map> rtt);
+      DirectHandle<Map> rtt, bool shared);
   DirectHandle<WasmCapiFunctionData> NewWasmCapiFunctionData(
       Address call_target, DirectHandle<Foreign> embedder_data,
       DirectHandle<Code> wrapper_code, DirectHandle<Map> rtt,
@@ -758,9 +763,9 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
   DirectHandle<WasmImportData> NewWasmImportData(
       DirectHandle<HeapObject> callable, wasm::Suspend suspend,
       MaybeDirectHandle<WasmTrustedInstanceData> instance_data,
-      const wasm::CanonicalSig* sig);
+      const wasm::CanonicalSig* sig, bool shared);
   DirectHandle<WasmImportData> NewWasmImportData(
-      DirectHandle<WasmImportData> ref);
+      DirectHandle<WasmImportData> ref, bool shared);
 
   DirectHandle<WasmFastApiCallData> NewWasmFastApiCallData(
       DirectHandle<HeapObject> signature, DirectHandle<Object> callback_data);
@@ -801,9 +806,6 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
       DirectHandle<WasmTrustedInstanceData> shared_trusted_instance_data,
       uint32_t segment_index, uint32_t start_offset, uint32_t length,
       DirectHandle<Map> map, wasm::CanonicalValueType element_type);
-  DirectHandle<WasmContinuationObject> NewWasmContinuationObject(
-      wasm::StackMemory* stack, DirectHandle<HeapObject> parent,
-      AllocationType allocation = AllocationType::kYoung);
 
   DirectHandle<SharedFunctionInfo> NewSharedFunctionInfoForWasmExportedFunction(
       DirectHandle<String> name, DirectHandle<WasmExportedFunctionData> data,
@@ -852,6 +854,9 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
       DirectHandle<JSArrayBuffer> buffer, size_t byte_offset,
       size_t byte_length, bool is_length_tracking = false);
 
+  DirectHandle<JSUint8ArraySetFromResult> NewJSUint8ArraySetFromResult(
+      DirectHandle<Number> read, DirectHandle<Number> written);
+
   DirectHandle<JSIteratorResult> NewJSIteratorResult(DirectHandle<Object> value,
                                                      bool done);
   DirectHandle<JSAsyncFromSyncIterator> NewJSAsyncFromSyncIterator(
@@ -889,6 +894,10 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
   Handle<JSObject> NewExternal(
       void* value, AllocationType allocation = AllocationType::kYoung);
 
+  // Create a CppHeapExternal object for V8's external API.
+  Handle<CppHeapExternalObject> NewCppHeapExternal(
+      AllocationType allocation = AllocationType::kYoung);
+
   // Allocates a new code object and initializes it to point to the given
   // off-heap entry point.
   //
@@ -1385,7 +1394,6 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
   // Initializes JSObject body starting at given offset.
   void InitializeJSObjectBody(Tagged<JSObject> obj, Tagged<Map> map,
                               int start_offset);
-  void InitializeCppHeapWrapper(Tagged<JSObject> obj);
 
   Handle<WeakArrayList> NewUninitializedWeakArrayList(
       int capacity, AllocationType allocation = AllocationType::kYoung);
diff --git a/deps/v8/src/heap/finalization-registry-cleanup-task.cc b/deps/v8/src/heap/finalization-registry-cleanup-task.cc
index 87a9bfcc68289c..d1fccd7b8e4257 100644
--- a/deps/v8/src/heap/finalization-registry-cleanup-task.cc
+++ b/deps/v8/src/heap/finalization-registry-cleanup-task.cc
@@ -23,8 +23,7 @@ void FinalizationRegistryCleanupTask::SlowAssertNoActiveJavaScript() {
   class NoActiveJavaScript : public ThreadVisitor {
    public:
     void VisitThread(Isolate* isolate, ThreadLocalTop* top) override {
-      for (StackFrameIterator it(isolate, top, StackFrameIterator::NoHandles{});
-           !it.done(); it.Advance()) {
+      for (StackFrameIterator it(isolate, top); !it.done(); it.Advance()) {
         DCHECK(!it.frame()->is_javascript());
       }
     }
diff --git a/deps/v8/src/heap/gc-callbacks-inl.h b/deps/v8/src/heap/gc-callbacks-inl.h
new file mode 100644
index 00000000000000..0e8d41c6a76a85
--- /dev/null
+++ b/deps/v8/src/heap/gc-callbacks-inl.h
@@ -0,0 +1,36 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_HEAP_GC_CALLBACKS_INL_H_
+#define V8_HEAP_GC_CALLBACKS_INL_H_
+
+#include "src/heap/gc-callbacks.h"
+// Include the non-inl header before the rest of the headers.
+
+#include "src/execution/local-isolate.h"
+#include "src/heap/local-heap-inl.h"
+
+namespace v8 {
+namespace internal {
+
+GCRootsProviderScope::GCRootsProviderScope(LocalIsolate* local_isolate,
+                                           GCRootsProvider* provider)
+    : GCRootsProviderScope(local_isolate->heap(), provider) {}
+
+GCRootsProviderScope::GCRootsProviderScope(LocalHeap* local_heap,
+                                           GCRootsProvider* provider)
+    : local_heap_(local_heap) {
+  CHECK_NULL(local_heap_->roots_provider_);
+  local_heap_->roots_provider_ = provider;
+}
+
+GCRootsProviderScope::~GCRootsProviderScope() {
+  DCHECK_NOT_NULL(local_heap_->roots_provider_);
+  local_heap_->roots_provider_ = nullptr;
+}
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_HEAP_GC_CALLBACKS_INL_H_
diff --git a/deps/v8/src/heap/gc-callbacks.h b/deps/v8/src/heap/gc-callbacks.h
index ae96c44818a73a..22395131babc18 100644
--- a/deps/v8/src/heap/gc-callbacks.h
+++ b/deps/v8/src/heap/gc-callbacks.h
@@ -15,6 +15,8 @@
 
 namespace v8::internal {
 
+class RootVisitor;
+
 class GCCallbacks final {
  public:
   using CallbackType = void (*)(v8::Isolate*, GCType, GCCallbackFlags, void*);
@@ -72,6 +74,25 @@ class GCCallbacks final {
   std::vector<CallbackData> callbacks_;
 };
 
+// This interface allows to extend the GC to consider more roots during a GC
+// cycle. This allows us to avoid the use of handles in C++ objects.
+//
+// During a GC the `Iterate()` method will be invoked with the GC's RootVisitor
+// passed in as argument. The implementer of this interface needs to invoke the
+// visitor on each unhandlified pointer in the object. The GC will both keep the
+// referenced object alive and also updates its address if the object gets
+// relocated. Note that in order to do so `Iterate()` may be invoked more than
+// once per GC.
+//
+// Note that an object implementing GCRootsProvider still needs to be registered
+// with a thread (=LocalHeap/LocalIsolate) using GCRootsProviderScope.
+class GCRootsProvider {
+ public:
+  virtual ~GCRootsProvider() {}
+
+  virtual void Iterate(RootVisitor* v) = 0;
+};
+
 class GCCallbacksInSafepoint final {
  public:
   using CallbackType = void (*)(void*);
@@ -123,6 +144,25 @@ class GCCallbacksInSafepoint final {
   std::vector<CallbackData> callbacks_;
 };
 
+// GCRootsProviderScope registers a C++ object implementing the GCRootsProvider
+// with the current thread (=LocalHeap/LocalIsolate) for the duration of the
+// scope.
+//
+// In every GC happening inside this scope, the GC will invoke the registered
+// GCRootsProvider for all threads. See GCRootsProvider for more details.
+class GCRootsProviderScope final {
+ public:
+  GCRootsProviderScope(LocalIsolate* local_isolate, GCRootsProvider* provider);
+  GCRootsProviderScope(LocalHeap* local_heap, GCRootsProvider* provider);
+  ~GCRootsProviderScope();
+
+  GCRootsProviderScope(GCRootsProviderScope&) = delete;
+  GCRootsProviderScope(GCRootsProviderScope&&) = delete;
+
+ private:
+  LocalHeap* local_heap_;
+};
+
 }  // namespace v8::internal
 
 #endif  // V8_HEAP_GC_CALLBACKS_H_
diff --git a/deps/v8/src/heap/gc-tracer.cc b/deps/v8/src/heap/gc-tracer.cc
index b3ef8427c37ce3..fe7f2416d78a91 100644
--- a/deps/v8/src/heap/gc-tracer.cc
+++ b/deps/v8/src/heap/gc-tracer.cc
@@ -232,21 +232,22 @@ void GCTracer::StartCycle(GarbageCollector collector,
   DCHECK_NE(Event::State::ATOMIC, current_.state);
   // We cannot start a new cycle while a young generation GC cycle has
   // already interrupted a full GC cycle.
-  DCHECK(!young_gc_while_full_gc_);
+  DCHECK(!young_gc_during_full_gc_sweeping_);
 
-  young_gc_while_full_gc_ = current_.state != Event::State::NOT_RUNNING;
-  CHECK_IMPLIES(v8_flags.separate_gc_phases && young_gc_while_full_gc_,
+  young_gc_during_full_gc_sweeping_ =
+      current_.state != Event::State::NOT_RUNNING;
+  CHECK_IMPLIES(young_gc_during_full_gc_sweeping_,
                 current_.state == Event::State::SWEEPING);
-  if (young_gc_while_full_gc_) {
+  if (young_gc_during_full_gc_sweeping_) {
     // The cases for interruption are: Scavenger, MinorMS interrupting sweeping.
     // In both cases we are fine with fetching background counters now and
     // fixing them up later in StopAtomicPause().
     FetchBackgroundCounters();
   }
 
-  DCHECK_IMPLIES(young_gc_while_full_gc_,
+  DCHECK_IMPLIES(young_gc_during_full_gc_sweeping_,
                  Heap::IsYoungGenerationCollector(collector));
-  DCHECK_IMPLIES(young_gc_while_full_gc_,
+  DCHECK_IMPLIES(young_gc_during_full_gc_sweeping_,
                  !Event::IsYoungGenerationEvent(current_.type));
 
   Event::Type type;
@@ -266,7 +267,7 @@ void GCTracer::StartCycle(GarbageCollector collector,
       break;
   }
 
-  DCHECK_IMPLIES(!young_gc_while_full_gc_,
+  DCHECK_IMPLIES(!young_gc_during_full_gc_sweeping_,
                  current_.state == Event::State::NOT_RUNNING);
   DCHECK_EQ(Event::State::NOT_RUNNING, previous_.state);
 
@@ -479,7 +480,7 @@ void GCTracer::StopCycle(GarbageCollector collector) {
 
     // If a young generation GC interrupted an unfinished full GC cycle, restore
     // the event corresponding to the full GC cycle.
-    if (young_gc_while_full_gc_) {
+    if (young_gc_during_full_gc_sweeping_) {
       // Sweeping for full GC could have occured during the young GC. Copy over
       // any sweeping scope values to the previous_ event. The full GC sweeping
       // scopes are never reported by young cycles.
@@ -487,7 +488,7 @@ void GCTracer::StopCycle(GarbageCollector collector) {
       previous_.scopes[Scope::MC_BACKGROUND_SWEEPING] +=
           current_.scopes[Scope::MC_BACKGROUND_SWEEPING];
       std::swap(current_, previous_);
-      young_gc_while_full_gc_ = false;
+      young_gc_during_full_gc_sweeping_ = false;
     }
   } else {
     ReportFullCycleToRecorder();
@@ -503,7 +504,7 @@ void GCTracer::StopCycle(GarbageCollector collector) {
   }
 }
 
-void GCTracer::StopFullCycleIfNeeded() {
+void GCTracer::StopFullCycleIfFinished() {
   if (current_.state != Event::State::SWEEPING) return;
   if (!notified_full_sweeping_completed_) return;
   if (heap_->cpp_heap() && !notified_full_cppgc_completed_) return;
@@ -513,31 +514,29 @@ void GCTracer::StopFullCycleIfNeeded() {
   full_cppgc_completed_during_minor_gc_ = false;
 }
 
-void GCTracer::StopYoungCycleIfNeeded() {
+void GCTracer::StopYoungCycleIfFinished() {
   DCHECK(Event::IsYoungGenerationEvent(current_.type));
   if (current_.state != Event::State::SWEEPING) return;
-  if ((current_.type == Event::Type::MINOR_MARK_SWEEPER ||
-       current_.type == Event::Type::INCREMENTAL_MINOR_MARK_SWEEPER) &&
-      !notified_young_sweeping_completed_)
-    return;
+  if (!notified_young_sweeping_completed_) return;
   // Check if young cppgc was scheduled but hasn't completed yet.
   if (heap_->cpp_heap() && notified_young_cppgc_running_ &&
       !notified_young_cppgc_completed_)
     return;
-  bool was_young_gc_while_full_gc_ = young_gc_while_full_gc_;
+  bool was_young_gc_during_full_gc_sweeping_ =
+      young_gc_during_full_gc_sweeping_;
   StopCycle(current_.type == Event::Type::SCAVENGER
                 ? GarbageCollector::SCAVENGER
                 : GarbageCollector::MINOR_MARK_SWEEPER);
   notified_young_sweeping_completed_ = false;
   notified_young_cppgc_running_ = false;
   notified_young_cppgc_completed_ = false;
-  if (was_young_gc_while_full_gc_) {
+  if (was_young_gc_during_full_gc_sweeping_) {
     // Check if the full gc cycle is ready to be stopped.
-    StopFullCycleIfNeeded();
+    StopFullCycleIfFinished();
   }
 }
 
-void GCTracer::NotifyFullSweepingCompleted() {
+void GCTracer::NotifyFullSweepingCompletedAndStopCycleIfFinished() {
   // Notifying twice that V8 sweeping is finished for the same cycle is possible
   // only if Oilpan sweeping is still in progress.
   DCHECK_IMPLIES(
@@ -545,13 +544,15 @@ void GCTracer::NotifyFullSweepingCompleted() {
       !notified_full_cppgc_completed_ || full_cppgc_completed_during_minor_gc_);
 
   if (Event::IsYoungGenerationEvent(current_.type)) {
-    bool was_young_gc_while_full_gc = young_gc_while_full_gc_;
+    bool was_young_gc_during_full_gc_sweeping =
+        young_gc_during_full_gc_sweeping_;
     bool was_full_sweeping_notified = notified_full_sweeping_completed_;
-    NotifyYoungSweepingCompleted();
-    // NotifyYoungSweepingCompleted checks if the full cycle needs to be stopped
-    // as well. If full sweeping was already notified, nothing more needs to be
-    // done here.
-    if (!was_young_gc_while_full_gc || was_full_sweeping_notified) return;
+    NotifyYoungSweepingCompletedAndStopCycleIfFinished();
+    // NotifyYoungSweepingCompletedAndStopCycleIfFinished checks if the full
+    // cycle needs to be stopped as well. If full sweeping was already notified,
+    // nothing more needs to be done here.
+    if (!was_young_gc_during_full_gc_sweeping || was_full_sweeping_notified)
+      return;
   }
 
   DCHECK(!Event::IsYoungGenerationEvent(current_.type));
@@ -568,25 +569,31 @@ void GCTracer::NotifyFullSweepingCompleted() {
     heap_->PrintFreeListsStats();
   }
   notified_full_sweeping_completed_ = true;
-  StopFullCycleIfNeeded();
+  StopFullCycleIfFinished();
 }
 
 void GCTracer::NotifyYoungSweepingCompleted() {
-  if (!Event::IsYoungGenerationEvent(current_.type)) return;
+  DCHECK(Event::IsYoungGenerationEvent(current_.type));
   if (v8_flags.verify_heap) {
     // If heap verification is enabled, sweeping finalization can also be
     // triggered from inside a full GC cycle's atomic pause.
     DCHECK(current_.type == Event::Type::MINOR_MARK_SWEEPER ||
-           current_.type == Event::Type::INCREMENTAL_MINOR_MARK_SWEEPER);
+           current_.type == Event::Type::INCREMENTAL_MINOR_MARK_SWEEPER ||
+           current_.type == Event::Type::SCAVENGER);
     DCHECK(current_.state == Event::State::SWEEPING ||
            current_.state == Event::State::ATOMIC);
   } else {
-    DCHECK(IsSweepingInProgress());
+    DCHECK(IsSweepingInProgress() || (current_.type == Event::Type::SCAVENGER));
   }
 
   DCHECK(!notified_young_sweeping_completed_);
   notified_young_sweeping_completed_ = true;
-  StopYoungCycleIfNeeded();
+}
+
+void GCTracer::NotifyYoungSweepingCompletedAndStopCycleIfFinished() {
+  if (!Event::IsYoungGenerationEvent(current_.type)) return;
+  NotifyYoungSweepingCompleted();
+  StopYoungCycleIfFinished();
 }
 
 void GCTracer::NotifyFullCppGCCompleted() {
@@ -602,11 +609,11 @@ void GCTracer::NotifyFullCppGCCompleted() {
   // Cppgc sweeping may finalize during MinorMS sweeping. In that case, delay
   // stopping the cycle until the nested MinorMS cycle is stopped.
   if (Event::IsYoungGenerationEvent(current_.type)) {
-    DCHECK(young_gc_while_full_gc_);
+    DCHECK(young_gc_during_full_gc_sweeping_);
     full_cppgc_completed_during_minor_gc_ = true;
     return;
   }
-  StopFullCycleIfNeeded();
+  StopFullCycleIfFinished();
 }
 
 void GCTracer::NotifyYoungCppGCCompleted() {
@@ -620,7 +627,7 @@ void GCTracer::NotifyYoungCppGCCompleted() {
   DCHECK(metric_recorder->YoungGCMetricsReportPending());
   DCHECK(!notified_young_cppgc_completed_);
   notified_young_cppgc_completed_ = true;
-  StopYoungCycleIfNeeded();
+  StopYoungCycleIfFinished();
 }
 
 void GCTracer::NotifyYoungCppGCRunning() {
@@ -789,19 +796,19 @@ void GCTracer::Print() const {
 
   // Avoid PrintF as Output also appends the string to the tracing ring buffer
   // that gets printed on OOM failures.
-  DCHECK_IMPLIES(young_gc_while_full_gc_,
+  DCHECK_IMPLIES(young_gc_during_full_gc_sweeping_,
                  Event::IsYoungGenerationEvent(current_.type));
   Output(
       "[%d:%p] "
       "%8.0f ms: "
       "%s%s%s %.1f (%.1f) -> %.1f (%.1f) MB, "
-      "pooled: %1.f MB, "
-      "%.2f / %.2f ms %s (average mu = %.3f, current mu = %.3f) %s; %s\n",
+      "pooled: %.1f MB, "
+      "%.2f / %.2f ms%s (average mu = %.3f, current mu = %.3f) %s; %s\n",
       base::OS::GetCurrentProcessId(),
       reinterpret_cast<void*>(heap_->isolate()),
       heap_->isolate()->time_millis_since_init(),
       ToString(current_.type, false), current_.reduce_memory ? " (reduce)" : "",
-      young_gc_while_full_gc_ ? " (interleaved)" : "",
+      young_gc_during_full_gc_sweeping_ ? " (during sweeping)" : "",
       static_cast<double>(current_.start_object_size) / MB,
       static_cast<double>(current_.start_memory_size) / MB,
       static_cast<double>(current_.end_object_size) / MB,
@@ -838,7 +845,7 @@ void GCTracer::PrintNVP() const {
           "mutator=%.1f "
           "gc=%s "
           "reduce_memory=%d "
-          "interleaved=%d "
+          "during_sweeping=%d "
           "time_to_safepoint=%.2f "
           "heap.prologue=%.2f "
           "heap.epilogue=%.2f "
@@ -854,6 +861,8 @@ void GCTracer::PrintNVP() const {
           "scavenge.weak_global_handles.process=%.2f "
           "scavenge.parallel=%.2f "
           "scavenge.update_refs=%.2f "
+          "scavenge.pin_objects=%.2f "
+          "scavenge.restore_pinned=%.2f "
           "scavenge.sweep_array_buffers=%.2f "
           "scavenge.resize_new_space=%.2f "
           "background.scavenge.parallel=%.2f "
@@ -888,7 +897,7 @@ void GCTracer::PrintNVP() const {
           "pool_total_chunks=%zu\n",
           duration.InMillisecondsF(), spent_in_mutator.InMillisecondsF(),
           ToString(current_.type, true), current_.reduce_memory,
-          young_gc_while_full_gc_,
+          young_gc_during_full_gc_sweeping_,
           current_.scopes[Scope::TIME_TO_SAFEPOINT].InMillisecondsF(),
           current_scope(Scope::HEAP_PROLOGUE),
           current_scope(Scope::HEAP_EPILOGUE),
@@ -904,6 +913,9 @@ void GCTracer::PrintNVP() const {
           current_scope(Scope::SCAVENGER_SCAVENGE_WEAK_GLOBAL_HANDLES_PROCESS),
           current_scope(Scope::SCAVENGER_SCAVENGE_PARALLEL),
           current_scope(Scope::SCAVENGER_SCAVENGE_UPDATE_REFS),
+          current_scope(Scope::SCAVENGER_SCAVENGE_PIN_OBJECTS),
+          current_scope(
+              Scope::SCAVENGER_SCAVENGE_RESTORE_AND_QUARANTINE_PINNED),
           current_scope(Scope::SCAVENGER_SWEEP_ARRAY_BUFFERS),
           current_scope(Scope::SCAVENGER_RESIZE_NEW_SPACE),
           current_scope(Scope::SCAVENGER_BACKGROUND_SCAVENGE_PARALLEL),
diff --git a/deps/v8/src/heap/gc-tracer.h b/deps/v8/src/heap/gc-tracer.h
index ca2c6b00b53102..6af100718b58e6 100644
--- a/deps/v8/src/heap/gc-tracer.h
+++ b/deps/v8/src/heap/gc-tracer.h
@@ -303,8 +303,8 @@ class V8_EXPORT_PRIVATE GCTracer {
   // Start and stop a GC cycle (collecting data and reporting results).
   void StartCycle(GarbageCollector collector, GarbageCollectionReason gc_reason,
                   const char* collector_reason, MarkingType marking);
-  void StopYoungCycleIfNeeded();
-  void StopFullCycleIfNeeded();
+  void StopYoungCycleIfFinished();
+  void StopFullCycleIfFinished();
 
   void UpdateMemoryBalancerGCSpeed();
 
@@ -315,7 +315,15 @@ class V8_EXPORT_PRIVATE GCTracer {
   void StartInSafepoint(base::TimeTicks time);
   void StopInSafepoint(base::TimeTicks time);
 
-  void NotifyFullSweepingCompleted();
+  // Notify the GC tracer that full/young sweeping is completed. A cycle cannot
+  // be stopped until sweeping is completed and `StopCycle` would bail out if
+  // `Notify*SweepingCompleted` is not called before. These methods also call
+  // `StopCycle` if all other conditions are also met (e.g. Oilpan sweeping is
+  // also completed).
+  void NotifyFullSweepingCompletedAndStopCycleIfFinished();
+  void NotifyYoungSweepingCompletedAndStopCycleIfFinished();
+  // Marks young sweeping as complete but doesn't try to call `StopCycle` even
+  // if possible.
   void NotifyYoungSweepingCompleted();
 
   void NotifyFullCppGCCompleted();
@@ -512,8 +520,7 @@ class V8_EXPORT_PRIVATE GCTracer {
   // The starting time of the observable pause if set.
   std::optional<base::TimeTicks> start_of_observable_pause_;
 
-  // We need two epochs, since there can be scavenges during incremental
-  // marking.
+  // We need two epochs, since there can be scavenges during sweeping.
   CollectionEpoch epoch_young_ = 0;
   CollectionEpoch epoch_full_ = 0;
 
@@ -588,7 +595,7 @@ class V8_EXPORT_PRIVATE GCTracer {
   // When a full GC cycle is interrupted by a young generation GC cycle, the
   // |previous_| event is used as temporary storage for the |current_| event
   // that corresponded to the full GC cycle, and this field is set to true.
-  bool young_gc_while_full_gc_ = false;
+  bool young_gc_during_full_gc_sweeping_ = false;
 
   v8::metrics::GarbageCollectionFullMainThreadBatchedIncrementalMark
       incremental_mark_batched_events_;
diff --git a/deps/v8/src/heap/heap-allocator.cc b/deps/v8/src/heap/heap-allocator.cc
index 6f5946fc2374c3..df065a5f88089e 100644
--- a/deps/v8/src/heap/heap-allocator.cc
+++ b/deps/v8/src/heap/heap-allocator.cc
@@ -9,7 +9,12 @@
 #include "src/execution/isolate.h"
 #include "src/heap/heap-allocator-inl.h"
 #include "src/heap/heap-inl.h"
+#include "src/heap/large-page-metadata.h"
+#include "src/heap/large-spaces.h"
+#include "src/heap/page-metadata.h"
 #include "src/logging/counters.h"
+#include "src/objects/heap-object.h"
+#include "src/utils/utils.h"
 
 namespace v8 {
 namespace internal {
@@ -174,6 +179,36 @@ AllocationResult HeapAllocator::RetryAllocateRaw(
   return result;
 }
 
+bool HeapAllocator::TryResizeLargeObject(Tagged<HeapObject> object,
+                                         size_t old_object_size,
+                                         size_t new_object_size) {
+  if (V8_UNLIKELY(!v8_flags.resize_large_object)) {
+    return false;
+  }
+
+  PageMetadata* page = PageMetadata::FromHeapObject(object);
+  Space* space = page->owner();
+  if (space->identity() != NEW_LO_SPACE && space->identity() != LO_SPACE) {
+    return false;
+  }
+  DCHECK(page->IsLargePage());
+  DCHECK_EQ(page->area_size(), old_object_size);
+  CHECK_GT(new_object_size, old_object_size);
+  if (!heap_->memory_allocator()->ResizeLargePage(
+          LargePageMetadata::cast(page), old_object_size, new_object_size)) {
+    if (V8_UNLIKELY(v8_flags.trace_resize_large_object)) {
+      heap_->isolate()->PrintWithTimestamp(
+          "resizing large object failed: allocation could not be extended\n");
+    }
+    return false;
+  }
+
+  LargeObjectSpace* large_space = static_cast<LargeObjectSpace*>(page->owner());
+  large_space->UpdateAccountingAfterResizingObject(old_object_size,
+                                                   new_object_size);
+  return true;
+}
+
 void HeapAllocator::MakeLinearAllocationAreasIterable() {
   if (new_space_allocator_) {
     new_space_allocator_->MakeLinearAllocationAreaIterable();
diff --git a/deps/v8/src/heap/heap-allocator.h b/deps/v8/src/heap/heap-allocator.h
index 3828bd16f43db2..fc34db707fe9ce 100644
--- a/deps/v8/src/heap/heap-allocator.h
+++ b/deps/v8/src/heap/heap-allocator.h
@@ -67,6 +67,11 @@ class V8_EXPORT_PRIVATE HeapAllocator final {
       AllocationOrigin origin = AllocationOrigin::kRuntime,
       AllocationAlignment alignment = kTaggedAligned);
 
+  // Returns true if a large object can be resized in-place to
+  // |new_object_size|. On failure the return value is false.
+  bool TryResizeLargeObject(Tagged<HeapObject> object, size_t old_object_size,
+                            size_t new_object_size);
+
   V8_INLINE bool CanAllocateInReadOnlySpace() const;
 
 #ifdef V8_ENABLE_ALLOCATION_TIMEOUT
diff --git a/deps/v8/src/heap/heap-inl.h b/deps/v8/src/heap/heap-inl.h
index 8d914a2cf04c8d..326db343f3d819 100644
--- a/deps/v8/src/heap/heap-inl.h
+++ b/deps/v8/src/heap/heap-inl.h
@@ -75,11 +75,6 @@ RootsTable& Heap::roots_table() { return isolate()->roots_table(); }
 MUTABLE_ROOT_LIST(ROOT_ACCESSOR)
 #undef ROOT_ACCESSOR
 
-Tagged<FixedArray> Heap::single_character_string_table() {
-  return Cast<FixedArray>(
-      Tagged<Object>(roots_table()[RootIndex::kSingleCharacterStringTable]));
-}
-
 #define STATIC_ROOTS_FAILED_MSG                                            \
   "Read-only heap layout changed. Run `tools/dev/gen-static-roots.py` to " \
   "update static-roots.h."
diff --git a/deps/v8/src/heap/heap-visitor-inl.h b/deps/v8/src/heap/heap-visitor-inl.h
index 3e902f918edbe7..a119b0eb35f744 100644
--- a/deps/v8/src/heap/heap-visitor-inl.h
+++ b/deps/v8/src/heap/heap-visitor-inl.h
@@ -176,6 +176,11 @@ size_t HeapVisitor<ConcreteVisitor>::Visit(Tagged<Map> map,
       return visitor->VisitJSApiObject(
           map, ConcreteVisitor::template Cast<JSObject>(object, heap_),
           maybe_object_size);
+    case kVisitCppHeapExternalObject:
+      return visitor->VisitCppHeapExternalObject(
+          map,
+          ConcreteVisitor::template Cast<CppHeapExternalObject>(object, heap_),
+          maybe_object_size);
     case kVisitStruct:
       return visitor->VisitStruct(map, object, maybe_object_size);
     case kVisitFiller:
@@ -299,6 +304,22 @@ size_t HeapVisitor<ConcreteVisitor>::VisitJSApiObject(
           map, object, maybe_object_size);
 }
 
+template <typename ConcreteVisitor>
+size_t HeapVisitor<ConcreteVisitor>::VisitCppHeapExternalObject(
+    Tagged<Map> map, Tagged<CppHeapExternalObject> object,
+    MaybeObjectSize maybe_object_size) {
+  ConcreteVisitor* visitor = static_cast<ConcreteVisitor*>(this);
+  const size_t size =
+      ConcreteVisitor::UsePrecomputedObjectSize()
+          ? maybe_object_size.AssumeSize()
+          : CppHeapExternalObject::BodyDescriptor::SizeOf(map, object);
+  visitor->template VisitMapPointerIfNeeded<
+      VisitorId::kVisitCppHeapExternalObject>(object);
+  CppHeapExternalObject::BodyDescriptor::IterateBody(
+      map, object, static_cast<int>(size), visitor);
+  return size;
+}
+
 template <typename ConcreteVisitor>
 size_t HeapVisitor<ConcreteVisitor>::VisitStruct(
     Tagged<Map> map, Tagged<HeapObject> object,
diff --git a/deps/v8/src/heap/heap-visitor.cc b/deps/v8/src/heap/heap-visitor.cc
index b595a5cb5a1268..85bc0b322e4e65 100644
--- a/deps/v8/src/heap/heap-visitor.cc
+++ b/deps/v8/src/heap/heap-visitor.cc
@@ -7,6 +7,7 @@
 #include "src/heap/heap-inl.h"
 #include "src/heap/heap-visitor-inl.h"
 #include "src/heap/mark-compact-inl.h"
+#include "src/objects/allocation-site.h"
 #include "src/objects/js-weak-refs.h"
 
 namespace v8 {
@@ -89,7 +90,7 @@ static void ClearWeakList(Heap* heap, Tagged<Object> list) {
 template <>
 struct WeakListVisitor<Context> {
   static void SetWeakNext(Tagged<Context> context, Tagged<HeapObject> next) {
-    context->set(Context::NEXT_CONTEXT_LINK, next, UPDATE_WRITE_BARRIER);
+    context->SetNoCell(Context::NEXT_CONTEXT_LINK, next, UPDATE_WRITE_BARRIER);
   }
 
   static Tagged<Object> WeakNext(Tagged<Context> context) {
@@ -122,10 +123,10 @@ struct WeakListVisitor<Context> {
                          WeakObjectRetainer* retainer, int index) {
     // Visit the weak list, removing dead intermediate elements.
     Tagged<Object> list_head =
-        VisitWeakList<T>(heap, context->get(index), retainer);
+        VisitWeakList<T>(heap, context->GetNoCell(index), retainer);
 
     // Update the list head.
-    context->set(index, list_head, UPDATE_WRITE_BARRIER);
+    context->SetNoCell(index, list_head, UPDATE_WRITE_BARRIER);
 
     if (MustRecordSlots(heap)) {
       // Record the updated slot if necessary.
@@ -139,20 +140,26 @@ struct WeakListVisitor<Context> {
 };
 
 template <>
-struct WeakListVisitor<AllocationSite> {
-  static void SetWeakNext(Tagged<AllocationSite> obj, Tagged<HeapObject> next) {
-    obj->set_weak_next(next, UPDATE_WRITE_BARRIER);
+struct WeakListVisitor<AllocationSiteWithWeakNext> {
+  static void SetWeakNext(Tagged<AllocationSiteWithWeakNext> obj,
+                          Tagged<HeapObject> next) {
+    obj->set_weak_next(
+        Cast<UnionOf<Undefined, AllocationSiteWithWeakNext>>(next),
+        UPDATE_WRITE_BARRIER);
   }
 
-  static Tagged<Object> WeakNext(Tagged<AllocationSite> obj) {
+  static Tagged<Object> WeakNext(Tagged<AllocationSiteWithWeakNext> obj) {
     return obj->weak_next();
   }
 
-  static Tagged<HeapObject> WeakNextHolder(Tagged<AllocationSite> obj) {
+  static Tagged<HeapObject> WeakNextHolder(
+      Tagged<AllocationSiteWithWeakNext> obj) {
     return obj;
   }
 
-  static int WeakNextOffset() { return AllocationSite::kWeakNextOffset; }
+  static int WeakNextOffset() {
+    return offsetof(AllocationSiteWithWeakNext, weak_next_);
+  }
 
   static void VisitLiveObject(Heap*, Tagged<AllocationSite>,
                               WeakObjectRetainer*) {}
@@ -191,7 +198,7 @@ struct WeakListVisitor<JSFinalizationRegistry> {
 template Tagged<Object> VisitWeakList<Context>(Heap* heap, Tagged<Object> list,
                                                WeakObjectRetainer* retainer);
 
-template Tagged<Object> VisitWeakList<AllocationSite>(
+template Tagged<Object> VisitWeakList<AllocationSiteWithWeakNext>(
     Heap* heap, Tagged<Object> list, WeakObjectRetainer* retainer);
 
 template Tagged<Object> VisitWeakList<JSFinalizationRegistry>(
diff --git a/deps/v8/src/heap/heap-visitor.h b/deps/v8/src/heap/heap-visitor.h
index 2ee724764f6089..30db7210037b8b 100644
--- a/deps/v8/src/heap/heap-visitor.h
+++ b/deps/v8/src/heap/heap-visitor.h
@@ -53,7 +53,7 @@ class MaybeObjectSize final {
   V(Cell)                             \
   V(CodeWrapper)                      \
   V(ConsString)                       \
-  V(ContextSidePropertyCell)          \
+  V(ContextCell)                      \
   V(CoverageInfo)                     \
   V(DataHandler)                      \
   V(DebugInfo)                        \
@@ -65,6 +65,7 @@ class MaybeObjectSize final {
   V(Foreign)                          \
   V(FunctionTemplateInfo)             \
   V(HeapNumber)                       \
+  V(InterceptorInfo)                  \
   V(Hole)                             \
   V(Map)                              \
   V(NativeContext)                    \
@@ -91,7 +92,6 @@ class MaybeObjectSize final {
   V(TransitionArray)                  \
   V(WeakCell)                         \
   IF_WASM(V, WasmArray)               \
-  IF_WASM(V, WasmContinuationObject)  \
   IF_WASM(V, WasmFuncRef)             \
   IF_WASM(V, WasmMemoryMapDescriptor) \
   IF_WASM(V, WasmNull)                \
@@ -120,6 +120,7 @@ class MaybeObjectSize final {
   IF_WASM(V, WasmGlobalObject)              \
   IF_WASM(V, WasmInstanceObject)            \
   IF_WASM(V, WasmMemoryObject)              \
+  IF_WASM(V, WasmDescriptorOptions)         \
   IF_WASM(V, WasmSuspendingObject)          \
   IF_WASM(V, WasmTableObject)               \
   IF_WASM(V, WasmTagObject)
@@ -152,6 +153,7 @@ class MaybeObjectSize final {
   V(FunctionTemplateInfo)                                 \
   V(FreeSpace)                                            \
   V(HeapNumber)                                           \
+  V(InterceptorInfo)                                      \
   V(PreparseData)                                         \
   V(PropertyArray)                                        \
   V(PropertyCell)                                         \
@@ -265,6 +267,9 @@ class HeapVisitor : public ObjectVisitorWithCageBases {
                                      MaybeObjectSize maybe_object_size);
   V8_INLINE size_t VisitJSApiObject(Tagged<Map> map, Tagged<JSObject> object,
                                     MaybeObjectSize maybe_object_size);
+  V8_INLINE size_t VisitCppHeapExternalObject(
+      Tagged<Map> map, Tagged<CppHeapExternalObject> object,
+      MaybeObjectSize maybe_object_size);
   V8_INLINE size_t VisitStruct(Tagged<Map> map, Tagged<HeapObject> object,
                                MaybeObjectSize maybe_object_size);
   V8_INLINE size_t VisitFiller(Tagged<Map> map, Tagged<HeapObject> object,
diff --git a/deps/v8/src/heap/heap-write-barrier-inl.h b/deps/v8/src/heap/heap-write-barrier-inl.h
index 00b5a7dc72fee7..40c47b4236d22a 100644
--- a/deps/v8/src/heap/heap-write-barrier-inl.h
+++ b/deps/v8/src/heap/heap-write-barrier-inl.h
@@ -15,6 +15,7 @@
 #include "src/heap/marking-barrier.h"
 #include "src/heap/memory-chunk.h"
 #include "src/objects/compressed-slots-inl.h"
+#include "src/objects/cpp-heap-object-wrapper.h"
 #include "src/objects/descriptor-array.h"
 #include "src/objects/maybe-object-inl.h"
 
@@ -348,7 +349,7 @@ void WriteBarrier::MarkingFromTracedHandle(Tagged<Object> value) {
 }
 
 // static
-void WriteBarrier::ForCppHeapPointer(Tagged<JSObject> host,
+void WriteBarrier::ForCppHeapPointer(Tagged<CppHeapPointerWrapperObjectT> host,
                                      CppHeapPointerSlot slot, void* value) {
   // Note: this is currently a combined barrier for marking both the
   // CppHeapPointerTable entry and the referenced object.
@@ -375,8 +376,8 @@ void WriteBarrier::ForCppHeapPointer(Tagged<JSObject> host,
 }
 
 // static
-void WriteBarrier::GenerationalBarrierForCppHeapPointer(Tagged<JSObject> host,
-                                                        void* value) {
+void WriteBarrier::GenerationalBarrierForCppHeapPointer(
+    Tagged<CppHeapPointerWrapperObjectT> host, void* value) {
   if (!value) {
     return;
   }
diff --git a/deps/v8/src/heap/heap-write-barrier.cc b/deps/v8/src/heap/heap-write-barrier.cc
index 5a547bfed242d9..f90e4997f6d8c9 100644
--- a/deps/v8/src/heap/heap-write-barrier.cc
+++ b/deps/v8/src/heap/heap-write-barrier.cc
@@ -62,10 +62,9 @@ void WriteBarrier::MarkingSlowFromTracedHandle(Tagged<HeapObject> value) {
 }
 
 // static
-void WriteBarrier::MarkingSlowFromCppHeapWrappable(Heap* heap,
-                                                   Tagged<JSObject> host,
-                                                   CppHeapPointerSlot slot,
-                                                   void* object) {
+void WriteBarrier::MarkingSlowFromCppHeapWrappable(
+    Heap* heap, Tagged<CppHeapPointerWrapperObjectT> host,
+    CppHeapPointerSlot slot, void* object) {
   // Note: this is currently a combined barrier for marking both the
   // CppHeapPointerTable entry and the referenced object (if any).
 
diff --git a/deps/v8/src/heap/heap-write-barrier.h b/deps/v8/src/heap/heap-write-barrier.h
index 3b73ab2e1b0e13..92087067f5874f 100644
--- a/deps/v8/src/heap/heap-write-barrier.h
+++ b/deps/v8/src/heap/heap-write-barrier.h
@@ -10,6 +10,7 @@
 
 #include "include/v8-internal.h"
 #include "src/common/globals.h"
+#include "src/objects/cpp-heap-object-wrapper.h"
 #include "src/objects/heap-object.h"
 
 namespace v8::internal {
@@ -74,8 +75,9 @@ class V8_EXPORT_PRIVATE WriteBarrier final {
       Tagged<TrustedObject> host, ProtectedPointerSlot slot,
       Tagged<TrustedObject> value,
       WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
-  static inline void ForCppHeapPointer(Tagged<JSObject> host,
-                                       CppHeapPointerSlot slot, void* value);
+  static inline void ForCppHeapPointer(
+      Tagged<CppHeapPointerWrapperObjectT> host, CppHeapPointerSlot slot,
+      void* value);
   static inline void ForJSDispatchHandle(
       Tagged<HeapObject> host, JSDispatchHandle handle,
       WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
@@ -152,14 +154,14 @@ class V8_EXPORT_PRIVATE WriteBarrier final {
                           Tagged<TrustedObject> value);
   static void MarkingSlow(Tagged<HeapObject> host, JSDispatchHandle handle);
   static void MarkingSlowFromTracedHandle(Tagged<HeapObject> value);
-  static void MarkingSlowFromCppHeapWrappable(Heap* heap, Tagged<JSObject> host,
-                                              CppHeapPointerSlot slot,
-                                              void* object);
+  static void MarkingSlowFromCppHeapWrappable(
+      Heap* heap, Tagged<CppHeapPointerWrapperObjectT> host,
+      CppHeapPointerSlot slot, void* object);
 
   static void GenerationalBarrierSlow(Tagged<HeapObject> object, Address slot,
                                       Tagged<HeapObject> value);
-  static inline void GenerationalBarrierForCppHeapPointer(Tagged<JSObject> host,
-                                                          void* value);
+  static inline void GenerationalBarrierForCppHeapPointer(
+      Tagged<CppHeapPointerWrapperObjectT> host, void* value);
 
   static void SharedSlow(Tagged<TrustedObject> host, ProtectedPointerSlot slot,
                          Tagged<TrustedObject> value);
diff --git a/deps/v8/src/heap/heap.cc b/deps/v8/src/heap/heap.cc
index f4e94e406e2690..f1500d72aec046 100644
--- a/deps/v8/src/heap/heap.cc
+++ b/deps/v8/src/heap/heap.cc
@@ -49,6 +49,7 @@
 #include "src/heap/collection-barrier.h"
 #include "src/heap/combined-heap.h"
 #include "src/heap/concurrent-marking.h"
+#include "src/heap/conservative-stack-visitor-inl.h"
 #include "src/heap/cppgc-js/cpp-heap.h"
 #include "src/heap/ephemeron-remembered-set.h"
 #include "src/heap/evacuation-verifier-inl.h"
@@ -64,7 +65,6 @@
 #include "src/heap/heap-visitor-inl.h"
 #include "src/heap/heap-visitor.h"
 #include "src/heap/heap-write-barrier-inl.h"
-#include "src/heap/incremental-marking-inl.h"
 #include "src/heap/incremental-marking.h"
 #include "src/heap/large-spaces.h"
 #include "src/heap/local-heap-inl.h"
@@ -104,6 +104,7 @@
 #include "src/logging/log.h"
 #include "src/logging/runtime-call-stats-scope.h"
 #include "src/numbers/conversions.h"
+#include "src/objects/allocation-site.h"
 #include "src/objects/data-handler.h"
 #include "src/objects/free-space-inl.h"
 #include "src/objects/hash-table-inl.h"
@@ -128,10 +129,6 @@
 #include "src/utils/utils-inl.h"
 #include "src/utils/utils.h"
 
-#ifdef V8_ENABLE_CONSERVATIVE_STACK_SCANNING
-#include "src/heap/conservative-stack-visitor-inl.h"
-#endif  // V8_ENABLE_CONSERVATIVE_STACK_SCANNING
-
 #if V8_ENABLE_WEBASSEMBLY
 #include "src/wasm/wasm-engine.h"
 #endif  // V8_ENABLE_WEBASSEMBLY
@@ -475,6 +472,14 @@ bool Heap::ShouldOptimizeForBattery() const {
 GarbageCollector Heap::SelectGarbageCollector(AllocationSpace space,
                                               GarbageCollectionReason gc_reason,
                                               const char** reason) const {
+  if (gc_reason == GarbageCollectionReason::kFinalizeMinorMSForMajorGC) {
+    DCHECK_NE(static_cast<bool>(new_space()),
+              v8_flags.sticky_mark_bits.value());
+    DCHECK(!ShouldReduceMemory());
+    *reason = "MinorMS finalization for starting major GC";
+    return GarbageCollector::MINOR_MARK_SWEEPER;
+  }
+
   if (gc_reason == GarbageCollectionReason::kFinalizeConcurrentMinorMS) {
     DCHECK_NE(static_cast<bool>(new_space()),
               v8_flags.sticky_mark_bits.value());
@@ -482,7 +487,6 @@ GarbageCollector Heap::SelectGarbageCollector(AllocationSpace space,
     *reason = "Concurrent MinorMS needs finalization";
     return GarbageCollector::MINOR_MARK_SWEEPER;
   }
-
   // Is global GC requested?
   if (space != NEW_SPACE && space != NEW_LO_SPACE) {
     isolate_->counters()->gc_compactor_caused_by_request()->Increment();
@@ -495,21 +499,11 @@ GarbageCollector Heap::SelectGarbageCollector(AllocationSpace space,
     return GarbageCollector::MARK_COMPACTOR;
   }
 
-  if (v8_flags.separate_gc_phases && incremental_marking()->IsMajorMarking()) {
-    // TODO(v8:12503): Remove next condition (allocation limit overshot) when
-    // separate_gc_phases flag is enabled and removed.
+  if (incremental_marking()->IsMajorMarking()) {
     *reason = "Incremental marking forced finalization";
     return GarbageCollector::MARK_COMPACTOR;
   }
 
-  if (incremental_marking()->IsMajorMarking() &&
-      incremental_marking()->IsMajorMarkingComplete() &&
-      AllocationLimitOvershotByLargeMargin()) {
-    DCHECK(!v8_flags.minor_ms);
-    *reason = "Incremental marking needs finalization";
-    return GarbageCollector::MARK_COMPACTOR;
-  }
-
   if (!CanPromoteYoungAndExpandOldGeneration(0)) {
     isolate_->counters()
         ->gc_compactor_caused_by_oldspace_exhaustion()
@@ -555,7 +549,7 @@ bool Heap::CanShortcutStringsDuringGC(GarbageCollector collector) const {
       break;
     case GarbageCollector::SCAVENGER:
       // Scavenger cannot short cut strings during incremental marking.
-      if (incremental_marking()->IsMajorMarking()) return false;
+      DCHECK(!incremental_marking()->IsMajorMarking());
 
       if (isolate()->has_shared_space() &&
           !isolate()->is_shared_space_isolate() &&
@@ -582,90 +576,96 @@ bool Heap::CanShortcutStringsDuringGC(GarbageCollector collector) const {
 void Heap::PrintShortHeapStatistics() {
   if (!v8_flags.trace_gc_verbose) return;
   PrintIsolate(isolate_,
-               "Memory allocator,       used: %6zu KB,"
-               " available: %6zu KB\n",
+               "Memory allocator,           used: %6zu KB"
+               ", available:  %7zu KB\n",
                memory_allocator()->Size() / KB,
                memory_allocator()->Available() / KB);
   PrintIsolate(isolate_,
-               "Read-only space,        used: %6zu KB"
-               ", available: %6zu KB"
+               "Read-only space,            used: %6zu KB"
+               ", available:  %7zu KB"
                ", committed: %6zu KB\n",
                read_only_space_->Size() / KB, size_t{0},
                read_only_space_->CommittedMemory() / KB);
   PrintIsolate(isolate_,
-               "New space,              used: %6zu KB"
-               ", available: %6zu KB%s"
+               "New space,                  used: %6zu KB"
+               ", available:%c %7zu KB"
                ", committed: %6zu KB\n",
-               NewSpaceSize() / KB, new_space_->Available() / KB,
-               (v8_flags.minor_ms && minor_sweeping_in_progress()) ? "*" : "",
+               NewSpaceSize() / KB,
+               (v8_flags.minor_ms && minor_sweeping_in_progress()) ? '*' : ' ',
+               new_space_->Available() / KB,
                new_space_->CommittedMemory() / KB);
   PrintIsolate(isolate_,
-               "New large object space, used: %6zu KB"
-               ", available: %6zu KB"
+               "New large object space,     used: %6zu KB"
+               ", available:  %7zu KB"
                ", committed: %6zu KB\n",
                new_lo_space_->SizeOfObjects() / KB,
                new_lo_space_->Available() / KB,
                new_lo_space_->CommittedMemory() / KB);
   PrintIsolate(isolate_,
-               "Old space,              used: %6zu KB"
-               ", available: %6zu KB%s"
+               "Old space,                  used: %6zu KB"
+               ", available:%c %7zu KB"
                ", committed: %6zu KB\n",
-               old_space_->SizeOfObjects() / KB, old_space_->Available() / KB,
-               major_sweeping_in_progress() ? "*" : "",
+               old_space_->SizeOfObjects() / KB,
+               major_sweeping_in_progress() ? '*' : ' ',
+               old_space_->Available() / KB,
                old_space_->CommittedMemory() / KB);
   PrintIsolate(isolate_,
-               "Code space,             used: %6zu KB"
-               ", available: %6zu KB%s"
+               "Code space,                 used: %6zu KB"
+               ", available:%c %7zu KB"
                ", committed: %6zu KB\n",
-               code_space_->SizeOfObjects() / KB, code_space_->Available() / KB,
-               major_sweeping_in_progress() ? "*" : "",
+               code_space_->SizeOfObjects() / KB,
+               major_sweeping_in_progress() ? '*' : ' ',
+               code_space_->Available() / KB,
                code_space_->CommittedMemory() / KB);
   PrintIsolate(isolate_,
-               "Large object space,     used: %6zu KB"
-               ", available: %6zu KB"
+               "Large object space,         used: %6zu KB"
+               ", available:  %7zu KB"
                ", committed: %6zu KB\n",
                lo_space_->SizeOfObjects() / KB, lo_space_->Available() / KB,
                lo_space_->CommittedMemory() / KB);
   PrintIsolate(isolate_,
-               "Code large object space,     used: %6zu KB"
-               ", available: %6zu KB"
+               "Code large object space,    used: %6zu KB"
+               ", available:  %7zu KB"
                ", committed: %6zu KB\n",
                code_lo_space_->SizeOfObjects() / KB,
                code_lo_space_->Available() / KB,
                code_lo_space_->CommittedMemory() / KB);
   PrintIsolate(isolate_,
                "Trusted space,              used: %6zu KB"
-               ", available: %6zu KB%s"
+               ", available:%c %7zu KB"
                ", committed: %6zu KB\n",
                trusted_space_->SizeOfObjects() / KB,
+               major_sweeping_in_progress() ? '*' : ' ',
                trusted_space_->Available() / KB,
-               major_sweeping_in_progress() ? "*" : "",
                trusted_space_->CommittedMemory() / KB);
   PrintIsolate(isolate_,
-               "Trusted large object space,     used: %6zu KB"
-               ", available: %6zu KB"
+               "Trusted large object space, used: %6zu KB"
+               ", available:  %7zu KB"
                ", committed: %6zu KB\n",
                trusted_lo_space_->SizeOfObjects() / KB,
                trusted_lo_space_->Available() / KB,
                trusted_lo_space_->CommittedMemory() / KB);
   ReadOnlySpace* const ro_space = read_only_space_;
   PrintIsolate(isolate_,
-               "All spaces,             used: %6zu KB"
-               ", available: %6zu KB%s"
+               "All spaces,                 used: %6zu KB"
+               ", available:%c %7zu KB"
                ", committed: %6zu KB\n",
                (this->SizeOfObjects() + ro_space->Size()) / KB,
-               (this->Available()) / KB, sweeping_in_progress() ? "*" : "",
+               sweeping_in_progress() ? '*' : ' ', (this->Available()) / KB,
                (this->CommittedMemory() + ro_space->CommittedMemory()) / KB);
   const size_t chunks = memory_allocator()->GetPooledChunksCount();
-  PrintIsolate(isolate_, "Pool buffering %zu chunks of committed: %6zu KB\n",
+  PrintIsolate(isolate_, "Pool buffering %4zu chunk(s) of committed: %7zu KB\n",
                chunks, (chunks * PageMetadata::kPageSize) / KB);
-  PrintIsolate(isolate_, "External memory reported: %6" PRId64 " KB\n",
+  PrintIsolate(isolate_,
+               "External memory reported:                  %7" PRId64 " KB\n",
                external_memory() / KB);
-  PrintIsolate(isolate_, "Backing store memory: %6" PRIu64 " KB\n",
+  PrintIsolate(isolate_,
+               "Backing store memory:                      %7" PRIu64 " KB\n",
                backing_store_bytes() / KB);
-  PrintIsolate(isolate_, "External memory global %zu KB\n",
+  PrintIsolate(isolate_, "External memory global:                    %7zu KB\n",
                external_memory_callback_() / KB);
-  PrintIsolate(isolate_, "Total time spent in GC  : %.1f ms\n",
+  PrintIsolate(isolate_,
+               "Total time spent in GC:                    %7.1f ms\n",
                total_gc_time_ms_.InMillisecondsF());
   if (sweeping_in_progress()) {
     PrintIsolate(isolate_,
@@ -1126,9 +1126,7 @@ void Heap::GarbageCollectionEpilogueInSafepoint(GarbageCollector collector) {
 
   // Young generation GCs only run with  memory reducing flags during
   // interleaved GCs.
-  DCHECK_IMPLIES(
-      v8_flags.separate_gc_phases && IsYoungGenerationCollector(collector),
-      !ShouldReduceMemory());
+  DCHECK_IMPLIES(IsYoungGenerationCollector(collector), !ShouldReduceMemory());
   if (collector == GarbageCollector::MARK_COMPACTOR) {
     memory_pressure_level_.store(MemoryPressureLevel::kNone,
                                  std::memory_order_relaxed);
@@ -1231,7 +1229,7 @@ size_t MinorMSConcurrentMarkingTrigger(Heap* heap) {
 }
 }  // namespace
 
-void Heap::StartMinorMSIncrementalMarkingIfNeeded() {
+void Heap::StartMinorMSConcurrentMarkingIfNeeded() {
   if (incremental_marking()->IsMarking()) return;
   if (v8_flags.concurrent_minor_ms_marking && !IsTearingDown() &&
       incremental_marking()->CanAndShouldBeStarted() &&
@@ -1328,6 +1326,18 @@ void ReportDuplicates(int size, std::vector<Tagged<HeapObject>>* objects) {
     PrintF("============================\n");
   }
 }
+
+// Frees caches when under memory pressure. The method assumes that callsites
+// are close to crashing and will very aggressively free memory.
+void FreeCachesOnMemoryPressure(Isolate* isolate) {
+  isolate->AbortConcurrentOptimization(BlockingBehavior::kDontBlock);
+  isolate->ClearSerializerData();
+  isolate->compilation_cache()->Clear();
+  if (v8_flags.discard_memory_pool_before_memory_pressure_gcs) {
+    IsolateGroup::current()->page_pool()->ReleaseImmediately();
+  }
+}
+
 }  // anonymous namespace
 
 void Heap::CollectAllAvailableGarbage(GarbageCollectionReason gc_reason) {
@@ -1356,10 +1366,7 @@ void Heap::CollectAllAvailableGarbage(GarbageCollectionReason gc_reason) {
   }
   RCS_SCOPE(isolate(), RuntimeCallCounterId::kGC_Custom_AllAvailableGarbage);
 
-  // The optimizing compiler may be unnecessarily holding on to memory.
-  isolate()->AbortConcurrentOptimization(BlockingBehavior::kDontBlock);
-  isolate()->ClearSerializerData();
-  isolate()->compilation_cache()->Clear();
+  FreeCachesOnMemoryPressure(isolate());
 
   GCFlags gc_flags = GCFlag::kReduceMemoryFootprint;
 
@@ -1607,7 +1614,7 @@ void Heap::CollectGarbage(AllocationSpace space,
     // Minor GCs should not be memory reducing.
     current_gc_flags_ &= ~GCFlag::kReduceMemoryFootprint;
     CollectGarbage(NEW_SPACE,
-                   GarbageCollectionReason::kFinalizeConcurrentMinorMS);
+                   GarbageCollectionReason::kFinalizeMinorMSForMajorGC);
     current_gc_flags_ = gc_flags;
   }
 
@@ -1709,17 +1716,16 @@ void Heap::CollectGarbage(AllocationSpace space,
     // order; the latter may replace the current event with that of an
     // interrupted full cycle.
     if (IsYoungGenerationCollector(collector)) {
-      tracer()->StopYoungCycleIfNeeded();
+      tracer()->StopYoungCycleIfFinished();
     } else {
-      tracer()->StopFullCycleIfNeeded();
+      tracer()->StopFullCycleIfFinished();
     }
     RecomputeLimits(collector, base::TimeTicks::Now());
   });
 
   if ((collector == GarbageCollector::MARK_COMPACTOR) &&
       is_full_gc_during_loading_) {
-    if (ShouldOptimizeForLoadTime() &&
-        v8_flags.update_allocation_limits_after_loading) {
+    if (ShouldOptimizeForLoadTime()) {
       update_allocation_limits_after_loading_ = true;
     }
     is_full_gc_during_loading_ = false;
@@ -1753,6 +1759,10 @@ void Heap::CollectGarbage(AllocationSpace space,
     StartIncrementalMarkingIfAllocationLimitIsReached(
         main_thread_local_heap(), GCFlagsForIncrementalMarking(),
         kGCCallbackScheduleIdleGarbageCollection);
+    if (v8_flags.minor_ms &&
+        (gc_reason != GarbageCollectionReason::kFinalizeMinorMSForMajorGC)) {
+      StartMinorMSConcurrentMarkingIfNeeded();
+    }
   }
 
   if (!CanExpandOldGeneration(0)) {
@@ -1884,7 +1894,7 @@ void Heap::StartIncrementalMarking(GCFlags gc_flags,
                 !isolate()->InFastCCall());
   DCHECK_EQ(isolate(), Isolate::TryGetCurrent());
 
-  if (v8_flags.separate_gc_phases && gc_callbacks_depth_ > 0) {
+  if (gc_callbacks_depth_ > 0) {
     // Do not start incremental marking while invoking GC callbacks.
     // Heap::CollectGarbage already decided which GC is going to be
     // invoked. In case it chose a young-gen GC, starting an incremental
@@ -2265,13 +2275,6 @@ void Heap::PerformGarbageCollection(GarbageCollector collector,
   UpdateSurvivalStatistics(static_cast<int>(start_young_generation_size));
   ShrinkOldGenerationAllocationLimitIfNotConfigured();
 
-  if (collector == GarbageCollector::SCAVENGER) {
-    // Objects that died in the new space might have been accounted
-    // as bytes marked ahead of schedule by the incremental marker.
-    incremental_marking()->UpdateMarkedBytesAfterScavenge(
-        start_young_generation_size - SurvivedYoungObjectSize());
-  }
-
   isolate_->counters()->objs_since_last_young()->Set(0);
 
   isolate_->eternal_handles()->PostGarbageCollectionProcessing();
@@ -2410,16 +2413,13 @@ bool Heap::CollectGarbageFromAnyThread(LocalHeap* local_heap,
 
 void Heap::CompleteSweepingYoung() {
   DCHECK(!v8_flags.sticky_mark_bits);
-  CompleteArrayBufferSweeping(this);
 
   // If sweeping is in progress and there are no sweeper tasks running, finish
   // the sweeping here, to avoid having to pause and resume during the young
   // generation GC.
   FinishSweepingIfOutOfWork();
 
-  if (v8_flags.minor_ms) {
-    EnsureYoungSweepingCompleted();
-  }
+  EnsureYoungSweepingCompleted();
 
 #if defined(CPPGC_YOUNG_GENERATION)
   // Always complete sweeping if young generation is enabled.
@@ -2470,8 +2470,6 @@ Heap::LimitsCompuatationResult Heap::ComputeNewAllocationLimits(Heap* heap) {
                 heap, heap->max_global_memory_size_, embedder_gc_speed,
                 embedder_speed, mode)
           : 0;
-  double global_growing_factor =
-      std::max(v8_growing_factor, embedder_growing_factor);
 
   size_t new_space_capacity = heap->NewSpaceTargetCapacity();
 
@@ -2482,11 +2480,22 @@ Heap::LimitsCompuatationResult Heap::ComputeNewAllocationLimits(Heap* heap) {
           heap->min_old_generation_size_, heap->max_old_generation_size(),
           new_space_capacity, mode);
 
+  double global_growing_factor =
+      std::max(v8_growing_factor, embedder_growing_factor);
+  double external_growing_factor = std::min(
+      global_growing_factor, GlobalMemoryTrait::kConservativeGrowingFactor);
   DCHECK_GT(global_growing_factor, 0);
+  DCHECK_GT(external_growing_factor, 0);
   size_t new_global_allocation_limit =
       MemoryController<GlobalMemoryTrait>::BoundAllocationLimit(
           heap, heap->GlobalConsumedBytesAtLastGC(),
-          heap->GlobalConsumedBytesAtLastGC() * global_growing_factor,
+          (heap->OldGenerationConsumedBytesAtLastGC() +
+           heap->embedder_size_at_last_gc_) *
+                  global_growing_factor +
+              (v8_flags.external_memory_accounted_in_global_limit
+                   ? heap->external_memory_.low_since_mark_compact() *
+                         external_growing_factor
+                   : 0),
           heap->min_global_memory_size_, heap->max_global_memory_size_,
           new_space_capacity, mode);
 
@@ -2539,11 +2548,6 @@ void Heap::RecomputeLimits(GarbageCollector collector, base::TimeTicks time) {
 }
 
 void Heap::RecomputeLimitsAfterLoadingIfNeeded() {
-  if (!v8_flags.update_allocation_limits_after_loading) {
-    DCHECK(!update_allocation_limits_after_loading_);
-    return;
-  }
-
   if (!update_allocation_limits_after_loading_) {
     return;
   }
@@ -2684,31 +2688,9 @@ void Heap::MarkCompactPrologue() {
 
 void Heap::Scavenge() {
   DCHECK_NOT_NULL(new_space());
-  DCHECK_IMPLIES(v8_flags.separate_gc_phases,
-                 !incremental_marking()->IsMarking());
-
-  if (v8_flags.trace_incremental_marking &&
-      !incremental_marking()->IsStopped()) {
-    isolate()->PrintWithTimestamp(
-        "[IncrementalMarking] Scavenge during marking.\n");
-  }
+  DCHECK(!incremental_marking()->IsMarking());
 
   TRACE_GC(tracer(), GCTracer::Scope::SCAVENGER_SCAVENGE);
-  base::MutexGuard guard(relocation_mutex());
-  // Young generation garbage collection is orthogonal from full GC marking. It
-  // is possible that objects that are currently being processed for marking are
-  // reclaimed in the young generation GC that interleaves concurrent marking.
-  // Pause concurrent markers to allow processing them using
-  // `UpdateMarkingWorklistAfterYoungGenGC()`.
-  ConcurrentMarking::PauseScope pause_js_marking(concurrent_marking());
-  CppHeap::PauseConcurrentMarkingScope pause_cpp_marking(
-      CppHeap::From(cpp_heap_));
-
-  // Bump-pointer allocations done during scavenge are not real allocations.
-  // Pause the inline allocation steps.
-  IncrementalMarking::PauseBlackAllocationScope pause_black_allocation(
-      incremental_marking());
-
   SetGCState(SCAVENGE);
 
   // Implements Cheney's copying algorithm
@@ -2932,8 +2914,11 @@ void Heap::ProcessNativeContexts(WeakObjectRetainer* retainer) {
 
 void Heap::ProcessAllocationSites(WeakObjectRetainer* retainer) {
   Tagged<Object> allocation_site_obj =
-      VisitWeakList<AllocationSite>(this, allocation_sites_list(), retainer);
-  set_allocation_sites_list(allocation_site_obj);
+      VisitWeakList<AllocationSiteWithWeakNext>(this, allocation_sites_list(),
+                                                retainer);
+  set_allocation_sites_list(
+      Cast<UnionOf<Undefined, AllocationSiteWithWeakNext>>(
+          allocation_site_obj));
 }
 
 void Heap::ProcessDirtyJSFinalizationRegistries(WeakObjectRetainer* retainer) {
@@ -2949,7 +2934,9 @@ void Heap::ProcessDirtyJSFinalizationRegistries(WeakObjectRetainer* retainer) {
 
 void Heap::ProcessWeakListRoots(WeakObjectRetainer* retainer) {
   set_native_contexts_list(retainer->RetainAs(native_contexts_list()));
-  set_allocation_sites_list(retainer->RetainAs(allocation_sites_list()));
+  set_allocation_sites_list(
+      Cast<UnionOf<Smi, Undefined, AllocationSiteWithWeakNext>>(
+          retainer->RetainAs(allocation_sites_list())));
   set_dirty_js_finalization_registries_list(
       retainer->RetainAs(dirty_js_finalization_registries_list()));
   set_dirty_js_finalization_registries_list_tail(
@@ -2962,7 +2949,8 @@ void Heap::ForeachAllocationSite(
   DisallowGarbageCollection no_gc;
   Tagged<Object> current = list;
   while (IsAllocationSite(current)) {
-    Tagged<AllocationSite> site = Cast<AllocationSite>(current);
+    Tagged<AllocationSiteWithWeakNext> site =
+        Cast<AllocationSiteWithWeakNext>(current);
     visitor(site);
     Tagged<Object> current_nested = site->nested_site();
     while (IsAllocationSite(current_nested)) {
@@ -3096,8 +3084,7 @@ void* Heap::AllocateExternalBackingStore(
   if (!always_allocate() && new_space()) {
     size_t new_space_backing_store_bytes =
         new_space()->ExternalBackingStoreOverallBytes();
-    if ((!v8_flags.separate_gc_phases ||
-         !incremental_marking()->IsMajorMarking()) &&
+    if ((!incremental_marking()->IsMajorMarking()) &&
         new_space_backing_store_bytes >= 2 * DefaultMaxSemiSpaceSize() &&
         new_space_backing_store_bytes >= byte_length) {
       // Performing a young generation GC amortizes over the allocated backing
@@ -3127,6 +3114,7 @@ void* Heap::AllocateExternalBackingStore(
 void Heap::ShrinkOldGenerationAllocationLimitIfNotConfigured() {
   if (using_initial_limit() && !initial_size_overwritten_ &&
       tracer()->SurvivalEventsRecorded()) {
+    base::MutexGuard guard(old_space()->mutex());
     const size_t minimum_growing_step =
         MemoryController<V8HeapTrait>::MinimumAllocationLimitGrowingStep(
             CurrentHeapGrowingMode());
@@ -4155,8 +4143,7 @@ class MemoryPressureInterruptTask : public CancelableTask {
 
 void Heap::CheckMemoryPressure() {
   if (HighMemoryPressure()) {
-    // The optimizing compiler may be unnecessarily holding on to memory.
-    isolate()->AbortConcurrentOptimization(BlockingBehavior::kDontBlock);
+    FreeCachesOnMemoryPressure(isolate());
   }
   // Reset the memory pressure level to avoid recursive GCs triggered by
   // CheckMemoryPressure from AdjustAmountOfExternalMemory called by
@@ -4864,8 +4851,7 @@ void Heap::IterateStackRoots(RootVisitor* v) { isolate_->Iterate(v); }
 
 void Heap::IterateConservativeStackRoots(RootVisitor* root_visitor,
                                          IterateRootsMode roots_mode) {
-#ifdef V8_ENABLE_CONSERVATIVE_STACK_SCANNING
-  if (!IsGCWithStack()) return;
+  if (!v8_flags.conservative_stack_scanning || !IsGCWithStack()) return;
 
   // In case of a shared GC, we're interested in the main isolate for CSS.
   Isolate* main_isolate = roots_mode == IterateRootsMode::kClientIsolate
@@ -4874,7 +4860,6 @@ void Heap::IterateConservativeStackRoots(RootVisitor* root_visitor,
 
   ConservativeStackVisitor stack_visitor(main_isolate, root_visitor);
   IterateConservativeStackRoots(&stack_visitor);
-#endif  // V8_ENABLE_CONSERVATIVE_STACK_SCANNING
 }
 
 void Heap::IterateConservativeStackRoots(
@@ -5113,7 +5098,7 @@ void Heap::ConfigureHeap(const v8::ResourceConstraints& constraints,
   DCHECK(kMaxRegularHeapObjectSize >=
          (JSArray::kHeaderSize +
           FixedArray::SizeFor(JSArray::kInitialMaxFastElementArray) +
-          ALIGN_TO_ALLOCATION_ALIGNMENT(AllocationMemento::kSize)));
+          ALIGN_TO_ALLOCATION_ALIGNMENT(sizeof(AllocationMemento))));
 
   code_range_size_ = constraints.code_range_size_in_bytes();
 
@@ -5287,7 +5272,7 @@ bool Heap::AllocationLimitOvershotByLargeMargin() const {
   if (!v8_flags.external_memory_accounted_in_global_limit) {
     size_now += AllocatedExternalMemorySinceMarkCompact();
   }
-  if (v8_flags.separate_gc_phases && incremental_marking()->IsMajorMarking()) {
+  if (incremental_marking()->IsMajorMarking()) {
     // No interleaved GCs, so we count young gen as part of old gen.
     size_now += YoungGenerationConsumedBytes();
   }
@@ -5993,18 +5978,15 @@ void Heap::NotifyDeserializationComplete() {
 
   FreeMainThreadLinearAllocationAreas();
 
+#if DEBUG
   PagedSpaceIterator spaces(this);
   for (PagedSpace* s = spaces.Next(); s != nullptr; s = spaces.Next()) {
-    // Shared space is used concurrently and cannot be shrunk.
-    if (s->identity() == SHARED_SPACE) continue;
-    if (isolate()->snapshot_available()) s->ShrinkImmortalImmovablePages();
-#ifdef DEBUG
     // All pages right after bootstrapping must be marked as never-evacuate.
     for (PageMetadata* p : *s) {
       DCHECK(p->Chunk()->NeverEvacuate());
     }
-#endif  // DEBUG
   }
+#endif  // DEBUG
 
   if (v8_flags.stress_concurrent_allocation) {
     stress_concurrent_allocation_observer_.reset(
@@ -6098,10 +6080,18 @@ const ::heap::base::Stack& Heap::stack() const {
 
 void Heap::StartTearDown() {
   if (cpp_heap_) {
+    // This may invoke a GC in case marking is running to get us into a
+    // well-defined state for tear down.
     CppHeap::From(cpp_heap_)->StartDetachingIsolate();
   }
 
-  // Finish any ongoing sweeping to avoid stray background tasks still accessing
+  // Stressing incremental marking should make it likely to force a GC here with
+  // a CppHeap present. Stress compaction serves as a more deterministic way to
+  // trigger such a GC.
+  if (v8_flags.stress_compaction) {
+    CollectGarbage(OLD_SPACE, GarbageCollectionReason::kTesting);
+  }
+
   // the heap during teardown.
   CompleteSweepingFull();
 
@@ -7299,6 +7289,8 @@ void Heap::FinishSweepingIfOutOfWork() {
 void Heap::EnsureSweepingCompleted(SweepingForcedFinalizationMode mode) {
   CompleteArrayBufferSweeping(this);
 
+  EnsureQuarantinedPagesSweepingCompleted();
+
   if (sweeper()->sweeping_in_progress()) {
     bool was_minor_sweeping_in_progress = minor_sweeping_in_progress();
     bool was_major_sweeping_in_progress = major_sweeping_in_progress();
@@ -7314,6 +7306,7 @@ void Heap::EnsureSweepingCompleted(SweepingForcedFinalizationMode mode) {
       code_space()->RefillFreeList();
       if (shared_space()) {
         shared_space()->RefillFreeList();
+        shared_trusted_space()->RefillFreeList();
       }
 
       trusted_space()->RefillFreeList();
@@ -7336,7 +7329,7 @@ void Heap::EnsureSweepingCompleted(SweepingForcedFinalizationMode mode) {
       paged_new_space()->paged_space()->RefillFreeList();
     }
 
-    tracer()->NotifyFullSweepingCompleted();
+    tracer()->NotifyFullSweepingCompletedAndStopCycleIfFinished();
 
 #ifdef VERIFY_HEAP
     if (v8_flags.verify_heap) {
@@ -7367,7 +7360,18 @@ void Heap::EnsureSweepingCompleted(SweepingForcedFinalizationMode mode) {
   }
 }
 
+void Heap::EnsureQuarantinedPagesSweepingCompleted() {
+  if (v8_flags.minor_ms) {
+    return;
+  }
+  scavenger_collector_->CompleteSweepingQuarantinedPagesIfNeeded();
+}
+
 void Heap::EnsureYoungSweepingCompleted() {
+  CompleteArrayBufferSweeping(this);
+
+  EnsureQuarantinedPagesSweepingCompleted();
+
   if (!sweeper()->minor_sweeping_in_progress()) return;
   DCHECK(!v8_flags.sticky_mark_bits);
 
@@ -7380,13 +7384,11 @@ void Heap::EnsureYoungSweepingCompleted() {
   sweeper()->EnsureMinorCompleted();
   paged_new_space()->paged_space()->RefillFreeList();
 
-  tracer()->NotifyYoungSweepingCompleted();
+  tracer()->NotifyYoungSweepingCompletedAndStopCycleIfFinished();
 }
 
 void Heap::NotifyLoadingStarted() {
-  if (v8_flags.update_allocation_limits_after_loading) {
-    update_allocation_limits_after_loading_ = true;
-  }
+  update_allocation_limits_after_loading_ = true;
   double now_ms = MonotonicallyIncreasingTimeInMs();
   DCHECK_NE(now_ms, kLoadTimeNotLoading);
   load_start_time_ms_.store(now_ms, std::memory_order_relaxed);
diff --git a/deps/v8/src/heap/heap.h b/deps/v8/src/heap/heap.h
index f2c5a25010d2a8..102132e9fc5124 100644
--- a/deps/v8/src/heap/heap.h
+++ b/deps/v8/src/heap/heap.h
@@ -281,10 +281,6 @@ class Heap final {
     std::atomic<uint64_t> low_since_mark_compact_{0};
   };
 
-  // Taking this mutex prevents the GC from entering a phase that relocates
-  // object references.
-  base::Mutex* relocation_mutex() { return &relocation_mutex_; }
-
   // Support for context snapshots.  After calling this we have a linear
   // space to write objects in each space.
   struct Chunk {
@@ -467,10 +463,14 @@ class Heap final {
         native_contexts_list_.load(std::memory_order_acquire));
   }
 
-  void set_allocation_sites_list(Tagged<Object> object) {
+  void set_allocation_sites_list(
+      Tagged<UnionOf<Smi, Undefined, AllocationSiteWithWeakNext>> object) {
     allocation_sites_list_ = object;
   }
-  Tagged<Object> allocation_sites_list() { return allocation_sites_list_; }
+  Tagged<UnionOf<Smi, Undefined, AllocationSiteWithWeakNext>>
+  allocation_sites_list() {
+    return allocation_sites_list_;
+  }
 
   void set_dirty_js_finalization_registries_list(Tagged<Object> object) {
     dirty_js_finalization_registries_list_ = object;
@@ -798,6 +798,7 @@ class Heap final {
   // ===========================================================================
 
   GCTracer* tracer() { return tracer_.get(); }
+  const GCTracer* tracer() const { return tracer_.get(); }
 
   MemoryAllocator* memory_allocator() { return memory_allocator_.get(); }
   const MemoryAllocator* memory_allocator() const {
@@ -854,8 +855,6 @@ class Heap final {
   MUTABLE_ROOT_LIST(ROOT_ACCESSOR)
 #undef ROOT_ACCESSOR
 
-  V8_INLINE Tagged<FixedArray> single_character_string_table();
-
   V8_INLINE void SetRootMaterializedObjects(Tagged<FixedArray> objects);
   V8_INLINE void SetRootScriptList(Tagged<Object> value);
   V8_INLINE void SetRootNoScriptSharedFunctionInfos(Tagged<Object> value);
@@ -1549,6 +1548,7 @@ class Heap final {
   V8_EXPORT_PRIVATE void EnsureSweepingCompleted(
       SweepingForcedFinalizationMode mode);
   void EnsureYoungSweepingCompleted();
+  void EnsureQuarantinedPagesSweepingCompleted();
 
   // =============================================================================
 
@@ -1986,7 +1986,7 @@ class Heap final {
   // GC Tasks. =================================================================
   // ===========================================================================
 
-  V8_EXPORT_PRIVATE void StartMinorMSIncrementalMarkingIfNeeded();
+  V8_EXPORT_PRIVATE void StartMinorMSConcurrentMarkingIfNeeded();
   bool MinorMSSizeTaskTriggerReached() const;
 
   MinorGCJob* minor_gc_job() { return minor_gc_job_.get(); }
@@ -2230,7 +2230,8 @@ class Heap final {
   // {native_contexts_list_} is an Address instead of an Object to allow the use
   // of atomic accessors.
   std::atomic<Address> native_contexts_list_;
-  Tagged<Object> allocation_sites_list_ = Smi::zero();
+  Tagged<UnionOf<Smi, Undefined, AllocationSiteWithWeakNext>>
+      allocation_sites_list_ = Smi::zero();
   Tagged<Object> dirty_js_finalization_registries_list_ = Smi::zero();
   // Weak list tails.
   Tagged<Object> dirty_js_finalization_registries_list_tail_ = Smi::zero();
@@ -2362,8 +2363,6 @@ class Heap final {
 
   const AllocationType allocation_type_for_in_place_internalizable_strings_;
 
-  base::Mutex relocation_mutex_;
-
   std::unique_ptr<CollectionBarrier> collection_barrier_;
 
   int ignore_local_gc_requests_depth_ = 0;
diff --git a/deps/v8/src/heap/incremental-marking-inl.h b/deps/v8/src/heap/incremental-marking-inl.h
deleted file mode 100644
index f4c05698d8218b..00000000000000
--- a/deps/v8/src/heap/incremental-marking-inl.h
+++ /dev/null
@@ -1,43 +0,0 @@
-// Copyright 2012 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_HEAP_INCREMENTAL_MARKING_INL_H_
-#define V8_HEAP_INCREMENTAL_MARKING_INL_H_
-
-#include "src/heap/incremental-marking.h"
-// Include the non-inl header before the rest of the headers.
-
-#include "src/common/globals.h"
-#include "src/execution/isolate.h"
-#include "src/heap/heap-inl.h"
-#include "src/heap/marking-state-inl.h"
-#include "src/objects/descriptor-array.h"
-
-namespace v8 {
-namespace internal {
-
-void IncrementalMarking::TransferColor(Tagged<HeapObject> from,
-                                       Tagged<HeapObject> to) {
-  DCHECK(marking_state()->IsUnmarked(to));
-  DCHECK(!black_allocation());
-  DCHECK(!MemoryChunk::FromHeapObject(to)->IsFlagSet(
-      MemoryChunk::BLACK_ALLOCATED));
-
-  if (marking_state()->IsMarked(from)) {
-    bool success = marking_state()->TryMark(to);
-    DCHECK(success);
-    USE(success);
-    if (!IsDescriptorArray(to) ||
-        (DescriptorArrayMarkingState::Marked::decode(
-             Cast<DescriptorArray>(to)->raw_gc_state(kRelaxedLoad)) != 0)) {
-      MutablePageMetadata::FromHeapObject(to)->IncrementLiveBytesAtomically(
-          ALIGN_TO_ALLOCATION_ALIGNMENT(to->Size()));
-    }
-  }
-}
-
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_HEAP_INCREMENTAL_MARKING_INL_H_
diff --git a/deps/v8/src/heap/incremental-marking-job.cc b/deps/v8/src/heap/incremental-marking-job.cc
index 27809a18db5bfe..abb82adaeb166a 100644
--- a/deps/v8/src/heap/incremental-marking-job.cc
+++ b/deps/v8/src/heap/incremental-marking-job.cc
@@ -116,7 +116,7 @@ void IncrementalMarkingJob::Task::RunInternal() {
                                     GarbageCollectionReason::kTask,
                                     kGCCallbackScheduleIdleGarbageCollection);
     } else if (v8_flags.minor_ms && v8_flags.concurrent_minor_ms_marking) {
-      heap->StartMinorMSIncrementalMarkingIfNeeded();
+      heap->StartMinorMSConcurrentMarkingIfNeeded();
     }
   }
 
diff --git a/deps/v8/src/heap/incremental-marking.cc b/deps/v8/src/heap/incremental-marking.cc
index 88ff441a5b119f..50a590734dd2f2 100644
--- a/deps/v8/src/heap/incremental-marking.cc
+++ b/deps/v8/src/heap/incremental-marking.cc
@@ -469,173 +469,6 @@ void IncrementalMarking::StopPointerTableBlackAllocation() {
 #endif  // V8_ENABLE_LEAPTIERING
 }
 
-void IncrementalMarking::UpdateMarkingWorklistAfterScavenge() {
-  if (!IsMajorMarking()) return;
-  DCHECK(!v8_flags.separate_gc_phases);
-  DCHECK(IsMajorMarking());
-  // Minor MS never runs during incremental marking.
-  DCHECK(!v8_flags.minor_ms);
-
-  Tagged<Map> filler_map = ReadOnlyRoots(heap_).one_pointer_filler_map();
-
-  MarkingState* marking_state = heap()->marking_state();
-
-  major_collector_->local_marking_worklists()->Publish();
-  MarkingBarrier::PublishAll(heap());
-  PtrComprCageBase cage_base(isolate());
-  major_collector_->marking_worklists()->Update([this, marking_state, cage_base,
-                                                 filler_map](
-                                                    Tagged<HeapObject> obj,
-                                                    Tagged<HeapObject>* out)
-                                                    -> bool {
-    DCHECK(IsHeapObject(obj));
-    USE(marking_state);
-
-    // Only pointers to from space have to be updated.
-    if (Heap::InFromPage(obj)) {
-      MapWord map_word = obj->map_word(cage_base, kRelaxedLoad);
-      if (!map_word.IsForwardingAddress()) {
-        // There may be objects on the marking deque that do not exist
-        // anymore, e.g. left trimmed objects or objects from the root set
-        // (frames). If these object are dead at scavenging time, their
-        // marking deque entries will not point to forwarding addresses.
-        // Hence, we can discard them.
-        return false;
-      }
-      // Live young large objects are not relocated and directly promoted into
-      // the old generation before invoking this method. So they looke like any
-      // other pointer into the old space and we won't encounter them here in
-      // this code path.
-      DCHECK(!Heap::IsLargeObject(obj));
-      Tagged<HeapObject> dest = map_word.ToForwardingAddress(obj);
-      DCHECK_IMPLIES(marking_state->IsUnmarked(obj), IsFreeSpaceOrFiller(obj));
-      if (HeapLayout::InWritableSharedSpace(dest) &&
-          !isolate()->is_shared_space_isolate()) {
-        // Object got promoted into the shared heap. Drop it from the client
-        // heap marking worklist.
-        return false;
-      }
-      // For any object not a DescriptorArray, transferring the object always
-      // increments live bytes as the marked state cannot distinguish fully
-      // processed from to-be-processed. Decrement the counter for such objects
-      // here.
-      if (!IsDescriptorArray(dest)) {
-        MutablePageMetadata::FromHeapObject(dest)->IncrementLiveBytesAtomically(
-            -ALIGN_TO_ALLOCATION_ALIGNMENT(dest->Size()));
-      }
-      *out = dest;
-      return true;
-    } else {
-      DCHECK(!Heap::InToPage(obj));
-      DCHECK_IMPLIES(marking_state->IsUnmarked(obj),
-                     IsFreeSpaceOrFiller(obj, cage_base));
-      // Skip one word filler objects that appear on the
-      // stack when we perform in place array shift.
-      if (obj->map(cage_base) != filler_map) {
-        *out = obj;
-        return true;
-      }
-      return false;
-    }
-  });
-
-  major_collector_->local_weak_objects()->Publish();
-  weak_objects_->UpdateAfterScavenge();
-}
-
-void IncrementalMarking::UpdateExternalPointerTableAfterScavenge() {
-#ifdef V8_COMPRESS_POINTERS
-  if (!IsMajorMarking()) return;
-  DCHECK(!v8_flags.separate_gc_phases);
-  heap_->isolate()->external_pointer_table().UpdateAllEvacuationEntries(
-      heap_->young_external_pointer_space(), [](Address old_handle_location) {
-        if (old_handle_location == kNullAddress) {
-          // Handle was clobbered by a previous Scavenger cycle.
-          return kNullAddress;
-        }
-        // 1) Resolve object start from the marking bitmap. Note that it's safe
-        //    since there is no black allocation for the young space (and hence
-        //    no range or page marking).
-        // 2) Get a relocated object from the forwarding reference stored in the
-        //    map.
-        // 3) Compute offset from the original object start to the handle
-        //    location.
-        // 4) Compute and return the new handle location.
-        //
-        // Please note that instead of updating the evacuation entries, we
-        // could simply clobber them all, which would still work, but limit
-        // compaction to some extent. We can reconsider this in the future, if
-        // relying on the marking bitmap becomes an issue (e.g. with inlined
-        // mark-bits).
-        const MemoryChunk* chunk =
-            MemoryChunk::FromAddress(old_handle_location);
-        DCHECK_NOT_NULL(chunk);
-        if (!chunk->InYoungGeneration()) {
-          return old_handle_location;
-        }
-        // TODO(358485426): Check that the page is not black.
-
-        Address base = MarkingBitmap::FindPreviousValidObject(
-            static_cast<const PageMetadata*>(chunk->Metadata()),
-            old_handle_location);
-        Tagged<HeapObject> object(HeapObject::FromAddress(base));
-
-        MapWord map_word = object->map_word(kRelaxedLoad);
-        if (!map_word.IsForwardingAddress()) {
-      // There may be objects in the EPT that do not exist anymore. If these
-      // objects are dead at scavenging time, their marking deque entries will
-      // not point to forwarding addresses. Hence, we can discard them.
-#if DEBUG
-          // Check that the handle did reside inside the original dead object.
-          const int object_size = object->Size();
-          // Map slots can never contain external pointers.
-          DCHECK_LT(object.address(), old_handle_location);
-          DCHECK_LT(old_handle_location, object.address() + object_size);
-#endif  // DEBUG
-          return kNullAddress;
-        }
-
-        Tagged<HeapObject> moved_object = map_word.ToForwardingAddress(object);
-#if DEBUG
-        const int object_size = moved_object->Size();
-        // Map slots can never contain external pointers.
-        DCHECK_LT(object.address(), old_handle_location);
-        DCHECK_LT(old_handle_location, object.address() + object_size);
-#endif  // DEBUG
-
-        if (!HeapLayout::InYoungGeneration(moved_object)) {
-          // If the object was promoted, it's external pointers were evacuated
-          // into the old EPT by IterateAndScavengePromotedObjectsVisitor.
-          // Ignore this evacuation entry.
-          return kNullAddress;
-        }
-
-        const ptrdiff_t handle_offset = old_handle_location - base;
-        const Address result = moved_object.address() + handle_offset;
-        // Check that the migrated and the original handles are the same.
-        DCHECK_EQ(
-            *reinterpret_cast<ExternalPointerHandle*>(old_handle_location),
-            *reinterpret_cast<ExternalPointerHandle*>(result));
-        return result;
-      });
-#endif  // V8_COMPRESS_POINTERS
-}
-
-void IncrementalMarking::UpdateMarkedBytesAfterScavenge(
-    size_t dead_bytes_in_new_space) {
-  if (!IsMajorMarking()) {
-    return;
-  }
-  // When removing the call, adjust the marking schedule to only support
-  // monotonically increasing mutator marked bytes.
-  // We don't know the exact dead bytes that were marked (and don't want to
-  // compute it).
-  const size_t dead_bytes_marked =
-      std::min(main_thread_marked_bytes_, dead_bytes_in_new_space);
-  schedule_->RemoveMutatorThreadMarkedBytes(dead_bytes_marked);
-  main_thread_marked_bytes_ -= dead_bytes_marked;
-}
-
 std::pair<v8::base::TimeDelta, size_t> IncrementalMarking::CppHeapStep(
     v8::base::TimeDelta max_duration, size_t marked_bytes_limit) {
   DCHECK(IsMarking());
@@ -1031,21 +864,6 @@ void IncrementalMarking::Step(v8::base::TimeDelta max_duration,
 
 Isolate* IncrementalMarking::isolate() const { return heap_->isolate(); }
 
-IncrementalMarking::PauseBlackAllocationScope::PauseBlackAllocationScope(
-    IncrementalMarking* marking)
-    : marking_(marking) {
-  if (marking_->black_allocation()) {
-    paused_ = true;
-    marking_->PauseBlackAllocation();
-  }
-}
-
-IncrementalMarking::PauseBlackAllocationScope::~PauseBlackAllocationScope() {
-  if (paused_) {
-    marking_->StartBlackAllocation();
-  }
-}
-
 // The allocation observer step size determines the LAB size when marking is on.
 // Objects in the LAB are not marked until the LAB bounds are reset in marking
 // steps. As a result, the concurrent marker may pick up this many bytes. If
diff --git a/deps/v8/src/heap/incremental-marking.h b/deps/v8/src/heap/incremental-marking.h
index 387c20d218c55a..0703e3acd0ce2e 100644
--- a/deps/v8/src/heap/incremental-marking.h
+++ b/deps/v8/src/heap/incremental-marking.h
@@ -53,22 +53,6 @@ constexpr const char* ToString(StepOrigin step_origin) {
 
 class V8_EXPORT_PRIVATE IncrementalMarking final {
  public:
-  class V8_NODISCARD V8_EXPORT_PRIVATE PauseBlackAllocationScope final {
-   public:
-    explicit PauseBlackAllocationScope(IncrementalMarking* marking);
-    ~PauseBlackAllocationScope();
-
-    PauseBlackAllocationScope(const PauseBlackAllocationScope&) = delete;
-    PauseBlackAllocationScope& operator=(const PauseBlackAllocationScope&) =
-        delete;
-
-   private:
-    IncrementalMarking* const marking_;
-    bool paused_ = false;
-  };
-
-  V8_INLINE void TransferColor(Tagged<HeapObject> from, Tagged<HeapObject> to);
-
   IncrementalMarking(Heap* heap, WeakObjects* weak_objects);
 
   IncrementalMarking(const IncrementalMarking&) = delete;
@@ -101,10 +85,6 @@ class V8_EXPORT_PRIVATE IncrementalMarking final {
   // Returns true if incremental marking was running and false otherwise.
   bool Stop();
 
-  void UpdateMarkingWorklistAfterScavenge();
-  void UpdateExternalPointerTableAfterScavenge();
-  void UpdateMarkedBytesAfterScavenge(size_t dead_bytes_in_new_space);
-
   // Performs incremental marking step and finalizes marking if complete.
   void AdvanceAndFinalizeIfComplete();
 
diff --git a/deps/v8/src/heap/large-spaces.cc b/deps/v8/src/heap/large-spaces.cc
index 9dac23bb8fc6b1..5b32e00344e5a7 100644
--- a/deps/v8/src/heap/large-spaces.cc
+++ b/deps/v8/src/heap/large-spaces.cc
@@ -255,6 +255,20 @@ void LargeObjectSpace::ShrinkPageToObjectSize(LargePageMetadata* page,
   DCHECK_EQ(object_size, page->area_size());
 }
 
+void LargeObjectSpace::UpdateAccountingAfterResizingObject(
+    size_t old_object_size, size_t new_object_size) {
+  DCHECK_GE(new_object_size, old_object_size);
+  size_t old_size_committed =
+      ::RoundUp(old_object_size, MemoryAllocator::GetCommitPageSize());
+  size_t new_size_committed =
+      ::RoundUp(new_object_size, MemoryAllocator::GetCommitPageSize());
+  DCHECK_GE(new_size_committed, old_size_committed);
+
+  size_ += new_size_committed - old_size_committed;
+  AccountCommitted(new_size_committed - old_size_committed);
+  objects_size_.fetch_add(new_object_size - old_object_size);
+}
+
 bool LargeObjectSpace::Contains(Tagged<HeapObject> object) const {
   MemoryChunkMetadata* chunk = MemoryChunkMetadata::FromHeapObject(object);
 
@@ -366,8 +380,7 @@ AllocationResult NewLargeObjectSpace::AllocateRaw(LocalHeap* local_heap,
 
   // Allocation for the first object must succeed independent from the capacity.
   if (SizeOfObjects() > 0 && static_cast<size_t>(object_size) > Available()) {
-    if (!v8_flags.separate_gc_phases ||
-        !heap()->ShouldExpandYoungGenerationOnSlowAllocation(object_size)) {
+    if (!heap()->ShouldExpandYoungGenerationOnSlowAllocation(object_size)) {
       return AllocationResult::Failure();
     }
   }
@@ -409,9 +422,7 @@ void NewLargeObjectSpace::Flip() {
 
 void NewLargeObjectSpace::FreeDeadObjects(
     const std::function<bool(Tagged<HeapObject>)>& is_dead) {
-  bool is_marking = heap()->incremental_marking()->IsMarking();
-  DCHECK_IMPLIES(v8_flags.minor_ms, !is_marking);
-  DCHECK_IMPLIES(is_marking, heap()->incremental_marking()->IsMajorMarking());
+  DCHECK(!heap()->incremental_marking()->IsMarking());
   size_t surviving_object_size = 0;
   PtrComprCageBase cage_base(heap()->isolate());
   for (auto it = begin(); it != end();) {
@@ -420,9 +431,6 @@ void NewLargeObjectSpace::FreeDeadObjects(
     Tagged<HeapObject> object = page->GetObject();
     if (is_dead(object)) {
       RemovePage(page);
-      if (v8_flags.concurrent_marking && is_marking) {
-        heap()->concurrent_marking()->ClearMemoryChunkData(page);
-      }
       heap()->memory_allocator()->Free(MemoryAllocator::FreeMode::kImmediately,
                                        page);
     } else {
diff --git a/deps/v8/src/heap/large-spaces.h b/deps/v8/src/heap/large-spaces.h
index cb681cbb5e82ad..d6c4fe4e21e805 100644
--- a/deps/v8/src/heap/large-spaces.h
+++ b/deps/v8/src/heap/large-spaces.h
@@ -105,6 +105,8 @@ class V8_EXPORT_PRIVATE LargeObjectSpace : public Space {
 
   base::Mutex* pending_allocation_mutex() { return &pending_allocation_mutex_; }
 
+  void UpdateAccountingAfterResizingObject(size_t old_size, size_t new_size);
+
   void set_objects_size(size_t objects_size) { objects_size_ = objects_size; }
 
  protected:
diff --git a/deps/v8/src/heap/local-heap.cc b/deps/v8/src/heap/local-heap.cc
index 1a1225ee0c95eb..d047b0d6a9d578 100644
--- a/deps/v8/src/heap/local-heap.cc
+++ b/deps/v8/src/heap/local-heap.cc
@@ -465,6 +465,13 @@ void LocalHeap::RemoveGCEpilogueCallback(GCEpilogueCallback* callback,
   gc_epilogue_callbacks_.Remove(callback, data);
 }
 
+void LocalHeap::Iterate(RootVisitor* visitor) {
+  handles_->Iterate(visitor);
+  if (roots_provider_) {
+    roots_provider_->Iterate(visitor);
+  }
+}
+
 void LocalHeap::InvokeGCEpilogueCallbacksInSafepoint(
     GCCallbacksInSafepoint::GCType gc_type) {
   gc_epilogue_callbacks_.Invoke(gc_type);
diff --git a/deps/v8/src/heap/local-heap.h b/deps/v8/src/heap/local-heap.h
index 5c83008f322df4..3e3400db0944d3 100644
--- a/deps/v8/src/heap/local-heap.h
+++ b/deps/v8/src/heap/local-heap.h
@@ -235,6 +235,8 @@ class V8_EXPORT_PRIVATE LocalHeap {
   pthread_t thread_handle() { return thread_handle_; }
 #endif
 
+  void Iterate(RootVisitor* visitor);
+
   HeapAllocator* allocator() { return &heap_allocator_; }
 
  private:
@@ -396,6 +398,7 @@ class V8_EXPORT_PRIVATE LocalHeap {
   std::unique_ptr<MarkingBarrier> marking_barrier_;
 
   GCCallbacksInSafepoint gc_epilogue_callbacks_;
+  GCRootsProvider* roots_provider_ = nullptr;
 
   HeapAllocator heap_allocator_;
 
@@ -412,6 +415,7 @@ class V8_EXPORT_PRIVATE LocalHeap {
   friend class IsolateSafepointScope;
   friend class ParkedScope;
   friend class UnparkedScope;
+  friend class GCRootsProviderScope;
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/heap/main-allocator.cc b/deps/v8/src/heap/main-allocator.cc
index 375cc521989352..3291add3c3f85f 100644
--- a/deps/v8/src/heap/main-allocator.cc
+++ b/deps/v8/src/heap/main-allocator.cc
@@ -462,8 +462,13 @@ bool SemiSpaceNewSpaceAllocatorPolicy::EnsureAllocation(
   std::optional<std::pair<Address, Address>> allocation_result =
       space_->Allocate(size_in_bytes, alignment);
   if (!allocation_result) {
-    if (!v8_flags.separate_gc_phases ||
-        !space_->heap()->ShouldExpandYoungGenerationOnSlowAllocation(
+    if (!space_->ReachedTargetCapacity()) {
+      // If allocation failed even though we have not even grown the space to
+      // its target capacity yet, we can bail out early.
+      return false;
+    }
+
+    if (!space_->heap()->ShouldExpandYoungGenerationOnSlowAllocation(
             PageMetadata::kPageSize)) {
       return false;
     }
@@ -640,7 +645,7 @@ bool PagedSpaceAllocatorPolicy::EnsureAllocation(int size_in_bytes,
                                                  AllocationOrigin origin) {
   if (allocator_->identity() == NEW_SPACE) {
     DCHECK(allocator_->is_main_thread());
-    space_heap()->StartMinorMSIncrementalMarkingIfNeeded();
+    space_heap()->StartMinorMSConcurrentMarkingIfNeeded();
   }
   if ((allocator_->identity() != NEW_SPACE) && !allocator_->in_gc()) {
     // Start incremental marking before the actual allocation, this allows the
diff --git a/deps/v8/src/heap/mark-compact.cc b/deps/v8/src/heap/mark-compact.cc
index 0da876053ce7ef..eb663464e5c33f 100644
--- a/deps/v8/src/heap/mark-compact.cc
+++ b/deps/v8/src/heap/mark-compact.cc
@@ -38,7 +38,7 @@
 #include "src/heap/heap-utils-inl.h"
 #include "src/heap/heap-visitor-inl.h"
 #include "src/heap/heap.h"
-#include "src/heap/incremental-marking-inl.h"
+#include "src/heap/incremental-marking.h"
 #include "src/heap/index-generator.h"
 #include "src/heap/large-spaces.h"
 #include "src/heap/live-object-range-inl.h"
@@ -873,17 +873,9 @@ void MarkCompactCollector::Finish() {
 #endif  // DEBUG
   }
 
-  if (auto* new_space = heap_->new_space()) {
+  if (heap_->new_space()) {
     TRACE_GC(heap_->tracer(), GCTracer::Scope::MC_EVACUATE);
     TRACE_GC(heap_->tracer(), GCTracer::Scope::MC_EVACUATE_REBALANCE);
-    // We rebalance first to be able to assume that from- and to-space have the
-    // same size.
-    //
-    // TODO(365027679): Make growing/shrinking more flexible to avoid ensuring
-    // the same capacity.
-    if (!new_space->EnsureCurrentCapacity()) {
-      heap_->FatalProcessOutOfMemory("NewSpace::EnsureCurrentCapacity");
-    }
     heap_->ResizeNewSpace();
   }
 
@@ -1210,7 +1202,7 @@ class MarkCompactWeakObjectRetainer : public WeakObjectRetainer {
     if (MarkingHelper::IsMarkedOrAlwaysLive(heap_, marking_state_,
                                             heap_object)) {
       return object;
-    } else if (IsAllocationSite(object) &&
+    } else if (IsAllocationSite(heap_object) &&
                !Cast<AllocationSite>(object)->IsZombie()) {
       // "dead" AllocationSites need to live long enough for a traversal of new
       // space. These sites get a one-time reprieve.
@@ -1754,7 +1746,9 @@ class EvacuateNewToOldSpacePageVisitor final : public HeapObjectVisitor {
         local_pretenuring_feedback_(local_pretenuring_feedback) {}
 
   static void Move(PageMetadata* page) {
-    page->heap()->new_space()->PromotePageToOldSpace(page);
+    page->heap()->new_space()->PromotePageToOldSpace(
+        page, v8_flags.minor_ms ? FreeMode::kDoNotLinkCategory
+                                : FreeMode::kLinkCategory);
   }
 
   inline bool Visit(Tagged<HeapObject> object, int size) override {
@@ -1915,6 +1909,9 @@ void MarkCompactCollector::MarkObjectsFromClientHeap(Isolate* client) {
   PtrComprCageBase cage_base(client);
   Heap* client_heap = client->heap();
 
+  // Finish sweeping quarantined pages for Scavenger's new space in order to
+  // iterate objects in it.
+  client_heap->EnsureQuarantinedPagesSweepingCompleted();
   // Finish sweeping for new space in order to iterate objects in it.
   client_heap->sweeper()->FinishMinorJobs();
   // Finish sweeping for old generation in order to iterate OLD_TO_SHARED.
@@ -2344,9 +2341,8 @@ void MarkCompactCollector::MarkTransitiveClosure() {
 
 void MarkCompactCollector::ProcessTopOptimizedFrame(ObjectVisitor* visitor,
                                                     Isolate* isolate) {
-  for (StackFrameIterator it(isolate, isolate->thread_local_top(),
-                             StackFrameIterator::NoHandles{});
-       !it.done(); it.Advance()) {
+  for (StackFrameIterator it(isolate, isolate->thread_local_top()); !it.done();
+       it.Advance()) {
     if (it.frame()->is_unoptimized_js()) return;
     if (it.frame()->is_optimized_js()) {
       Tagged<GcSafeCode> lookup_result = it.frame()->GcSafeLookupCode();
@@ -3741,7 +3737,7 @@ void MarkCompactCollector::RecordStrongDescriptorArraysForWeakening(
 void MarkCompactCollector::WeakenStrongDescriptorArrays() {
   Tagged<Map> descriptor_array_map =
       ReadOnlyRoots(heap_->isolate()).descriptor_array_map();
-  for (auto vec : strong_descriptor_arrays_) {
+  for (auto& vec : strong_descriptor_arrays_) {
     for (auto it = vec.begin(); it != vec.end(); ++it) {
       Tagged<DescriptorArray> raw = it.raw();
       DCHECK(IsStrongDescriptorArray(raw));
@@ -4421,7 +4417,7 @@ void MarkCompactCollector::EvacuatePrologue() {
                  std::back_inserter(new_space_evacuation_pages_),
                  [](PageMetadata* p) { return p->live_bytes() > 0; });
     if (!v8_flags.minor_ms) {
-      SemiSpaceNewSpace::From(new_space)->EvacuatePrologue();
+      SemiSpaceNewSpace::From(new_space)->SwapSemiSpaces();
     }
   }
 
@@ -5040,7 +5036,6 @@ class EvacuationWeakObjectRetainer : public WeakObjectRetainer {
 
 void MarkCompactCollector::Evacuate() {
   TRACE_GC(heap_->tracer(), GCTracer::Scope::MC_EVACUATE);
-  base::MutexGuard guard(heap_->relocation_mutex());
 
   {
     TRACE_GC(heap_->tracer(), GCTracer::Scope::MC_EVACUATE_PROLOGUE);
@@ -5789,7 +5784,8 @@ void MarkCompactCollector::UpdatePointersInPointerTables() {
         if (!relocated_object.is_null()) {
           DCHECK_EQ(handle, relocated_object->self_indirect_pointer_handle());
           auto instance_type = relocated_object->map()->instance_type();
-          auto tag = IndirectPointerTagFromInstanceType(instance_type);
+          bool shared = HeapLayout::InAnySharedSpace(relocated_object);
+          auto tag = IndirectPointerTagFromInstanceType(instance_type, shared);
           tpt->Set(handle, relocated_object.ptr(), tag);
         }
       });
@@ -5803,7 +5799,8 @@ void MarkCompactCollector::UpdatePointersInPointerTables() {
         if (!relocated_object.is_null()) {
           DCHECK_EQ(handle, relocated_object->self_indirect_pointer_handle());
           auto instance_type = relocated_object->map()->instance_type();
-          auto tag = IndirectPointerTagFromInstanceType(instance_type);
+          bool shared = HeapLayout::InAnySharedSpace(relocated_object);
+          auto tag = IndirectPointerTagFromInstanceType(instance_type, shared);
           DCHECK(IsSharedTrustedPointerType(tag));
           stpt->Set(handle, relocated_object.ptr(), tag);
         }
diff --git a/deps/v8/src/heap/marking-barrier-inl.h b/deps/v8/src/heap/marking-barrier-inl.h
index 306e37e5d7eac2..a7ec6d41385110 100644
--- a/deps/v8/src/heap/marking-barrier-inl.h
+++ b/deps/v8/src/heap/marking-barrier-inl.h
@@ -10,7 +10,6 @@
 
 #include "src/base/logging.h"
 #include "src/heap/heap-layout-inl.h"
-#include "src/heap/incremental-marking-inl.h"
 #include "src/heap/incremental-marking.h"
 #include "src/heap/mark-compact-inl.h"
 #include "src/heap/marking.h"
diff --git a/deps/v8/src/heap/marking-barrier.cc b/deps/v8/src/heap/marking-barrier.cc
index 3a21af080d72a9..5db35dc29c7581 100644
--- a/deps/v8/src/heap/marking-barrier.cc
+++ b/deps/v8/src/heap/marking-barrier.cc
@@ -12,7 +12,6 @@
 #include "src/heap/heap-layout-inl.h"
 #include "src/heap/heap-write-barrier.h"
 #include "src/heap/heap.h"
-#include "src/heap/incremental-marking-inl.h"
 #include "src/heap/incremental-marking.h"
 #include "src/heap/mark-compact-inl.h"
 #include "src/heap/mark-compact.h"
@@ -179,12 +178,6 @@ void MarkingBarrier::Write(Tagged<DescriptorArray> descriptor_array,
     worklist = current_worklists_.get();
   }
 
-  // The DescriptorArray needs to be marked black here to ensure that slots
-  // are recorded by the Scavenger in case the DescriptorArray is promoted
-  // while incremental marking is running. This is needed as the regular
-  // marking visitor does not re-process any already marked descriptors. If we
-  // don't mark it black here, the Scavenger may promote a DescriptorArray and
-  // any already marked descriptors will not have any slots recorded.
   if (v8_flags.black_allocated_pages) {
     // Make sure to only mark the descriptor array for non black allocated
     // pages. The atomic pause will fix it afterwards.
diff --git a/deps/v8/src/heap/marking-worklist-inl.h b/deps/v8/src/heap/marking-worklist-inl.h
index 425285a7bc8697..102241222665e4 100644
--- a/deps/v8/src/heap/marking-worklist-inl.h
+++ b/deps/v8/src/heap/marking-worklist-inl.h
@@ -17,16 +17,6 @@
 namespace v8 {
 namespace internal {
 
-template <typename Callback>
-void MarkingWorklists::Update(Callback callback) {
-  shared_.Update(callback);
-  on_hold_.Update(callback);
-  other_.Update(callback);
-  for (auto& cw : context_worklists_) {
-    cw.worklist->Update(callback);
-  }
-}
-
 void MarkingWorklists::Local::Push(Tagged<HeapObject> object) {
   active_->Push(object);
 }
diff --git a/deps/v8/src/heap/marking-worklist.h b/deps/v8/src/heap/marking-worklist.h
index a95771e7a2b508..967a455ec28eb5 100644
--- a/deps/v8/src/heap/marking-worklist.h
+++ b/deps/v8/src/heap/marking-worklist.h
@@ -80,13 +80,6 @@ class V8_EXPORT_PRIVATE MarkingWorklists final {
   // Worklists implicitly check for emptiness on destruction.
   ~MarkingWorklists() = default;
 
-  // Calls the specified callback on each element of the deques and replaces
-  // the element with the result of the callback. If the callback returns
-  // nullptr then the element is removed from the deque.
-  // The callback must accept HeapObject and return HeapObject.
-  template <typename Callback>
-  void Update(Callback callback);
-
   MarkingWorklist* shared() { return &shared_; }
   MarkingWorklist* on_hold() { return &on_hold_; }
   MarkingWorklist* other() { return &other_; }
diff --git a/deps/v8/src/heap/memory-allocator.cc b/deps/v8/src/heap/memory-allocator.cc
index cb1c27c4040689..1a7afc72c74a1a 100644
--- a/deps/v8/src/heap/memory-allocator.cc
+++ b/deps/v8/src/heap/memory-allocator.cc
@@ -8,6 +8,7 @@
 #include <optional>
 
 #include "src/base/address-region.h"
+#include "src/base/macros.h"
 #include "src/common/globals.h"
 #include "src/execution/isolate.h"
 #include "src/flags/flags.h"
@@ -15,6 +16,7 @@
 #include "src/heap/gc-tracer.h"
 #include "src/heap/heap-inl.h"
 #include "src/heap/heap.h"
+#include "src/heap/large-page-metadata.h"
 #include "src/heap/memory-chunk-metadata.h"
 #include "src/heap/mutable-page-metadata.h"
 #include "src/heap/page-pool.h"
@@ -83,26 +85,6 @@ void MemoryAllocator::ReleasePooledChunksImmediately() {
   pool()->ReleaseImmediately(isolate_);
 }
 
-bool MemoryAllocator::CommitMemory(VirtualMemory* reservation,
-                                   Executability executable) {
-  Address base = reservation->address();
-  size_t size = reservation->size();
-  if (!reservation->SetPermissions(base, size, PageAllocator::kReadWrite)) {
-    return false;
-  }
-  UpdateAllocatedSpaceLimits(base, base + size, executable);
-  return true;
-}
-
-bool MemoryAllocator::UncommitMemory(VirtualMemory* reservation) {
-  size_t size = reservation->size();
-  if (!reservation->SetPermissions(reservation->address(), size,
-                                   PageAllocator::kNoAccess)) {
-    return false;
-  }
-  return true;
-}
-
 void MemoryAllocator::FreeMemoryRegion(v8::PageAllocator* page_allocator,
                                        Address base, size_t size) {
   FreePages(page_allocator, reinterpret_cast<void*>(base), size);
@@ -359,22 +341,25 @@ void MemoryAllocator::Free(MemoryAllocator::FreeMode mode,
                            MutablePageMetadata* chunk_metadata) {
   MemoryChunk* chunk = chunk_metadata->Chunk();
   RecordMemoryChunkDestroyed(chunk);
+  PreFreeMemory(chunk_metadata);
 
   switch (mode) {
     case FreeMode::kImmediately:
-      PreFreeMemory(chunk_metadata);
       PerformFreeMemory(chunk_metadata);
       break;
     case FreeMode::kPostpone:
-      PreFreeMemory(chunk_metadata);
       // Record page to be freed later.
       queued_pages_to_be_freed_.push_back(chunk_metadata);
       break;
     case FreeMode::kPool:
+      // Ensure that we only ever put pages with their markbits cleared into the
+      // pool. This is necessary because `PreFreeMemory` doesn't clear the
+      // marking bitmap and the marking bitmap is reused when this page is taken
+      // out of the pool again.
+      DCHECK(chunk_metadata->IsLivenessClear());
       DCHECK_EQ(chunk_metadata->size(),
                 static_cast<size_t>(MutablePageMetadata::kPageSize));
       DCHECK_EQ(chunk->executable(), NOT_EXECUTABLE);
-      PreFreeMemory(chunk_metadata);
       // The chunks added to this queue will be cached until memory reducing GC.
       pool()->Add(isolate_, chunk_metadata);
       break;
@@ -436,6 +421,7 @@ PageMetadata* MemoryAllocator::AllocatePage(
   if (chunk->executable()) RegisterExecutableMemoryChunk(metadata);
 #endif  // DEBUG
 
+  DCHECK(metadata->IsLivenessClear());
   space->InitializePage(metadata);
   RecordMemoryChunkCreated(chunk);
   return metadata;
@@ -506,6 +492,46 @@ LargePageMetadata* MemoryAllocator::AllocateLargePage(
   return metadata;
 }
 
+bool MemoryAllocator::ResizeLargePage(LargePageMetadata* page,
+                                      size_t old_object_size,
+                                      size_t new_object_size) {
+  const size_t old_reservation_size = page->reservation_.size();
+  const size_t old_page_end = page->reservation_.end();
+  const Address new_area_end = page->area_start() + new_object_size;
+  const Address new_page_end = RoundUp(new_area_end, GetCommitPageSize());
+  const size_t new_page_size = new_page_end - page->ChunkAddress();
+
+  if (old_page_end == new_page_end) {
+    // We were able to grow the object without growing its owning page.
+    page->set_area_end(new_area_end);
+    return true;
+  }
+
+  // Currently we only support growing.
+  DCHECK_LT(old_page_end, new_page_end);
+
+  if (!page->reservation_.Resize(page->ChunkAddress(), new_page_size,
+                                 PageAllocator::kReadWrite)) {
+    return false;
+  }
+
+  page->set_area_end(new_area_end);
+  page->set_size(new_page_size);
+
+#if DEBUG
+  AllocationSpace space = page->owner_identity();
+  DCHECK(space == NEW_LO_SPACE || space == LO_SPACE);
+#endif  // DEBUG
+
+  UpdateAllocatedSpaceLimits(page->ChunkAddress(), new_page_end,
+                             Executability::NOT_EXECUTABLE);
+
+  size_ -= old_reservation_size;
+  size_ += page->reservation_.size();
+
+  return true;
+}
+
 std::optional<MemoryAllocator::MemoryChunkAllocationResult>
 MemoryAllocator::AllocateUninitializedPageFromPool(Space* space) {
   MemoryChunkMetadata* chunk_metadata = pool()->Remove(isolate_);
diff --git a/deps/v8/src/heap/memory-allocator.h b/deps/v8/src/heap/memory-allocator.h
index c6fa1997287d29..6797b41aa116fe 100644
--- a/deps/v8/src/heap/memory-allocator.h
+++ b/deps/v8/src/heap/memory-allocator.h
@@ -21,6 +21,7 @@
 #include "src/base/platform/semaphore.h"
 #include "src/common/globals.h"
 #include "src/heap/code-range.h"
+#include "src/heap/large-page-metadata.h"
 #include "src/heap/memory-chunk-metadata.h"
 #include "src/heap/mutable-page-metadata.h"
 #include "src/heap/spaces.h"
@@ -96,6 +97,9 @@ class MemoryAllocator {
   V8_EXPORT_PRIVATE LargePageMetadata* AllocateLargePage(
       LargeObjectSpace* space, size_t object_size, Executability executable);
 
+  bool ResizeLargePage(LargePageMetadata* page, size_t old_object_size,
+                       size_t new_object_size);
+
   ReadOnlyPageMetadata* AllocateReadOnlyPage(ReadOnlySpace* space,
                                              Address hint = kNullAddress);
 
@@ -262,20 +266,12 @@ class MemoryAllocator {
                                 Executability executable, void* hint,
                                 VirtualMemory* controller);
 
-  // Commit memory region owned by given reservation object.  Returns true if
-  // it succeeded and false otherwise.
-  bool CommitMemory(VirtualMemory* reservation, Executability executable);
-
   // Sets memory permissions on executable memory chunks. This entails page
   // header (RW), guard pages (no access) and the object area (code modification
   // permissions).
   V8_WARN_UNUSED_RESULT bool SetPermissionsOnExecutableMemoryChunk(
       VirtualMemory* vm, Address start, size_t reserved_size);
 
-  // Disallows any access on memory region owned by given reservation object.
-  // Returns true if it succeeded and false otherwise.
-  bool UncommitMemory(VirtualMemory* reservation);
-
   // Frees the given memory region.
   void FreeMemoryRegion(v8::PageAllocator* page_allocator, Address addr,
                         size_t size);
diff --git a/deps/v8/src/heap/memory-chunk.h b/deps/v8/src/heap/memory-chunk.h
index b0cb4f4294480f..2755cb107a5ed7 100644
--- a/deps/v8/src/heap/memory-chunk.h
+++ b/deps/v8/src/heap/memory-chunk.h
@@ -24,6 +24,11 @@ namespace debug_helper_internal {
 class ReadStringVisitor;
 }  // namespace  debug_helper_internal
 
+namespace compiler::turboshaft {
+template <typename Next>
+class TurboshaftAssemblerOpInterface;
+}
+
 class Heap;
 class MemoryChunkMetadata;
 class ReadOnlyPageMetadata;
@@ -137,9 +142,6 @@ class V8_EXPORT_PRIVATE MemoryChunk final {
     // A new space page that will be promoted to old space by the end of the GC.
     // This flag should only ever be set during a scavenge cycle.
     WILL_BE_PROMOTED = 1u << 24,
-
-    // Set on pages which were shrunk to the "high water mark".
-    SHRINK_TO_HIGH_WATER_MARK = 1u << 25,
   };
 
   using MainThreadFlags = base::Flags<Flag, uintptr_t>;
@@ -169,10 +171,16 @@ class V8_EXPORT_PRIVATE MemoryChunk final {
   V8_INLINE Address address() const { return reinterpret_cast<Address>(this); }
 
   static constexpr Address BaseAddress(Address a) {
+    // LINT.IfChange(MemoryObjectBaseAddress)
     // If this changes, we also need to update
-    // CodeStubAssembler::MemoryChunkFromAddress and
-    // MacroAssembler::MemoryChunkHeaderFromObject
+    // - CodeStubAssembler::MemoryChunkFromAddress
+    // - MacroAssembler::MemoryChunkHeaderFromObject
+    // - TurboshaftAssemblerOpInterface::MemoryChunkFromAddress
     return a & ~kAlignmentMask;
+    // LINT.ThenChange(src/codegen/code-stub-assembler.cc:MemoryObjectBaseAddress)
+    // LINT.ThenChange(src/codegen/ia32/macro-assembler-ia32.cc:MemoryObjectBaseAddress)
+    // LINT.ThenChange(src/codegen/x64/macro-assembler-x64.cc:MemoryObjectBaseAddress)
+    // LINT.ThenChange(src/compiler/turboshaft/assembler.h:MemoryObjectBaseAddress)
   }
 
   V8_INLINE static MemoryChunk* FromAddress(Address addr) {
@@ -416,6 +424,8 @@ class V8_EXPORT_PRIVATE MemoryChunk final {
   // MetadataOffset().
   friend class CodeStubAssembler;
   friend class MacroAssembler;
+  template <typename Next>
+  friend class compiler::turboshaft::TurboshaftAssemblerOpInterface;
 };
 
 DEFINE_OPERATORS_FOR_FLAGS(MemoryChunk::MainThreadFlags)
diff --git a/deps/v8/src/heap/minor-gc-job.cc b/deps/v8/src/heap/minor-gc-job.cc
index 2b8199fb0a904a..998aac9874066c 100644
--- a/deps/v8/src/heap/minor-gc-job.cc
+++ b/deps/v8/src/heap/minor-gc-job.cc
@@ -173,8 +173,7 @@ void MinorGCJob::Task::RunInternal() {
 
   Heap* heap = isolate()->heap();
 
-  if (v8_flags.separate_gc_phases &&
-      heap->incremental_marking()->IsMajorMarking()) {
+  if (heap->incremental_marking()->IsMajorMarking()) {
     // Don't trigger a minor GC while major incremental marking is active.
     return;
   }
diff --git a/deps/v8/src/heap/minor-mark-sweep.cc b/deps/v8/src/heap/minor-mark-sweep.cc
index 32b77fddb2e53f..f0eed1eeb5f412 100644
--- a/deps/v8/src/heap/minor-mark-sweep.cc
+++ b/deps/v8/src/heap/minor-mark-sweep.cc
@@ -48,6 +48,7 @@
 #include "src/heap/traced-handles-marking-visitor.h"
 #include "src/heap/weak-object-worklists.h"
 #include "src/init/v8.h"
+#include "src/objects/cpp-heap-object-wrapper-inl.h"
 #include "src/objects/js-collection-inl.h"
 #include "src/objects/objects.h"
 #include "src/objects/string-forwarding-table-inl.h"
@@ -403,11 +404,6 @@ void MinorMarkSweepCollector::Finish() {
   {
     TRACE_GC(heap_->tracer(), GCTracer::Scope::MINOR_MS_FINISH_ENSURE_CAPACITY);
     heap_->ResizeNewSpace();
-
-    if (!v8_flags.sticky_mark_bits &&
-        !heap_->new_space()->EnsureCurrentCapacity()) {
-      heap_->FatalProcessOutOfMemory("NewSpace::EnsureCurrentCapacity");
-    }
   }
 
   if (!v8_flags.sticky_mark_bits) {
@@ -608,18 +604,15 @@ void MinorMarkSweepCollector::ClearNonLiveReferences() {
 }
 
 namespace {
-void VisitObjectWithEmbedderFields(Isolate* isolate, Tagged<JSObject> js_object,
-                                   MarkingWorklists::Local& worklist) {
-  DCHECK(js_object->MayHaveEmbedderFields());
-  DCHECK(!HeapLayout::InYoungGeneration(js_object));
-  // Not every object that can have embedder fields is actually a JSApiWrapper.
-  if (!IsJSApiWrapperObject(js_object)) {
-    return;
-  }
+void VisitObjectWithCppHeapPointerField(
+    Isolate* isolate, Tagged<CppHeapPointerWrapperObjectT> object,
+    MarkingWorklists::Local& worklist) {
+  DCHECK(IsCppHeapPointerWrapperObject(object));
+  DCHECK(!HeapLayout::InYoungGeneration(object));
 
   // Wrapper using cpp_heap_wrappable field.
-  void* wrappable =
-      JSApiWrapper(js_object).GetCppHeapWrappable(isolate, kAnyCppHeapPointer);
+  void* wrappable = CppHeapObjectWrapper::From(object).GetCppHeapWrappable(
+      isolate, kAnyCppHeapPointer);
   if (wrappable) {
     worklist.cpp_marking_state()->MarkAndPush(wrappable);
   }
@@ -635,10 +628,11 @@ void MinorMarkSweepCollector::MarkRootsFromTracedHandles(
     heap_->isolate()->traced_handles()->IterateAndMarkYoungRootsWithOldHosts(
         &root_visitor);
     // Visit the V8-to-Oilpan remembered set.
-    cpp_heap->VisitCrossHeapRememberedSetIfNeeded([this](Tagged<JSObject> obj) {
-      VisitObjectWithEmbedderFields(heap_->isolate(), obj,
-                                    *local_marking_worklists());
-    });
+    cpp_heap->VisitCrossHeapRememberedSetIfNeeded(
+        [this](Tagged<CppHeapPointerWrapperObjectT> obj) {
+          VisitObjectWithCppHeapPointerField(heap_->isolate(), obj,
+                                             *local_marking_worklists());
+        });
   } else {
     // Otherwise, visit all young roots.
     heap_->isolate()->traced_handles()->IterateYoungRoots(&root_visitor);
@@ -959,7 +953,10 @@ bool MinorMarkSweepCollector::StartSweepNewSpace() {
 
     if (ShouldMovePage(p, live_bytes_on_page, p->wasted_memory())) {
       EvacuateExternalPointerReferences(p);
-      heap_->new_space()->PromotePageToOldSpace(p);
+      // free list categories will be relinked by the sweeper after sweeping is
+      // done.
+      heap_->new_space()->PromotePageToOldSpace(p,
+                                                FreeMode::kDoNotLinkCategory);
       has_promoted_pages = true;
       sweeper()->AddPromotedPage(p);
     } else {
diff --git a/deps/v8/src/heap/new-spaces-inl.h b/deps/v8/src/heap/new-spaces-inl.h
index 6ccb6f1b043a7f..de396270a02379 100644
--- a/deps/v8/src/heap/new-spaces-inl.h
+++ b/deps/v8/src/heap/new-spaces-inl.h
@@ -65,11 +65,13 @@ SemiSpaceObjectIterator::SemiSpaceObjectIterator(const SemiSpaceNewSpace* space)
     : current_(space->first_allocatable_address()) {}
 
 Tagged<HeapObject> SemiSpaceObjectIterator::Next() {
+  if (!current_) return {};
+
   while (true) {
     if (PageMetadata::IsAlignedToPageSize(current_)) {
       PageMetadata* page = PageMetadata::FromAllocationAreaAddress(current_);
       page = page->next_page();
-      if (page == nullptr) return Tagged<HeapObject>();
+      if (page == nullptr) return {};
       current_ = page->area_start();
     }
     Tagged<HeapObject> object = HeapObject::FromAddress(current_);
diff --git a/deps/v8/src/heap/new-spaces.cc b/deps/v8/src/heap/new-spaces.cc
index 2808891b24a2db..a8c74bf90efbde 100644
--- a/deps/v8/src/heap/new-spaces.cc
+++ b/deps/v8/src/heap/new-spaces.cc
@@ -7,6 +7,7 @@
 #include <atomic>
 #include <optional>
 
+#include "src/base/logging.h"
 #include "src/base/macros.h"
 #include "src/common/globals.h"
 #include "src/flags/flags.h"
@@ -54,62 +55,50 @@ SemiSpace::SemiSpace(Heap* heap, SemiSpaceId semispace)
     : Space(heap, NEW_SPACE, nullptr), id_(semispace) {}
 
 SemiSpace::~SemiSpace() {
-  // Properly uncommit memory to keep the allocator counters in sync.
-  if (IsCommitted()) {
-    Uncommit();
-  }
-}
-
-bool SemiSpace::EnsureCapacityIfCommitted(size_t target_capacity) {
-  if (IsCommitted()) {
-    return EnsureCapacity(target_capacity);
+  const bool is_marking = heap_->isolate()->isolate_data()->is_marking();
+  while (!memory_chunk_list_.Empty()) {
+    MutablePageMetadata* page = memory_chunk_list_.front();
+    memory_chunk_list_.Remove(page);
+    if (is_marking) {
+      page->ClearLiveness();
+    }
+    heap_->memory_allocator()->Free(MemoryAllocator::FreeMode::kPool, page);
   }
-  return true;
 }
 
-bool SemiSpace::EnsureCapacity(size_t capacity) {
+void SemiSpace::ShrinkCapacityTo(size_t capacity) {
   DCHECK_IMPLIES(!IsCommitted(), CommittedMemory() == 0);
+  // Only the to-space is allowed to have quarantined pages.
+  DCHECK_IMPLIES(id_ != kToSpace, quarantined_pages_count_ == 0);
+  DCHECK_GE(memory_chunk_list_.size(), quarantined_pages_count_);
+
   const size_t quarantined_pages =
       id_ == kToSpace ? quarantined_pages_count_ : 0;
+  // Quarantined pages are not accounted against the capacity of the space.
   const int pages_available_for_allocation =
       static_cast<int>(memory_chunk_list_.size() - quarantined_pages);
   const int num_pages = static_cast<int>((capacity / PageMetadata::kPageSize)) -
                         pages_available_for_allocation;
   if (num_pages >= 0) {
-    for (int pages_added = 0; pages_added < num_pages; pages_added++) {
-      if (!AllocateFreshPage()) {
-        if (pages_added) RewindPages(pages_added);
-        return false;
-      }
-    }
-  } else {
-    // Due to previously quarantined pages, we already have more pages then
-    // needed. Free the redundant pages.
-    RewindPages(-num_pages);
+    // The space is already smaller than it needs to be.
+    return;
   }
+
+  RewindPages(-num_pages);
+
   DCHECK_EQ(capacity + quarantined_pages * PageMetadata::kPageSize,
             CommittedMemory());
   DCHECK_EQ(
       static_cast<int>(capacity / PageMetadata::kPageSize) + quarantined_pages,
       memory_chunk_list_.size());
-  return true;
-}
-
-bool SemiSpace::Commit(size_t target_capacity) {
-  if (!EnsureCapacity(target_capacity)) {
-    return false;
-  }
-  Reset();
-  DCHECK_EQ(target_capacity, CommittedMemory());
-  DCHECK(IsCommitted());
-  return true;
 }
 
 void SemiSpace::Uncommit() {
-  DCHECK(IsCommitted());
   DCHECK_EQ(CommittedMemory(),
             memory_chunk_list_.size() * PageMetadata::kPageSize);
-  RewindPages(static_cast<int>(memory_chunk_list_.size()));
+  if (!memory_chunk_list_.Empty()) {
+    RewindPages(static_cast<int>(memory_chunk_list_.size()));
+  }
   current_page_ = nullptr;
   current_capacity_ = 0;
   quarantined_pages_count_ = 0;
@@ -175,14 +164,6 @@ void SemiSpace::FixPagesFlags() {
   }
 }
 
-void SemiSpace::Reset() {
-  DCHECK(first_page());
-  DCHECK(last_page());
-  current_page_ = first_page();
-  current_capacity_ = PageMetadata::kPageSize;
-  quarantined_pages_count_ = 0;
-}
-
 void SemiSpace::RemovePage(PageMetadata* page) {
   if (current_page_ == page) {
     if (page->prev_page()) {
@@ -207,9 +188,6 @@ void SemiSpace::MovePageToTheEnd(PageMetadata* page) {
 }
 
 void SemiSpace::Swap(SemiSpace* from, SemiSpace* to) {
-  // We won't be swapping semispaces without data in them.
-  DCHECK(from->first_page());
-  DCHECK(to->first_page());
   // We swap all properties but id_.
   std::swap(from->memory_chunk_list_, to->memory_chunk_list_);
   std::swap(from->current_page_, to->current_page_);
@@ -240,8 +218,31 @@ void SemiSpace::Swap(SemiSpace* from, SemiSpace* to) {
 }
 
 bool SemiSpace::AdvancePage(size_t target_capacity) {
-  PageMetadata* next_page = current_page_->next_page();
-  if (!next_page) return false;
+  PageMetadata* next_page;
+
+  if (current_page_) {
+    next_page = current_page_->next_page();
+  } else {
+    // Start allocating on the first page but skip the quarantined pages.
+    DCHECK_GE(memory_chunk_list_.size(), quarantined_pages_count_);
+    next_page = first_page();
+    for (size_t i = 0; i < quarantined_pages_count_; i++) {
+      DCHECK_NOT_NULL(next_page);
+      next_page = next_page->next_page();
+    }
+  }
+
+  if (!next_page && current_capacity_ < target_capacity) {
+    DCHECK_IMPLIES(current_page_, current_page_ == last_page());
+    if (!AllocateFreshPage()) return false;
+    next_page = last_page();
+    DCHECK_NOT_NULL(next_page);
+  }
+
+  if (!next_page) {
+    return false;
+  }
+
   current_page_ = next_page;
   base::AsAtomicWord::Relaxed_Store(
       &current_capacity_, current_capacity_ + PageMetadata::kPageSize);
@@ -283,6 +284,12 @@ std::unique_ptr<ObjectIterator> SemiSpace::GetObjectIterator(Heap* heap) {
   UNREACHABLE();
 }
 
+void SemiSpace::Reset() {
+  current_page_ = nullptr;
+  current_capacity_ = 0;
+  quarantined_pages_count_ = 0;
+}
+
 #ifdef DEBUG
 void SemiSpace::Print() {}
 #endif
@@ -384,7 +391,6 @@ void SemiSpace::MoveQuarantinedPage(MemoryChunk* chunk) {
   page->set_owner(this);
   AccountCommitted(PageMetadata::kPageSize);
   IncrementCommittedPhysicalMemory(page->CommittedPhysicalMemory());
-  DCHECK(!memory_chunk_list_.Empty());
   memory_chunk_list_.PushFront(page);
   quarantined_pages_count_++;
 }
@@ -395,11 +401,11 @@ void SemiSpace::MoveQuarantinedPage(MemoryChunk* chunk) {
 NewSpace::NewSpace(Heap* heap)
     : SpaceWithLinearArea(heap, NEW_SPACE, nullptr) {}
 
-void NewSpace::PromotePageToOldSpace(PageMetadata* page) {
+void NewSpace::PromotePageToOldSpace(PageMetadata* page, FreeMode free_mode) {
   DCHECK(!page->Chunk()->IsFlagSet(MemoryChunk::PAGE_NEW_OLD_PROMOTION));
   DCHECK(page->Chunk()->InYoungGeneration());
   RemovePage(page);
-  PageMetadata* new_page = PageMetadata::ConvertNewToOld(page);
+  PageMetadata* new_page = PageMetadata::ConvertNewToOld(page, free_mode);
   DCHECK(!new_page->Chunk()->InYoungGeneration());
   USE(new_page);
 }
@@ -424,53 +430,48 @@ SemiSpaceNewSpace::SemiSpaceNewSpace(Heap* heap,
   DCHECK_LE(static_cast<size_t>(PageMetadata::kPageSize), minimum_capacity_);
   DCHECK_LE(minimum_capacity_, target_capacity_);
   DCHECK_LE(target_capacity_, maximum_capacity_);
-
-  if (!to_space_.Commit(target_capacity_)) {
-    DCHECK(!to_space_.IsCommitted());
-    V8::FatalProcessOutOfMemory(heap->isolate(), "New space setup");
-  }
-  age_mark_ = to_space_.first_page()->area_start();
-  DCHECK(!from_space_.IsCommitted());  // No need to use memory yet.
-  ResetCurrentSpace();
 }
 
 void SemiSpaceNewSpace::Grow(size_t new_capacity) {
   heap()->safepoint()->AssertActive();
-  DCHECK_LT(TotalCapacity(), MaximumCapacity());
-  DCHECK_LE(new_capacity, MaximumCapacity());
-
   DCHECK(MemoryChunk::IsAligned(new_capacity));
+  DCHECK_LE(target_capacity_, new_capacity);
   DCHECK_LE(new_capacity, maximum_capacity_);
-  DCHECK_GT(new_capacity, target_capacity_);
-
-  if (to_space_.EnsureCapacity(new_capacity)) {
-    // Only grow from space if we managed to grow to-space.
-    if (!from_space_.EnsureCapacity(new_capacity)) {
-      // If we managed to grow to-space but couldn't grow from-space,
-      // attempt to shrink to-space.
-      to_space_.EnsureCapacity(target_capacity_);
-      return;
-    }
-  }
-
   target_capacity_ = new_capacity;
-  DCHECK_SEMISPACE_ALLOCATION_TOP(allocation_top(), to_space_);
+}
+
+void SemiSpaceNewSpace::GrowToMaximumCapacityForTesting() {
+  Grow(maximum_capacity_);
 }
 
 void SemiSpaceNewSpace::SetAgeMarkAndBelowAgeMarkPageFlags() {
   age_mark_ = allocation_top();
-  PageMetadata* age_mark_page =
-      PageMetadata::FromAllocationAreaAddress(age_mark_);
-  size_t below_age_mark_pages = 0;
-  DCHECK_EQ(age_mark_page->owner(), &to_space());
-  // Mark all pages up to the one containing mark.
-  for (PageMetadata* p : to_space()) {
-    below_age_mark_pages++;
-    p->Chunk()->SetFlagNonExecutable(MemoryChunk::NEW_SPACE_BELOW_AGE_MARK);
-    if (p == age_mark_page) break;
+
+  PageMetadata* current_page = to_space().first_page();
+
+  for (size_t i = 0; i < to_space_.quarantined_pages_count_; i++) {
+    DCHECK_NOT_NULL(current_page);
+    current_page->Chunk()->SetFlagNonExecutable(
+        MemoryChunk::NEW_SPACE_BELOW_AGE_MARK);
+    current_page = current_page->next_page();
+  }
+
+  if (age_mark_) {
+    PageMetadata* age_mark_page =
+        PageMetadata::FromAllocationAreaAddress(age_mark_);
+    DCHECK_EQ(age_mark_page->owner(), &to_space());
+
+    // Mark all pages up to (and including) the one containing mark.
+    for (; current_page != age_mark_page;
+         current_page = current_page->next_page()) {
+      current_page->Chunk()->SetFlagNonExecutable(
+          MemoryChunk::NEW_SPACE_BELOW_AGE_MARK);
+    }
+
+    DCHECK_EQ(current_page, age_mark_page);
+    current_page->Chunk()->SetFlagNonExecutable(
+        MemoryChunk::NEW_SPACE_BELOW_AGE_MARK);
   }
-  DCHECK_LT(to_space().quarantined_pages_count_, below_age_mark_pages);
-  USE(below_age_mark_pages);
 }
 
 void SemiSpaceNewSpace::Shrink(size_t new_capacity) {
@@ -480,11 +481,11 @@ void SemiSpaceNewSpace::Shrink(size_t new_capacity) {
   DCHECK_LE(target_capacity_, maximum_capacity_);
 
   target_capacity_ = new_capacity;
-  to_space_.EnsureCapacity(new_capacity);
-  DCHECK_SEMISPACE_ALLOCATION_TOP(allocation_top(), to_space_);
-  if (from_space_.IsCommitted()) {
-    from_space_.Uncommit();
+  to_space_.ShrinkCapacityTo(new_capacity);
+  if (allocation_top()) {
+    DCHECK_SEMISPACE_ALLOCATION_TOP(allocation_top(), to_space_);
   }
+  from_space_.Uncommit();
 }
 
 size_t SemiSpaceNewSpace::CommittedPhysicalMemory() const {
@@ -496,30 +497,8 @@ size_t SemiSpaceNewSpace::CommittedPhysicalMemory() const {
   return size;
 }
 
-bool SemiSpaceNewSpace::EnsureCurrentCapacity() {
-  // Order here is important to make use of the page pool.
-  return to_space_.EnsureCapacityIfCommitted(target_capacity_) &&
-         from_space_.EnsureCapacityIfCommitted(target_capacity_);
-}
-
-void SemiSpaceNewSpace::ResetCurrentSpace() {
-  to_space_.Reset();
-  quarantined_size_ = 0;
-  // Clear all mark-bits in the to-space.
-  for (PageMetadata* p : to_space_) {
-    if (!v8_flags.separate_gc_phases) {
-      p->ClearLiveness();
-    } else {
-      DCHECK(p->IsLivenessClear());
-    }
-    // Concurrent marking may have local live bytes for this page.
-    heap()->concurrent_marking()->ClearMemoryChunkData(p);
-  }
-  ResetAllocationTopToCurrentPageStart();
-}
-
 bool SemiSpaceNewSpace::AddFreshPage() {
-  DCHECK_EQ(allocation_top(), to_space_.page_high());
+  DCHECK_IMPLIES(allocation_top(), allocation_top() == to_space_.page_high());
 
   if (to_space_.AdvancePage(target_capacity_)) {
     ResetAllocationTopToCurrentPageStart();
@@ -565,6 +544,7 @@ void SemiSpaceNewSpace::ResetParkedAllocationBuffers() {
 }
 
 int SemiSpaceNewSpace::GetSpaceRemainingOnCurrentPageForTesting() {
+  if (!allocation_top()) return 0;
   return static_cast<int>(to_space_.page_high() - allocation_top());
 }
 
@@ -655,6 +635,11 @@ void SemiSpaceNewSpace::MakeAllPagesInFromSpaceIterable() {
 }
 
 void SemiSpaceNewSpace::MakeUnusedPagesInToSpaceIterable() {
+  if (!to_space().current_page()) {
+    DCHECK(to_space().memory_chunk_list().Empty());
+    return;
+  }
+
   PageIterator it(to_space().current_page());
 
   // Fix the remaining unused pages in the "to" semispace.
@@ -688,14 +673,25 @@ bool SemiSpaceNewSpace::ContainsSlow(Address a) const {
 }
 
 size_t SemiSpaceNewSpace::Size() const {
-  size_t top = allocation_top();
+  size_t const top = allocation_top();
+  size_t const quarantined = QuarantinedSize();
+
+  if (top) {
+    DCHECK_SEMISPACE_ALLOCATION_TOP(top, to_space_);
+    return quarantined +
+           (to_space_.current_capacity() - PageMetadata::kPageSize) /
+               PageMetadata::kPageSize *
+               MemoryChunkLayout::AllocatableMemoryInDataPage() +
+           static_cast<size_t>(top - to_space_.page_low());
+  } else {
+    DCHECK_EQ(to_space_.current_capacity(), 0);
+    return quarantined;
+  }
+}
 
-  DCHECK_GE(top, to_space_.page_low());
-  return QuarantinedSize() +
-         (to_space_.current_capacity() - PageMetadata::kPageSize) /
-             PageMetadata::kPageSize *
-             MemoryChunkLayout::AllocatableMemoryInDataPage() +
-         static_cast<size_t>(top - to_space_.page_low());
+size_t SemiSpaceNewSpace::Available() const {
+  DCHECK_GE(Capacity(), Size() - QuarantinedSize());
+  return Capacity() - (Size() - QuarantinedSize());
 }
 
 size_t SemiSpaceNewSpace::AllocatedSinceLastGC() const {
@@ -706,22 +702,23 @@ size_t SemiSpaceNewSpace::AllocatedSinceLastGC() const {
 
 void SemiSpaceNewSpace::GarbageCollectionPrologue() {
   ResetParkedAllocationBuffers();
-
-  // We need to commit from space here to be able to check for from/to space
-  // pages later on in the GC. We need to commit before sweeping starts to avoid
-  // empty pages being reused for commiting from space and thus ending up with
-  // remembered set entries that point to from space instead of freed memory.
-  if (!from_space_.Commit(target_capacity_)) {
-    heap_->FatalProcessOutOfMemory("Committing semi space failed.");
-  }
 }
 
-void SemiSpaceNewSpace::EvacuatePrologue() {
+void SemiSpaceNewSpace::SwapSemiSpaces() {
   // Flip the semispaces. After flipping, to space is empty and from space has
   // live objects.
   SemiSpace::Swap(&from_space_, &to_space_);
-  ResetCurrentSpace();
+  to_space_.Reset();
+  from_space_.Reset();
+  quarantined_size_ = 0;
+  allocation_top_ = kNullAddress;
   DCHECK_EQ(0u, Size());
+
+#if DEBUG
+  for (PageMetadata* p : to_space_) {
+    DCHECK(p->IsLivenessClear());
+  }
+#endif  // DEBUG
 }
 
 void SemiSpaceNewSpace::GarbageCollectionEpilogue() {
@@ -733,6 +730,10 @@ void SemiSpaceNewSpace::GarbageCollectionEpilogue() {
     ZapUnusedMemory();
   }
 
+  // Shrink from-space down to target_capacity_ if necessary.
+  from_space_.ShrinkCapacityTo(target_capacity_);
+  // to-space always fits into target_capacity_ after the GC.
+  DCHECK_LE(to_space_.current_capacity(), target_capacity_);
   MakeAllPagesInFromSpaceIterable();
 }
 
@@ -761,29 +762,30 @@ bool SemiSpaceNewSpace::IsPromotionCandidate(
 std::optional<std::pair<Address, Address>> SemiSpaceNewSpace::Allocate(
     int size_in_bytes, AllocationAlignment alignment) {
   size_in_bytes = ALIGN_TO_ALLOCATION_ALIGNMENT(size_in_bytes);
-  DCHECK_SEMISPACE_ALLOCATION_TOP(allocation_top(), to_space_);
-
   Address top = allocation_top();
-  Address high = to_space_.page_high();
-  int filler_size = Heap::GetFillToAlign(top, alignment);
-  int aligned_size_in_bytes = size_in_bytes + filler_size;
-
-  if (top + aligned_size_in_bytes <= high) {
-    IncrementAllocationTop(high);
-    return std::pair(top, high);
-  }
-
-  int remaining_in_page = static_cast<int>(high - top);
-  heap()->CreateFillerObjectAt(top, remaining_in_page);
-  SetAllocationTop(high);
+  if (top) {
+    DCHECK_SEMISPACE_ALLOCATION_TOP(allocation_top(), to_space_);
+    Address high = to_space_.page_high();
+    int filler_size = Heap::GetFillToAlign(top, alignment);
+    int aligned_size_in_bytes = size_in_bytes + filler_size;
+
+    if (top + aligned_size_in_bytes <= high) {
+      IncrementAllocationTop(high);
+      return std::pair(top, high);
+    }
 
-  // We park unused allocation buffer space of allocations happening from the
-  // mutator.
-  if (v8_flags.allocation_buffer_parking &&
-      heap()->gc_state() == Heap::NOT_IN_GC &&
-      remaining_in_page >= kAllocationBufferParkingThreshold) {
-    parked_allocation_buffers_.push_back(
-        ParkedAllocationBuffer(remaining_in_page, top));
+    int remaining_in_page = static_cast<int>(high - top);
+    heap()->CreateFillerObjectAt(top, remaining_in_page);
+    SetAllocationTop(high);
+
+    // We park unused allocation buffer space of allocations happening from the
+    // mutator.
+    if (v8_flags.allocation_buffer_parking &&
+        heap()->gc_state() == Heap::NOT_IN_GC &&
+        remaining_in_page >= kAllocationBufferParkingThreshold) {
+      parked_allocation_buffers_.push_back(
+          ParkedAllocationBuffer(remaining_in_page, top));
+    }
   }
 
   if (AddFreshPage()) {
@@ -866,11 +868,15 @@ PageMetadata* PagedSpaceForNewSpace::InitializePage(
 
 void PagedSpaceForNewSpace::Grow(size_t new_capacity) {
   heap()->safepoint()->AssertActive();
-  DCHECK_LT(TotalCapacity(), MaximumCapacity());
+  DCHECK_LE(TotalCapacity(), MaximumCapacity());
   DCHECK_LE(new_capacity, MaximumCapacity());
   target_capacity_ = new_capacity;
 }
 
+void PagedSpaceForNewSpace::GrowToMaximumCapacityForTesting() {
+  Grow(max_capacity_);
+}
+
 bool PagedSpaceForNewSpace::StartShrinking(size_t new_target_capacity) {
   DCHECK(heap()->tracer()->IsInAtomicPause());
   if (new_target_capacity > target_capacity_) return false;
@@ -889,7 +895,9 @@ void PagedSpaceForNewSpace::FinishShrinking() {
       DCHECK_NE(0, page->live_bytes());
     }
 #endif  // DEBUG
-    target_capacity_ = current_capacity_;
+    // After a minor GC current_capacity_ could be still above max_capacity_
+    // when not enough pages got promoted or died.
+    target_capacity_ = std::min(current_capacity_, max_capacity_);
   }
 }
 
diff --git a/deps/v8/src/heap/new-spaces.h b/deps/v8/src/heap/new-spaces.h
index 62c389666bbcaa..47e9b15021390c 100644
--- a/deps/v8/src/heap/new-spaces.h
+++ b/deps/v8/src/heap/new-spaces.h
@@ -56,20 +56,16 @@ class SemiSpace final : public Space {
   inline bool Contains(Tagged<T> o) const;
   inline bool ContainsSlow(Address a) const;
 
-  bool Commit(size_t target_capacity);
   void Uncommit();
   bool IsCommitted() const { return !memory_chunk_list_.Empty(); }
 
-  // Invokes `EnsureCapacity()` if the semi space is committed.
-  bool EnsureCapacityIfCommitted(size_t target_capacity);
-
   // Returns the start address of the first page of the space.
   Address space_start() const {
-    DCHECK_NE(memory_chunk_list_.front(), nullptr);
-    return memory_chunk_list_.front()->area_start();
+    const PageMetadata* page = first_page();
+    return page ? page->area_start() : kNullAddress;
   }
 
-  PageMetadata* current_page() { return current_page_; }
+  PageMetadata* current_page() const { return current_page_; }
 
   // Returns the start address of the current page of the space.
   Address page_low() const { return current_page_->area_start(); }
@@ -79,9 +75,6 @@ class SemiSpace final : public Space {
 
   bool AdvancePage(size_t target_capacity);
 
-  // Resets the space to using the first page.
-  void Reset();
-
   void RemovePage(PageMetadata* page);
   void MovePageToTheEnd(PageMetadata* page);
 
@@ -163,13 +156,17 @@ class SemiSpace final : public Space {
   void IncrementCommittedPhysicalMemory(size_t increment_value);
   void DecrementCommittedPhysicalMemory(size_t decrement_value);
 
-  bool EnsureCapacity(size_t capacity);
+  void ShrinkCapacityTo(size_t capacity);
+  void Reset();
 
   // The currently committed space capacity.
   size_t current_capacity_ = 0;
   size_t committed_physical_memory_ = 0;
   SemiSpaceId id_;
   PageMetadata* current_page_ = nullptr;
+
+  // The number of quarantined pages in this space. Those pages are at the front
+  // of memory_chunk_list_.
   size_t quarantined_pages_count_ = 0;
 
   friend class SemiSpaceNewSpace;
@@ -212,7 +209,7 @@ class NewSpace : NON_EXPORTED_BASE(public SpaceWithLinearArea) {
     return result;
   }
 
-  void PromotePageToOldSpace(PageMetadata* page);
+  void PromotePageToOldSpace(PageMetadata* page, FreeMode free_mode);
 
   virtual size_t Capacity() const = 0;
   virtual size_t TotalCapacity() const = 0;
@@ -238,7 +235,7 @@ class NewSpace : NON_EXPORTED_BASE(public SpaceWithLinearArea) {
 
   virtual bool IsPromotionCandidate(const MutablePageMetadata* page) const = 0;
 
-  virtual bool EnsureCurrentCapacity() = 0;
+  virtual void GrowToMaximumCapacityForTesting() = 0;
 
  protected:
   static const int kAllocationBufferParkingThreshold = 4 * KB;
@@ -318,9 +315,10 @@ class V8_EXPORT_PRIVATE SemiSpaceNewSpace final : public NewSpace {
   size_t CommittedPhysicalMemory() const final;
 
   // Return the available bytes without growing.
-  size_t Available() const final {
-    DCHECK_GE(Capacity(), Size() - QuarantinedSize());
-    return Capacity() - (Size() - QuarantinedSize());
+  size_t Available() const final;
+
+  bool ReachedTargetCapacity() const {
+    return to_space_.current_capacity_ >= target_capacity_;
   }
 
   size_t ExternalBackingStoreBytes(ExternalBackingStoreType type) const final {
@@ -332,7 +330,7 @@ class V8_EXPORT_PRIVATE SemiSpaceNewSpace final : public NewSpace {
 
   size_t AllocatedSinceLastGC() const final;
 
-  bool EnsureCurrentCapacity() final;
+  void GrowToMaximumCapacityForTesting() final;
 
   // Return the maximum capacity of a semispace.
   size_t MaximumCapacity() const final { return maximum_capacity_; }
@@ -409,7 +407,8 @@ class V8_EXPORT_PRIVATE SemiSpaceNewSpace final : public NewSpace {
 
   V8_INLINE bool ShouldBePromoted(Address object) const;
 
-  void EvacuatePrologue();
+  // Invoked at the beginning of a GC to swap from- and to-space.
+  void SwapSemiSpaces();
 
   void GarbageCollectionPrologue() final;
   void GarbageCollectionEpilogue() final;
@@ -439,9 +438,6 @@ class V8_EXPORT_PRIVATE SemiSpaceNewSpace final : public NewSpace {
 
   SemiSpace* active_space() { return &to_space_; }
 
-  // Reset the allocation pointer to the beginning of the active semispace.
-  void ResetCurrentSpace();
-
   std::optional<std::pair<Address, Address>> Allocate(
       int size_in_bytes, AllocationAlignment alignment);
 
@@ -457,7 +453,8 @@ class V8_EXPORT_PRIVATE SemiSpaceNewSpace final : public NewSpace {
   void Free(Address start, Address end);
 
   void ResetAllocationTopToCurrentPageStart() {
-    allocation_top_ = to_space_.page_low();
+    allocation_top_ =
+        to_space_.current_page() ? to_space_.page_low() : kNullAddress;
   }
 
   void SetAllocationTop(Address top) { allocation_top_ = top; }
@@ -474,7 +471,7 @@ class V8_EXPORT_PRIVATE SemiSpaceNewSpace final : public NewSpace {
 
   // Bump pointer for allocation. to_space_.page_low() <= allocation_top_ <=
   // to_space.page_high() always holds.
-  Address allocation_top_;
+  Address allocation_top_ = kNullAddress;
 
   ParkedAllocationBuffersVector parked_allocation_buffers_;
 
@@ -515,6 +512,7 @@ class V8_EXPORT_PRIVATE PagedSpaceForNewSpace final : public PagedSpaceBase {
 
   // Grow the capacity of the space.
   void Grow(size_t new_capacity);
+  void GrowToMaximumCapacityForTesting();
 
   // Shrink the capacity of the space.
   bool StartShrinking(size_t new_target_capacity);
@@ -542,8 +540,6 @@ class V8_EXPORT_PRIVATE PagedSpaceForNewSpace final : public PagedSpaceBase {
     last_lab_page_ = nullptr;
   }
 
-  bool EnsureCurrentCapacity() { return true; }
-
   PageMetadata* InitializePage(MutablePageMetadata* chunk) final;
 
   size_t AddPage(PageMetadata* page) final;
@@ -715,8 +711,8 @@ class V8_EXPORT_PRIVATE PagedNewSpace final : public NewSpace {
     return paged_space_.IsPromotionCandidate(page);
   }
 
-  bool EnsureCurrentCapacity() final {
-    return paged_space_.EnsureCurrentCapacity();
+  void GrowToMaximumCapacityForTesting() final {
+    paged_space_.GrowToMaximumCapacityForTesting();
   }
 
   PagedSpaceForNewSpace* paged_space() { return &paged_space_; }
diff --git a/deps/v8/src/heap/object-stats.cc b/deps/v8/src/heap/object-stats.cc
index a951b401839bb5..684426916a5022 100644
--- a/deps/v8/src/heap/object-stats.cc
+++ b/deps/v8/src/heap/object-stats.cc
@@ -858,8 +858,8 @@ void ObjectStatsCollectorImpl::CollectStatistics(
 void ObjectStatsCollectorImpl::CollectGlobalStatistics() {
   // Iterate boilerplates first to disambiguate them from regular JS objects.
   Tagged<Object> list = heap_->allocation_sites_list();
-  while (IsAllocationSite(list, cage_base())) {
-    Tagged<AllocationSite> site = Cast<AllocationSite>(list);
+  Tagged<AllocationSiteWithWeakNext> site;
+  while (TryCast(list, &site)) {
     RecordVirtualAllocationSiteDetails(site);
     list = site->weak_next();
   }
@@ -869,9 +869,6 @@ void ObjectStatsCollectorImpl::CollectGlobalStatistics() {
                                  StatsEnum::SERIALIZED_OBJECTS_TYPE);
   RecordSimpleVirtualObjectStats(HeapObject(), heap_->number_string_cache(),
                                  StatsEnum::NUMBER_STRING_CACHE_TYPE);
-  RecordSimpleVirtualObjectStats(HeapObject(),
-                                 heap_->single_character_string_table(),
-                                 StatsEnum::SINGLE_CHARACTER_STRING_TABLE_TYPE);
   RecordSimpleVirtualObjectStats(HeapObject(), heap_->string_split_cache(),
                                  StatsEnum::STRING_SPLIT_CACHE_TYPE);
   RecordSimpleVirtualObjectStats(HeapObject(), heap_->regexp_multiple_cache(),
diff --git a/deps/v8/src/heap/object-stats.h b/deps/v8/src/heap/object-stats.h
index e5da94b32211f2..f266472e965513 100644
--- a/deps/v8/src/heap/object-stats.h
+++ b/deps/v8/src/heap/object-stats.h
@@ -76,7 +76,6 @@
   V(SCRIPT_SOURCE_NON_EXTERNAL_ONE_BYTE_TYPE)    \
   V(SCRIPT_SOURCE_NON_EXTERNAL_TWO_BYTE_TYPE)    \
   V(SERIALIZED_OBJECTS_TYPE)                     \
-  V(SINGLE_CHARACTER_STRING_TABLE_TYPE)          \
   V(STRING_SPLIT_CACHE_TYPE)                     \
   V(STRING_EXTERNAL_RESOURCE_ONE_BYTE_TYPE)      \
   V(STRING_EXTERNAL_RESOURCE_TWO_BYTE_TYPE)      \
diff --git a/deps/v8/src/heap/page-metadata.cc b/deps/v8/src/heap/page-metadata.cc
index 7893b48f45a0e2..5fd15567a2d5bb 100644
--- a/deps/v8/src/heap/page-metadata.cc
+++ b/deps/v8/src/heap/page-metadata.cc
@@ -51,7 +51,8 @@ void PageMetadata::ReleaseFreeListCategories() {
   }
 }
 
-PageMetadata* PageMetadata::ConvertNewToOld(PageMetadata* old_page) {
+PageMetadata* PageMetadata::ConvertNewToOld(PageMetadata* old_page,
+                                            FreeMode free_mode) {
   DCHECK(old_page);
   MemoryChunk* chunk = old_page->Chunk();
   DCHECK(chunk->InNewSpace());
@@ -63,7 +64,7 @@ PageMetadata* PageMetadata::ConvertNewToOld(PageMetadata* old_page) {
   chunk->SetOldGenerationPageFlags(
       old_page->heap()->incremental_marking()->marking_mode(), OLD_SPACE);
   PageMetadata* new_page = old_space->InitializePage(old_page);
-  old_space->AddPromotedPage(new_page);
+  old_space->AddPromotedPage(new_page, free_mode);
   return new_page;
 }
 
@@ -83,71 +84,6 @@ void PageMetadata::MarkNeverAllocateForTesting() {
   reinterpret_cast<PagedSpace*>(owner())->free_list()->EvictFreeListItems(this);
 }
 
-#ifdef DEBUG
-namespace {
-// Skips filler starting from the given filler until the end address.
-// Returns the first address after the skipped fillers.
-Address SkipFillers(PtrComprCageBase cage_base, Tagged<HeapObject> filler,
-                    Address end) {
-  Address addr = filler.address();
-  while (addr < end) {
-    filler = HeapObject::FromAddress(addr);
-    CHECK(IsFreeSpaceOrFiller(filler, cage_base));
-    addr = filler.address() + filler->Size(cage_base);
-  }
-  return addr;
-}
-}  // anonymous namespace
-#endif  // DEBUG
-
-size_t PageMetadata::ShrinkToHighWaterMark() {
-  // Shrinking only makes sense outside of the CodeRange, where we don't care
-  // about address space fragmentation.
-  VirtualMemory* reservation = reserved_memory();
-  if (!reservation->IsReserved()) return 0;
-
-  // Shrink pages to high water mark. The water mark points either to a filler
-  // or the area_end.
-  Tagged<HeapObject> filler = HeapObject::FromAddress(HighWaterMark());
-  if (filler.address() == area_end()) return 0;
-  PtrComprCageBase cage_base(heap()->isolate());
-  CHECK(IsFreeSpaceOrFiller(filler, cage_base));
-  // Ensure that no objects were allocated in [filler, area_end) region.
-  DCHECK_EQ(area_end(), SkipFillers(cage_base, filler, area_end()));
-  // Ensure that no objects will be allocated on this page.
-  DCHECK_EQ(0u, AvailableInFreeList());
-
-  // Ensure that slot sets are empty. Otherwise the buckets for the shrunk
-  // area would not be freed when deallocating this page.
-  DCHECK_NULL(slot_set<OLD_TO_NEW>());
-  DCHECK_NULL(slot_set<OLD_TO_NEW_BACKGROUND>());
-  DCHECK_NULL(slot_set<OLD_TO_OLD>());
-
-  Chunk()->SetFlagNonExecutable(MemoryChunk::SHRINK_TO_HIGH_WATER_MARK);
-
-  size_t unused = RoundDown(static_cast<size_t>(area_end() - filler.address()),
-                            MemoryAllocator::GetCommitPageSize());
-  if (unused > 0) {
-    DCHECK_EQ(0u, unused % MemoryAllocator::GetCommitPageSize());
-    if (v8_flags.trace_gc_verbose) {
-      PrintIsolate(heap()->isolate(), "Shrinking page %p: end %p -> %p\n",
-                   reinterpret_cast<void*>(this),
-                   reinterpret_cast<void*>(area_end()),
-                   reinterpret_cast<void*>(area_end() - unused));
-    }
-    heap()->CreateFillerObjectAt(
-        filler.address(),
-        static_cast<int>(area_end() - filler.address() - unused));
-    heap()->memory_allocator()->PartialFreeMemory(
-        this, ChunkAddress() + size() - unused, unused, area_end() - unused);
-    if (filler.address() != area_end()) {
-      CHECK(IsFreeSpaceOrFiller(filler, cage_base));
-      CHECK_EQ(filler.address() + filler->Size(cage_base), area_end());
-    }
-  }
-  return unused;
-}
-
 void PageMetadata::CreateBlackArea(Address start, Address end) {
   DCHECK(!v8_flags.black_allocated_pages);
   DCHECK_NE(NEW_SPACE, owner_identity());
diff --git a/deps/v8/src/heap/page-metadata.h b/deps/v8/src/heap/page-metadata.h
index a3cf8ad30bfbdd..f24ee69c5b230b 100644
--- a/deps/v8/src/heap/page-metadata.h
+++ b/deps/v8/src/heap/page-metadata.h
@@ -58,7 +58,8 @@ class PageMetadata : public MutablePageMetadata {
     return MemoryChunk::IsAligned(addr);
   }
 
-  static PageMetadata* ConvertNewToOld(PageMetadata* old_page);
+  static PageMetadata* ConvertNewToOld(PageMetadata* old_page,
+                                       FreeMode free_mode);
 
   V8_EXPORT_PRIVATE void MarkNeverAllocateForTesting();
   inline void MarkEvacuationCandidate();
@@ -92,8 +93,6 @@ class PageMetadata : public MutablePageMetadata {
     return categories_[type];
   }
 
-  V8_EXPORT_PRIVATE size_t ShrinkToHighWaterMark();
-
   V8_EXPORT_PRIVATE void CreateBlackArea(Address start, Address end);
   void DestroyBlackArea(Address start, Address end);
 
diff --git a/deps/v8/src/heap/page-pool.cc b/deps/v8/src/heap/page-pool.cc
index 8317eeb83905b5..1f495a54152d34 100644
--- a/deps/v8/src/heap/page-pool.cc
+++ b/deps/v8/src/heap/page-pool.cc
@@ -9,168 +9,255 @@
 #include "src/heap/mutable-page-metadata.h"
 #include "src/tasks/cancelable-task.h"
 
-namespace v8 {
-namespace internal {
+namespace v8::internal {
 
-PagePool::~PagePool() {
-  DCHECK(shared_pool_.empty());
-  DCHECK(local_pools.empty());
+template <typename PoolEntry>
+void PagePool::PoolImpl<PoolEntry>::TearDown() {
+  DCHECK(local_pools_.empty());
+  shared_pool_.clear();
 }
 
-class ReleasePooledChunksTask final : public CancelableTask {
- public:
-  ReleasePooledChunksTask(Isolate* isolate, PagePool* pool, size_t id)
-      : CancelableTask(isolate), isolate_(isolate), pool_(pool), id_(id) {}
+template <typename PoolEntry>
+void PagePool::PoolImpl<PoolEntry>::PutLocal(Isolate* isolate,
+                                             PoolEntry entry) {
+  base::MutexGuard guard(&mutex_);
+  local_pools_[isolate].emplace_back(std::move(entry));
+}
 
-  ~ReleasePooledChunksTask() override = default;
-  ReleasePooledChunksTask(const ReleasePooledChunksTask&) = delete;
-  ReleasePooledChunksTask& operator=(const ReleasePooledChunksTask&) = delete;
+template <typename PoolEntry>
+std::optional<PoolEntry> PagePool::PoolImpl<PoolEntry>::Get(Isolate* isolate) {
+  DCHECK_NOT_NULL(isolate);
+  base::MutexGuard guard(&mutex_);
 
- private:
-  void RunInternal() override {
-    size_t count = pool_->ReleaseUpTo(id_);
-    if (v8_flags.trace_gc_nvp) {
-      isolate_->PrintWithTimestamp("Removed %zu pages from the shared pool.\n",
-                                   count);
+  // Try to get a page from the page pool for the given isolate first.
+  auto it = local_pools_.find(isolate);
+
+  if (it == local_pools_.end()) {
+    // Pages in this pool will be flushed soon. Take them first.
+    if (!shared_pool_.empty()) {
+      auto& shared_entries = shared_pool_.back().second;
+      if (!shared_entries.empty()) {
+        PoolEntry shared_entry = std::move(shared_entries.back());
+        shared_entries.pop_back();
+        if (shared_entries.empty()) {
+          shared_pool_.pop_back();
+        }
+        return {std::move(shared_entry)};
+      }
     }
-  }
 
-  Isolate* const isolate_;
-  PagePool* const pool_;
-  const size_t id_;
-};
+    // Otherwise steal from some other isolate's local pool.
+    it = local_pools_.begin();
+  }
 
-void PagePool::ReleaseOnTearDown(Isolate* isolate) {
-  base::MutexGuard guard(&mutex_);
-  auto it = local_pools.find(isolate);
+  if (it != local_pools_.end()) {
+    DCHECK(!it->second.empty());
+    std::vector<PoolEntry>& entries = it->second;
+    if (!entries.empty()) {
+      PoolEntry local_entry = std::move(entries.back());
+      entries.pop_back();
+      if (entries.empty()) {
+        local_pools_.erase(it);
+      }
+      return {std::move(local_entry)};
+    }
+  }
 
-  size_t id = next_id_++;
+  return std::nullopt;
+}
 
-  if (it != local_pools.end()) {
+template <typename PoolEntry>
+bool PagePool::PoolImpl<PoolEntry>::MoveLocalToShared(
+    Isolate* isolate, InternalTime release_time) {
+  base::MutexGuard guard(&mutex_);
+  auto it = local_pools_.find(isolate);
+  if (it != local_pools_.end()) {
     DCHECK(!it->second.empty());
-    shared_pool_.push_back(std::make_pair(std::move(it->second), id));
-    local_pools.erase(it);
+    shared_pool_.push_back(std::make_pair(release_time, std::move(it->second)));
+    local_pools_.erase(it);
   }
+  return !shared_pool_.empty();
+}
 
-  // Always post task when there are pages in the shared pool.
-  if (!shared_pool_.empty()) {
-    auto schedule_task = [this, isolate, id](Isolate* target_isolate) {
-      DCHECK_NE(isolate, target_isolate);
-      USE(isolate);
-      static constexpr base::TimeDelta kReleaseTaskDelayInSeconds =
-          base::TimeDelta::FromSeconds(8);
-      target_isolate->task_runner()->PostDelayedTask(
-          std::make_unique<ReleasePooledChunksTask>(target_isolate, this, id),
-          kReleaseTaskDelayInSeconds.InSecondsF());
-    };
+template <typename PoolEntry>
+void PagePool::PoolImpl<PoolEntry>::ClearShared() {
+  std::vector<std::pair<InternalTime, std::vector<PoolEntry>>> entries_to_free;
+  {
+    base::MutexGuard guard(&mutex_);
+    entries_to_free = std::move(shared_pool_);
+    shared_pool_.clear();
+  }
+  // Entries will be freed automatically here.
+}
 
-    if (!isolate->isolate_group()->FindAnotherIsolateLocked(isolate,
-                                                            schedule_task)) {
-      // No other isolate could be found. Release pooled pages right away.
-      for (auto entry : shared_pool_) {
-        for (auto page : entry.first) {
-          MemoryAllocator::DeleteMemoryChunk(page);
-        }
-      }
-      shared_pool_.clear();
+template <typename PoolEntry>
+void PagePool::PoolImpl<PoolEntry>::ClearLocal() {
+  std::vector<std::vector<PoolEntry>> entries_to_free;
+  {
+    base::MutexGuard page_guard(&mutex_);
+    for (auto& entry : local_pools_) {
+      entries_to_free.push_back(std::move(entry.second));
     }
+    local_pools_.clear();
   }
+  // Entries will be freed automatically here.
 }
 
-void PagePool::ReleaseImmediately(Isolate* isolate) {
-  std::vector<MutablePageMetadata*> pages_to_free;
-
+template <typename PoolEntry>
+void PagePool::PoolImpl<PoolEntry>::ClearLocal(Isolate* isolate) {
+  std::vector<PoolEntry> entries_to_free;
   {
-    base::MutexGuard guard(&mutex_);
-    auto it = local_pools.find(isolate);
-
-    if (it != local_pools.end()) {
+    base::MutexGuard page_guard(&mutex_);
+    const auto it = local_pools_.find(isolate);
+    if (it != local_pools_.end()) {
       DCHECK(!it->second.empty());
-      pages_to_free = std::move(it->second);
-      local_pools.erase(it);
+      entries_to_free = std::move(it->second);
+      local_pools_.erase(it);
     }
   }
+  // Entries will be freed automatically here.
+}
 
-  for (MutablePageMetadata* page : pages_to_free) {
-    MemoryAllocator::DeleteMemoryChunk(page);
+template <typename PoolEntry>
+size_t PagePool::PoolImpl<PoolEntry>::Size() const {
+  base::MutexGuard guard(&mutex_);
+  size_t count = 0;
+  for (const auto& entry : local_pools_) {
+    count += entry.second.size();
   }
+  for (const auto& entry : shared_pool_) {
+    count += entry.second.size();
+  }
+  return count;
 }
 
-void PagePool::TearDown() {
-  DCHECK(local_pools.empty());
+template <typename PoolEntry>
+size_t PagePool::PoolImpl<PoolEntry>::LocalSize(Isolate* isolate) const {
+  base::MutexGuard guard(&mutex_);
+  const auto it = local_pools_.find(isolate);
+  return (it != local_pools_.end()) ? it->second.size() : 0;
+}
 
-  for (auto entry : shared_pool_) {
-    for (auto page : entry.first) {
-      MemoryAllocator::DeleteMemoryChunk(page);
-    }
+template <typename PoolEntry>
+size_t PagePool::PoolImpl<PoolEntry>::SharedSize() const {
+  base::MutexGuard guard(&mutex_);
+  size_t count = 0;
+  for (const auto& entry : shared_pool_) {
+    count += entry.second.size();
   }
-  shared_pool_.clear();
+  return count;
 }
 
-size_t PagePool::ReleaseUpTo(size_t id) {
-  std::vector<std::vector<MutablePageMetadata*>> groups_to_free;
-
+template <typename PoolEntry>
+size_t PagePool::PoolImpl<PoolEntry>::ReleaseUpTo(InternalTime release_time) {
+  std::vector<std::vector<PoolEntry>> entries_to_free;
+  size_t freed = 0;
   {
     base::MutexGuard guard(&mutex_);
-    std::erase_if(shared_pool_, [&groups_to_free, id](auto entry) {
-      if (entry.second <= id) {
-        groups_to_free.push_back(std::move(entry.first));
-        return true;
-      }
-
-      return false;
-    });
+    std::erase_if(shared_pool_,
+                  [&entries_to_free, &freed, release_time](auto& entry) {
+                    if (entry.first <= release_time) {
+                      freed += entry.second.size();
+                      entries_to_free.push_back(std::move(entry.second));
+                      return true;
+                    }
+                    return false;
+                  });
   }
+  // Entries will be freed automatically here.
+  return freed;
+}
 
-  size_t freed = 0;
+PagePool::~PagePool() = default;
 
-  for (auto group : groups_to_free) {
-    for (auto page : group) {
-      MemoryAllocator::DeleteMemoryChunk(page);
-      ++freed;
-    }
-  }
+class PagePool::ReleasePooledChunksTask final : public CancelableTask {
+ public:
+  ReleasePooledChunksTask(Isolate* isolate, PagePool* pool,
+                          InternalTime release_time)
+      : CancelableTask(isolate),
+        isolate_(isolate),
+        pool_(pool),
+        release_time_(release_time) {}
 
-  return freed;
-}
+  ~ReleasePooledChunksTask() override = default;
+  ReleasePooledChunksTask(const ReleasePooledChunksTask&) = delete;
+  ReleasePooledChunksTask& operator=(const ReleasePooledChunksTask&) = delete;
 
-size_t PagePool::GetCount(Isolate* isolate) const {
-  base::MutexGuard guard(&mutex_);
-  auto it = local_pools.find(isolate);
-  if (it != local_pools.end()) {
-    return it->second.size();
-  }
+ private:
+  void RunInternal() override { pool_->ReleaseUpTo(isolate_, release_time_); }
 
-  return 0;
-}
+  Isolate* const isolate_;
+  PagePool* const pool_;
+  const InternalTime release_time_;
+};
 
-size_t PagePool::GetSharedCount() const {
-  base::MutexGuard guard(&mutex_);
-  size_t count = 0;
+void PagePool::ReleaseOnTearDown(Isolate* isolate) {
+  const InternalTime time = next_time_.fetch_add(1, std::memory_order_relaxed);
+
+  const bool shared_page_pool_populate =
+      page_pool_.MoveLocalToShared(isolate, time);
+  const bool shared_zone_pool_populated =
+      zone_pool_.MoveLocalToShared(isolate, time);
+
+  // Always post task when there are pages in the shared pool.
+  if (shared_page_pool_populate || shared_zone_pool_populated) {
+    auto schedule_task = [this, isolate, time](Isolate* target_isolate) {
+      DCHECK_NE(isolate, target_isolate);
+      USE(isolate);
+      static constexpr base::TimeDelta kReleaseTaskDelayInSeconds =
+          base::TimeDelta::FromSeconds(8);
+      target_isolate->task_runner()->PostDelayedTask(
+          std::make_unique<ReleasePooledChunksTask>(target_isolate, this, time),
+          kReleaseTaskDelayInSeconds.InSecondsF());
+    };
 
-  for (auto& entry : shared_pool_) {
-    count += entry.first.size();
+    if (!isolate->isolate_group()->FindAnotherIsolateLocked(isolate,
+                                                            schedule_task)) {
+      // No other isolate could be found. Release pooled pages right away.
+      page_pool_.ClearShared();
+      zone_pool_.ClearShared();
+    }
   }
+}
 
-  return count;
+void PagePool::ReleaseImmediately(Isolate* isolate) {
+  page_pool_.ClearLocal(isolate);
+  zone_pool_.ClearLocal(isolate);
 }
 
-size_t PagePool::GetTotalCount() const {
-  base::MutexGuard guard(&mutex_);
-  size_t count = 0;
+void PagePool::ReleaseImmediately() {
+  page_pool_.ClearLocal();
+  page_pool_.ClearShared();
+  zone_pool_.ClearLocal();
+  page_pool_.ClearShared();
+}
 
-  for (auto& entry : shared_pool_) {
-    count += entry.first.size();
-  }
+void PagePool::TearDown() {
+  page_pool_.TearDown();
+  zone_pool_.TearDown();
+}
 
-  for (auto& entry : local_pools) {
-    count += entry.second.size();
+void PagePool::ReleaseUpTo(Isolate* isolate_for_printing,
+                           InternalTime release_time) {
+  const auto pages_removed = page_pool_.ReleaseUpTo(release_time);
+  const auto zone_reservations_removed = zone_pool_.ReleaseUpTo(release_time);
+  if (v8_flags.trace_gc_nvp) {
+    isolate_for_printing->PrintWithTimestamp(
+        "Shared pool: Removed pages: %zu removed zone reservations: %zu\n",
+        pages_removed, zone_reservations_removed);
   }
+}
 
-  return count;
+size_t PagePool::GetCount(Isolate* isolate) const {
+  return page_pool_.LocalSize(isolate);
 }
 
+size_t PagePool::GetSharedCount() const { return page_pool_.SharedSize(); }
+
+size_t PagePool::GetTotalCount() const { return page_pool_.Size(); }
+
 void PagePool::Add(Isolate* isolate, MutablePageMetadata* chunk) {
+  DCHECK_NOT_NULL(isolate);
   // This method is called only on the main thread and only during the
   // atomic pause so a lock is not needed.
   DCHECK_NOT_NULL(chunk);
@@ -179,48 +266,30 @@ void PagePool::Add(Isolate* isolate, MutablePageMetadata* chunk) {
   DCHECK(!chunk->Chunk()->IsTrusted());
   DCHECK_NE(chunk->Chunk()->executable(), EXECUTABLE);
   chunk->ReleaseAllAllocatedMemory();
-  base::MutexGuard guard(&mutex_);
-  local_pools[isolate].push_back(chunk);
+  page_pool_.PutLocal(isolate,
+                      PageMemory(chunk, [](MutablePageMetadata* metadata) {
+                        MemoryAllocator::DeleteMemoryChunk(metadata);
+                      }));
 }
 
 MutablePageMetadata* PagePool::Remove(Isolate* isolate) {
-  base::MutexGuard guard(&mutex_);
-
-  // Try to get a page from the page pool for the given isolate first.
-  auto it = local_pools.find(isolate);
-
-  if (it == local_pools.end()) {
-    // Pages in this pool will be flushed soon. Take them first.
-    if (!shared_pool_.empty()) {
-      auto& group = shared_pool_.back().first;
-      MutablePageMetadata* page = group.back();
-      group.pop_back();
-      if (group.empty()) {
-        shared_pool_.pop_back();
-      }
-      return page;
-    }
-
-    // Otherwise steal from some other isolate's local pool.
-    it = local_pools.begin();
+  DCHECK_NOT_NULL(isolate);
+  auto result = page_pool_.Get(isolate);
+  if (result) {
+    return result.value().release();
   }
+  return nullptr;
+}
 
-  if (it != local_pools.end()) {
-    std::vector<MutablePageMetadata*>& pages = it->second;
-    DCHECK(!pages.empty());
-
-    MutablePageMetadata* result = pages.back();
-    pages.pop_back();
-
-    if (pages.empty()) {
-      local_pools.erase(it);
-    }
-
-    return result;
-  }
+void PagePool::AddZoneReservation(Isolate* isolate,
+                                  VirtualMemory zone_reservation) {
+  DCHECK_NOT_NULL(isolate);
+  zone_pool_.PutLocal(isolate, std::move(zone_reservation));
+}
 
-  return nullptr;
+std::optional<VirtualMemory> PagePool::RemoveZoneReservation(Isolate* isolate) {
+  DCHECK_NOT_NULL(isolate);
+  return zone_pool_.Get(isolate);
 }
 
-}  // namespace internal
-}  // namespace v8
+}  // namespace v8::internal
diff --git a/deps/v8/src/heap/page-pool.h b/deps/v8/src/heap/page-pool.h
index c90cb581d414bf..6c6550b7c067ce 100644
--- a/deps/v8/src/heap/page-pool.h
+++ b/deps/v8/src/heap/page-pool.h
@@ -6,8 +6,8 @@
 #define V8_HEAP_PAGE_POOL_H_
 
 #include "absl/container/flat_hash_map.h"
-#include "include/v8-platform.h"
 #include "src/base/platform/mutex.h"
+#include "src/utils/allocation.h"
 
 namespace v8 {
 namespace internal {
@@ -16,7 +16,10 @@ class Isolate;
 class MutablePageMetadata;
 
 // Pool keeps pages allocated and accessible until explicitly flushed.
-class PagePool {
+class PagePool final {
+  // Logical time used to indicate when memory is supposed to be released.
+  using InternalTime = size_t;
+
  public:
   PagePool() = default;
   ~PagePool();
@@ -33,22 +36,26 @@ class PagePool {
   //   (3) Steal from another isolate.
   MutablePageMetadata* Remove(Isolate* isolate);
 
+  // Adds a zone reservation to the pool.
+  void AddZoneReservation(Isolate* isolate, VirtualMemory zone_reservation);
+
+  // Tries to get a zone reservation from the pool. See Remove() for details.
+  std::optional<VirtualMemory> RemoveZoneReservation(Isolate* isolate);
+
   // Used to release the local page pool for this isolate on isolate teardown.
   // If a task can be scheduled on another isolate, freeing of pooled pages will
   // be delayed to give other isolates the chance to make use of its pooled
   // pages. If this is not possible pages will be freed immediately.
   void ReleaseOnTearDown(Isolate* isolate);
 
-  // Releases the pooled pages immediately.
+  // Releases the pooled pages of a specific isolate immediately.
   V8_EXPORT_PRIVATE void ReleaseImmediately(Isolate* isolate);
+  // Releases pooled pages of all isolates.
+  void ReleaseImmediately();
 
   // Tear down this page pool. Frees all pooled pages immediately.
   void TearDown();
 
-  // Released shared pool pages at least as old as `id`. Returns the number of
-  // freed pages.
-  size_t ReleaseUpTo(size_t id);
-
   // Returns the number of pages in the local pool for the given isolate.
   size_t GetCount(Isolate* isolate) const;
 
@@ -59,14 +66,49 @@ class PagePool {
   size_t GetTotalCount() const;
 
  private:
-  absl::flat_hash_map<Isolate*, std::vector<MutablePageMetadata*>> local_pools;
-  // Shared pages are tracked with a logical time. This allows `ReleaseUpTo()`
-  // to free all those pages where enough time has passed.
-  std::vector<std::pair<std::vector<MutablePageMetadata*>, size_t>>
-      shared_pool_;
-  size_t next_id_ = 1;
-
-  mutable base::Mutex mutex_;
+  class ReleasePooledChunksTask;
+
+  // Simple wrapper to be able to free the page via destructors.
+  using PageMemory = std::unique_ptr<MutablePageMetadata,
+                                     std::function<void(MutablePageMetadata*)>>;
+
+  template <typename PoolEntry>
+  class PoolImpl final {
+   public:
+    ~PoolImpl() {
+      DCHECK(local_pools_.empty());
+      DCHECK(shared_pool_.empty());
+    }
+    void PutLocal(Isolate* isolate, PoolEntry entry);
+    std::optional<PoolEntry> Get(Isolate* isolate);
+    bool MoveLocalToShared(Isolate* isolate, InternalTime release_time);
+    void ClearShared();
+    void ClearLocal();
+    void ClearLocal(Isolate* isolate);
+    size_t ReleaseUpTo(InternalTime release_time);
+
+    void TearDown();
+
+    size_t Size() const;
+    size_t LocalSize(Isolate* isolate) const;
+    size_t SharedSize() const;
+
+   private:
+    absl::flat_hash_map<Isolate*, std::vector<PoolEntry>> local_pools_;
+    // Shared pages are tracked with a logical time. This allows `ReleaseUpTo()`
+    // to free all those pages where enough time has passed.
+    std::vector<std::pair<InternalTime, std::vector<PoolEntry>>> shared_pool_;
+    mutable base::Mutex mutex_;
+  };
+
+  PoolImpl<PageMemory> page_pool_;
+  PoolImpl<VirtualMemory> zone_pool_;
+
+  // Released shared pool pages at least as old as `release_time`. Returns the
+  // number of freed pages.
+  void ReleaseUpTo(Isolate* isolate_for_printing, InternalTime release_time);
+
+  std::atomic<InternalTime> next_time_{1};
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/heap/paged-spaces.cc b/deps/v8/src/heap/paged-spaces.cc
index 9351953c9e5e3b..860657afa9d2a1 100644
--- a/deps/v8/src/heap/paged-spaces.cc
+++ b/deps/v8/src/heap/paged-spaces.cc
@@ -8,8 +8,8 @@
 #include <iterator>
 
 #include "src/base/logging.h"
+#include "src/base/numerics/safe_conversions.h"
 #include "src/base/platform/mutex.h"
-#include "src/base/safe_conversions.h"
 #include "src/common/globals.h"
 #include "src/execution/isolate.h"
 #include "src/execution/vm-state-inl.h"
@@ -93,14 +93,17 @@ PageMetadata* PagedSpaceBase::InitializePage(
 }
 
 void PagedSpaceBase::TearDown() {
+  const bool is_marking = heap_->isolate()->isolate_data()->is_marking();
   while (!memory_chunk_list_.Empty()) {
     MutablePageMetadata* chunk = memory_chunk_list_.front();
     memory_chunk_list_.Remove(chunk);
-    auto mode = (id_ == NEW_SPACE || id_ == OLD_SPACE) &&
-                        !chunk->Chunk()->IsFlagSet(
-                            MemoryChunk::SHRINK_TO_HIGH_WATER_MARK)
-                    ? MemoryAllocator::FreeMode::kPool
-                    : MemoryAllocator::FreeMode::kImmediately;
+    const auto mode = (id_ == NEW_SPACE || id_ == OLD_SPACE)
+                          ? MemoryAllocator::FreeMode::kPool
+                          : MemoryAllocator::FreeMode::kImmediately;
+    if (mode == MemoryAllocator::FreeMode::kPool &&
+        (is_marking || V8_ENABLE_STICKY_MARK_BITS_BOOL)) {
+      chunk->ClearLiveness();
+    }
     heap()->memory_allocator()->Free(mode, chunk);
   }
   accounting_stats_.Clear();
@@ -276,13 +279,6 @@ void PagedSpaceBase::RemovePage(PageMetadata* page) {
   DecrementCommittedPhysicalMemory(page->CommittedPhysicalMemory());
 }
 
-size_t PagedSpaceBase::ShrinkPageToHighWaterMark(PageMetadata* page) {
-  size_t unused = page->ShrinkToHighWaterMark();
-  accounting_stats_.DecreaseCapacity(static_cast<intptr_t>(unused));
-  AccountUncommitted(unused);
-  return unused;
-}
-
 void PagedSpaceBase::ResetFreeList() {
   for (PageMetadata* page : *this) {
     free_list_->EvictFreeListItems(page);
@@ -291,15 +287,6 @@ void PagedSpaceBase::ResetFreeList() {
   DCHECK_EQ(0, free_list_->Available());
 }
 
-void PagedSpaceBase::ShrinkImmortalImmovablePages() {
-  DCHECK(!heap()->deserialization_complete());
-  ResetFreeList();
-  for (PageMetadata* page : *this) {
-    DCHECK(page->Chunk()->IsFlagSet(MemoryChunk::NEVER_EVACUATE));
-    ShrinkPageToHighWaterMark(page);
-  }
-}
-
 bool PagedSpaceBase::TryExpand(LocalHeap* local_heap, AllocationOrigin origin) {
   DCHECK_EQ(!local_heap, origin == AllocationOrigin::kGC);
   const size_t accounted_size =
@@ -558,7 +545,7 @@ void PagedSpaceBase::RefillFreeList() {
   // Any PagedSpace might invoke RefillFreeList.
   DCHECK(identity() == OLD_SPACE || identity() == CODE_SPACE ||
          identity() == SHARED_SPACE || identity() == NEW_SPACE ||
-         identity() == TRUSTED_SPACE);
+         identity() == TRUSTED_SPACE || identity() == SHARED_TRUSTED_SPACE);
   DCHECK_IMPLIES(identity() == NEW_SPACE, heap_->IsMainThread());
   DCHECK(!is_compaction_space());
 
@@ -646,15 +633,15 @@ CompactionSpaceCollection::CompactionSpaceCollection(
 // -----------------------------------------------------------------------------
 // OldSpace implementation
 
-void OldSpace::AddPromotedPage(PageMetadata* page) {
+void OldSpace::AddPromotedPage(PageMetadata* page, FreeMode free_mode) {
+  DCHECK_EQ(page->area_size(), page->allocated_bytes());
   if (v8_flags.minor_ms) {
     // Reset the page's allocated bytes. The page will be swept and the
     // allocated bytes will be updated to match the live bytes.
-    DCHECK_EQ(page->area_size(), page->allocated_bytes());
     page->DecreaseAllocatedBytes(page->area_size());
   }
   AddPageImpl(page);
-  if (!v8_flags.minor_ms) {
+  if (free_mode == FreeMode::kLinkCategory) {
     RelinkFreeListCategories(page);
   }
 }
@@ -663,6 +650,18 @@ void OldSpace::ReleasePage(PageMetadata* page) {
   ReleasePageImpl(page, MemoryAllocator::FreeMode::kPool);
 }
 
+void OldSpace::RelinkQuarantinedPageFreeList(PageMetadata* page,
+                                             size_t filler_size_on_page) {
+  base::MutexGuard guard(mutex());
+  DCHECK_EQ(this, page->owner());
+  DCHECK(page->SweepingDone());
+  DCHECK_EQ(page->live_bytes(), 0);
+  DCHECK_EQ(accounting_stats_.AllocatedOnPage(page),
+            MemoryChunkLayout::AllocatableMemoryInMemoryChunk(OLD_SPACE));
+  DecreaseAllocatedBytes(filler_size_on_page, page);
+  RelinkFreeListCategories(page);
+}
+
 // -----------------------------------------------------------------------------
 // StickySpace implementation
 
diff --git a/deps/v8/src/heap/paged-spaces.h b/deps/v8/src/heap/paged-spaces.h
index 0157e5e1bef1b4..ba6d960c3b7d29 100644
--- a/deps/v8/src/heap/paged-spaces.h
+++ b/deps/v8/src/heap/paged-spaces.h
@@ -279,12 +279,6 @@ class V8_EXPORT_PRIVATE PagedSpaceBase
   const_iterator begin() const { return const_iterator(first_page()); }
   const_iterator end() const { return const_iterator(nullptr); }
 
-  // Shrink immortal immovable pages of the space to be exactly the size needed
-  // using the high water mark.
-  void ShrinkImmortalImmovablePages();
-
-  size_t ShrinkPageToHighWaterMark(PageMetadata* page);
-
   std::unique_ptr<ObjectIterator> GetObjectIterator(Heap* heap) override;
 
   void AddRangeToActiveSystemPages(PageMetadata* page, Address start,
@@ -455,7 +449,7 @@ class V8_EXPORT_PRIVATE OldSpace : public PagedSpace {
       : PagedSpace(heap, OLD_SPACE, NOT_EXECUTABLE, FreeList::CreateFreeList(),
                    CompactionSpaceKind::kNone) {}
 
-  void AddPromotedPage(PageMetadata* page);
+  void AddPromotedPage(PageMetadata* page, FreeMode free_mode);
 
   void ReleasePage(PageMetadata* page) override;
 
@@ -464,6 +458,9 @@ class V8_EXPORT_PRIVATE OldSpace : public PagedSpace {
       return heap()->OldArrayBufferBytes();
     return external_backing_store_bytes_[static_cast<int>(type)];
   }
+
+  void RelinkQuarantinedPageFreeList(PageMetadata* page,
+                                     size_t filler_size_on_page);
 };
 
 // -----------------------------------------------------------------------------
diff --git a/deps/v8/src/heap/pretenuring-handler-inl.h b/deps/v8/src/heap/pretenuring-handler-inl.h
index b170e321c68b56..e95d659e05ab6b 100644
--- a/deps/v8/src/heap/pretenuring-handler-inl.h
+++ b/deps/v8/src/heap/pretenuring-handler-inl.h
@@ -77,7 +77,7 @@ Tagged<AllocationMemento> PretenuringHandler::FindAllocationMemento(
   Address last_memento_word_address = memento_address + kTaggedSize;
   // If the memento would be on another page, bail out immediately.
   if (!PageMetadata::OnSamePage(object_address, last_memento_word_address)) {
-    return AllocationMemento();
+    return {};
   }
 
   // If the page is being swept, treat it as if the memento was already swept
@@ -86,7 +86,7 @@ Tagged<AllocationMemento> PretenuringHandler::FindAllocationMemento(
     MemoryChunk* object_chunk = MemoryChunk::FromAddress(object_address);
     PageMetadata* object_page = PageMetadata::cast(object_chunk->Metadata());
     if (!object_page->SweepingDone()) {
-      return AllocationMemento();
+      return {};
     }
   }
 
@@ -98,7 +98,7 @@ Tagged<AllocationMemento> PretenuringHandler::FindAllocationMemento(
   MSAN_MEMORY_IS_INITIALIZED(candidate_map_slot.address(), kTaggedSize);
   if (!candidate_map_slot.Relaxed_ContainsMapValue(
           ReadOnlyRoots(heap).allocation_memento_map().ptr())) {
-    return AllocationMemento();
+    return {};
   }
 
   // Bailout if memento is below the age mark. This is only possible for pinned
@@ -106,7 +106,7 @@ Tagged<AllocationMemento> PretenuringHandler::FindAllocationMemento(
   // NEW_SPACE_BELOW_AGE_MARK page flags before checking mementos.
   if (!v8_flags.minor_ms &&
       heap->semi_space_new_space()->IsAddressBelowAgeMark(object_address)) {
-    return AllocationMemento();
+    return {};
   }
 
   Tagged<AllocationMemento> memento_candidate =
@@ -119,19 +119,19 @@ Tagged<AllocationMemento> PretenuringHandler::FindAllocationMemento(
     case kForGC:
       return memento_candidate;
     case kForRuntime:
-      if (memento_candidate.is_null()) return AllocationMemento();
+      if (memento_candidate.is_null()) return {};
       // Either the object is the last object in the new space, or there is
       // another object of at least word size (the header map word) following
       // it, so suffices to compare ptr and top here.
       top = heap->NewSpaceTop();
       DCHECK(memento_address >= heap->NewSpaceLimit() ||
              memento_address +
-                     ALIGN_TO_ALLOCATION_ALIGNMENT(AllocationMemento::kSize) <=
+                     ALIGN_TO_ALLOCATION_ALIGNMENT(sizeof(AllocationMemento)) <=
                  top);
       if ((memento_address != top) && memento_candidate->IsValid()) {
         return memento_candidate;
       }
-      return AllocationMemento();
+      return {};
     default:
       UNREACHABLE();
   }
diff --git a/deps/v8/src/heap/pretenuring-handler.cc b/deps/v8/src/heap/pretenuring-handler.cc
index 2a9b7a8262b169..639bf52342564e 100644
--- a/deps/v8/src/heap/pretenuring-handler.cc
+++ b/deps/v8/src/heap/pretenuring-handler.cc
@@ -143,7 +143,7 @@ void PretenuringHandler::MergeAllocationSitePretenuringFeedback(
   Tagged<AllocationSite> site;
   for (auto& site_and_count : local_pretenuring_feedback) {
     site = site_and_count.first;
-    MapWord map_word = site->map_word(cage_base, kRelaxedLoad);
+    MapWord map_word = site->map_word(kRelaxedLoad);
     if (map_word.IsForwardingAddress()) {
       DCHECK(!HeapLayout::IsSelfForwarded(site, map_word));
       site = Cast<AllocationSite>(map_word.ToForwardingAddress(site));
diff --git a/deps/v8/src/heap/read-only-promotion.cc b/deps/v8/src/heap/read-only-promotion.cc
index fd9409c55e0f28..ea88830d5a345a 100644
--- a/deps/v8/src/heap/read-only-promotion.cc
+++ b/deps/v8/src/heap/read-only-promotion.cc
@@ -36,6 +36,25 @@ bool Contains(const HeapObjectMap& s, Tagged<HeapObject> o) {
   return s.count(o) != 0;
 }
 
+enum class PromoRecommendation {
+  // Do not promote this object.
+  kReject,
+  // Do promote this object.
+  kPromote,
+
+  // Promote if it's referenced by an object that must be promoted, otherwise
+  // do not promote.
+  // This is a rare case when by looking at an object itself it's not clear
+  // whether it should be promoted or not. The decision can be made later
+  // only taking into account where it's used.
+  // One of such examples is ArrayList which shouldn't be promoted unless
+  // it's a value of TemplateInfoWithProperties::property_list or
+  // TemplateInfoWithProperties::property_accessors of a template that
+  // should be promoted to RO space.
+  kMatchHost,
+};
+using enum PromoRecommendation;
+
 class Committee final {
  public:
   static HeapObjectList DeterminePromotees(
@@ -78,7 +97,7 @@ class Committee final {
       HeapObjectSet accepted_subgraph;  // Either all are accepted or none.
       HeapObjectList accepted_subgraph_list;
       HeapObjectSet visited;            // Cycle detection.
-      if (!EvaluateSubgraph(o, &accepted_subgraph, &visited,
+      if (!EvaluateSubgraph(std::nullopt, o, &accepted_subgraph, &visited,
                             &accepted_subgraph_list)) {
         continue;
       }
@@ -95,6 +114,11 @@ class Committee final {
                                  accepted_subgraph_list.begin(),
                                  accepted_subgraph_list.end());
     }
+    if (V8_UNLIKELY(v8_flags.trace_read_only_promotion)) {
+      for (auto o : promo_deferred_) {
+        LogRejectedPromotionForNoMatchingHost(o);
+      }
+    }
 
     // Remove duplicates from the promo_accepted_list. Note we have to jump
     // through these hoops in order to preserve deterministic ordering
@@ -115,22 +139,42 @@ class Committee final {
   // Returns `false` if the subgraph rooted at `o` is rejected.
   // Returns `true` if it is accepted, or if we've reached a cycle and `o`
   // will be processed further up the callchain.
-  bool EvaluateSubgraph(Tagged<HeapObject> o, HeapObjectSet* accepted_subgraph,
+  bool EvaluateSubgraph(std::optional<Tagged<HeapObject>> maybe_host,
+                        Tagged<HeapObject> o, HeapObjectSet* accepted_subgraph,
                         HeapObjectSet* visited, HeapObjectList* promotees) {
     if (HeapLayout::InReadOnlySpace(o)) return true;
     if (Contains(promo_rejected_, o)) return false;
     if (Contains(promo_accepted_, o)) return true;
     if (Contains(*visited, o)) return true;
     visited->insert(o);
-    if (!IsPromoCandidate(this, isolate_, o)) {
-      const auto& [it, inserted] = promo_rejected_.insert(o);
-      if (V8_UNLIKELY(v8_flags.trace_read_only_promotion) && inserted) {
-        LogRejectedPromotionForFailedPredicate(o);
+    PromoRecommendation recommendation =
+        GetPromoRecommendation(this, isolate_, o);
+    switch (recommendation) {
+      case kPromote:
+        break;
+      case kReject: {
+        const auto& [it, inserted] = promo_rejected_.insert(o);
+        if (V8_UNLIKELY(v8_flags.trace_read_only_promotion) && inserted) {
+          LogRejectedPromotionForFailedPredicate(o);
+        }
+        return false;
       }
-      return false;
+      case kMatchHost:
+        if (!maybe_host.has_value()) {
+          // We've met this object during regular heap iteration and don't know
+          // yet how it's used. Postpone the decision for later.
+          DCHECK(!Contains(promo_deferred_, o));
+          promo_deferred_.insert(o);
+          visited->erase(o);
+          return false;
+        }
+        // This object is referenced by another promotion candidate, so
+        // let this one be promoted too.
+        promo_deferred_.erase(o);
+        break;
     }
     // Recurse into outgoing pointers.
-    CandidateVisitor v(this, accepted_subgraph, visited, promotees);
+    CandidateVisitor v(this, accepted_subgraph, visited, promotees, maybe_host);
     VisitObject(isolate_, o, &v);
     if (!v.all_slots_are_promo_candidates()) {
       const auto& [it, inserted] = promo_rejected_.insert(o);
@@ -149,16 +193,25 @@ class Committee final {
 
     accepted_subgraph->insert(o);
     promotees->push_back(o);
+
+    // Some sanity checks for general-purpose objects (they should be included
+    // only as a part of expected hosts).
+    DCHECK_IMPLIES(IsArrayList(o),
+                   maybe_host.has_value() &&
+                       IsTemplateInfoWithProperties(maybe_host.value()));
     return true;
   }
 
 #define PROMO_CANDIDATE_TYPE_LIST(V) \
   V(AccessCheckInfo)                 \
   V(AccessorInfo)                    \
+  V(ArrayList)                       \
   V(Code)                            \
   V(CodeWrapper)                     \
   V(JSExternalObject)                \
+  V(ObjectTemplateInfo)              \
   V(FunctionTemplateInfo)            \
+  V(FunctionTemplateRareData)        \
   V(InterceptorInfo)                 \
   V(ScopeInfo)                       \
   V(SharedFunctionInfo)              \
@@ -166,63 +219,74 @@ class Committee final {
   // TODO(jgruber): Don't forget to extend ReadOnlyPromotionImpl::Verify when
   // adding new object types here.
 
-  static bool IsPromoCandidate(Committee* committee, Isolate* isolate,
-                               Tagged<HeapObject> o) {
+  static PromoRecommendation GetPromoRecommendation(Committee* committee,
+                                                    Isolate* isolate,
+                                                    Tagged<HeapObject> o) {
     const InstanceType itype = o->map(isolate)->instance_type();
-#define V(TYPE)                                                       \
-  if (InstanceTypeChecker::Is##TYPE(itype)) {                         \
-    return IsPromoCandidate##TYPE(committee, isolate, Cast<TYPE>(o)); \
-    /* NOLINTNEXTLINE(readability/braces) */                          \
+#define V(TYPE)                                                             \
+  if (InstanceTypeChecker::Is##TYPE(itype)) {                               \
+    return GetPromoRecommendation##TYPE(committee, isolate, Cast<TYPE>(o)); \
+    /* NOLINTNEXTLINE(readability/braces) */                                \
   } else
     PROMO_CANDIDATE_TYPE_LIST(V)
     /* if { ... } else */ {
-      return false;
+      return kReject;
     }
 #undef V
     UNREACHABLE();
   }
 #undef PROMO_CANDIDATE_TYPE_LIST
 
-#define DEF_PROMO_CANDIDATE(Type)                                            \
-  static bool IsPromoCandidate##Type(Committee* committee, Isolate* isolate, \
-                                     Tagged<Type> o) {                       \
-    return true;                                                             \
+#define DEF_PROMO_CANDIDATE(Type)                               \
+  static PromoRecommendation GetPromoRecommendation##Type(      \
+      Committee* committee, Isolate* isolate, Tagged<Type> o) { \
+    return kPromote;                                            \
+  }
+#define DEF_MATCH_HOST_CANDIDATE(Type)                          \
+  static PromoRecommendation GetPromoRecommendation##Type(      \
+      Committee* committee, Isolate* isolate, Tagged<Type> o) { \
+    return kMatchHost;                                          \
   }
 
   DEF_PROMO_CANDIDATE(AccessCheckInfo)
   DEF_PROMO_CANDIDATE(AccessorInfo)
+  DEF_MATCH_HOST_CANDIDATE(ArrayList)
+  // Promote v8::External only if it's used by a v8::Template that was
+  // explicitly requested to be promoted to RO space.
+  DEF_MATCH_HOST_CANDIDATE(JSExternalObject)
 
-  static bool IsPromoCandidateJSExternalObject(Committee* committee,
-                                               Isolate* isolate,
-                                               Tagged<JSExternalObject> o) {
-    // Check if the external pointer value is serializable.
-    DCHECK(IsNull(o->map()->map()->native_context_or_null()));
-    Address address = reinterpret_cast<Address>(o->value());
-    auto maybe_index = committee->ref_encoder().TryEncode(address);
-    return !maybe_index.IsNothing();
-  }
-  static bool IsPromoCandidateFunctionTemplateInfo(
+  static PromoRecommendation GetPromoRecommendationFunctionTemplateInfo(
       Committee* committee, Isolate* isolate, Tagged<FunctionTemplateInfo> o) {
     // This flag is set by the embedder explicitly by calling
     // v8::FunctionTemplate::SealAndPrepareForPromotionToReadOnly(..).
-    return o->should_promote_to_read_only();
+    return o->should_promote_to_read_only() ? kPromote : kReject;
   }
-  static bool IsPromoCandidateCode(Committee* committee, Isolate* isolate,
-                                   Tagged<Code> o) {
-    return Builtins::kCodeObjectsAreInROSpace && o->is_builtin();
+  DEF_PROMO_CANDIDATE(FunctionTemplateRareData)
+
+  static PromoRecommendation GetPromoRecommendationCode(Committee* committee,
+                                                        Isolate* isolate,
+                                                        Tagged<Code> o) {
+    return Builtins::kCodeObjectsAreInROSpace && o->is_builtin() ? kPromote
+                                                                 : kReject;
   }
-  static bool IsPromoCandidateCodeWrapper(Committee* committee,
-                                          Isolate* isolate,
-                                          Tagged<CodeWrapper> o) {
-    return IsPromoCandidateCode(committee, isolate, o->code(isolate));
+  static PromoRecommendation GetPromoRecommendationCodeWrapper(
+      Committee* committee, Isolate* isolate, Tagged<CodeWrapper> o) {
+    return GetPromoRecommendationCode(committee, isolate, o->code(isolate));
   }
   DEF_PROMO_CANDIDATE(InterceptorInfo)
+
+  static PromoRecommendation GetPromoRecommendationObjectTemplateInfo(
+      Committee* committee, Isolate* isolate, Tagged<ObjectTemplateInfo> o) {
+    // This flag is set by the embedder explicitly by calling
+    // v8::ObjectTemplate::SealAndPrepareForPromotionToReadOnly(..).
+    return o->should_promote_to_read_only() ? kPromote : kReject;
+  }
+
   DEF_PROMO_CANDIDATE(ScopeInfo)
-  static bool IsPromoCandidateSharedFunctionInfo(Committee* committee,
-                                                 Isolate* isolate,
-                                                 Tagged<SharedFunctionInfo> o) {
+  static PromoRecommendation GetPromoRecommendationSharedFunctionInfo(
+      Committee* committee, Isolate* isolate, Tagged<SharedFunctionInfo> o) {
     // Only internal SFIs are guaranteed to remain immutable.
-    if (o->has_script(kAcquireLoad)) return false;
+    if (o->has_script(kAcquireLoad)) return kReject;
     // kIllegal is used for js_global_object_function, which is created during
     // bootstrapping but never rooted. We currently assumed that all objects in
     // the snapshot are live. But RO space is 1) not GC'd and 2) serialized
@@ -232,11 +296,11 @@ class Committee final {
     // test-heap-profiler.cc)? Overwrite dead RO objects with fillers
     // pre-serialization? Implement a RO GC pass pre-serialization?
     if (o->HasBuiltinId() && o->builtin_id() != Builtin::kIllegal) {
-      return true;
+      return kPromote;
     }
     // Api functions are good candidates for promotion.
-    if (o->IsApiFunction()) return true;
-    return false;
+    if (o->IsApiFunction()) return kPromote;
+    return kReject;
   }
   DEF_PROMO_CANDIDATE(Symbol)
 
@@ -247,11 +311,17 @@ class Committee final {
   class CandidateVisitor : public ObjectVisitor {
    public:
     CandidateVisitor(Committee* committee, HeapObjectSet* accepted_subgraph,
-                     HeapObjectSet* visited, HeapObjectList* promotees)
+                     HeapObjectSet* visited, HeapObjectList* promotees,
+                     std::optional<Tagged<HeapObject>> maybe_host)
         : committee_(committee),
           accepted_subgraph_(accepted_subgraph),
           visited_(visited),
-          promotees_(promotees) {}
+          promotees_(promotees),
+          maybe_host_(maybe_host) {}
+
+    // Promotion decisions for some objects might depend on the properties
+    // of the "outer" object.
+    std::optional<Tagged<HeapObject>> maybe_host() const { return maybe_host_; }
 
     int first_rejected_slot_offset() const {
       return first_rejected_slot_offset_;
@@ -267,8 +337,9 @@ class Committee final {
         Tagged<MaybeObject> maybe_object = slot.load(committee_->isolate_);
         Tagged<HeapObject> heap_object;
         if (!maybe_object.GetHeapObject(&heap_object)) continue;
-        if (!committee_->EvaluateSubgraph(heap_object, accepted_subgraph_,
-                                          visited_, promotees_)) {
+        if (!committee_->EvaluateSubgraph({host}, heap_object,
+                                          accepted_subgraph_, visited_,
+                                          promotees_)) {
           first_rejected_slot_offset_ =
               static_cast<int>(slot.address() - host.address());
           DCHECK_GE(first_rejected_slot_offset_, 0);
@@ -294,6 +365,7 @@ class Committee final {
     HeapObjectSet* const accepted_subgraph_;
     HeapObjectSet* const visited_;
     HeapObjectList* const promotees_;
+    std::optional<Tagged<HeapObject>> maybe_host_;
     int first_rejected_slot_offset_ = -1;
   };
 
@@ -312,6 +384,14 @@ class Committee final {
               << "\n";
   }
 
+  void LogRejectedPromotionForNoMatchingHost(Tagged<HeapObject> o) {
+    std::cout << "ro-promotion: rejected because it wasn't included into any "
+                 "accepted set "
+              << reinterpret_cast<void*>(o.ptr()) << " ("
+              << o->map()->instance_type() << ")"
+              << "\n";
+  }
+
   void LogRejectedPromotionForInvalidSubgraph(Tagged<HeapObject> o,
                                               int first_rejected_slot_offset) {
     std::cout << "ro-promotion: rejected due to rejected subgraph "
@@ -335,6 +415,7 @@ class Committee final {
   ExternalReferenceEncoder ref_encoder_;
   HeapObjectSet promo_accepted_;
   HeapObjectSet promo_rejected_;
+  HeapObjectSet promo_deferred_;
 };
 
 class ReadOnlyPromotionImpl final : public AllStatic {
diff --git a/deps/v8/src/heap/remembered-set-inl.h b/deps/v8/src/heap/remembered-set-inl.h
index b0a19bd15c68a7..4f3070cb700711 100644
--- a/deps/v8/src/heap/remembered-set-inl.h
+++ b/deps/v8/src/heap/remembered-set-inl.h
@@ -40,7 +40,7 @@ SlotCallbackResult UpdateTypedSlotHelper::UpdateTypedSlot(
     case SlotType::kConstPoolEmbeddedObjectCompressed: {
       Tagged<HeapObject> old_target = Cast<HeapObject>(
           Tagged<Object>(V8HeapCompressionScheme::DecompressTagged(
-              heap->isolate(), base::Memory<Tagged_t>(addr))));
+              base::Memory<Tagged_t>(addr))));
       Tagged<HeapObject> new_target = old_target;
       SlotCallbackResult result = callback(FullMaybeObjectSlot(&new_target));
       DCHECK(!HasWeakHeapObjectTag(new_target));
@@ -87,7 +87,7 @@ Tagged<HeapObject> UpdateTypedSlotHelper::GetTargetObject(Heap* heap,
     }
     case SlotType::kConstPoolEmbeddedObjectCompressed: {
       Address full = V8HeapCompressionScheme::DecompressTagged(
-          heap->isolate(), base::Memory<Tagged_t>(addr));
+          base::Memory<Tagged_t>(addr));
       return Cast<HeapObject>(Tagged<Object>(full));
     }
     case SlotType::kConstPoolEmbeddedObjectFull: {
diff --git a/deps/v8/src/heap/safepoint.cc b/deps/v8/src/heap/safepoint.cc
index aa83375a3a6903..817fcbc5863dc3 100644
--- a/deps/v8/src/heap/safepoint.cc
+++ b/deps/v8/src/heap/safepoint.cc
@@ -297,7 +297,7 @@ void IsolateSafepoint::Iterate(RootVisitor* visitor) {
   AssertActive();
   for (LocalHeap* current = local_heaps_head_; current;
        current = current->next_) {
-    current->handles()->Iterate(visitor);
+    current->Iterate(visitor);
   }
 }
 
diff --git a/deps/v8/src/heap/safepoint.h b/deps/v8/src/heap/safepoint.h
index 6f121ec3225423..04314c8467216d 100644
--- a/deps/v8/src/heap/safepoint.h
+++ b/deps/v8/src/heap/safepoint.h
@@ -192,6 +192,7 @@ class GlobalSafepoint final {
     for (Isolate* current = clients_head_; current;
          current = current->global_safepoint_next_client_isolate_) {
       DCHECK(!current->is_shared_space_isolate());
+      SetCurrentIsolateScope current_isolate_scope{current};
       callback(current);
     }
   }
diff --git a/deps/v8/src/heap/scavenger-inl.h b/deps/v8/src/heap/scavenger-inl.h
index 632ddcd20ddd3e..c008a79b9c9255 100644
--- a/deps/v8/src/heap/scavenger-inl.h
+++ b/deps/v8/src/heap/scavenger-inl.h
@@ -12,7 +12,6 @@
 #include "src/heap/evacuation-allocator-inl.h"
 #include "src/heap/heap-layout-inl.h"
 #include "src/heap/heap-visitor-inl.h"
-#include "src/heap/incremental-marking-inl.h"
 #include "src/heap/marking-state-inl.h"
 #include "src/heap/mutable-page-metadata.h"
 #include "src/heap/new-spaces.h"
@@ -71,10 +70,6 @@ bool Scavenger::MigrateObject(Tagged<Map> map, Tagged<HeapObject> source,
     heap()->OnMoveEvent(source, target, size);
   }
 
-  if (is_incremental_marking_ &&
-      (promotion_heap_choice != kPromoteIntoSharedHeap || mark_shared_heap_)) {
-    heap()->incremental_marking()->TransferColor(source, target);
-  }
   PretenuringHandler::UpdateAllocationSite(heap_, map, source, size,
                                            &local_pretenuring_feedback_);
 
@@ -155,9 +150,7 @@ CopyAndForwardResult Scavenger::PromoteObject(Tagged<Map> map,
     }
     UpdateHeapObjectReferenceSlot(slot, target);
 
-    // During incremental marking we want to push every object in order to
-    // record slots for map words. Necessary for map space compaction.
-    if (object_fields == ObjectFields::kMaybePointers || is_compacting_) {
+    if (object_fields == ObjectFields::kMaybePointers) {
       local_promoted_list_.Push({target, map, object_size});
     }
     promoted_size_ += object_size;
@@ -457,6 +450,8 @@ class ScavengeVisitor final : public NewSpaceVisitor<ScavengeVisitor> {
                                       MaybeObjectSize);
   V8_INLINE size_t VisitJSApiObject(Tagged<Map> map, Tagged<JSObject> object,
                                     MaybeObjectSize);
+  V8_INLINE size_t VisitCppHeapExternalObject(
+      Tagged<Map> map, Tagged<CppHeapExternalObject> object, MaybeObjectSize);
   V8_INLINE void VisitExternalPointer(Tagged<HeapObject> host,
                                       ExternalPointerSlot slot);
 
@@ -537,6 +532,13 @@ size_t ScavengeVisitor::VisitJSApiObject(Tagged<Map> map,
   return size;
 }
 
+size_t ScavengeVisitor::VisitCppHeapExternalObject(
+    Tagged<Map> map, Tagged<CppHeapExternalObject> object, MaybeObjectSize) {
+  int size = CppHeapExternalObject::BodyDescriptor::SizeOf(map, object);
+  CppHeapExternalObject::BodyDescriptor::IterateBody(map, object, size, this);
+  return size;
+}
+
 void ScavengeVisitor::VisitExternalPointer(Tagged<HeapObject> host,
                                            ExternalPointerSlot slot) {
 #ifdef V8_COMPRESS_POINTERS
@@ -544,14 +546,6 @@ void ScavengeVisitor::VisitExternalPointer(Tagged<HeapObject> host,
   DCHECK(!IsSharedExternalPointerType(slot.tag_range()));
   DCHECK(HeapLayout::InYoungGeneration(host));
 
-  // If an incremental mark is in progress, there is already a whole-heap trace
-  // running that will mark live EPT entries, and the scavenger won't sweep the
-  // young EPT space.  So, leave the tracing and sweeping work to the impending
-  // major GC.
-  //
-  // The EPT entry may or may not be marked already by the incremental marker.
-  if (scavenger_->is_incremental_marking_) return;
-
   // TODO(chromium:337580006): Remove when pointer compression always uses
   // EPT.
   if (!slot.HasExternalPointerHandle()) return;
diff --git a/deps/v8/src/heap/scavenger.cc b/deps/v8/src/heap/scavenger.cc
index bd5a5265d9c9fb..39b5e588b4c67a 100644
--- a/deps/v8/src/heap/scavenger.cc
+++ b/deps/v8/src/heap/scavenger.cc
@@ -32,12 +32,14 @@
 #include "src/heap/memory-chunk.h"
 #include "src/heap/mutable-page-metadata-inl.h"
 #include "src/heap/mutable-page-metadata.h"
+#include "src/heap/new-spaces.h"
 #include "src/heap/page-metadata.h"
 #include "src/heap/pretenuring-handler.h"
 #include "src/heap/remembered-set-inl.h"
 #include "src/heap/scavenger-inl.h"
 #include "src/heap/slot-set.h"
 #include "src/heap/sweeper.h"
+#include "src/heap/zapping.h"
 #include "src/objects/data-handler-inl.h"
 #include "src/objects/embedder-data-array-inl.h"
 #include "src/objects/js-array-buffer-inl.h"
@@ -53,28 +55,14 @@ namespace internal {
 class IterateAndScavengePromotedObjectsVisitor final
     : public HeapVisitor<IterateAndScavengePromotedObjectsVisitor> {
  public:
-  IterateAndScavengePromotedObjectsVisitor(Scavenger* scavenger,
-                                           bool record_slots)
-      : HeapVisitor(scavenger->heap()->isolate()),
-        scavenger_(scavenger),
-        record_slots_(record_slots) {}
+  IterateAndScavengePromotedObjectsVisitor(Scavenger* scavenger)
+      : HeapVisitor(scavenger->heap()->isolate()), scavenger_(scavenger) {}
 
   V8_INLINE static constexpr bool ShouldUseUncheckedCast() { return true; }
 
   V8_INLINE static constexpr bool UsePrecomputedObjectSize() { return true; }
 
-  V8_INLINE void VisitMapPointer(Tagged<HeapObject> host) final {
-    if (!record_slots_) return;
-    MapWord map_word = host->map_word(kRelaxedLoad);
-    if (map_word.IsForwardingAddress()) {
-      // Surviving new large objects and pinned objects have forwarding pointers
-      // in the map word.
-      DCHECK(MemoryChunk::FromHeapObject(host)->InNewLargeObjectSpace() ||
-             v8_flags.scavenger_conservative_object_pinning);
-      return;
-    }
-    HandleSlot(host, HeapObjectSlot(host->map_slot()), map_word.ToMap());
-  }
+  V8_INLINE void VisitMapPointer(Tagged<HeapObject> host) final {}
 
   V8_INLINE void VisitPointers(Tagged<HeapObject> host, ObjectSlot start,
                                ObjectSlot end) final {
@@ -114,15 +102,13 @@ class IterateAndScavengePromotedObjectsVisitor final
 
     // For survivor objects, the scavenger marks their EPT entries when they are
     // copied and then sweeps the young EPT space at the end of collection,
-    // reclaiming unmarked EPT entries.  (Exception: if an incremental mark is
-    // in progress, the scavenger neither marks nor sweeps, as it will be the
-    // major GC's responsibility.)
+    // reclaiming unmarked EPT entries.
     //
     // However when promoting, we just evacuate the entry from new to old space.
-    // Usually the entry will be unmarked, unless an incremental mark is in
-    // progress, or the slot was initialized since the last GC (external pointer
-    // tags have the mark bit set), in which case it may be marked already.  In
-    // any case, transfer the color from new to old EPT space.
+    // Usually the entry will be unmarked, unless the slot was initialized since
+    // the last GC (external pointer tags have the mark bit set), in which case
+    // it may be marked already.  In any case, transfer the color from new to
+    // old EPT space.
     table.Evacuate(heap->young_external_pointer_space(),
                    heap->old_external_pointer_space(), handle, slot.address(),
                    ExternalPointerTable::EvacuateMarkMode::kTransferMark);
@@ -185,24 +171,6 @@ class IterateAndScavengePromotedObjectsVisitor final
             page, chunk->Offset(slot.address()));
       }
       DCHECK(!MarkCompactCollector::IsOnEvacuationCandidate(target));
-    } else if (record_slots_ &&
-               MarkCompactCollector::IsOnEvacuationCandidate(target)) {
-      // We should never try to record off-heap slots.
-      DCHECK((std::is_same<THeapObjectSlot, HeapObjectSlot>::value));
-      // InstructionStream slots never appear in new space because
-      // Code objects, the only object that can contain code pointers, are
-      // always allocated in the old space.
-      DCHECK_IMPLIES(V8_EXTERNAL_CODE_SPACE_BOOL,
-                     !MemoryChunk::FromHeapObject(target)->IsFlagSet(
-                         MemoryChunk::IS_EXECUTABLE));
-
-      // We cannot call MarkCompactCollector::RecordSlot because that checks
-      // that the host page is not in young generation, which does not hold
-      // for pending large pages.
-      MemoryChunk* chunk = MemoryChunk::FromHeapObject(host);
-      MutablePageMetadata* page = MutablePageMetadata::cast(chunk->Metadata());
-      RememberedSet<OLD_TO_OLD>::Insert<AccessMode::ATOMIC>(
-          page, chunk->Offset(slot.address()));
     }
 
     if (HeapLayout::InWritableSharedSpace(target)) {
@@ -214,7 +182,6 @@ class IterateAndScavengePromotedObjectsVisitor final
   }
 
   Scavenger* const scavenger_;
-  const bool record_slots_;
 };
 
 namespace {
@@ -336,7 +303,7 @@ void ScavengerCollector::JobTask::ConcurrentScavengePages(
 }
 
 ScavengerCollector::ScavengerCollector(Heap* heap)
-    : isolate_(heap->isolate()), heap_(heap) {}
+    : isolate_(heap->isolate()), heap_(heap), quarantined_page_sweeper_(heap) {}
 
 namespace {
 
@@ -489,13 +456,11 @@ class YoungGenerationConservativeStackVisitor
       YoungGenerationConservativeStackVisitor>;
 };
 
-using PinnedObjects = std::vector<std::pair<Address, MapWord>>;
-
 template <typename ConcreteVisitor>
 class ObjectPinningVisitorBase : public RootVisitor {
  public:
   ObjectPinningVisitorBase(const Heap* heap, Scavenger& scavenger,
-                           PinnedObjects& pinned_objects)
+                           ScavengerCollector::PinnedObjects& pinned_objects)
       : RootVisitor(),
         heap_(heap),
         scavenger_(scavenger),
@@ -538,14 +503,13 @@ class ObjectPinningVisitorBase : public RootVisitor {
     DCHECK(!map_word.IsForwardingAddress());
     DCHECK(std::all_of(
         pinned_objects_.begin(), pinned_objects_.end(),
-        [object_address](std::pair<Address, MapWord>& object_and_map) {
-          return object_and_map.first != object_address;
+        [object_address](ScavengerCollector::PinnedObjectEntry& entry) {
+          return entry.address != object_address;
         }));
-    pinned_objects_.push_back({object_address, map_word});
-    // Pin the object in place.
-    object->set_map_word_forwarded(object, kRelaxedStore);
-    DCHECK(object->map_word(kRelaxedLoad).IsForwardingAddress());
-    DCHECK(HeapLayout::IsSelfForwarded(object));
+    int object_size = object->SizeFromMap(map_word.ToMap());
+    DCHECK_LT(0, object_size);
+    pinned_objects_.push_back(
+        {object_address, map_word, static_cast<size_t>(object_size)});
     MemoryChunk* chunk = MemoryChunk::FromHeapObject(object);
     if (!chunk->IsQuarantined()) {
       chunk->SetFlagNonExecutable(MemoryChunk::IS_QUARANTINED);
@@ -554,20 +518,21 @@ class ObjectPinningVisitorBase : public RootVisitor {
         chunk->SetFlagNonExecutable(MemoryChunk::WILL_BE_PROMOTED);
       }
     }
-    scavenger_.PushPinnedObject(chunk, object, map_word.ToMap());
+    scavenger_.PinAndPushObject(chunk, object, map_word);
   }
 
  private:
   const Heap* const heap_;
   Scavenger& scavenger_;
-  PinnedObjects& pinned_objects_;
+  ScavengerCollector::PinnedObjects& pinned_objects_;
 };
 
 class ConservativeObjectPinningVisitor final
     : public ObjectPinningVisitorBase<ConservativeObjectPinningVisitor> {
  public:
-  ConservativeObjectPinningVisitor(const Heap* heap, Scavenger& scavenger,
-                                   PinnedObjects& pinned_objects)
+  ConservativeObjectPinningVisitor(
+      const Heap* heap, Scavenger& scavenger,
+      ScavengerCollector::PinnedObjects& pinned_objects)
       : ObjectPinningVisitorBase<ConservativeObjectPinningVisitor>(
             heap, scavenger, pinned_objects) {}
 
@@ -583,7 +548,7 @@ class PreciseObjectPinningVisitor final
     : public ObjectPinningVisitorBase<PreciseObjectPinningVisitor> {
  public:
   PreciseObjectPinningVisitor(const Heap* heap, Scavenger& scavenger,
-                              PinnedObjects& pinned_objects)
+                              ScavengerCollector::PinnedObjects& pinned_objects)
       : ObjectPinningVisitorBase<PreciseObjectPinningVisitor>(heap, scavenger,
                                                               pinned_objects) {}
 
@@ -646,107 +611,212 @@ class TreatConservativelyVisitor final : public RootVisitor {
   base::RandomNumberGenerator* const rng_;
   double stressing_threshold_;
 };
-template <typename FreeSpaceHandler>
-size_t SweepQuarantinedPage(
-    FreeSpaceHandler& free_space_handler, MemoryChunk* chunk,
-    std::vector<std::pair<Address, size_t>>& pinned_objects_and_sizes) {
-  MemoryChunkMetadata* metadata = chunk->Metadata();
-  Address start = metadata->area_start();
-  std::sort(pinned_objects_and_sizes.begin(), pinned_objects_and_sizes.end());
-  size_t quarantined_objects_size = 0;
-  for (const auto& [object, size] : pinned_objects_and_sizes) {
-    DCHECK_LE(start, object);
-    if (start != object) {
-      free_space_handler(start, object - start);
-    }
-    quarantined_objects_size += size;
-    start = object + size;
-  }
-  Address end = metadata->area_end();
-  if (start != end) {
-    free_space_handler(start, end - start);
-  }
-  DCHECK(
-      static_cast<MutablePageMetadata*>(metadata)->marking_bitmap()->IsClean());
-  DCHECK_LT(0, quarantined_objects_size);
-  return quarantined_objects_size;
-}
 
-void RestoreAndQuarantinePinnedObjects(SemiSpaceNewSpace& new_space,
-                                       const PinnedObjects& pinned_objects) {
-  std::unordered_map<MemoryChunk*, std::vector<std::pair<Address, size_t>>,
-                     base::hash<const MemoryChunk*>>
-      pages_with_pinned_objects;
+void RestorePinnedObjects(
+    SemiSpaceNewSpace& new_space,
+    const ScavengerCollector::PinnedObjects& pinned_objects) {
   // Restore the maps of quarantined objects. We use the iteration over
   // quarantined objects to split them based on pages. This will be used below
   // for sweeping the quarantined pages (since there are no markbits).
-  for (const auto& [object_address, map_word] : pinned_objects) {
+  DCHECK_EQ(0, new_space.QuarantinedPageCount());
+  size_t quarantined_objects_size = 0;
+  for (const auto& [object_address, map_word, object_size] : pinned_objects) {
     DCHECK(!map_word.IsForwardingAddress());
     Tagged<HeapObject> object = HeapObject::FromAddress(object_address);
     DCHECK(HeapLayout::IsSelfForwarded(object));
     object->set_map_word(map_word.ToMap(), kRelaxedStore);
-    const size_t object_size = object->SizeFromMap(map_word.ToMap());
-    pages_with_pinned_objects[MemoryChunk::FromHeapObject(
-                                  Cast<HeapObject>(object))]
-        .emplace_back(object_address, object_size);
-  }
-  DCHECK_EQ(0, new_space.QuarantinedPageCount());
-  // Sweep quarantined pages to make them iterable.
-  Heap* const heap = new_space.heap();
-  auto create_filler = [heap](Address address, size_t size) {
-    if (heap::ShouldZapGarbage()) {
-      heap::ZapBlock(address, size, heap::ZapValue());
+    DCHECK(!HeapLayout::IsSelfForwarded(object));
+    MemoryChunk* chunk = MemoryChunk::FromHeapObject(object);
+    DCHECK(chunk->IsQuarantined());
+    if (!chunk->IsFlagSet(MemoryChunk::WILL_BE_PROMOTED)) {
+      quarantined_objects_size += object_size;
     }
-    heap->CreateFillerObjectAt(address, static_cast<int>(size));
-  };
-  auto create_filler_and_add_to_freelist = [heap, create_filler](
-                                               Address address, size_t size) {
-    create_filler(address, size);
-    PageMetadata* page = PageMetadata::FromAddress(address);
-    DCHECK_EQ(OLD_SPACE, page->owner()->identity());
-    DCHECK(page->SweepingDone());
-    OldSpace* const old_space = heap->old_space();
-    FreeList* const free_list = old_space->free_list();
-    const size_t wasted = free_list->Free(
-        WritableFreeSpace::ForNonExecutableMemory(address, size),
-        kLinkCategory);
-    old_space->DecreaseAllocatedBytes(size, page);
-    free_list->increase_wasted_bytes(wasted);
-  };
-  size_t quarantined_objects_size = 0;
-  for (auto it : pages_with_pinned_objects) {
-    MemoryChunk* chunk = it.first;
-    std::vector<std::pair<Address, size_t>>& pinned_objects_and_sizes =
-        it.second;
+  }
+  new_space.SetQuarantinedSize(quarantined_objects_size);
+}
+
+void QuarantinePinnedPages(SemiSpaceNewSpace& new_space) {
+  PageMetadata* next_page = new_space.from_space().first_page();
+  while (next_page) {
+    PageMetadata* current_page = next_page;
+    next_page = current_page->next_page();
+    MemoryChunk* chunk = current_page->Chunk();
     DCHECK(chunk->IsFromPage());
+    if (!chunk->IsQuarantined()) {
+      continue;
+    }
     if (chunk->IsFlagSet(MemoryChunk::WILL_BE_PROMOTED)) {
-      new_space.PromotePageToOldSpace(
-          static_cast<PageMetadata*>(chunk->Metadata()));
+      // free list categories will be relinked by the quarantined page sweeper
+      // after sweeping is done.
+      new_space.PromotePageToOldSpace(current_page,
+                                      FreeMode::kDoNotLinkCategory);
       DCHECK(!chunk->InYoungGeneration());
-      SweepQuarantinedPage(create_filler_and_add_to_freelist, chunk,
-                           pinned_objects_and_sizes);
     } else {
       new_space.MoveQuarantinedPage(chunk);
+      DCHECK(!chunk->IsFromPage());
       DCHECK(chunk->IsToPage());
-      quarantined_objects_size +=
-          SweepQuarantinedPage(create_filler, chunk, pinned_objects_and_sizes);
     }
-    DCHECK(PageMetadata::cast(chunk->Metadata())->marking_bitmap()->IsClean());
+    DCHECK(current_page->marking_bitmap()->IsClean());
     DCHECK(!chunk->IsFromPage());
     DCHECK(!chunk->IsQuarantined());
     DCHECK(!chunk->IsFlagSet(MemoryChunk::WILL_BE_PROMOTED));
   }
-  new_space.SetQuarantinedSize(quarantined_objects_size);
 }
 
 }  // namespace
 
+ScavengerCollector::QuarantinedPageSweeper::JobTask::JobTask(
+    Heap* heap, const PinnedObjects&& pinned_objects)
+    : heap_(heap),
+      trace_id_(reinterpret_cast<uint64_t>(this) ^
+                heap_->tracer()->CurrentEpoch(GCTracer::Scope::SCAVENGER)),
+      should_zap_(heap::ShouldZapGarbage()),
+      pinned_objects_(std::move(pinned_objects)) {
+  DCHECK(!pinned_objects.empty());
+}
+
+void ScavengerCollector::QuarantinedPageSweeper::JobTask::Run(
+    JobDelegate* delegate) {
+#ifdef V8_COMPRESS_POINTERS_IN_MULTIPLE_CAGES
+  SetCurrentIsolateScope current_isolate_scope(heap_->isolate());
+#endif  // V8_COMPRESS_POINTERS_IN_MULTIPLE_CAGES
+  DCHECK_IMPLIES(
+      delegate->IsJoiningThread(),
+      heap_->IsMainThread() ||
+          (!heap_->isolate()->is_shared_space_isolate() &&
+           heap_->isolate()->shared_space_isolate()->heap()->IsMainThread()));
+  const bool is_main_thread =
+      delegate->IsJoiningThread() && heap_->IsMainThread();
+  TRACE_GC_EPOCH_WITH_FLOW(
+      heap_->tracer(),
+      GCTracer::Scope::SCAVENGER_BACKGROUND_QUARANTINED_PAGE_SWEEPING,
+      is_main_thread ? ThreadKind::kMain : ThreadKind::kBackground, trace_id(),
+      TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT);
+  DCHECK(!is_done_.load(std::memory_order_relaxed));
+  DCHECK(!pinned_objects_.empty());
+  if (pinned_object_per_page_.empty()) {
+    // Populate the per page map.
+    for (const PinnedObjectEntry& entry : pinned_objects_) {
+      DCHECK(!HeapLayout::IsSelfForwarded(
+          HeapObject::FromAddress(entry.address), heap_->isolate()));
+      MemoryChunk* chunk = MemoryChunk::FromAddress(entry.address);
+      DCHECK(!chunk->IsQuarantined());
+      ObjectsAndSizes& objects_for_page = pinned_object_per_page_[chunk];
+      DCHECK(!std::any_of(objects_for_page.begin(), objects_for_page.end(),
+                          [entry](auto& object_and_size) {
+                            return object_and_size.first == entry.address;
+                          }));
+      objects_for_page.emplace_back(entry.address, entry.size);
+    }
+    // Initialize the iterator.
+    next_page_iterator_ = pinned_object_per_page_.begin();
+    DCHECK_NE(next_page_iterator_, pinned_object_per_page_.end());
+  }
+  // Sweep all quarantined pages.
+  while (next_page_iterator_ != pinned_object_per_page_.end()) {
+    if (delegate->ShouldYield()) {
+      TRACE_GC_NOTE("Quarantined page sweeping preempted");
+      return;
+    }
+    MemoryChunk* chunk = next_page_iterator_->first;
+    PageMetadata* page = static_cast<PageMetadata*>(chunk->Metadata());
+    DCHECK(!chunk->IsFromPage());
+    if (chunk->IsToPage()) {
+      SweepPage(CreateFillerFreeSpaceHandler, chunk, page,
+                next_page_iterator_->second);
+    } else {
+      DCHECK_EQ(chunk->Metadata()->owner()->identity(), OLD_SPACE);
+      base::MutexGuard guard(page->mutex());
+      // If for some reason the page is swept twice, this DCHECK will fail.
+      DCHECK_EQ(page->area_size(), page->allocated_bytes());
+      size_t filler_size_on_page =
+          SweepPage(AddToFreeListFreeSpaceHandler, chunk, page,
+                    next_page_iterator_->second);
+      DCHECK_EQ(page->owner()->identity(), OLD_SPACE);
+      OldSpace* old_space = static_cast<OldSpace*>(page->owner());
+      old_space->RelinkQuarantinedPageFreeList(page, filler_size_on_page);
+    }
+    next_page_iterator_++;
+  }
+  is_done_.store(true, std::memory_order_relaxed);
+  pinned_object_per_page_.clear();
+  pinned_objects_.clear();
+}
+
+// static
+void ScavengerCollector::QuarantinedPageSweeper::JobTask::
+    CreateFillerFreeSpaceHandler(Heap* heap, Address address, size_t size,
+                                 bool should_zap) {
+  if (should_zap) {
+    heap::ZapBlock(address, size, heap::ZapValue());
+  }
+  heap->CreateFillerObjectAt(address, static_cast<int>(size));
+}
+
+// static
+void ScavengerCollector::QuarantinedPageSweeper::JobTask::
+    AddToFreeListFreeSpaceHandler(Heap* heap, Address address, size_t size,
+                                  bool should_zap) {
+  if (should_zap) {
+    heap::ZapBlock(address, size, heap::ZapValue());
+  }
+  DCHECK_EQ(OLD_SPACE, PageMetadata::FromAddress(address)->owner()->identity());
+  DCHECK(PageMetadata::FromAddress(address)->SweepingDone());
+  OldSpace* const old_space = heap->old_space();
+  old_space->FreeDuringSweep(address, size);
+}
+
+size_t ScavengerCollector::QuarantinedPageSweeper::JobTask::SweepPage(
+    FreeSpaceHandler free_space_handler, MemoryChunk* chunk, PageMetadata* page,
+    ObjectsAndSizes& pinned_objects_on_page) {
+  DCHECK_EQ(page, chunk->Metadata());
+  DCHECK(!pinned_objects_on_page.empty());
+  Address start = page->area_start();
+  std::sort(pinned_objects_on_page.begin(), pinned_objects_on_page.end());
+  size_t filler_size_on_page = 0;
+  for (const auto& [object_adress, object_size] : pinned_objects_on_page) {
+    DCHECK_LE(start, object_adress);
+    if (start != object_adress) {
+      size_t filler_size = object_adress - start;
+      free_space_handler(heap_, start, filler_size, should_zap_);
+      filler_size_on_page += filler_size;
+    }
+    start = object_adress + object_size;
+  }
+  Address end = page->area_end();
+  if (start != end) {
+    size_t filler_size = end - start;
+    free_space_handler(heap_, start, filler_size, should_zap_);
+    filler_size_on_page += filler_size;
+  }
+  return filler_size_on_page;
+}
+
+void ScavengerCollector::QuarantinedPageSweeper::StartSweeping(
+    const ScavengerCollector::PinnedObjects&& pinned_objects) {
+  DCHECK_NULL(job_handle_);
+  DCHECK(!pinned_objects.empty());
+  auto job = std::make_unique<JobTask>(heap_, std::move(pinned_objects));
+  TRACE_GC_NOTE_WITH_FLOW("Quarantined page sweeper started", job->trace_id(),
+                          TRACE_EVENT_FLAG_FLOW_OUT);
+  job_handle_ = V8::GetCurrentPlatform()->PostJob(
+      v8::TaskPriority::kUserVisible, std::move(job));
+}
+
+void ScavengerCollector::QuarantinedPageSweeper::FinishSweeping() {
+  job_handle_->Join();
+  job_handle_.reset();
+}
+
 void ScavengerCollector::CollectGarbage() {
   ScopedFullHeapCrashKey collect_full_heap_dump_if_crash(isolate_);
 
+  DCHECK(surviving_new_large_objects_.empty());
+  DCHECK(!quarantined_page_sweeper_.IsSweeping());
+
   SemiSpaceNewSpace* new_space = SemiSpaceNewSpace::From(heap_->new_space());
   new_space->GarbageCollectionPrologue();
-  new_space->EvacuatePrologue();
+  new_space->SwapSemiSpaces();
 
   // We also flip the young generation large object space. All large objects
   // will be in the from space.
@@ -755,8 +825,6 @@ void ScavengerCollector::CollectGarbage() {
 
   DCHECK(!heap_->allocator()->new_space_allocator()->IsLabValid());
 
-  DCHECK(surviving_new_large_objects_.empty());
-
   Scavenger::EmptyChunksList empty_chunks;
   Scavenger::CopiedList copied_list;
   Scavenger::PinnedList pinned_list;
@@ -767,150 +835,142 @@ void ScavengerCollector::CollectGarbage() {
 
   const int num_scavenge_tasks = NumberOfScavengeTasks();
   std::vector<std::unique_ptr<Scavenger>> scavengers;
+
+  const bool is_logging = isolate_->log_object_relocation();
+  for (int i = 0; i < num_scavenge_tasks; ++i) {
+    scavengers.emplace_back(
+        new Scavenger(this, heap_, is_logging, &empty_chunks, &copied_list,
+                      &pinned_list, &promoted_list, &ephemeron_table_list));
+  }
+  Scavenger& main_thread_scavenger = *scavengers[kMainThreadId].get();
+
   {
-    const bool is_logging = isolate_->log_object_relocation();
-    for (int i = 0; i < num_scavenge_tasks; ++i) {
-      scavengers.emplace_back(
-          new Scavenger(this, heap_, is_logging, &empty_chunks, &copied_list,
-                        &pinned_list, &promoted_list, &ephemeron_table_list));
-    }
-    Scavenger& main_thread_scavenger = *scavengers[kMainThreadId].get();
-
-    {
-      // Identify weak unmodified handles. Requires an unmodified graph.
-      TRACE_GC(
-          heap_->tracer(),
-          GCTracer::Scope::SCAVENGER_SCAVENGE_WEAK_GLOBAL_HANDLES_IDENTIFY);
-      isolate_->traced_handles()->ComputeWeaknessForYoungObjects();
-    }
+    // Identify weak unmodified handles. Requires an unmodified graph.
+    TRACE_GC(heap_->tracer(),
+             GCTracer::Scope::SCAVENGER_SCAVENGE_WEAK_GLOBAL_HANDLES_IDENTIFY);
+    isolate_->traced_handles()->ComputeWeaknessForYoungObjects();
+  }
 
-    std::vector<std::pair<ParallelWorkItem, MutablePageMetadata*>>
-        old_to_new_chunks;
-    {
-      // Copy roots.
-      TRACE_GC(heap_->tracer(), GCTracer::Scope::SCAVENGER_SCAVENGE_ROOTS);
-
-      // We must collect old-to-new pages before starting Scavenge because pages
-      // could be removed from the old generation for allocation which hides
-      // them from the iteration.
-      OldGenerationMemoryChunkIterator::ForAll(
-          heap_, [&old_to_new_chunks](MutablePageMetadata* chunk) {
-            if (chunk->slot_set<OLD_TO_NEW>() ||
-                chunk->typed_slot_set<OLD_TO_NEW>() ||
-                chunk->slot_set<OLD_TO_NEW_BACKGROUND>()) {
-              old_to_new_chunks.emplace_back(ParallelWorkItem{}, chunk);
-            }
-          });
+  std::vector<std::pair<ParallelWorkItem, MutablePageMetadata*>>
+      old_to_new_chunks;
+  {
+    // Copy roots.
+    TRACE_GC(heap_->tracer(), GCTracer::Scope::SCAVENGER_SCAVENGE_ROOTS);
 
-      if (v8_flags.scavenger_conservative_object_pinning &&
-          heap_->IsGCWithStack()) {
-        // Pinning objects must be the first step and must happen before
-        // scavenging any objects. Specifically we must all pin all objects
-        // before visiting other pinned objects. If we scavenge some object X
-        // and move it before all stack-reachable objects are pinned, and we
-        // later find that we need to pin X, it will be too late to undo the
-        // moving.
-        TRACE_GC(heap_->tracer(),
-                 GCTracer::Scope::SCAVENGER_SCAVENGE_PIN_OBJECTS);
-        ConservativeObjectPinningVisitor conservative_pinning_visitor(
-            heap_, main_thread_scavenger, pinned_objects);
-        // Scavenger reuses the page's marking bitmap as a temporary object
-        // start bitmap. Stack scanning will incrementally build the map as it
-        // searches through pages.
-        YoungGenerationConservativeStackVisitor stack_visitor(
-            isolate_, &conservative_pinning_visitor);
-        // Marker was already set by Heap::CollectGarbage.
-        heap_->IterateConservativeStackRoots(&stack_visitor);
-        if (V8_UNLIKELY(
-                v8_flags.stress_scavenger_conservative_object_pinning)) {
-          TreatConservativelyVisitor handles_visitor(&stack_visitor, heap_);
-          heap_->IterateRootsForPrecisePinning(&handles_visitor);
-        }
-      }
-      if (v8_flags.scavenger_precise_object_pinning) {
-        PreciseObjectPinningVisitor precise_pinning_visitor(
-            heap_, main_thread_scavenger, pinned_objects);
-        ClearStaleLeftTrimmedPointerVisitor left_trim_visitor(
-            heap_, &precise_pinning_visitor);
-        heap_->IterateRootsForPrecisePinning(&left_trim_visitor);
-      }
+    // We must collect old-to-new pages before starting Scavenge because
+    // pages could be removed from the old generation for allocation which
+    // hides them from the iteration.
+    OldGenerationMemoryChunkIterator::ForAll(
+        heap_, [&old_to_new_chunks](MutablePageMetadata* chunk) {
+          if (chunk->slot_set<OLD_TO_NEW>() ||
+              chunk->typed_slot_set<OLD_TO_NEW>() ||
+              chunk->slot_set<OLD_TO_NEW_BACKGROUND>()) {
+            old_to_new_chunks.emplace_back(ParallelWorkItem{}, chunk);
+          }
+        });
 
-      // Scavenger treats all weak roots except for global handles as strong.
-      // That is why we don't set skip_weak = true here and instead visit
-      // global handles separately.
-      base::EnumSet<SkipRoot> options(
-          {SkipRoot::kExternalStringTable, SkipRoot::kGlobalHandles,
-           SkipRoot::kTracedHandles, SkipRoot::kOldGeneration,
-           SkipRoot::kConservativeStack, SkipRoot::kReadOnlyBuiltins});
-      if (v8_flags.scavenger_precise_object_pinning) {
-        options.Add({SkipRoot::kMainThreadHandles, SkipRoot::kStack});
+    if (v8_flags.scavenger_conservative_object_pinning &&
+        heap_->IsGCWithStack()) {
+      // Pinning objects must be the first step and must happen before
+      // scavenging any objects. Specifically we must all pin all objects
+      // before visiting other pinned objects. If we scavenge some object X
+      // and move it before all stack-reachable objects are pinned, and we
+      // later find that we need to pin X, it will be too late to undo the
+      // moving.
+      TRACE_GC(heap_->tracer(),
+               GCTracer::Scope::SCAVENGER_SCAVENGE_PIN_OBJECTS);
+      ConservativeObjectPinningVisitor conservative_pinning_visitor(
+          heap_, main_thread_scavenger, pinned_objects);
+      // Scavenger reuses the page's marking bitmap as a temporary object
+      // start bitmap. Stack scanning will incrementally build the map as it
+      // searches through pages.
+      YoungGenerationConservativeStackVisitor stack_visitor(
+          isolate_, &conservative_pinning_visitor);
+      // Marker was already set by Heap::CollectGarbage.
+      heap_->IterateConservativeStackRoots(&stack_visitor);
+      if (V8_UNLIKELY(v8_flags.stress_scavenger_conservative_object_pinning)) {
+        TreatConservativelyVisitor handles_visitor(&stack_visitor, heap_);
+        heap_->IterateRootsForPrecisePinning(&handles_visitor);
       }
-      RootScavengeVisitor root_scavenge_visitor(main_thread_scavenger);
-
-      heap_->IterateRoots(&root_scavenge_visitor, options);
-      isolate_->global_handles()->IterateYoungStrongAndDependentRoots(
-          &root_scavenge_visitor);
-      isolate_->traced_handles()->IterateYoungRoots(&root_scavenge_visitor);
     }
-    {
-      // Parallel phase scavenging all copied and promoted objects.
-      TRACE_GC_ARG1(
-          heap_->tracer(), GCTracer::Scope::SCAVENGER_SCAVENGE_PARALLEL_PHASE,
-          "UseBackgroundThreads", heap_->ShouldUseBackgroundThreads());
-
-      auto job = std::make_unique<JobTask>(
-          this, &scavengers, std::move(old_to_new_chunks), copied_list,
-          pinned_list, promoted_list);
-      TRACE_GC_NOTE_WITH_FLOW("Parallel scavenge started", job->trace_id(),
-                              TRACE_EVENT_FLAG_FLOW_OUT);
-      V8::GetCurrentPlatform()
-          ->CreateJob(v8::TaskPriority::kUserBlocking, std::move(job))
-          ->Join();
-      DCHECK(copied_list.IsEmpty());
-      DCHECK(pinned_list.IsEmpty());
-      DCHECK(promoted_list.IsEmpty());
+    if (v8_flags.scavenger_precise_object_pinning) {
+      PreciseObjectPinningVisitor precise_pinning_visitor(
+          heap_, main_thread_scavenger, pinned_objects);
+      ClearStaleLeftTrimmedPointerVisitor left_trim_visitor(
+          heap_, &precise_pinning_visitor);
+      heap_->IterateRootsForPrecisePinning(&left_trim_visitor);
     }
 
-    {
-      // Scavenge weak global handles.
-      TRACE_GC(heap_->tracer(),
-               GCTracer::Scope::SCAVENGER_SCAVENGE_WEAK_GLOBAL_HANDLES_PROCESS);
-      GlobalHandlesWeakRootsUpdatingVisitor visitor;
-      isolate_->global_handles()->ProcessWeakYoungObjects(
-          &visitor, &IsUnscavengedHeapObjectSlot);
-      isolate_->traced_handles()->ProcessWeakYoungObjects(
-          &visitor, &IsUnscavengedHeapObjectSlot);
+    // Scavenger treats all weak roots except for global handles as strong.
+    // That is why we don't set skip_weak = true here and instead visit
+    // global handles separately.
+    base::EnumSet<SkipRoot> options(
+        {SkipRoot::kExternalStringTable, SkipRoot::kGlobalHandles,
+         SkipRoot::kTracedHandles, SkipRoot::kOldGeneration,
+         SkipRoot::kConservativeStack, SkipRoot::kReadOnlyBuiltins});
+    if (v8_flags.scavenger_precise_object_pinning) {
+      options.Add({SkipRoot::kMainThreadHandles, SkipRoot::kStack});
     }
+    RootScavengeVisitor root_scavenge_visitor(main_thread_scavenger);
 
-    {
-      // Finalize parallel scavenging.
-      TRACE_GC(heap_->tracer(), GCTracer::Scope::SCAVENGER_SCAVENGE_FINALIZE);
+    heap_->IterateRoots(&root_scavenge_visitor, options);
+    isolate_->global_handles()->IterateYoungStrongAndDependentRoots(
+        &root_scavenge_visitor);
+    isolate_->traced_handles()->IterateYoungRoots(&root_scavenge_visitor);
+  }
+  {
+    // Parallel phase scavenging all copied and promoted objects.
+    TRACE_GC_ARG1(heap_->tracer(),
+                  GCTracer::Scope::SCAVENGER_SCAVENGE_PARALLEL_PHASE,
+                  "UseBackgroundThreads", heap_->ShouldUseBackgroundThreads());
+
+    auto job = std::make_unique<JobTask>(
+        this, &scavengers, std::move(old_to_new_chunks), copied_list,
+        pinned_list, promoted_list);
+    TRACE_GC_NOTE_WITH_FLOW("Parallel scavenge started", job->trace_id(),
+                            TRACE_EVENT_FLAG_FLOW_OUT);
+    V8::GetCurrentPlatform()
+        ->CreateJob(v8::TaskPriority::kUserBlocking, std::move(job))
+        ->Join();
+    DCHECK(copied_list.IsEmpty());
+    DCHECK(pinned_list.IsEmpty());
+    DCHECK(promoted_list.IsEmpty());
+  }
 
-      DCHECK(surviving_new_large_objects_.empty());
+  {
+    // Scavenge weak global handles.
+    TRACE_GC(heap_->tracer(),
+             GCTracer::Scope::SCAVENGER_SCAVENGE_WEAK_GLOBAL_HANDLES_PROCESS);
+    GlobalHandlesWeakRootsUpdatingVisitor visitor;
+    isolate_->global_handles()->ProcessWeakYoungObjects(
+        &visitor, &IsUnscavengedHeapObjectSlot);
+    isolate_->traced_handles()->ProcessWeakYoungObjects(
+        &visitor, &IsUnscavengedHeapObjectSlot);
+  }
 
-      for (auto& scavenger : scavengers) {
-        scavenger->Finalize();
-      }
-      scavengers.clear();
+  {
+    // Finalize parallel scavenging.
+    TRACE_GC(heap_->tracer(), GCTracer::Scope::SCAVENGER_SCAVENGE_FINALIZE);
+
+    DCHECK(surviving_new_large_objects_.empty());
+
+    for (auto& scavenger : scavengers) {
+      scavenger->Finalize();
+    }
+    scavengers.clear();
 
 #ifdef V8_COMPRESS_POINTERS
-      // Sweep the external pointer table, unless an incremental mark is in
-      // progress, in which case leave sweeping to the end of the
-      // already-scheduled major GC cycle.  (If we swept here we'd clear EPT
-      // marks that the major marker was using, which would be an error.)
-      DCHECK(heap_->concurrent_marking()->IsStopped());
-      if (!heap_->incremental_marking()->IsMajorMarking()) {
-        heap_->isolate()->external_pointer_table().Sweep(
-            heap_->young_external_pointer_space(),
-            heap_->isolate()->counters());
-      }
+    // Sweep the external pointer table.
+    DCHECK(heap_->concurrent_marking()->IsStopped());
+    DCHECK(!heap_->incremental_marking()->IsMajorMarking());
+    heap_->isolate()->external_pointer_table().Sweep(
+        heap_->young_external_pointer_space(), heap_->isolate()->counters());
 #endif  // V8_COMPRESS_POINTERS
 
-      HandleSurvivingNewLargeObjects();
+    HandleSurvivingNewLargeObjects();
 
-      heap_->tracer()->SampleConcurrencyEsimate(
-          FetchAndResetConcurrencyEstimate());
-    }
+    heap_->tracer()->SampleConcurrencyEsimate(
+        FetchAndResetConcurrencyEstimate());
   }
 
   {
@@ -919,26 +979,19 @@ void ScavengerCollector::CollectGarbage() {
     heap_->UpdateYoungReferencesInExternalStringTable(
         &Heap::UpdateYoungReferenceInExternalStringTableEntry);
 
-    heap_->incremental_marking()->UpdateMarkingWorklistAfterScavenge();
-    heap_->incremental_marking()->UpdateExternalPointerTableAfterScavenge();
-
     if (V8_UNLIKELY(v8_flags.always_use_string_forwarding_table)) {
       isolate_->string_forwarding_table()->UpdateAfterYoungEvacuation();
     }
   }
 
-  if (v8_flags.concurrent_marking) {
-    // Ensure that concurrent marker does not track pages that are
-    // going to be unmapped.
-    for (PageMetadata* p :
-         PageRange(new_space->from_space().first_page(), nullptr)) {
-      heap_->concurrent_marking()->ClearMemoryChunkData(p);
-    }
-  }
-
   ProcessWeakReferences(&ephemeron_table_list);
 
-  RestoreAndQuarantinePinnedObjects(*new_space, pinned_objects);
+  {
+    TRACE_GC(heap_->tracer(),
+             GCTracer::Scope::SCAVENGER_SCAVENGE_RESTORE_AND_QUARANTINE_PINNED);
+    RestorePinnedObjects(*new_space, pinned_objects);
+    QuarantinePinnedPages(*new_space);
+  }
 
   // Need to free new space LAB that was allocated during scavenge.
   heap_->allocator()->new_space_allocator()->FreeLinearAllocationArea();
@@ -951,6 +1004,16 @@ void ScavengerCollector::CollectGarbage() {
 
   new_space->GarbageCollectionEpilogue();
 
+  // Start sweeping quarantined pages.
+  if (!pinned_objects.empty()) {
+    quarantined_page_sweeper_.StartSweeping(std::move(pinned_objects));
+  } else {
+    // Sweeping is not started since there are no pages to sweep. Mark sweeping
+    // as completed so that the current GC cycle can be stopped since there is
+    // no sweeper to mark it has completed later.
+    heap_->tracer()->NotifyYoungSweepingCompleted();
+  }
+
   {
     TRACE_GC(heap_->tracer(), GCTracer::Scope::SCAVENGER_FREE_REMEMBERED_SET);
     Scavenger::EmptyChunksList::Local empty_chunks_local(empty_chunks);
@@ -996,8 +1059,7 @@ void ScavengerCollector::SweepArrayBufferExtensions() {
 }
 
 void ScavengerCollector::HandleSurvivingNewLargeObjects() {
-  const bool is_compacting = heap_->incremental_marking()->IsCompacting();
-  MarkingState* marking_state = heap_->marking_state();
+  DCHECK(!heap_->incremental_marking()->IsMarking());
 
   for (SurvivingNewLargeObjectMapEntry update_info :
        surviving_new_large_objects_) {
@@ -1007,13 +1069,6 @@ void ScavengerCollector::HandleSurvivingNewLargeObjects() {
     // to meta-data like size during page promotion.
     object->set_map_word(map, kRelaxedStore);
 
-    if (is_compacting && marking_state->IsMarked(object) &&
-        MarkCompactCollector::IsOnEvacuationCandidate(map)) {
-      MemoryChunk* chunk = MemoryChunk::FromHeapObject(object);
-      MutablePageMetadata* page = MutablePageMetadata::cast(chunk->Metadata());
-      RememberedSet<OLD_TO_OLD>::Insert<AccessMode::ATOMIC>(
-          page, chunk->Offset(object->map_slot().address()));
-    }
     LargePageMetadata* page = LargePageMetadata::FromHeapObject(object);
     heap_->lo_space()->PromoteNewLargeObject(page);
   }
@@ -1030,6 +1085,14 @@ void ScavengerCollector::MergeSurvivingNewLargeObjects(
   }
 }
 
+void ScavengerCollector::CompleteSweepingQuarantinedPagesIfNeeded() {
+  if (!quarantined_page_sweeper_.IsSweeping()) {
+    return;
+  }
+  quarantined_page_sweeper_.FinishSweeping();
+  heap_->tracer()->NotifyYoungSweepingCompletedAndStopCycleIfFinished();
+}
+
 int ScavengerCollector::NumberOfScavengeTasks() {
   if (!v8_flags.parallel_scavenge) {
     return 1;
@@ -1064,15 +1127,12 @@ Scavenger::Scavenger(ScavengerCollector* collector, Heap* heap, bool is_logging,
       local_pretenuring_feedback_(PretenuringHandler::kInitialFeedbackCapacity),
       allocator_(heap, CompactionSpaceKind::kCompactionSpaceForScavenge),
       is_logging_(is_logging),
-      is_incremental_marking_(heap->incremental_marking()->IsMarking()),
-      is_compacting_(heap->incremental_marking()->IsCompacting()),
       shared_string_table_(v8_flags.shared_string_table &&
                            heap->isolate()->has_shared_space()),
       mark_shared_heap_(heap->isolate()->is_shared_space_isolate()),
       shortcut_strings_(
           heap->CanShortcutStringsDuringGC(GarbageCollector::SCAVENGER)) {
-  DCHECK_IMPLIES(is_incremental_marking_,
-                 heap->incremental_marking()->IsMajorMarking());
+  DCHECK(!heap->incremental_marking()->IsMarking());
 }
 
 void Scavenger::IterateAndScavengePromotedObject(Tagged<HeapObject> target,
@@ -1083,11 +1143,7 @@ void Scavenger::IterateAndScavengePromotedObject(Tagged<HeapObject> target,
   // object's slots would be rescanned. White object might not survive until
   // the end of collection it would be a violation of the invariant to record
   // its slots.
-  const bool record_slots =
-      is_compacting_ && heap()->marking_state()->IsMarked(target);
-  DCHECK_IMPLIES(v8_flags.separate_gc_phases, !record_slots);
-
-  IterateAndScavengePromotedObjectsVisitor visitor(this, record_slots);
+  IterateAndScavengePromotedObjectsVisitor visitor(this);
 
   // Iterate all outgoing pointers including map word.
   visitor.Visit(map, target, size);
@@ -1358,21 +1414,44 @@ bool Scavenger::PromoteIfLargeObject(Tagged<HeapObject> object) {
                            Map::ObjectFieldsFrom(map->visitor_id()));
 }
 
-void Scavenger::PushPinnedObject(MemoryChunk* chunk, Tagged<HeapObject> object,
-                                 Tagged<Map> map) {
-  DCHECK(HeapLayout::IsSelfForwarded(object));
+void Scavenger::PinAndPushObject(MemoryChunk* chunk, Tagged<HeapObject> object,
+                                 MapWord map_word) {
+  DCHECK(chunk->Metadata()->Contains(object->address()));
+  DCHECK_EQ(map_word, object->map_word(kRelaxedLoad));
+  Tagged<Map> map = map_word.ToMap();
   int object_size = object->SizeFromMap(map);
   PretenuringHandler::UpdateAllocationSite(heap_, map, object, object_size,
                                            &local_pretenuring_feedback_);
+  object->set_map_word_forwarded(object, kRelaxedStore);
+  DCHECK(object->map_word(kRelaxedLoad).IsForwardingAddress());
+  DCHECK(HeapLayout::IsSelfForwarded(object));
   if (chunk->IsFlagSet(MemoryChunk::WILL_BE_PROMOTED)) {
-    local_promoted_list_.Push({object, map, object_size});
-    promoted_size_ += object_size;
+    PushPinnedPromotedObject(object, map, object_size);
   } else {
-    local_pinned_list_.Push(ObjectAndMap(object, map));
-    copied_size_ += object_size;
+    PushPinnedObject(object, map, object_size);
   }
 }
 
+void Scavenger::PushPinnedObject(Tagged<HeapObject> object, Tagged<Map> map,
+                                 int object_size) {
+  DCHECK(HeapLayout::IsSelfForwarded(object));
+  DCHECK(!MemoryChunk::FromHeapObject(object)->IsFlagSet(
+      MemoryChunk::WILL_BE_PROMOTED));
+  DCHECK_EQ(object_size, object->SizeFromMap(map));
+  local_pinned_list_.Push(ObjectAndMap(object, map));
+  copied_size_ += object_size;
+}
+
+void Scavenger::PushPinnedPromotedObject(Tagged<HeapObject> object,
+                                         Tagged<Map> map, int object_size) {
+  DCHECK(HeapLayout::IsSelfForwarded(object));
+  DCHECK(MemoryChunk::FromHeapObject(object)->IsFlagSet(
+      MemoryChunk::WILL_BE_PROMOTED));
+  DCHECK_EQ(object_size, object->SizeFromMap(map));
+  local_promoted_list_.Push({object, map, object_size});
+  promoted_size_ += object_size;
+}
+
 void Scavenger::VisitPinnedObjects() {
   ScavengeVisitor scavenge_visitor(this);
 
diff --git a/deps/v8/src/heap/scavenger.h b/deps/v8/src/heap/scavenger.h
index f6fa8531a1a236..a54e81e0919f44 100644
--- a/deps/v8/src/heap/scavenger.h
+++ b/deps/v8/src/heap/scavenger.h
@@ -5,6 +5,8 @@
 #ifndef V8_HEAP_SCAVENGER_H_
 #define V8_HEAP_SCAVENGER_H_
 
+#include <atomic>
+
 #include "src/base/platform/condition-variable.h"
 #include "src/heap/base/worklist.h"
 #include "src/heap/ephemeron-remembered-set.h"
@@ -82,8 +84,8 @@ class Scavenger {
   // Returns true if the object is a large young object, and false otherwise.
   bool PromoteIfLargeObject(Tagged<HeapObject> object);
 
-  void PushPinnedObject(MemoryChunk* chunk, Tagged<HeapObject> object,
-                        Tagged<Map> map);
+  void PinAndPushObject(MemoryChunk* chunk, Tagged<HeapObject> object,
+                        MapWord map_word);
   void VisitPinnedObjects();
 
   size_t bytes_copied() const { return copied_size_; }
@@ -182,6 +184,11 @@ class Scavenger {
 
   V8_INLINE bool ShouldEagerlyProcessPromotedList() const;
 
+  void PushPinnedObject(Tagged<HeapObject> object, Tagged<Map> map,
+                        int object_size);
+  void PushPinnedPromotedObject(Tagged<HeapObject> object, Tagged<Map> map,
+                                int object_size);
+
   ScavengerCollector* const collector_;
   Heap* const heap_;
   EmptyChunksList::Local local_empty_chunks_;
@@ -197,8 +204,6 @@ class Scavenger {
   EvacuationAllocator allocator_;
 
   const bool is_logging_;
-  const bool is_incremental_marking_;
-  const bool is_compacting_;
   const bool shared_string_table_;
   const bool mark_shared_heap_;
   const bool shortcut_strings_;
@@ -228,6 +233,13 @@ class RootScavengeVisitor final : public RootVisitor {
 
 class ScavengerCollector {
  public:
+  struct PinnedObjectEntry {
+    Address address;
+    MapWord map_word;
+    size_t size;
+  };
+  using PinnedObjects = std::vector<PinnedObjectEntry>;
+
   static const int kMaxScavengerTasks = 8;
   static const int kMainThreadId = 0;
 
@@ -235,6 +247,8 @@ class ScavengerCollector {
 
   void CollectGarbage();
 
+  void CompleteSweepingQuarantinedPagesIfNeeded();
+
  private:
   class JobTask : public v8::JobTask {
    public:
@@ -271,6 +285,74 @@ class ScavengerCollector {
     const uint64_t trace_id_;
   };
 
+  // Quarantined pages must be swept before the next GC. If the next GC uses
+  // conservative scanning and encounters a stale object left over from a
+  // previous GC, this can result in memory corruptions.
+  class QuarantinedPageSweeper {
+   public:
+    explicit QuarantinedPageSweeper(Heap* heap) : heap_(heap) {}
+    ~QuarantinedPageSweeper() {
+      if (IsSweeping()) {
+        FinishSweeping();
+      }
+    }
+
+    void StartSweeping(const PinnedObjects&& pinned_objects);
+    void FinishSweeping();
+    bool IsSweeping() const {
+      DCHECK_IMPLIES(job_handle_, job_handle_->IsValid());
+      return job_handle_.get();
+    }
+
+   private:
+    class JobTask : public v8::JobTask {
+     public:
+      JobTask(Heap* heap, const PinnedObjects&& pinned_objects);
+      ~JobTask() {
+        DCHECK(is_done_.load(std::memory_order_relaxed));
+        DCHECK(pinned_object_per_page_.empty());
+        DCHECK(pinned_objects_.empty());
+      }
+
+      void Run(JobDelegate* delegate) override;
+
+      size_t GetMaxConcurrency(size_t worker_count) const override {
+        return is_done_.load(std::memory_order_relaxed) ? 0 : 1;
+      }
+
+      uint64_t trace_id() const { return trace_id_; }
+
+     private:
+      using ObjectsAndSizes = std::vector<std::pair<Address, size_t>>;
+      using PinnedObjectPerPage =
+          std::unordered_map<MemoryChunk*, ObjectsAndSizes,
+                             base::hash<MemoryChunk*>>;
+      using FreeSpaceHandler =
+          std::function<void(Heap*, Address, size_t, bool)>;
+      static void CreateFillerFreeSpaceHandler(Heap* heap, Address address,
+                                               size_t size, bool should_zap);
+      static void AddToFreeListFreeSpaceHandler(Heap* heap, Address address,
+                                                size_t size, bool should_zap);
+
+      size_t SweepPage(FreeSpaceHandler free_space_handler, MemoryChunk* chunk,
+                       PageMetadata* page,
+                       ObjectsAndSizes& pinned_objects_on_page);
+      void CreateFillerFreeHandler(Address address, size_t size);
+
+      Heap* const heap_;
+      const uint64_t trace_id_;
+      const bool should_zap_;
+      PinnedObjects pinned_objects_;
+
+      std::atomic_bool is_done_{false};
+      PinnedObjectPerPage pinned_object_per_page_;
+      PinnedObjectPerPage::iterator next_page_iterator_;
+    };
+
+    Heap* const heap_;
+    std::unique_ptr<JobHandle> job_handle_;
+  };
+
   void MergeSurvivingNewLargeObjects(
       const SurvivingNewLargeObjectsMap& objects);
 
@@ -295,6 +377,7 @@ class ScavengerCollector {
   Heap* const heap_;
   SurvivingNewLargeObjectsMap surviving_new_large_objects_;
   std::atomic<size_t> estimate_concurrency_{0};
+  QuarantinedPageSweeper quarantined_page_sweeper_;
 
   friend class Scavenger;
 };
diff --git a/deps/v8/src/heap/setup-heap-internal.cc b/deps/v8/src/heap/setup-heap-internal.cc
index afa45af9da0802..44816f6f403859 100644
--- a/deps/v8/src/heap/setup-heap-internal.cc
+++ b/deps/v8/src/heap/setup-heap-internal.cc
@@ -20,7 +20,7 @@
 #include "src/objects/call-site-info.h"
 #include "src/objects/cell-inl.h"
 #include "src/objects/contexts.h"
-#include "src/objects/data-handler.h"
+#include "src/objects/data-handler-inl.h"
 #include "src/objects/debug-objects.h"
 #include "src/objects/descriptor-array.h"
 #include "src/objects/dictionary.h"
@@ -149,17 +149,27 @@ constexpr bool is_important_struct(InstanceType type) {
   return type == ENUM_CACHE_TYPE || type == CALL_SITE_INFO_TYPE;
 }
 
+template <typename StructType>
+constexpr int StructSize() {
+  if constexpr (std::is_base_of_v<StructLayout, StructType>) {
+    return sizeof(StructType);
+  } else {
+    return StructType::kSize;
+  }
+}
+
+using AllocationSiteWithoutWeakNext = AllocationSite;
 constexpr std::initializer_list<StructInit> kStructTable{
 #define STRUCT_TABLE_ELEMENT(TYPE, Name, name) \
-  {TYPE, Name::kSize, RootIndex::k##Name##Map},
+  {TYPE, StructSize<Name>(), RootIndex::k##Name##Map},
     STRUCT_LIST(STRUCT_TABLE_ELEMENT)
 #undef STRUCT_TABLE_ELEMENT
 #define ALLOCATION_SITE_ELEMENT(_, TYPE, Name, Size, name) \
-  {TYPE, Name::kSize##Size, RootIndex::k##Name##Size##Map},
+  {TYPE, sizeof(Name##Size), RootIndex::k##Name##Size##Map},
         ALLOCATION_SITE_LIST(ALLOCATION_SITE_ELEMENT, /* not used */)
 #undef ALLOCATION_SITE_ELEMENT
 #define DATA_HANDLER_ELEMENT(_, TYPE, Name, Size, name) \
-  {TYPE, Name::kSizeWithData##Size, RootIndex::k##Name##Size##Map},
+  {TYPE, Name::SizeFor(Size), RootIndex::k##Name##Size##Map},
             DATA_HANDLER_LIST(DATA_HANDLER_ELEMENT, /* not used */)
 #undef DATA_HANDLER_ELEMENT
 };
@@ -198,7 +208,6 @@ bool Heap::CreateReadOnlyHeapObjects() {
 #endif
 
   if (!CreateLateReadOnlyNonJSReceiverMaps()) return false;
-  CreateReadOnlyApiObjects();
   if (!CreateReadOnlyObjects()) return false;
 
   // Order is important. JSReceiver maps must come after all non-JSReceiver maps
@@ -208,6 +217,8 @@ bool Heap::CreateReadOnlyHeapObjects() {
   // See InstanceTypeChecker::kNonJsReceiverMapLimit.
   if (!CreateLateReadOnlyJSReceiverMaps()) return false;
 
+  CreateReadOnlyApiObjects();
+
 #ifdef DEBUG
   ReadOnlyRoots roots(isolate());
   for (auto pos = RootIndex::kFirstReadOnlyRoot;
@@ -426,7 +437,10 @@ bool Heap::CreateEarlyReadOnlyMapsAndObjects() {
       Tagged<Map> map = UncheckedCast<Map>(roots.object_at(entry.index));
       InitializePartialMap(isolate(), map, meta_map, entry.type, entry.size);
       map->SetConstructorFunctionIndex(Context::STRING_FUNCTION_INDEX);
-      if (StringShape(entry.type).IsCons()) map->mark_unstable();
+      // Strings change maps in-place (e.g., when internalizing them). Thus they
+      // are marked unstable to let the compilers not depend on them not
+      // changing.
+      map->mark_unstable();
     }
     InitializePartialMap(isolate(), symbol_map, meta_map, SYMBOL_TYPE,
                          sizeof(Symbol));
@@ -565,6 +579,7 @@ bool Heap::CreateEarlyReadOnlyMapsAndObjects() {
     Tagged<DescriptorArray> array = Cast<DescriptorArray>(obj);
     array->Initialize(roots.empty_enum_cache(), roots.undefined_value(), 0, 0,
                       DescriptorArrayMarkingState::kInitialGCState);
+    array->set_fast_iterable(DescriptorArray::FastIterableState::kJsonFast);
   }
   set_empty_descriptor_array(Cast<DescriptorArray>(obj));
 
@@ -685,6 +700,8 @@ bool Heap::CreateEarlyReadOnlyMapsAndObjects() {
     ALLOCATE_VARSIZE_MAP(ARRAY_LIST_TYPE, array_list)
 
     ALLOCATE_MAP(ACCESSOR_INFO_TYPE, AccessorInfo::kSize, accessor_info)
+    ALLOCATE_MAP(INTERCEPTOR_INFO_TYPE, InterceptorInfo::kSize,
+                 interceptor_info)
 
     ALLOCATE_VARSIZE_MAP(PREPARSE_DATA_TYPE, preparse_data)
     ALLOCATE_MAP(SHARED_FUNCTION_INFO_TYPE, SharedFunctionInfo::kSize,
@@ -726,6 +743,7 @@ bool Heap::CreateLateReadOnlyNonJSReceiverMaps() {
 
     ALLOCATE_VARSIZE_MAP(SIMPLE_NUMBER_DICTIONARY_TYPE,
                          simple_number_dictionary)
+    ALLOCATE_VARSIZE_MAP(SIMPLE_NAME_DICTIONARY_TYPE, simple_name_dictionary)
     ALLOCATE_VARSIZE_MAP(NAME_TO_INDEX_HASH_TABLE_TYPE,
                          name_to_index_hash_table)
 
@@ -750,9 +768,7 @@ bool Heap::CreateLateReadOnlyNonJSReceiverMaps() {
     ALLOCATE_MAP(SYNTHETIC_MODULE_TYPE, SyntheticModule::kSize,
                  synthetic_module)
 
-    ALLOCATE_MAP(CONTEXT_SIDE_PROPERTY_CELL_TYPE,
-                 ContextSidePropertyCell::kSize,
-                 global_context_side_property_cell)
+    ALLOCATE_MAP(CONTEXT_CELL_TYPE, sizeof(ContextCell), context_cell)
 
     IF_WASM(ALLOCATE_MAP, WASM_IMPORT_DATA_TYPE, WasmImportData::kSize,
             wasm_import_data)
@@ -771,8 +787,6 @@ bool Heap::CreateLateReadOnlyNonJSReceiverMaps() {
             WasmSuspenderObject::kSize, wasm_suspender_object)
     IF_WASM(ALLOCATE_MAP, WASM_TYPE_INFO_TYPE, kVariableSizeSentinel,
             wasm_type_info)
-    IF_WASM(ALLOCATE_MAP, WASM_CONTINUATION_OBJECT_TYPE,
-            WasmContinuationObject::kSize, wasm_continuation_object)
     IF_WASM(ALLOCATE_MAP, WASM_NULL_TYPE, kVariableSizeSentinel, wasm_null);
     IF_WASM(ALLOCATE_MAP, WASM_TRUSTED_INSTANCE_DATA_TYPE,
             WasmTrustedInstanceData::kSize, wasm_trusted_instance_data);
@@ -824,6 +838,9 @@ bool Heap::CreateLateReadOnlyJSReceiverMaps() {
                  external)
     roots.external_map()->SetEnumLength(0);
     roots.external_map()->set_is_extensible(false);
+
+    ALLOCATE_MAP(CPP_HEAP_EXTERNAL_OBJECT_TYPE,
+                 CppHeapExternalObject::kHeaderSize, cpp_heap_external)
   }
 
   // Shared space object maps are immutable and can be in RO space.
@@ -1087,17 +1104,6 @@ bool Heap::CreateReadOnlyObjects() {
       /* not used */)
 #undef ENSURE_SINGLE_CHAR_STRINGS_ARE_SINGLE_CHAR
 
-  // Allocate and initialize table for single character one byte strings.
-  int table_size = String::kMaxOneByteCharCode + 1;
-  set_single_character_string_table(
-      *factory->NewFixedArray(table_size, AllocationType::kReadOnly));
-  for (int i = 0; i < table_size; ++i) {
-    DirectHandle<String> str = Cast<String>(
-        roots_table().handle_at(RootsTable::SingleCharacterStringIndex(i)));
-    DCHECK(ReadOnlyHeap::Contains(*str));
-    single_character_string_table()->set(i, *str);
-  }
-
   // Finish initializing oddballs after creating the string table.
   Oddball::Initialize(isolate(), factory->undefined_value(), "undefined",
                       factory->nan_value(), "undefined", Oddball::kUndefined);
@@ -1330,10 +1336,13 @@ void Heap::CreateMutableApiObjects() {
 
 void Heap::CreateReadOnlyApiObjects() {
   HandleScope scope(isolate());
-  auto info = Cast<InterceptorInfo>(isolate()->factory()->NewStruct(
-      INTERCEPTOR_INFO_TYPE, AllocationType::kReadOnly));
-  info->set_flags(0);
+  auto info =
+      isolate()->factory()->NewInterceptorInfo(AllocationType::kReadOnly);
   set_noop_interceptor_info(*info);
+  // Make sure read only heap layout does not depend on the size of
+  // ExternalPointer fields.
+  StaticRootsEnsureAllocatedSize(info,
+                                 3 * kTaggedSize + 7 * kSystemPointerSize);
 }
 
 void Heap::CreateInitialMutableObjects() {
@@ -1371,7 +1380,6 @@ void Heap::CreateInitialMutableObjects() {
   set_shared_wasm_memories(roots.empty_weak_array_list());
   set_locals_block_list_cache(roots.undefined_value());
 #ifdef V8_ENABLE_WEBASSEMBLY
-  set_active_continuation(roots.undefined_value());
   set_active_suspender(roots.undefined_value());
   set_js_to_wasm_wrappers(roots.empty_weak_fixed_array());
   set_wasm_canonical_rtts(roots.empty_weak_fixed_array());
diff --git a/deps/v8/src/heap/spaces.cc b/deps/v8/src/heap/spaces.cc
index fc85c17ae248a3..59c1443a75b954 100644
--- a/deps/v8/src/heap/spaces.cc
+++ b/deps/v8/src/heap/spaces.cc
@@ -16,7 +16,6 @@
 #include "src/heap/base/active-system-pages.h"
 #include "src/heap/concurrent-marking.h"
 #include "src/heap/heap.h"
-#include "src/heap/incremental-marking-inl.h"
 #include "src/heap/large-spaces.h"
 #include "src/heap/main-allocator-inl.h"
 #include "src/heap/mark-compact.h"
diff --git a/deps/v8/src/heap/sweeper.cc b/deps/v8/src/heap/sweeper.cc
index c89bf286ed4d9d..2692d6e0f0cb86 100644
--- a/deps/v8/src/heap/sweeper.cc
+++ b/deps/v8/src/heap/sweeper.cc
@@ -129,7 +129,16 @@ class Sweeper::MajorSweeperJob final : public JobTask {
   MajorSweeperJob& operator=(const MajorSweeperJob&) = delete;
 
   void Run(JobDelegate* delegate) final {
-    RunImpl(delegate, delegate->IsJoiningThread());
+    DCHECK_IMPLIES(
+        delegate->IsJoiningThread(),
+        sweeper_->heap_->IsMainThread() ||
+            (!sweeper_->heap_->isolate()->is_shared_space_isolate() &&
+             sweeper_->heap_->isolate()
+                 ->shared_space_isolate()
+                 ->heap()
+                 ->IsMainThread()));
+    RunImpl(delegate,
+            delegate->IsJoiningThread() && sweeper_->heap_->IsMainThread());
   }
 
   size_t GetMaxConcurrency(size_t worker_count) const override {
@@ -142,7 +151,7 @@ class Sweeper::MajorSweeperJob final : public JobTask {
   }
 
  private:
-  void RunImpl(JobDelegate* delegate, bool is_joining_thread) {
+  void RunImpl(JobDelegate* delegate, bool is_main_thread) {
     // Set the current isolate such that trusted pointer tables etc are
     // available and the cage base is set correctly for multi-cage mode.
     SetCurrentIsolateScope isolate_scope(sweeper_->heap_->isolate());
@@ -152,9 +161,9 @@ class Sweeper::MajorSweeperJob final : public JobTask {
     DCHECK_LT(offset, concurrent_sweepers.size());
     ConcurrentMajorSweeper& concurrent_sweeper = concurrent_sweepers[offset];
     TRACE_GC_EPOCH_WITH_FLOW(
-        tracer_, sweeper_->GetTracingScope(OLD_SPACE, is_joining_thread),
-        is_joining_thread ? ThreadKind::kMain : ThreadKind::kBackground,
-        trace_id_, TRACE_EVENT_FLAG_FLOW_IN);
+        tracer_, sweeper_->GetTracingScope(OLD_SPACE, is_main_thread),
+        is_main_thread ? ThreadKind::kMain : ThreadKind::kBackground, trace_id_,
+        TRACE_EVENT_FLAG_FLOW_IN);
     for (int i = 0; i < kNumberOfMajorSweepingSpaces; i++) {
       const AllocationSpace space_id = static_cast<AllocationSpace>(
           FIRST_SWEEPABLE_SPACE + 1 +
@@ -191,7 +200,16 @@ class Sweeper::MinorSweeperJob final : public JobTask {
   MinorSweeperJob& operator=(const MinorSweeperJob&) = delete;
 
   void Run(JobDelegate* delegate) final {
-    RunImpl(delegate, delegate->IsJoiningThread());
+    DCHECK_IMPLIES(
+        delegate->IsJoiningThread(),
+        sweeper_->heap_->IsMainThread() ||
+            (!sweeper_->heap_->isolate()->is_shared_space_isolate() &&
+             sweeper_->heap_->isolate()
+                 ->shared_space_isolate()
+                 ->heap()
+                 ->IsMainThread()));
+    RunImpl(delegate,
+            delegate->IsJoiningThread() && sweeper_->heap_->IsMainThread());
   }
 
   size_t GetMaxConcurrency(size_t worker_count) const override {
@@ -204,15 +222,15 @@ class Sweeper::MinorSweeperJob final : public JobTask {
   }
 
  private:
-  void RunImpl(JobDelegate* delegate, bool is_joining_thread) {
+  void RunImpl(JobDelegate* delegate, bool is_main_thread) {
     DCHECK(sweeper_->minor_sweeping_in_progress());
     const int offset = delegate->GetTaskId();
     DCHECK_LT(offset, concurrent_sweepers.size());
     ConcurrentMinorSweeper& concurrent_sweeper = concurrent_sweepers[offset];
     TRACE_GC_EPOCH_WITH_FLOW(
-        tracer_, sweeper_->GetTracingScope(NEW_SPACE, is_joining_thread),
-        is_joining_thread ? ThreadKind::kMain : ThreadKind::kBackground,
-        trace_id_, TRACE_EVENT_FLAG_FLOW_IN);
+        tracer_, sweeper_->GetTracingScope(NEW_SPACE, is_main_thread),
+        is_main_thread ? ThreadKind::kMain : ThreadKind::kBackground, trace_id_,
+        TRACE_EVENT_FLAG_FLOW_IN);
     // Set the current isolate such that trusted pointer tables etc are
     // available and the cage base is set correctly for multi-cage mode.
     SetCurrentIsolateScope isolate_scope(sweeper_->heap_->isolate());
@@ -378,8 +396,7 @@ void Sweeper::LocalSweeper::ParallelSweepPage(PageMetadata* page,
                                               SweepingMode sweeping_mode) {
   DCHECK(IsValidSweepingSpace(identity));
 
-  // The Scavenger may add already swept pages back.
-  if (page->SweepingDone()) return;
+  DCHECK(!page->SweepingDone());
 
   {
     base::MutexGuard guard(page->mutex());
@@ -598,6 +615,14 @@ void ZapDeadObjectsInRange(Heap* heap, Address dead_start, Address dead_end) {
 }
 
 void ZapDeadObjectsOnPage(Heap* heap, PageMetadata* p) {
+  if (!heap::ShouldZapGarbage() && !v8_flags.track_gc_object_stats) {
+    // We need to zap and create fillers on promoted pages when
+    // --track-gc-object-stats is enabled because it expects all dead objects to
+    // still be valid objects. Dead object on promoted pages may otherwise
+    // contain invalid old-to-new references to pages that are gone or were
+    // already reallocated.
+    return;
+  }
   Address dead_start = p->area_start();
   // Iterate over the page using the live objects.
   for (auto [object, size] : LiveObjectRange(p)) {
@@ -635,8 +660,6 @@ void Sweeper::LocalSweeper::ParallelIteratePromotedPage(
            LiveObjectRange(static_cast<PageMetadata*>(page))) {
         record_visitor.Process(object);
       }
-    }
-    if (heap::ShouldZapGarbage() && !is_large_page) {
       ZapDeadObjectsOnPage(sweeper_->heap_, static_cast<PageMetadata*>(page));
     }
     page->ClearLiveness();
@@ -746,7 +769,7 @@ void ClearPromotedPages(Heap* heap, std::vector<MutablePageMetadata*> pages) {
     DCHECK(!page->SweepingDone());
     DCHECK_EQ(PageMetadata::ConcurrentSweepingState::kPendingIteration,
               page->concurrent_sweeping_state());
-    if (heap::ShouldZapGarbage() && !page->Chunk()->IsLargePage()) {
+    if (!page->Chunk()->IsLargePage()) {
       ZapDeadObjectsOnPage(heap, static_cast<PageMetadata*>(page));
     }
     page->ClearLiveness();
@@ -804,11 +827,24 @@ Sweeper::SweptList Sweeper::GetAllSweptPagesSafe(PagedSpaceBase* space) {
 void Sweeper::FinishMajorJobs() {
   if (!major_sweeping_in_progress()) return;
 
-  ForAllSweepingSpaces([this](AllocationSpace space) {
-    if (space == NEW_SPACE) return;
-    main_thread_local_sweeper_.ParallelSweepSpace(
-        space, SweepingMode::kLazyOrConcurrent);
-  });
+  {
+    const bool is_main_thread = heap_->IsMainThread();
+    DCHECK_IMPLIES(
+        !is_main_thread,
+        heap_->isolate()->shared_space_isolate()->heap()->IsMainThread());
+    TRACE_GC_EPOCH_WITH_FLOW(
+        heap_->tracer(),
+        is_main_thread ? GCTracer::Scope::MC_SWEEP
+                       : GCTracer::Scope::MC_BACKGROUND_SWEEPING,
+        is_main_thread ? ThreadKind::kMain : ThreadKind::kBackground,
+        major_sweeping_state_.trace_id(),
+        TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT);
+    ForAllSweepingSpaces([this](AllocationSpace space) {
+      if (space == NEW_SPACE) return;
+      main_thread_local_sweeper_.ParallelSweepSpace(
+          space, SweepingMode::kLazyOrConcurrent);
+    });
+  }
 
   // Join all concurrent tasks.
   major_sweeping_state_.JoinSweeping();
@@ -861,11 +897,24 @@ void Sweeper::EnsureMajorCompleted() {
 void Sweeper::FinishMinorJobs() {
   if (!minor_sweeping_in_progress()) return;
 
-  main_thread_local_sweeper_.ParallelSweepSpace(
-      kNewSpace, SweepingMode::kLazyOrConcurrent);
-  // Array buffer sweeper may have grabbed a page for iteration to contribute.
-  // Wait until it has finished iterating.
-  main_thread_local_sweeper_.ContributeAndWaitForPromotedPagesIteration();
+  {
+    const bool is_main_thread = heap_->IsMainThread();
+    DCHECK_IMPLIES(
+        !is_main_thread,
+        heap_->isolate()->shared_space_isolate()->heap()->IsMainThread());
+    TRACE_GC_EPOCH_WITH_FLOW(
+        heap_->tracer(),
+        is_main_thread ? GCTracer::Scope::MINOR_MS_SWEEP
+                       : GCTracer::Scope::MINOR_MS_BACKGROUND_SWEEPING,
+        is_main_thread ? ThreadKind::kMain : ThreadKind::kBackground,
+        minor_sweeping_state_.trace_id(),
+        TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT);
+    main_thread_local_sweeper_.ParallelSweepSpace(
+        kNewSpace, SweepingMode::kLazyOrConcurrent);
+    // Array buffer sweeper may have grabbed a page for iteration to contribute.
+    // Wait until it has finished iterating.
+    main_thread_local_sweeper_.ContributeAndWaitForPromotedPagesIteration();
+  }
 
   // Join all concurrent tasks.
   minor_sweeping_state_.JoinSweeping();
diff --git a/deps/v8/src/heap/sweeper.h b/deps/v8/src/heap/sweeper.h
index 2173199baa1e72..0945c9dc0b798a 100644
--- a/deps/v8/src/heap/sweeper.h
+++ b/deps/v8/src/heap/sweeper.h
@@ -215,6 +215,7 @@ class Sweeper {
     callback(CODE_SPACE);
     callback(SHARED_SPACE);
     callback(TRUSTED_SPACE);
+    callback(SHARED_TRUSTED_SPACE);
   }
 
   // Helper function for RawSweep. Depending on the FreeListRebuildingMode and
diff --git a/deps/v8/src/heap/weak-object-worklists.cc b/deps/v8/src/heap/weak-object-worklists.cc
index 7c49cb8d13c9c1..89bdbd07728454 100644
--- a/deps/v8/src/heap/weak-object-worklists.cc
+++ b/deps/v8/src/heap/weak-object-worklists.cc
@@ -33,212 +33,11 @@ void WeakObjects::Local::Publish() {
 #undef INVOKE_PUBLISH
 }
 
-void WeakObjects::UpdateAfterScavenge() {
-#define INVOKE_UPDATE(_, name, Name) Update##Name(name);
-  WEAK_OBJECT_WORKLISTS(INVOKE_UPDATE)
-#undef INVOKE_UPDATE
-}
-
 void WeakObjects::Clear() {
 #define INVOKE_CLEAR(_, name, __) name.Clear();
   WEAK_OBJECT_WORKLISTS(INVOKE_CLEAR)
 #undef INVOKE_CLEAR
 }
 
-// static
-void WeakObjects::UpdateTransitionArrays(
-    WeakObjectWorklist<Tagged<TransitionArray>>& transition_arrays) {
-  DCHECK(!ContainsYoungObjects(transition_arrays));
-}
-
-// static
-void WeakObjects::UpdateEphemeronHashTables(
-    WeakObjectWorklist<Tagged<EphemeronHashTable>>& ephemeron_hash_tables) {
-  ephemeron_hash_tables.Update(
-      [](Tagged<EphemeronHashTable> slot_in,
-         Tagged<EphemeronHashTable>* slot_out) -> bool {
-        Tagged<EphemeronHashTable> forwarded = ForwardingAddress(slot_in);
-
-        if (!forwarded.is_null()) {
-          *slot_out = forwarded;
-          return true;
-        }
-
-        return false;
-      });
-}
-
-namespace {
-bool EphemeronUpdater(Ephemeron slot_in, Ephemeron* slot_out) {
-  Tagged<HeapObject> key = slot_in.key;
-  Tagged<HeapObject> value = slot_in.value;
-  Tagged<HeapObject> forwarded_key = ForwardingAddress(key);
-  Tagged<HeapObject> forwarded_value = ForwardingAddress(value);
-
-  if (!forwarded_key.is_null() && !forwarded_value.is_null()) {
-    *slot_out = Ephemeron{forwarded_key, forwarded_value};
-    return true;
-  }
-
-  return false;
-}
-}  // anonymous namespace
-
-// static
-void WeakObjects::UpdateCurrentEphemerons(
-    WeakObjectWorklist<Ephemeron>& current_ephemerons) {
-  current_ephemerons.Update(EphemeronUpdater);
-}
-
-// static
-void WeakObjects::UpdateNextEphemerons(
-    WeakObjectWorklist<Ephemeron>& next_ephemerons) {
-  next_ephemerons.Update(EphemeronUpdater);
-}
-
-namespace {
-template <typename TSlot>
-void UpdateWeakReferencesHelper(
-    WeakObjects::WeakObjectWorklist<TSlot>& weak_references) {
-  weak_references.Update([](TSlot slot_in, TSlot* slot_out) -> bool {
-    Tagged<HeapObject> heap_obj = slot_in.heap_object;
-    Tagged<HeapObject> forwarded = ForwardingAddress(heap_obj);
-
-    if (!forwarded.is_null()) {
-      ptrdiff_t distance_to_slot =
-          slot_in.slot.address() - slot_in.heap_object.ptr();
-      Address new_slot = forwarded.ptr() + distance_to_slot;
-      slot_out->heap_object = forwarded;
-      slot_out->slot = typename TSlot::SlotType(new_slot);
-      return true;
-    }
-
-    return false;
-  });
-}
-}  // anonymous namespace
-
-// static
-void WeakObjects::UpdateWeakReferencesTrivial(
-    WeakObjectWorklist<HeapObjectAndSlot>& weak_references) {
-  UpdateWeakReferencesHelper(weak_references);
-}
-
-// static
-void WeakObjects::UpdateWeakReferencesTrusted(
-    WeakObjectWorklist<TrustedObjectAndSlot>& weak_references) {
-  UpdateWeakReferencesHelper(weak_references);
-}
-
-// static
-void WeakObjects::UpdateWeakReferencesNonTrivial(
-    WeakObjectWorklist<HeapObjectAndSlot>& weak_references) {
-  UpdateWeakReferencesHelper(weak_references);
-}
-
-// static
-void WeakObjects::UpdateWeakReferencesNonTrivialUnmarked(
-    WeakObjectWorklist<HeapObjectAndSlot>& weak_references) {
-  UpdateWeakReferencesHelper(weak_references);
-}
-
-// static
-void WeakObjects::UpdateWeakObjectsInCode(
-    WeakObjectWorklist<HeapObjectAndCode>& weak_objects_in_code) {
-  weak_objects_in_code.Update(
-      [](HeapObjectAndCode slot_in, HeapObjectAndCode* slot_out) -> bool {
-        Tagged<HeapObject> heap_obj = slot_in.heap_object;
-        Tagged<HeapObject> forwarded = ForwardingAddress(heap_obj);
-
-        if (!forwarded.is_null()) {
-          slot_out->heap_object = forwarded;
-          slot_out->code = slot_in.code;
-          return true;
-        }
-
-        return false;
-      });
-}
-
-// static
-void WeakObjects::UpdateJSWeakRefs(
-    WeakObjectWorklist<Tagged<JSWeakRef>>& js_weak_refs) {
-  js_weak_refs.Update([](Tagged<JSWeakRef> js_weak_ref_in,
-                         Tagged<JSWeakRef>* js_weak_ref_out) -> bool {
-    Tagged<JSWeakRef> forwarded = ForwardingAddress(js_weak_ref_in);
-
-    if (!forwarded.is_null()) {
-      *js_weak_ref_out = forwarded;
-      return true;
-    }
-
-    return false;
-  });
-}
-
-// static
-void WeakObjects::UpdateWeakCells(
-    WeakObjectWorklist<Tagged<WeakCell>>& weak_cells) {
-  // TODO(syg, marja): Support WeakCells in the young generation.
-  DCHECK(!ContainsYoungObjects(weak_cells));
-}
-
-// static
-void WeakObjects::UpdateCodeFlushingCandidates(
-    WeakObjectWorklist<Tagged<SharedFunctionInfo>>& code_flushing_candidates) {
-  DCHECK(!ContainsYoungObjects(code_flushing_candidates));
-}
-
-// static
-void WeakObjects::UpdateFlushedJSFunctions(
-    WeakObjectWorklist<Tagged<JSFunction>>& flushed_js_functions) {
-  flushed_js_functions.Update(
-      [](Tagged<JSFunction> slot_in, Tagged<JSFunction>* slot_out) -> bool {
-        Tagged<JSFunction> forwarded = ForwardingAddress(slot_in);
-
-        if (!forwarded.is_null()) {
-          *slot_out = forwarded;
-          return true;
-        }
-
-        return false;
-      });
-}
-
-#ifndef V8_ENABLE_LEAPTIERING
-
-// static
-void WeakObjects::UpdateBaselineFlushingCandidates(
-    WeakObjectWorklist<Tagged<JSFunction>>& baseline_flush_candidates) {
-  baseline_flush_candidates.Update(
-      [](Tagged<JSFunction> slot_in, Tagged<JSFunction>* slot_out) -> bool {
-        Tagged<JSFunction> forwarded = ForwardingAddress(slot_in);
-
-        if (!forwarded.is_null()) {
-          *slot_out = forwarded;
-          return true;
-        }
-
-        return false;
-      });
-}
-
-#endif  // !V8_ENABLE_LEAPTIERING
-
-#ifdef DEBUG
-// static
-template <typename Type>
-bool WeakObjects::ContainsYoungObjects(
-    WeakObjectWorklist<Tagged<Type>>& worklist) {
-  bool result = false;
-  worklist.Iterate([&result](Tagged<Type> candidate) {
-    if (HeapLayout::InYoungGeneration(candidate)) {
-      result = true;
-    }
-  });
-  return result;
-}
-#endif
-
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/heap/weak-object-worklists.h b/deps/v8/src/heap/weak-object-worklists.h
index 242658f83908a5..f67ab4f125d055 100644
--- a/deps/v8/src/heap/weak-object-worklists.h
+++ b/deps/v8/src/heap/weak-object-worklists.h
@@ -50,9 +50,6 @@ class TransitionArray;
 // 1) Type of the worklist entry.
 // 2) Lower-case name of the worklsit.
 // 3) Capitalized name of the worklist.
-//
-// If you add a new entry, then you also need to implement the corresponding
-// Update*() function in the cc file for updating pointers after Scavenge.
 #define WEAK_OBJECT_WORKLISTS_GENERIC(F)                                      \
   F(Tagged<TransitionArray>, transition_arrays, TransitionArrays)             \
   /* Keep track of all EphemeronHashTables in the heap to process             \
@@ -116,19 +113,7 @@ class WeakObjects final {
   WEAK_OBJECT_WORKLISTS(DECLARE_WORKLIST)
 #undef DECLARE_WORKLIST
 
-  void UpdateAfterScavenge();
   void Clear();
-
- private:
-#define DECLARE_UPDATE_METHODS(Type, _, Name) \
-  static void Update##Name(WeakObjectWorklist<Type>&);
-  WEAK_OBJECT_WORKLISTS(DECLARE_UPDATE_METHODS)
-#undef DECLARE_UPDATE_METHODS
-
-#ifdef DEBUG
-  template <typename Type>
-  static bool ContainsYoungObjects(WeakObjectWorklist<Tagged<Type>>& worklist);
-#endif
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/ic/accessor-assembler.cc b/deps/v8/src/ic/accessor-assembler.cc
index 7f0031fb995892..cf6fadfe246b2d 100644
--- a/deps/v8/src/ic/accessor-assembler.cc
+++ b/deps/v8/src/ic/accessor-assembler.cc
@@ -18,6 +18,7 @@
 #include "src/ic/stub-cache.h"
 #include "src/logging/counters.h"
 #include "src/objects/cell.h"
+#include "src/objects/data-handler-inl.h"
 #include "src/objects/dictionary.h"
 #include "src/objects/feedback-vector.h"
 #include "src/objects/foreign.h"
@@ -50,28 +51,15 @@ TNode<MaybeObject> AccessorAssembler::LoadHandlerDataField(
   CSA_DCHECK(this,
              Word32Or(InstanceTypeEqual(instance_type, LOAD_HANDLER_TYPE),
                       InstanceTypeEqual(instance_type, STORE_HANDLER_TYPE)));
-  int offset = 0;
-  int minimum_size = 0;
-  switch (data_index) {
-    case 1:
-      offset = DataHandler::kData1Offset;
-      minimum_size = DataHandler::kSizeWithData1;
-      break;
-    case 2:
-      offset = DataHandler::kData2Offset;
-      minimum_size = DataHandler::kSizeWithData2;
-      break;
-    case 3:
-      offset = DataHandler::kData3Offset;
-      minimum_size = DataHandler::kSizeWithData3;
-      break;
-    default:
-      UNREACHABLE();
-  }
-  USE(minimum_size);
+  // data_index is 1-indexed, so subtract one to make it 0-indexed.
+  data_index -= 1;
+  CHECK_GE(data_index, 0);
+  CHECK_LT(data_index, 3);
+  int offset = DataHandler::OffsetOf(data_index);
   CSA_DCHECK(this, UintPtrGreaterThanOrEqual(
                        LoadMapInstanceSizeInWords(handler_map),
-                       IntPtrConstant(minimum_size / kTaggedSize)));
+                       IntPtrConstant(DataHandler::SizeFor(data_index + 1) /
+                                      kTaggedSize)));
   return LoadMaybeWeakObjectField(handler, offset);
 }
 
@@ -1116,7 +1104,7 @@ TNode<Object> AccessorAssembler::HandleProtoHandler(
   //
   {
     TNode<Object> maybe_validity_cell =
-        LoadObjectField(handler, ICHandler::kValidityCellOffset);
+        LoadObjectField(handler, offsetof(ICHandler, validity_cell_));
     CheckPrototypeValidityCell(maybe_validity_cell, miss);
   }
 
@@ -1125,7 +1113,7 @@ TNode<Object> AccessorAssembler::HandleProtoHandler(
   //
   {
     TNode<Object> smi_or_code_handler =
-        LoadObjectField(handler, ICHandler::kSmiHandlerOffset);
+        LoadObjectField(handler, offsetof(ICHandler, smi_handler_));
     if (on_code_handler) {
       Label if_smi_handler(this);
       GotoIf(TaggedIsSmi(smi_or_code_handler), &if_smi_handler);
@@ -1285,10 +1273,10 @@ void AccessorAssembler::EmitAccessCheck(TNode<Context> expected_native_context,
   GotoIfNot(IsJSGlobalProxy(CAST(receiver)), miss);
   // For JSGlobalProxy receiver try to compare security tokens of current
   // and expected native contexts.
-  TNode<Object> expected_token = LoadContextElement(
+  TNode<Object> expected_token = LoadContextElementNoCell(
       expected_native_context, Context::SECURITY_TOKEN_INDEX);
   TNode<Object> current_token =
-      LoadContextElement(native_context, Context::SECURITY_TOKEN_INDEX);
+      LoadContextElementNoCell(native_context, Context::SECURITY_TOKEN_INDEX);
   Branch(TaggedEqual(expected_token, current_token), can_access, miss);
 }
 
@@ -3505,7 +3493,7 @@ void AccessorAssembler::LoadGlobalIC_TryPropertyCellCase(
         Signed(DecodeWord<FeedbackNexus::SlotIndexBits>(lexical_handler));
     TNode<Context> context = lazy_context();
     TNode<Context> script_context = LoadScriptContext(context, context_index);
-    TNode<Object> result = LoadScriptContextElement(script_context, slot_index);
+    TNode<Object> result = LoadContextElement(script_context, slot_index);
     exit_point->Return(result);
   }
 }
@@ -3529,10 +3517,10 @@ void AccessorAssembler::LoadGlobalIC_TryHandlerCase(
 
   TNode<Context> context = lazy_context();
   TNode<NativeContext> native_context = LoadNativeContext(context);
-  TNode<JSGlobalProxy> receiver =
-      CAST(LoadContextElement(native_context, Context::GLOBAL_PROXY_INDEX));
+  TNode<JSGlobalProxy> receiver = CAST(
+      LoadContextElementNoCell(native_context, Context::GLOBAL_PROXY_INDEX));
   TNode<JSAny> global =
-      CAST(LoadContextElement(native_context, Context::EXTENSION_INDEX));
+      CAST(LoadContextElementNoCell(native_context, Context::EXTENSION_INDEX));
 
   LazyLoadICParameters p([=] { return context; }, receiver, lazy_name,
                          [=] { return slot; }, vector, global);
@@ -3544,8 +3532,9 @@ void AccessorAssembler::LoadGlobalIC_TryHandlerCase(
 void AccessorAssembler::ScriptContextTableLookup(
     TNode<Name> name, TNode<NativeContext> native_context, Label* found_hole,
     Label* not_found) {
-  TNode<ScriptContextTable> script_context_table = CAST(
-      LoadContextElement(native_context, Context::SCRIPT_CONTEXT_TABLE_INDEX));
+  TNode<ScriptContextTable> script_context_table =
+      CAST(LoadContextElementNoCell(native_context,
+                                    Context::SCRIPT_CONTEXT_TABLE_INDEX));
   TVARIABLE(IntPtrT, context_index, IntPtrConstant(-1));
   Label loop(this, &context_index);
   TNode<IntPtrT> num_script_contexts = PositiveSmiUntag(CAST(LoadObjectField(
@@ -3560,16 +3549,15 @@ void AccessorAssembler::ScriptContextTableLookup(
 
     TNode<Context> script_context =
         LoadArrayElement(script_context_table, context_index.value());
-    TNode<ScopeInfo> scope_info =
-        CAST(LoadContextElement(script_context, Context::SCOPE_INFO_INDEX));
+    TNode<ScopeInfo> scope_info = CAST(
+        LoadContextElementNoCell(script_context, Context::SCOPE_INFO_INDEX));
 
     TNode<IntPtrT> context_local_index =
         IndexOfLocalName(scope_info, name, &loop);
 
-    TNode<IntPtrT> var_index =
-        IntPtrAdd(IntPtrConstant(Context::MIN_CONTEXT_EXTENDED_SLOTS),
-                  context_local_index);
-    TNode<Object> result = LoadScriptContextElement(script_context, var_index);
+    TNode<IntPtrT> var_index = IntPtrAdd(
+        IntPtrConstant(Context::MIN_CONTEXT_SLOTS), context_local_index);
+    TNode<Object> result = LoadContextElement(script_context, var_index);
     GotoIf(IsTheHole(result), found_hole);
     Return(result);
   }
@@ -3590,7 +3578,7 @@ void AccessorAssembler::LoadGlobalIC_NoFeedback(TNode<Context> context,
 
   BIND(&regular_load);
   TNode<JSGlobalObject> global_object =
-      CAST(LoadContextElement(native_context, Context::EXTENSION_INDEX));
+      CAST(LoadContextElementNoCell(native_context, Context::EXTENSION_INDEX));
   TailCallBuiltin(Builtin::kLoadIC_NoFeedback, context, global_object, name,
                   smi_typeof_mode);
 }
@@ -3952,11 +3940,11 @@ void AccessorAssembler::StoreGlobalIC(const StoreICParameters* pp) {
       DCHECK(pp->receiver_is_null());
       DCHECK(pp->flags_is_null());
       TNode<NativeContext> native_context = LoadNativeContext(pp->context());
-      StoreICParameters p(
-          pp->context(),
-          CAST(LoadContextElement(native_context, Context::GLOBAL_PROXY_INDEX)),
-          pp->name(), pp->value(), std::nullopt, pp->slot(), pp->vector(),
-          StoreICMode::kDefault);
+      StoreICParameters p(pp->context(),
+                          CAST(LoadContextElementNoCell(
+                              native_context, Context::GLOBAL_PROXY_INDEX)),
+                          pp->name(), pp->value(), std::nullopt, pp->slot(),
+                          pp->vector(), StoreICMode::kDefault);
 
       HandleStoreICHandlerCase(&p, handler, &miss, ICMode::kGlobalIC);
     }
@@ -3981,8 +3969,7 @@ void AccessorAssembler::StoreGlobalIC(const StoreICParameters* pp) {
         Signed(DecodeWord<FeedbackNexus::SlotIndexBits>(lexical_handler));
     TNode<Context> script_context =
         LoadScriptContext(pp->context(), context_index);
-    StoreContextElementAndUpdateSideData(script_context, slot_index,
-                                         pp->value());
+    StoreContextElement(script_context, slot_index, pp->value());
     Return(pp->value());
   }
 
@@ -4275,8 +4262,8 @@ void AccessorAssembler::StoreInArrayLiteralIC(const StoreICParameters* p) {
         TNode<Map> transition_map =
             CAST(GetHeapObjectAssumeWeak(maybe_transition_map, &miss));
         GotoIf(IsDeprecatedMap(transition_map), &miss);
-        TNode<Code> code =
-            CAST(LoadObjectField(handler, StoreHandler::kSmiHandlerOffset));
+        TNode<Code> code = CAST(
+            LoadObjectField(handler, offsetof(StoreHandler, smi_handler_)));
         TailCallStub(StoreTransitionDescriptor{}, code, p->context(),
                      p->receiver(), p->name(), transition_map, p->value(),
                      p->slot(), p->vector());
@@ -4557,7 +4544,7 @@ void AccessorAssembler::LookupContext(LazyNode<Object> lazy_name,
                                       LazyNode<TaggedIndex> lazy_slot,
                                       TNode<Context> context,
                                       TypeofMode typeof_mode,
-                                      ContextKind context_kind) {
+                                      ContextMode context_mode) {
   Label slowpath(this, Label::kDeferred);
 
   // Check for context extensions to allow the fast path.
@@ -4568,10 +4555,10 @@ void AccessorAssembler::LookupContext(LazyNode<Object> lazy_name,
   // Fast path does a normal load context.
   {
     auto slot = lazy_slot();
-    Return(
-        context_kind == ContextKind::kScriptContext
-            ? LoadScriptContextElement(slot_context, TaggedIndexToIntPtr(slot))
-            : LoadContextElement(slot_context, TaggedIndexToIntPtr(slot)));
+    Return(context_mode == ContextMode::kHasContextCells
+               ? LoadContextElement(slot_context, TaggedIndexToIntPtr(slot))
+               : LoadContextElementNoCell(slot_context,
+                                          TaggedIndexToIntPtr(slot)));
   }
 
   // Slow path when we have to call out to the runtime.
@@ -4586,22 +4573,22 @@ void AccessorAssembler::LookupContext(LazyNode<Object> lazy_name,
 }
 
 void AccessorAssembler::GenerateLookupContextTrampoline(
-    TypeofMode typeof_mode, ContextKind context_kind) {
+    TypeofMode typeof_mode, ContextMode context_mode) {
   using Descriptor = LookupTrampolineDescriptor;
   LookupContext([&] { return Parameter<Object>(Descriptor::kName); },
                 Parameter<TaggedIndex>(Descriptor::kDepth),
                 [&] { return Parameter<TaggedIndex>(Descriptor::kSlot); },
                 Parameter<Context>(Descriptor::kContext), typeof_mode,
-                context_kind);
+                context_mode);
 }
 
 void AccessorAssembler::GenerateLookupContextBaseline(
-    TypeofMode typeof_mode, ContextKind context_kind) {
+    TypeofMode typeof_mode, ContextMode context_mode) {
   using Descriptor = LookupBaselineDescriptor;
   LookupContext([&] { return Parameter<Object>(Descriptor::kName); },
                 Parameter<TaggedIndex>(Descriptor::kDepth),
                 [&] { return Parameter<TaggedIndex>(Descriptor::kSlot); },
-                LoadContextFromBaseline(), typeof_mode, context_kind);
+                LoadContextFromBaseline(), typeof_mode, context_mode);
 }
 
 void AccessorAssembler::LookupGlobalIC(
diff --git a/deps/v8/src/ic/accessor-assembler.h b/deps/v8/src/ic/accessor-assembler.h
index 457886548fe8c1..9c4127c91f66ca 100644
--- a/deps/v8/src/ic/accessor-assembler.h
+++ b/deps/v8/src/ic/accessor-assembler.h
@@ -69,9 +69,9 @@ class V8_EXPORT_PRIVATE AccessorAssembler : public CodeStubAssembler {
   void GenerateLookupGlobalICTrampoline(TypeofMode typeof_mode);
   void GenerateLookupGlobalICBaseline(TypeofMode typeof_mode);
   void GenerateLookupContextTrampoline(TypeofMode typeof_mode,
-                                       ContextKind context_kind);
+                                       ContextMode context_mode);
   void GenerateLookupContextBaseline(TypeofMode typeof_mode,
-                                     ContextKind context_kind);
+                                     ContextMode context_mode);
 
   void GenerateKeyedStoreIC();
   void GenerateKeyedStoreICTrampoline();
@@ -382,7 +382,7 @@ class V8_EXPORT_PRIVATE AccessorAssembler : public CodeStubAssembler {
                       TypeofMode typeof_mode);
   void LookupContext(LazyNode<Object> lazy_name, TNode<TaggedIndex> depth,
                      LazyNode<TaggedIndex> lazy_slot, TNode<Context> context,
-                     TypeofMode typeof_mode, ContextKind context_kind);
+                     TypeofMode typeof_mode, ContextMode context_mode);
 
   void GotoIfNotSameNumberBitPattern(TNode<Float64T> left,
                                      TNode<Float64T> right, Label* miss);
diff --git a/deps/v8/src/ic/binary-op-assembler.cc b/deps/v8/src/ic/binary-op-assembler.cc
index e9b6b9446ebbe9..44f0eb6a37f40a 100644
--- a/deps/v8/src/ic/binary-op-assembler.cc
+++ b/deps/v8/src/ic/binary-op-assembler.cc
@@ -353,6 +353,108 @@ TNode<Object> BinaryOpAssembler::Generate_AddWithFeedback(
   return var_result.value();
 }
 
+TNode<Object>
+BinaryOpAssembler::Generate_AddLhsIsStringConstantInternalizeWithFeedback(
+    const LazyNode<Context>& context, TNode<Object> lhs, TNode<Object> rhs,
+    TNode<UintPtrT> slot_id, const LazyNode<HeapObject>& maybe_feedback_vector,
+    UpdateFeedbackMode update_feedback_mode, bool rhs_known_smi) {
+  Label call_with_any_feedback(this), call_add_stub(this),
+      slow(this, Label::kDeferred), end(this);
+  TVARIABLE(Smi, var_type_feedback, SmiConstant(BinaryOperationFeedback::kAny));
+  TVARIABLE(Object, var_result);
+
+  // Lhs is an internalized string constant. Since our cache is stored in the
+  // feedback vector and is thus specific to a particular bytecode, we can
+  // ignore the lhs and use rhs as the cache key instead. This is our
+  // optimization:
+  //
+  //   Instead of: return Internalize(lhs + rhs)
+  //   .. we do:   return cache[rhs]  // .. if possible.
+  CSA_DCHECK(this, Word32BinaryNot(TaggedIsSmi(lhs)));
+  CSA_DCHECK(this,
+             IsInternalizedStringInstanceType(LoadInstanceType(CAST(lhs))));
+
+  // We need the cache slot for our optimization.
+  {
+    Label next(this);
+    GotoIfNot(IsUndefined(maybe_feedback_vector()), &next);
+    // TODO(jgruber): This could be a builtin call. Add a builtin that expects
+    // a possibly-undefined feedback vector.
+    var_result = Generate_AddWithFeedback(context, lhs, rhs, slot_id,
+                                          maybe_feedback_vector,
+                                          update_feedback_mode, rhs_known_smi);
+    Goto(&end);
+    BIND(&next);
+  }
+  TNode<FeedbackVector> fv = CAST(maybe_feedback_vector());
+
+  // Ensure rhs is internalized so we can query the cache.
+  // TODO(jgruber): We could TryInternalize in CSA.
+  {
+    Label set_feedback_to_any_then_slow(this), next(this);
+    GotoIf(TaggedIsSmi(rhs), &set_feedback_to_any_then_slow);
+    TNode<Uint16T> itype = LoadInstanceType(CAST(rhs));
+    GotoIfNot(IsStringInstanceType(itype), &set_feedback_to_any_then_slow);
+
+    var_type_feedback = SmiConstant(BinaryOperationFeedback::kString);
+    UpdateFeedback(var_type_feedback.value(), maybe_feedback_vector(), slot_id,
+                   update_feedback_mode);
+    GotoIfNot(IsInternalizedStringInstanceType(itype), &slow);
+    Goto(&next);
+
+    BIND(&set_feedback_to_any_then_slow);
+    var_type_feedback = SmiConstant(BinaryOperationFeedback::kAny);
+    UpdateFeedback(var_type_feedback.value(), maybe_feedback_vector(), slot_id,
+                   update_feedback_mode);
+    Goto(&slow);
+
+    BIND(&next);
+  }
+  TNode<String> rhs_internalized = CAST(rhs);
+
+  // Get or create the cache object.
+  TNode<SimpleNameDictionary> cache;
+  {
+    Label next(this);
+    static constexpr int kSlotOffset =
+        kAdd_LhsIsStringConstant_Internalize_CacheSlotOffset;
+    TVARIABLE(Object, var_maybe_cache);
+    var_maybe_cache = CAST(LoadFeedbackVectorSlot(
+        fv, UintPtrAdd(slot_id, UintPtrConstant(kSlotOffset))));
+    GotoIf(
+        TaggedNotEqual(var_maybe_cache.value(), UninitializedSymbolConstant()),
+        &next);
+    // TODO(jgruber): Allocate in CSA.
+    Goto(&slow);
+    BIND(&next);
+    cache = CAST(var_maybe_cache.value());
+  }
+
+  {
+    // TODO(jgruber): Fill the cache in CSA.
+    TVARIABLE(IntPtrT, var_entry);
+    Label index_found(this, {&var_entry});
+    NameDictionaryLookup<SimpleNameDictionary>(cache, rhs_internalized,
+                                               &index_found, &var_entry, &slow,
+                                               LookupMode::kFindExisting);
+    BIND(&index_found);
+    var_result =
+        LoadValueByKeyIndex<SimpleNameDictionary>(cache, var_entry.value());
+    Goto(&end);
+  }
+
+  BIND(&slow);
+  {
+    var_result = CallRuntime(
+        Runtime::kStringAdd_LhsIsStringConstant_Internalize, context(), lhs,
+        rhs, maybe_feedback_vector(), IntPtrToTaggedIndex(Signed(slot_id)));
+    Goto(&end);
+  }
+
+  BIND(&end);
+  return var_result.value();
+}
+
 TNode<Object> BinaryOpAssembler::Generate_BinaryOperationWithFeedback(
     const LazyNode<Context>& context, TNode<Object> lhs, TNode<Object> rhs,
     TNode<UintPtrT> slot_id, const LazyNode<HeapObject>& maybe_feedback_vector,
diff --git a/deps/v8/src/ic/binary-op-assembler.h b/deps/v8/src/ic/binary-op-assembler.h
index 014673634c21ef..2b73ba81431f8a 100644
--- a/deps/v8/src/ic/binary-op-assembler.h
+++ b/deps/v8/src/ic/binary-op-assembler.h
@@ -26,6 +26,11 @@ class BinaryOpAssembler : public CodeStubAssembler {
       TNode<UintPtrT> slot, const LazyNode<HeapObject>& maybe_feedback_vector,
       UpdateFeedbackMode update_feedback_mode, bool rhs_known_smi);
 
+  TNode<Object> Generate_AddLhsIsStringConstantInternalizeWithFeedback(
+      const LazyNode<Context>& context, TNode<Object> left, TNode<Object> right,
+      TNode<UintPtrT> slot, const LazyNode<HeapObject>& maybe_feedback_vector,
+      UpdateFeedbackMode update_feedback_mode, bool rhs_known_smi);
+
   TNode<Object> Generate_SubtractWithFeedback(
       const LazyNode<Context>& context, TNode<Object> left, TNode<Object> right,
       TNode<UintPtrT> slot, const LazyNode<HeapObject>& maybe_feedback_vector,
diff --git a/deps/v8/src/ic/handler-configuration-inl.h b/deps/v8/src/ic/handler-configuration-inl.h
index 2be274385eacf9..5a3a277623f64d 100644
--- a/deps/v8/src/ic/handler-configuration-inl.h
+++ b/deps/v8/src/ic/handler-configuration-inl.h
@@ -22,8 +22,6 @@
 namespace v8 {
 namespace internal {
 
-OBJECT_CONSTRUCTORS_IMPL(LoadHandler, DataHandler)
-
 // Decodes kind from Smi-handler.
 LoadHandler::Kind LoadHandler::GetHandlerKind(Tagged<Smi> smi_handler) {
   return KindBits::decode(smi_handler.value());
@@ -132,8 +130,6 @@ DirectHandle<Smi> LoadHandler::LoadWasmArrayElement(Isolate* isolate,
   return direct_handle(Smi::FromInt(config), isolate);
 }
 
-OBJECT_CONSTRUCTORS_IMPL(StoreHandler, DataHandler)
-
 DirectHandle<Smi> StoreHandler::StoreGlobalProxy(Isolate* isolate) {
   int config = KindBits::encode(Kind::kGlobalProxy);
   return direct_handle(Smi::FromInt(config), isolate);
diff --git a/deps/v8/src/ic/handler-configuration.h b/deps/v8/src/ic/handler-configuration.h
index 407742888f7f64..f4ab40d39508c6 100644
--- a/deps/v8/src/ic/handler-configuration.h
+++ b/deps/v8/src/ic/handler-configuration.h
@@ -41,7 +41,7 @@ enum class WasmValueType {
 // A set of bit fields representing Smi handlers for loads and a HeapObject
 // that represents load handlers that can't be encoded in a Smi.
 // TODO(ishell): move to load-handler.h
-class LoadHandler final : public DataHandler {
+V8_OBJECT class LoadHandler final : public DataHandler {
  public:
   DECL_PRINTER(LoadHandler)
   DECL_VERIFIER(LoadHandler)
@@ -232,14 +232,12 @@ class LoadHandler final : public DataHandler {
 #if defined(OBJECT_PRINT)
   static void PrintHandler(Tagged<Object> handler, std::ostream& os);
 #endif  // defined(OBJECT_PRINT)
-
-  OBJECT_CONSTRUCTORS(LoadHandler, DataHandler);
-};
+} V8_OBJECT_END;
 
 // A set of bit fields representing Smi handlers for stores and a HeapObject
 // that represents store handlers that can't be encoded in a Smi.
 // TODO(ishell): move to store-handler.h
-class StoreHandler final : public DataHandler {
+V8_OBJECT class StoreHandler final : public DataHandler {
  public:
   DECL_PRINTER(StoreHandler)
   DECL_VERIFIER(StoreHandler)
@@ -381,9 +379,7 @@ class StoreHandler final : public DataHandler {
   static inline Handle<Smi> StoreField(Isolate* isolate, Kind kind,
                                        int descriptor, FieldIndex field_index,
                                        Representation representation);
-
-  OBJECT_CONSTRUCTORS(StoreHandler, DataHandler);
-};
+} V8_OBJECT_END;
 
 inline const char* WasmValueType2String(WasmValueType type);
 
diff --git a/deps/v8/src/ic/ic-stats.cc b/deps/v8/src/ic/ic-stats.cc
index e947362c87ab8a..77fc17b2466ca6 100644
--- a/deps/v8/src/ic/ic-stats.cc
+++ b/deps/v8/src/ic/ic-stats.cc
@@ -35,7 +35,7 @@ void ICStats::End() {
 }
 
 void ICStats::Reset() {
-  for (auto ic_info : ic_infos_) {
+  for (auto& ic_info : ic_infos_) {
     ic_info.Reset();
   }
   pos_ = 0;
diff --git a/deps/v8/src/ic/ic.cc b/deps/v8/src/ic/ic.cc
index 9c8edbc4dd543d..5c916aa6137a6b 100644
--- a/deps/v8/src/ic/ic.cc
+++ b/deps/v8/src/ic/ic.cc
@@ -198,19 +198,20 @@ static void LookupForRead(LookupIterator* it, bool is_has_property) {
       case LookupIterator::TRANSITION:
         UNREACHABLE();
       case LookupIterator::JSPROXY:
-      case LookupIterator::WASM_OBJECT:
         return;
+      case LookupIterator::WASM_OBJECT:
+        continue;  // Continue to the prototype, if present.
       case LookupIterator::INTERCEPTOR: {
         // If there is a getter, return; otherwise loop to perform the lookup.
         DirectHandle<JSObject> holder = it->GetHolder<JSObject>();
-        if (!IsUndefined(holder->GetNamedInterceptor()->getter(),
-                         it->isolate())) {
-          return;
-        }
-        if (is_has_property &&
-            !IsUndefined(holder->GetNamedInterceptor()->query(),
-                         it->isolate())) {
-          return;
+        {
+          Tagged<InterceptorInfo> interceptor = holder->GetNamedInterceptor();
+          if (interceptor->has_getter()) {
+            return;
+          }
+          if (is_has_property && interceptor->has_query()) {
+            return;
+          }
         }
         continue;
       }
@@ -474,10 +475,7 @@ MaybeDirectHandle<Object> LoadGlobalIC::Load(Handle<Name> name,
     if (script_contexts->Lookup(str_name, &lookup_result)) {
       DirectHandle<Context> script_context(
           script_contexts->get(lookup_result.context_index), isolate());
-      DirectHandle<Object> result(script_context->get(lookup_result.slot_index),
-                                  isolate());
-
-      if (IsTheHole(*result, isolate())) {
+      if (script_context->IsElementTheHole(lookup_result.slot_index)) {
         // Do not install stubs and stay pre-monomorphic for
         // uninitialized accesses.
         THROW_NEW_ERROR(
@@ -485,7 +483,6 @@ MaybeDirectHandle<Object> LoadGlobalIC::Load(Handle<Name> name,
             NewReferenceError(MessageTemplate::kAccessedUninitializedVariable,
                               name));
       }
-
       bool use_ic =
           (state() != NO_FEEDBACK) && v8_flags.use_ic && update_feedback;
       if (use_ic) {
@@ -505,13 +502,7 @@ MaybeDirectHandle<Object> LoadGlobalIC::Load(Handle<Name> name,
       } else if (state() == NO_FEEDBACK) {
         TraceIC("LoadGlobalIC", name);
       }
-      if (v8_flags.script_context_mutable_heap_number) {
-        return direct_handle(
-            *Context::LoadScriptContextElement(
-                script_context, lookup_result.slot_index, result, isolate()),
-            isolate());
-      }
-      return result;
+      return Context::Get(script_context, lookup_result.slot_index, isolate());
     }
   }
   return LoadIC::Load(global, name, update_feedback);
@@ -1130,7 +1121,6 @@ MaybeObjectHandle LoadIC::ComputeHandler(LookupIterator* lookup) {
     }
 
     case LookupIterator::WASM_OBJECT:
-      return MaybeObjectHandle(LoadHandler::LoadSlow(isolate()));
     case LookupIterator::ACCESS_CHECK:
     case LookupIterator::NOT_FOUND:
     case LookupIterator::TRANSITION:
@@ -1367,11 +1357,8 @@ Handle<Object> KeyedLoadIC::LoadElementHandler(
     DirectHandle<Map> receiver_map, KeyedAccessLoadMode new_load_mode) {
   // Has a getter interceptor, or is any has and has a query interceptor.
   if (receiver_map->has_indexed_interceptor() &&
-      (!IsUndefined(receiver_map->GetIndexedInterceptor()->getter(),
-                    isolate()) ||
-       (IsAnyHas() &&
-        !IsUndefined(receiver_map->GetIndexedInterceptor()->query(),
-                     isolate()))) &&
+      (receiver_map->GetIndexedInterceptor()->has_getter() ||
+       (IsAnyHas() && receiver_map->GetIndexedInterceptor()->has_query())) &&
       !receiver_map->GetIndexedInterceptor()->non_masking()) {
     // TODO(jgruber): Update counter name.
     TRACE_HANDLER_STATS(isolate(), KeyedLoadIC_LoadIndexedInterceptorStub);
@@ -1603,8 +1590,8 @@ bool StoreIC::LookupForWrite(LookupIterator* it, DirectHandle<Object> value,
   // Disable ICs for non-JSObjects for now.
   DirectHandle<Object> object = it->GetReceiver();
   if (IsJSProxy(*object)) return true;
-  if (!IsJSObject(*object)) return false;
-  DirectHandle<JSObject> receiver = Cast<JSObject>(object);
+  if (!IsJSObject(*object) && !IsWasmObject(*object)) return false;
+  DirectHandle<JSReceiver> receiver = Cast<JSReceiver>(object);
   DCHECK(!receiver->map()->is_deprecated());
 
   for (;; it->Next()) {
@@ -1612,15 +1599,14 @@ bool StoreIC::LookupForWrite(LookupIterator* it, DirectHandle<Object> value,
       case LookupIterator::TRANSITION:
         UNREACHABLE();
       case LookupIterator::WASM_OBJECT:
-        return false;
+        continue;  // Continue to the prototype, if present.
       case LookupIterator::JSPROXY:
         return true;
       case LookupIterator::INTERCEPTOR: {
         DirectHandle<JSObject> holder = it->GetHolder<JSObject>();
         Tagged<InterceptorInfo> info = holder->GetNamedInterceptor();
-        if (it->HolderIsReceiverOrHiddenPrototype() ||
-            !IsUndefined(info->getter(), isolate()) ||
-            !IsUndefined(info->query(), isolate())) {
+        if (it->HolderIsReceiverOrHiddenPrototype() || info->has_getter() ||
+            info->has_query()) {
           return true;
         }
         continue;
@@ -1686,7 +1672,7 @@ bool StoreIC::LookupForWrite(LookupIterator* it, DirectHandle<Object> value,
           // cell got invalidated) and handle these stores correctly.
           return false;
         }
-        receiver = it->GetStoreTarget<JSObject>();
+        receiver = it->GetStoreTarget<JSReceiver>();
         if (it->ExtendingNonExtensible(receiver)) return false;
         it->PrepareTransitionToDataProperty(receiver, value, NONE,
                                             store_origin);
@@ -1717,10 +1703,7 @@ MaybeDirectHandle<Object> StoreGlobalIC::Store(Handle<Name> name,
       return TypeError(MessageTemplate::kConstAssign, global, name);
     }
 
-    Tagged<Object> previous_value =
-        script_context->get(lookup_result.slot_index);
-
-    if (IsTheHole(previous_value, isolate())) {
+    if (script_context->IsElementTheHole(lookup_result.slot_index)) {
       // Do not install stubs and stay pre-monomorphic for uninitialized
       // accesses.
       AllowGarbageCollection yes_gc;
@@ -1745,15 +1728,9 @@ MaybeDirectHandle<Object> StoreGlobalIC::Store(Handle<Name> name,
     } else if (state() == NO_FEEDBACK) {
       TraceIC("StoreGlobalIC", name);
     }
-    if (v8_flags.script_context_mutable_heap_number ||
-        v8_flags.const_tracking_let) {
-      AllowGarbageCollection yes_gc;
-      Context::StoreScriptContextAndUpdateSlotProperty(
-          direct_handle(script_context, isolate()), lookup_result.slot_index,
-          value, isolate());
-    } else {
-      script_context->set(lookup_result.slot_index, *value);
-    }
+    AllowGarbageCollection yes_gc;
+    Context::Set(handle(script_context, isolate()), lookup_result.slot_index,
+                 value, isolate());
     return value;
   }
 
@@ -2024,7 +2001,7 @@ MaybeObjectHandle StoreIC::ComputeHandler(LookupIterator* lookup) {
         // ...return a store interceptor Smi handler if there is a setter
         // interceptor and it's not DefineNamedOwnIC or DefineKeyedOwnIC
         // (which should call the definer)...
-        if (!IsUndefined(info->setter(), isolate()) && !IsAnyDefineOwn()) {
+        if (info->has_setter() && !IsAnyDefineOwn()) {
           return MaybeObjectHandle(StoreHandler::StoreInterceptor(isolate()));
         }
         // ...otherwise return a slow-case Smi handler, which invokes the
@@ -2035,8 +2012,7 @@ MaybeObjectHandle StoreIC::ComputeHandler(LookupIterator* lookup) {
       // If the interceptor is a getter/query interceptor on the prototype
       // chain, return an invalidatable slow handler so it can turn fast if the
       // interceptor is masked by a regular property later.
-      DCHECK(!IsUndefined(info->getter(), isolate()) ||
-             !IsUndefined(info->query(), isolate()));
+      DCHECK(info->has_getter() || info->has_query());
       Handle<Object> handler = StoreHandler::StoreThroughPrototype(
           isolate(), lookup_start_object_map(), holder,
           *StoreHandler::StoreSlow(isolate()));
@@ -2045,7 +2021,8 @@ MaybeObjectHandle StoreIC::ComputeHandler(LookupIterator* lookup) {
 
     case LookupIterator::ACCESSOR: {
       // This is currently guaranteed by checks in StoreIC::Store.
-      DirectHandle<JSObject> receiver = Cast<JSObject>(lookup->GetReceiver());
+      DirectHandle<JSReceiver> receiver =
+          Cast<JSReceiver>(lookup->GetReceiver());
       Handle<JSObject> holder =
           indirect_handle(lookup->GetHolder<JSObject>(), isolate());
       DCHECK(!IsAccessCheckNeeded(*receiver) || lookup->name()->IsPrivate());
@@ -3053,10 +3030,7 @@ RUNTIME_FUNCTION(Runtime_StoreGlobalIC_Slow) {
 
     {
       DisallowGarbageCollection no_gc;
-      Tagged<Object> previous_value =
-          script_context->get(lookup_result.slot_index);
-
-      if (IsTheHole(previous_value, isolate)) {
+      if (script_context->IsElementTheHole(lookup_result.slot_index)) {
         AllowGarbageCollection yes_gc;
         THROW_NEW_ERROR_RETURN_FAILURE(
             isolate,
@@ -3064,13 +3038,7 @@ RUNTIME_FUNCTION(Runtime_StoreGlobalIC_Slow) {
                               name));
       }
     }
-    if (v8_flags.script_context_mutable_heap_number ||
-        v8_flags.const_tracking_let) {
-      Context::StoreScriptContextAndUpdateSlotProperty(
-          script_context, lookup_result.slot_index, value, isolate);
-    } else {
-      script_context->set(lookup_result.slot_index, *value);
-    }
+    Context::Set(script_context, lookup_result.slot_index, value, isolate);
     return *value;
   }
 
@@ -3222,7 +3190,7 @@ RUNTIME_FUNCTION(Runtime_ElementsTransitionAndStoreIC_Miss) {
   FeedbackSlotKind kind = vector->GetKind(vector_slot);
 
   if (IsJSObject(*object)) {
-    JSObject::TransitionElementsKind(Cast<JSObject>(object),
+    JSObject::TransitionElementsKind(isolate, Cast<JSObject>(object),
                                      map->elements_kind());
   }
 
@@ -4138,7 +4106,7 @@ RUNTIME_FUNCTION(Runtime_HasElementWithInterceptor) {
     PropertyCallbackArguments arguments(isolate, interceptor->data(), *receiver,
                                         *receiver, Just(kDontThrow));
 
-    if (!IsUndefined(interceptor->query(), isolate)) {
+    if (interceptor->has_query()) {
       DirectHandle<Object> result =
           arguments.CallIndexedQuery(interceptor, index);
       // An exception was thrown in the interceptor. Propagate.
@@ -4152,7 +4120,7 @@ RUNTIME_FUNCTION(Runtime_HasElementWithInterceptor) {
         arguments.AcceptSideEffects();
         return ReadOnlyRoots(isolate).true_value();
       }
-    } else if (!IsUndefined(interceptor->getter(), isolate)) {
+    } else if (interceptor->has_getter()) {
       DirectHandle<Object> result =
           arguments.CallIndexedGetter(interceptor, index);
       // An exception was thrown in the interceptor. Propagate.
diff --git a/deps/v8/src/ic/keyed-store-generic.cc b/deps/v8/src/ic/keyed-store-generic.cc
index e468354bd59eeb..a96dc1e5a50a49 100644
--- a/deps/v8/src/ic/keyed-store-generic.cc
+++ b/deps/v8/src/ic/keyed-store-generic.cc
@@ -306,18 +306,18 @@ void KeyedStoreGenericAssembler::TryRewriteElements(
   {
     TNode<Map> packed_map = LoadJSArrayElementsMap(from_kind, native_context);
     GotoIf(TaggedNotEqual(receiver_map, packed_map), &check_holey_map);
-    var_target_map = CAST(
-        LoadContextElement(native_context, Context::ArrayMapIndex(to_kind)));
+    var_target_map = CAST(LoadContextElementNoCell(
+        native_context, Context::ArrayMapIndex(to_kind)));
     Goto(&perform_transition);
   }
 
   // Check if the receiver has the default |holey_from_kind| map.
   BIND(&check_holey_map);
   {
-    TNode<Object> holey_map = LoadContextElement(
+    TNode<Object> holey_map = LoadContextElementNoCell(
         native_context, Context::ArrayMapIndex(holey_from_kind));
     GotoIf(TaggedNotEqual(receiver_map, holey_map), bailout);
-    var_target_map = CAST(LoadContextElement(
+    var_target_map = CAST(LoadContextElementNoCell(
         native_context, Context::ArrayMapIndex(holey_to_kind)));
     Goto(&perform_transition);
   }
@@ -343,8 +343,8 @@ void KeyedStoreGenericAssembler::TryChangeToHoleyMapHelper(
   if (AllocationSite::ShouldTrack(packed_kind, holey_kind)) {
     TrapAllocationMemento(receiver, bailout);
   }
-  TNode<Map> holey_map = CAST(
-      LoadContextElement(native_context, Context::ArrayMapIndex(holey_kind)));
+  TNode<Map> holey_map = CAST(LoadContextElementNoCell(
+      native_context, Context::ArrayMapIndex(holey_kind)));
   StoreMap(receiver, holey_map);
   Goto(done);
 }
@@ -1108,7 +1108,7 @@ void KeyedStoreGenericAssembler::EmitGenericPropertyStore(
       GotoIf(IsAccessorInfo(accessor_pair), slow);
       CSA_DCHECK(this, IsAccessorPair(accessor_pair));
       TNode<HeapObject> setter =
-          CAST(LoadObjectField(accessor_pair, AccessorPair::kSetterOffset));
+          CAST(LoadAccessorPairSetter(CAST(accessor_pair)));
       TNode<Map> setter_map = LoadMap(setter);
       // FunctionTemplateInfo setters are not supported yet.
       GotoIf(IsFunctionTemplateInfoMap(setter_map), slow);
diff --git a/deps/v8/src/init/bootstrapper.cc b/deps/v8/src/init/bootstrapper.cc
index 0249e150cf5547..9c78ee92e205c3 100644
--- a/deps/v8/src/init/bootstrapper.cc
+++ b/deps/v8/src/init/bootstrapper.cc
@@ -395,11 +395,11 @@ namespace {
 bool IsFunctionMapOrSpecialBuiltin(DirectHandle<Map> map, Builtin builtin,
                                    DirectHandle<Context> context) {
   // During bootstrapping some of these maps could be not created yet.
-  return ((*map == context->get(Context::STRICT_FUNCTION_MAP_INDEX)) ||
-          (*map == context->get(
+  return ((*map == context->GetNoCell(Context::STRICT_FUNCTION_MAP_INDEX)) ||
+          (*map == context->GetNoCell(
                        Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX)) ||
           (*map ==
-           context->get(
+           context->GetNoCell(
                Context::STRICT_FUNCTION_WITH_READONLY_PROTOTYPE_MAP_INDEX)) ||
           // Check if it's a creation of an empty or Proxy function during
           // bootstrapping.
@@ -944,7 +944,7 @@ void Genesis::CreateObjectFunction(DirectHandle<JSFunction> empty_function) {
   }
 
   native_context()->set_initial_object_prototype(*object_function_prototype);
-  JSFunction::SetPrototype(object_fun, object_function_prototype);
+  JSFunction::SetPrototype(isolate_, object_fun, object_function_prototype);
   object_function_prototype->map()->set_instance_type(JS_OBJECT_PROTOTYPE_TYPE);
   {
     // Set up slow map for Object.create(null) instances without in-object
@@ -1287,8 +1287,8 @@ void InitializeJSArrayMaps(Isolate* isolate,
   DCHECK_EQ(PACKED_SMI_ELEMENTS, kind);
   DCHECK_EQ(Context::ArrayMapIndex(kind),
             Context::JS_ARRAY_PACKED_SMI_ELEMENTS_MAP_INDEX);
-  native_context->set(Context::ArrayMapIndex(kind), *current_map,
-                      UPDATE_WRITE_BARRIER, kReleaseStore);
+  native_context->SetNoCell(Context::ArrayMapIndex(kind), *current_map,
+                            kReleaseStore);
   for (int i = GetSequenceIndexFromFastElementsKind(kind) + 1;
        i < kFastElementsKindCount; ++i) {
     DirectHandle<Map> new_map;
@@ -1302,8 +1302,8 @@ void InitializeJSArrayMaps(Isolate* isolate,
                                         INSERT_TRANSITION);
     }
     DCHECK_EQ(next_kind, new_map->elements_kind());
-    native_context->set(Context::ArrayMapIndex(next_kind), *new_map,
-                        UPDATE_WRITE_BARRIER, kReleaseStore);
+    native_context->SetNoCell(Context::ArrayMapIndex(next_kind), *new_map,
+                              kReleaseStore);
     current_map = new_map;
   }
 }
@@ -1338,8 +1338,8 @@ static void AddToWeakNativeContextList(Isolate* isolate,
     }
   }
 #endif
-  context->set(Context::NEXT_CONTEXT_LINK, heap->native_contexts_list(),
-               UPDATE_WRITE_BARRIER);
+  context->SetNoCell(Context::NEXT_CONTEXT_LINK, heap->native_contexts_list(),
+                     UPDATE_WRITE_BARRIER);
   heap->set_native_contexts_list(context);
 }
 
@@ -1362,8 +1362,7 @@ void Genesis::InstallGlobalThisBinding() {
 
   // Go ahead and hook it up while we're at it.
   int slot = scope_info->ReceiverContextSlotIndex();
-  DCHECK_EQ(slot, Context::MIN_CONTEXT_EXTENDED_SLOTS);
-  context->set(slot, native_context()->global_proxy());
+  context->SetNoCell(slot, native_context()->global_proxy());
 
   Handle<ScriptContextTable> script_contexts(
       native_context()->script_context_table(), isolate());
@@ -1467,7 +1466,7 @@ DirectHandle<JSGlobalObject> Genesis::CreateNewGlobals(
   // Set the global proxy of the native context. If the native context has been
   // deserialized, the global proxy is already correctly set up by the
   // deserializer. Otherwise it's undefined.
-  DCHECK(IsUndefined(native_context()->get(Context::GLOBAL_PROXY_INDEX),
+  DCHECK(IsUndefined(native_context()->GetNoCell(Context::GLOBAL_PROXY_INDEX),
                      isolate()) ||
          native_context()->global_proxy_object() == *global_proxy);
   native_context()->set_global_proxy_object(*global_proxy);
@@ -1496,7 +1495,7 @@ void Genesis::HookUpGlobalObject(DirectHandle<JSGlobalObject> global_object) {
 
   TransferNamedProperties(global_object_from_snapshot, global_object);
   if (global_object_from_snapshot->HasDictionaryElements()) {
-    JSObject::NormalizeElements(global_object);
+    JSObject::NormalizeElements(isolate(), global_object);
   }
   DCHECK_EQ(global_object_from_snapshot->GetElementsKind(),
             global_object->GetElementsKind());
@@ -2534,7 +2533,7 @@ void Genesis::InitializeGlobal(DirectHandle<JSGlobalObject> global_object,
     // mode and back.
     DirectHandle<JSArray> proto = factory->NewJSArray(
         0, TERMINAL_FAST_ELEMENTS_KIND, AllocationType::kOld);
-    JSFunction::SetPrototype(array_function, proto);
+    JSFunction::SetPrototype(isolate_, array_function, proto);
     native_context()->set_initial_array_prototype(*proto);
 
     InitializeJSArrayMaps(
@@ -2720,7 +2719,7 @@ void Genesis::InitializeGlobal(DirectHandle<JSGlobalObject> global_object,
     DirectHandle<JSPrimitiveWrapper> prototype = Cast<JSPrimitiveWrapper>(
         factory->NewJSObject(number_fun, AllocationType::kOld));
     prototype->set_value(Smi::zero());
-    JSFunction::SetPrototype(number_fun, prototype);
+    JSFunction::SetPrototype(isolate_, number_fun, prototype);
 
     // Install the "constructor" property on the {prototype}.
     JSObject::AddProperty(isolate_, prototype, factory->constructor_string(),
@@ -2806,7 +2805,7 @@ void Genesis::InitializeGlobal(DirectHandle<JSGlobalObject> global_object,
     DirectHandle<JSPrimitiveWrapper> prototype = Cast<JSPrimitiveWrapper>(
         factory->NewJSObject(boolean_fun, AllocationType::kOld));
     prototype->set_value(ReadOnlyRoots(isolate_).false_value());
-    JSFunction::SetPrototype(boolean_fun, prototype);
+    JSFunction::SetPrototype(isolate_, boolean_fun, prototype);
 
     // Install the "constructor" property on the {prototype}.
     JSObject::AddProperty(isolate_, prototype, factory->constructor_string(),
@@ -2858,7 +2857,7 @@ void Genesis::InitializeGlobal(DirectHandle<JSGlobalObject> global_object,
     DirectHandle<JSPrimitiveWrapper> prototype = Cast<JSPrimitiveWrapper>(
         factory->NewJSObject(string_fun, AllocationType::kOld));
     prototype->set_value(ReadOnlyRoots(isolate_).empty_string());
-    JSFunction::SetPrototype(string_fun, prototype);
+    JSFunction::SetPrototype(isolate_, string_fun, prototype);
     native_context()->set_initial_string_prototype(*prototype);
 
     // Install the "constructor" property on the {prototype}.
@@ -4608,7 +4607,7 @@ void Genesis::InitializeGlobal(DirectHandle<JSGlobalObject> global_object,
     // Set up the %BigIntPrototype%.
     DirectHandle<JSObject> prototype(
         Cast<JSObject>(bigint_fun->instance_prototype()), isolate_);
-    JSFunction::SetPrototype(bigint_fun, prototype);
+    JSFunction::SetPrototype(isolate_, bigint_fun, prototype);
 
     // Install the properties of the BigInt.prototype.
     // "constructor" is created implicitly by InstallFunction() above.
@@ -5562,7 +5561,7 @@ void Genesis::InitializeConsole(DirectHandle<JSObject> extras_binding) {
       Factory::JSFunctionBuilder{isolate(), info, context}.Build();
   DirectHandle<JSObject> empty =
       factory->NewJSObject(isolate_->object_function());
-  JSFunction::SetPrototype(cons, empty);
+  JSFunction::SetPrototype(isolate_, cons, empty);
 
   DirectHandle<JSObject> console =
       factory->NewJSObject(cons, AllocationType::kOld);
@@ -6004,6 +6003,12 @@ void Genesis::InitializeGlobal_js_source_phase_imports() {
 void Genesis::InitializeGlobal_js_base_64() {
   if (!v8_flags.js_base_64) return;
 
+  std::array<DirectHandle<Name>, 2> fields{
+      isolate()->factory()->read_string(),
+      isolate()->factory()->written_string()};
+  DirectHandle<Map> map = CreateLiteralObjectMapFromCache(isolate(), fields);
+  native_context()->set_set_unit8_array_result_map(*map);
+
   DirectHandle<JSGlobalObject> global(native_context()->global_object(),
                                       isolate());
   DirectHandle<JSObject> uint8_array_function =
@@ -6020,8 +6025,13 @@ void Genesis::InitializeGlobal_js_base_64() {
       isolate());
   SimpleInstallFunction(isolate(), uint8_array_prototype, "toBase64",
                         Builtin::kUint8ArrayPrototypeToBase64, 0, kDontAdapt);
+  SimpleInstallFunction(isolate(), uint8_array_prototype, "setFromBase64",
+                        Builtin::kUint8ArrayPrototypeSetFromBase64, 1,
+                        kDontAdapt);
   SimpleInstallFunction(isolate(), uint8_array_prototype, "toHex",
                         Builtin::kUint8ArrayPrototypeToHex, 0, kDontAdapt);
+  SimpleInstallFunction(isolate(), uint8_array_prototype, "setFromHex",
+                        Builtin::kUint8ArrayPrototypeSetFromHex, 1, kDontAdapt);
 }
 
 void Genesis::InitializeGlobal_regexp_linear_flag() {
diff --git a/deps/v8/src/init/heap-symbols.h b/deps/v8/src/init/heap-symbols.h
index b4a27d7ce991dd..d110e5439530f3 100644
--- a/deps/v8/src/init/heap-symbols.h
+++ b/deps/v8/src/init/heap-symbols.h
@@ -786,6 +786,7 @@
   V(_, RangeError_string, "RangeError")                                       \
   V(_, raw_json_string, "rawJSON")                                            \
   V(_, raw_string, "raw")                                                     \
+  V(_, read_string, "read")                                                   \
   V(_, ReferenceError_string, "ReferenceError")                               \
   V(_, ReflectGet_string, "Reflect.get")                                      \
   V(_, ReflectHas_string, "Reflect.has")                                      \
@@ -871,6 +872,7 @@
   V(_, weekOfYear_string, "weekOfYear")                                       \
   V(_, with_string, "with")                                                   \
   V(_, word_string, "word")                                                   \
+  V(_, written_string, "written")                                             \
   V(_, yearMonthFromFields_string, "yearMonthFromFields")                     \
   V(_, year_string, "year")                                                   \
   V(_, years_string, "years")
@@ -1040,6 +1042,7 @@
   F(SCAVENGER_SCAVENGE_UPDATE_REFS)                     \
   F(SCAVENGER_SCAVENGE_WEAK)                            \
   F(SCAVENGER_SCAVENGE_FINALIZE)                        \
+  F(SCAVENGER_SCAVENGE_RESTORE_AND_QUARANTINE_PINNED)   \
   F(SCAVENGER_SWEEP_ARRAY_BUFFERS)                      \
   F(SCAVENGER_TRACED_HANDLES_COMPUTE_WEAKNESS_PARALLEL) \
   F(SCAVENGER_TRACED_HANDLES_RESET_PARALLEL)
@@ -1153,6 +1156,7 @@
   F(MINOR_MS_BACKGROUND_SWEEPING)                       \
   F(MINOR_MS_BACKGROUND_MARKING_CLOSURE)                \
   F(SCAVENGER_BACKGROUND_SCAVENGE_PARALLEL)             \
+  F(SCAVENGER_BACKGROUND_QUARANTINED_PAGE_SWEEPING)     \
   F(SCAVENGER_BACKGROUND_TRACED_HANDLES_RESET_PARALLEL) \
   /* LAST_BACKGROUND_SCOPE = */                         \
   F(SCAVENGER_BACKGROUND_TRACED_HANDLES_COMPUTE_WEAKNESS_PARALLEL)
@@ -1167,6 +1171,7 @@
   F(MINOR_MS_BACKGROUND_MARKING_CLOSURE)                \
   SCAVENGER_MAIN_THREAD_SCOPES(F)                       \
   F(SCAVENGER_BACKGROUND_SCAVENGE_PARALLEL)             \
+  F(SCAVENGER_BACKGROUND_QUARANTINED_PAGE_SWEEPING)     \
   F(SCAVENGER_BACKGROUND_TRACED_HANDLES_RESET_PARALLEL) \
   F(SCAVENGER_BACKGROUND_TRACED_HANDLES_COMPUTE_WEAKNESS_PARALLEL)
 
diff --git a/deps/v8/src/inspector/DEPS b/deps/v8/src/inspector/DEPS
index 0694306ccf2e41..b29d772d1b4f21 100644
--- a/deps/v8/src/inspector/DEPS
+++ b/deps/v8/src/inspector/DEPS
@@ -10,7 +10,7 @@ include_rules = [
   "+src/base/platform/mutex.h",
   "+src/base/platform/platform.h",
   "+src/base/platform/time.h",
-  "+src/base/safe_conversions.h",
+  "+src/base/numerics/safe_conversions.h",
   "+src/base/template-utils.h",
   "+src/numbers/conversions.h",
   "+src/inspector",
diff --git a/deps/v8/src/inspector/search-util.cc b/deps/v8/src/inspector/search-util.cc
index 7489c4fad5767a..d7cd967a3169c2 100644
--- a/deps/v8/src/inspector/search-util.cc
+++ b/deps/v8/src/inspector/search-util.cc
@@ -165,4 +165,8 @@ String16 findSourceMapURL(const String16& content, bool multiline) {
   return findMagicComment(content, "sourceMappingURL", multiline);
 }
 
+String16 findDebugId(const String16& content, bool multiline) {
+  return findMagicComment(content, "debugId", multiline);
+}
+
 }  // namespace v8_inspector
diff --git a/deps/v8/src/inspector/search-util.h b/deps/v8/src/inspector/search-util.h
index 11d511a30c1bbb..34fd6c1fe73161 100644
--- a/deps/v8/src/inspector/search-util.h
+++ b/deps/v8/src/inspector/search-util.h
@@ -16,6 +16,7 @@ class V8InspectorSession;
 
 String16 findSourceURL(const String16& content, bool multiline);
 String16 findSourceMapURL(const String16& content, bool multiline);
+String16 findDebugId(const String16& content, bool multiline);
 std::vector<std::unique_ptr<protocol::Debugger::SearchMatch>>
 searchInTextByLinesImpl(V8InspectorSession*, const String16& text,
                         const String16& query, bool caseSensitive,
diff --git a/deps/v8/src/inspector/v8-debugger-agent-impl.cc b/deps/v8/src/inspector/v8-debugger-agent-impl.cc
index 8a154530c140bd..fb3d3637138a59 100644
--- a/deps/v8/src/inspector/v8-debugger-agent-impl.cc
+++ b/deps/v8/src/inspector/v8-debugger-agent-impl.cc
@@ -12,7 +12,7 @@
 #include "include/v8-function.h"
 #include "include/v8-inspector.h"
 #include "include/v8-microtask-queue.h"
-#include "src/base/safe_conversions.h"
+#include "src/base/numerics/safe_conversions.h"
 #include "src/debug/debug-interface.h"
 #include "src/inspector/crc32.h"
 #include "src/inspector/injected-script.h"
@@ -400,7 +400,8 @@ Response isValidPosition(protocol::Debugger::ScriptPosition* position) {
   return Response::Success();
 }
 
-Response isValidRangeOfPositions(std::vector<std::pair<int, int>>& positions) {
+Response isValidRangeOfPositions(
+    const std::vector<std::pair<int, int>>& positions) {
   for (size_t i = 1; i < positions.size(); ++i) {
     if (positions[i - 1].first < positions[i].first) continue;
     if (positions[i - 1].first == positions[i].first &&
@@ -1947,6 +1948,7 @@ void V8DebuggerAgentImpl::didParseSource(
     String16 scriptSource = script->source(0);
     script->setSourceURL(findSourceURL(scriptSource, false));
     script->setSourceMappingURL(findSourceMapURL(scriptSource, false));
+    script->setBuildId(findDebugId(scriptSource, false));
   }
 
   int contextId = script->executionContextId();
@@ -2400,7 +2402,7 @@ Response V8DebuggerAgentImpl::processSkipList(
 
   // Verify that the skipList is sorted, and that all ranges
   // are properly defined (start comes before end).
-  for (auto skipListPair : skipListInit) {
+  for (const auto& skipListPair : skipListInit) {
     Response res = isValidRangeOfPositions(skipListPair.second);
     if (res.IsError()) return res;
   }
diff --git a/deps/v8/src/inspector/v8-debugger-script.cc b/deps/v8/src/inspector/v8-debugger-script.cc
index 32babcf01a23cb..5d65d7abbb1b6e 100644
--- a/deps/v8/src/inspector/v8-debugger-script.cc
+++ b/deps/v8/src/inspector/v8-debugger-script.cc
@@ -38,193 +38,184 @@ String16 calculateHash(v8::Isolate* isolate, v8::Local<v8::String> source) {
   return formatted_hash.toString();
 }
 
-class ActualScript : public V8DebuggerScript {
-  friend class V8DebuggerScript;
-
- public:
-  ActualScript(v8::Isolate* isolate, v8::Local<v8::debug::Script> script,
-               bool isLiveEdit, V8DebuggerAgentImpl* agent,
-               V8InspectorClient* client)
-      : V8DebuggerScript(isolate, String16::fromInteger(script->Id()),
-                         GetScriptURL(isolate, script, client),
-                         GetScriptName(isolate, script, client)),
-        m_agent(agent),
-        m_isLiveEdit(isLiveEdit) {
-    Initialize(script);
-  }
+}  // namespace
 
-  bool isLiveEdit() const override { return m_isLiveEdit; }
-  bool isModule() const override { return m_isModule; }
+V8DebuggerScript::V8DebuggerScript(v8::Isolate* isolate,
+                                   v8::Local<v8::debug::Script> script,
+                                   bool isLiveEdit, V8DebuggerAgentImpl* agent,
+                                   V8InspectorClient* client)
+    : m_id(String16::fromInteger(script->Id())),
+      m_url(GetScriptURL(isolate, script, client)),
+      m_isolate(isolate),
+      m_embedderName(GetScriptName(isolate, script, client)),
+      m_agent(agent),
+      m_isLiveEdit(isLiveEdit) {
+  Initialize(script);
+}
 
-  String16 source(size_t pos, size_t len) const override {
-    v8::HandleScope scope(m_isolate);
-    v8::Local<v8::String> v8Source;
-    if (!m_scriptSource.Get(m_isolate)->JavaScriptCode().ToLocal(&v8Source)) {
-      return String16();
-    }
-    if (pos >= static_cast<size_t>(v8Source->Length())) return String16();
-    size_t substringLength =
-        std::min(len, static_cast<size_t>(v8Source->Length()) - pos);
-    std::unique_ptr<UChar[]> buffer(new UChar[substringLength]);
-    v8Source->WriteV2(m_isolate, static_cast<uint32_t>(pos),
-                      static_cast<uint32_t>(substringLength),
-                      reinterpret_cast<uint16_t*>(buffer.get()));
-    return String16(buffer.get(), substringLength);
+String16 V8DebuggerScript::source(size_t pos, size_t len) const {
+  v8::HandleScope scope(m_isolate);
+  v8::Local<v8::String> v8Source;
+  if (!m_scriptSource.Get(m_isolate)->JavaScriptCode().ToLocal(&v8Source)) {
+    return String16();
   }
-  Language getLanguage() const override { return m_language; }
+  if (pos >= static_cast<size_t>(v8Source->Length())) return String16();
+  size_t substringLength =
+      std::min(len, static_cast<size_t>(v8Source->Length()) - pos);
+  std::unique_ptr<UChar[]> buffer(new UChar[substringLength]);
+  v8Source->WriteV2(m_isolate, static_cast<uint32_t>(pos),
+                    static_cast<uint32_t>(substringLength),
+                    reinterpret_cast<uint16_t*>(buffer.get()));
+  return String16(buffer.get(), substringLength);
+}
 
 #if V8_ENABLE_WEBASSEMBLY
-  v8::Maybe<v8::MemorySpan<const uint8_t>> wasmBytecode() const override {
-    v8::HandleScope scope(m_isolate);
-    v8::MemorySpan<const uint8_t> bytecode;
-    if (m_scriptSource.Get(m_isolate)->WasmBytecode().To(&bytecode)) {
-      return v8::Just(bytecode);
-    }
-    return v8::Nothing<v8::MemorySpan<const uint8_t>>();
+v8::Maybe<v8::MemorySpan<const uint8_t>> V8DebuggerScript::wasmBytecode()
+    const {
+  v8::HandleScope scope(m_isolate);
+  v8::MemorySpan<const uint8_t> bytecode;
+  if (m_scriptSource.Get(m_isolate)->WasmBytecode().To(&bytecode)) {
+    return v8::Just(bytecode);
   }
+  return v8::Nothing<v8::MemorySpan<const uint8_t>>();
+}
 
-  std::vector<v8::debug::WasmScript::DebugSymbols> getDebugSymbols()
-      const override {
-    auto script = this->script();
-    if (!script->IsWasm())
-      return std::vector<v8::debug::WasmScript::DebugSymbols>();
-    return v8::debug::WasmScript::Cast(*script)->GetDebugSymbols();
-  }
+std::vector<v8::debug::WasmScript::DebugSymbols>
+V8DebuggerScript::getDebugSymbols() const {
+  auto script = this->script();
+  if (!script->IsWasm())
+    return std::vector<v8::debug::WasmScript::DebugSymbols>();
+  return v8::debug::WasmScript::Cast(*script)->GetDebugSymbols();
+}
 
-  void Disassemble(v8::debug::DisassemblyCollector* collector,
-                   std::vector<int>* function_body_offsets) const override {
-    v8::HandleScope scope(m_isolate);
-    v8::Local<v8::debug::Script> script = this->script();
-    DCHECK(script->IsWasm());
-    v8::debug::WasmScript::Cast(*script)->Disassemble(collector,
-                                                      function_body_offsets);
-  }
+void V8DebuggerScript::Disassemble(
+    v8::debug::DisassemblyCollector* collector,
+    std::vector<int>* function_body_offsets) const {
+  v8::HandleScope scope(m_isolate);
+  v8::Local<v8::debug::Script> script = this->script();
+  DCHECK(script->IsWasm());
+  v8::debug::WasmScript::Cast(*script)->Disassemble(collector,
+                                                    function_body_offsets);
+}
 #endif  // V8_ENABLE_WEBASSEMBLY
 
-  int startLine() const override { return m_startLine; }
-  int startColumn() const override { return m_startColumn; }
-  int endLine() const override { return m_endLine; }
-  int endColumn() const override { return m_endColumn; }
-  int codeOffset() const override {
+int V8DebuggerScript::codeOffset() const {
 #if V8_ENABLE_WEBASSEMBLY
     if (script()->IsWasm()) {
       return v8::debug::WasmScript::Cast(*script())->CodeOffset();
     }
 #endif  // V8_ENABLE_WEBASSEMBLY
     return 0;
-  }
-  int length() const override {
-    return static_cast<int>(m_scriptSource.Get(m_isolate)->Length());
-  }
+}
+int V8DebuggerScript::length() const {
+  return static_cast<int>(m_scriptSource.Get(m_isolate)->Length());
+}
 
-  const String16& sourceMappingURL() const override {
-    return m_sourceMappingURL;
-  }
+void V8DebuggerScript::setSourceMappingURL(const String16& sourceMappingURL) {
+  m_sourceMappingURL = sourceMappingURL;
+}
 
-  void setSourceMappingURL(const String16& sourceMappingURL) override {
-    m_sourceMappingURL = sourceMappingURL;
+void V8DebuggerScript::setSource(const String16& newSource, bool preview,
+                                 bool allowTopFrameLiveEditing,
+                                 v8::debug::LiveEditResult* result) {
+  v8::EscapableHandleScope scope(m_isolate);
+  v8::Local<v8::String> v8Source = toV8String(m_isolate, newSource);
+  if (!m_script.Get(m_isolate)->SetScriptSource(
+          v8Source, preview, allowTopFrameLiveEditing, result)) {
+    result->message = scope.Escape(result->message);
+    return;
   }
+  // NOP if preview or unchanged source (diffs.empty() in PatchScript)
+  if (preview || result->script.IsEmpty()) return;
 
-  void setSource(const String16& newSource, bool preview,
-                 bool allowTopFrameLiveEditing,
-                 v8::debug::LiveEditResult* result) override {
-    v8::EscapableHandleScope scope(m_isolate);
-    v8::Local<v8::String> v8Source = toV8String(m_isolate, newSource);
-    if (!m_script.Get(m_isolate)->SetScriptSource(
-            v8Source, preview, allowTopFrameLiveEditing, result)) {
-      result->message = scope.Escape(result->message);
-      return;
-    }
-    // NOP if preview or unchanged source (diffs.empty() in PatchScript)
-    if (preview || result->script.IsEmpty()) return;
+  m_hash = String16();
+  Initialize(scope.Escape(result->script));
+}
 
-    m_hash = String16();
-    Initialize(scope.Escape(result->script));
+bool V8DebuggerScript::getPossibleBreakpoints(
+    const v8::debug::Location& start, const v8::debug::Location& end,
+    bool restrictToFunction, std::vector<v8::debug::BreakLocation>* locations) {
+  v8::HandleScope scope(m_isolate);
+  v8::Local<v8::debug::Script> script = m_script.Get(m_isolate);
+  std::vector<v8::debug::BreakLocation> allLocations;
+  if (!script->GetPossibleBreakpoints(start, end, restrictToFunction,
+                                      &allLocations)) {
+    return false;
   }
-
-  bool getPossibleBreakpoints(
-      const v8::debug::Location& start, const v8::debug::Location& end,
-      bool restrictToFunction,
-      std::vector<v8::debug::BreakLocation>* locations) override {
-    v8::HandleScope scope(m_isolate);
-    v8::Local<v8::debug::Script> script = m_script.Get(m_isolate);
-    std::vector<v8::debug::BreakLocation> allLocations;
-    if (!script->GetPossibleBreakpoints(start, end, restrictToFunction,
-                                        &allLocations)) {
-      return false;
-    }
-    if (allLocations.empty()) return true;
-    v8::debug::BreakLocation current = allLocations[0];
-    for (size_t i = 1; i < allLocations.size(); ++i) {
-      if (allLocations[i].GetLineNumber() == current.GetLineNumber() &&
-          allLocations[i].GetColumnNumber() == current.GetColumnNumber()) {
-        if (allLocations[i].type() != v8::debug::kCommonBreakLocation) {
-          DCHECK(allLocations[i].type() == v8::debug::kCallBreakLocation ||
-                 allLocations[i].type() == v8::debug::kReturnBreakLocation);
-          // debugger can returns more then one break location at the same
-          // source location, e.g. foo() - in this case there are two break
-          // locations before foo: for statement and for function call, we can
-          // merge them for inspector and report only one with call type.
-          current = allLocations[i];
-        }
-      } else {
-        // we assume that returned break locations are sorted.
-        DCHECK(
-            allLocations[i].GetLineNumber() > current.GetLineNumber() ||
-            (allLocations[i].GetColumnNumber() >= current.GetColumnNumber() &&
-             allLocations[i].GetLineNumber() == current.GetLineNumber()));
-        locations->push_back(current);
+  if (allLocations.empty()) return true;
+  v8::debug::BreakLocation current = allLocations[0];
+  for (size_t i = 1; i < allLocations.size(); ++i) {
+    if (allLocations[i].GetLineNumber() == current.GetLineNumber() &&
+        allLocations[i].GetColumnNumber() == current.GetColumnNumber()) {
+      if (allLocations[i].type() != v8::debug::kCommonBreakLocation) {
+        DCHECK(allLocations[i].type() == v8::debug::kCallBreakLocation ||
+               allLocations[i].type() == v8::debug::kReturnBreakLocation);
+        // debugger can returns more then one break location at the same
+        // source location, e.g. foo() - in this case there are two break
+        // locations before foo: for statement and for function call, we can
+        // merge them for inspector and report only one with call type.
         current = allLocations[i];
       }
+    } else {
+      // we assume that returned break locations are sorted.
+      DCHECK(allLocations[i].GetLineNumber() > current.GetLineNumber() ||
+             (allLocations[i].GetColumnNumber() >= current.GetColumnNumber() &&
+              allLocations[i].GetLineNumber() == current.GetLineNumber()));
+      locations->push_back(current);
+      current = allLocations[i];
     }
-    locations->push_back(current);
-    return true;
   }
+  locations->push_back(current);
+  return true;
+}
 
-  void resetBlackboxedStateCache() override {
-    v8::HandleScope scope(m_isolate);
-    v8::debug::ResetBlackboxedStateCache(m_isolate, m_script.Get(m_isolate));
-  }
+void V8DebuggerScript::resetBlackboxedStateCache() {
+  v8::HandleScope scope(m_isolate);
+  v8::debug::ResetBlackboxedStateCache(m_isolate, m_script.Get(m_isolate));
+}
 
-  v8::Maybe<int> offset(int lineNumber, int columnNumber) const override {
-    v8::HandleScope scope(m_isolate);
-    return m_script.Get(m_isolate)->GetSourceOffset(
-        v8::debug::Location(lineNumber, columnNumber));
-  }
+v8::Maybe<int> V8DebuggerScript::offset(int lineNumber,
+                                        int columnNumber) const {
+  v8::HandleScope scope(m_isolate);
+  return m_script.Get(m_isolate)->GetSourceOffset(
+      v8::debug::Location(lineNumber, columnNumber));
+}
 
-  v8::debug::Location location(int offset) const override {
-    v8::HandleScope scope(m_isolate);
-    return m_script.Get(m_isolate)->GetSourceLocation(offset);
-  }
+v8::debug::Location V8DebuggerScript::location(int offset) const {
+  v8::HandleScope scope(m_isolate);
+  return m_script.Get(m_isolate)->GetSourceLocation(offset);
+}
 
-  bool setBreakpoint(const String16& condition, v8::debug::Location* location,
-                     int* id) const override {
-    v8::HandleScope scope(m_isolate);
-    return script()->SetBreakpoint(toV8String(m_isolate, condition), location,
-                                   id);
-  }
+bool V8DebuggerScript::setBreakpoint(const String16& condition,
+                                     v8::debug::Location* location,
+                                     int* id) const {
+  v8::HandleScope scope(m_isolate);
+  return script()->SetBreakpoint(toV8String(m_isolate, condition), location,
+                                 id);
+}
 
-  bool setInstrumentationBreakpoint(int* id) const override {
-    v8::HandleScope scope(m_isolate);
-    return script()->SetInstrumentationBreakpoint(id);
-  }
+bool V8DebuggerScript::setInstrumentationBreakpoint(int* id) const {
+  v8::HandleScope scope(m_isolate);
+  return script()->SetInstrumentationBreakpoint(id);
+}
 
-  const String16& hash() const override {
-    if (!m_hash.isEmpty()) return m_hash;
-    v8::HandleScope scope(m_isolate);
-    v8::Local<v8::String> v8Source;
-    if (!m_scriptSource.Get(m_isolate)->JavaScriptCode().ToLocal(&v8Source)) {
-      v8Source = v8::String::Empty(m_isolate);
-    }
-    m_hash = calculateHash(m_isolate, v8Source);
-    DCHECK(!m_hash.isEmpty());
-    return m_hash;
+const String16& V8DebuggerScript::hash() const {
+  if (!m_hash.isEmpty()) return m_hash;
+  v8::HandleScope scope(m_isolate);
+  v8::Local<v8::String> v8Source;
+  if (!m_scriptSource.Get(m_isolate)->JavaScriptCode().ToLocal(&v8Source)) {
+    v8Source = v8::String::Empty(m_isolate);
   }
+  m_hash = calculateHash(m_isolate, v8Source);
+  DCHECK(!m_hash.isEmpty());
+  return m_hash;
+}
 
-  String16 buildId() const override {
+String16 V8DebuggerScript::buildId() const {
+  if (!m_buildId.isEmpty()) return m_buildId;
+  v8::Local<v8::debug::Script> script = this->script();
 #if V8_ENABLE_WEBASSEMBLY
     if (m_language == Language::WebAssembly) {
-      v8::Local<v8::debug::Script> script = this->script();
       auto maybe_build_id =
           v8::debug::WasmScript::Cast(*script)->GetModuleBuildId();
       if (maybe_build_id.IsJust()) {
@@ -234,53 +225,64 @@ class ActualScript : public V8DebuggerScript {
           buildIdFormatter.appendUnsignedAsHex(
               static_cast<uint8_t>(buildId[i]));
         }
-        return buildIdFormatter.toString();
+        m_buildId = buildIdFormatter.toString();
       }
     }
 #endif  // V8_ENABLE_WEBASSEMBLY
-    return {};
-  }
+    if (m_language == Language::JavaScript) {
+      v8::Local<v8::String> debugId;
+      if (script->DebugId().ToLocal(&debugId)) {
+        m_buildId = toProtocolString(m_isolate, debugId);
+      }
+    }
+    return m_buildId;
+}
 
- private:
-  static String16 GetScriptURL(v8::Isolate* isolate,
-                               v8::Local<v8::debug::Script> script,
-                               V8InspectorClient* client) {
-    v8::Local<v8::String> sourceURL;
-    if (script->SourceURL().ToLocal(&sourceURL) && sourceURL->Length() > 0)
-      return toProtocolString(isolate, sourceURL);
-    return GetScriptName(isolate, script, client);
-  }
+void V8DebuggerScript::setBuildId(const String16& buildId) {
+  m_buildId = buildId;
+}
 
-  static String16 GetScriptName(v8::Isolate* isolate,
-                                v8::Local<v8::debug::Script> script,
-                                V8InspectorClient* client) {
-    v8::Local<v8::String> v8Name;
-    if (script->Name().ToLocal(&v8Name) && v8Name->Length() > 0) {
-      String16 name = toProtocolString(isolate, v8Name);
-      std::unique_ptr<StringBuffer> url =
-          client->resourceNameToUrl(toStringView(name));
-      return url ? toString16(url->string()) : name;
-    }
-    return String16();
-  }
+// static
+String16 V8DebuggerScript::GetScriptURL(v8::Isolate* isolate,
+                                        v8::Local<v8::debug::Script> script,
+                                        V8InspectorClient* client) {
+  v8::Local<v8::String> sourceURL;
+  if (script->SourceURL().ToLocal(&sourceURL) && sourceURL->Length() > 0)
+    return toProtocolString(isolate, sourceURL);
+  return GetScriptName(isolate, script, client);
+}
 
-  v8::Local<v8::debug::Script> script() const override {
-    return m_script.Get(m_isolate);
+// static
+String16 V8DebuggerScript::GetScriptName(v8::Isolate* isolate,
+                                         v8::Local<v8::debug::Script> script,
+                                         V8InspectorClient* client) {
+  v8::Local<v8::String> v8Name;
+  if (script->Name().ToLocal(&v8Name) && v8Name->Length() > 0) {
+    String16 name = toProtocolString(isolate, v8Name);
+    std::unique_ptr<StringBuffer> url =
+        client->resourceNameToUrl(toStringView(name));
+    return url ? toString16(url->string()) : name;
   }
+  return String16();
+}
 
-  void Initialize(v8::Local<v8::debug::Script> script) {
-    v8::Local<v8::String> tmp;
-    m_hasSourceURLComment =
-        script->SourceURL().ToLocal(&tmp) && tmp->Length() > 0;
-    if (script->SourceMappingURL().ToLocal(&tmp))
-      m_sourceMappingURL = toProtocolString(m_isolate, tmp);
-    m_startLine = script->StartLine();
-    m_startColumn = script->StartColumn();
-    m_endLine = script->EndLine();
-    m_endColumn = script->EndColumn();
-
-    USE(script->ContextId().To(&m_executionContextId));
-    m_language = V8DebuggerScript::Language::JavaScript;
+v8::Local<v8::debug::Script> V8DebuggerScript::script() const {
+  return m_script.Get(m_isolate);
+}
+
+void V8DebuggerScript::Initialize(v8::Local<v8::debug::Script> script) {
+  v8::Local<v8::String> tmp;
+  m_hasSourceURLComment =
+      script->SourceURL().ToLocal(&tmp) && tmp->Length() > 0;
+  if (script->SourceMappingURL().ToLocal(&tmp))
+    m_sourceMappingURL = toProtocolString(m_isolate, tmp);
+  m_startLine = script->StartLine();
+  m_startColumn = script->StartColumn();
+  m_endLine = script->EndLine();
+  m_endColumn = script->EndColumn();
+
+  USE(script->ContextId().To(&m_executionContextId));
+  m_language = V8DebuggerScript::Language::JavaScript;
 #if V8_ENABLE_WEBASSEMBLY
     if (script->IsWasm()) {
       m_language = V8DebuggerScript::Language::WebAssembly;
@@ -298,53 +300,21 @@ class ActualScript : public V8DebuggerScript {
     m_script.AnnotateStrongRetainer(kGlobalDebuggerScriptHandleLabel);
     m_scriptSource.Reset(m_isolate, script->Source());
     m_scriptSource.AnnotateStrongRetainer(kGlobalDebuggerScriptHandleLabel);
-  }
-
-  void MakeWeak() override {
-    m_script.SetWeak(
-        this,
-        [](const v8::WeakCallbackInfo<ActualScript>& data) {
-          data.GetParameter()->WeakCallback();
-        },
-        v8::WeakCallbackType::kParameter);
-  }
-
-  void WeakCallback() {
-    m_script.Reset();
-    m_agent->ScriptCollected(this);
-  }
-
-  V8DebuggerAgentImpl* m_agent;
-  String16 m_sourceMappingURL;
-  Language m_language;
-  bool m_isLiveEdit = false;
-  bool m_isModule = false;
-  mutable String16 m_hash;
-  int m_startLine = 0;
-  int m_startColumn = 0;
-  int m_endLine = 0;
-  int m_endColumn = 0;
-  v8::Global<v8::debug::Script> m_script;
-  v8::Global<v8::debug::ScriptSource> m_scriptSource;
-};
-
-}  // namespace
-
-std::unique_ptr<V8DebuggerScript> V8DebuggerScript::Create(
-    v8::Isolate* isolate, v8::Local<v8::debug::Script> scriptObj,
-    bool isLiveEdit, V8DebuggerAgentImpl* agent, V8InspectorClient* client) {
-  return std::make_unique<ActualScript>(isolate, scriptObj, isLiveEdit, agent,
-                                        client);
 }
 
-V8DebuggerScript::V8DebuggerScript(v8::Isolate* isolate, String16 id,
-                                   String16 url, String16 embedderName)
-    : m_id(std::move(id)),
-      m_url(std::move(url)),
-      m_isolate(isolate),
-      m_embedderName(embedderName) {}
+void V8DebuggerScript::MakeWeak() {
+  m_script.SetWeak(
+      this,
+      [](const v8::WeakCallbackInfo<V8DebuggerScript>& data) {
+        data.GetParameter()->WeakCallback();
+      },
+      v8::WeakCallbackType::kParameter);
+}
 
-V8DebuggerScript::~V8DebuggerScript() = default;
+void V8DebuggerScript::WeakCallback() {
+  m_script.Reset();
+  m_agent->ScriptCollected(this);
+}
 
 void V8DebuggerScript::setSourceURL(const String16& sourceURL) {
   if (sourceURL.length() > 0) {
diff --git a/deps/v8/src/inspector/v8-debugger-script.h b/deps/v8/src/inspector/v8-debugger-script.h
index 9e1b5aee7285e1..d8f5e1db9c19e5 100644
--- a/deps/v8/src/inspector/v8-debugger-script.h
+++ b/deps/v8/src/inspector/v8-debugger-script.h
@@ -51,11 +51,11 @@ class V8InspectorClient;
 class V8DebuggerScript {
  public:
   enum class Language { JavaScript, WebAssembly };
-  static std::unique_ptr<V8DebuggerScript> Create(
-      v8::Isolate* isolate, v8::Local<v8::debug::Script> script,
-      bool isLiveEdit, V8DebuggerAgentImpl* agent, V8InspectorClient* client);
 
-  virtual ~V8DebuggerScript();
+  V8DebuggerScript(v8::Isolate* isolate, v8::Local<v8::debug::Script> script,
+                   bool isLiveEdit, V8DebuggerAgentImpl* agent,
+                   V8InspectorClient* client);
+  ~V8DebuggerScript() = default;
   V8DebuggerScript(const V8DebuggerScript&) = delete;
   V8DebuggerScript& operator=(const V8DebuggerScript&) = delete;
 
@@ -65,55 +65,61 @@ class V8DebuggerScript {
   const String16& sourceURL() const { return m_url; }
   const String16& embedderName() const { return m_embedderName; }
 
-  virtual const String16& sourceMappingURL() const = 0;
-  virtual String16 source(size_t pos, size_t len = UINT_MAX) const = 0;
-  virtual Language getLanguage() const = 0;
-  virtual const String16& hash() const = 0;
-  virtual String16 buildId() const = 0;
-  virtual int startLine() const = 0;
-  virtual int startColumn() const = 0;
-  virtual int endLine() const = 0;
-  virtual int endColumn() const = 0;
-  virtual int codeOffset() const = 0;
+  const String16& sourceMappingURL() const { return m_sourceMappingURL; }
+  String16 source(size_t pos, size_t len = UINT_MAX) const;
+  Language getLanguage() const { return m_language; }
+  const String16& hash() const;
+  String16 buildId() const;
+  int startLine() const { return m_startLine; }
+  int startColumn() const { return m_startColumn; }
+  int endLine() const { return m_endLine; }
+  int endColumn() const { return m_endColumn; }
+  int codeOffset() const;
   int executionContextId() const { return m_executionContextId; }
-  virtual bool isLiveEdit() const = 0;
-  virtual bool isModule() const = 0;
-  virtual int length() const = 0;
+  bool isLiveEdit() const { return m_isLiveEdit; }
+  bool isModule() const { return m_isModule; }
+  int length() const;
 
   void setSourceURL(const String16&);
-  virtual void setSourceMappingURL(const String16&) = 0;
-  virtual void setSource(const String16& source, bool preview,
-                         bool allowTopFrameLiveEditing,
-                         v8::debug::LiveEditResult* result) = 0;
-
-  virtual bool getPossibleBreakpoints(
-      const v8::debug::Location& start, const v8::debug::Location& end,
-      bool ignoreNestedFunctions,
-      std::vector<v8::debug::BreakLocation>* locations) = 0;
-  virtual void resetBlackboxedStateCache() = 0;
-
-  virtual v8::Maybe<int> offset(int lineNumber, int columnNumber) const = 0;
-  virtual v8::debug::Location location(int offset) const = 0;
-
-  virtual bool setBreakpoint(const String16& condition,
-                             v8::debug::Location* location, int* id) const = 0;
-  virtual void MakeWeak() = 0;
-  virtual bool setInstrumentationBreakpoint(int* id) const = 0;
+  void setSourceMappingURL(const String16&);
+  void setBuildId(const String16&);
+  void setSource(const String16& source, bool preview,
+                 bool allowTopFrameLiveEditing,
+                 v8::debug::LiveEditResult* result);
+
+  bool getPossibleBreakpoints(const v8::debug::Location& start,
+                              const v8::debug::Location& end,
+                              bool ignoreNestedFunctions,
+                              std::vector<v8::debug::BreakLocation>* locations);
+  void resetBlackboxedStateCache();
+
+  v8::Maybe<int> offset(int lineNumber, int columnNumber) const;
+  v8::debug::Location location(int offset) const;
+
+  bool setBreakpoint(const String16& condition, v8::debug::Location* location,
+                     int* id) const;
+  void MakeWeak();
+  void WeakCallback();
+  bool setInstrumentationBreakpoint(int* id) const;
 
 #if V8_ENABLE_WEBASSEMBLY
-  virtual v8::Maybe<v8::MemorySpan<const uint8_t>> wasmBytecode() const = 0;
-  virtual std::vector<v8::debug::WasmScript::DebugSymbols> getDebugSymbols()
-      const = 0;
+  v8::Maybe<v8::MemorySpan<const uint8_t>> wasmBytecode() const;
+  std::vector<v8::debug::WasmScript::DebugSymbols> getDebugSymbols() const;
   void removeWasmBreakpoint(int id);
-  virtual void Disassemble(v8::debug::DisassemblyCollector* collector,
-                           std::vector<int>* function_body_offsets) const = 0;
+  void Disassemble(v8::debug::DisassemblyCollector* collector,
+                   std::vector<int>* function_body_offsets) const;
 #endif  // V8_ENABLE_WEBASSEMBLY
 
- protected:
-  V8DebuggerScript(v8::Isolate*, String16 id, String16 url,
-                   String16 embedderName);
+ private:
+  v8::Local<v8::debug::Script> script() const;
 
-  virtual v8::Local<v8::debug::Script> script() const = 0;
+  static String16 GetScriptURL(v8::Isolate* isolate,
+                               v8::Local<v8::debug::Script> script,
+                               V8InspectorClient* client);
+  static String16 GetScriptName(v8::Isolate* isolate,
+                                v8::Local<v8::debug::Script> script,
+                                V8InspectorClient* client);
+  void Initialize(v8::Local<v8::debug::Script> script);
 
   String16 m_id;
   String16 m_url;
@@ -122,6 +128,19 @@ class V8DebuggerScript {
 
   v8::Isolate* m_isolate;
   String16 m_embedderName;
+  V8DebuggerAgentImpl* m_agent;
+  String16 m_sourceMappingURL;
+  mutable String16 m_buildId;
+  Language m_language;
+  bool m_isLiveEdit = false;
+  bool m_isModule = false;
+  mutable String16 m_hash;
+  int m_startLine = 0;
+  int m_startColumn = 0;
+  int m_endLine = 0;
+  int m_endColumn = 0;
+  v8::Global<v8::debug::Script> m_script;
+  v8::Global<v8::debug::ScriptSource> m_scriptSource;
 };
 
 }  // namespace v8_inspector
diff --git a/deps/v8/src/inspector/v8-debugger.cc b/deps/v8/src/inspector/v8-debugger.cc
index bd0f9015744a10..64a95809d60d4d 100644
--- a/deps/v8/src/inspector/v8-debugger.cc
+++ b/deps/v8/src/inspector/v8-debugger.cc
@@ -176,8 +176,8 @@ std::vector<std::unique_ptr<V8DebuggerScript>> V8Debugger::getCompiledScripts(
       if (!script->ContextId().To(&contextId)) continue;
       if (m_inspector->contextGroupId(contextId) != contextGroupId) continue;
     }
-    result.push_back(V8DebuggerScript::Create(m_isolate, script, false, agent,
-                                              m_inspector->client()));
+    result.push_back(std::make_unique<V8DebuggerScript>(
+        m_isolate, script, false, agent, m_inspector->client()));
   }
   return result;
 }
@@ -613,8 +613,8 @@ void V8Debugger::ScriptCompiled(v8::Local<v8::debug::Script> script,
         auto agent = session->debuggerAgent();
         if (!agent->enabled()) return;
         agent->didParseSource(
-            V8DebuggerScript::Create(isolate, script, is_live_edited, agent,
-                                     client),
+            std::make_unique<V8DebuggerScript>(isolate, script, is_live_edited,
+                                               agent, client),
             !has_compile_error);
       });
 }
diff --git a/deps/v8/src/inspector/v8-inspector-impl.cc b/deps/v8/src/inspector/v8-inspector-impl.cc
index 8172e3a55486ab..f2091bddb37e3b 100644
--- a/deps/v8/src/inspector/v8-inspector-impl.cc
+++ b/deps/v8/src/inspector/v8-inspector-impl.cc
@@ -147,6 +147,24 @@ std::unique_ptr<V8StackTrace> V8InspectorImpl::createStackTrace(
 std::unique_ptr<V8InspectorSession> V8InspectorImpl::connect(
     int contextGroupId, V8Inspector::Channel* channel, StringView state,
     ClientTrustLevel client_trust_level, SessionPauseState pause_state) {
+  return std::unique_ptr<V8InspectorSession>(connectImpl(
+      contextGroupId, channel, state, client_trust_level, pause_state));
+}
+
+std::shared_ptr<V8InspectorSession> V8InspectorImpl::connectShared(
+    int contextGroupId, V8Inspector::Channel* channel, StringView state,
+    ClientTrustLevel client_trust_level, SessionPauseState pause_state) {
+  std::shared_ptr<V8InspectorSessionImpl> session(connectImpl(
+      contextGroupId, channel, state, client_trust_level, pause_state));
+  // TODO(crbug.com/40071155): Move to V8InspectorSessionImpl::create once the
+  // unique_ptr version is no longer required.
+  session->setWeakThis(session);
+  return session;
+}
+
+V8InspectorSessionImpl* V8InspectorImpl::connectImpl(
+    int contextGroupId, V8Inspector::Channel* channel, StringView state,
+    ClientTrustLevel client_trust_level, SessionPauseState pause_state) {
   int sessionId = ++m_lastSessionId;
   std::shared_ptr<V8DebuggerBarrier> debuggerBarrier;
   if (pause_state == kWaitingForDebugger) {
@@ -162,12 +180,11 @@ std::unique_ptr<V8InspectorSession> V8InspectorImpl::connect(
       m_debuggerBarriers.insert(it, {contextGroupId, debuggerBarrier});
     }
   }
-  std::unique_ptr<V8InspectorSessionImpl> session =
-      V8InspectorSessionImpl::create(this, contextGroupId, sessionId, channel,
-                                     state, client_trust_level,
-                                     std::move(debuggerBarrier));
-  m_sessions[contextGroupId][sessionId] = session.get();
-  return std::move(session);
+  V8InspectorSessionImpl* session = V8InspectorSessionImpl::create(
+      this, contextGroupId, sessionId, channel, state, client_trust_level,
+      std::move(debuggerBarrier));
+  m_sessions[contextGroupId][sessionId] = session;
+  return session;
 }
 
 void V8InspectorImpl::disconnect(V8InspectorSessionImpl* session) {
diff --git a/deps/v8/src/inspector/v8-inspector-impl.h b/deps/v8/src/inspector/v8-inspector-impl.h
index 514a34140a23b3..d3c617bbc5df29 100644
--- a/deps/v8/src/inspector/v8-inspector-impl.h
+++ b/deps/v8/src/inspector/v8-inspector-impl.h
@@ -85,6 +85,11 @@ class V8InspectorImpl : public V8Inspector {
                                               StringView state,
                                               ClientTrustLevel,
                                               SessionPauseState) override;
+  std::shared_ptr<V8InspectorSession> connectShared(int contextGroupId,
+                                                    V8Inspector::Channel*,
+                                                    StringView state,
+                                                    ClientTrustLevel,
+                                                    SessionPauseState) override;
   void contextCreated(const V8ContextInfo&) override;
   void contextDestroyed(v8::Local<v8::Context>) override;
   v8::MaybeLocal<v8::Context> contextById(int contextId) override;
@@ -159,6 +164,10 @@ class V8InspectorImpl : public V8Inspector {
   };
 
  private:
+  V8InspectorSessionImpl* connectImpl(int contextGroupId, V8Inspector::Channel*,
+                                      StringView state, ClientTrustLevel,
+                                      SessionPauseState);
+
   v8::Isolate* m_isolate;
   V8InspectorClient* m_client;
   std::unique_ptr<V8Debugger> m_debugger;
diff --git a/deps/v8/src/inspector/v8-inspector-session-impl.cc b/deps/v8/src/inspector/v8-inspector-session-impl.cc
index 916ddb5ebbd412..0546ea09581ece 100644
--- a/deps/v8/src/inspector/v8-inspector-session-impl.cc
+++ b/deps/v8/src/inspector/v8-inspector-session-impl.cc
@@ -90,14 +90,14 @@ int V8ContextInfo::executionContextId(v8::Local<v8::Context> context) {
   return InspectedContext::contextId(context);
 }
 
-std::unique_ptr<V8InspectorSessionImpl> V8InspectorSessionImpl::create(
+V8InspectorSessionImpl* V8InspectorSessionImpl::create(
     V8InspectorImpl* inspector, int contextGroupId, int sessionId,
     V8Inspector::Channel* channel, StringView state,
     V8Inspector::ClientTrustLevel clientTrustLevel,
     std::shared_ptr<V8DebuggerBarrier> debuggerBarrier) {
-  return std::unique_ptr<V8InspectorSessionImpl>(new V8InspectorSessionImpl(
-      inspector, contextGroupId, sessionId, channel, state, clientTrustLevel,
-      std::move(debuggerBarrier)));
+  return new V8InspectorSessionImpl(inspector, contextGroupId, sessionId,
+                                    channel, state, clientTrustLevel,
+                                    std::move(debuggerBarrier));
 }
 
 V8InspectorSessionImpl::V8InspectorSessionImpl(
@@ -359,6 +359,8 @@ void V8InspectorSessionImpl::reportAllContexts(V8RuntimeAgentImpl* agent) {
 }
 
 void V8InspectorSessionImpl::dispatchProtocolMessage(StringView message) {
+  KeepSessionAliveScope keepAlive(*this);
+
   using v8_crdtp::span;
   using v8_crdtp::SpanFrom;
   span<uint8_t> cbor;
diff --git a/deps/v8/src/inspector/v8-inspector-session-impl.h b/deps/v8/src/inspector/v8-inspector-session-impl.h
index c1add396546d25..630fc66b91d8c7 100644
--- a/deps/v8/src/inspector/v8-inspector-session-impl.h
+++ b/deps/v8/src/inspector/v8-inspector-session-impl.h
@@ -33,7 +33,7 @@ using protocol::Response;
 class V8InspectorSessionImpl : public V8InspectorSession,
                                public protocol::FrontendChannel {
  public:
-  static std::unique_ptr<V8InspectorSessionImpl> create(
+  static V8InspectorSessionImpl* create(
       V8InspectorImpl*, int contextGroupId, int sessionId,
       V8Inspector::Channel*, StringView state,
       v8_inspector::V8Inspector::ClientTrustLevel,
@@ -108,6 +108,10 @@ class V8InspectorSessionImpl : public V8InspectorSession,
     return m_clientTrustLevel;
   }
 
+  void setWeakThis(std::weak_ptr<V8InspectorSessionImpl> weakThis) {
+    m_weakThis = std::move(weakThis);
+  }
+
  private:
   V8InspectorSessionImpl(V8InspectorImpl*, int contextGroupId, int sessionId,
                          V8Inspector::Channel*, StringView state,
@@ -145,6 +149,20 @@ class V8InspectorSessionImpl : public V8InspectorSession,
       m_inspectedObjects;
   bool use_binary_protocol_ = false;
   V8Inspector::ClientTrustLevel m_clientTrustLevel = V8Inspector::kUntrusted;
+
+  // On each call to "dispatchProtocolMessage", the session turns the weakThis
+  // reference into a strong one, so nested run loops are not able to fully
+  // deconstruct the V8 session until we return from the
+  // "dispatchProtocolMessage" call (i.e. no freed "this" remains on the stack).
+  class KeepSessionAliveScope {
+   public:
+    explicit KeepSessionAliveScope(const V8InspectorSessionImpl& session)
+        : m_this(session.m_weakThis.lock()) {}
+
+   private:
+    std::shared_ptr<V8InspectorSessionImpl> m_this;
+  };
+  std::weak_ptr<V8InspectorSessionImpl> m_weakThis;
 };
 
 }  // namespace v8_inspector
diff --git a/deps/v8/src/interpreter/bytecode-array-builder.cc b/deps/v8/src/interpreter/bytecode-array-builder.cc
index 9aebaaecadafcb..c25d6714a533b1 100644
--- a/deps/v8/src/interpreter/bytecode-array-builder.cc
+++ b/deps/v8/src/interpreter/bytecode-array-builder.cc
@@ -453,6 +453,13 @@ BytecodeArrayBuilder& BytecodeArrayBuilder::BinaryOperation(Token::Value op,
   return *this;
 }
 
+BytecodeArrayBuilder& BytecodeArrayBuilder::Add_LhsIsStringConstant_Internalize(
+    Token::Value op, Register reg, int feedback_slot) {
+  DCHECK_EQ(op, Token::kAdd);
+  OutputAdd_LhsIsStringConstant_Internalize(reg, feedback_slot);
+  return *this;
+}
+
 BytecodeArrayBuilder& BytecodeArrayBuilder::BinaryOperationSmiLiteral(
     Token::Value op, Tagged<Smi> literal, int feedback_slot) {
   switch (op) {
@@ -785,18 +792,17 @@ BytecodeArrayBuilder& BytecodeArrayBuilder::LoadContextSlot(
     }
   } else {
     DCHECK_EQ(kMutableSlot, mutability);
-    if (v8_flags.script_context_mutable_heap_number &&
-        variable->scope()->is_script_scope()) {
+    if (variable->scope()->has_context_cells()) {
       if (context.is_current_context() && depth == 0) {
-        OutputLdaCurrentScriptContextSlot(slot_index);
+        OutputLdaCurrentContextSlot(slot_index);
       } else {
-        OutputLdaScriptContextSlot(context, slot_index, depth);
+        OutputLdaContextSlot(context, slot_index, depth);
       }
     } else {
       if (context.is_current_context() && depth == 0) {
-        OutputLdaCurrentContextSlot(slot_index);
+        OutputLdaCurrentContextSlotNoCell(slot_index);
       } else {
-        OutputLdaContextSlot(context, slot_index, depth);
+        OutputLdaContextSlotNoCell(context, slot_index, depth);
       }
     }
   }
@@ -807,20 +813,18 @@ BytecodeArrayBuilder& BytecodeArrayBuilder::StoreContextSlot(Register context,
                                                              Variable* variable,
                                                              int depth) {
   int slot_index = variable->index();
-  if ((v8_flags.script_context_mutable_heap_number ||
-       (v8_flags.const_tracking_let &&
-        variable->mode() == VariableMode::kLet)) &&
-      variable->scope()->is_script_scope()) {
+  if (variable->mode() != VariableMode::kConst &&
+      variable->scope()->has_context_cells()) {
     if (context.is_current_context() && depth == 0) {
-      OutputStaCurrentScriptContextSlot(slot_index);
+      OutputStaCurrentContextSlot(slot_index);
     } else {
-      OutputStaScriptContextSlot(context, slot_index, depth);
+      OutputStaContextSlot(context, slot_index, depth);
     }
   } else {
     if (context.is_current_context() && depth == 0) {
-      OutputStaCurrentContextSlot(slot_index);
+      OutputStaCurrentContextSlotNoCell(slot_index);
     } else {
-      OutputStaContextSlot(context, slot_index, depth);
+      OutputStaContextSlotNoCell(context, slot_index, depth);
     }
   }
   return *this;
@@ -841,25 +845,23 @@ BytecodeArrayBuilder& BytecodeArrayBuilder::LoadLookupSlot(
 }
 
 BytecodeArrayBuilder& BytecodeArrayBuilder::LoadLookupContextSlot(
-    const AstRawString* name, TypeofMode typeof_mode, ContextKind context_kind,
+    const AstRawString* name, TypeofMode typeof_mode, ContextMode context_mode,
     int slot_index, int depth) {
   size_t name_index = GetConstantPoolEntry(name);
   switch (typeof_mode) {
     case TypeofMode::kInside:
-      if (v8_flags.script_context_mutable_heap_number &&
-          context_kind == ContextKind::kScriptContext) {
-        OutputLdaLookupScriptContextSlotInsideTypeof(name_index, slot_index,
-                                                     depth);
-      } else {
+      if (context_mode == ContextMode::kHasContextCells) {
         OutputLdaLookupContextSlotInsideTypeof(name_index, slot_index, depth);
+      } else {
+        OutputLdaLookupContextSlotNoCellInsideTypeof(name_index, slot_index,
+                                                     depth);
       }
       break;
     case TypeofMode::kNotInside:
-      if (v8_flags.script_context_mutable_heap_number &&
-          context_kind == ContextKind::kScriptContext) {
-        OutputLdaLookupScriptContextSlot(name_index, slot_index, depth);
-      } else {
+      if (context_mode == ContextMode::kHasContextCells) {
         OutputLdaLookupContextSlot(name_index, slot_index, depth);
+      } else {
+        OutputLdaLookupContextSlotNoCell(name_index, slot_index, depth);
       }
       break;
   }
diff --git a/deps/v8/src/interpreter/bytecode-array-builder.h b/deps/v8/src/interpreter/bytecode-array-builder.h
index 612c0923f9904a..8791b476964fb3 100644
--- a/deps/v8/src/interpreter/bytecode-array-builder.h
+++ b/deps/v8/src/interpreter/bytecode-array-builder.h
@@ -228,7 +228,7 @@ class V8_EXPORT_PRIVATE BytecodeArrayBuilder final {
   // somewhere in that context chain.
   BytecodeArrayBuilder& LoadLookupContextSlot(const AstRawString* name,
                                               TypeofMode typeof_mode,
-                                              ContextKind context_kind,
+                                              ContextMode context_mode,
                                               int slot_index, int depth);
 
   // Lookup the variable with |name|, which has its feedback in |feedback_slot|
@@ -376,6 +376,9 @@ class V8_EXPORT_PRIVATE BytecodeArrayBuilder final {
   // Type feedback will be recorded in the |feedback_slot|
   BytecodeArrayBuilder& BinaryOperation(Token::Value binop, Register reg,
                                         int feedback_slot);
+  BytecodeArrayBuilder& Add_LhsIsStringConstant_Internalize(Token::Value binop,
+                                                            Register reg,
+                                                            int feedback_slot);
   // Same as above, but lhs in the accumulator and rhs in |literal|.
   BytecodeArrayBuilder& BinaryOperationSmiLiteral(Token::Value binop,
                                                   Tagged<Smi> literal,
@@ -529,8 +532,8 @@ class V8_EXPORT_PRIVATE BytecodeArrayBuilder final {
 
   void InitializeReturnPosition(FunctionLiteral* literal);
 
-  void SetStatementPosition(Statement* stmt) {
-    SetStatementPosition(stmt->position());
+  void SetStatementPosition(Statement* stmt, bool is_breakable = true) {
+    SetStatementPosition(stmt->position(), is_breakable);
   }
 
   std::optional<BytecodeSourceInfo> MaybePopSourcePosition(int scope_start) {
@@ -548,9 +551,9 @@ class V8_EXPORT_PRIVATE BytecodeArrayBuilder final {
     latest_source_info_ = source_info;
   }
 
-  void SetStatementPosition(int position) {
+  void SetStatementPosition(int position, bool is_breakable = true) {
     if (position == kNoSourcePosition) return;
-    latest_source_info_.MakeStatementPosition(position);
+    latest_source_info_.MakeStatementPosition(position, is_breakable);
   }
 
   void SetExpressionPosition(Expression* expr) {
@@ -566,8 +569,9 @@ class V8_EXPORT_PRIVATE BytecodeArrayBuilder final {
     }
   }
 
-  void SetExpressionAsStatementPosition(Expression* expr) {
-    SetStatementPosition(expr->position());
+  void SetExpressionAsStatementPosition(Expression* expr,
+                                        bool is_breakable = true) {
+    SetStatementPosition(expr->position(), is_breakable);
   }
 
   bool RemainderOfBlockIsDead() const {
diff --git a/deps/v8/src/interpreter/bytecode-array-writer.cc b/deps/v8/src/interpreter/bytecode-array-writer.cc
index 6805de5fb9accd..176207874a4dcb 100644
--- a/deps/v8/src/interpreter/bytecode-array-writer.cc
+++ b/deps/v8/src/interpreter/bytecode-array-writer.cc
@@ -226,7 +226,7 @@ void BytecodeArrayWriter::UpdateSourcePositionTable(
   if (source_info.is_valid()) {
     source_position_table_builder()->AddPosition(
         bytecode_offset, SourcePosition(source_info.source_position()),
-        source_info.is_statement());
+        source_info.is_statement(), source_info.is_breakable());
   }
 }
 
diff --git a/deps/v8/src/interpreter/bytecode-generator.cc b/deps/v8/src/interpreter/bytecode-generator.cc
index a7e07e7fc8ce6c..9c24e1e8417b94 100644
--- a/deps/v8/src/interpreter/bytecode-generator.cc
+++ b/deps/v8/src/interpreter/bytecode-generator.cc
@@ -704,7 +704,17 @@ class V8_NODISCARD BytecodeGenerator::AccumulatorPreservingScope final {
 // used.
 class V8_NODISCARD BytecodeGenerator::ExpressionResultScope {
  public:
-  ExpressionResultScope(BytecodeGenerator* generator, Expression::Context kind)
+  enum Kind : uint8_t {
+    // Evaluated for its side effects.
+    kEffect,
+    // Evaluated for its value (and side effects).
+    kValue,
+    kValueAsPropertyKey,
+    // Evaluated for control flow (and side effects).
+    kTest,
+  };
+
+  ExpressionResultScope(BytecodeGenerator* generator, Kind kind)
       : outer_(generator->execution_result()),
         allocator_(generator),
         kind_(kind),
@@ -719,9 +729,10 @@ class V8_NODISCARD BytecodeGenerator::ExpressionResultScope {
   ExpressionResultScope(const ExpressionResultScope&) = delete;
   ExpressionResultScope& operator=(const ExpressionResultScope&) = delete;
 
-  bool IsEffect() const { return kind_ == Expression::kEffect; }
-  bool IsValue() const { return kind_ == Expression::kValue; }
-  bool IsTest() const { return kind_ == Expression::kTest; }
+  bool IsEffect() const { return kind_ == kEffect; }
+  bool IsValue() const { return kind_ == kValue; }
+  bool IsValueAsPropertyKey() const { return kind_ == kValueAsPropertyKey; }
+  bool IsTest() const { return kind_ == kTest; }
 
   TestResultScope* AsTest() {
     DCHECK(IsTest());
@@ -749,7 +760,7 @@ class V8_NODISCARD BytecodeGenerator::ExpressionResultScope {
  private:
   ExpressionResultScope* outer_;
   RegisterAllocationScope allocator_;
-  Expression::Context kind_;
+  Kind kind_;
   TypeHint type_hint_;
 };
 
@@ -759,7 +770,7 @@ class BytecodeGenerator::EffectResultScope final
     : public ExpressionResultScope {
  public:
   explicit EffectResultScope(BytecodeGenerator* generator)
-      : ExpressionResultScope(generator, Expression::kEffect) {}
+      : ExpressionResultScope(generator, kEffect) {}
 };
 
 // Scoped class used when the result of the current expression to be
@@ -768,7 +779,11 @@ class V8_NODISCARD BytecodeGenerator::ValueResultScope final
     : public ExpressionResultScope {
  public:
   explicit ValueResultScope(BytecodeGenerator* generator)
-      : ExpressionResultScope(generator, Expression::kValue) {}
+      : ValueResultScope(generator, kValue) {}
+  ValueResultScope(BytecodeGenerator* generator, Kind kind)
+      : ExpressionResultScope(generator, kind) {
+    DCHECK(kind == kValue || kind == kValueAsPropertyKey);
+  }
 };
 
 // Scoped class used when the result of the current expression to be
@@ -778,7 +793,7 @@ class V8_NODISCARD BytecodeGenerator::TestResultScope final
  public:
   TestResultScope(BytecodeGenerator* generator, BytecodeLabels* then_labels,
                   BytecodeLabels* else_labels, TestFallthrough fallthrough)
-      : ExpressionResultScope(generator, Expression::kTest),
+      : ExpressionResultScope(generator, kTest),
         result_consumed_by_test_(false),
         fallthrough_(fallthrough),
         then_labels_(then_labels),
@@ -4523,11 +4538,12 @@ void BytecodeGenerator::BuildVariableLoad(Variable* variable,
           Variable* local_variable = variable->local_if_not_shadowed();
           int depth =
               execution_context()->ContextChainDepth(local_variable->scope());
-          ContextKind context_kind = (local_variable->scope()->is_script_scope()
-                                          ? ContextKind::kScriptContext
-                                          : ContextKind::kDefault);
+          ContextMode context_mode =
+              (local_variable->scope()->has_context_cells()
+                   ? ContextMode::kHasContextCells
+                   : ContextMode::kNoContextCells);
           builder()->LoadLookupContextSlot(variable->raw_name(), typeof_mode,
-                                           context_kind,
+                                           context_mode,
                                            local_variable->index(), depth);
           if (VariableNeedsHoleCheckInCurrentBlock(local_variable,
                                                    hole_check_mode)) {
@@ -4688,6 +4704,22 @@ void BytecodeGenerator::BuildHoleCheckForVariableAssignment(Variable* variable,
   }
 }
 
+void BytecodeGenerator::AddDisposableValue(VariableMode mode) {
+  if (mode == VariableMode::kUsing) {
+    RegisterList args = register_allocator()->NewRegisterList(2);
+    builder()
+        ->MoveRegister(current_disposables_stack(), args[0])
+        .StoreAccumulatorInRegister(args[1])
+        .CallRuntime(Runtime::kAddDisposableValue, args);
+  } else if (mode == VariableMode::kAwaitUsing) {
+    RegisterList args = register_allocator()->NewRegisterList(2);
+    builder()
+        ->MoveRegister(current_disposables_stack(), args[0])
+        .StoreAccumulatorInRegister(args[1])
+        .CallRuntime(Runtime::kAddAsyncDisposableValue, args);
+  }
+}
+
 void BytecodeGenerator::BuildVariableAssignment(
     Variable* variable, Token::Value op, HoleCheckMode hole_check_mode,
     LookupHoistingMode lookup_hoisting_mode) {
@@ -4727,19 +4759,7 @@ void BytecodeGenerator::BuildVariableAssignment(
             // elide subsequent checks.
             RememberHoleCheckInCurrentBlock(variable);
           }
-          if (mode == VariableMode::kUsing) {
-            RegisterList args = register_allocator()->NewRegisterList(2);
-            builder()
-                ->MoveRegister(current_disposables_stack(), args[0])
-                .StoreAccumulatorInRegister(args[1])
-                .CallRuntime(Runtime::kAddDisposableValue, args);
-          } else if (mode == VariableMode::kAwaitUsing) {
-            RegisterList args = register_allocator()->NewRegisterList(2);
-            builder()
-                ->MoveRegister(current_disposables_stack(), args[0])
-                .StoreAccumulatorInRegister(args[1])
-                .CallRuntime(Runtime::kAddAsyncDisposableValue, args);
-          }
+          AddDisposableValue(mode);
         }
         builder()->StoreAccumulatorInRegister(destination);
       } else if (variable->throw_on_const_assignment(language_mode()) &&
@@ -4780,12 +4800,16 @@ void BytecodeGenerator::BuildVariableAssignment(
         builder()->LoadAccumulatorWithRegister(value_temp);
       }
 
-      if (mode != VariableMode::kConst || op == Token::kInit) {
-        if (op == Token::kInit &&
-            variable->HasHoleCheckUseInSameClosureScope()) {
-          // After initializing a variable it won't be the hole anymore, so
-          // elide subsequent checks.
-          RememberHoleCheckInCurrentBlock(variable);
+      if ((mode != VariableMode::kConst && mode != VariableMode::kUsing &&
+           mode != VariableMode::kAwaitUsing) ||
+          op == Token::kInit) {
+        if (op == Token::kInit) {
+          if (variable->HasHoleCheckUseInSameClosureScope()) {
+            // After initializing a variable it won't be the hole anymore, so
+            // elide subsequent checks.
+            RememberHoleCheckInCurrentBlock(variable);
+          }
+          AddDisposableValue(mode);
         }
         builder()->StoreContextSlot(context_reg, variable, depth);
       } else if (variable->throw_on_const_assignment(language_mode())) {
@@ -6157,7 +6181,7 @@ void BytecodeGenerator::VisitPropertyLoad(Register obj, Property* property) {
       break;
     }
     case KEYED_PROPERTY: {
-      VisitForAccumulatorValue(property->key());
+      VisitForAccumulatorValueAsPropertyKey(property->key());
       builder()->SetExpressionPosition(property);
       BuildLoadKeyedProperty(obj, feedback_spec()->AddKeyedLoadICSlot());
       break;
@@ -7510,7 +7534,26 @@ void BytecodeGenerator::VisitCompareOperation(CompareOperation* expr) {
 }
 
 void BytecodeGenerator::VisitArithmeticExpression(BinaryOperation* expr) {
-  FeedbackSlot slot = feedback_spec()->AddBinaryOpICSlot();
+  FeedbackSlot slot;
+
+  // We special-case string concatenation when the result is used as a property
+  // key. In this case, we know it will eventually be internalized and it's
+  // better to do so early.
+  //
+  // For now, we handle only the specialized situation in which lhs is a string
+  // constant.
+  // TODO(jgruber): Generalize. ConsString literals, rhs-as-literal,
+  // property-key but no string-literal, string-literal but no property-key.
+  const bool emit_add_lhs_is_string_constant_internalize =
+      expr->op() == Token::kAdd && execution_result()->IsValueAsPropertyKey() &&
+      expr->left()->IsLiteral() && expr->left()->AsLiteral()->IsRawString() &&
+      v8_flags.cache_property_key_string_adds;
+  if (emit_add_lhs_is_string_constant_internalize) {
+    slot = feedback_spec()->AddStringAddAndInternalizeICSlot();
+  } else {
+    slot = feedback_spec()->AddBinaryOpICSlot();
+  }
+
   Expression* subexpr;
   Tagged<Smi> literal;
   if (expr->IsSmiLiteralOperation(&subexpr, &literal)) {
@@ -7531,8 +7574,15 @@ void BytecodeGenerator::VisitArithmeticExpression(BinaryOperation* expr) {
       execution_result()->SetResultIsString();
     }
 
-    builder()->SetExpressionPosition(expr);
-    builder()->BinaryOperation(expr->op(), lhs, feedback_index(slot));
+    if (emit_add_lhs_is_string_constant_internalize) {
+      DCHECK(IsStringTypeHint(lhs_type));
+      builder()->SetExpressionPosition(expr);
+      builder()->Add_LhsIsStringConstant_Internalize(expr->op(), lhs,
+                                                     feedback_index(slot));
+    } else {
+      builder()->SetExpressionPosition(expr);
+      builder()->BinaryOperation(expr->op(), lhs, feedback_index(slot));
+    }
   }
 }
 
@@ -8375,9 +8425,21 @@ void BytecodeGenerator::BuildIncrementBlockCoverageCounterIfEnabled(
 BytecodeGenerator::TypeHint BytecodeGenerator::VisitForAccumulatorValue(
     Expression* expr) {
   ValueResultScope accumulator_scope(this);
+  return VisitForAccumulatorValueImpl(expr, &accumulator_scope);
+}
+
+BytecodeGenerator::TypeHint
+BytecodeGenerator::VisitForAccumulatorValueAsPropertyKey(Expression* expr) {
+  ValueResultScope accumulator_scope(this,
+                                     ValueResultScope::kValueAsPropertyKey);
+  return VisitForAccumulatorValueImpl(expr, &accumulator_scope);
+}
+
+BytecodeGenerator::TypeHint BytecodeGenerator::VisitForAccumulatorValueImpl(
+    Expression* expr, ValueResultScope* accumulator_scope) {
   Visit(expr);
   // Record the type hint for the result of current expression in accumulator.
-  const TypeHint type_hint = accumulator_scope.type_hint();
+  const TypeHint type_hint = accumulator_scope->type_hint();
   BytecodeRegisterOptimizer* optimizer = builder()->GetRegisterOptimizer();
   if (optimizer && type_hint != TypeHint::kUnknown) {
     optimizer->SetTypeHintForAccumulator(type_hint);
diff --git a/deps/v8/src/interpreter/bytecode-generator.h b/deps/v8/src/interpreter/bytecode-generator.h
index ac35c58727bf49..5396c57a02b24d 100644
--- a/deps/v8/src/interpreter/bytecode-generator.h
+++ b/deps/v8/src/interpreter/bytecode-generator.h
@@ -294,6 +294,7 @@ class BytecodeGenerator final : public AstVisitor<BytecodeGenerator> {
 
   Variable* GetPotentialVariableInAccumulator();
 
+  void AddDisposableValue(VariableMode mode);
   void BuildVariableLoad(Variable* variable, HoleCheckMode hole_check_mode,
                          TypeofMode typeof_mode = TypeofMode::kNotInside);
   void BuildVariableLoadForAccumulatorValue(
@@ -471,6 +472,9 @@ class BytecodeGenerator final : public AstVisitor<BytecodeGenerator> {
   // register, or just getting the effect. Some visitors return a TypeHint which
   // specifies the type of the result of the visited expression.
   TypeHint VisitForAccumulatorValue(Expression* expr);
+  TypeHint VisitForAccumulatorValueAsPropertyKey(Expression* expr);
+  TypeHint VisitForAccumulatorValueImpl(Expression* expr,
+                                        ValueResultScope* accumulator_scope);
   void VisitForAccumulatorValueOrTheHole(Expression* expr);
   V8_WARN_UNUSED_RESULT Register VisitForRegisterValue(Expression* expr);
   V8_INLINE void VisitForRegisterValue(Expression* expr, Register destination);
diff --git a/deps/v8/src/interpreter/bytecode-source-info.h b/deps/v8/src/interpreter/bytecode-source-info.h
index 40dd49460f3cfd..93a017c6005e7d 100644
--- a/deps/v8/src/interpreter/bytecode-source-info.h
+++ b/deps/v8/src/interpreter/bytecode-source-info.h
@@ -18,17 +18,20 @@ class BytecodeSourceInfo final {
 
   BytecodeSourceInfo()
       : position_type_(PositionType::kNone),
-        source_position_(kUninitializedPosition) {}
+        source_position_(kUninitializedPosition),
+        is_breakable_(true) {}
 
-  BytecodeSourceInfo(int source_position, bool is_statement)
+  BytecodeSourceInfo(int source_position, bool is_statement,
+                     bool is_breakable = true)
       : position_type_(is_statement ? PositionType::kStatement
                                     : PositionType::kExpression),
-        source_position_(source_position) {
+        source_position_(source_position),
+        is_breakable_(is_breakable) {
     DCHECK_GE(source_position, 0);
   }
 
   // Makes instance into a statement position.
-  void MakeStatementPosition(int source_position) {
+  void MakeStatementPosition(int source_position, bool is_breakable = true) {
     // Statement positions can be replaced by other statement
     // positions. For example , "for (x = 0; x < 3; ++x) 7;" has a
     // statement position associated with 7 but no bytecode associated
@@ -36,6 +39,7 @@ class BytecodeSourceInfo final {
     // statement position and overrides the existing one.
     position_type_ = PositionType::kStatement;
     source_position_ = source_position;
+    is_breakable_ = is_breakable;
   }
 
   // Makes instance into an expression position. Instance should not
@@ -45,6 +49,7 @@ class BytecodeSourceInfo final {
     DCHECK(!is_statement());
     position_type_ = PositionType::kExpression;
     source_position_ = source_position;
+    is_breakable_ = true;
   }
 
   // Forces an instance into an expression position.
@@ -71,6 +76,8 @@ class BytecodeSourceInfo final {
     source_position_ = kUninitializedPosition;
   }
 
+  bool is_breakable() const { return is_breakable_; }
+
   bool operator==(const BytecodeSourceInfo& other) const {
     return position_type_ == other.position_type_ &&
            source_position_ == other.source_position_;
@@ -86,6 +93,7 @@ class BytecodeSourceInfo final {
 
   PositionType position_type_;
   int source_position_;
+  bool is_breakable_;
 };
 
 V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream& os,
diff --git a/deps/v8/src/interpreter/bytecodes.cc b/deps/v8/src/interpreter/bytecodes.cc
index 8da7b02b40ebdb..d75bccc1befb33 100644
--- a/deps/v8/src/interpreter/bytecodes.cc
+++ b/deps/v8/src/interpreter/bytecodes.cc
@@ -274,9 +274,9 @@ bool Bytecodes::IsStarLookahead(Bytecode bytecode, OperandScale operand_scale) {
       case Bytecode::kLdaGlobal:
       case Bytecode::kGetNamedProperty:
       case Bytecode::kGetKeyedProperty:
-      case Bytecode::kLdaContextSlot:
+      case Bytecode::kLdaContextSlotNoCell:
       case Bytecode::kLdaImmutableContextSlot:
-      case Bytecode::kLdaCurrentContextSlot:
+      case Bytecode::kLdaCurrentContextSlotNoCell:
       case Bytecode::kLdaImmutableCurrentContextSlot:
       case Bytecode::kAdd:
       case Bytecode::kSub:
diff --git a/deps/v8/src/interpreter/bytecodes.h b/deps/v8/src/interpreter/bytecodes.h
index 44cd83ed1eaede..706aa75b594f66 100644
--- a/deps/v8/src/interpreter/bytecodes.h
+++ b/deps/v8/src/interpreter/bytecodes.h
@@ -82,15 +82,15 @@ namespace interpreter {
   V(LdaTrue, ImplicitRegisterUse::kWriteAccumulator)                           \
   V(LdaFalse, ImplicitRegisterUse::kWriteAccumulator)                          \
   V(LdaConstant, ImplicitRegisterUse::kWriteAccumulator, OperandType::kIdx)    \
+  V(LdaContextSlotNoCell, ImplicitRegisterUse::kWriteAccumulator,              \
+    OperandType::kReg, OperandType::kIdx, OperandType::kUImm)                  \
   V(LdaContextSlot, ImplicitRegisterUse::kWriteAccumulator, OperandType::kReg, \
     OperandType::kIdx, OperandType::kUImm)                                     \
-  V(LdaScriptContextSlot, ImplicitRegisterUse::kWriteAccumulator,              \
-    OperandType::kReg, OperandType::kIdx, OperandType::kUImm)                  \
   V(LdaImmutableContextSlot, ImplicitRegisterUse::kWriteAccumulator,           \
     OperandType::kReg, OperandType::kIdx, OperandType::kUImm)                  \
-  V(LdaCurrentContextSlot, ImplicitRegisterUse::kWriteAccumulator,             \
+  V(LdaCurrentContextSlotNoCell, ImplicitRegisterUse::kWriteAccumulator,       \
     OperandType::kIdx)                                                         \
-  V(LdaCurrentScriptContextSlot, ImplicitRegisterUse::kWriteAccumulator,       \
+  V(LdaCurrentContextSlot, ImplicitRegisterUse::kWriteAccumulator,             \
     OperandType::kIdx)                                                         \
   V(LdaImmutableCurrentContextSlot, ImplicitRegisterUse::kWriteAccumulator,    \
     OperandType::kIdx)                                                         \
@@ -117,30 +117,30 @@ namespace interpreter {
     OperandType::kIdx, OperandType::kIdx)                                      \
                                                                                \
   /* Context operations */                                                     \
+  V(StaContextSlotNoCell, ImplicitRegisterUse::kReadAccumulator,               \
+    OperandType::kReg, OperandType::kIdx, OperandType::kUImm)                  \
+  V(StaCurrentContextSlotNoCell, ImplicitRegisterUse::kReadAccumulator,        \
+    OperandType::kIdx)                                                         \
   V(StaContextSlot, ImplicitRegisterUse::kReadAccumulator, OperandType::kReg,  \
     OperandType::kIdx, OperandType::kUImm)                                     \
   V(StaCurrentContextSlot, ImplicitRegisterUse::kReadAccumulator,              \
-    OperandType::kIdx)                                                         \
-  V(StaScriptContextSlot, ImplicitRegisterUse::kReadAccumulator,               \
-    OperandType::kReg, OperandType::kIdx, OperandType::kUImm)                  \
-  V(StaCurrentScriptContextSlot, ImplicitRegisterUse::kReadAccumulator,        \
     OperandType::kIdx)                                                         \
                                                                                \
   /* Load-Store lookup slots */                                                \
   V(LdaLookupSlot, ImplicitRegisterUse::kWriteAccumulator, OperandType::kIdx)  \
-  V(LdaLookupContextSlot, ImplicitRegisterUse::kWriteAccumulator,              \
+  V(LdaLookupContextSlotNoCell, ImplicitRegisterUse::kWriteAccumulator,        \
     OperandType::kIdx, OperandType::kIdx, OperandType::kUImm)                  \
-  V(LdaLookupScriptContextSlot, ImplicitRegisterUse::kWriteAccumulator,        \
+  V(LdaLookupContextSlot, ImplicitRegisterUse::kWriteAccumulator,              \
     OperandType::kIdx, OperandType::kIdx, OperandType::kUImm)                  \
   V(LdaLookupGlobalSlot, ImplicitRegisterUse::kWriteAccumulator,               \
     OperandType::kIdx, OperandType::kIdx, OperandType::kUImm)                  \
   V(LdaLookupSlotInsideTypeof, ImplicitRegisterUse::kWriteAccumulator,         \
     OperandType::kIdx)                                                         \
-  V(LdaLookupContextSlotInsideTypeof, ImplicitRegisterUse::kWriteAccumulator,  \
-    OperandType::kIdx, OperandType::kIdx, OperandType::kUImm)                  \
-  V(LdaLookupScriptContextSlotInsideTypeof,                                    \
+  V(LdaLookupContextSlotNoCellInsideTypeof,                                    \
     ImplicitRegisterUse::kWriteAccumulator, OperandType::kIdx,                 \
     OperandType::kIdx, OperandType::kUImm)                                     \
+  V(LdaLookupContextSlotInsideTypeof, ImplicitRegisterUse::kWriteAccumulator,  \
+    OperandType::kIdx, OperandType::kIdx, OperandType::kUImm)                  \
   V(LdaLookupGlobalSlotInsideTypeof, ImplicitRegisterUse::kWriteAccumulator,   \
     OperandType::kIdx, OperandType::kIdx, OperandType::kUImm)                  \
   V(StaLookupSlot, ImplicitRegisterUse::kReadWriteAccumulator,                 \
@@ -205,6 +205,11 @@ namespace interpreter {
   V(ShiftRightLogical, ImplicitRegisterUse::kReadWriteAccumulator,             \
     OperandType::kReg, OperandType::kIdx)                                      \
                                                                                \
+  /* Specialized binary operators. */                                          \
+  V(Add_LhsIsStringConstant_Internalize,                                       \
+    ImplicitRegisterUse::kReadWriteAccumulator, OperandType::kReg,             \
+    OperandType::kIdx)                                                         \
+                                                                               \
   /* Binary operators with immediate operands */                               \
   V(AddSmi, ImplicitRegisterUse::kReadWriteAccumulator, OperandType::kImm,     \
     OperandType::kIdx)                                                         \
diff --git a/deps/v8/src/interpreter/interpreter-assembler.cc b/deps/v8/src/interpreter/interpreter-assembler.cc
index e224856d701df2..7663e896d3a94e 100644
--- a/deps/v8/src/interpreter/interpreter-assembler.cc
+++ b/deps/v8/src/interpreter/interpreter-assembler.cc
@@ -199,8 +199,8 @@ TNode<Context> InterpreterAssembler::GetContextAtDepth(TNode<Context> context,
   BIND(&context_search);
   {
     cur_depth = Unsigned(Int32Sub(cur_depth.value(), Int32Constant(1)));
-    cur_context =
-        CAST(LoadContextElement(cur_context.value(), Context::PREVIOUS_INDEX));
+    cur_context = CAST(
+        LoadContextElementNoCell(cur_context.value(), Context::PREVIOUS_INDEX));
 
     Branch(Word32Equal(cur_depth.value(), Int32Constant(0)), &context_found,
            &context_search);
@@ -1415,7 +1415,8 @@ void InterpreterAssembler::OnStackReplacement(
   // 3) Presence of cached OSR Sparkplug code.
 
   TVARIABLE(Object, maybe_target_code, SmiConstant(0));
-  Label osr_to_opt(this), osr_to_sparkplug(this);
+  Label baseline(this), maybe_osr_to_opt(this), osr_to_opt(this),
+      osr_to_sparkplug(this);
 
   // Case 1).
   {
@@ -1444,8 +1445,20 @@ void InterpreterAssembler::OnStackReplacement(
     static_assert(FeedbackVector::OsrUrgencyBits::kShift == 0);
     TNode<Int32T> osr_urgency = Word32And(
         osr_state, Int32Constant(FeedbackVector::OsrUrgencyBits::kMask));
-    GotoIf(Uint32LessThan(loop_depth, osr_urgency), &osr_to_opt);
+    GotoIf(Uint32LessThan(loop_depth, osr_urgency), &maybe_osr_to_opt);
+    Goto(&baseline);
 
+    BIND(&maybe_osr_to_opt);
+    {
+      TNode<Uint16T> flags = LoadObjectField<Uint16T>(
+          feedback_vector, FeedbackVector::kFlagsOffset);
+      TNode<Word32T> in_progress = Word32And(
+          flags, Int32Constant(FeedbackVector::OsrTieringInProgressBit::kMask));
+      GotoIf(Word32Equal(in_progress, 0), &osr_to_opt);
+      Goto(&baseline);
+    }
+
+    BIND(&baseline);
     // Case 3).
     if (params == OnStackReplacementParams::kBaselineCodeIsCached) {
       Goto(&osr_to_sparkplug);
diff --git a/deps/v8/src/interpreter/interpreter-generator.cc b/deps/v8/src/interpreter/interpreter-generator.cc
index 4885a75fa7b10a..a842f44af84bc2 100644
--- a/deps/v8/src/interpreter/interpreter-generator.cc
+++ b/deps/v8/src/interpreter/interpreter-generator.cc
@@ -253,30 +253,30 @@ IGNITION_HANDLER(StaGlobal, InterpreterAssembler) {
   Dispatch();
 }
 
-// LdaContextSlot <context> <slot_index> <depth>
+// LdaContextSlotNoCell <context> <slot_index> <depth>
 //
 // Load the object in |slot_index| of the context at |depth| in the context
 // chain starting at |context| into the accumulator.
-IGNITION_HANDLER(LdaContextSlot, InterpreterAssembler) {
+IGNITION_HANDLER(LdaContextSlotNoCell, InterpreterAssembler) {
   TNode<Context> context = CAST(LoadRegisterAtOperandIndex(0));
   TNode<IntPtrT> slot_index = Signed(BytecodeOperandIdx(1));
   TNode<Uint32T> depth = BytecodeOperandUImm(2);
   TNode<Context> slot_context = GetContextAtDepth(context, depth);
-  TNode<Object> result = LoadContextElement(slot_context, slot_index);
+  TNode<Object> result = LoadContextElementNoCell(slot_context, slot_index);
   SetAccumulator(result);
   Dispatch();
 }
 
-// LdaScriptContextSlot <context> <slot_index> <depth>
+// LdaContextSlot <context> <slot_index> <depth>
 //
 // Load the object in |slot_index| of the context at |depth| in the context
 // chain starting at |context| into the accumulator.
-IGNITION_HANDLER(LdaScriptContextSlot, InterpreterAssembler) {
+IGNITION_HANDLER(LdaContextSlot, InterpreterAssembler) {
   TNode<Context> context = CAST(LoadRegisterAtOperandIndex(0));
   TNode<IntPtrT> slot_index = Signed(BytecodeOperandIdx(1));
   TNode<Uint32T> depth = BytecodeOperandUImm(2);
   TNode<Context> slot_context = GetContextAtDepth(context, depth);
-  TNode<Object> result = LoadScriptContextElement(slot_context, slot_index);
+  TNode<Object> result = LoadContextElement(slot_context, slot_index);
   SetAccumulator(result);
   Dispatch();
 }
@@ -290,29 +290,29 @@ IGNITION_HANDLER(LdaImmutableContextSlot, InterpreterAssembler) {
   TNode<IntPtrT> slot_index = Signed(BytecodeOperandIdx(1));
   TNode<Uint32T> depth = BytecodeOperandUImm(2);
   TNode<Context> slot_context = GetContextAtDepth(context, depth);
-  TNode<Object> result = LoadContextElement(slot_context, slot_index);
+  TNode<Object> result = LoadContextElementNoCell(slot_context, slot_index);
   SetAccumulator(result);
   Dispatch();
 }
 
-// LdaCurrentContextSlot <slot_index>
+// LdaCurrentContextSlotNoCell <slot_index>
 //
 // Load the object in |slot_index| of the current context into the accumulator.
-IGNITION_HANDLER(LdaCurrentContextSlot, InterpreterAssembler) {
+IGNITION_HANDLER(LdaCurrentContextSlotNoCell, InterpreterAssembler) {
   TNode<IntPtrT> slot_index = Signed(BytecodeOperandIdx(0));
   TNode<Context> slot_context = GetContext();
-  TNode<Object> result = LoadContextElement(slot_context, slot_index);
+  TNode<Object> result = LoadContextElementNoCell(slot_context, slot_index);
   SetAccumulator(result);
   Dispatch();
 }
 
-// LdaCurrentScriptContextSlot <slot_index>
+// LdaCurrentContextSlot <slot_index>
 //
 // Load the object in |slot_index| of the current context into the accumulator.
-IGNITION_HANDLER(LdaCurrentScriptContextSlot, InterpreterAssembler) {
+IGNITION_HANDLER(LdaCurrentContextSlot, InterpreterAssembler) {
   TNode<IntPtrT> slot_index = Signed(BytecodeOperandIdx(0));
   TNode<Context> slot_context = GetContext();
-  TNode<Object> result = LoadScriptContextElement(slot_context, slot_index);
+  TNode<Object> result = LoadContextElement(slot_context, slot_index);
   SetAccumulator(result);
   Dispatch();
 }
@@ -323,60 +323,60 @@ IGNITION_HANDLER(LdaCurrentScriptContextSlot, InterpreterAssembler) {
 IGNITION_HANDLER(LdaImmutableCurrentContextSlot, InterpreterAssembler) {
   TNode<IntPtrT> slot_index = Signed(BytecodeOperandIdx(0));
   TNode<Context> slot_context = GetContext();
-  TNode<Object> result = LoadContextElement(slot_context, slot_index);
+  TNode<Object> result = LoadContextElementNoCell(slot_context, slot_index);
   SetAccumulator(result);
   Dispatch();
 }
 
-// StaContextSlot <context> <slot_index> <depth>
+// StaContextSlotNoCell <context> <slot_index> <depth>
 //
 // Stores the object in the accumulator into |slot_index| of the context at
 // |depth| in the context chain starting at |context|.
-IGNITION_HANDLER(StaContextSlot, InterpreterAssembler) {
+IGNITION_HANDLER(StaContextSlotNoCell, InterpreterAssembler) {
   TNode<Object> value = GetAccumulator();
   TNode<Context> context = CAST(LoadRegisterAtOperandIndex(0));
   TNode<IntPtrT> slot_index = Signed(BytecodeOperandIdx(1));
   TNode<Uint32T> depth = BytecodeOperandUImm(2);
   TNode<Context> slot_context = GetContextAtDepth(context, depth);
-  StoreContextElement(slot_context, slot_index, value);
+  StoreContextElementNoCell(slot_context, slot_index, value);
   Dispatch();
 }
 
-// StaCurrentContextSlot <slot_index>
+// StaCurrentContextSlotNoCell <slot_index>
 //
 // Stores the object in the accumulator into |slot_index| of the current
 // context.
-IGNITION_HANDLER(StaCurrentContextSlot, InterpreterAssembler) {
+IGNITION_HANDLER(StaCurrentContextSlotNoCell, InterpreterAssembler) {
   TNode<Object> value = GetAccumulator();
   TNode<IntPtrT> slot_index = Signed(BytecodeOperandIdx(0));
   TNode<Context> slot_context = GetContext();
-  StoreContextElement(slot_context, slot_index, value);
+  StoreContextElementNoCell(slot_context, slot_index, value);
   Dispatch();
 }
 
-// StaScriptContextSlot <context> <slot_index> <depth>
+// StaContextSlot <context> <slot_index> <depth>
 //
 // Stores the object in the accumulator into |slot_index| of the script context
 // at |depth| in the context chain starting at |context|.
-IGNITION_HANDLER(StaScriptContextSlot, InterpreterAssembler) {
+IGNITION_HANDLER(StaContextSlot, InterpreterAssembler) {
   TNode<Object> value = GetAccumulator();
   TNode<Context> context = CAST(LoadRegisterAtOperandIndex(0));
   TNode<IntPtrT> slot_index = Signed(BytecodeOperandIdx(1));
   TNode<Uint32T> depth = BytecodeOperandUImm(2);
   TNode<Context> slot_context = GetContextAtDepth(context, depth);
-  StoreContextElementAndUpdateSideData(slot_context, slot_index, value);
+  StoreContextElement(slot_context, slot_index, value);
   Dispatch();
 }
 
-// StaCurrentScriptContextSlot <slot_index>
+// StaCurrentContextSlot <slot_index>
 //
 // Stores the object in the accumulator into |slot_index| of the current
 // context (which has to be a script context).
-IGNITION_HANDLER(StaCurrentScriptContextSlot, InterpreterAssembler) {
+IGNITION_HANDLER(StaCurrentContextSlot, InterpreterAssembler) {
   TNode<Object> value = GetAccumulator();
   TNode<IntPtrT> slot_index = Signed(BytecodeOperandIdx(0));
   TNode<Context> slot_context = GetContext();
-  StoreContextElementAndUpdateSideData(slot_context, slot_index, value);
+  StoreContextElement(slot_context, slot_index, value);
   Dispatch();
 }
 
@@ -412,7 +412,7 @@ class InterpreterLookupContextSlotAssembler : public InterpreterAssembler {
                                         OperandScale operand_scale)
       : InterpreterAssembler(state, bytecode, operand_scale) {}
 
-  void LookupContextSlot(Runtime::FunctionId function_id, ContextKind kind) {
+  void LookupContextSlot(Runtime::FunctionId function_id, ContextMode kind) {
     TNode<Context> context = GetContext();
     TNode<IntPtrT> slot_index = Signed(BytecodeOperandIdx(1));
     TNode<Uint32T> depth = BytecodeOperandUImm(2);
@@ -426,9 +426,9 @@ class InterpreterLookupContextSlotAssembler : public InterpreterAssembler {
     // Fast path does a normal load context.
     {
       TNode<Object> result =
-          (kind == ContextKind::kScriptContext)
-              ? LoadScriptContextElement(slot_context, slot_index)
-              : LoadContextElement(slot_context, slot_index);
+          (kind == ContextMode::kHasContextCells)
+              ? LoadContextElement(slot_context, slot_index)
+              : LoadContextElementNoCell(slot_context, slot_index);
       SetAccumulator(result);
       Dispatch();
     }
@@ -448,37 +448,37 @@ class InterpreterLookupContextSlotAssembler : public InterpreterAssembler {
 //
 // Lookup the object with the name in constant pool entry |name_index|
 // dynamically.
-IGNITION_HANDLER(LdaLookupContextSlot, InterpreterLookupContextSlotAssembler) {
-  LookupContextSlot(Runtime::kLoadLookupSlot, ContextKind::kDefault);
+IGNITION_HANDLER(LdaLookupContextSlotNoCell,
+                 InterpreterLookupContextSlotAssembler) {
+  LookupContextSlot(Runtime::kLoadLookupSlot, ContextMode::kNoContextCells);
 }
 
-// LdaLookupScriptContextSlot <name_index>
+// LdaLookupContextSlot <name_index>
 //
 // Lookup the object with the name in constant pool entry |name_index|
 // dynamically.
-IGNITION_HANDLER(LdaLookupScriptContextSlot,
-                 InterpreterLookupContextSlotAssembler) {
-  LookupContextSlot(Runtime::kLoadLookupSlot, ContextKind::kScriptContext);
+IGNITION_HANDLER(LdaLookupContextSlot, InterpreterLookupContextSlotAssembler) {
+  LookupContextSlot(Runtime::kLoadLookupSlot, ContextMode::kHasContextCells);
 }
 
 // LdaLookupContextSlotInsideTypeof <name_index>
 //
 // Lookup the object with the name in constant pool entry |name_index|
 // dynamically without causing a NoReferenceError.
-IGNITION_HANDLER(LdaLookupContextSlotInsideTypeof,
+IGNITION_HANDLER(LdaLookupContextSlotNoCellInsideTypeof,
                  InterpreterLookupContextSlotAssembler) {
   LookupContextSlot(Runtime::kLoadLookupSlotInsideTypeof,
-                    ContextKind::kDefault);
+                    ContextMode::kNoContextCells);
 }
 
-// LdaLookupScriptContextSlotInsideTypeof <name_index>
+// LdaLookupContextSlotInsideTypeof <name_index>
 //
 // Lookup the object with the name in constant pool entry |name_index|
 // dynamically without causing a NoReferenceError.
-IGNITION_HANDLER(LdaLookupScriptContextSlotInsideTypeof,
+IGNITION_HANDLER(LdaLookupContextSlotInsideTypeof,
                  InterpreterLookupContextSlotAssembler) {
   LookupContextSlot(Runtime::kLoadLookupSlotInsideTypeof,
-                    ContextKind::kScriptContext);
+                    ContextMode::kHasContextCells);
 }
 
 class InterpreterLookupGlobalAssembler : public InterpreterLoadGlobalAssembler {
@@ -858,7 +858,7 @@ IGNITION_HANDLER(LdaModuleVariable, InterpreterAssembler) {
 
   TNode<Context> module_context = GetContextAtDepth(GetContext(), depth);
   TNode<SourceTextModule> module =
-      CAST(LoadContextElement(module_context, Context::EXTENSION_INDEX));
+      CAST(LoadContextElementNoCell(module_context, Context::EXTENSION_INDEX));
 
   Label if_export(this), if_import(this), end(this);
   Branch(IntPtrGreaterThan(cell_index, IntPtrConstant(0)), &if_export,
@@ -903,7 +903,7 @@ IGNITION_HANDLER(StaModuleVariable, InterpreterAssembler) {
 
   TNode<Context> module_context = GetContextAtDepth(GetContext(), depth);
   TNode<SourceTextModule> module =
-      CAST(LoadContextElement(module_context, Context::EXTENSION_INDEX));
+      CAST(LoadContextElementNoCell(module_context, Context::EXTENSION_INDEX));
 
   Label if_export(this), if_import(this), end(this);
   Branch(IntPtrGreaterThan(cell_index, IntPtrConstant(0)), &if_export,
@@ -1006,6 +1006,16 @@ IGNITION_HANDLER(Add, InterpreterBinaryOpAssembler) {
   BinaryOpWithFeedback(&BinaryOpAssembler::Generate_AddWithFeedback);
 }
 
+// Add_LhsIsConstant_Internalize <src>
+//
+// Add register <src> to accumulator.
+IGNITION_HANDLER(Add_LhsIsStringConstant_Internalize,
+                 InterpreterBinaryOpAssembler) {
+  BinaryOpWithFeedback(
+      &BinaryOpAssembler::
+          Generate_AddLhsIsStringConstantInternalizeWithFeedback);
+}
+
 // Sub <src>
 //
 // Subtract register <src> from accumulator.
@@ -1670,7 +1680,7 @@ IGNITION_HANDLER(CallJSRuntime, InterpreterAssembler) {
   TNode<Context> context = GetContext();
   TNode<NativeContext> native_context = LoadNativeContext(context);
   TNode<JSAny> function =
-      CAST(LoadContextElement(native_context, context_index));
+      CAST(LoadContextElementNoCell(native_context, context_index));
 
   // Call the function.
   CallJSAndDispatch(function, context, args,
diff --git a/deps/v8/src/json/json-parser.cc b/deps/v8/src/json/json-parser.cc
index 2225b60f2fa74e..9d877b1b80dba0 100644
--- a/deps/v8/src/json/json-parser.cc
+++ b/deps/v8/src/json/json-parser.cc
@@ -2155,43 +2155,49 @@ template <typename Char>
 template <typename SinkChar>
 void JsonParser<Char>::DecodeString(SinkChar* sink, uint32_t start,
                                     uint32_t length) {
-  SinkChar* sink_start = sink;
   const Char* cursor = chars_ + start;
-  while (true) {
-    const Char* end = cursor + length - (sink - sink_start);
-    cursor = std::find_if(cursor, end, [&sink](Char c) {
-      if (c == '\\') return true;
-      *sink++ = c;
-      return false;
-    });
+  while (length > 0) {
+    // Copy everything until the first escape character
+    const Char* backslash_pos = std::find(cursor, cursor + length, '\\');
+    size_t to_copy = backslash_pos - cursor;
+    std::copy_n(cursor, to_copy, sink);
+    length -= to_copy;
+    cursor += to_copy;
+    sink += to_copy;
 
-    if (cursor == end) return;
+    if (length == 0) return;
 
     cursor++;
 
     switch (GetEscapeKind(character_json_scan_flags[*cursor])) {
       case EscapeKind::kSelf:
         *sink++ = *cursor;
+        length--;
         break;
 
       case EscapeKind::kBackspace:
         *sink++ = '\x08';
+        length--;
         break;
 
       case EscapeKind::kTab:
         *sink++ = '\x09';
+        length--;
         break;
 
       case EscapeKind::kNewLine:
         *sink++ = '\x0A';
+        length--;
         break;
 
       case EscapeKind::kFormFeed:
         *sink++ = '\x0C';
+        length--;
         break;
 
       case EscapeKind::kCarriageReturn:
         *sink++ = '\x0D';
+        length--;
         break;
 
       case EscapeKind::kUnicode: {
@@ -2202,9 +2208,12 @@ void JsonParser<Char>::DecodeString(SinkChar* sink, uint32_t start,
         if (value <=
             static_cast<base::uc32>(unibrow::Utf16::kMaxNonSurrogateCharCode)) {
           *sink++ = value;
+          length--;
         } else {
+          SBXCHECK_GE(length, 2);
           *sink++ = unibrow::Utf16::LeadSurrogate(value);
           *sink++ = unibrow::Utf16::TrailSurrogate(value);
+          length -= 2;
         }
         break;
       }
diff --git a/deps/v8/src/json/json-stringifier.cc b/deps/v8/src/json/json-stringifier.cc
index 3e967b78a093a9..ac81e713cc8b56 100644
--- a/deps/v8/src/json/json-stringifier.cc
+++ b/deps/v8/src/json/json-stringifier.cc
@@ -9,6 +9,7 @@
 #include "hwy/highway.h"
 #include "src/base/strings.h"
 #include "src/common/assert-scope.h"
+#include "src/common/globals.h"
 #include "src/common/message-template.h"
 #include "src/execution/protectors-inl.h"
 #include "src/numbers/conversions.h"
@@ -485,6 +486,7 @@ constexpr const char* const JsonEscapeTable =
     "X\0      Y\0      Z\0      [\0      "
     "\\\\\0     ]\0      ^\0      _\0      ";
 
+// LINT.IfChange(StringDoesNotContainEscapeCharacters)
 constexpr bool JsonDoNotEscapeFlagTable[] = {
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
@@ -533,6 +535,38 @@ constexpr bool NeedsEscape(uint32_t input) {
   const uint32_t result = ((has_lt_0x20 | has_0x22 | has_0x5c) & result_mask);
   return result != 0;
 }
+// LINT.ThenChange(/src/objects/string.cc:StringDoesNotContainEscapeCharacters)
+
+template <typename SrcChar>
+  requires(sizeof(SrcChar) == sizeof(uint8_t))
+bool DoNotEscape(const SrcChar* chars, size_t length,
+                 const DisallowGarbageCollection& no_gc) {
+  bool no_escape = true;
+  using PackedT = uint32_t;
+  static constexpr size_t stride = sizeof(PackedT);
+  size_t i = 0;
+  for (; i + (stride - 1) < length; i += stride) {
+    PackedT packed = *reinterpret_cast<const PackedT*>(chars + i);
+    if (V8_UNLIKELY(NeedsEscape(packed))) break;
+  }
+  for (; i < length; i++) {
+    no_escape = no_escape && DoNotEscape(chars[i]);
+  }
+  return no_escape;
+}
+
+bool IsFastKey(Tagged<String> key, const DisallowGarbageCollection& no_gc) {
+  return key->DispatchToSpecificType(
+      base::overloaded{[&](Tagged<SeqOneByteString> str) {
+                         const uint8_t* chars = str->GetChars(no_gc);
+                         return DoNotEscape(chars, str->length(), no_gc);
+                       },
+                       [&](Tagged<ExternalOneByteString> str) {
+                         const uint8_t* chars = str->GetChars();
+                         return DoNotEscape(chars, str->length(), no_gc);
+                       },
+                       [&](Tagged<String> str) { return false; }});
+}
 
 bool CanFastSerializeJSArray(Isolate* isolate, Tagged<JSArray> object) {
   // If the no elements protector is intact, Array.prototype and
@@ -541,7 +575,8 @@ bool CanFastSerializeJSArray(Isolate* isolate, Tagged<JSArray> object) {
   Tagged<Map> map = object->map(isolate);
   Tagged<NativeContext> native_context = map->map(isolate)->native_context();
   Tagged<HeapObject> proto = map->prototype();
-  return native_context->get(Context::INITIAL_ARRAY_PROTOTYPE_INDEX) == proto;
+  return native_context->GetNoCell(Context::INITIAL_ARRAY_PROTOTYPE_INDEX) ==
+         proto;
 }
 
 V8_INLINE bool CanFastSerializeJSObject(Tagged<JSObject> raw_object,
@@ -1909,14 +1944,8 @@ enum FastJsonStringifierResult {
 
 enum class FastJsonStringifierObjectKeyResult : uint8_t {
   kSuccess,
-  kNeedsEscaping,
-  kChangeEncoding
-};
-
-enum class ResumeJSObjectMode : uint8_t {
-  kWithMapCache,
-  kWithoutMapCache,
-  kBuildingMapCache
+  kChangeEncoding,  // Two-byte key in one-byte stringifier.
+  kSlow  // Two-byte key (in two-byte stringifier) or requires escaping.
 };
 
 class ContinuationRecord {
@@ -1924,9 +1953,9 @@ class ContinuationRecord {
   enum Type {
     kObject,
     kArray,
-    kObjectResume_WithMapCache,
-    kObjectResume_WithoutMapCache,
-    kObjectResume_BuildingMapCache,
+    kObjectResume_FastIterable,
+    kObjectResume_SlowIterable,
+    kObjectResume_Uninitialized,
     kArrayResume,
     kArrayResume_Holey,
     kArrayResume_WithInterrupts,
@@ -1963,28 +1992,29 @@ class ContinuationRecord {
   }
   static constexpr ContinuationRecord ForJSObject(Tagged<JSAny> obj) {
     DCHECK(Is<JSObject>(obj));
-    return ContinuationRecord(Type::kObject, obj, Tagged<Map>(), 0, 0, 0, 0,
+    return ContinuationRecord(Type::kObject, obj, 0, 0, 0, 0,
                               Tagged<DescriptorArray>());
   }
-  template <ResumeJSObjectMode mode>
+  template <DescriptorArray::FastIterableState fast_iterable_state>
   static constexpr ContinuationRecord ForJSObjectResume(
-      Tagged<JSAny> obj, Tagged<Map> map, uint16_t descriptor_idx,
-      uint16_t nof_descriptors, uint8_t in_object_properties,
-      uint8_t in_object_properties_start, Tagged<DescriptorArray> descriptors) {
+      Tagged<JSAny> obj, uint16_t descriptor_idx, uint16_t nof_descriptors,
+      uint8_t in_object_properties, uint8_t in_object_properties_start,
+      Tagged<DescriptorArray> descriptors) {
     DCHECK(Is<JSObject>(obj));
     Type type;
-    switch (mode) {
-      case ResumeJSObjectMode::kWithMapCache:
-        type = Type::kObjectResume_WithMapCache;
+    using enum DescriptorArray::FastIterableState;
+    switch (fast_iterable_state) {
+      case kJsonFast:
+        type = Type::kObjectResume_FastIterable;
         break;
-      case ResumeJSObjectMode::kWithoutMapCache:
-        type = Type::kObjectResume_WithoutMapCache;
+      case kJsonSlow:
+        type = Type::kObjectResume_SlowIterable;
         break;
-      case ResumeJSObjectMode::kBuildingMapCache:
-        type = Type::kObjectResume_BuildingMapCache;
+      case kUnknown:
+        type = Type::kObjectResume_Uninitialized;
         break;
     }
-    return ContinuationRecord(type, obj, map, descriptor_idx, nof_descriptors,
+    return ContinuationRecord(type, obj, descriptor_idx, nof_descriptors,
                               in_object_properties, in_object_properties_start,
                               descriptors);
   }
@@ -2045,10 +2075,6 @@ class ContinuationRecord {
     DCHECK(IsObjectResumeType(type()));
     return js_object_.descriptors;
   }
-  Tagged<Map> object_map() const {
-    DCHECK(IsObjectResumeType(type()));
-    return js_object_.map;
-  }
 
   bool object_key_comma() const {
     DCHECK_EQ(type(), Type::kObjectKey);
@@ -2056,9 +2082,9 @@ class ContinuationRecord {
   }
 
   static constexpr bool IsObjectResumeType(Type type) {
-    return type == Type::kObjectResume_WithMapCache ||
-           type == Type::kObjectResume_WithoutMapCache ||
-           type == Type::kObjectResume_BuildingMapCache;
+    return type == Type::kObjectResume_FastIterable ||
+           type == Type::kObjectResume_SlowIterable ||
+           type == Type::kObjectResume_Uninitialized;
   }
   static constexpr bool IsArrayResumeType(Type type) {
     return type == Type::kArrayResume || type == Type::kArrayResume_Holey ||
@@ -2070,7 +2096,7 @@ class ContinuationRecord {
   constexpr ContinuationRecord(Type type, Tagged<ObjectT> obj, uint32_t index,
                                uint32_t length)
       : type_(type), object_(obj), js_array_({index, length}) {}
-  constexpr ContinuationRecord(Type type, Tagged<ObjectT> obj, Tagged<Map> map,
+  constexpr ContinuationRecord(Type type, Tagged<ObjectT> obj,
                                uint16_t descriptor_idx,
                                uint16_t nof_descriptors,
                                uint8_t in_object_properties,
@@ -2078,7 +2104,7 @@ class ContinuationRecord {
                                Tagged<DescriptorArray> descriptors)
       : type_(type),
         object_(obj),
-        js_object_({map, descriptor_idx, nof_descriptors, in_object_properties,
+        js_object_({descriptor_idx, nof_descriptors, in_object_properties,
                     in_object_properties_start, descriptors}) {}
   constexpr ContinuationRecord(Type type, Tagged<ObjectT> obj, bool comma)
       : type_(type), object_(obj), object_key_{comma} {}
@@ -2117,7 +2143,6 @@ class ContinuationRecord {
       uint32_t length;
     } js_array_;
     struct {
-      Tagged<Map> map;
       uint16_t descriptor_idx;
       uint16_t nof_descriptors;
       uint8_t in_object_properties;
@@ -2177,9 +2202,9 @@ class FastJsonStringifier {
       Tagged<JSPrimitiveWrapper> obj, const DisallowGarbageCollection& no_gc);
   V8_INLINE FastJsonStringifierResult SerializeJSObject(
       Tagged<JSObject> obj, const DisallowGarbageCollection& no_gc);
-  template <ResumeJSObjectMode mode>
+  template <DescriptorArray::FastIterableState fast_iterable_state>
   V8_INLINE FastJsonStringifierResult ResumeJSObject(
-      Tagged<JSObject> obj, Tagged<Map> map, uint16_t start_descriptor_idx,
+      Tagged<JSObject> obj, uint16_t start_descriptor_idx,
       uint16_t nof_descriptors, uint8_t in_object_properties,
       uint8_t in_object_properties_start, Tagged<DescriptorArray> descriptors,
       bool comma, const DisallowGarbageCollection& no_gc);
@@ -2276,22 +2301,16 @@ class FastJsonStringifier {
   V8_INLINE bool AppendString(const SrcChar* chars, size_t length,
                               const DisallowGarbageCollection& no_gc);
 
+  using FastIterableState = DescriptorArray::FastIterableState;
   static constexpr uint32_t kGlobalInterruptBudget = 200000;
   static constexpr uint32_t kArrayInterruptLength = 4000;
 
   Isolate* isolate_;
-  Zone zone_;
   OutBuffer<Char> buffer_;
   base::SmallVector<ContinuationRecord, 16> stack_;
 
   Tagged<HeapObject> initial_jsobject_proto_;
   Tagged<HeapObject> initial_jsarray_proto_;
-  // Contains all JSObject maps for which we have seen all object keys already.
-  // The value is true for a map iff all of the following conditions are true:
-  // * No property key is a symbol.
-  // * All property keys are enumberable.
-  // * No property key contains any character that requires escaping.
-  ZoneUnorderedMap<Tagged<Map>, bool, Object::Hasher> map_cache_;
   template <typename>
   friend class FastJsonStringifier;
 };
@@ -2333,10 +2352,7 @@ V8_INLINE bool CanFastSerializeJSObjectFastPath(
 
 template <typename Char>
 FastJsonStringifier<Char>::FastJsonStringifier(Isolate* isolate)
-    : isolate_(isolate),
-      zone_(isolate->allocator(), kJsonStringifierZoneName),
-      buffer_(isolate->allocator()),
-      map_cache_(&zone_) {}
+    : isolate_(isolate), buffer_(isolate->allocator()) {}
 
 template <typename Char>
 void FastJsonStringifier<Char>::SerializeSmi(Tagged<Smi> object) {
@@ -2385,9 +2401,7 @@ FastJsonStringifier<Char>::SerializeObjectKey(
   } else {
     if constexpr (is_one_byte) {
       DCHECK(InstanceTypeChecker::IsTwoByteString(map));
-      // no_escaping is only possible if we have already seen all the keys in a
-      // map. But it is not possible we have seen a two-byte string and are
-      // still in one-byte mode.
+      // no_escaping implies that all keys are one-byte.
       if constexpr (no_escaping) {
         UNREACHABLE();
       } else {
@@ -2435,7 +2449,7 @@ namespace {
 
 // The worst case length of an escaped character is 6. Shifting the string
 // length left by 3 is a more pessimistic estimate, but faster to calculate.
-size_t MaxEscapedStringLength(uint32_t length) { return length << 3; }
+size_t MaxEscapedStringLength(size_t length) { return length << 3; }
 
 }  // namespace
 
@@ -2475,13 +2489,18 @@ FastJsonStringifier<Char>::SerializeObjectKey(
     AppendCharacterUnchecked('"');
     FastJsonStringifierObjectKeyResult result;
     if constexpr (no_escaping) {
+      DCHECK(IsFastKey(obj, no_gc));
+      SLOW_DCHECK(String::DoesNotContainEscapeCharacters(obj));
       AppendStringNoEscapes(chars, length, no_gc);
       result = FastJsonStringifierObjectKeyResult::kSuccess;
     } else {
       bool needs_escaping = AppendString(chars, length, no_gc);
-      result = needs_escaping
-                   ? FastJsonStringifierObjectKeyResult::kNeedsEscaping
-                   : FastJsonStringifierObjectKeyResult::kSuccess;
+      DCHECK_IMPLIES(needs_escaping, !IsFastKey(obj, no_gc));
+      SLOW_DCHECK(needs_escaping !=
+                  String::DoesNotContainEscapeCharacters(obj));
+      result = sizeof(StringChar) == 1 && !needs_escaping
+                   ? FastJsonStringifierObjectKeyResult::kSuccess
+                   : FastJsonStringifierObjectKeyResult::kSlow;
     }
     AppendCharacterUnchecked('"');
     AppendCharacterUnchecked(':');
@@ -2732,26 +2751,25 @@ FastJsonStringifierResult FastJsonStringifier<Char>::SerializeJSObject(
   const uint8_t in_object_properties_start =
       map->GetInObjectPropertiesStartInWords();
   const Tagged<DescriptorArray> descriptors = map->instance_descriptors();
-  auto mode = map_cache_.find(map);
-  if (mode == map_cache_.end()) {
-    return ResumeJSObject<ResumeJSObjectMode::kBuildingMapCache>(
-        obj, map, 0, nof_descriptors, in_object_properties,
-        in_object_properties_start, descriptors, false, no_gc);
-  } else if (mode->second == true) {
-    return ResumeJSObject<ResumeJSObjectMode::kWithMapCache>(
-        obj, map, 0, nof_descriptors, in_object_properties,
-        in_object_properties_start, descriptors, false, no_gc);
-  } else {
-    return ResumeJSObject<ResumeJSObjectMode::kWithoutMapCache>(
-        obj, map, 0, nof_descriptors, in_object_properties,
-        in_object_properties_start, descriptors, false, no_gc);
+  FastIterableState fast_iterable_state = descriptors->fast_iterable();
+  switch (fast_iterable_state) {
+#define CASE(state)                                    \
+  case FastIterableState::state:                       \
+    return ResumeJSObject<FastIterableState::state>(   \
+        obj, 0, nof_descriptors, in_object_properties, \
+        in_object_properties_start, descriptors, false, no_gc)
+    CASE(kUnknown);
+    CASE(kJsonFast);
+    CASE(kJsonSlow);
+#undef CASE
   }
+  UNREACHABLE();
 }
 
 template <typename Char>
-template <ResumeJSObjectMode mode>
+template <DescriptorArray::FastIterableState fast_iterable_state>
 FastJsonStringifierResult FastJsonStringifier<Char>::ResumeJSObject(
-    Tagged<JSObject> obj, Tagged<Map> map, uint16_t start_descriptor_idx,
+    Tagged<JSObject> obj, uint16_t start_descriptor_idx,
     uint16_t nof_descriptors, uint8_t in_object_properties,
     uint8_t in_object_properties_start, Tagged<DescriptorArray> descriptors,
     bool comma, const DisallowGarbageCollection& no_gc) {
@@ -2767,21 +2785,22 @@ FastJsonStringifierResult FastJsonStringifier<Char>::ResumeJSObject(
 
     Tagged<Name> name = descriptors->GetKey(i);
     int property_index;
-    if constexpr (mode != ResumeJSObjectMode::kWithMapCache) {
+    if constexpr (fast_iterable_state != FastIterableState::kJsonFast) {
       if (V8_UNLIKELY(IsSymbol(name))) {
-        if constexpr (mode == ResumeJSObjectMode::kBuildingMapCache) {
-          map_cache_[map] = false;
+        if constexpr (fast_iterable_state == FastIterableState::kUnknown) {
+          descriptors->set_fast_iterable(FastIterableState::kJsonSlow);
         }
         continue;
       }
       PropertyDetails details = descriptors->GetDetails(i);
       if (V8_UNLIKELY(details.IsDontEnum())) {
-        if constexpr (mode == ResumeJSObjectMode::kBuildingMapCache) {
-          map_cache_[map] = false;
+        if constexpr (fast_iterable_state == FastIterableState::kUnknown) {
+          descriptors->set_fast_iterable(FastIterableState::kJsonSlow);
         }
         continue;
       }
       if (V8_UNLIKELY(details.location() != PropertyLocation::kField)) {
+        descriptors->set_fast_iterable(FastIterableState::kJsonSlow);
         return SLOW_PATH;
       }
       DCHECK_EQ(PropertyKind::kData, details.kind());
@@ -2800,54 +2819,53 @@ FastJsonStringifierResult FastJsonStringifier<Char>::ResumeJSObject(
       property = obj->property_array(cage_base)->get(cage_base, property_index);
     }
 
+    DCHECK(IsInternalizedString(name));
+    Tagged<String> key_name = Cast<String>(name);
+
     if (V8_UNLIKELY(IsUndefined(property) || IsSymbol(property))) {
+      if constexpr (fast_iterable_state == FastIterableState::kUnknown) {
+        // Even if we don't serialize the key, check if it is fast iterable to
+        // avoid false positives in DescriptorArray::fast_iterable.
+        if (!IsFastKey(key_name, no_gc)) {
+          descriptors->set_fast_iterable(FastIterableState::kJsonSlow);
+        }
+      }
       continue;
     }
 
-    DCHECK(IsInternalizedString(name));
-    Tagged<String> key_name = Cast<String>(name);
     FastJsonStringifierObjectKeyResult key_result;
-    if constexpr (mode == ResumeJSObjectMode::kWithMapCache) {
+    if constexpr (fast_iterable_state == FastIterableState::kJsonFast) {
       V8_INLINE_STATEMENT key_result =
           SerializeObjectKey<true>(key_name, comma, no_gc);
       DCHECK_EQ(key_result, FastJsonStringifierObjectKeyResult::kSuccess);
     } else {
       key_result = SerializeObjectKey<false>(key_name, comma, no_gc);
-      // We only need to check the result while building the map cache.
-      // Once the map cache is built, we are sure that we won't observe any
-      // encoding changes.
-      // In addition we don't care if we need escaping or not, since we already
-      // need to check for that unconditionally without a fast map cache.
-      if constexpr (mode == ResumeJSObjectMode::kBuildingMapCache) {
-        if (V8_UNLIKELY(key_result !=
-                        FastJsonStringifierObjectKeyResult::kSuccess)) {
-          if constexpr (is_one_byte) {
-            if (key_result ==
-                FastJsonStringifierObjectKeyResult::kChangeEncoding) {
-              stack_.emplace_back(ContinuationRecord::ForJSObjectResume<mode>(
-                  obj, map, descriptor_idx + 1, nof_descriptors,
-                  in_object_properties, in_object_properties_start,
-                  descriptors));
-              if (IsJSObject(property)) {
-                stack_.emplace_back(ContinuationRecord::ForJSObject(property));
-              } else if (IsJSArray(property)) {
-                stack_.emplace_back(ContinuationRecord::ForJSArray(property));
-              } else {
-                stack_.emplace_back(
-                    ContinuationRecord::ForSimpleObject(property));
-              }
+      if (V8_UNLIKELY(key_result !=
+                      FastJsonStringifierObjectKeyResult::kSuccess)) {
+        descriptors->set_fast_iterable(FastIterableState::kJsonSlow);
+        if constexpr (is_one_byte) {
+          if (key_result ==
+              FastJsonStringifierObjectKeyResult::kChangeEncoding) {
+            stack_.emplace_back(
+                ContinuationRecord::ForJSObjectResume<fast_iterable_state>(
+                    obj, descriptor_idx + 1, nof_descriptors,
+                    in_object_properties, in_object_properties_start,
+                    descriptors));
+            if (IsJSObject(property)) {
+              stack_.emplace_back(ContinuationRecord::ForJSObject(property));
+            } else if (IsJSArray(property)) {
+              stack_.emplace_back(ContinuationRecord::ForJSArray(property));
+            } else {
               stack_.emplace_back(
-                  ContinuationRecord::ForObjectKey(key_name, comma));
-              return CHANGE_ENCODING;
+                  ContinuationRecord::ForSimpleObject(property));
             }
-          } else {
-            DCHECK_NE(key_result,
-                      FastJsonStringifierObjectKeyResult::kChangeEncoding);
-          }
-          if (key_result ==
-              FastJsonStringifierObjectKeyResult::kNeedsEscaping) {
-            map_cache_[map] = false;
+            stack_.emplace_back(
+                ContinuationRecord::ForObjectKey(key_name, comma));
+            return CHANGE_ENCODING;
           }
+        } else {
+          DCHECK_NE(key_result,
+                    FastJsonStringifierObjectKeyResult::kChangeEncoding);
         }
       }
     }
@@ -2855,7 +2873,7 @@ FastJsonStringifierResult FastJsonStringifier<Char>::ResumeJSObject(
     // SerializeJSPrimitiveWrapper for explanation.
     DisableGCMole no_gc_mole;
     FastJsonStringifierResult result;
-    if constexpr (mode == ResumeJSObjectMode::kWithMapCache) {
+    if constexpr (fast_iterable_state == FastIterableState::kJsonFast) {
       V8_INLINE_STATEMENT result = TrySerializeSimpleObject(property);
     } else {
       result = TrySerializeSimpleObject(property);
@@ -2868,16 +2886,19 @@ FastJsonStringifierResult FastJsonStringifier<Char>::ResumeJSObject(
         break;
       case JS_OBJECT:
       case JS_ARRAY:
-        stack_.push_back(ContinuationRecord::ForJSObjectResume<mode>(
-            obj, map, descriptor_idx + 1, nof_descriptors, in_object_properties,
-            in_object_properties_start, descriptors));
+        stack_.push_back(
+            ContinuationRecord::ForJSObjectResume<fast_iterable_state>(
+                obj, descriptor_idx + 1, nof_descriptors, in_object_properties,
+                in_object_properties_start, descriptors));
         stack_.push_back(ContinuationRecord::ForJSAny(property, result));
         return result;
       case CHANGE_ENCODING:
         if constexpr (is_one_byte) {
-          stack_.push_back(ContinuationRecord::ForJSObjectResume<mode>(
-              obj, map, descriptor_idx + 1, nof_descriptors,
-              in_object_properties, in_object_properties_start, descriptors));
+          stack_.push_back(
+              ContinuationRecord::ForJSObjectResume<fast_iterable_state>(
+                  obj, descriptor_idx + 1, nof_descriptors,
+                  in_object_properties, in_object_properties_start,
+                  descriptors));
           stack_.push_back(ContinuationRecord::ForSimpleObject(property));
           return result;
         } else {
@@ -2889,8 +2910,11 @@ FastJsonStringifierResult FastJsonStringifier<Char>::ResumeJSObject(
     }
   }
   AppendCharacter('}');
-  if constexpr (mode == ResumeJSObjectMode::kBuildingMapCache) {
-    map_cache_.try_emplace(map, true);
+  if constexpr (fast_iterable_state == FastIterableState::kUnknown) {
+    if (nof_descriptors == descriptors->number_of_descriptors()) {
+      descriptors->set_fast_iterable_if(FastIterableState::kJsonFast,
+                                        FastIterableState::kUnknown);
+    }
   }
   return SUCCESS;
 }
@@ -3175,25 +3199,25 @@ FastJsonStringifierResult FastJsonStringifier<Char>::SerializeObject(
         result = SerializeJSObject(cont.js_object(), no_gc);
         break;
       }
-      case ContinuationRecord::kObjectResume_BuildingMapCache: {
-        result = ResumeJSObject<ResumeJSObjectMode::kBuildingMapCache>(
-            cont.js_object(), cont.object_map(), cont.object_descriptor_idx(),
+      case ContinuationRecord::kObjectResume_Uninitialized: {
+        result = ResumeJSObject<FastIterableState::kUnknown>(
+            cont.js_object(), cont.object_descriptor_idx(),
             cont.object_nof_descriptors(), cont.object_in_object_properties(),
             cont.object_in_object_properties_start(), cont.object_descriptors(),
             true, no_gc);
         break;
       }
-      case ContinuationRecord::kObjectResume_WithMapCache: {
-        result = ResumeJSObject<ResumeJSObjectMode::kWithMapCache>(
-            cont.js_object(), cont.object_map(), cont.object_descriptor_idx(),
+      case ContinuationRecord::kObjectResume_FastIterable: {
+        result = ResumeJSObject<FastIterableState::kJsonFast>(
+            cont.js_object(), cont.object_descriptor_idx(),
             cont.object_nof_descriptors(), cont.object_in_object_properties(),
             cont.object_in_object_properties_start(), cont.object_descriptors(),
             true, no_gc);
         break;
       }
-      case ContinuationRecord::kObjectResume_WithoutMapCache: {
-        result = ResumeJSObject<ResumeJSObjectMode::kWithoutMapCache>(
-            cont.js_object(), cont.object_map(), cont.object_descriptor_idx(),
+      case ContinuationRecord::kObjectResume_SlowIterable: {
+        result = ResumeJSObject<FastIterableState::kJsonSlow>(
+            cont.js_object(), cont.object_descriptor_idx(),
             cont.object_nof_descriptors(), cont.object_in_object_properties(),
             cont.object_in_object_properties_start(), cont.object_descriptors(),
             true, no_gc);
diff --git a/deps/v8/src/libplatform/default-foreground-task-runner.cc b/deps/v8/src/libplatform/default-foreground-task-runner.cc
index b99948c7c54166..2ed5a034fd3f1a 100644
--- a/deps/v8/src/libplatform/default-foreground-task-runner.cc
+++ b/deps/v8/src/libplatform/default-foreground-task-runner.cc
@@ -113,6 +113,10 @@ bool DefaultForegroundTaskRunner::NonNestableTasksEnabled() const {
   return true;
 }
 
+bool DefaultForegroundTaskRunner::NonNestableDelayedTasksEnabled() const {
+  return true;
+}
+
 bool DefaultForegroundTaskRunner::HasPoppableTaskInQueue() const {
   if (nesting_depth_ == 0) return !task_queue_.empty();
   for (auto it = task_queue_.cbegin(); it != task_queue_.cend(); it++) {
diff --git a/deps/v8/src/libplatform/default-foreground-task-runner.h b/deps/v8/src/libplatform/default-foreground-task-runner.h
index c2d490e405d33e..6bfaf56f0778b8 100644
--- a/deps/v8/src/libplatform/default-foreground-task-runner.h
+++ b/deps/v8/src/libplatform/default-foreground-task-runner.h
@@ -46,6 +46,7 @@ class V8_PLATFORM_EXPORT DefaultForegroundTaskRunner
   // v8::TaskRunner implementation.
   bool IdleTasksEnabled() override;
   bool NonNestableTasksEnabled() const override;
+  bool NonNestableDelayedTasksEnabled() const override;
 
  private:
   // v8::TaskRunner implementation.
diff --git a/deps/v8/src/logging/log.cc b/deps/v8/src/logging/log.cc
index ea07e176391b02..fe4096d4dadcc3 100644
--- a/deps/v8/src/logging/log.cc
+++ b/deps/v8/src/logging/log.cc
@@ -350,12 +350,12 @@ void CodeEventLogger::RegExpCodeCreateEvent(DirectHandle<AbstractCode> code,
                     name_buffer_->get(), name_buffer_->size());
 }
 
-// Linux perf tool logging support.
-#if V8_OS_LINUX
-class LinuxPerfBasicLogger : public CodeEventLogger {
+// Linux & Darwin perf tool logging support.
+#if V8_OS_LINUX || V8_OS_DARWIN
+class PerfBasicLogger : public CodeEventLogger {
  public:
-  explicit LinuxPerfBasicLogger(Isolate* isolate);
-  ~LinuxPerfBasicLogger() override;
+  explicit PerfBasicLogger(Isolate* isolate);
+  ~PerfBasicLogger() override;
 
   void CodeMoveEvent(Tagged<InstructionStream> from,
                      Tagged<InstructionStream> to) override {}
@@ -388,21 +388,20 @@ class LinuxPerfBasicLogger : public CodeEventLogger {
 };
 
 // Extra space for the "perf-%d.map" filename, including the PID.
-const int LinuxPerfBasicLogger::kFilenameBufferPadding = 32;
+const int PerfBasicLogger::kFilenameBufferPadding = 32;
 
 // static
-base::LazyRecursiveMutex& LinuxPerfBasicLogger::GetFileMutex() {
+base::LazyRecursiveMutex& PerfBasicLogger::GetFileMutex() {
   static base::LazyRecursiveMutex file_mutex = LAZY_RECURSIVE_MUTEX_INITIALIZER;
   return file_mutex;
 }
 
 // The following static variables are protected by
-// LinuxPerfBasicLogger::GetFileMutex().
-uint64_t LinuxPerfBasicLogger::reference_count_ = 0;
-FILE* LinuxPerfBasicLogger::perf_output_handle_ = nullptr;
+// PerfBasicLogger::GetFileMutex().
+uint64_t PerfBasicLogger::reference_count_ = 0;
+FILE* PerfBasicLogger::perf_output_handle_ = nullptr;
 
-LinuxPerfBasicLogger::LinuxPerfBasicLogger(Isolate* isolate)
-    : CodeEventLogger(isolate) {
+PerfBasicLogger::PerfBasicLogger(Isolate* isolate) : CodeEventLogger(isolate) {
   base::LockGuard<base::RecursiveMutex> guard_file(GetFileMutex().Pointer());
   int process_id_ = base::OS::GetCurrentProcessId();
   reference_count_++;
@@ -424,7 +423,7 @@ LinuxPerfBasicLogger::LinuxPerfBasicLogger(Isolate* isolate)
   }
 }
 
-LinuxPerfBasicLogger::~LinuxPerfBasicLogger() {
+PerfBasicLogger::~PerfBasicLogger() {
   base::LockGuard<base::RecursiveMutex> guard_file(GetFileMutex().Pointer());
   reference_count_--;
 
@@ -436,9 +435,9 @@ LinuxPerfBasicLogger::~LinuxPerfBasicLogger() {
   }
 }
 
-void LinuxPerfBasicLogger::WriteLogRecordedBuffer(uintptr_t address,
-                                                  size_t size, const char* name,
-                                                  size_t name_length) {
+void PerfBasicLogger::WriteLogRecordedBuffer(uintptr_t address, size_t size,
+                                             const char* name,
+                                             size_t name_length) {
   // Linux perf expects hex literals without a leading 0x, while some
   // implementations of printf might prepend one when using the %p format
   // for pointers, leading to wrongly formatted JIT symbols maps. On the other
@@ -456,9 +455,9 @@ void LinuxPerfBasicLogger::WriteLogRecordedBuffer(uintptr_t address,
 #endif
 }
 
-void LinuxPerfBasicLogger::LogRecordedBuffer(
-    Tagged<AbstractCode> code, MaybeDirectHandle<SharedFunctionInfo>,
-    const char* name, size_t length) {
+void PerfBasicLogger::LogRecordedBuffer(Tagged<AbstractCode> code,
+                                        MaybeDirectHandle<SharedFunctionInfo>,
+                                        const char* name, size_t length) {
   DisallowGarbageCollection no_gc;
   PtrComprCageBase cage_base(isolate_);
   if (v8_flags.perf_basic_prof_only_functions &&
@@ -472,13 +471,13 @@ void LinuxPerfBasicLogger::LogRecordedBuffer(
 }
 
 #if V8_ENABLE_WEBASSEMBLY
-void LinuxPerfBasicLogger::LogRecordedBuffer(const wasm::WasmCode* code,
-                                             const char* name, size_t length) {
+void PerfBasicLogger::LogRecordedBuffer(const wasm::WasmCode* code,
+                                        const char* name, size_t length) {
   WriteLogRecordedBuffer(static_cast<uintptr_t>(code->instruction_start()),
                          code->instructions().length(), name, length);
 }
 #endif  // V8_ENABLE_WEBASSEMBLY
-#endif  // V8_OS_LINUX
+#endif  // V8_OS_LINUX || V8_OS_DARWIN
 
 // External LogEventListener
 ExternalLogEventListener::ExternalLogEventListener(Isolate* isolate)
@@ -2304,14 +2303,14 @@ bool V8FileLogger::SetUp(Isolate* isolate) {
   PrepareLogFileName(log_file_name, isolate, v8_flags.logfile);
   log_file_ = std::make_unique<LogFile>(this, log_file_name.str());
 
-#if V8_OS_LINUX
+#if V8_OS_LINUX || V8_OS_DARWIN
   if (v8_flags.perf_basic_prof) {
-    perf_basic_logger_ = std::make_unique<LinuxPerfBasicLogger>(isolate);
+    perf_basic_logger_ = std::make_unique<PerfBasicLogger>(isolate);
     CHECK(logger()->AddListener(perf_basic_logger_.get()));
   }
 
   if (v8_flags.perf_prof) {
-    perf_jit_logger_ = std::make_unique<LinuxPerfJitLogger>(isolate);
+    perf_jit_logger_ = std::make_unique<PerfJitLogger>(isolate);
     CHECK(logger()->AddListener(perf_jit_logger_.get()));
   }
 #else
@@ -2457,7 +2456,7 @@ FILE* V8FileLogger::TearDownAndGetLogFile() {
   ticker_.reset();
   timer_.Stop();
 
-#if V8_OS_LINUX
+#if V8_OS_LINUX || V8_OS_DARWIN
   if (perf_basic_logger_) {
     CHECK(logger()->RemoveListener(perf_basic_logger_.get()));
     perf_basic_logger_.reset();
diff --git a/deps/v8/src/logging/log.h b/deps/v8/src/logging/log.h
index ec39b1ec097a86..b8b5c2be526a45 100644
--- a/deps/v8/src/logging/log.h
+++ b/deps/v8/src/logging/log.h
@@ -64,8 +64,8 @@ class Isolate;
 class JitLogger;
 class LogFile;
 class LowLevelLogger;
-class LinuxPerfBasicLogger;
-class LinuxPerfJitLogger;
+class PerfBasicLogger;
+class PerfJitLogger;
 class Profiler;
 class SourcePosition;
 class Ticker;
@@ -363,9 +363,9 @@ class V8FileLogger : public LogEventListener {
 
   std::atomic<bool> is_logging_;
   std::unique_ptr<LogFile> log_file_;
-#if V8_OS_LINUX
-  std::unique_ptr<LinuxPerfBasicLogger> perf_basic_logger_;
-  std::unique_ptr<LinuxPerfJitLogger> perf_jit_logger_;
+#if V8_OS_LINUX || V8_OS_DARWIN
+  std::unique_ptr<PerfBasicLogger> perf_basic_logger_;
+  std::unique_ptr<PerfJitLogger> perf_jit_logger_;
 #endif
   std::unique_ptr<LowLevelLogger> ll_logger_;
   std::unique_ptr<JitLogger> jit_logger_;
diff --git a/deps/v8/src/logging/runtime-call-stats.h b/deps/v8/src/logging/runtime-call-stats.h
index 45257759f1e698..c7ed5ef55cec2c 100644
--- a/deps/v8/src/logging/runtime-call-stats.h
+++ b/deps/v8/src/logging/runtime-call-stats.h
@@ -173,11 +173,13 @@ class RuntimeCallTimer final {
   V(FunctionTemplate_NewRemoteInstance)                    \
   V(FunctionTemplate_NewWithCache)                         \
   V(FunctionTemplate_NewWithFastHandler)                   \
+  V(CppHeapExternal_New)                                   \
   V(Int16Array_New)                                        \
   V(Int32Array_New)                                        \
   V(Int8Array_New)                                         \
   V(Isolate_DateTimeConfigurationChangeNotification)       \
   V(Isolate_LocaleConfigurationChangeNotification)         \
+  V(Isolate_ValidateAndCanonicalizeUnicodeLocaleId)        \
   V(JSON_Parse)                                            \
   V(JSON_Stringify)                                        \
   V(Map_AsArray)                                           \
@@ -441,14 +443,14 @@ class RuntimeCallTimer final {
   V(BoundFunctionNameGetter)                   \
   V(CodeGenerationFromStringsCallbacks)        \
   V(CompileBackgroundBaseline)                 \
+  V(CompileBackgroundBaselineBuild)            \
   V(CompileBackgroundBaselinePreVisit)         \
   V(CompileBackgroundBaselineVisit)            \
-  V(CompileBackgroundBaselineBuild)            \
   V(CompileBaseline)                           \
+  V(CompileBaselineBuild)                      \
   V(CompileBaselineFinalization)               \
   V(CompileBaselinePreVisit)                   \
   V(CompileBaselineVisit)                      \
-  V(CompileBaselineBuild)                      \
   V(CompileCollectSourcePositions)             \
   V(CompileDeserialize)                        \
   V(CompileEnqueueOnDispatcher)                \
@@ -515,11 +517,11 @@ class RuntimeCallTimer final {
   V(OptimizeConcurrentPrepare)                 \
   V(OptimizeFinalizePipelineJob)               \
   V(OptimizeHeapBrokerInitialization)          \
-  V(OptimizeNonConcurrent)                     \
-  V(OptimizeNonConcurrentMaglev)               \
   V(OptimizeRevectorizer)                      \
   V(OptimizeSerialization)                     \
   V(OptimizeSerializeMetadata)                 \
+  V(OptimizeSynchronous)                       \
+  V(OptimizeSynchronousMaglev)                 \
   V(ParseEval)                                 \
   V(ParseFunction)                             \
   V(PropertyCallback)                          \
diff --git a/deps/v8/src/maglev/arm/maglev-assembler-arm-inl.h b/deps/v8/src/maglev/arm/maglev-assembler-arm-inl.h
index d4e5d02eb11e97..8ce675e7ae0153 100644
--- a/deps/v8/src/maglev/arm/maglev-assembler-arm-inl.h
+++ b/deps/v8/src/maglev/arm/maglev-assembler-arm-inl.h
@@ -1178,19 +1178,36 @@ inline void MaglevAssembler::TestUint8AndJumpIfAllClear(
   TestInt32AndJumpIfAllClear(value, mask, target);
 }
 
-inline void MaglevAssembler::LoadHeapNumberValue(DoubleRegister result,
-                                                 Register heap_number) {
-  vldr(result, FieldMemOperand(heap_number, offsetof(HeapNumber, value_)));
+inline void MaglevAssembler::LoadContextCellState(Register state,
+                                                  Register cell) {
+  ldr(state, FieldMemOperand(cell, offsetof(ContextCell, state_)));
 }
 
-inline void MaglevAssembler::LoadHeapInt32Value(Register result,
-                                                Register heap_number) {
-  ldr(result, FieldMemOperand(heap_number, offsetof(HeapNumber, value_)));
+inline void MaglevAssembler::LoadContextCellInt32Value(Register value,
+                                                       Register cell) {
+  AssertContextCellState(cell, ContextCell::kInt32);
+  ldr(value, FieldMemOperand(cell, offsetof(ContextCell, double_value_)));
 }
 
-inline void MaglevAssembler::StoreHeapInt32Value(Register value,
+inline void MaglevAssembler::LoadContextCellFloat64Value(DoubleRegister value,
+                                                         Register cell) {
+  AssertContextCellState(cell, ContextCell::kFloat64);
+  vldr(value, FieldMemOperand(cell, offsetof(ContextCell, double_value_)));
+}
+
+inline void MaglevAssembler::StoreContextCellInt32Value(Register cell,
+                                                        Register value) {
+  str(value, FieldMemOperand(cell, offsetof(ContextCell, double_value_)));
+}
+
+inline void MaglevAssembler::StoreContextCellFloat64Value(
+    Register cell, DoubleRegister value) {
+  vstr(value, FieldMemOperand(cell, offsetof(ContextCell, double_value_)));
+}
+
+inline void MaglevAssembler::LoadHeapNumberValue(DoubleRegister result,
                                                  Register heap_number) {
-  str(value, (FieldMemOperand(heap_number, offsetof(HeapNumber, value_))));
+  vldr(result, FieldMemOperand(heap_number, offsetof(HeapNumber, value_)));
 }
 
 inline void MaglevAssembler::Int32ToDouble(DoubleRegister result,
diff --git a/deps/v8/src/maglev/arm/maglev-assembler-arm.cc b/deps/v8/src/maglev/arm/maglev-assembler-arm.cc
index 7ef6eb69be72b1..54ae24900f83ca 100644
--- a/deps/v8/src/maglev/arm/maglev-assembler-arm.cc
+++ b/deps/v8/src/maglev/arm/maglev-assembler-arm.cc
@@ -228,9 +228,10 @@ void MaglevAssembler::LoadSingleCharacterString(Register result,
     Assert(kUnsignedLessThanEqual, AbortReason::kUnexpectedValue);
   }
   Register table = scratch;
-  LoadRoot(table, RootIndex::kSingleCharacterStringTable);
-  add(table, table, Operand(char_code, LSL, kTaggedSizeLog2));
-  ldr(result, FieldMemOperand(table, OFFSET_OF_DATA_START(FixedArray)));
+  add(table, kRootRegister,
+      Operand(RootRegisterOffsetForRootIndex(
+          RootIndex::kFirstSingleCharacterString)));
+  ldr(result, MemOperand(table, char_code, LSL, kSystemPointerSizeLog2));
 }
 
 void MaglevAssembler::StringFromCharCode(RegisterSnapshot register_snapshot,
diff --git a/deps/v8/src/maglev/arm64/maglev-assembler-arm64-inl.h b/deps/v8/src/maglev/arm64/maglev-assembler-arm64-inl.h
index fd1d5419b86777..6e7fdfa8641a23 100644
--- a/deps/v8/src/maglev/arm64/maglev-assembler-arm64-inl.h
+++ b/deps/v8/src/maglev/arm64/maglev-assembler-arm64-inl.h
@@ -765,6 +765,9 @@ inline void MaglevAssembler::Move(Register dst, int32_t i) {
 inline void MaglevAssembler::Move(Register dst, uint32_t i) {
   Mov(dst.W(), Immediate(i));
 }
+inline void MaglevAssembler::Move(Register dst, intptr_t p) {
+  Mov(dst, Immediate(p));
+}
 inline void MaglevAssembler::Move(Register dst, IndirectPointerTag i) {
   Mov(dst, Immediate(i));
 }
@@ -1378,19 +1381,36 @@ inline void MaglevAssembler::TestUint8AndJumpIfAllClear(
   TestAndBranchIfAllClear(value, mask, target);
 }
 
-inline void MaglevAssembler::LoadHeapNumberValue(DoubleRegister result,
-                                                 Register heap_number) {
-  Ldr(result, FieldMemOperand(heap_number, offsetof(HeapNumber, value_)));
+inline void MaglevAssembler::LoadContextCellState(Register state,
+                                                  Register cell) {
+  Ldr(state, FieldMemOperand(cell, offsetof(ContextCell, state_)));
 }
 
-inline void MaglevAssembler::LoadHeapInt32Value(Register result,
-                                                Register heap_number) {
-  Ldr(result, FieldMemOperand(heap_number, offsetof(HeapNumber, value_)));
+inline void MaglevAssembler::LoadContextCellInt32Value(Register value,
+                                                       Register cell) {
+  AssertContextCellState(cell, ContextCell::kInt32);
+  Ldr(value, FieldMemOperand(cell, offsetof(ContextCell, double_value_)));
+}
+
+inline void MaglevAssembler::LoadContextCellFloat64Value(DoubleRegister value,
+                                                         Register cell) {
+  AssertContextCellState(cell, ContextCell::kFloat64);
+  Ldr(value, FieldMemOperand(cell, offsetof(ContextCell, double_value_)));
 }
 
-inline void MaglevAssembler::StoreHeapInt32Value(Register value,
+inline void MaglevAssembler::StoreContextCellInt32Value(Register cell,
+                                                        Register value) {
+  Str(value, FieldMemOperand(cell, offsetof(ContextCell, double_value_)));
+}
+
+inline void MaglevAssembler::StoreContextCellFloat64Value(
+    Register cell, DoubleRegister value) {
+  Str(value, FieldMemOperand(cell, offsetof(ContextCell, double_value_)));
+}
+
+inline void MaglevAssembler::LoadHeapNumberValue(DoubleRegister result,
                                                  Register heap_number) {
-  Str(value, (FieldMemOperand(heap_number, offsetof(HeapNumber, value_))));
+  Ldr(result, FieldMemOperand(heap_number, offsetof(HeapNumber, value_)));
 }
 
 inline void MaglevAssembler::Int32ToDouble(DoubleRegister result,
diff --git a/deps/v8/src/maglev/arm64/maglev-assembler-arm64.cc b/deps/v8/src/maglev/arm64/maglev-assembler-arm64.cc
index 4e0d6b5641bf58..ca611174029456 100644
--- a/deps/v8/src/maglev/arm64/maglev-assembler-arm64.cc
+++ b/deps/v8/src/maglev/arm64/maglev-assembler-arm64.cc
@@ -261,9 +261,10 @@ void MaglevAssembler::LoadSingleCharacterString(Register result,
     Assert(ls, AbortReason::kUnexpectedValue);
   }
   Register table = scratch;
-  LoadRoot(table, RootIndex::kSingleCharacterStringTable);
-  LoadTaggedFieldByIndex(result, table, char_code, kTaggedSize,
-                         OFFSET_OF_DATA_START(FixedArray));
+  Add(table, kRootRegister,
+      Operand(RootRegisterOffsetForRootIndex(
+          RootIndex::kFirstSingleCharacterString)));
+  Ldr(result, MemOperand(table, char_code, LSL, kSystemPointerSizeLog2));
 }
 
 void MaglevAssembler::StringFromCharCode(RegisterSnapshot register_snapshot,
diff --git a/deps/v8/src/maglev/arm64/maglev-ir-arm64.cc b/deps/v8/src/maglev/arm64/maglev-ir-arm64.cc
index a8d9081f7365c8..96ea3d0dbebe07 100644
--- a/deps/v8/src/maglev/arm64/maglev-ir-arm64.cc
+++ b/deps/v8/src/maglev/arm64/maglev-ir-arm64.cc
@@ -75,16 +75,13 @@ void Int32NegateWithOverflow::GenerateCode(MaglevAssembler* masm,
 void Int32AbsWithOverflow::GenerateCode(MaglevAssembler* masm,
                                         const ProcessingState& state) {
   Register out = ToRegister(result()).W();
-  Label done;
+
   DCHECK(ToRegister(input()).W().Aliases(out));
-  __ Cmp(out, Immediate(0));
-  __ JumpIf(ge, &done);
-  __ Negs(out, out);
+  __ AbsWithOverflow(out, out);
   // Output register must not be a register input into the eager deopt info.
   DCHECK_REGLIST_EMPTY(RegList{out} &
                        GetGeneralRegistersUsedAsInputs(eager_deopt_info()));
   __ EmitEagerDeoptIf(vs, DeoptimizeReason::kOverflow, this);
-  __ bind(&done);
 }
 
 void Int32IncrementWithOverflow::SetValueLocationConstraints() {
diff --git a/deps/v8/src/maglev/maglev-assembler-inl.h b/deps/v8/src/maglev/maglev-assembler-inl.h
index 5c5a8a2b39be3c..12ed316a5212a3 100644
--- a/deps/v8/src/maglev/maglev-assembler-inl.h
+++ b/deps/v8/src/maglev/maglev-assembler-inl.h
@@ -284,6 +284,31 @@ inline void MaglevAssembler::SmiToDouble(DoubleRegister result, Register smi) {
   Int32ToDouble(result, smi);
 }
 
+inline void MaglevAssembler::AssertContextCellState(Register cell,
+                                                    ContextCell::State state,
+                                                    Condition condition) {
+  if (!v8_flags.slow_debug_code) return;
+  TemporaryRegisterScope temps(this);
+  Register scratch = temps.AcquireScratch();
+  LoadContextCellState(scratch, cell);
+  CompareInt32AndAssert(scratch, static_cast<int>(state), condition,
+                        AbortReason::kUnexpectedValue);
+}
+
+inline void MaglevAssembler::LoadContextCellTaggedValue(Register value,
+                                                        Register cell) {
+  static_assert(ContextCell::kConst == 0);
+  static_assert(ContextCell::kSmi == 1);
+  AssertContextCellState(cell, ContextCell::kSmi, kLessThanEqual);
+  LoadTaggedField(value, cell, offsetof(ContextCell, tagged_value_));
+}
+
+inline void MaglevAssembler::StoreContextCellSmiValue(Register cell,
+                                                      Register value) {
+  StoreTaggedFieldNoWriteBarrier(cell, offsetof(ContextCell, tagged_value_),
+                                 value);
+}
+
 #if !defined(V8_TARGET_ARCH_RISCV64)
 
 inline void MaglevAssembler::CompareInstanceTypeAndJumpIf(
diff --git a/deps/v8/src/maglev/maglev-assembler.cc b/deps/v8/src/maglev/maglev-assembler.cc
index 0347c7184779bb..18addeed1a6448 100644
--- a/deps/v8/src/maglev/maglev-assembler.cc
+++ b/deps/v8/src/maglev/maglev-assembler.cc
@@ -60,10 +60,7 @@ void MaglevAssembler::LoadSingleCharacterString(Register result,
                                                 int char_code) {
   DCHECK_GE(char_code, 0);
   DCHECK_LT(char_code, String::kMaxOneByteCharCode);
-  Register table = result;
-  LoadRoot(table, RootIndex::kSingleCharacterStringTable);
-  LoadTaggedField(result, table,
-                  OFFSET_OF_DATA_START(FixedArray) + char_code * kTaggedSize);
+  LoadRoot(result, RootsTable::SingleCharacterStringIndex(char_code));
 }
 
 void MaglevAssembler::LoadDataField(const PolymorphicAccessInfo& access_info,
@@ -281,6 +278,16 @@ void MaglevAssembler::MaterialiseValueNode(Register dst, ValueNode* value) {
       }
       return;
     }
+    case Opcode::kIntPtrConstant: {
+      intptr_t intptr_value = value->Cast<IntPtrConstant>()->value();
+      if (intptr_value <= std::numeric_limits<int>::max() &&
+          Smi::IsValid(static_cast<int>(intptr_value))) {
+        Move(dst, Smi::FromInt(static_cast<int>(intptr_value)));
+      } else {
+        MoveHeapNumber(dst, intptr_value);
+      }
+      return;
+    }
     case Opcode::kUint32Constant: {
       uint32_t uint_value = value->Cast<Uint32Constant>()->value();
       if (Smi::IsValid(uint_value)) {
@@ -667,38 +674,6 @@ void MaglevAssembler::StoreFixedArrayElementWithWriteBarrier(
       kValueCanBeSmi);
 }
 
-void MaglevAssembler::GenerateCheckConstTrackingLetCellFooter(Register context,
-                                                              Register data,
-                                                              int index,
-                                                              Label* done) {
-  Label smi_data, deopt;
-
-  // Load the const tracking let side data.
-  LoadTaggedField(
-      data, context,
-      Context::OffsetOfElementAt(Context::CONTEXT_SIDE_TABLE_PROPERTY_INDEX));
-
-  LoadTaggedField(data, data,
-                  FixedArray::OffsetOfElementAt(
-                      index - Context::MIN_CONTEXT_EXTENDED_SLOTS));
-
-  // Load property.
-  JumpIfSmi(data, &smi_data, Label::kNear);
-  JumpIfRoot(data, RootIndex::kUndefinedValue, &deopt);
-  if (v8_flags.debug_code) {
-    AssertObjectType(data, CONTEXT_SIDE_PROPERTY_CELL_TYPE,
-                     AbortReason::kUnexpectedValue);
-  }
-  LoadTaggedField(data, data,
-                  ContextSidePropertyCell::kPropertyDetailsRawOffset);
-
-  // It must be different than kConst.
-  bind(&smi_data);
-  CompareTaggedAndJumpIf(data, ContextSidePropertyCell::Const(), kNotEqual,
-                         done, Label::kNear);
-  bind(&deopt);
-}
-
 void MaglevAssembler::TryMigrateInstance(Register object,
                                          RegisterSnapshot& register_snapshot,
                                          Label* fail) {
diff --git a/deps/v8/src/maglev/maglev-assembler.h b/deps/v8/src/maglev/maglev-assembler.h
index 6352e53b0c44b4..f55a3a67e768b5 100644
--- a/deps/v8/src/maglev/maglev-assembler.h
+++ b/deps/v8/src/maglev/maglev-assembler.h
@@ -450,6 +450,9 @@ class V8_EXPORT_PRIVATE MaglevAssembler : public MacroAssembler {
   inline void Move(Register dst, Tagged<TaggedIndex> i);
   inline void Move(Register dst, int32_t i);
   inline void Move(Register dst, uint32_t i);
+#ifdef V8_TARGET_ARCH_64_BIT
+  inline void Move(Register dst, intptr_t p);
+#endif
   inline void Move(Register dst, IndirectPointerTag i);
   inline void Move(DoubleRegister dst, double n);
   inline void Move(DoubleRegister dst, Float64 n);
@@ -765,12 +768,22 @@ class V8_EXPORT_PRIVATE MaglevAssembler : public MacroAssembler {
 
   inline void SetMapAsRoot(Register object, RootIndex map);
 
+  inline void AssertContextCellState(Register cell, ContextCell::State state,
+                                     Condition condition = kEqual);
+  inline void LoadContextCellState(Register state, Register cell);
+
+  inline void LoadContextCellTaggedValue(Register value, Register cell);
+  inline void StoreContextCellSmiValue(Register cell, Register value);
+
+  inline void LoadContextCellInt32Value(Register value, Register cell);
+  inline void StoreContextCellInt32Value(Register cell, Register value);
+
+  inline void LoadContextCellFloat64Value(DoubleRegister value, Register cell);
+  inline void StoreContextCellFloat64Value(Register cell, DoubleRegister value);
+
   inline void LoadHeapNumberValue(DoubleRegister result, Register heap_number);
   inline void StoreHeapNumberValue(DoubleRegister value, Register heap_number);
 
-  inline void LoadHeapInt32Value(Register result, Register heap_number);
-  inline void StoreHeapInt32Value(Register value, Register heap_number);
-
   inline void LoadHeapNumberOrOddballValue(DoubleRegister result,
                                            Register object);
 
@@ -782,9 +795,6 @@ class V8_EXPORT_PRIVATE MaglevAssembler : public MacroAssembler {
                                   size_t lazy_deopt_count,
                                   Label* lazy_deopt_entry);
 
-  void GenerateCheckConstTrackingLetCellFooter(Register context, Register data,
-                                               int index, Label* done);
-
   void TryMigrateInstance(Register object, RegisterSnapshot& register_snapshot,
                           Label* fail);
 
diff --git a/deps/v8/src/maglev/maglev-compilation-unit.cc b/deps/v8/src/maglev/maglev-compilation-unit.cc
index 1557b9df450e91..ce527c969315de 100644
--- a/deps/v8/src/maglev/maglev-compilation-unit.cc
+++ b/deps/v8/src/maglev/maglev-compilation-unit.cc
@@ -38,9 +38,9 @@ MaglevCompilationUnit::MaglevCompilationUnit(
       inlining_depth_(caller == nullptr ? 0 : caller->inlining_depth_ + 1) {
   // Check that the parameter count in the bytecode and in the shared function
   // info are consistent.
-  DCHECK_EQ(
-      bytecode_->parameter_count(),
-      shared_function_info.internal_formal_parameter_count_with_receiver());
+  DCHECK_EQ(bytecode_->parameter_count(),
+            shared_function_info
+                .internal_formal_parameter_count_with_receiver_deprecated());
 }
 
 MaglevCompilationUnit::MaglevCompilationUnit(
diff --git a/deps/v8/src/maglev/maglev-compiler.cc b/deps/v8/src/maglev/maglev-compiler.cc
index 7bece9f40573f8..e9cba2b100da9b 100644
--- a/deps/v8/src/maglev/maglev-compiler.cc
+++ b/deps/v8/src/maglev/maglev-compiler.cc
@@ -223,6 +223,7 @@ bool MaglevCompiler::Compile(LocalIsolate* local_isolate,
       //   - Mark
       TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
                    "V8.Maglev.NodeProcessing");
+      UnparkedScopeIfOnBackground unparked_scope(local_isolate->heap());
       GraphMultiProcessor<DeadNodeSweepingProcessor,
                           ValueLocationConstraintProcessor,
                           MaxCallDepthProcessor, LiveRangeAndNextUseProcessor,
diff --git a/deps/v8/src/maglev/maglev-graph-builder.cc b/deps/v8/src/maglev/maglev-graph-builder.cc
index db081bfde623c3..3163f9f0c8cac7 100644
--- a/deps/v8/src/maglev/maglev-graph-builder.cc
+++ b/deps/v8/src/maglev/maglev-graph-builder.cc
@@ -50,6 +50,7 @@
 #include "src/objects/feedback-vector.h"
 #include "src/objects/fixed-array.h"
 #include "src/objects/heap-number-inl.h"
+#include "src/objects/heap-object.h"
 #include "src/objects/instance-type-inl.h"
 #include "src/objects/js-array.h"
 #include "src/objects/js-function.h"
@@ -1519,15 +1520,22 @@ ValueNode* MaglevGraphBuilder::GetTaggedValue(
     return alt;
   }
 
+  // This is called when converting inputs in AddNewNode. We might already have
+  // an empty type for `value` here. Make sure we don't add unsafe conversion
+  // nodes in that case by checking for the empty node type explicitly.
+  // TODO(marja): The checks can be removed after we're able to bail out
+  // earlier.
   switch (representation) {
     case ValueRepresentation::kInt32: {
-      if (NodeTypeIsSmi(node_info->type())) {
+      if (!IsEmptyNodeType(node_info->type()) &&
+          NodeTypeIsSmi(node_info->type())) {
         return alternative.set_tagged(AddNewNode<UnsafeSmiTagInt32>({value}));
       }
       return alternative.set_tagged(AddNewNode<Int32ToNumber>({value}));
     }
     case ValueRepresentation::kUint32: {
-      if (NodeTypeIsSmi(node_info->type())) {
+      if (!IsEmptyNodeType(node_info->type()) &&
+          NodeTypeIsSmi(node_info->type())) {
         return alternative.set_tagged(AddNewNode<UnsafeSmiTagUint32>({value}));
       }
       return alternative.set_tagged(AddNewNode<Uint32ToNumber>({value}));
@@ -1542,7 +1550,8 @@ ValueNode* MaglevGraphBuilder::GetTaggedValue(
     }
 
     case ValueRepresentation::kIntPtr:
-      if (NodeTypeIsSmi(node_info->type())) {
+      if (!IsEmptyNodeType(node_info->type()) &&
+          NodeTypeIsSmi(node_info->type())) {
         return alternative.set_tagged(AddNewNode<UnsafeSmiTagIntPtr>({value}));
       }
       return alternative.set_tagged(AddNewNode<IntPtrToNumber>({value}));
@@ -1838,7 +1847,7 @@ ValueNode* MaglevGraphBuilder::GetInt32(ValueNode* value,
       return alternative.set_int32(BuildSmiUntag(value));
     }
     case ValueRepresentation::kUint32: {
-      if (node_info->is_smi()) {
+      if (!IsEmptyNodeType(GetType(value)) && node_info->is_smi()) {
         return alternative.set_int32(
             AddNewNode<TruncateUint32ToInt32>({value}));
       }
@@ -1931,21 +1940,29 @@ ValueNode* MaglevGraphBuilder::GetFloat64ForToNumber(
     return alt;
   }
 
+  // This is called when converting inputs in AddNewNode. We might already have
+  // an empty type for `value` here. Make sure we don't add unsafe conversion
+  // nodes in that case by checking for the empty node type explicitly.
+  // TODO(marja): The checks can be removed after we're able to bail out
+  // earlier.
   switch (representation) {
     case ValueRepresentation::kTagged: {
       auto combined_type = CombineType(allowed_input_type, node_info->type());
-      if (NodeTypeIs(combined_type, NodeType::kSmi)) {
+      if (!IsEmptyNodeType(node_info->type()) &&
+          NodeTypeIs(combined_type, NodeType::kSmi)) {
         // Get the float64 value of a Smi value its int32 representation.
         return GetFloat64(GetInt32(value));
       }
-      if (NodeTypeIs(combined_type, NodeType::kNumber)) {
+      if (!IsEmptyNodeType(node_info->type()) &&
+          NodeTypeIs(combined_type, NodeType::kNumber)) {
         // Number->Float64 conversions are exact alternatives, so they can
         // also become the canonical float64_alternative.
         return alternative.set_float64(BuildNumberOrOddballToFloat64(
             value, NodeType::kNumber,
             TaggedToFloat64ConversionType::kOnlyNumber));
       }
-      if (NodeTypeIs(combined_type, NodeType::kNumberOrOddball)) {
+      if (!IsEmptyNodeType(node_info->type()) &&
+          NodeTypeIs(combined_type, NodeType::kNumberOrOddball)) {
         // NumberOrOddball->Float64 conversions are not exact alternatives,
         // since they lose the information that this is an oddball, so they
         // can only become the canonical float64_alternative if they are a
@@ -2797,9 +2814,16 @@ MaybeReduceResult MaglevGraphBuilder::TryBuildNewConsString(
       });
 }
 
+// TODO(olivf): It's unclear if this unwrapping actually makes sense or if we
+// should rather let it be unwrapped lazily once we flatten the string.
 ValueNode* MaglevGraphBuilder::BuildUnwrapThinString(ValueNode* input) {
   DCHECK(NodeTypeIs(GetType(input), NodeType::kString));
-  if (NodeTypeIs(GetType(input), NodeType::kNonThinString)) return input;
+  if (input->Is<UnwrapThinString>()) return input;
+  if (auto obj = input->TryCast<InlinedAllocation>()) {
+    // Generally string types can change in-place. But as long as the object
+    // does not escape we know it is not thin.
+    if (obj->object()->type() == VirtualObject::kConsString) return input;
+  }
   return AddNewNode<UnwrapThinString>({input});
 }
 
@@ -2813,20 +2837,20 @@ ReduceResult MaglevGraphBuilder::BuildStringConcat(ValueNode* left,
                                                    ValueNode* right) {
   if (RootConstant* root_constant = left->TryCast<RootConstant>()) {
     if (root_constant->index() == RootIndex::kempty_string) {
-      BuildCheckString(right);
+      RETURN_IF_ABORT(BuildCheckString(right));
       SetAccumulator(right);
       return ReduceResult::Done();
     }
   }
   if (RootConstant* root_constant = right->TryCast<RootConstant>()) {
     if (root_constant->index() == RootIndex::kempty_string) {
-      BuildCheckString(left);
+      RETURN_IF_ABORT(BuildCheckString(left));
       SetAccumulator(left);
       return ReduceResult::Done();
     }
   }
-  BuildCheckString(left);
-  BuildCheckString(right);
+  RETURN_IF_ABORT(BuildCheckString(left));
+  RETURN_IF_ABORT(BuildCheckString(right));
   PROCESS_AND_RETURN_IF_DONE(TryBuildNewConsString(left, right),
                              SetAccumulator);
   SetAccumulator(AddNewNode<StringConcat>({left, right}));
@@ -2878,8 +2902,8 @@ ReduceResult MaglevGraphBuilder::VisitBinaryOperation() {
                 ->DependOnStringWrapperToPrimitiveProtector()) {
           ValueNode* left = LoadRegister(0);
           ValueNode* right = GetAccumulator();
-          BuildCheckStringOrStringWrapper(left);
-          BuildCheckStringOrStringWrapper(right);
+          RETURN_IF_ABORT(BuildCheckStringOrStringWrapper(left));
+          RETURN_IF_ABORT(BuildCheckStringOrStringWrapper(right));
           left = BuildUnwrapStringWrapper(left);
           right = BuildUnwrapStringWrapper(right);
           return BuildStringConcat(left, right);
@@ -3237,8 +3261,8 @@ ReduceResult MaglevGraphBuilder::VisitCompareOperation() {
 
       ValueNode* left = LoadRegister(0);
       ValueNode* right = GetAccumulator();
-      BuildCheckSymbol(left);
-      BuildCheckSymbol(right);
+      RETURN_IF_ABORT(BuildCheckSymbol(left));
+      RETURN_IF_ABORT(BuildCheckSymbol(right));
       if (TryConstantFoldEqual(left, right)) return ReduceResult::Done();
       SetAccumulator(BuildTaggedEqual(left, right));
       return ReduceResult::Done();
@@ -3246,8 +3270,8 @@ ReduceResult MaglevGraphBuilder::VisitCompareOperation() {
     case CompareOperationHint::kString: {
       ValueNode* left = LoadRegister(0);
       ValueNode* right = GetAccumulator();
-      BuildCheckString(left);
-      BuildCheckString(right);
+      RETURN_IF_ABORT(BuildCheckString(left));
+      RETURN_IF_ABORT(BuildCheckString(right));
 
       ValueNode* result;
       if (TryConstantFoldEqual(left, right)) return ReduceResult::Done();
@@ -3291,8 +3315,8 @@ ReduceResult MaglevGraphBuilder::VisitCompareOperation() {
 
       ValueNode* left = LoadRegister(0);
       ValueNode* right = GetAccumulator();
-      BuildCheckJSReceiverOrNullOrUndefined(left);
-      BuildCheckJSReceiverOrNullOrUndefined(right);
+      RETURN_IF_ABORT(BuildCheckJSReceiverOrNullOrUndefined(left));
+      RETURN_IF_ABORT(BuildCheckJSReceiverOrNullOrUndefined(right));
       SetAccumulator(BuildTaggedEqual(left, right));
       return ReduceResult::Done();
     }
@@ -3302,8 +3326,8 @@ ReduceResult MaglevGraphBuilder::VisitCompareOperation() {
 
       ValueNode* left = LoadRegister(0);
       ValueNode* right = GetAccumulator();
-      BuildCheckJSReceiver(left);
-      BuildCheckJSReceiver(right);
+      RETURN_IF_ABORT(BuildCheckJSReceiver(left));
+      RETURN_IF_ABORT(BuildCheckJSReceiver(right));
       SetAccumulator(BuildTaggedEqual(left, right));
       return ReduceResult::Done();
     }
@@ -3391,79 +3415,58 @@ bool MaglevGraphBuilder::TrySpecializeLoadContextSlotToFunctionContext(
   return true;
 }
 
-ValueNode* MaglevGraphBuilder::TrySpecializeLoadScriptContextSlot(
+ValueNode* MaglevGraphBuilder::TrySpecializeLoadContextSlot(
     ValueNode* context_node, int index) {
   if (!context_node->Is<Constant>()) return {};
   compiler::ContextRef context =
       context_node->Cast<Constant>()->ref().AsContext();
-  DCHECK(context.object()->IsScriptContext());
-  auto maybe_property = context.object()->GetScriptContextSideProperty(index);
-  if (!maybe_property) return {};
-  auto property = maybe_property.value();
+  auto maybe_value = context.get(broker(), index);
+  if (!maybe_value || maybe_value->IsTheHole()) return {};
   int offset = Context::OffsetOfElementAt(index);
-  switch (property) {
-    case ContextSidePropertyCell::kConst: {
-      compiler::OptionalObjectRef constant = context.get(broker(), index);
+  if (!maybe_value->IsContextCell()) {
+    // No need to check for extended context slots anymore.
+    return BuildLoadTaggedField<LoadTaggedFieldForContextSlot>(context_node,
+                                                               offset);
+  }
+  compiler::ContextCellRef slot_ref = maybe_value->AsContextCell();
+  ContextCell::State state = slot_ref.state();
+  switch (state) {
+    case ContextCell::kConst: {
+      auto constant = slot_ref.tagged_value(broker());
       if (!constant.has_value()) {
         return BuildLoadTaggedField<LoadTaggedFieldForContextSlot>(context_node,
                                                                    offset);
       }
-      broker()->dependencies()->DependOnScriptContextSlotProperty(
-          context, index, property, broker());
+      broker()->dependencies()->DependOnContextCell(slot_ref, state);
       return GetConstant(*constant);
     }
-    case ContextSidePropertyCell::kSmi: {
-      broker()->dependencies()->DependOnScriptContextSlotProperty(
-          context, index, property, broker());
-      ValueNode* value = BuildLoadTaggedField<LoadTaggedFieldForContextSlot>(
-          context_node, offset);
+    case ContextCell::kSmi: {
+      broker()->dependencies()->DependOnContextCell(slot_ref, state);
+      ValueNode* value = BuildLoadTaggedField(
+          GetConstant(slot_ref), offsetof(ContextCell, tagged_value_));
       EnsureType(value, NodeType::kSmi);
       return value;
     }
-    case ContextSidePropertyCell::kMutableInt32:
-      if (auto mutable_heap_number = context.get(broker(), index)) {
-        if (!mutable_heap_number->IsHeapNumber()) {
-          // TODO(victorgomes): In case the tag is out of date by now we could
-          // retry this reduction.
-          break;
-        }
-        broker()->dependencies()->DependOnScriptContextSlotProperty(
-            context, index, property, broker());
-        return AddNewNode<LoadInt32>(
-            {GetConstant(*mutable_heap_number)},
-            static_cast<int>(offsetof(HeapNumber, value_)));
-      }
-      broker()->dependencies()->DependOnScriptContextSlotProperty(
-          context, index, property, broker());
-      return AddNewNode<LoadHeapInt32>({context_node}, offset);
-    case ContextSidePropertyCell::kMutableHeapNumber:
-      if (auto mutable_heap_number = context.get(broker(), index)) {
-        if (!mutable_heap_number->IsHeapNumber()) {
-          // TODO(victorgomes): In case the tag is out of date by now we could
-          // retry this reduction.
-          break;
-        }
-        broker()->dependencies()->DependOnScriptContextSlotProperty(
-            context, index, property, broker());
-        return AddNewNode<LoadFloat64>(
-            {GetConstant(*mutable_heap_number)},
-            static_cast<int>(offsetof(HeapNumber, value_)));
-      }
-      broker()->dependencies()->DependOnScriptContextSlotProperty(
-          context, index, property, broker());
-      return AddNewNode<LoadDoubleField>({context_node}, offset);
-    case ContextSidePropertyCell::kOther:
-      break;
-    default:
-      UNREACHABLE();
+    case ContextCell::kInt32:
+      broker()->dependencies()->DependOnContextCell(slot_ref, state);
+      return AddNewNode<LoadInt32>(
+          {GetConstant(slot_ref)},
+          static_cast<int>(offsetof(ContextCell, double_value_)));
+    case ContextCell::kFloat64:
+      broker()->dependencies()->DependOnContextCell(slot_ref, state);
+      return AddNewNode<LoadFloat64>(
+          {GetConstant(slot_ref)},
+          static_cast<int>(offsetof(ContextCell, double_value_)));
+    case ContextCell::kDetached:
+      return BuildLoadTaggedField<LoadTaggedFieldForContextSlot>(context_node,
+                                                                 offset);
   }
-  return BuildLoadTaggedField<LoadTaggedFieldForContextSlot>(context_node,
-                                                             offset);
+  UNREACHABLE();
 }
 
 ValueNode* MaglevGraphBuilder::LoadAndCacheContextSlot(
     ValueNode* context, int index, ContextSlotMutability slot_mutability,
-    ContextKind context_kind) {
+    ContextMode context_mode) {
   int offset = Context::OffsetOfElementAt(index);
   ValueNode*& cached_value =
       slot_mutability == kMutable
@@ -3479,12 +3482,10 @@ ValueNode* MaglevGraphBuilder::LoadAndCacheContextSlot(
     return cached_value;
   }
   known_node_aspects().UpdateMayHaveAliasingContexts(context);
-  if (context_kind == ContextKind::kScriptContext &&
-      (v8_flags.script_context_mutable_heap_number ||
-       v8_flags.const_tracking_let) &&
-      slot_mutability == kMutable) {
+  if (context_mode == ContextMode::kHasContextCells &&
+      v8_flags.script_context_cells && slot_mutability == kMutable) {
     // We collect feedback only for mutable context slots.
-    cached_value = TrySpecializeLoadScriptContextSlot(context, index);
+    cached_value = TrySpecializeLoadContextSlot(context, index);
     if (cached_value) return cached_value;
     return cached_value =
                BuildLoadTaggedField<LoadTaggedFieldForScriptContextSlot>(
@@ -3510,116 +3511,88 @@ bool MaglevGraphBuilder::ContextMayAlias(
   return scope_info->equals(*other);
 }
 
-MaybeReduceResult MaglevGraphBuilder::TrySpecializeStoreScriptContextSlot(
+MaybeReduceResult MaglevGraphBuilder::TrySpecializeStoreContextSlot(
     ValueNode* context, int index, ValueNode* value, Node** store) {
   DCHECK_NOT_NULL(store);
-  DCHECK(v8_flags.script_context_mutable_heap_number ||
-         v8_flags.const_tracking_let);
+  DCHECK(v8_flags.script_context_cells);
   if (!context->Is<Constant>()) {
-    *store = AddNewNode<StoreScriptContextSlotWithWriteBarrier>(
-        {context, value}, index);
+    *store =
+        AddNewNode<StoreContextSlotWithWriteBarrier>({context, value}, index);
     return ReduceResult::Done();
   }
 
   compiler::ContextRef context_ref =
       context->Cast<Constant>()->ref().AsContext();
-  DCHECK(context_ref.object()->IsScriptContext());
-  auto maybe_property =
-      context_ref.object()->GetScriptContextSideProperty(index);
-  if (!maybe_property) {
-    *store = AddNewNode<StoreScriptContextSlotWithWriteBarrier>(
-        {context, value}, index);
+  auto maybe_value = context_ref.get(broker(), index);
+  if (!maybe_value || maybe_value->IsTheHole()) {
+    *store =
+        AddNewNode<StoreContextSlotWithWriteBarrier>({context, value}, index);
     return ReduceResult::Done();
   }
-  auto property = maybe_property.value();
-  int offset = Context::OffsetOfElementAt(index);
-  if (property == ContextSidePropertyCell::kConst) {
-    compiler::OptionalObjectRef constant = context_ref.get(broker(), index);
-    if (!constant.has_value() ||
-        (constant->IsString() && !constant->IsInternalizedString())) {
-      *store = AddNewNode<StoreScriptContextSlotWithWriteBarrier>(
-          {context, value}, index);
-      return ReduceResult::Done();
-    }
-    broker()->dependencies()->DependOnScriptContextSlotProperty(
-        context_ref, index, property, broker());
-    return BuildCheckNumericalValueOrByReference(
-        value, *constant, DeoptimizeReason::kStoreToConstant);
-  }
 
-  if (!v8_flags.script_context_mutable_heap_number) {
+  int offset = Context::OffsetOfElementAt(index);
+  if (!maybe_value->IsContextCell()) {
     *store = BuildStoreTaggedField(context, value, offset,
                                    StoreTaggedMode::kDefault);
     return ReduceResult::Done();
   }
 
-  switch (property) {
-    case ContextSidePropertyCell::kConst:
-      UNREACHABLE();
-    case ContextSidePropertyCell::kSmi:
+  compiler::ContextCellRef slot_ref = maybe_value->AsContextCell();
+  ContextCell::State state = slot_ref.state();
+  switch (state) {
+    case ContextCell::kConst: {
+      auto constant = slot_ref.tagged_value(broker());
+      if (!constant.has_value() ||
+          (constant->IsString() && !constant->IsInternalizedString())) {
+        *store = AddNewNode<StoreContextSlotWithWriteBarrier>({context, value},
+                                                              index);
+        return ReduceResult::Done();
+      }
+      broker()->dependencies()->DependOnContextCell(slot_ref, state);
+      return BuildCheckNumericalValueOrByReference(
+          value, *constant, DeoptimizeReason::kStoreToConstant);
+    }
+    case ContextCell::kSmi:
       RETURN_IF_ABORT(BuildCheckSmi(value));
-      broker()->dependencies()->DependOnScriptContextSlotProperty(
-          context_ref, index, property, broker());
-      *store = BuildStoreTaggedField(context, value, offset,
-                                     StoreTaggedMode::kDefault);
-      break;
-    case ContextSidePropertyCell::kMutableInt32:
+      broker()->dependencies()->DependOnContextCell(slot_ref, state);
+      *store = BuildStoreTaggedFieldNoWriteBarrier(
+          GetConstant(slot_ref), value, offsetof(ContextCell, tagged_value_),
+          StoreTaggedMode::kDefault);
+      return ReduceResult::Done();
+    case ContextCell::kInt32:
       EnsureInt32(value, true);
-      if (auto mutable_heap_number = context_ref.get(broker(), index)) {
-        if (!mutable_heap_number->IsHeapNumber()) {
-          // TODO(victorgomes): In case the tag is out of date by now we could
-          // retry this reduction.
-          return {};
-        }
-        *store = AddNewNode<StoreInt32>(
-            {GetConstant(*mutable_heap_number), value},
-            static_cast<int>(offsetof(HeapNumber, value_)));
-      } else {
-        *store = AddNewNode<StoreHeapInt32>({context, value}, offset);
-      }
-      broker()->dependencies()->DependOnScriptContextSlotProperty(
-          context_ref, index, property, broker());
-      break;
-    case ContextSidePropertyCell::kMutableHeapNumber:
-      BuildCheckNumber(value);
-      if (auto mutable_heap_number = context_ref.get(broker(), index)) {
-        if (!mutable_heap_number->IsHeapNumber()) {
-          // TODO(victorgomes): In case the tag is out of date by now we could
-          // retry this reduction.
-          return {};
-        }
-        *store = AddNewNode<StoreFloat64>(
-            {GetConstant(*mutable_heap_number), value},
-            static_cast<int>(offsetof(HeapNumber, value_)));
-      } else {
-        *store = AddNewNode<StoreDoubleField>({context, value}, offset);
-      }
-      broker()->dependencies()->DependOnScriptContextSlotProperty(
-          context_ref, index, property, broker());
-      break;
-    case ContextSidePropertyCell::kOther:
+      *store = AddNewNode<StoreInt32>(
+          {GetConstant(slot_ref), value},
+          static_cast<int>(offsetof(ContextCell, double_value_)));
+      broker()->dependencies()->DependOnContextCell(slot_ref, state);
+      return ReduceResult::Done();
+    case ContextCell::kFloat64:
+      RETURN_IF_ABORT(BuildCheckNumber(value));
+      *store = AddNewNode<StoreFloat64>(
+          {GetConstant(slot_ref), value},
+          static_cast<int>(offsetof(ContextCell, double_value_)));
+      broker()->dependencies()->DependOnContextCell(slot_ref, state);
+      return ReduceResult::Done();
+    case ContextCell::kDetached:
       *store = BuildStoreTaggedField(context, value, offset,
                                      StoreTaggedMode::kDefault);
-      break;
-    default:
-      UNREACHABLE();
+      return ReduceResult::Done();
   }
-  return ReduceResult::Done();
+  UNREACHABLE();
 }
 
 ReduceResult MaglevGraphBuilder::StoreAndCacheContextSlot(
-    ValueNode* context, int index, ValueNode* value, ContextKind context_kind) {
+    ValueNode* context, int index, ValueNode* value, ContextMode context_mode) {
   int offset = Context::OffsetOfElementAt(index);
   DCHECK_EQ(
       known_node_aspects().loaded_context_constants.count({context, offset}),
       0);
 
   Node* store = nullptr;
-  if ((v8_flags.script_context_mutable_heap_number ||
-       v8_flags.const_tracking_let) &&
-      context_kind == ContextKind::kScriptContext) {
+  if (v8_flags.script_context_cells &&
+      context_mode == ContextMode::kHasContextCells) {
     MaybeReduceResult result =
-        TrySpecializeStoreScriptContextSlot(context, index, value, &store);
+        TrySpecializeStoreContextSlot(context, index, value, &store);
     RETURN_IF_ABORT(result);
     if (!store && result.IsDone()) {
       // If we didn't need to emit any store, there is nothing to cache.
@@ -3696,7 +3669,7 @@ ReduceResult MaglevGraphBuilder::StoreAndCacheContextSlot(
 
 void MaglevGraphBuilder::BuildLoadContextSlot(
     ValueNode* context, size_t depth, int slot_index,
-    ContextSlotMutability slot_mutability, ContextKind context_kind) {
+    ContextSlotMutability slot_mutability, ContextMode context_mode) {
   context = GetContextAtDepth(context, depth);
   if (compilation_unit_->info()->specialize_to_function_context() &&
       TrySpecializeLoadContextSlotToFunctionContext(context, slot_index,
@@ -3709,30 +3682,30 @@ void MaglevGraphBuilder::BuildLoadContextSlot(
   // initialized, so we can't safely assume that the load can be cached in case
   // it's a load before initialization (e.g. var a = a + 42).
   current_interpreter_frame_.set_accumulator(
-      LoadAndCacheContextSlot(context, slot_index, kMutable, context_kind));
+      LoadAndCacheContextSlot(context, slot_index, kMutable, context_mode));
 }
 
 ReduceResult MaglevGraphBuilder::BuildStoreContextSlot(
     ValueNode* context, size_t depth, int slot_index, ValueNode* value,
-    ContextKind context_kind) {
+    ContextMode context_mode) {
   context = GetContextAtDepth(context, depth);
-  return StoreAndCacheContextSlot(context, slot_index, value, context_kind);
+  return StoreAndCacheContextSlot(context, slot_index, value, context_mode);
 }
 
-ReduceResult MaglevGraphBuilder::VisitLdaContextSlot() {
+ReduceResult MaglevGraphBuilder::VisitLdaContextSlotNoCell() {
   ValueNode* context = LoadRegister(0);
   int slot_index = iterator_.GetIndexOperand(1);
   size_t depth = iterator_.GetUnsignedImmediateOperand(2);
   BuildLoadContextSlot(context, depth, slot_index, kMutable,
-                       ContextKind::kDefault);
+                       ContextMode::kNoContextCells);
   return ReduceResult::Done();
 }
-ReduceResult MaglevGraphBuilder::VisitLdaScriptContextSlot() {
+ReduceResult MaglevGraphBuilder::VisitLdaContextSlot() {
   ValueNode* context = LoadRegister(0);
   int slot_index = iterator_.GetIndexOperand(1);
   size_t depth = iterator_.GetUnsignedImmediateOperand(2);
   BuildLoadContextSlot(context, depth, slot_index, kMutable,
-                       ContextKind::kScriptContext);
+                       ContextMode::kHasContextCells);
   return ReduceResult::Done();
 }
 ReduceResult MaglevGraphBuilder::VisitLdaImmutableContextSlot() {
@@ -3740,57 +3713,58 @@ ReduceResult MaglevGraphBuilder::VisitLdaImmutableContextSlot() {
   int slot_index = iterator_.GetIndexOperand(1);
   size_t depth = iterator_.GetUnsignedImmediateOperand(2);
   BuildLoadContextSlot(context, depth, slot_index, kImmutable,
-                       ContextKind::kDefault);
+                       ContextMode::kNoContextCells);
   return ReduceResult::Done();
 }
-ReduceResult MaglevGraphBuilder::VisitLdaCurrentContextSlot() {
+ReduceResult MaglevGraphBuilder::VisitLdaCurrentContextSlotNoCell() {
   ValueNode* context = GetContext();
   int slot_index = iterator_.GetIndexOperand(0);
-  BuildLoadContextSlot(context, 0, slot_index, kMutable, ContextKind::kDefault);
+  BuildLoadContextSlot(context, 0, slot_index, kMutable,
+                       ContextMode::kNoContextCells);
   return ReduceResult::Done();
 }
-ReduceResult MaglevGraphBuilder::VisitLdaCurrentScriptContextSlot() {
+ReduceResult MaglevGraphBuilder::VisitLdaCurrentContextSlot() {
   ValueNode* context = GetContext();
   int slot_index = iterator_.GetIndexOperand(0);
   BuildLoadContextSlot(context, 0, slot_index, kMutable,
-                       ContextKind::kScriptContext);
+                       ContextMode::kHasContextCells);
   return ReduceResult::Done();
 }
 ReduceResult MaglevGraphBuilder::VisitLdaImmutableCurrentContextSlot() {
   ValueNode* context = GetContext();
   int slot_index = iterator_.GetIndexOperand(0);
   BuildLoadContextSlot(context, 0, slot_index, kImmutable,
-                       ContextKind::kDefault);
+                       ContextMode::kNoContextCells);
   return ReduceResult::Done();
 }
 
-ReduceResult MaglevGraphBuilder::VisitStaContextSlot() {
+ReduceResult MaglevGraphBuilder::VisitStaContextSlotNoCell() {
   ValueNode* context = LoadRegister(0);
   int slot_index = iterator_.GetIndexOperand(1);
   size_t depth = iterator_.GetUnsignedImmediateOperand(2);
   return BuildStoreContextSlot(context, depth, slot_index, GetAccumulator(),
-                               ContextKind::kDefault);
+                               ContextMode::kNoContextCells);
 }
-ReduceResult MaglevGraphBuilder::VisitStaCurrentContextSlot() {
+ReduceResult MaglevGraphBuilder::VisitStaCurrentContextSlotNoCell() {
   ValueNode* context = GetContext();
   int slot_index = iterator_.GetIndexOperand(0);
   return BuildStoreContextSlot(context, 0, slot_index, GetAccumulator(),
-                               ContextKind::kDefault);
+                               ContextMode::kNoContextCells);
 }
 
-ReduceResult MaglevGraphBuilder::VisitStaScriptContextSlot() {
+ReduceResult MaglevGraphBuilder::VisitStaContextSlot() {
   ValueNode* context = LoadRegister(0);
   int slot_index = iterator_.GetIndexOperand(1);
   size_t depth = iterator_.GetUnsignedImmediateOperand(2);
   return BuildStoreContextSlot(context, depth, slot_index, GetAccumulator(),
-                               ContextKind::kScriptContext);
+                               ContextMode::kHasContextCells);
 }
 
-ReduceResult MaglevGraphBuilder::VisitStaCurrentScriptContextSlot() {
+ReduceResult MaglevGraphBuilder::VisitStaCurrentContextSlot() {
   ValueNode* context = GetContext();
   int slot_index = iterator_.GetIndexOperand(0);
   return BuildStoreContextSlot(context, 0, slot_index, GetAccumulator(),
-                               ContextKind::kScriptContext);
+                               ContextMode::kHasContextCells);
 }
 
 ReduceResult MaglevGraphBuilder::VisitStar() {
@@ -4025,7 +3999,7 @@ MaybeReduceResult MaglevGraphBuilder::TryBuildScriptContextStore(
   auto script_context = GetConstant(global_access_feedback.script_context());
   return StoreAndCacheContextSlot(
       script_context, global_access_feedback.slot_index(), GetAccumulator(),
-      ContextKind::kScriptContext);
+      ContextMode::kHasContextCells);
 }
 
 MaybeReduceResult MaglevGraphBuilder::TryBuildPropertyCellStore(
@@ -4079,7 +4053,7 @@ MaybeReduceResult MaglevGraphBuilder::TryBuildPropertyCellStore(
         compiler::MapRef property_cell_value_map =
             property_cell_value.AsHeapObject().map(broker());
         broker()->dependencies()->DependOnStableMap(property_cell_value_map);
-        BuildCheckHeapObject(value);
+        RETURN_IF_ABORT(BuildCheckHeapObject(value));
         RETURN_IF_ABORT(
             BuildCheckMaps(value, base::VectorOf({property_cell_value_map})));
       } else {
@@ -4127,7 +4101,7 @@ MaybeReduceResult MaglevGraphBuilder::TryBuildScriptContextLoad(
       global_access_feedback.immutable() ? kImmutable : kMutable;
   return LoadAndCacheContextSlot(script_context,
                                  global_access_feedback.slot_index(),
-                                 mutability, ContextKind::kScriptContext);
+                                 mutability, ContextMode::kHasContextCells);
 }
 
 MaybeReduceResult MaglevGraphBuilder::TryBuildPropertyCellLoad(
@@ -4253,25 +4227,25 @@ ReduceResult MaglevGraphBuilder::VisitLdaLookupSlot() {
   return ReduceResult::Done();
 }
 
-ReduceResult MaglevGraphBuilder::VisitLdaLookupContextSlot() {
+ReduceResult MaglevGraphBuilder::VisitLdaLookupContextSlotNoCell() {
   // LdaLookupContextSlot <name_index> <feedback_slot> <depth>
   ValueNode* name = GetConstant(GetRefOperand<Name>(0));
   ValueNode* slot = GetTaggedIndexConstant(iterator_.GetIndexOperand(1));
   ValueNode* depth =
       GetTaggedIndexConstant(iterator_.GetUnsignedImmediateOperand(2));
-  SetAccumulator(
-      BuildCallBuiltin<Builtin::kLookupContextTrampoline>({name, depth, slot}));
+  SetAccumulator(BuildCallBuiltin<Builtin::kLookupContextNoCellTrampoline>(
+      {name, depth, slot}));
   return ReduceResult::Done();
 }
 
-ReduceResult MaglevGraphBuilder::VisitLdaLookupScriptContextSlot() {
+ReduceResult MaglevGraphBuilder::VisitLdaLookupContextSlot() {
   // LdaLookupContextSlot <name_index> <feedback_slot> <depth>
   ValueNode* name = GetConstant(GetRefOperand<Name>(0));
   ValueNode* slot = GetTaggedIndexConstant(iterator_.GetIndexOperand(1));
   ValueNode* depth =
       GetTaggedIndexConstant(iterator_.GetUnsignedImmediateOperand(2));
-  SetAccumulator(BuildCallBuiltin<Builtin::kLookupScriptContextTrampoline>(
-      {name, depth, slot}));
+  SetAccumulator(
+      BuildCallBuiltin<Builtin::kLookupContextTrampoline>({name, depth, slot}));
   return ReduceResult::Done();
 }
 
@@ -4302,8 +4276,9 @@ bool MaglevGraphBuilder::CheckContextExtensions(size_t depth) {
       // optimization.
       if (!extension_ref) return false;
       if (!extension_ref->IsUndefined()) return false;
-      ValueNode* extension = LoadAndCacheContextSlot(
-          context, Context::EXTENSION_INDEX, kMutable, ContextKind::kDefault);
+      ValueNode* extension =
+          LoadAndCacheContextSlot(context, Context::EXTENSION_INDEX, kMutable,
+                                  ContextMode::kNoContextCells);
       AddNewNode<CheckValue>({extension}, broker()->undefined_value(),
                              DeoptimizeReason::kUnexpectedContextExtension);
     }
@@ -4349,26 +4324,26 @@ ReduceResult MaglevGraphBuilder::VisitLdaLookupSlotInsideTypeof() {
   return ReduceResult::Done();
 }
 
-ReduceResult MaglevGraphBuilder::VisitLdaLookupContextSlotInsideTypeof() {
+ReduceResult MaglevGraphBuilder::VisitLdaLookupContextSlotNoCellInsideTypeof() {
   // LdaLookupContextSlotInsideTypeof <name_index> <context_slot> <depth>
   ValueNode* name = GetConstant(GetRefOperand<Name>(0));
   ValueNode* slot = GetTaggedIndexConstant(iterator_.GetIndexOperand(1));
   ValueNode* depth =
       GetTaggedIndexConstant(iterator_.GetUnsignedImmediateOperand(2));
   SetAccumulator(
-      BuildCallBuiltin<Builtin::kLookupContextInsideTypeofTrampoline>(
+      BuildCallBuiltin<Builtin::kLookupContextNoCellInsideTypeofTrampoline>(
           {name, depth, slot}));
   return ReduceResult::Done();
 }
 
-ReduceResult MaglevGraphBuilder::VisitLdaLookupScriptContextSlotInsideTypeof() {
+ReduceResult MaglevGraphBuilder::VisitLdaLookupContextSlotInsideTypeof() {
   // LdaLookupContextSlotInsideTypeof <name_index> <context_slot> <depth>
   ValueNode* name = GetConstant(GetRefOperand<Name>(0));
   ValueNode* slot = GetTaggedIndexConstant(iterator_.GetIndexOperand(1));
   ValueNode* depth =
       GetTaggedIndexConstant(iterator_.GetUnsignedImmediateOperand(2));
   SetAccumulator(
-      BuildCallBuiltin<Builtin::kLookupScriptContextInsideTypeofTrampoline>(
+      BuildCallBuiltin<Builtin::kLookupContextInsideTypeofTrampoline>(
           {name, depth, slot}));
   return ReduceResult::Done();
 }
@@ -4459,7 +4434,7 @@ NodeType StaticTypeForNode(compiler::JSHeapBroker* broker,
       } else {
         switch (obj->type()) {
           case VirtualObject::kConsString:
-            return NodeType::kNonThinString;
+            return NodeType::kString;
           case VirtualObject::kDefault:
           case VirtualObject::kHeapNumber:
           case VirtualObject::kFixedDoubleArray:
@@ -4496,10 +4471,9 @@ NodeType StaticTypeForNode(compiler::JSHeapBroker* broker,
     case Opcode::kToString:
     case Opcode::kNumberToString:
     case Opcode::kUnwrapStringWrapper:
+    case Opcode::kUnwrapThinString:
       return NodeType::kString;
     case Opcode::kStringConcat:
-    case Opcode::kUnwrapThinString:
-      return NodeType::kNonThinString;
     case Opcode::kCheckedInternalizedString:
       return NodeType::kInternalizedString;
     case Opcode::kToObject:
@@ -4584,7 +4558,6 @@ NodeType StaticTypeForNode(compiler::JSHeapBroker* broker,
     case Opcode::kLoadDoubleField:
     case Opcode::kLoadFloat64:
     case Opcode::kLoadInt32:
-    case Opcode::kLoadHeapInt32:
     case Opcode::kLoadTaggedFieldByFieldIndex:
     case Opcode::kLoadFixedArrayElement:
     case Opcode::kLoadFixedDoubleArrayElement:
@@ -4596,6 +4569,9 @@ NodeType StaticTypeForNode(compiler::JSHeapBroker* broker,
     case Opcode::kLoadSignedIntTypedArrayElement:
     case Opcode::kLoadUnsignedIntTypedArrayElement:
     case Opcode::kLoadDoubleTypedArrayElement:
+    case Opcode::kLoadSignedIntConstantTypedArrayElement:
+    case Opcode::kLoadUnsignedIntConstantTypedArrayElement:
+    case Opcode::kLoadDoubleConstantTypedArrayElement:
     case Opcode::kLoadEnumCacheLength:
     case Opcode::kLoadGlobal:
     case Opcode::kLoadNamedGeneric:
@@ -4653,6 +4629,7 @@ NodeType StaticTypeForNode(compiler::JSHeapBroker* broker,
     case Opcode::kFloat64Constant:
     case Opcode::kInt32Constant:
     case Opcode::kUint32Constant:
+    case Opcode::kIntPtrConstant:
     case Opcode::kTaggedIndexConstant:
     case Opcode::kTrustedConstant:
     case Opcode::kInt32AbsWithOverflow:
@@ -4806,12 +4783,10 @@ bool MaglevGraphBuilder::HaveDisjointTypes(ValueNode* lhs, ValueNode* rhs) {
   return HasDisjointType(lhs, GetType(rhs));
 }
 
-// Note: this is conservative, ie, returns true if {lhs} cannot be {rhs}.
-// It might return false even if {lhs} is not {rhs}.
 bool MaglevGraphBuilder::HasDisjointType(ValueNode* lhs, NodeType rhs_type) {
   NodeType lhs_type = GetType(lhs);
   NodeType meet = CombineType(lhs_type, rhs_type);
-  return NodeTypeCannotHaveInstances(meet);
+  return IsEmptyNodeType(meet);
 }
 
 bool MaglevGraphBuilder::MayBeNullOrUndefined(ValueNode* node) {
@@ -4823,7 +4798,12 @@ bool MaglevGraphBuilder::MayBeNullOrUndefined(ValueNode* node) {
 }
 
 ValueNode* MaglevGraphBuilder::BuildSmiUntag(ValueNode* node) {
-  if (EnsureType(node, NodeType::kSmi)) {
+  // This is called when converting inputs in AddNewNode. We might already have
+  // an empty type for `node` here. Make sure we don't add unsafe conversion
+  // nodes in that case by checking for the empty node type explicitly.
+  // TODO(marja): The checks can be removed after we're able to bail out
+  // earlier.
+  if (!IsEmptyNodeType(GetType(node)) && EnsureType(node, NodeType::kSmi)) {
     if (SmiValuesAre31Bits()) {
       if (auto phi = node->TryCast<Phi>()) {
         phi->SetUseRequires31BitValue();
@@ -4854,8 +4834,10 @@ ValueNode* MaglevGraphBuilder::BuildNumberOrOddballToFloat64(
 ReduceResult MaglevGraphBuilder::BuildCheckSmi(ValueNode* object,
                                                bool elidable) {
   if (CheckStaticType(object, NodeType::kSmi)) return object;
-  if (CheckType(object, NodeType::kAnyHeapObject)) {
-    return EmitUnconditionalDeopt(DeoptimizeReason::kNotASmi);
+  // Check for the empty type first so that we catch the case where
+  // GetType(object) is already empty.
+  if (IsEmptyNodeType(CombineType(GetType(object), NodeType::kSmi))) {
+    return EmitUnconditionalDeopt(DeoptimizeReason::kSmi);
   }
   if (EnsureType(object, NodeType::kSmi) && elidable) return object;
   switch (object->value_representation()) {
@@ -4881,49 +4863,100 @@ ReduceResult MaglevGraphBuilder::BuildCheckSmi(ValueNode* object,
   return object;
 }
 
-void MaglevGraphBuilder::BuildCheckHeapObject(ValueNode* object) {
-  if (EnsureType(object, NodeType::kAnyHeapObject)) return;
+ReduceResult MaglevGraphBuilder::BuildCheckHeapObject(ValueNode* object) {
+  // Check for the empty type first so that we catch the case where
+  // GetType(object) is already empty.
+  if (IsEmptyNodeType(CombineType(GetType(object), NodeType::kAnyHeapObject))) {
+    return EmitUnconditionalDeopt(DeoptimizeReason::kSmi);
+  }
+  if (EnsureType(object, NodeType::kAnyHeapObject)) return ReduceResult::Done();
   AddNewNode<CheckHeapObject>({object});
+  return ReduceResult::Done();
 }
 
-void MaglevGraphBuilder::BuildCheckString(ValueNode* object) {
+ReduceResult MaglevGraphBuilder::BuildCheckString(ValueNode* object) {
   NodeType known_type;
-  if (EnsureType(object, NodeType::kString, &known_type)) return;
+  // Check for the empty type first so that we catch the case where
+  // GetType(object) is already empty.
+  if (IsEmptyNodeType(CombineType(GetType(object), NodeType::kString))) {
+    return EmitUnconditionalDeopt(DeoptimizeReason::kNotAString);
+  }
+  if (EnsureType(object, NodeType::kString, &known_type)) {
+    return ReduceResult::Done();
+  }
   AddNewNode<CheckString>({object}, GetCheckType(known_type));
+  return ReduceResult::Done();
 }
 
-void MaglevGraphBuilder::BuildCheckStringOrStringWrapper(ValueNode* object) {
+ReduceResult MaglevGraphBuilder::BuildCheckStringOrStringWrapper(
+    ValueNode* object) {
   NodeType known_type;
-  if (EnsureType(object, NodeType::kStringOrStringWrapper, &known_type)) return;
+  // Check for the empty type first so that we catch the case where
+  // GetType(object) is already empty.
+  if (IsEmptyNodeType(
+          CombineType(GetType(object), NodeType::kStringOrStringWrapper))) {
+    return EmitUnconditionalDeopt(DeoptimizeReason::kNotAStringOrStringWrapper);
+  }
+  if (EnsureType(object, NodeType::kStringOrStringWrapper, &known_type))
+    return ReduceResult::Done();
   AddNewNode<CheckStringOrStringWrapper>({object}, GetCheckType(known_type));
+  return ReduceResult::Done();
 }
 
-void MaglevGraphBuilder::BuildCheckNumber(ValueNode* object) {
-  if (EnsureType(object, NodeType::kNumber)) return;
+ReduceResult MaglevGraphBuilder::BuildCheckNumber(ValueNode* object) {
+  // Check for the empty type first so that we catch the case where
+  // GetType(object) is already empty.
+  if (IsEmptyNodeType(CombineType(GetType(object), NodeType::kNumber))) {
+    return EmitUnconditionalDeopt(DeoptimizeReason::kNotANumber);
+  }
+  if (EnsureType(object, NodeType::kNumber)) return ReduceResult::Done();
   AddNewNode<CheckNumber>({object}, Object::Conversion::kToNumber);
+  return ReduceResult::Done();
 }
 
-void MaglevGraphBuilder::BuildCheckSymbol(ValueNode* object) {
+ReduceResult MaglevGraphBuilder::BuildCheckSymbol(ValueNode* object) {
   NodeType known_type;
-  if (EnsureType(object, NodeType::kSymbol, &known_type)) return;
+  // Check for the empty type first so that we catch the case where
+  // GetType(object) is already empty.
+  if (IsEmptyNodeType(CombineType(GetType(object), NodeType::kSymbol))) {
+    return EmitUnconditionalDeopt(DeoptimizeReason::kNotASymbol);
+  }
+  if (EnsureType(object, NodeType::kSymbol, &known_type))
+    return ReduceResult::Done();
   AddNewNode<CheckSymbol>({object}, GetCheckType(known_type));
+  return ReduceResult::Done();
 }
 
-void MaglevGraphBuilder::BuildCheckJSReceiver(ValueNode* object) {
+ReduceResult MaglevGraphBuilder::BuildCheckJSReceiver(ValueNode* object) {
   NodeType known_type;
-  if (EnsureType(object, NodeType::kJSReceiver, &known_type)) return;
+  // Check for the empty type first so that we catch the case where
+  // GetType(object) is already empty.
+  if (IsEmptyNodeType(CombineType(GetType(object), NodeType::kJSReceiver))) {
+    return EmitUnconditionalDeopt(DeoptimizeReason::kWrongInstanceType);
+  }
+  if (EnsureType(object, NodeType::kJSReceiver, &known_type))
+    return ReduceResult::Done();
   AddNewNode<CheckInstanceType>({object}, GetCheckType(known_type),
                                 FIRST_JS_RECEIVER_TYPE, LAST_JS_RECEIVER_TYPE);
+  return ReduceResult::Done();
 }
 
-void MaglevGraphBuilder::BuildCheckJSReceiverOrNullOrUndefined(
+ReduceResult MaglevGraphBuilder::BuildCheckJSReceiverOrNullOrUndefined(
     ValueNode* object) {
   NodeType known_type;
+  // Check for the empty type first so that we catch the case where
+  // GetType(object) is already empty.
+  if (IsEmptyNodeType(CombineType(GetType(object),
+                                  NodeType::kJSReceiverOrNullOrUndefined))) {
+    return EmitUnconditionalDeopt(
+        DeoptimizeReason::kNotAJavaScriptObjectOrNullOrUndefined);
+  }
   if (EnsureType(object, NodeType::kJSReceiverOrNullOrUndefined, &known_type)) {
-    return;
+    return ReduceResult::Done();
   }
   AddNewNode<CheckJSReceiverOrNullOrUndefined>({object},
                                                GetCheckType(known_type));
+  return ReduceResult::Done();
 }
 
 namespace {
@@ -4962,7 +4995,7 @@ class KnownMapsMerger {
         }
       }
       if (intersect_set_.is_empty()) {
-        node_type_ = NodeType::kUnknown;
+        node_type_ = EmptyNodeType();
       }
     } else {
       // A missing entry here means the universal set, i.e., we don't know
@@ -5031,7 +5064,7 @@ class KnownMapsMerger {
   bool existing_known_maps_found_ = true;
   bool emit_check_with_migration_ = false;
   bool any_map_is_unstable_ = false;
-  NodeType node_type_ = static_cast<NodeType>(-1);
+  NodeType node_type_ = EmptyNodeType();
 
   Zone* zone() const { return zone_; }
 
@@ -5084,6 +5117,10 @@ ReduceResult MaglevGraphBuilder::BuildCheckMaps(
   KnownMapsMerger merger(broker(), zone(), maps);
   merger.IntersectWithKnownNodeAspects(object, known_node_aspects());
 
+  if (IsEmptyNodeType(CombineType(merger.node_type(), GetType(object)))) {
+    return EmitUnconditionalDeopt(DeoptimizeReason::kWrongMap);
+  }
+
   // If the known maps are the subset of the maps to check, we are done.
   if (merger.known_maps_are_subset_of_requested_maps()) {
     // The node type of known_info can get out of sync with the possible maps.
@@ -5248,7 +5285,7 @@ AllocationBlock* GetAllocation(ValueNode* object) {
 bool MaglevGraphBuilder::CanElideWriteBarrier(ValueNode* object,
                                               ValueNode* value) {
   if (value->Is<RootConstant>() || value->Is<ConsStringMap>()) return true;
-  if (CheckType(value, NodeType::kSmi)) {
+  if (!IsEmptyNodeType(GetType(value)) && CheckType(value, NodeType::kSmi)) {
     RecordUseReprHintIfPhi(value, UseRepresentation::kTagged);
     return true;
   }
@@ -5431,6 +5468,8 @@ Node* MaglevGraphBuilder::BuildStoreTaggedField(ValueNode* object,
   // may allocate, and are not used to set a VO.
   DCHECK_IMPLIES(store_mode != StoreTaggedMode::kInitializing,
                  !value->properties().is_conversion());
+  // TODO(marja): Bail out if `value` has the empty type. This requires that
+  // BuildInlinedAllocation can bail out.
   if (store_mode != StoreTaggedMode::kInitializing) {
     TryBuildStoreTaggedFieldToAllocation(object, value, offset);
   }
@@ -5455,7 +5494,7 @@ Node* MaglevGraphBuilder::BuildStoreTaggedField(ValueNode* object,
   }
 }
 
-void MaglevGraphBuilder::BuildStoreTaggedFieldNoWriteBarrier(
+Node* MaglevGraphBuilder::BuildStoreTaggedFieldNoWriteBarrier(
     ValueNode* object, ValueNode* value, int offset,
     StoreTaggedMode store_mode) {
   // The value may be used to initialize a VO, which can leak to IFS.
@@ -5468,8 +5507,8 @@ void MaglevGraphBuilder::BuildStoreTaggedFieldNoWriteBarrier(
   if (store_mode != StoreTaggedMode::kInitializing) {
     TryBuildStoreTaggedFieldToAllocation(object, value, offset);
   }
-  AddNewNode<StoreTaggedFieldNoWriteBarrier>({object, value}, offset,
-                                             store_mode);
+  return AddNewNode<StoreTaggedFieldNoWriteBarrier>({object, value}, offset,
+                                                    store_mode);
 }
 
 void MaglevGraphBuilder::BuildStoreTrustedPointerField(
@@ -5906,7 +5945,7 @@ MaybeReduceResult MaglevGraphBuilder::TryBuildStoreField(
         RETURN_IF_ABORT(BuildCheckMaps(
             value, base::VectorOf({access_info.field_map().value()})));
       } else {
-        BuildCheckHeapObject(value);
+        RETURN_IF_ABORT(BuildCheckHeapObject(value));
       }
     }
   }
@@ -6185,9 +6224,9 @@ MaybeReduceResult MaglevGraphBuilder::TryBuildNamedAccess(
       // Check for string maps before checking if we need to do an access
       // check. Primitive strings always get the prototype from the native
       // context they're operated on, so they don't need the access check.
-      BuildCheckString(lookup_start_object);
+      RETURN_IF_ABORT(BuildCheckString(lookup_start_object));
     } else if (HasOnlyNumberMaps(maps)) {
-      BuildCheckNumber(lookup_start_object);
+      RETURN_IF_ABORT(BuildCheckNumber(lookup_start_object));
     } else {
       RETURN_IF_ABORT(
           BuildCheckMaps(lookup_start_object, maps, {},
@@ -6294,7 +6333,7 @@ MaybeReduceResult MaglevGraphBuilder::TryBuildElementAccessOnString(
   }
 
   // Ensure that {object} is actually a String.
-  BuildCheckString(object);
+  RETURN_IF_ABORT(BuildCheckString(object));
 
   ValueNode* length = BuildLoadStringLength(object);
   ValueNode* index = GetInt32ElementIndex(index_object);
@@ -6444,6 +6483,21 @@ ReduceResult MaglevGraphBuilder::BuildLoadTypedArrayLength(
   bool is_variable_length = IsRabGsabTypedArrayElementsKind(elements_kind);
 
   if (!is_variable_length) {
+    if (auto const_object = TryGetConstant(broker(), local_isolate(), object)) {
+      // TODO(marja): Add TryGetConstant<JSTypedArray>().
+      if (const_object->IsJSTypedArray()) {
+        auto const_typed_array = const_object->AsJSTypedArray();
+        if (!const_typed_array.is_on_heap() &&
+            !IsRabGsabTypedArrayElementsKind(
+                const_typed_array.elements_kind(broker()))) {
+          size_t length = const_typed_array.length();
+          static_assert(ArrayBuffer::kMaxByteLength <=
+                        std::numeric_limits<intptr_t>::max());
+          return GetIntPtrConstant(static_cast<intptr_t>(length));
+        }
+      }
+    }
+
     // Note: We can't use broker()->length_string() here, because it could
     // conflict with redefinitions of the TypedArray length property.
     RETURN_IF_DONE(TryFindLoadedProperty(
@@ -6485,6 +6539,32 @@ ValueNode* MaglevGraphBuilder::BuildLoadTypedArrayElement(
 #undef BUILD_AND_RETURN_LOAD_TYPED_ARRAY
 }
 
+ValueNode* MaglevGraphBuilder::BuildLoadConstantTypedArrayElement(
+    compiler::JSTypedArrayRef typed_array, ValueNode* index,
+    ElementsKind elements_kind) {
+#define BUILD_AND_RETURN_LOAD_CONSTANT_TYPED_ARRAY(Type)    \
+  return AddNewNode<Load##Type##ConstantTypedArrayElement>( \
+      {index}, typed_array, elements_kind);
+
+  switch (elements_kind) {
+    case INT8_ELEMENTS:
+    case INT16_ELEMENTS:
+    case INT32_ELEMENTS:
+      BUILD_AND_RETURN_LOAD_CONSTANT_TYPED_ARRAY(SignedInt);
+    case UINT8_CLAMPED_ELEMENTS:
+    case UINT8_ELEMENTS:
+    case UINT16_ELEMENTS:
+    case UINT32_ELEMENTS:
+      BUILD_AND_RETURN_LOAD_CONSTANT_TYPED_ARRAY(UnsignedInt);
+    case FLOAT32_ELEMENTS:
+    case FLOAT64_ELEMENTS:
+      BUILD_AND_RETURN_LOAD_CONSTANT_TYPED_ARRAY(Double);
+    default:
+      UNREACHABLE();
+  }
+#undef BUILD_AND_RETURN_LOAD_CONSTANTTYPED_ARRAY
+}
+
 void MaglevGraphBuilder::BuildStoreTypedArrayElement(
     ValueNode* object, ValueNode* index, ElementsKind elements_kind) {
 #define BUILD_STORE_TYPED_ARRAY(Type, value)                           \
@@ -6523,6 +6603,46 @@ void MaglevGraphBuilder::BuildStoreTypedArrayElement(
 #undef BUILD_STORE_TYPED_ARRAY
 }
 
+void MaglevGraphBuilder::BuildStoreConstantTypedArrayElement(
+    compiler::JSTypedArrayRef typed_array, ValueNode* index,
+    ElementsKind elements_kind) {
+#define BUILD_STORE_CONSTANT_TYPED_ARRAY(Type, value) \
+  AddNewNode<Store##Type##ConstantTypedArrayElement>( \
+      {index, (value)}, typed_array, elements_kind);
+
+  // TODO(leszeks): These operations have a deopt loop when the ToNumber
+  // conversion sees a type other than number or oddball. Turbofan has the same
+  // deopt loop, but ideally we'd avoid it.
+  switch (elements_kind) {
+    case UINT8_CLAMPED_ELEMENTS: {
+      BUILD_STORE_CONSTANT_TYPED_ARRAY(Int,
+                                       GetAccumulatorUint8ClampedForToNumber())
+      break;
+    }
+    case INT8_ELEMENTS:
+    case INT16_ELEMENTS:
+    case INT32_ELEMENTS:
+    case UINT8_ELEMENTS:
+    case UINT16_ELEMENTS:
+    case UINT32_ELEMENTS:
+      BUILD_STORE_CONSTANT_TYPED_ARRAY(
+          Int, GetAccumulatorTruncatedInt32ForToNumber(
+                   NodeType::kNumberOrOddball,
+                   TaggedToFloat64ConversionType::kNumberOrOddball))
+      break;
+    case FLOAT32_ELEMENTS:
+    case FLOAT64_ELEMENTS:
+      BUILD_STORE_CONSTANT_TYPED_ARRAY(
+          Double, GetAccumulatorHoleyFloat64ForToNumber(
+                      NodeType::kNumberOrOddball,
+                      TaggedToFloat64ConversionType::kNumberOrOddball))
+      break;
+    default:
+      UNREACHABLE();
+  }
+#undef BUILD_STORE_CONSTANT_TYPED_ARRAY
+}
+
 MaybeReduceResult MaglevGraphBuilder::TryBuildElementAccessOnTypedArray(
     ValueNode* object, ValueNode* index_object,
     const compiler::ElementAccessInfo& access_info,
@@ -6565,9 +6685,28 @@ MaybeReduceResult MaglevGraphBuilder::TryBuildElementAccessOnTypedArray(
   switch (keyed_mode.access_mode()) {
     case compiler::AccessMode::kLoad:
       DCHECK(!LoadModeHandlesOOB(keyed_mode.load_mode()));
+      if (auto constant = object->TryCast<Constant>()) {
+        compiler::HeapObjectRef constant_object = constant->object();
+        if (constant_object.IsJSTypedArray() &&
+            constant_object.AsJSTypedArray().is_off_heap_non_rab_gsab(
+                broker())) {
+          return BuildLoadConstantTypedArrayElement(
+              constant_object.AsJSTypedArray(), index, elements_kind);
+        }
+      }
       return BuildLoadTypedArrayElement(object, index, elements_kind);
     case compiler::AccessMode::kStore:
       DCHECK(StoreModeIsInBounds(keyed_mode.store_mode()));
+      if (auto constant = object->TryCast<Constant>()) {
+        compiler::HeapObjectRef constant_object = constant->object();
+        if (constant_object.IsJSTypedArray() &&
+            constant_object.AsJSTypedArray().is_off_heap_non_rab_gsab(
+                broker())) {
+          BuildStoreConstantTypedArrayElement(constant_object.AsJSTypedArray(),
+                                              index, elements_kind);
+          return ReduceResult::Done();
+        }
+      }
       BuildStoreTypedArrayElement(object, index, elements_kind);
       return ReduceResult::Done();
     case compiler::AccessMode::kHas:
@@ -6895,7 +7034,7 @@ MaybeReduceResult MaglevGraphBuilder::TryBuildElementAccess(
       }
 #endif  // DEBUG
 
-      BuildCheckHeapObject(object);
+      RETURN_IF_ABORT(BuildCheckHeapObject(object));
       ValueNode* object_map =
           BuildLoadTaggedField(object, HeapObject::kMapOffset);
 
@@ -6937,7 +7076,7 @@ MaybeReduceResult MaglevGraphBuilder::TryBuildPolymorphicElementAccess(
   std::optional<MaglevSubGraphBuilder::Label> done;
   std::optional<MaglevSubGraphBuilder::Label> generic_access;
 
-  BuildCheckHeapObject(object);
+  RETURN_IF_ABORT(BuildCheckHeapObject(object));
   ValueNode* object_map = BuildLoadTaggedField(object, HeapObject::kMapOffset);
 
   // TODO(pthier): We could do better here than just emitting code for each map,
@@ -7062,7 +7201,7 @@ MaybeReduceResult MaglevGraphBuilder::TryBuildPolymorphicPropertyAccess(
     GenericAccessFunc&& build_generic_access) {
   const bool is_any_store = compiler::IsAnyStore(access_mode);
   const int access_info_count = static_cast<int>(access_infos.size());
-  int number_map_index = -1;
+  int number_map_index_for_smi = -1;
 
   bool needs_migration = false;
   bool has_deprecated_map_without_migration_target =
@@ -7080,9 +7219,11 @@ MaybeReduceResult MaglevGraphBuilder::TryBuildPolymorphicPropertyAccess(
         KnownMapsMerger merger(broker(), zone(), base::VectorOf(known_maps));
         merger.IntersectWithKnownNodeAspects(lookup_start_object,
                                              known_node_aspects());
-        if (!merger.intersect_set().is_empty()) {
-          DCHECK_EQ(number_map_index, -1);
-          number_map_index = i;
+        if (!merger.intersect_set().is_empty() &&
+            !IsEmptyNodeType(
+                CombineType(GetType(lookup_start_object), NodeType::kSmi))) {
+          DCHECK_EQ(number_map_index_for_smi, -1);
+          number_map_index_for_smi = i;
         }
       }
     }
@@ -7095,11 +7236,11 @@ MaybeReduceResult MaglevGraphBuilder::TryBuildPolymorphicPropertyAccess(
   std::optional<MaglevSubGraphBuilder::Label> is_number;
   std::optional<MaglevSubGraphBuilder::Label> generic_access;
 
-  if (number_map_index >= 0) {
+  if (number_map_index_for_smi >= 0) {
     is_number.emplace(&sub_graph, 2);
     sub_graph.GotoIfTrue<BranchIfSmi>(&*is_number, {lookup_start_object});
   } else {
-    BuildCheckHeapObject(lookup_start_object);
+    RETURN_IF_ABORT(BuildCheckHeapObject(lookup_start_object));
   }
   ValueNode* lookup_start_object_map =
       BuildLoadTaggedField(lookup_start_object, HeapObject::kMapOffset);
@@ -7128,11 +7269,12 @@ MaybeReduceResult MaglevGraphBuilder::TryBuildPolymorphicPropertyAccess(
                            base::VectorOf(maps), &sub_graph, check_next_map);
     }
     if (map_check_result.IsDoneWithAbort()) {
+      DCHECK_NE(i, number_map_index_for_smi);
       // We know from known possible maps that this branch is not reachable,
       // so don't emit any code for it.
       continue;
     }
-    if (i == number_map_index) {
+    if (i == number_map_index_for_smi) {
       DCHECK(is_number.has_value());
       sub_graph.Goto(&*is_number);
       sub_graph.Bind(&*is_number);
@@ -7474,7 +7616,7 @@ ReduceResult MaglevGraphBuilder::VisitGetNamedPropertyFromSuper() {
   return ReduceResult::Done();
 }
 
-bool MaglevGraphBuilder::TryBuildGetKeyedPropertyWithEnumeratedKey(
+MaybeReduceResult MaglevGraphBuilder::TryBuildGetKeyedPropertyWithEnumeratedKey(
     ValueNode* object, const compiler::FeedbackSource& feedback_source,
     const compiler::ProcessedFeedback& processed_feedback) {
   if (current_for_in_state.index != nullptr &&
@@ -7488,9 +7630,11 @@ bool MaglevGraphBuilder::TryBuildGetKeyedPropertyWithEnumeratedKey(
       // the enum cache if the map match the {cache_type}.
       if (processed_feedback.kind() !=
           compiler::ProcessedFeedback::kInsufficient) {
-        return false;
+        return MaybeReduceResult::Fail();
+      }
+      if (BuildCheckHeapObject(object).IsDoneWithAbort()) {
+        return ReduceResult::DoneWithAbort();
       }
-      BuildCheckHeapObject(object);
       speculating_receiver_map_matches = true;
     }
 
@@ -7509,18 +7653,16 @@ bool MaglevGraphBuilder::TryBuildGetKeyedPropertyWithEnumeratedKey(
         current_for_in_state.enum_cache_indices, current_for_in_state.index);
     SetAccumulator(
         AddNewNode<LoadTaggedFieldByFieldIndex>({object, field_index}));
-    return true;
+    return ReduceResult::Done();
   }
-  return false;
+  return MaybeReduceResult::Fail();
 }
 
 ReduceResult MaglevGraphBuilder::BuildGetKeyedProperty(
     ValueNode* object, const compiler::FeedbackSource& feedback_source,
     const compiler::ProcessedFeedback& processed_feedback) {
-  if (TryBuildGetKeyedPropertyWithEnumeratedKey(object, feedback_source,
-                                                processed_feedback)) {
-    return ReduceResult::Done();
-  }
+  RETURN_IF_DONE(TryBuildGetKeyedPropertyWithEnumeratedKey(
+      object, feedback_source, processed_feedback));
 
   auto build_generic_access = [this, object, &feedback_source]() {
     ValueNode* context = GetContext();
@@ -7615,8 +7757,9 @@ ReduceResult MaglevGraphBuilder::VisitLdaModuleVariable() {
   size_t depth = iterator_.GetUnsignedImmediateOperand(1);
   ValueNode* context = GetContextAtDepth(GetContext(), depth);
 
-  ValueNode* module = LoadAndCacheContextSlot(
-      context, Context::EXTENSION_INDEX, kImmutable, ContextKind::kDefault);
+  ValueNode* module =
+      LoadAndCacheContextSlot(context, Context::EXTENSION_INDEX, kImmutable,
+                              ContextMode::kNoContextCells);
   ValueNode* exports_or_imports;
   if (cell_index > 0) {
     exports_or_imports =
@@ -7649,7 +7792,7 @@ ValueNode* MaglevGraphBuilder::GetContextAtDepth(ValueNode* context,
 
   for (size_t i = 0; i < depth; i++) {
     context = LoadAndCacheContextSlot(context, Context::PREVIOUS_INDEX,
-                                      kImmutable, ContextKind::kDefault);
+                                      kImmutable, ContextMode::kNoContextCells);
   }
   return context;
 }
@@ -7667,8 +7810,9 @@ ReduceResult MaglevGraphBuilder::VisitStaModuleVariable() {
   size_t depth = iterator_.GetUnsignedImmediateOperand(1);
   ValueNode* context = GetContextAtDepth(GetContext(), depth);
 
-  ValueNode* module = LoadAndCacheContextSlot(
-      context, Context::EXTENSION_INDEX, kImmutable, ContextKind::kDefault);
+  ValueNode* module =
+      LoadAndCacheContextSlot(context, Context::EXTENSION_INDEX, kImmutable,
+                              ContextMode::kNoContextCells);
   ValueNode* exports =
       BuildLoadTaggedField(module, SourceTextModule::kRegularExportsOffset);
   // The actual array index is (cell_index - 1).
@@ -7887,6 +8031,25 @@ ReduceResult MaglevGraphBuilder::VisitDefineKeyedOwnPropertyInLiteral() {
 ReduceResult MaglevGraphBuilder::VisitAdd() {
   return VisitBinaryOperation<Operation::kAdd>();
 }
+ReduceResult MaglevGraphBuilder::VisitAdd_LhsIsStringConstant_Internalize() {
+  ValueNode* left = LoadRegister(0);
+  ValueNode* right = GetAccumulator();
+  FeedbackNexus nexus = FeedbackNexusForOperand(1);
+  ValueNode* slot = GetSmiConstant(nexus.slot().ToInt());
+  ValueNode* result;
+  if (is_inline()) {
+    ValueNode* vector = GetConstant(feedback());
+    result =
+        BuildCallBuiltin<Builtin::kAddLhsIsStringConstantInternalizeWithVector>(
+            {left, right, slot, vector});
+  } else {
+    result =
+        BuildCallBuiltin<Builtin::kAddLhsIsStringConstantInternalizeTrampoline>(
+            {left, right, slot});
+  }
+  SetAccumulator(result);
+  return ReduceResult::Done();
+}
 ReduceResult MaglevGraphBuilder::VisitSub() {
   return VisitBinaryOperation<Operation::kSubtract>();
 }
@@ -8008,11 +8171,11 @@ ReduceResult MaglevGraphBuilder::VisitTypeOf() {
       return EmitUnconditionalDeopt(
           DeoptimizeReason::kInsufficientTypeFeedbackForTypeOf);
     case TypeOfFeedback::kNumber:
-      BuildCheckNumber(value);
+      RETURN_IF_ABORT(BuildCheckNumber(value));
       SetAccumulator(GetRootConstant(RootIndex::knumber_string));
       return ReduceResult::Done();
     case TypeOfFeedback::kString:
-      BuildCheckString(value);
+      RETURN_IF_ABORT(BuildCheckString(value));
       SetAccumulator(GetRootConstant(RootIndex::kstring_string));
       return ReduceResult::Done();
     case TypeOfFeedback::kFunction:
@@ -9247,7 +9410,7 @@ MaybeReduceResult MaglevGraphBuilder::TryReduceStringPrototypeCharCodeAt(
   }
 
   // Ensure that {receiver} is actually a String.
-  BuildCheckString(receiver);
+  RETURN_IF_ABORT(BuildCheckString(receiver));
   // And index is below length.
   ValueNode* length = BuildLoadStringLength(receiver);
   RETURN_IF_ABORT(TryBuildCheckInt32Condition(
@@ -9271,7 +9434,7 @@ MaybeReduceResult MaglevGraphBuilder::TryReduceStringPrototypeCodePointAt(
   }
   // Any other argument is ignored.
   // Ensure that {receiver} is actually a String.
-  BuildCheckString(receiver);
+  RETURN_IF_ABORT(BuildCheckString(receiver));
   // And index is below length.
   ValueNode* length = BuildLoadStringLength(receiver);
   RETURN_IF_ABORT(TryBuildCheckInt32Condition(
@@ -9287,7 +9450,7 @@ MaybeReduceResult MaglevGraphBuilder::TryReduceStringPrototypeIterator(
   if (!CanSpeculateCall()) return {};
   ValueNode* receiver = GetValueOrUndefined(args.receiver());
   // Ensure that {receiver} is actually a String.
-  BuildCheckString(receiver);
+  RETURN_IF_ABORT(BuildCheckString(receiver));
   compiler::MapRef map =
       broker()->target_native_context().initial_string_iterator_map(broker());
   VirtualObject* string_iterator = CreateJSStringIterator(map, receiver);
@@ -10510,7 +10673,7 @@ ValueNode* MaglevGraphBuilder::BuildCallSelf(
   graph()->set_has_recursive_calls(true);
   DCHECK_EQ(
       compilation_unit_->info()->toplevel_compilation_unit()->parameter_count(),
-      shared.internal_formal_parameter_count_with_receiver());
+      shared.internal_formal_parameter_count_with_receiver_deprecated());
   return AddNewNode<CallSelf>(
       input_count,
       [&](CallSelf* call) {
@@ -11381,8 +11544,8 @@ ReduceResult MaglevGraphBuilder::VisitCallJSRuntime() {
   compiler::NativeContextRef native_context = broker()->target_native_context();
   ValueNode* context = GetConstant(native_context);
   uint32_t slot = iterator_.GetNativeContextIndexOperand(0);
-  ValueNode* callee =
-      LoadAndCacheContextSlot(context, slot, kMutable, ContextKind::kDefault);
+  ValueNode* callee = LoadAndCacheContextSlot(context, slot, kMutable,
+                                              ContextMode::kNoContextCells);
   // Call the function.
   interpreter::RegisterList reglist = iterator_.GetRegisterListOperand(1);
   CallArguments args(ConvertReceiverMode::kNullOrUndefined, reglist,
diff --git a/deps/v8/src/maglev/maglev-graph-builder.h b/deps/v8/src/maglev/maglev-graph-builder.h
index 8da2b8e86671ce..87730a884f3c83 100644
--- a/deps/v8/src/maglev/maglev-graph-builder.h
+++ b/deps/v8/src/maglev/maglev-graph-builder.h
@@ -352,6 +352,16 @@ class MaglevGraphBuilder {
     return it->second;
   }
 
+  IntPtrConstant* GetIntPtrConstant(intptr_t constant) {
+    auto it = graph_->intptr().find(constant);
+    if (it == graph_->intptr().end()) {
+      IntPtrConstant* node = CreateNewConstantNode<IntPtrConstant>(0, constant);
+      graph_->intptr().emplace(constant, node);
+      return node;
+    }
+    return it->second;
+  }
+
   Uint32Constant* GetUint32Constant(int constant) {
     auto it = graph_->uint32().find(constant);
     if (it == graph_->uint32().end()) {
@@ -597,7 +607,7 @@ class MaglevGraphBuilder {
     // same maglev osr code again, before reaching the turbofan OSR code in the
     // callee. The solution is to support osr from maglev without
     // deoptimization.
-    return !(graph_->is_osr() && is_inline());
+    return !is_inline();
   }
   bool MaglevIsTopTier() const { return !v8_flags.turbofan && v8_flags.maglev; }
   BasicBlock* CreateEdgeSplitBlock(BasicBlockRef& jump_targets,
@@ -1040,6 +1050,8 @@ class MaglevGraphBuilder {
       int i = 0;
       constexpr UseReprHintRecording hint = ShouldRecordUseReprHint<NodeT>();
       for (ValueNode* raw_input : raw_inputs) {
+        // TODO(marja): Here we might already have the empty type for the
+        // node. Generate a deopt and make callers handle it.
         inputs[i] = ConvertInputTo<hint>(raw_input, NodeT::kInputTypes[i]);
         i++;
       }
@@ -1300,26 +1312,25 @@ class MaglevGraphBuilder {
   bool TrySpecializeLoadContextSlotToFunctionContext(
       ValueNode* context, int slot_index,
       ContextSlotMutability slot_mutability);
-  ValueNode* TrySpecializeLoadScriptContextSlot(ValueNode* context, int index);
+  ValueNode* TrySpecializeLoadContextSlot(ValueNode* context, int index);
   ValueNode* LoadAndCacheContextSlot(ValueNode* context, int offset,
                                      ContextSlotMutability slot_mutability,
-                                     ContextKind context_kind);
-  MaybeReduceResult TrySpecializeStoreScriptContextSlot(ValueNode* context,
-                                                        int index,
-                                                        ValueNode* value,
-                                                        Node** store);
+                                     ContextMode context_mode);
+  MaybeReduceResult TrySpecializeStoreContextSlot(ValueNode* context, int index,
+                                                  ValueNode* value,
+                                                  Node** store);
   ReduceResult StoreAndCacheContextSlot(ValueNode* context, int index,
                                         ValueNode* value,
-                                        ContextKind context_kind);
+                                        ContextMode context_mode);
   ValueNode* TryGetParentContext(ValueNode* node);
   void MinimizeContextChainDepth(ValueNode** context, size_t* depth);
   void EscapeContext();
   void BuildLoadContextSlot(ValueNode* context, size_t depth, int slot_index,
                             ContextSlotMutability slot_mutability,
-                            ContextKind context_kind);
+                            ContextMode context_mode);
   ReduceResult BuildStoreContextSlot(ValueNode* context, size_t depth,
                                      int slot_index, ValueNode* value,
-                                     ContextKind context_kind);
+                                     ContextMode context_mode);
 
   void BuildStoreMap(ValueNode* object, compiler::MapRef map,
                      StoreMap::Kind kind);
@@ -2343,13 +2354,13 @@ class MaglevGraphBuilder {
       TaggedToFloat64ConversionType conversion_type);
 
   ReduceResult BuildCheckSmi(ValueNode* object, bool elidable = true);
-  void BuildCheckNumber(ValueNode* object);
-  void BuildCheckHeapObject(ValueNode* object);
-  void BuildCheckJSReceiver(ValueNode* object);
-  void BuildCheckJSReceiverOrNullOrUndefined(ValueNode* object);
-  void BuildCheckString(ValueNode* object);
-  void BuildCheckStringOrStringWrapper(ValueNode* object);
-  void BuildCheckSymbol(ValueNode* object);
+  ReduceResult BuildCheckNumber(ValueNode* object);
+  ReduceResult BuildCheckHeapObject(ValueNode* object);
+  ReduceResult BuildCheckJSReceiver(ValueNode* object);
+  ReduceResult BuildCheckJSReceiverOrNullOrUndefined(ValueNode* object);
+  ReduceResult BuildCheckString(ValueNode* object);
+  ReduceResult BuildCheckStringOrStringWrapper(ValueNode* object);
+  ReduceResult BuildCheckSymbol(ValueNode* object);
   ReduceResult BuildCheckMaps(
       ValueNode* object, base::Vector<const compiler::MapRef> maps,
       std::optional<ValueNode*> map = {},
@@ -2430,9 +2441,9 @@ class MaglevGraphBuilder {
 
   Node* BuildStoreTaggedField(ValueNode* object, ValueNode* value, int offset,
                               StoreTaggedMode store_mode);
-  void BuildStoreTaggedFieldNoWriteBarrier(ValueNode* object, ValueNode* value,
-                                           int offset,
-                                           StoreTaggedMode store_mode);
+  Node* BuildStoreTaggedFieldNoWriteBarrier(ValueNode* object, ValueNode* value,
+                                            int offset,
+                                            StoreTaggedMode store_mode);
   void BuildStoreTrustedPointerField(ValueNode* object, ValueNode* value,
                                      int offset, IndirectPointerTag tag,
                                      StoreTaggedMode store_mode);
@@ -2492,7 +2503,7 @@ class MaglevGraphBuilder {
   MaybeReduceResult TryBuildPropertySetterCall(
       compiler::PropertyAccessInfo const& access_info, ValueNode* receiver,
       ValueNode* lookup_start_object, ValueNode* value);
-  bool TryBuildGetKeyedPropertyWithEnumeratedKey(
+  MaybeReduceResult TryBuildGetKeyedPropertyWithEnumeratedKey(
       ValueNode* object, const compiler::FeedbackSource& feedback_source,
       const compiler::ProcessedFeedback& processed_feedback);
   ReduceResult BuildGetKeyedProperty(
@@ -2540,8 +2551,14 @@ class MaglevGraphBuilder {
                                          ElementsKind elements_kind);
   ValueNode* BuildLoadTypedArrayElement(ValueNode* object, ValueNode* index,
                                         ElementsKind elements_kind);
+  ValueNode* BuildLoadConstantTypedArrayElement(
+      compiler::JSTypedArrayRef typed_array, ValueNode* index,
+      ElementsKind elements_kind);
   void BuildStoreTypedArrayElement(ValueNode* object, ValueNode* index,
                                    ElementsKind elements_kind);
+  void BuildStoreConstantTypedArrayElement(
+      compiler::JSTypedArrayRef typed_array, ValueNode* index,
+      ElementsKind elements_kind);
 
   MaybeReduceResult TryBuildElementAccessOnString(
       ValueNode* object, ValueNode* index,
diff --git a/deps/v8/src/maglev/maglev-graph-processor.h b/deps/v8/src/maglev/maglev-graph-processor.h
index 088399c2e8e19d..d185c94d1c8d10 100644
--- a/deps/v8/src/maglev/maglev-graph-processor.h
+++ b/deps/v8/src/maglev/maglev-graph-processor.h
@@ -122,6 +122,7 @@ class GraphProcessor {
     process_constants(graph->tagged_index());
     process_constants(graph->int32());
     process_constants(graph->uint32());
+    process_constants(graph->intptr());
     process_constants(graph->float64());
     process_constants(graph->external_references());
     process_constants(graph->trusted_constants());
diff --git a/deps/v8/src/maglev/maglev-graph.h b/deps/v8/src/maglev/maglev-graph.h
index 64758ca0c9cd7d..2ad5e435646627 100644
--- a/deps/v8/src/maglev/maglev-graph.h
+++ b/deps/v8/src/maglev/maglev-graph.h
@@ -37,6 +37,7 @@ class Graph final : public ZoneObject {
         tagged_index_(zone),
         int32_(zone),
         uint32_(zone),
+        intptr_(zone),
         float_(zone),
         external_references_(zone),
         parameters_(zone),
@@ -143,6 +144,7 @@ class Graph final : public ZoneObject {
   ZoneMap<int, TaggedIndexConstant*>& tagged_index() { return tagged_index_; }
   ZoneMap<int32_t, Int32Constant*>& int32() { return int32_; }
   ZoneMap<uint32_t, Uint32Constant*>& uint32() { return uint32_; }
+  ZoneMap<intptr_t, IntPtrConstant*>& intptr() { return intptr_; }
   ZoneMap<uint64_t, Float64Constant*>& float64() { return float_; }
   ZoneMap<Address, ExternalConstant*>& external_references() {
     return external_references_;
@@ -278,6 +280,7 @@ class Graph final : public ZoneObject {
   ZoneMap<int, TaggedIndexConstant*> tagged_index_;
   ZoneMap<int32_t, Int32Constant*> int32_;
   ZoneMap<uint32_t, Uint32Constant*> uint32_;
+  ZoneMap<intptr_t, IntPtrConstant*> intptr_;
   // Use the bits of the float as the key.
   ZoneMap<uint64_t, Float64Constant*> float_;
   ZoneMap<Address, ExternalConstant*> external_references_;
diff --git a/deps/v8/src/maglev/maglev-interpreter-frame-state.cc b/deps/v8/src/maglev/maglev-interpreter-frame-state.cc
index a6d2ab4d894657..5a4367c70cb2f0 100644
--- a/deps/v8/src/maglev/maglev-interpreter-frame-state.cc
+++ b/deps/v8/src/maglev/maglev-interpreter-frame-state.cc
@@ -1096,9 +1096,13 @@ ValueNode* MergePointInterpreterFrameState::MergeValue(
         // happened to be true before allowing the loop to conclude in
         // `TryMergeLoop`. Some types which are known to cause issues are
         // generalized here.
-        NodeType initial_optimistic_type =
-            (unmerged_type == NodeType::kInternalizedString) ? NodeType::kString
-                                                             : unmerged_type;
+        NodeType initial_optimistic_type = unmerged_type;
+        if (!IsEmptyNodeType(CombineType(unmerged_type, NodeType::kString))) {
+          // Make sure we don't depend on something being an internalized string
+          // in particular, by making the type cover all String subtypes.
+          initial_optimistic_type =
+              IntersectType(unmerged_type, NodeType::kString);
+        }
         result->set_type(initial_optimistic_type);
       }
     } else {
diff --git a/deps/v8/src/maglev/maglev-ir-inl.h b/deps/v8/src/maglev/maglev-ir-inl.h
index c5ed7a316c4cfe..7460bc15d6e159 100644
--- a/deps/v8/src/maglev/maglev-ir-inl.h
+++ b/deps/v8/src/maglev/maglev-ir-inl.h
@@ -100,7 +100,8 @@ CallKnownJSFunction::CallKnownJSFunction(
           IsolateGroup::current()->js_dispatch_table()->GetParameterCount(
               dispatch_handle)
 #else
-          shared_function_info.internal_formal_parameter_count_with_receiver()
+          shared_function_info
+              .internal_formal_parameter_count_with_receiver_deprecated()
 #endif
       ) {
   set_input(kClosureIndex, closure);
diff --git a/deps/v8/src/maglev/maglev-ir.cc b/deps/v8/src/maglev/maglev-ir.cc
index a3b2290d30db3d..f642da058a4095 100644
--- a/deps/v8/src/maglev/maglev-ir.cc
+++ b/deps/v8/src/maglev/maglev-ir.cc
@@ -889,6 +889,10 @@ DirectHandle<Object> Uint32Constant::DoReify(LocalIsolate* isolate) const {
   return isolate->factory()->NewNumberFromUint<AllocationType::kOld>(value());
 }
 
+DirectHandle<Object> IntPtrConstant::DoReify(LocalIsolate* isolate) const {
+  return isolate->factory()->NewNumberFromInt64<AllocationType::kOld>(value());
+}
+
 DirectHandle<Object> Float64Constant::DoReify(LocalIsolate* isolate) const {
   return isolate->factory()->NewNumber<AllocationType::kOld>(
       value_.get_scalar());
@@ -1000,6 +1004,10 @@ void Uint32Constant::DoLoadToRegister(MaglevAssembler* masm, Register reg) {
   __ Move(reg, value());
 }
 
+void IntPtrConstant::DoLoadToRegister(MaglevAssembler* masm, Register reg) {
+  __ Move(reg, value());
+}
+
 void Float64Constant::DoLoadToRegister(MaglevAssembler* masm,
                                        DoubleRegister reg) {
   __ Move(reg, value());
@@ -1053,6 +1061,10 @@ void Uint32Constant::SetValueLocationConstraints() { DefineAsConstant(this); }
 void Uint32Constant::GenerateCode(MaglevAssembler* masm,
                                   const ProcessingState& state) {}
 
+void IntPtrConstant::SetValueLocationConstraints() { DefineAsConstant(this); }
+void IntPtrConstant::GenerateCode(MaglevAssembler* masm,
+                                  const ProcessingState& state) {}
+
 void Float64Constant::SetValueLocationConstraints() { DefineAsConstant(this); }
 void Float64Constant::GenerateCode(MaglevAssembler* masm,
                                    const ProcessingState& state) {}
@@ -2471,22 +2483,6 @@ void CheckedHoleyFloat64ToFloat64::GenerateCode(MaglevAssembler* masm,
                    __ GetDeoptLabel(this, DeoptimizeReason::kHole));
 }
 
-void LoadHeapInt32::SetValueLocationConstraints() {
-  UseRegister(object_input());
-  DefineAsRegister(this);
-  set_temporaries_needed(1);
-}
-void LoadHeapInt32::GenerateCode(MaglevAssembler* masm,
-                                 const ProcessingState& state) {
-  MaglevAssembler::TemporaryRegisterScope temps(masm);
-  Register tmp = temps.Acquire();
-  Register object = ToRegister(object_input());
-  __ AssertNotSmi(object);
-  __ LoadTaggedField(tmp, object, offset());
-  __ AssertNotSmi(tmp);
-  __ LoadHeapInt32Value(ToRegister(result()), tmp);
-}
-
 void LoadDoubleField::SetValueLocationConstraints() {
   UseRegister(object_input());
   DefineAsRegister(this);
@@ -2560,67 +2556,45 @@ void LoadTaggedFieldForScriptContextSlot::GenerateCode(
   __ AssertObjectType(script_context, SCRIPT_CONTEXT_TYPE,
                       AbortReason::kUnexpectedInstanceType);
 
-  // Be sure to not clobber script_context.
-  if (value == script_context) {
-    Register tmp = temps.Acquire();
-    __ Move(tmp, script_context);
-    script_context = tmp;
-  }
-
   // Load value from context.
   __ LoadTaggedField(value, script_context, offset());
 
-  // Check side table if HeapNumber.
+  // Check if an ContextCell
   __ JumpIfSmi(value, *done);
-  __ CompareMapWithRoot(value, RootIndex::kHeapNumberMap, scratch);
+  __ CompareMapWithRoot(value, RootIndex::kContextCellMap, scratch);
   __ JumpToDeferredIf(
       kEqual,
-      [](MaglevAssembler* masm, Register script_context, Register result_reg,
-         Register scratch, LoadTaggedFieldForScriptContextSlot* node,
-         ZoneLabelRef done) {
-        Label property_loaded;
-        Label check_heap_number, allocate;
-        // Load side table.
-        // TODO(victorgomes): Should we hoist the side_table?
-        __ LoadTaggedField(scratch, script_context,
-                           Context::OffsetOfElementAt(
-                               Context::CONTEXT_SIDE_TABLE_PROPERTY_INDEX));
-        __ LoadTaggedField(
-            scratch, scratch,
-            FixedArray::OffsetOfElementAt(node->index() -
-                                          Context::MIN_CONTEXT_EXTENDED_SLOTS));
-
-        __ JumpIfSmi(scratch, &property_loaded);
-        __ AssertObjectType(scratch, CONTEXT_SIDE_PROPERTY_CELL_TYPE,
-                            AbortReason::kUnexpectedInstanceType);
-        __ LoadTaggedField(scratch, scratch,
-                           ContextSidePropertyCell::kPropertyDetailsRawOffset);
-        __ bind(&property_loaded);
-
+      [](MaglevAssembler* masm, Register value, Register scratch,
+         LoadTaggedFieldForScriptContextSlot* node, ZoneLabelRef done) {
         MaglevAssembler::TemporaryRegisterScope temps(masm);
         DoubleRegister double_value = temps.AcquireDouble();
+        Label allocate, is_untagged;
+        __ LoadContextCellState(scratch, value);
+
+        static_assert(ContextCell::State::kConst == 0);
+        static_assert(ContextCell::State::kSmi == 1);
+        __ CompareInt32AndJumpIf(scratch, ContextCell::kSmi, kGreaterThan,
+                                 &is_untagged);
+        __ LoadContextCellTaggedValue(value, value);
+        __ Jump(*done);
 
-        if (v8_flags.script_context_mutable_heap_int32) {
-          __ CompareTaggedAndJumpIf(scratch,
-                                    ContextSidePropertyCell::MutableInt32(),
-                                    kNotEqual, &check_heap_number);
-          __ LoadHeapInt32Value(scratch, result_reg);
+        __ bind(&is_untagged);
+        {
+          Label check_float64;
+          __ CompareInt32AndJumpIf(scratch, ContextCell::kInt32, kNotEqual,
+                                   &check_float64);
+          __ LoadContextCellInt32Value(scratch, value);
           __ Int32ToDouble(double_value, scratch);
           __ Jump(&allocate, Label::kNear);
+          __ bind(&check_float64);
         }
-
-        __ bind(&check_heap_number);
-        __ CompareTaggedAndJumpIf(scratch,
-                                  ContextSidePropertyCell::MutableHeapNumber(),
-                                  kNotEqual, *done);
-        __ LoadHeapNumberValue(double_value, result_reg);
+        __ LoadContextCellFloat64Value(double_value, value);
 
         __ bind(&allocate);
-        __ AllocateHeapNumber(node->register_snapshot(), result_reg,
-                              double_value);
+        __ AllocateHeapNumber(node->register_snapshot(), value, double_value);
         __ Jump(*done);
       },
-      script_context, value, scratch, this, done);
+      value, scratch, this, done);
 
   __ bind(*done);
 }
@@ -3495,12 +3469,24 @@ void CheckCacheIndicesNotCleared::GenerateCode(MaglevAssembler* masm,
 
 void CheckTypedArrayBounds::SetValueLocationConstraints() {
   UseRegister(index_input());
-  UseRegister(length_input());
+  if (length_input().node()->Is<IntPtrConstant>()) {
+    UseAny(length_input());
+    set_temporaries_needed(1);
+  } else {
+    UseRegister(length_input());
+  }
 }
 void CheckTypedArrayBounds::GenerateCode(MaglevAssembler* masm,
                                          const ProcessingState& state) {
+  MaglevAssembler::TemporaryRegisterScope temps(masm);
   Register index = ToRegister(index_input());
-  Register length = ToRegister(length_input());
+  Register length = Register::no_reg();
+  if (auto length_constant = length_input().node()->TryCast<IntPtrConstant>()) {
+    length = temps.Acquire();
+    __ Move(length, length_constant->value());
+  } else {
+    length = ToRegister(length_input());
+  }
   // The index must be a zero-extended Uint32 for this to work.
 #ifdef V8_TARGET_ARCH_RISCV64
   // All Word32 values are been signed-extended in Register in RISCV.
@@ -3523,22 +3509,22 @@ void CheckInt32Condition::GenerateCode(MaglevAssembler* masm,
                            NegateCondition(ToCondition(condition())), fail);
 }
 
-int StoreScriptContextSlotWithWriteBarrier::MaxCallStackArgs() const {
+int StoreContextSlotWithWriteBarrier::MaxCallStackArgs() const {
   return WriteBarrierDescriptor::GetStackParameterCount();
 }
 
-void StoreScriptContextSlotWithWriteBarrier::SetValueLocationConstraints() {
+void StoreContextSlotWithWriteBarrier::SetValueLocationConstraints() {
   UseFixed(context_input(), WriteBarrierDescriptor::ObjectRegister());
   UseRegister(new_value_input());
   set_temporaries_needed(2);
   set_double_temporaries_needed(1);
 }
 
-void StoreScriptContextSlotWithWriteBarrier::GenerateCode(
+void StoreContextSlotWithWriteBarrier::GenerateCode(
     MaglevAssembler* masm, const ProcessingState& state) {
-  __ RecordComment("StoreScriptContextSlotWithWriteBarrier");
+  __ RecordComment("StoreContextSlotWithWriteBarrier");
   ZoneLabelRef done(masm);
-  ZoneLabelRef do_normal_store(masm);
+  Label do_normal_store;
 
   // TODO(leszeks): Consider making this an arbitrary register and push/popping
   // in the deferred path.
@@ -3550,112 +3536,80 @@ void StoreScriptContextSlotWithWriteBarrier::GenerateCode(
 
   __ AssertObjectType(context, SCRIPT_CONTEXT_TYPE,
                       AbortReason::kUnexpectedInstanceType);
-
   __ LoadTaggedField(old_value, context, offset());
-  __ CompareTaggedAndJumpIf(old_value, new_value, kEqual, *done);
-
-  // Load property.
-  // TODO(victorgomes): Should we hoist the side_table?
-  __ LoadTaggedField(
-      scratch, context,
-      Context::OffsetOfElementAt(Context::CONTEXT_SIDE_TABLE_PROPERTY_INDEX));
-  __ LoadTaggedField(scratch, scratch,
-                     FixedArray::OffsetOfElementAt(
-                         index() - Context::MIN_CONTEXT_EXTENDED_SLOTS));
-
-  __ CompareTaggedAndJumpIf(
-      scratch, ContextSidePropertyCell::Other(), kNotEqual,
-      __ MakeDeferredCode(
-          [](MaglevAssembler* masm, Register context, Register old_value,
-             Register new_value, Register property,
-             StoreScriptContextSlotWithWriteBarrier* node, ZoneLabelRef done,
-             ZoneLabelRef do_normal_store) {
-            Label check_smi, check_mutable_int32, mutable_heap_number;
-            __ CompareRootAndEmitEagerDeoptIf(
-                property, RootIndex::kUndefinedValue, kEqual,
-                DeoptimizeReason::kStoreToConstant, node);
-            __ JumpIfSmi(property, &check_smi);
-            __ AssertObjectType(property, CONTEXT_SIDE_PROPERTY_CELL_TYPE,
-                                AbortReason::kUnexpectedInstanceType);
-            __ LoadTaggedField(
-                property, property,
-                ContextSidePropertyCell::kPropertyDetailsRawOffset);
-            __ bind(&check_smi);
-
-            // Check for const case.
-            __ CompareTaggedAndJumpIf(
-                property, ContextSidePropertyCell::Const(), kEqual,
-                __ GetDeoptLabel(node, DeoptimizeReason::kStoreToConstant));
-
-            if (v8_flags.script_context_mutable_heap_number) {
-              // Check for smi case
-              __ CompareTaggedAndJumpIf(property,
-                                        ContextSidePropertyCell::SmiMarker(),
-                                        kNotEqual, &check_mutable_int32);
-              __ EmitEagerDeoptIfNotSmi(node, new_value,
-                                        DeoptimizeReason::kStoreToConstant);
-              __ Jump(*do_normal_store);
 
-              MaglevAssembler::TemporaryRegisterScope temps(masm);
-              DoubleRegister double_scratch = temps.AcquireDouble();
-
-              // Check mutable int32 case.
-              __ bind(&check_mutable_int32);
-              if (v8_flags.script_context_mutable_heap_int32) {
-                __ CompareTaggedAndJumpIf(
-                    property, ContextSidePropertyCell::MutableInt32(),
-                    kNotEqual, &mutable_heap_number);
-                {
-                  Label new_value_is_not_smi;
-                  Register new_value_int32 = property;
-                  __ JumpIfNotSmi(new_value, &new_value_is_not_smi);
-                  __ SmiUntag(new_value_int32, new_value);
-                  __ StoreHeapInt32Value(new_value_int32, old_value);
-                  __ Jump(*done);
-
-                  __ bind(&new_value_is_not_smi);
-                  __ CompareMapWithRoot(new_value, RootIndex::kHeapNumberMap,
-                                        property);
-                  __ EmitEagerDeoptIf(kNotEqual,
-                                      DeoptimizeReason::kStoreToConstant, node);
-
-                  __ LoadHeapNumberValue(double_scratch, new_value);
-                  __ TryTruncateDoubleToInt32(
-                      new_value_int32, double_scratch,
-                      __ GetDeoptLabel(node,
-                                       DeoptimizeReason::kStoreToConstant));
-                  __ StoreHeapInt32Value(new_value_int32, old_value);
-                  __ Jump(*done);
-                }
-              }
+  __ JumpIfSmi(old_value, &do_normal_store);
+  __ CompareMapWithRoot(old_value, RootIndex::kContextCellMap, scratch);
+  __ JumpToDeferredIf(
+      kEqual,
+      [](MaglevAssembler* masm, Register slot, Register new_value,
+         Register scratch, StoreContextSlotWithWriteBarrier* node,
+         ZoneLabelRef done) {
+        MaglevAssembler::TemporaryRegisterScope temps(masm);
+        DoubleRegister double_scratch = temps.AcquireDouble();
+        Label try_int32, try_smi, try_const;
+        __ LoadContextCellState(scratch, slot);
 
-              // Check mutable heap number case.
-              __ bind(&mutable_heap_number);
-              {
-                Label new_value_is_not_smi;
-                Register new_value_int32 = property;
-                __ JumpIfNotSmi(new_value, &new_value_is_not_smi);
-                __ SmiUntag(new_value_int32, new_value);
-                __ Int32ToDouble(double_scratch, new_value_int32);
-                __ StoreHeapNumberValue(double_scratch, old_value);
-                __ Jump(*done);
-
-                __ bind(&new_value_is_not_smi);
-                __ CompareMapWithRoot(new_value, RootIndex::kHeapNumberMap,
-                                      property);
-                __ EmitEagerDeoptIf(kNotEqual,
-                                    DeoptimizeReason::kStoreToConstant, node);
-                __ LoadHeapNumberValue(double_scratch, new_value);
-                __ StoreHeapNumberValue(double_scratch, old_value);
-                __ Jump(*done);
-              }
-            } else {
-              __ Jump(*do_normal_store);
-            }
-          },
-          context, old_value, new_value, scratch, this, done, do_normal_store));
+        __ CompareInt32AndJumpIf(scratch, ContextCell::kFloat64, kNotEqual,
+                                 &try_int32);
+        {
+          Label new_value_is_not_smi;
+          __ JumpIfNotSmi(new_value, &new_value_is_not_smi);
+          __ SmiUntag(scratch, new_value);
+          __ Int32ToDouble(double_scratch, scratch);
+          __ StoreContextCellFloat64Value(slot, double_scratch);
+          __ Jump(*done);
+
+          __ bind(&new_value_is_not_smi);
+          __ CompareMapWithRoot(new_value, RootIndex::kHeapNumberMap, scratch);
+          __ EmitEagerDeoptIf(kNotEqual, DeoptimizeReason::kStoreToConstant,
+                              node);
+          __ LoadHeapNumberValue(double_scratch, new_value);
+          __ StoreContextCellFloat64Value(slot, double_scratch);
+          __ Jump(*done);
+        }
+
+        __ bind(&try_int32);
+        {
+          __ CompareInt32AndJumpIf(scratch, ContextCell::kInt32, kNotEqual,
+                                   &try_smi);
+          Label new_value_is_not_smi;
+          __ JumpIfNotSmi(new_value, &new_value_is_not_smi);
+          __ SmiUntag(scratch, new_value);
+          __ StoreContextCellInt32Value(slot, scratch);
+          __ Jump(*done);
 
-  __ bind(*do_normal_store);
+          __ bind(&new_value_is_not_smi);
+          __ CompareMapWithRoot(new_value, RootIndex::kHeapNumberMap, scratch);
+          __ EmitEagerDeoptIf(kNotEqual, DeoptimizeReason::kStoreToConstant,
+                              node);
+
+          __ LoadHeapNumberValue(double_scratch, new_value);
+          __ TryTruncateDoubleToInt32(
+              scratch, double_scratch,
+              __ GetDeoptLabel(node, DeoptimizeReason::kStoreToConstant));
+          __ StoreContextCellInt32Value(slot, scratch);
+          __ Jump(*done);
+
+          __ bind(&try_smi);
+        }
+        __ CompareInt32AndJumpIf(scratch, ContextCell::kSmi, kNotEqual,
+                                 &try_const);
+        __ EmitEagerDeoptIfNotSmi(node, new_value,
+                                  DeoptimizeReason::kStoreToConstant);
+        __ StoreContextCellSmiValue(slot, new_value);
+        __ Jump(*done);
+
+        __ bind(&try_const);
+        __ LoadContextCellTaggedValue(scratch, slot);
+        __ CompareTaggedAndJumpIf(
+            scratch, new_value, kNotEqual,
+            __ GetDeoptLabel(node, DeoptimizeReason::kStoreToConstant));
+        __ Jump(*done);
+      },
+      old_value, new_value, scratch, this, done);
+
+  __ bind(&do_normal_store);
   __ StoreTaggedFieldWithWriteBarrier(
       context, offset(), new_value, register_snapshot(),
       new_value_input().node()->decompresses_tagged_result()
@@ -6665,24 +6619,6 @@ void StoreDoubleField::GenerateCode(MaglevAssembler* masm,
   __ StoreHeapNumberValue(value, heap_number);
 }
 
-void StoreHeapInt32::SetValueLocationConstraints() {
-  UseRegister(object_input());
-  UseRegister(value_input());
-}
-void StoreHeapInt32::GenerateCode(MaglevAssembler* masm,
-                                  const ProcessingState& state) {
-  Register object = ToRegister(object_input());
-  Register value = ToRegister(value_input());
-
-  MaglevAssembler::TemporaryRegisterScope temps(masm);
-  Register heap_number = temps.AcquireScratch();
-
-  __ AssertNotSmi(object);
-  __ LoadTaggedField(heap_number, object, offset());
-  __ AssertNotSmi(heap_number);
-  __ StoreHeapInt32Value(value, heap_number);
-}
-
 namespace {
 
 template <typename NodeT>
@@ -6827,23 +6763,11 @@ void SetContinuationPreservedEmbedderData::GenerateCode(
 
 namespace {
 
-template <typename ResultReg, typename NodeT>
-void GenerateTypedArrayLoad(MaglevAssembler* masm, NodeT* node, Register object,
-                            Register index, ResultReg result_reg,
-                            ElementsKind kind) {
-  __ AssertNotSmi(object);
-  if (v8_flags.debug_code) {
-    MaglevAssembler::TemporaryRegisterScope temps(masm);
-    __ AssertObjectType(object, JS_TYPED_ARRAY_TYPE,
-                        AbortReason::kUnexpectedValue);
-  }
-
-  MaglevAssembler::TemporaryRegisterScope temps(masm);
-  Register scratch = temps.Acquire();
-
-  Register data_pointer = scratch;
-  __ BuildTypedArrayDataPointer(data_pointer, object);
-
+template <typename ResultReg>
+void GenerateTypedArrayLoadFromDataPointer(MaglevAssembler* masm,
+                                           Register data_pointer,
+                                           Register index, ResultReg result_reg,
+                                           ElementsKind kind) {
   int element_size = ElementsKindToByteSize(kind);
   MemOperand operand =
       __ TypedArrayElementOperand(data_pointer, index, element_size);
@@ -6873,10 +6797,10 @@ void GenerateTypedArrayLoad(MaglevAssembler* masm, NodeT* node, Register object,
   }
 }
 
-template <typename ValueReg, typename NodeT>
-void GenerateTypedArrayStore(MaglevAssembler* masm, NodeT* node,
-                             Register object, Register index, ValueReg value,
-                             ElementsKind kind) {
+template <typename ResultReg>
+void GenerateTypedArrayLoad(MaglevAssembler* masm, Register object,
+                            Register index, ResultReg result_reg,
+                            ElementsKind kind) {
   __ AssertNotSmi(object);
   if (v8_flags.debug_code) {
     MaglevAssembler::TemporaryRegisterScope temps(masm);
@@ -6888,8 +6812,30 @@ void GenerateTypedArrayStore(MaglevAssembler* masm, NodeT* node,
   Register scratch = temps.Acquire();
 
   Register data_pointer = scratch;
+  // TODO(victorgomes): Consider hoisting array data pointer.
   __ BuildTypedArrayDataPointer(data_pointer, object);
 
+  GenerateTypedArrayLoadFromDataPointer(masm, data_pointer, index, result_reg,
+                                        kind);
+}
+
+template <typename ResultReg>
+void GenerateConstantTypedArrayLoad(MaglevAssembler* masm,
+                                    compiler::JSTypedArrayRef typed_array,
+                                    Register index, ResultReg result_reg,
+                                    ElementsKind kind) {
+  MaglevAssembler::TemporaryRegisterScope temps(masm);
+  Register data_pointer = temps.Acquire();
+  __ Move(data_pointer, reinterpret_cast<intptr_t>(typed_array.data_ptr()));
+
+  GenerateTypedArrayLoadFromDataPointer(masm, data_pointer, index, result_reg,
+                                        kind);
+}
+
+template <typename ValueReg>
+void GenerateTypedArrayStoreToDataPointer(MaglevAssembler* masm,
+                                          Register data_pointer, Register index,
+                                          ValueReg value, ElementsKind kind) {
   int element_size = ElementsKindToByteSize(kind);
   MemOperand operand =
       __ TypedArrayElementOperand(data_pointer, index, element_size);
@@ -6914,23 +6860,55 @@ void GenerateTypedArrayStore(MaglevAssembler* masm, NodeT* node,
   }
 }
 
+template <typename ValueReg>
+void GenerateTypedArrayStore(MaglevAssembler* masm, Register object,
+                             Register index, ValueReg value,
+                             ElementsKind kind) {
+  __ AssertNotSmi(object);
+  if (v8_flags.debug_code) {
+    MaglevAssembler::TemporaryRegisterScope temps(masm);
+    __ AssertObjectType(object, JS_TYPED_ARRAY_TYPE,
+                        AbortReason::kUnexpectedValue);
+  }
+
+  MaglevAssembler::TemporaryRegisterScope temps(masm);
+  Register scratch = temps.Acquire();
+
+  Register data_pointer = scratch;
+  __ BuildTypedArrayDataPointer(data_pointer, object);
+
+  GenerateTypedArrayStoreToDataPointer(masm, data_pointer, index, value, kind);
+}
+
+template <typename ValueReg>
+void GenerateConstantTypedArrayStore(MaglevAssembler* masm,
+                                     compiler::JSTypedArrayRef typed_array,
+                                     Register index, ValueReg value,
+                                     ElementsKind elements_kind) {
+  MaglevAssembler::TemporaryRegisterScope temps(masm);
+  Register data_pointer = temps.Acquire();
+
+  __ Move(data_pointer, reinterpret_cast<intptr_t>(typed_array.data_ptr()));
+  GenerateTypedArrayStoreToDataPointer(masm, data_pointer, index, value,
+                                       elements_kind);
+}
+
 }  // namespace
 
-#define DEF_LOAD_TYPED_ARRAY(Name, ResultReg, ToResultReg)        \
-  void Name::SetValueLocationConstraints() {                      \
-    UseRegister(object_input());                                  \
-    UseRegister(index_input());                                   \
-    DefineAsRegister(this);                                       \
-    set_temporaries_needed(1);                                    \
-  }                                                               \
-  void Name::GenerateCode(MaglevAssembler* masm,                  \
-                          const ProcessingState& state) {         \
-    Register object = ToRegister(object_input());                 \
-    Register index = ToRegister(index_input());                   \
-    ResultReg result_reg = ToResultReg(result());                 \
-                                                                  \
-    GenerateTypedArrayLoad(masm, this, object, index, result_reg, \
-                           elements_kind_);                       \
+#define DEF_LOAD_TYPED_ARRAY(Name, ResultReg, ToResultReg)                   \
+  void Name::SetValueLocationConstraints() {                                 \
+    UseRegister(object_input());                                             \
+    UseRegister(index_input());                                              \
+    DefineAsRegister(this);                                                  \
+    set_temporaries_needed(1);                                               \
+  }                                                                          \
+  void Name::GenerateCode(MaglevAssembler* masm,                             \
+                          const ProcessingState& state) {                    \
+    Register index = ToRegister(index_input());                              \
+    ResultReg result_reg = ToResultReg(result());                            \
+                                                                             \
+    Register object = ToRegister(object_input());                            \
+    GenerateTypedArrayLoad(masm, object, index, result_reg, elements_kind_); \
   }
 
 DEF_LOAD_TYPED_ARRAY(LoadSignedIntTypedArrayElement, Register, ToRegister)
@@ -6941,20 +6919,43 @@ DEF_LOAD_TYPED_ARRAY(LoadDoubleTypedArrayElement, DoubleRegister,
                      ToDoubleRegister)
 #undef DEF_LOAD_TYPED_ARRAY
 
-#define DEF_STORE_TYPED_ARRAY(Name, ValueReg, ToValueReg)                      \
-  void Name::SetValueLocationConstraints() {                                   \
-    UseRegister(object_input());                                               \
-    UseRegister(index_input());                                                \
-    UseRegister(value_input());                                                \
-    set_temporaries_needed(1);                                                 \
-  }                                                                            \
-  void Name::GenerateCode(MaglevAssembler* masm,                               \
-                          const ProcessingState& state) {                      \
-    Register object = ToRegister(object_input());                              \
-    Register index = ToRegister(index_input());                                \
-    ValueReg value = ToValueReg(value_input());                                \
-                                                                               \
-    GenerateTypedArrayStore(masm, this, object, index, value, elements_kind_); \
+#define DEF_LOAD_CONSTANT_TYPED_ARRAY(Name, ResultReg, ToResultReg)        \
+  void Name::SetValueLocationConstraints() {                               \
+    UseRegister(index_input());                                            \
+    DefineAsRegister(this);                                                \
+    set_temporaries_needed(1);                                             \
+  }                                                                        \
+  void Name::GenerateCode(MaglevAssembler* masm,                           \
+                          const ProcessingState& state) {                  \
+    Register index = ToRegister(index_input());                            \
+    ResultReg result_reg = ToResultReg(result());                          \
+    GenerateConstantTypedArrayLoad(masm, typed_array(), index, result_reg, \
+                                   elements_kind_);                        \
+  }
+
+DEF_LOAD_CONSTANT_TYPED_ARRAY(LoadSignedIntConstantTypedArrayElement, Register,
+                              ToRegister)
+
+DEF_LOAD_CONSTANT_TYPED_ARRAY(LoadUnsignedIntConstantTypedArrayElement,
+                              Register, ToRegister)
+
+DEF_LOAD_CONSTANT_TYPED_ARRAY(LoadDoubleConstantTypedArrayElement,
+                              DoubleRegister, ToDoubleRegister)
+#undef DEF_LOAD_CONSTANT_TYPED_ARRAY
+
+#define DEF_STORE_TYPED_ARRAY(Name, ValueReg, ToValueReg)                \
+  void Name::SetValueLocationConstraints() {                             \
+    UseRegister(object_input());                                         \
+    UseRegister(index_input());                                          \
+    UseRegister(value_input());                                          \
+    set_temporaries_needed(1);                                           \
+  }                                                                      \
+  void Name::GenerateCode(MaglevAssembler* masm,                         \
+                          const ProcessingState& state) {                \
+    Register index = ToRegister(index_input());                          \
+    ValueReg value = ToValueReg(value_input());                          \
+    Register object = ToRegister(object_input());                        \
+    GenerateTypedArrayStore(masm, object, index, value, elements_kind_); \
   }
 
 DEF_STORE_TYPED_ARRAY(StoreIntTypedArrayElement, Register, ToRegister)
@@ -6963,6 +6964,27 @@ DEF_STORE_TYPED_ARRAY(StoreDoubleTypedArrayElement, DoubleRegister,
                       ToDoubleRegister)
 #undef DEF_STORE_TYPED_ARRAY
 
+#define DEF_STORE_CONSTANT_TYPED_ARRAY(Name, ValueReg, ToValueReg)     \
+  void Name::SetValueLocationConstraints() {                           \
+    UseRegister(index_input());                                        \
+    UseRegister(value_input());                                        \
+    set_temporaries_needed(1);                                         \
+  }                                                                    \
+  void Name::GenerateCode(MaglevAssembler* masm,                       \
+                          const ProcessingState& state) {              \
+    Register index = ToRegister(index_input());                        \
+    ValueReg value = ToValueReg(value_input());                        \
+    GenerateConstantTypedArrayStore(masm, typed_array(), index, value, \
+                                    elements_kind_);                   \
+  }
+
+DEF_STORE_CONSTANT_TYPED_ARRAY(StoreIntConstantTypedArrayElement, Register,
+                               ToRegister)
+
+DEF_STORE_CONSTANT_TYPED_ARRAY(StoreDoubleConstantTypedArrayElement,
+                               DoubleRegister, ToDoubleRegister)
+#undef DEF_STORE_CONSTANT_TYPED_ARRAY
+
 // ---
 // Arch agnostic control nodes
 // ---
@@ -7012,30 +7034,28 @@ void AttemptOnStackReplacement(MaglevAssembler* masm,
 
   // Case 2).
   {
-    __ LoadByte(scratch0,
+    __ LoadByte(scratch1,
                 FieldMemOperand(scratch0, FeedbackVector::kOsrStateOffset));
-    __ DecodeField<FeedbackVector::OsrUrgencyBits>(scratch0);
-    __ JumpIfByte(kUnsignedLessThanEqual, scratch0, loop_depth,
+    __ DecodeField<FeedbackVector::OsrUrgencyBits>(scratch1);
+    __ JumpIfByte(kUnsignedLessThanEqual, scratch1, loop_depth,
                   *no_code_for_osr);
 
+    // If tiering is already in progress wait.
+    __ LoadByte(scratch1,
+                FieldMemOperand(scratch0, FeedbackVector::kFlagsOffset));
+    __ DecodeField<FeedbackVector::OsrTieringInProgressBit>(scratch1);
+    __ JumpIfByte(kNotEqual, scratch1, 0, *no_code_for_osr);
+
     // The osr_urgency exceeds the current loop_depth, signaling an OSR
     // request. Call into runtime to compile.
     {
       RegisterSnapshot snapshot = node->register_snapshot();
       DCHECK(!snapshot.live_registers.has(maybe_target_code));
       SaveRegisterStateForCall save_register_state(masm, snapshot);
-      if (node->unit()->is_inline()) {
-        // See comment in
-        // MaglevGraphBuilder::ShouldEmitOsrInterruptBudgetChecks.
-        CHECK(!node->unit()->is_osr());
-        __ Push(Smi::FromInt(osr_offset.ToInt()), node->closure());
-        __ Move(kContextRegister, masm->native_context().object());
-        __ CallRuntime(Runtime::kCompileOptimizedOSRFromMaglevInlined, 2);
-      } else {
-        __ Push(Smi::FromInt(osr_offset.ToInt()));
-        __ Move(kContextRegister, masm->native_context().object());
-        __ CallRuntime(Runtime::kCompileOptimizedOSRFromMaglev, 1);
-      }
+      DCHECK(!node->unit()->is_inline());
+      __ Push(Smi::FromInt(osr_offset.ToInt()));
+      __ Move(kContextRegister, masm->native_context().object());
+      __ CallRuntime(Runtime::kCompileOptimizedOSRFromMaglev, 1);
       save_register_state.DefineSafepoint();
       __ Move(maybe_target_code, kReturnRegister0);
     }
@@ -7455,6 +7475,11 @@ void Uint32Constant::PrintParams(std::ostream& os,
   os << "(" << value() << ")";
 }
 
+void IntPtrConstant::PrintParams(std::ostream& os,
+                                 MaglevGraphLabeller* graph_labeller) const {
+  os << "(" << value() << ")";
+}
+
 void Float64Constant::PrintParams(std::ostream& os,
                                   MaglevGraphLabeller* graph_labeller) const {
   if (value().is_nan()) {
@@ -7688,7 +7713,7 @@ void CheckInt32Condition::PrintParams(
   os << "(" << condition() << ", " << deoptimize_reason() << ")";
 }
 
-void StoreScriptContextSlotWithWriteBarrier::PrintParams(
+void StoreContextSlotWithWriteBarrier::PrintParams(
     std::ostream& os, MaglevGraphLabeller* graph_labeller) const {
   os << "(" << index_ << ")";
 }
@@ -7747,11 +7772,6 @@ void LoadFloat64::PrintParams(std::ostream& os,
   os << "(0x" << std::hex << offset() << std::dec << ")";
 }
 
-void LoadHeapInt32::PrintParams(std::ostream& os,
-                                MaglevGraphLabeller* graph_labeller) const {
-  os << "(0x" << std::hex << offset() << std::dec << ")";
-}
-
 void LoadInt32::PrintParams(std::ostream& os,
                             MaglevGraphLabeller* graph_labeller) const {
   os << "(0x" << std::hex << offset() << std::dec << ")";
@@ -7775,11 +7795,6 @@ void StoreDoubleField::PrintParams(std::ostream& os,
   os << "(0x" << std::hex << offset() << std::dec << ")";
 }
 
-void StoreHeapInt32::PrintParams(std::ostream& os,
-                                 MaglevGraphLabeller* graph_labeller) const {
-  os << "(0x" << std::hex << offset() << std::dec << ")";
-}
-
 void StoreFloat64::PrintParams(std::ostream& os,
                                MaglevGraphLabeller* graph_labeller) const {
   os << "(0x" << std::hex << offset() << std::dec << ")";
diff --git a/deps/v8/src/maglev/maglev-ir.h b/deps/v8/src/maglev/maglev-ir.h
index ba1313dabd7bd3..df4de9c9dcb312 100644
--- a/deps/v8/src/maglev/maglev-ir.h
+++ b/deps/v8/src/maglev/maglev-ir.h
@@ -141,6 +141,7 @@ class ExceptionHandlerInfo;
   V(Float64Constant)                \
   V(Int32Constant)                  \
   V(Uint32Constant)                 \
+  V(IntPtrConstant)                 \
   V(RootConstant)                   \
   V(SmiConstant)                    \
   V(TaggedIndexConstant)            \
@@ -204,7 +205,6 @@ class ExceptionHandlerInfo;
   V(LoadTaggedFieldForProperty)                     \
   V(LoadTaggedFieldForContextSlot)                  \
   V(LoadTaggedFieldForScriptContextSlot)            \
-  V(LoadHeapInt32)                                  \
   V(LoadDoubleField)                                \
   V(LoadFloat64)                                    \
   V(LoadInt32)                                      \
@@ -219,6 +219,9 @@ class ExceptionHandlerInfo;
   V(LoadSignedIntTypedArrayElement)                 \
   V(LoadUnsignedIntTypedArrayElement)               \
   V(LoadDoubleTypedArrayElement)                    \
+  V(LoadSignedIntConstantTypedArrayElement)         \
+  V(LoadUnsignedIntConstantTypedArrayElement)       \
+  V(LoadDoubleConstantTypedArrayElement)            \
   V(LoadEnumCacheLength)                            \
   V(LoadGlobal)                                     \
   V(LoadNamedGeneric)                               \
@@ -356,7 +359,6 @@ class ExceptionHandlerInfo;
   V(TryOnStackReplacement)                    \
   V(StoreMap)                                 \
   V(StoreDoubleField)                         \
-  V(StoreHeapInt32)                           \
   V(StoreFixedArrayElementWithWriteBarrier)   \
   V(StoreFixedArrayElementNoWriteBarrier)     \
   V(StoreFixedDoubleArrayElement)             \
@@ -364,11 +366,13 @@ class ExceptionHandlerInfo;
   V(StoreFloat64)                             \
   V(StoreIntTypedArrayElement)                \
   V(StoreDoubleTypedArrayElement)             \
+  V(StoreIntConstantTypedArrayElement)        \
+  V(StoreDoubleConstantTypedArrayElement)     \
   V(StoreSignedIntDataViewElement)            \
   V(StoreDoubleDataViewElement)               \
   V(StoreTaggedFieldNoWriteBarrier)           \
   V(StoreTaggedFieldWithWriteBarrier)         \
-  V(StoreScriptContextSlotWithWriteBarrier)   \
+  V(StoreContextSlotWithWriteBarrier)         \
   V(StoreTrustedPointerFieldWithWriteBarrier) \
   V(HandleNoHeapWritesInterrupt)              \
   V(ReduceInterruptBudgetForLoop)             \
@@ -548,8 +552,7 @@ constexpr bool IsSimpleFieldStore(Opcode opcode) {
   return opcode == Opcode::kStoreTaggedFieldWithWriteBarrier ||
          opcode == Opcode::kStoreTaggedFieldNoWriteBarrier ||
          opcode == Opcode::kStoreDoubleField ||
-         opcode == Opcode::kStoreHeapInt32 || opcode == Opcode::kStoreFloat64 ||
-         opcode == Opcode::kStoreInt32 ||
+         opcode == Opcode::kStoreFloat64 || opcode == Opcode::kStoreInt32 ||
          opcode == Opcode::kUpdateJSArrayLength ||
          opcode == Opcode::kStoreFixedArrayElementWithWriteBarrier ||
          opcode == Opcode::kStoreFixedArrayElementNoWriteBarrier ||
@@ -572,7 +575,7 @@ constexpr bool CanBeStoreToNonEscapedObject(Opcode opcode) {
     case Opcode::kStoreTrustedPointerFieldWithWriteBarrier:
     case Opcode::kStoreTaggedFieldWithWriteBarrier:
     case Opcode::kStoreTaggedFieldNoWriteBarrier:
-    case Opcode::kStoreScriptContextSlotWithWriteBarrier:
+    case Opcode::kStoreContextSlotWithWriteBarrier:
     case Opcode::kStoreFloat64:
       return true;
     default:
@@ -613,71 +616,44 @@ inline constexpr bool IsZeroExtendedRepresentation(ValueRepresentation repr) {
 #endif
 }
 
-/*
- * NodeType lattice.
- *
- * Maglev node types are intersection types. As an example consider
- *
- *     Boolen = Oddball & NumberOrBoolean
- *
- * The individual bits can be thought of as atomic propositions. An object of
- * type boolean is an object for which the Oddball as well as the
- * NumberOrBoolean proposition holds.
- *
- * The literals in the NODE_TYPE_LIST form a semi-lattice.
- *
- * For efficiency often used intersections (i.e., the join operation using `&`)
- * should be added as NodeType.
- *
- * Here is a diagram of the relations between the types:
- *
- *
- *            .----------- Unknown ---------------------.
- *            |                                         |
- *            |              .---.-----.------- AnyHeapObject ---------.
- *            |             /   /      |                |              |
- *            |            /   /       |                |              |
- *            |            |  |    JSReceiver           |              |
- *            |            |  |  .-OrNullOrUndefined    |              |
- *            |            |  | |        |              |              |
- *      NumberOrOddball   /   | |     JSReceiver     StringOr          Name
- *         /      \      /   /  |    /     |    \    StringWrapper     /  \
- *        /        \    /   /   |   /      |     \     /        \     /    \
- * NumberOrBoolean Oddball /    | Callable JSArray  String      String   Symbol
- *      /      \   /   \  /     |                   Wrapper         |
- *   Number   Boolean   \/      |                               NonThin
- *    /  \              /\      |                               String
- * Smi    \            /  \     |                                   |
- *          HeapNumber     --- NullOrUndefined                 Internalized
- *                                                             String
- *
- * Ensure that each super-type mentioned in the following NODE_TYPE_LIST
- * corresponds to exactly one arrow in the above diagram.
- *
- * TODO(olivf): Rename Unknown to Any.
- */
-#define NODE_TYPE_LIST(V)                                     \
-  V(Unknown, 0)                                               \
-  V(NumberOrOddball, (1 << 1) | kUnknown)                     \
-  V(NumberOrBoolean, (1 << 2) | kNumberOrOddball)             \
-  V(Number, (1 << 3) | kNumberOrBoolean)                      \
-  V(Smi, (1 << 4) | kNumber)                                  \
-  V(AnyHeapObject, (1 << 5) | kUnknown)                       \
-  V(HeapNumber, kAnyHeapObject | kNumber)                     \
-  V(Oddball, (1 << 6) | kAnyHeapObject | kNumberOrOddball)    \
-  V(Boolean, kOddball | kNumberOrBoolean)                     \
-  V(JSReceiverOrNullOrUndefined, (1 << 7) | kAnyHeapObject)   \
-  V(NullOrUndefined, kOddball | kJSReceiverOrNullOrUndefined) \
-  V(Name, (1 << 8) | kAnyHeapObject)                          \
-  V(StringOrStringWrapper, (1 << 9) | kAnyHeapObject)         \
-  V(String, kName | kStringOrStringWrapper)                   \
-  V(NonThinString, (1 << 10) | kString)                       \
-  V(InternalizedString, (1 << 11) | kNonThinString)           \
-  V(Symbol, (1 << 12) | kName)                                \
-  V(JSReceiver, (1 << 13) | kJSReceiverOrNullOrUndefined)     \
-  V(JSArray, (1 << 14) | kJSReceiver)                         \
-  V(Callable, (1 << 15) | kJSReceiver)                        \
-  V(StringWrapper, kStringOrStringWrapper | kJSReceiver)
+// TODO(olivf): Rename Unknown to Any.
+
+/* Every object should belong to exactly one of these.*/
+#define LEAF_NODE_TYPE_LIST(V)       \
+  V(Smi, (1 << 0))                   \
+  V(HeapNumber, (1 << 1))            \
+  V(NullOrUndefined, (1 << 2))       \
+  V(Boolean, (1 << 3))               \
+  V(Symbol, (1 << 4))                \
+  V(InternalizedString, (1 << 5))    \
+  V(NonInternalizedString, (1 << 6)) \
+  V(StringWrapper, (1 << 7))         \
+  V(JSArray, (1 << 8))               \
+  V(Callable, (1 << 9))              \
+  V(OtherJSReceiver, (1 << 10))      \
+  V(OtherHeapObject, (1 << 11))
+
+#define COUNT(...) +1
+static constexpr int kNumberOfLeafNodeTypes = 0 LEAF_NODE_TYPE_LIST(COUNT);
+#undef COUNT
+
+#define COMBINED_NODE_TYPE_LIST(V)                                        \
+  /* A value which has all the above bits set */                          \
+  V(Unknown, ((1 << kNumberOfLeafNodeTypes) - 1))                         \
+  V(Oddball, kNullOrUndefined | kBoolean)                                 \
+  V(Number, kSmi | kHeapNumber)                                           \
+  V(NumberOrBoolean, kNumber | kBoolean)                                  \
+  V(NumberOrOddball, kNumber | kOddball)                                  \
+  V(String, kNonInternalizedString | kInternalizedString)                 \
+  V(StringOrStringWrapper, kString | kStringWrapper)                      \
+  V(Name, kString | kSymbol)                                              \
+  V(JSReceiver, kJSArray | kCallable | kStringWrapper | kOtherJSReceiver) \
+  V(JSReceiverOrNullOrUndefined, kJSReceiver | kNullOrUndefined)          \
+  V(AnyHeapObject, kUnknown - kSmi)
+
+#define NODE_TYPE_LIST(V) \
+  LEAF_NODE_TYPE_LIST(V)  \
+  COMBINED_NODE_TYPE_LIST(V)
 
 enum class NodeType : uint32_t {
 #define DEFINE_NODE_TYPE(Name, Value) k##Name = Value,
@@ -685,136 +661,125 @@ enum class NodeType : uint32_t {
 #undef DEFINE_NODE_TYPE
 };
 
+inline constexpr NodeType EmptyNodeType() { return static_cast<NodeType>(0); }
+
 inline constexpr NodeType CombineType(NodeType left, NodeType right) {
-  return static_cast<NodeType>(static_cast<int>(left) |
+  return static_cast<NodeType>(static_cast<int>(left) &
                                static_cast<int>(right));
 }
 inline constexpr NodeType IntersectType(NodeType left, NodeType right) {
-  return static_cast<NodeType>(static_cast<int>(left) &
+  return static_cast<NodeType>(static_cast<int>(left) |
                                static_cast<int>(right));
 }
 inline constexpr bool NodeTypeIs(NodeType type, NodeType to_check) {
   int right = static_cast<int>(to_check);
-  return (static_cast<int>(type) & right) == right;
+  return (static_cast<int>(type) & (~right)) == 0;
 }
 
+// Assert that the Unknown type is constructed correctly.
+#define ADD_STATIC_ASSERT(Name, Value) \
+  static_assert(NodeTypeIs(NodeType::k##Name, NodeType::kUnknown));
+LEAF_NODE_TYPE_LIST(ADD_STATIC_ASSERT)
+#undef ADD_STATIC_ASSERT
+
 inline NodeType StaticTypeForMap(compiler::MapRef map,
                                  compiler::JSHeapBroker* broker) {
   if (map.IsHeapNumberMap()) return NodeType::kHeapNumber;
   if (map.IsStringMap()) {
     if (map.IsInternalizedStringMap()) return NodeType::kInternalizedString;
-    if (!map.IsThinStringMap()) return NodeType::kNonThinString;
     return NodeType::kString;
   }
-  if (map.IsNameMap()) return NodeType::kName;
-  if (map.IsJSPrimitiveWrapperMap() &&
-      IsStringWrapperElementsKind(map.elements_kind())) {
-    return NodeType::kStringWrapper;
-  }
+  if (map.IsStringWrapperMap()) return NodeType::kStringWrapper;
   if (map.IsSymbolMap()) return NodeType::kSymbol;
-  if (map.IsJSArrayMap()) return NodeType::kJSArray;
   if (map.IsBooleanMap(broker)) return NodeType::kBoolean;
-  if (map.IsOddballMap()) return NodeType::kNullOrUndefined;
-  if (map.IsCallableJSFunctionMap()) return NodeType::kCallable;
-  if (map.IsJSReceiverMap()) return NodeType::kJSReceiver;
-  return NodeType::kAnyHeapObject;
+  if (map.IsOddballMap()) {
+    // Oddball but not a Boolean.
+    return NodeType::kNullOrUndefined;
+  }
+  if (map.IsJSArrayMap()) return NodeType::kJSArray;
+  if (map.is_callable()) {
+    return NodeType::kCallable;
+  }
+  if (map.IsJSReceiverMap()) {
+    // JSReceiver but not any of the above.
+    return NodeType::kOtherJSReceiver;
+  }
+  return NodeType::kOtherHeapObject;
 }
 
-// Conservatively find types which are guaranteed to have no instances.
-// Currently we search for some common contradicting properties.
-// TODO(olivf): Find a better way of doing this. Alternatives considered are,
-// * ensure that every inhabited type is also a NodeType. This would blow up the
-//   lattice quite a bit.
-// * ensure that every possible leaf type exists in the lattice and check if the
-//   type is reachable from a leaf. This is difficult to test for correctness
-//   and also more expensive to compute.
-constexpr static std::initializer_list<std::pair<NodeType, NodeType>>
-    kNodeTypeExclusivePairs{
-        {NodeType::kAnyHeapObject, NodeType::kSmi},
-        {NodeType::kNumberOrOddball, NodeType::kName},
-        {NodeType::kNumberOrOddball, NodeType::kJSReceiver},
-        {NodeType::kJSReceiver, NodeType::kName},
-    };
-inline constexpr bool NodeTypeCannotHaveInstances(NodeType type) {
-  for (auto types : kNodeTypeExclusivePairs) {
-    if (NodeTypeIs(type, types.first) && NodeTypeIs(type, types.second)) {
-      return true;
-    }
-  }
-  return false;
+inline constexpr bool IsEmptyNodeType(NodeType type) {
+  // No bits are set.
+  return static_cast<int>(type) == 0;
 }
 
 inline NodeType StaticTypeForConstant(compiler::JSHeapBroker* broker,
                                       compiler::ObjectRef ref) {
   if (ref.IsSmi()) return NodeType::kSmi;
   NodeType type = StaticTypeForMap(ref.AsHeapObject().map(broker), broker);
-  DCHECK(!NodeTypeCannotHaveInstances(type));
+  DCHECK(!IsEmptyNodeType(type));
   return type;
 }
 
-inline bool IsInstanceOfNodeType(compiler::MapRef map, NodeType type,
-                                 compiler::JSHeapBroker* broker) {
+inline bool IsInstanceOfLeafNodeType(compiler::MapRef map, NodeType type,
+                                     compiler::JSHeapBroker* broker) {
   switch (type) {
-    case NodeType::kUnknown:
-      return true;
-    case NodeType::kNumberOrBoolean:
-      return map.IsHeapNumberMap() || map.IsBooleanMap(broker);
-    case NodeType::kNumberOrOddball:
-      return map.IsHeapNumberMap() || map.IsOddballMap();
     case NodeType::kSmi:
       return false;
-    case NodeType::kNumber:
     case NodeType::kHeapNumber:
       return map.IsHeapNumberMap();
-    case NodeType::kAnyHeapObject:
-      return true;
-    case NodeType::kOddball:
-      return map.IsOddballMap();
+    case NodeType::kNullOrUndefined:
+      return map.IsOddballMap() && !map.IsBooleanMap(broker);
     case NodeType::kBoolean:
       return map.IsBooleanMap(broker);
-    case NodeType::kName:
-      return map.IsNameMap();
-    case NodeType::kNonThinString:
-      return map.IsStringMap() && !map.IsThinStringMap();
-    case NodeType::kString:
-      return map.IsStringMap();
-    case NodeType::kStringWrapper:
-      return map.IsJSPrimitiveWrapperMap() &&
-             IsStringWrapperElementsKind(map.elements_kind());
-    case NodeType::kStringOrStringWrapper:
-      return map.IsStringMap() ||
-             (map.IsJSPrimitiveWrapperMap() &&
-              IsStringWrapperElementsKind(map.elements_kind()));
-    case NodeType::kInternalizedString:
-      return map.IsInternalizedStringMap();
     case NodeType::kSymbol:
       return map.IsSymbolMap();
-    case NodeType::kJSReceiver:
-      return map.IsJSReceiverMap();
+    case NodeType::kInternalizedString:
+      return map.IsStringMap() && map.IsInternalizedStringMap();
+    case NodeType::kNonInternalizedString:
+      return map.IsStringMap() && !map.IsInternalizedStringMap();
+    case NodeType::kStringWrapper:
+      return map.IsStringWrapperMap();
     case NodeType::kJSArray:
       return map.IsJSArrayMap();
     case NodeType::kCallable:
       return map.is_callable();
-    case NodeType::kNullOrUndefined:
-      return map.IsOddballMap() && !map.IsBooleanMap(broker);
-    case NodeType::kJSReceiverOrNullOrUndefined:
-      return map.IsJSReceiverMap() || map.is_undetectable();
+    case NodeType::kOtherJSReceiver:
+      return map.IsJSReceiverMap() && !map.IsJSArrayMap() &&
+             !map.is_callable() && !map.IsStringWrapperMap();
+    case NodeType::kOtherHeapObject:
+      return !map.IsHeapNumberMap() && !map.IsOddballMap() &&
+             !map.IsSymbolMap() && !map.IsStringMap() && !map.IsJSReceiverMap();
+    default:
+      UNREACHABLE();
   }
+}
 
-    // This is some composed type. We could speed this up by exploiting the tree
-    // structure of the types.
-#define CASE(Name, _)                                            \
-  if (NodeTypeIs(type, NodeType::k##Name)) {                     \
-    if (!IsInstanceOfNodeType(map, NodeType::k##Name, broker)) { \
-      return false;                                              \
-    }                                                            \
-  }
-  NODE_TYPE_LIST(CASE)
+inline bool IsInstanceOfNodeType(compiler::MapRef map, NodeType type,
+                                 compiler::JSHeapBroker* broker) {
+  switch (type) {
+#define CASE(Name, _) case NodeType::k##Name:
+    LEAF_NODE_TYPE_LIST(CASE)
 #undef CASE
-  return true;
+    return IsInstanceOfLeafNodeType(map, type, broker);
+    default:
+      // This is some a composed type.
+#define CASE(Name, _)                                               \
+  if (NodeTypeIs(NodeType::k##Name, type)) {                        \
+    if (IsInstanceOfLeafNodeType(map, NodeType::k##Name, broker)) { \
+      return true;                                                  \
+    }                                                               \
+  }
+      LEAF_NODE_TYPE_LIST(CASE)
+#undef CASE
+      return false;
+  }
 }
 
 inline std::ostream& operator<<(std::ostream& out, const NodeType& type) {
+  if (IsEmptyNodeType(type)) {
+    out << "Empty";
+    return out;
+  }
   switch (type) {
 #define CASE(Name, _)     \
   case NodeType::k##Name: \
@@ -824,12 +789,12 @@ inline std::ostream& operator<<(std::ostream& out, const NodeType& type) {
 #undef CASE
     default:
 #define CASE(Name, _)                                        \
-  if (NodeTypeIs(type, NodeType::k##Name)) {                 \
+  if (NodeTypeIs(NodeType::k##Name, type)) {                 \
     if constexpr (NodeType::k##Name != NodeType::kUnknown) { \
-      out << #Name ",";                                      \
+      out << #Name "|";                                      \
     }                                                        \
   }
-      NODE_TYPE_LIST(CASE)
+      LEAF_NODE_TYPE_LIST(CASE)
 #undef CASE
   }
   return out;
@@ -843,11 +808,8 @@ NODE_TYPE_LIST(DEFINE_NODE_TYPE_CHECK)
 #undef DEFINE_NODE_TYPE_CHECK
 
 inline bool NodeTypeMayBeNullOrUndefined(NodeType type) {
-  if (NodeTypeIsBoolean(type)) return false;
-  if (NodeTypeIsNumber(type)) return false;
-  if (NodeTypeIsJSReceiver(type)) return false;
-  if (NodeTypeIsName(type)) return false;
-  return true;
+  return (static_cast<int>(type) &
+          static_cast<int>(NodeType::kNullOrUndefined)) != 0;
 }
 
 enum class TaggedToFloat64ConversionType : uint8_t {
@@ -3782,6 +3744,32 @@ class Uint32Constant : public FixedInputValueNodeT<0, Uint32Constant> {
   const uint32_t value_;
 };
 
+class IntPtrConstant : public FixedInputValueNodeT<0, IntPtrConstant> {
+  using Base = FixedInputValueNodeT<0, IntPtrConstant>;
+
+ public:
+  using OutputRegister = Register;
+
+  explicit IntPtrConstant(uint64_t bitfield, intptr_t value)
+      : Base(bitfield), value_(value) {}
+
+  static constexpr OpProperties kProperties = OpProperties::IntPtr();
+
+  intptr_t value() const { return value_; }
+
+  bool ToBoolean(LocalIsolate* local_isolate) const { return value_ != 0; }
+
+  void SetValueLocationConstraints();
+  void GenerateCode(MaglevAssembler*, const ProcessingState&);
+  void PrintParams(std::ostream&, MaglevGraphLabeller*) const;
+
+  void DoLoadToRegister(MaglevAssembler*, OutputRegister);
+  DirectHandle<Object> DoReify(LocalIsolate* isolate) const;
+
+ private:
+  const intptr_t value_;
+};
+
 class Float64Constant : public FixedInputValueNodeT<0, Float64Constant> {
   using Base = FixedInputValueNodeT<0, Float64Constant>;
 
@@ -4685,8 +4673,9 @@ class StringEqual : public FixedInputValueNodeT<2, StringEqual> {
 
  public:
   explicit StringEqual(uint64_t bitfield) : Base(bitfield) {}
-  static constexpr OpProperties kProperties =
-      OpProperties::Call() | OpProperties::LazyDeopt();
+  static constexpr OpProperties kProperties = OpProperties::Call() |
+                                              OpProperties::LazyDeopt() |
+                                              OpProperties::CanAllocate();
 
   static constexpr typename Base::InputTypes kInputTypes{
       ValueRepresentation::kTagged, ValueRepresentation::kTagged};
@@ -4965,8 +4954,7 @@ class TryOnStackReplacement : public FixedInputNodeT<1, TryOnStackReplacement> {
 
   static constexpr OpProperties kProperties =
       OpProperties::DeferredCall() | OpProperties::EagerDeopt() |
-      OpProperties::Call() | OpProperties::CanAllocate() |
-      OpProperties::NotIdempotent();
+      OpProperties::CanAllocate() | OpProperties::NotIdempotent();
   static constexpr
       typename Base::InputTypes kInputTypes{ValueRepresentation::kTagged};
 
@@ -7909,33 +7897,6 @@ class LoadFloat64 : public FixedInputValueNodeT<1, LoadFloat64> {
   const int offset_;
 };
 
-class LoadHeapInt32 : public FixedInputValueNodeT<1, LoadHeapInt32> {
-  using Base = FixedInputValueNodeT<1, LoadHeapInt32>;
-
- public:
-  explicit LoadHeapInt32(uint64_t bitfield, int offset)
-      : Base(bitfield), offset_(offset) {}
-
-  static constexpr OpProperties kProperties =
-      OpProperties::CanRead() | OpProperties::Int32();
-  static constexpr
-      typename Base::InputTypes kInputTypes{ValueRepresentation::kTagged};
-
-  int offset() const { return offset_; }
-
-  static constexpr int kObjectIndex = 0;
-  Input& object_input() { return input(kObjectIndex); }
-
-  void SetValueLocationConstraints();
-  void GenerateCode(MaglevAssembler*, const ProcessingState&);
-  void PrintParams(std::ostream&, MaglevGraphLabeller*) const;
-
-  auto options() const { return std::tuple{offset()}; }
-
- private:
-  const int offset_;
-};
-
 class LoadInt32 : public FixedInputValueNodeT<1, LoadInt32> {
   using Base = FixedInputValueNodeT<1, LoadInt32>;
 
@@ -8389,6 +8350,57 @@ LOAD_TYPED_ARRAY(LoadDoubleTypedArrayElement, OpProperties::Float64(),
 
 #undef LOAD_TYPED_ARRAY
 
+#define LOAD_CONSTANT_TYPED_ARRAY(name, properties, ...)                      \
+  class name : public FixedInputValueNodeT<1, name> {                         \
+    using Base = FixedInputValueNodeT<1, name>;                               \
+                                                                              \
+   public:                                                                    \
+    explicit name(uint64_t bitfield, compiler::JSTypedArrayRef typed_array,   \
+                  ElementsKind elements_kind)                                 \
+        : Base(bitfield),                                                     \
+          typed_array_(typed_array),                                          \
+          elements_kind_(elements_kind) {                                     \
+      DCHECK(elements_kind ==                                                 \
+             v8::internal::compiler::turboshaft::any_of(__VA_ARGS__));        \
+    }                                                                         \
+                                                                              \
+    static constexpr OpProperties kProperties =                               \
+        OpProperties::CanRead() | properties;                                 \
+    static constexpr                                                          \
+        typename Base::InputTypes kInputTypes{ValueRepresentation::kUint32};  \
+                                                                              \
+    static constexpr int kIndexIndex = 0;                                     \
+    Input& index_input() { return input(kIndexIndex); }                       \
+                                                                              \
+    void SetValueLocationConstraints();                                       \
+    void GenerateCode(MaglevAssembler*, const ProcessingState&);              \
+    void PrintParams(std::ostream&, MaglevGraphLabeller*) const {}            \
+                                                                              \
+    auto options() const { return std::tuple{typed_array_, elements_kind_}; } \
+                                                                              \
+    ElementsKind elements_kind() const { return elements_kind_; }             \
+    compiler::JSTypedArrayRef typed_array() const { return typed_array_; }    \
+                                                                              \
+   private:                                                                   \
+    compiler::JSTypedArrayRef typed_array_;                                   \
+    ElementsKind elements_kind_;                                              \
+  };
+
+LOAD_CONSTANT_TYPED_ARRAY(LoadSignedIntConstantTypedArrayElement,
+                          OpProperties::Int32(), INT8_ELEMENTS, INT16_ELEMENTS,
+                          INT32_ELEMENTS)
+
+LOAD_CONSTANT_TYPED_ARRAY(LoadUnsignedIntConstantTypedArrayElement,
+                          OpProperties::Uint32(), UINT8_ELEMENTS,
+                          UINT8_CLAMPED_ELEMENTS, UINT16_ELEMENTS,
+                          UINT16_ELEMENTS, UINT32_ELEMENTS)
+
+LOAD_CONSTANT_TYPED_ARRAY(LoadDoubleConstantTypedArrayElement,
+                          OpProperties::Float64(), FLOAT32_ELEMENTS,
+                          FLOAT64_ELEMENTS)
+
+#undef LOAD_CONSTANT_TYPED_ARRAY
+
 #define STORE_TYPED_ARRAY(name, properties, type, ...)                     \
   class name : public FixedInputNodeT<3, name> {                           \
     using Base = FixedInputNodeT<3, name>;                                 \
@@ -8430,6 +8442,53 @@ STORE_TYPED_ARRAY(StoreDoubleTypedArrayElement, OpProperties::CanWrite(),
                   FLOAT64_ELEMENTS)
 #undef STORE_TYPED_ARRAY
 
+#define STORE_CONSTANT_TYPED_ARRAY(name, properties, type, ...)             \
+  class name : public FixedInputNodeT<2, name> {                            \
+    using Base = FixedInputNodeT<2, name>;                                  \
+                                                                            \
+   public:                                                                  \
+    explicit name(uint64_t bitfield, compiler::JSTypedArrayRef typed_array, \
+                  ElementsKind elements_kind)                               \
+        : Base(bitfield),                                                   \
+          typed_array_(typed_array),                                        \
+          elements_kind_(elements_kind) {                                   \
+      DCHECK(elements_kind ==                                               \
+             v8::internal::compiler::turboshaft::any_of(__VA_ARGS__));      \
+    }                                                                       \
+                                                                            \
+    static constexpr OpProperties kProperties = properties;                 \
+    static constexpr typename Base::InputTypes kInputTypes{                 \
+        ValueRepresentation::kUint32, type};                                \
+                                                                            \
+    static constexpr int kIndexIndex = 0;                                   \
+    static constexpr int kValueIndex = 1;                                   \
+    Input& index_input() { return input(kIndexIndex); }                     \
+    Input& value_input() { return input(kValueIndex); }                     \
+                                                                            \
+    void SetValueLocationConstraints();                                     \
+    void GenerateCode(MaglevAssembler*, const ProcessingState&);            \
+    void PrintParams(std::ostream&, MaglevGraphLabeller*) const {}          \
+                                                                            \
+    ElementsKind elements_kind() const { return elements_kind_; }           \
+    compiler::JSTypedArrayRef typed_array() const { return typed_array_; }  \
+                                                                            \
+   private:                                                                 \
+    compiler::JSTypedArrayRef typed_array_;                                 \
+    ElementsKind elements_kind_;                                            \
+  };
+
+STORE_CONSTANT_TYPED_ARRAY(StoreIntConstantTypedArrayElement,
+                           OpProperties::CanWrite(),
+                           ValueRepresentation::kInt32, INT8_ELEMENTS,
+                           INT16_ELEMENTS, INT32_ELEMENTS, UINT8_ELEMENTS,
+                           UINT8_CLAMPED_ELEMENTS, UINT16_ELEMENTS,
+                           UINT16_ELEMENTS, UINT32_ELEMENTS)
+STORE_CONSTANT_TYPED_ARRAY(StoreDoubleConstantTypedArrayElement,
+                           OpProperties::CanWrite(),
+                           ValueRepresentation::kHoleyFloat64, FLOAT32_ELEMENTS,
+                           FLOAT64_ELEMENTS)
+#undef STORE_CONSTANT_TYPED_ARRAY
+
 class StoreSignedIntDataViewElement
     : public FixedInputNodeT<4, StoreSignedIntDataViewElement> {
   using Base = FixedInputNodeT<4, StoreSignedIntDataViewElement>;
@@ -8530,32 +8589,6 @@ class StoreDoubleField : public FixedInputNodeT<2, StoreDoubleField> {
   const int offset_;
 };
 
-class StoreHeapInt32 : public FixedInputNodeT<2, StoreHeapInt32> {
-  using Base = FixedInputNodeT<2, StoreHeapInt32>;
-
- public:
-  explicit StoreHeapInt32(uint64_t bitfield, int offset)
-      : Base(bitfield), offset_(offset) {}
-
-  static constexpr OpProperties kProperties = OpProperties::CanWrite();
-  static constexpr typename Base::InputTypes kInputTypes{
-      ValueRepresentation::kTagged, ValueRepresentation::kInt32};
-
-  int offset() const { return offset_; }
-
-  static constexpr int kObjectIndex = 0;
-  static constexpr int kValueIndex = 1;
-  Input& object_input() { return input(kObjectIndex); }
-  Input& value_input() { return input(kValueIndex); }
-
-  void SetValueLocationConstraints();
-  void GenerateCode(MaglevAssembler*, const ProcessingState&);
-  void PrintParams(std::ostream&, MaglevGraphLabeller*) const;
-
- private:
-  const int offset_;
-};
-
 class StoreInt32 : public FixedInputNodeT<2, StoreInt32> {
   using Base = FixedInputNodeT<2, StoreInt32>;
 
@@ -8753,12 +8786,12 @@ class StoreTaggedFieldWithWriteBarrier
   const int offset_;
 };
 
-class StoreScriptContextSlotWithWriteBarrier
-    : public FixedInputNodeT<2, StoreScriptContextSlotWithWriteBarrier> {
-  using Base = FixedInputNodeT<2, StoreScriptContextSlotWithWriteBarrier>;
+class StoreContextSlotWithWriteBarrier
+    : public FixedInputNodeT<2, StoreContextSlotWithWriteBarrier> {
+  using Base = FixedInputNodeT<2, StoreContextSlotWithWriteBarrier>;
 
  public:
-  explicit StoreScriptContextSlotWithWriteBarrier(uint64_t bitfield, int index)
+  explicit StoreContextSlotWithWriteBarrier(uint64_t bitfield, int index)
       : Base(bitfield), index_(index) {}
 
   static constexpr OpProperties kProperties = OpProperties::CanWrite() |
diff --git a/deps/v8/src/maglev/maglev-post-hoc-optimizations-processors.h b/deps/v8/src/maglev/maglev-post-hoc-optimizations-processors.h
index 684eebd2967727..1877ae4b28ab72 100644
--- a/deps/v8/src/maglev/maglev-post-hoc-optimizations-processors.h
+++ b/deps/v8/src/maglev/maglev-post-hoc-optimizations-processors.h
@@ -253,11 +253,11 @@ class AnyUseMarkingProcessor {
 
   void VerifyEscapeAnalysis(Graph* graph) {
 #ifdef DEBUG
-    for (auto it : graph->allocations_escape_map()) {
-      auto alloc = it.first;
+    for (const auto& it : graph->allocations_escape_map()) {
+      auto* alloc = it.first;
       DCHECK(alloc->HasBeenAnalysed());
       if (alloc->HasEscaped()) {
-        for (auto dep : it.second) {
+        for (auto* dep : it.second) {
           DCHECK(dep->HasEscaped());
         }
       }
@@ -266,8 +266,8 @@ class AnyUseMarkingProcessor {
   }
 
   void RunEscapeAnalysis(Graph* graph) {
-    for (auto it : graph->allocations_escape_map()) {
-      auto alloc = it.first;
+    for (auto& it : graph->allocations_escape_map()) {
+      auto* alloc = it.first;
       if (alloc->HasBeenAnalysed()) continue;
       // Check if all its uses are non escaping.
       if (alloc->IsEscaping()) {
diff --git a/deps/v8/src/maglev/maglev-regalloc.cc b/deps/v8/src/maglev/maglev-regalloc.cc
index 3be6831cb6e467..ca2ecf27d11ccb 100644
--- a/deps/v8/src/maglev/maglev-regalloc.cc
+++ b/deps/v8/src/maglev/maglev-regalloc.cc
@@ -392,6 +392,10 @@ void StraightForwardRegisterAllocator::AllocateRegisters() {
     constant->SetConstantLocation();
     USE(value);
   }
+  for (const auto& [value, constant] : graph_->intptr()) {
+    constant->SetConstantLocation();
+    USE(value);
+  }
   for (const auto& [value, constant] : graph_->float64()) {
     constant->SetConstantLocation();
     USE(value);
diff --git a/deps/v8/src/maglev/maglev.cc b/deps/v8/src/maglev/maglev.cc
index b0069ecf57bbbd..202dc15431c6d8 100644
--- a/deps/v8/src/maglev/maglev.cc
+++ b/deps/v8/src/maglev/maglev.cc
@@ -18,7 +18,7 @@ namespace internal {
 MaybeHandle<Code> Maglev::Compile(Isolate* isolate, Handle<JSFunction> function,
                                   BytecodeOffset osr_offset) {
   DCHECK(v8_flags.maglev);
-  RCS_SCOPE(isolate, RuntimeCallCounterId::kOptimizeNonConcurrentMaglev);
+  RCS_SCOPE(isolate, RuntimeCallCounterId::kOptimizeSynchronousMaglev);
   std::unique_ptr<maglev::MaglevCompilationInfo> info =
       maglev::MaglevCompilationInfo::New(isolate, function, osr_offset);
   if (!maglev::MaglevCompiler::Compile(isolate->main_thread_local_isolate(),
diff --git a/deps/v8/src/maglev/riscv/maglev-assembler-riscv-inl.h b/deps/v8/src/maglev/riscv/maglev-assembler-riscv-inl.h
index 3abe70a93ab8e3..50e42e6e48c935 100644
--- a/deps/v8/src/maglev/riscv/maglev-assembler-riscv-inl.h
+++ b/deps/v8/src/maglev/riscv/maglev-assembler-riscv-inl.h
@@ -824,6 +824,9 @@ inline void MaglevAssembler::Move(Register dst, int32_t i) {
 inline void MaglevAssembler::Move(Register dst, uint32_t i) {
   li(dst, Operand(i));
 }
+inline void MaglevAssembler::Move(Register dst, intptr_t p) {
+  li(dst, Operand(p));
+}
 inline void MaglevAssembler::Move(Register dst, IndirectPointerTag i) {
   li(dst, Operand(i));
 }
@@ -1902,20 +1905,35 @@ inline void MaglevAssembler::TestUint8AndJumpIfAllClear(
   MacroAssembler::Branch(target, kZero, scratch, Operand(zero_reg), distance);
 }
 
-inline void MaglevAssembler::LoadHeapNumberValue(DoubleRegister result,
-                                                 Register heap_number) {
-  LoadDouble(result,
-             FieldMemOperand(heap_number, offsetof(HeapNumber, value_)));
+inline void MaglevAssembler::LoadContextCellState(Register state,
+                                                  Register cell) {
+  Lwu(state, FieldMemOperand(cell, offsetof(ContextCell, state_)));
 }
-
-inline void MaglevAssembler::LoadHeapInt32Value(Register result,
-                                                Register heap_number) {
-  Load32U(result, FieldMemOperand(heap_number, offsetof(HeapNumber, value_)));
+inline void MaglevAssembler::LoadContextCellInt32Value(Register value,
+                                                       Register cell) {
+  AssertContextCellState(cell, ContextCell::kInt32);
+  Lwu(value, FieldMemOperand(cell, offsetof(ContextCell, double_value_)));
+}
+inline void MaglevAssembler::LoadContextCellFloat64Value(DoubleRegister value,
+                                                         Register cell) {
+  AssertContextCellState(cell, ContextCell::kFloat64);
+  LoadDouble(value,
+             FieldMemOperand(cell, offsetof(ContextCell, double_value_)));
+}
+inline void MaglevAssembler::StoreContextCellInt32Value(Register cell,
+                                                        Register value) {
+  Sw(value, FieldMemOperand(cell, offsetof(ContextCell, double_value_)));
+}
+inline void MaglevAssembler::StoreContextCellFloat64Value(
+    Register cell, DoubleRegister value) {
+  StoreDouble(value,
+              FieldMemOperand(cell, offsetof(ContextCell, double_value_)));
 }
 
-inline void MaglevAssembler::StoreHeapInt32Value(Register value,
+inline void MaglevAssembler::LoadHeapNumberValue(DoubleRegister result,
                                                  Register heap_number) {
-  Sw(value, (FieldMemOperand(heap_number, offsetof(HeapNumber, value_))));
+  LoadDouble(result,
+             FieldMemOperand(heap_number, offsetof(HeapNumber, value_)));
 }
 
 inline void MaglevAssembler::Int32ToDouble(DoubleRegister result,
diff --git a/deps/v8/src/maglev/riscv/maglev-assembler-riscv.cc b/deps/v8/src/maglev/riscv/maglev-assembler-riscv.cc
index b4237c3d4125d9..62daad42782803 100644
--- a/deps/v8/src/maglev/riscv/maglev-assembler-riscv.cc
+++ b/deps/v8/src/maglev/riscv/maglev-assembler-riscv.cc
@@ -257,9 +257,11 @@ void MaglevAssembler::LoadSingleCharacterString(Register result,
                            Operand(String::kMaxOneByteCharCode));
   }
   Register table = scratch;
-  LoadRoot(table, RootIndex::kSingleCharacterStringTable);
-  LoadTaggedFieldByIndex(result, table, char_code, kTaggedSize,
-                         OFFSET_OF_DATA_START(FixedArray));
+  AddWord(table, kRootRegister,
+          Operand(RootRegisterOffsetForRootIndex(
+              RootIndex::kFirstSingleCharacterString)));
+  CalcScaledAddress(table, table, char_code, kSystemPointerSizeLog2);
+  LoadWord(result, MemOperand(table, 0));
 }
 
 void MaglevAssembler::StringFromCharCode(RegisterSnapshot register_snapshot,
diff --git a/deps/v8/src/maglev/riscv/maglev-ir-riscv.cc b/deps/v8/src/maglev/riscv/maglev-ir-riscv.cc
index 53c8c3ce3ac667..2bf5e1f5089825 100644
--- a/deps/v8/src/maglev/riscv/maglev-ir-riscv.cc
+++ b/deps/v8/src/maglev/riscv/maglev-ir-riscv.cc
@@ -224,6 +224,40 @@ void CheckedIntPtrToInt32::GenerateCode(MaglevAssembler* masm,
                             Operand(std::numeric_limits<int32_t>::min()));
 }
 
+void CheckFloat64SameValue::SetValueLocationConstraints() {
+  UseRegister(target_input());
+  // We need two because LoadFPRImmediate needs to acquire one as well in the
+  // case where value() is not 0.0 or -0.0.
+  set_temporaries_needed((value().get_scalar() == 0) ? 1 : 2);
+  set_double_temporaries_needed(
+      value().is_nan() || (value().get_scalar() == 0) ? 0 : 1);
+}
+
+void CheckFloat64SameValue::GenerateCode(MaglevAssembler* masm,
+                                         const ProcessingState& state) {
+  Label* fail = __ GetDeoptLabel(this, deoptimize_reason());
+  MaglevAssembler::TemporaryRegisterScope temps(masm);
+  DoubleRegister target = ToDoubleRegister(target_input());
+  if (value().is_nan()) {
+    __ JumpIfNotNan(target, fail);
+  } else {
+    DoubleRegister double_scratch = temps.AcquireScratchDouble();
+    Register scratch = temps.AcquireScratch();
+    __ Move(double_scratch, value().get_scalar());
+    __ CompareF64(scratch, EQ, double_scratch, target);
+    __ BranchFalseF(scratch, fail);
+    if (value().get_scalar() == 0) {  // +0.0 or -0.0.
+      __ MacroAssembler::Move(scratch, target);
+      __ And(scratch, scratch, Operand(1ULL << 63));
+      if (value().get_bits() == 0) {
+        __ BranchTrueF(scratch, fail);
+      } else {
+        __ BranchFalseF(scratch, fail);
+      }
+    }
+  }
+}
+
 void Int32AddWithOverflow::SetValueLocationConstraints() {
   UseRegister(left_input());
   UseRegister(right_input());
diff --git a/deps/v8/src/maglev/s390/maglev-assembler-s390-inl.h b/deps/v8/src/maglev/s390/maglev-assembler-s390-inl.h
index 7a58a5292dc610..1ff15eae0c8643 100644
--- a/deps/v8/src/maglev/s390/maglev-assembler-s390-inl.h
+++ b/deps/v8/src/maglev/s390/maglev-assembler-s390-inl.h
@@ -645,6 +645,10 @@ inline void MaglevAssembler::Move(Register dst, uint32_t i) {
   LoadU32(dst, dst);
 }
 
+inline void MaglevAssembler::Move(Register dst, intptr_t p) {
+  mov(dst, Operand(p));
+}
+
 void MaglevAssembler::MoveTagged(Register dst, Handle<HeapObject> obj) {
 #ifdef V8_COMPRESS_POINTERS
   MacroAssembler::Move(dst, obj, RelocInfo::COMPRESSED_EMBEDDED_OBJECT);
@@ -1276,23 +1280,37 @@ inline void MaglevAssembler::TestUint8AndJumpIfAllClear(
   beq(target, distance);
 }
 
-inline void MaglevAssembler::LoadHeapNumberValue(DoubleRegister result,
-                                                 Register heap_number) {
-  LoadF64(result, FieldMemOperand(heap_number, offsetof(HeapNumber, value_)));
+inline void MaglevAssembler::LoadContextCellState(Register state,
+                                                  Register cell) {
+  LoadU32(state, FieldMemOperand(cell, offsetof(ContextCell, state_)));
+}
+
+inline void MaglevAssembler::LoadContextCellInt32Value(Register value,
+                                                       Register cell) {
+  AssertContextCellState(cell, ContextCell::kInt32);
+  LoadU32(value, FieldMemOperand(cell, offsetof(ContextCell, double_value_)));
 }
 
-inline void MaglevAssembler::LoadHeapInt32Value(Register result,
-                                                Register heap_number) {
-  LoadU32(result,
-          FieldMemOperand(heap_number, offsetof(HeapNumber, value_) +
-                                           kIeeeDoubleMantissaWordOffset));
+inline void MaglevAssembler::LoadContextCellFloat64Value(DoubleRegister value,
+                                                         Register cell) {
+  AssertContextCellState(cell, ContextCell::kFloat64);
+  LoadFloat64(value,
+              FieldMemOperand(cell, offsetof(ContextCell, double_value_)));
 }
 
-inline void MaglevAssembler::StoreHeapInt32Value(Register value,
+inline void MaglevAssembler::StoreContextCellInt32Value(Register cell,
+                                                        Register value) {
+  StoreU32(value, FieldMemOperand(cell, offsetof(ContextCell, double_value_)));
+}
+
+inline void MaglevAssembler::StoreContextCellFloat64Value(
+    Register cell, DoubleRegister value) {
+  StoreF64(value, FieldMemOperand(cell, offsetof(ContextCell, double_value_)));
+}
+
+inline void MaglevAssembler::LoadHeapNumberValue(DoubleRegister result,
                                                  Register heap_number) {
-  StoreU32(value,
-           FieldMemOperand(heap_number, offsetof(HeapNumber, value_) +
-                                            kIeeeDoubleMantissaWordOffset));
+  LoadF64(result, FieldMemOperand(heap_number, offsetof(HeapNumber, value_)));
 }
 
 inline void MaglevAssembler::Int32ToDouble(DoubleRegister result,
diff --git a/deps/v8/src/maglev/s390/maglev-assembler-s390.cc b/deps/v8/src/maglev/s390/maglev-assembler-s390.cc
index 7d460aa0953430..9886f12435d837 100644
--- a/deps/v8/src/maglev/s390/maglev-assembler-s390.cc
+++ b/deps/v8/src/maglev/s390/maglev-assembler-s390.cc
@@ -221,9 +221,11 @@ void MaglevAssembler::LoadSingleCharacterString(Register result,
     Assert(le, AbortReason::kUnexpectedValue);
   }
   Register table = scratch;
-  LoadRoot(table, RootIndex::kSingleCharacterStringTable);
-  LoadTaggedFieldByIndex(result, table, char_code, kTaggedSize,
-                         OFFSET_OF_DATA_START(FixedArray));
+  AddS64(table, kRootRegister,
+         Operand(RootRegisterOffsetForRootIndex(
+             RootIndex::kFirstSingleCharacterString)));
+  ShiftLeftU64(result, char_code, Operand(kSystemPointerSizeLog2));
+  LoadU64(result, MemOperand(table, result));
 }
 
 void MaglevAssembler::StringFromCharCode(RegisterSnapshot register_snapshot,
diff --git a/deps/v8/src/maglev/x64/maglev-assembler-x64-inl.h b/deps/v8/src/maglev/x64/maglev-assembler-x64-inl.h
index f759302835bcf4..1d8dfb87034beb 100644
--- a/deps/v8/src/maglev/x64/maglev-assembler-x64-inl.h
+++ b/deps/v8/src/maglev/x64/maglev-assembler-x64-inl.h
@@ -661,6 +661,10 @@ void MaglevAssembler::MoveTagged(Register dst, Handle<HeapObject> obj) {
 #endif
 }
 
+inline void MaglevAssembler::Move(Register dst, intptr_t p) {
+  MacroAssembler::Move(dst, p);
+}
+
 inline void MaglevAssembler::LoadInt32(Register dst, MemOperand src) {
   movl(dst, src);
 }
@@ -1256,19 +1260,36 @@ inline void MaglevAssembler::TestUint8AndJumpIfAllClear(
   JumpIf(kZero, target, distance);
 }
 
-inline void MaglevAssembler::LoadHeapNumberValue(DoubleRegister result,
-                                                 Register heap_number) {
-  Movsd(result, FieldOperand(heap_number, offsetof(HeapNumber, value_)));
+inline void MaglevAssembler::LoadContextCellState(Register state,
+                                                  Register cell) {
+  movl(state, FieldMemOperand(cell, offsetof(ContextCell, state_)));
+}
+
+inline void MaglevAssembler::LoadContextCellInt32Value(Register value,
+                                                       Register cell) {
+  AssertContextCellState(cell, ContextCell::kInt32);
+  movl(value, FieldMemOperand(cell, offsetof(ContextCell, double_value_)));
 }
 
-inline void MaglevAssembler::LoadHeapInt32Value(Register result,
-                                                Register heap_number) {
-  movl(result, FieldOperand(heap_number, offsetof(HeapNumber, value_)));
+inline void MaglevAssembler::LoadContextCellFloat64Value(DoubleRegister value,
+                                                         Register cell) {
+  AssertContextCellState(cell, ContextCell::kFloat64);
+  Movsd(value, FieldOperand(cell, offsetof(ContextCell, double_value_)));
 }
 
-inline void MaglevAssembler::StoreHeapInt32Value(Register value,
+inline void MaglevAssembler::StoreContextCellInt32Value(Register cell,
+                                                        Register value) {
+  movl(FieldMemOperand(cell, offsetof(ContextCell, double_value_)), value);
+}
+
+inline void MaglevAssembler::StoreContextCellFloat64Value(
+    Register cell, DoubleRegister value) {
+  Movsd(FieldOperand(cell, offsetof(ContextCell, double_value_)), value);
+}
+
+inline void MaglevAssembler::LoadHeapNumberValue(DoubleRegister result,
                                                  Register heap_number) {
-  movl(FieldOperand(heap_number, offsetof(HeapNumber, value_)), value);
+  Movsd(result, FieldOperand(heap_number, offsetof(HeapNumber, value_)));
 }
 
 inline void MaglevAssembler::Int32ToDouble(DoubleRegister result,
diff --git a/deps/v8/src/maglev/x64/maglev-assembler-x64.cc b/deps/v8/src/maglev/x64/maglev-assembler-x64.cc
index 2e433b4e7a4db4..7164f50b14d432 100644
--- a/deps/v8/src/maglev/x64/maglev-assembler-x64.cc
+++ b/deps/v8/src/maglev/x64/maglev-assembler-x64.cc
@@ -87,10 +87,9 @@ void MaglevAssembler::LoadSingleCharacterString(Register result,
     Assert(below_equal, AbortReason::kUnexpectedValue);
   }
   DCHECK_NE(char_code, scratch);
-  Register table = scratch;
-  LoadRoot(table, RootIndex::kSingleCharacterStringTable);
-  LoadTaggedFieldByIndex(result, table, char_code, kTaggedSize,
-                         OFFSET_OF_DATA_START(FixedArray));
+  movq(result, MemOperand(kRootRegister, char_code, times_system_pointer_size,
+                          RootRegisterOffsetForRootIndex(
+                              RootIndex::kFirstSingleCharacterString)));
 }
 
 void MaglevAssembler::StringFromCharCode(RegisterSnapshot register_snapshot,
diff --git a/deps/v8/src/objects/all-objects-inl.h b/deps/v8/src/objects/all-objects-inl.h
index 33c7d9c37bcf49..bbb0a18ae5305c 100644
--- a/deps/v8/src/objects/all-objects-inl.h
+++ b/deps/v8/src/objects/all-objects-inl.h
@@ -19,6 +19,8 @@
 #include "src/objects/compilation-cache-table-inl.h"
 #include "src/objects/compressed-slots-inl.h"
 #include "src/objects/contexts-inl.h"
+#include "src/objects/cpp-heap-external-object-inl.h"
+#include "src/objects/cpp-heap-object-wrapper-inl.h"
 #include "src/objects/data-handler-inl.h"
 #include "src/objects/debug-objects-inl.h"
 #include "src/objects/descriptor-array-inl.h"
diff --git a/deps/v8/src/objects/allocation-site-inl.h b/deps/v8/src/objects/allocation-site-inl.h
index acd042b7dd99a8..c2b44f2490e86b 100644
--- a/deps/v8/src/objects/allocation-site-inl.h
+++ b/deps/v8/src/objects/allocation-site-inl.h
@@ -8,6 +8,8 @@
 #include "src/objects/allocation-site.h"
 // Include the non-inl header before the rest of the headers.
 
+#include <atomic>
+
 #include "src/common/globals.h"
 #include "src/heap/heap-write-barrier-inl.h"
 #include "src/objects/dependent-code-inl.h"
@@ -15,65 +17,84 @@
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
+#include "src/objects/objects.h"
 
 namespace v8 {
 namespace internal {
 
 #include "torque-generated/src/objects/allocation-site-tq-inl.inc"
 
-TQ_OBJECT_CONSTRUCTORS_IMPL(AllocationMemento)
-OBJECT_CONSTRUCTORS_IMPL(AllocationSite, Struct)
-
 NEVER_READ_ONLY_SPACE_IMPL(AllocationSite)
 
-ACCESSORS(AllocationSite, transition_info_or_boilerplate, Tagged<Object>,
-          kTransitionInfoOrBoilerplateOffset)
-RELEASE_ACQUIRE_ACCESSORS(AllocationSite, transition_info_or_boilerplate,
-                          Tagged<Object>, kTransitionInfoOrBoilerplateOffset)
-ACCESSORS(AllocationSite, nested_site, Tagged<Object>, kNestedSiteOffset)
-RELAXED_INT32_ACCESSORS(AllocationSite, pretenure_data, kPretenureDataOffset)
-INT32_ACCESSORS(AllocationSite, pretenure_create_count,
-                kPretenureCreateCountOffset)
-ACCESSORS(AllocationSite, dependent_code, Tagged<DependentCode>,
-          kDependentCodeOffset)
-ACCESSORS_CHECKED(AllocationSite, weak_next, Tagged<Object>, kWeakNextOffset,
-                  HasWeakNext())
-ACCESSORS(AllocationMemento, allocation_site, Tagged<Object>,
-          kAllocationSiteOffset)
-
-Tagged<JSObject> AllocationSite::boilerplate() const {
+inline Tagged<UnionOf<Smi, JSObject>>
+AllocationSite::transition_info_or_boilerplate() const {
+  return transition_info_or_boilerplate_.load();
+}
+
+inline Tagged<UnionOf<Smi, AllocationSite>> AllocationSite::nested_site()
+    const {
+  return nested_site_.load();
+}
+inline void AllocationSite::set_nested_site(
+    Tagged<UnionOf<Smi, AllocationSite>> value, WriteBarrierMode mode) {
+  nested_site_.store(this, value, mode);
+}
+
+inline Tagged<DependentCode> AllocationSite::dependent_code() const {
+  return dependent_code_.load();
+}
+void AllocationSite::set_dependent_code(Tagged<DependentCode> value,
+                                        WriteBarrierMode mode) {
+  dependent_code_.store(this, value, mode);
+}
+
+inline int32_t AllocationSite::pretenure_data(RelaxedLoadTag) const {
+  return pretenure_data_.load(std::memory_order_relaxed);
+}
+inline void AllocationSite::set_pretenure_data(int32_t value, RelaxedStoreTag) {
+  pretenure_data_.store(value, std::memory_order_relaxed);
+}
+
+inline int32_t AllocationSite::pretenure_create_count() const {
+  return pretenure_create_count_;
+}
+inline void AllocationSite::set_pretenure_create_count(int32_t value) {
+  pretenure_create_count_ = value;
+}
+
+inline Tagged<JSObject> AllocationSite::boilerplate() const {
   DCHECK(PointsToLiteral());
-  return Cast<JSObject>(transition_info_or_boilerplate());
+  return Cast<JSObject>(transition_info_or_boilerplate_.load());
 }
 
-Tagged<JSObject> AllocationSite::boilerplate(AcquireLoadTag tag) const {
+inline Tagged<JSObject> AllocationSite::boilerplate(AcquireLoadTag tag) const {
   DCHECK(PointsToLiteral());
-  return Cast<JSObject>(transition_info_or_boilerplate(tag));
+  return Cast<JSObject>(transition_info_or_boilerplate_.Acquire_Load());
 }
 
-void AllocationSite::set_boilerplate(Tagged<JSObject> value,
-                                     ReleaseStoreTag tag,
-                                     WriteBarrierMode mode) {
-  set_transition_info_or_boilerplate(value, tag, mode);
+inline void AllocationSite::set_boilerplate(Tagged<JSObject> value,
+                                            ReleaseStoreTag tag,
+                                            WriteBarrierMode mode) {
+  transition_info_or_boilerplate_.Release_Store(this, value, mode);
 }
 
-int AllocationSite::transition_info() const {
+inline int AllocationSite::transition_info() const {
   DCHECK(!PointsToLiteral());
-  return Cast<Smi>(transition_info_or_boilerplate(kAcquireLoad)).value();
+  return Cast<Smi>(transition_info_or_boilerplate_.Acquire_Load()).value();
 }
 
 void AllocationSite::set_transition_info(int value) {
   DCHECK(!PointsToLiteral());
-  set_transition_info_or_boilerplate(Smi::FromInt(value), kReleaseStore,
-                                     SKIP_WRITE_BARRIER);
+  transition_info_or_boilerplate_.Release_Store(this, Smi::FromInt(value),
+                                                SKIP_WRITE_BARRIER);
 }
 
-bool AllocationSite::HasWeakNext() const {
+inline bool AllocationSite::HasWeakNext() const {
   return map() == GetReadOnlyRoots().allocation_site_map();
 }
 
-void AllocationSite::Initialize() {
-  set_transition_info_or_boilerplate(Smi::zero());
+inline void AllocationSite::Initialize() {
+  transition_info_or_boilerplate_.store(this, Smi::zero(), SKIP_WRITE_BARRIER);
   SetElementsKind(GetInitialFastElementsKind());
   set_nested_site(Smi::zero());
   set_pretenure_data(0, kRelaxedStore);
@@ -82,49 +103,50 @@ void AllocationSite::Initialize() {
                      SKIP_WRITE_BARRIER);
 }
 
-bool AllocationSite::IsZombie() const {
+inline bool AllocationSite::IsZombie() const {
   return pretenure_decision() == kZombie;
 }
 
-bool AllocationSite::IsMaybeTenure() const {
+inline bool AllocationSite::IsMaybeTenure() const {
   return pretenure_decision() == kMaybeTenure;
 }
 
-bool AllocationSite::PretenuringDecisionMade() const {
+inline bool AllocationSite::PretenuringDecisionMade() const {
   return pretenure_decision() != kUndecided;
 }
 
-void AllocationSite::MarkZombie() {
+inline void AllocationSite::MarkZombie() {
   DCHECK(!IsZombie());
   Initialize();
   set_pretenure_decision(kZombie);
 }
 
-ElementsKind AllocationSite::GetElementsKind() const {
+inline ElementsKind AllocationSite::GetElementsKind() const {
   return ElementsKindBits::decode(transition_info());
 }
 
-void AllocationSite::SetElementsKind(ElementsKind kind) {
+inline void AllocationSite::SetElementsKind(ElementsKind kind) {
   set_transition_info(ElementsKindBits::update(transition_info(), kind));
 }
 
-bool AllocationSite::CanInlineCall() const {
+inline bool AllocationSite::CanInlineCall() const {
   return DoNotInlineBit::decode(transition_info()) == 0;
 }
 
-void AllocationSite::SetDoNotInlineCall() {
+inline void AllocationSite::SetDoNotInlineCall() {
   set_transition_info(DoNotInlineBit::update(transition_info(), true));
 }
 
-bool AllocationSite::PointsToLiteral() const {
-  Tagged<Object> raw_value = transition_info_or_boilerplate(kAcquireLoad);
+inline bool AllocationSite::PointsToLiteral() const {
+  Tagged<Object> raw_value = transition_info_or_boilerplate_.Acquire_Load();
   DCHECK_EQ(!IsSmi(raw_value), IsJSArray(raw_value) || IsJSObject(raw_value));
   return !IsSmi(raw_value);
 }
 
 // Heuristic: We only need to create allocation site info if the boilerplate
 // elements kind is the initial elements kind.
-bool AllocationSite::ShouldTrack(ElementsKind boilerplate_elements_kind) {
+inline bool AllocationSite::ShouldTrack(
+    ElementsKind boilerplate_elements_kind) {
   if (!V8_ALLOCATION_SITE_TRACKING_BOOL) return false;
   return IsSmiElementsKind(boilerplate_elements_kind);
 }
@@ -139,27 +161,28 @@ inline bool AllocationSite::CanTrack(InstanceType type) {
   return type == JS_ARRAY_TYPE;
 }
 
-AllocationSite::PretenureDecision AllocationSite::pretenure_decision() const {
+inline AllocationSite::PretenureDecision AllocationSite::pretenure_decision()
+    const {
   return PretenureDecisionBits::decode(pretenure_data(kRelaxedLoad));
 }
 
-void AllocationSite::set_pretenure_decision(PretenureDecision decision) {
+inline void AllocationSite::set_pretenure_decision(PretenureDecision decision) {
   int32_t value = pretenure_data(kRelaxedLoad);
   set_pretenure_data(PretenureDecisionBits::update(value, decision),
                      kRelaxedStore);
 }
 
-bool AllocationSite::deopt_dependent_code() const {
+inline bool AllocationSite::deopt_dependent_code() const {
   return DeoptDependentCodeBit::decode(pretenure_data(kRelaxedLoad));
 }
 
-void AllocationSite::set_deopt_dependent_code(bool deopt) {
+inline void AllocationSite::set_deopt_dependent_code(bool deopt) {
   int32_t value = pretenure_data(kRelaxedLoad);
   set_pretenure_data(DeoptDependentCodeBit::update(value, deopt),
                      kRelaxedStore);
 }
 
-int AllocationSite::memento_found_count() const {
+inline int AllocationSite::memento_found_count() const {
   return MementoFoundCountBits::decode(pretenure_data(kRelaxedLoad));
 }
 
@@ -169,17 +192,17 @@ inline void AllocationSite::set_memento_found_count(int count) {
   // new space collection.
   DCHECK((GetHeap()->MaxSemiSpaceSize() /
           (Heap::kMinObjectSizeInTaggedWords * kTaggedSize +
-           AllocationMemento::kSize)) < MementoFoundCountBits::kMax);
+           sizeof(AllocationSiteWithWeakNext))) < MementoFoundCountBits::kMax);
   DCHECK_LT(count, MementoFoundCountBits::kMax);
   set_pretenure_data(MementoFoundCountBits::update(value, count),
                      kRelaxedStore);
 }
 
-int AllocationSite::memento_create_count() const {
+inline int AllocationSite::memento_create_count() const {
   return pretenure_create_count();
 }
 
-void AllocationSite::set_memento_create_count(int count) {
+inline void AllocationSite::set_memento_create_count(int count) {
   set_pretenure_create_count(count);
 }
 
@@ -197,24 +220,37 @@ inline void AllocationSite::IncrementMementoCreateCount() {
   set_memento_create_count(value + 1);
 }
 
-bool AllocationMemento::IsValid() const {
-  return IsAllocationSite(allocation_site()) &&
-         !Cast<AllocationSite>(allocation_site())->IsZombie();
+inline Tagged<UnionOf<Undefined, AllocationSiteWithWeakNext>>
+AllocationSiteWithWeakNext::weak_next() const {
+  return weak_next_.load();
+}
+inline void AllocationSiteWithWeakNext::set_weak_next(
+    Tagged<UnionOf<Undefined, AllocationSiteWithWeakNext>> value,
+    WriteBarrierMode mode) {
+  weak_next_.store(this, value, mode);
 }
 
-Tagged<AllocationSite> AllocationMemento::GetAllocationSite() const {
+inline bool AllocationMemento::IsValid() const {
+  return !allocation_site_.load()->IsZombie();
+}
+
+void AllocationMemento::set_allocation_site(Tagged<AllocationSite> value,
+                                            WriteBarrierMode mode) {
+  allocation_site_.store(this, value, mode);
+}
+inline Tagged<AllocationSite> AllocationMemento::GetAllocationSite() const {
   DCHECK(IsValid());
-  return Cast<AllocationSite>(allocation_site());
+  return allocation_site_.load();
 }
 
-Address AllocationMemento::GetAllocationSiteUnchecked() const {
-  return allocation_site().ptr();
+inline Address AllocationMemento::GetAllocationSiteUnchecked() const {
+  return allocation_site_.load().ptr();
 }
 
 template <AllocationSiteUpdateMode update_or_check>
-bool AllocationSite::DigestTransitionFeedback(DirectHandle<AllocationSite> site,
+bool AllocationSite::DigestTransitionFeedback(Isolate* isolate,
+                                              DirectHandle<AllocationSite> site,
                                               ElementsKind to_kind) {
-  Isolate* isolate = site->GetIsolate();
   bool result = false;
 
   if (site->PointsToLiteral() && IsJSArray(site->boilerplate())) {
@@ -242,7 +278,7 @@ bool AllocationSite::DigestTransitionFeedback(DirectHandle<AllocationSite> site,
                  ElementsKindToString(to_kind));
         }
         CHECK_NE(to_kind, DICTIONARY_ELEMENTS);
-        JSObject::TransitionElementsKind(boilerplate, to_kind);
+        JSObject::TransitionElementsKind(isolate, boilerplate, to_kind);
         DependentCode::DeoptimizeDependencyGroups(
             isolate, *site,
             DependentCode::kAllocationSiteTransitionChangedGroup);
diff --git a/deps/v8/src/objects/allocation-site.h b/deps/v8/src/objects/allocation-site.h
index 53e2286cd65495..9aabc64acf5c20 100644
--- a/deps/v8/src/objects/allocation-site.h
+++ b/deps/v8/src/objects/allocation-site.h
@@ -5,6 +5,8 @@
 #ifndef V8_OBJECTS_ALLOCATION_SITE_H_
 #define V8_OBJECTS_ALLOCATION_SITE_H_
 
+#include <atomic>
+
 #include "src/objects/objects.h"
 #include "src/objects/struct.h"
 
@@ -18,7 +20,7 @@ enum InstanceType : uint16_t;
 
 #include "torque-generated/src/objects/allocation-site-tq.inc"
 
-class AllocationSite : public Struct {
+V8_OBJECT class AllocationSite : public HeapObjectLayout {
  public:
   NEVER_READ_ONLY_SPACE
   static const uint32_t kMaximumArrayBytesToPretransition = 8 * 1024;
@@ -35,29 +37,33 @@ class AllocationSite : public Struct {
 
   const char* PretenureDecisionName(PretenureDecision decision);
 
-  // Contains either a Smi-encoded bitfield or a boilerplate. If it's a Smi the
-  // AllocationSite is for a constructed Array.
-  DECL_ACCESSORS(transition_info_or_boilerplate, Tagged<Object>)
-  DECL_RELEASE_ACQUIRE_ACCESSORS(transition_info_or_boilerplate, Tagged<Object>)
-  DECL_GETTER(boilerplate, Tagged<JSObject>)
-  DECL_RELEASE_ACQUIRE_ACCESSORS(boilerplate, Tagged<JSObject>)
-  DECL_INT_ACCESSORS(transition_info)
+  inline Tagged<UnionOf<Smi, JSObject>> transition_info_or_boilerplate() const;
+
+  inline Tagged<JSObject> boilerplate() const;
+  inline Tagged<JSObject> boilerplate(AcquireLoadTag tag) const;
+  inline void set_boilerplate(Tagged<JSObject> value, ReleaseStoreTag,
+                              WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+
+  inline int transition_info() const;
+  inline void set_transition_info(int value);
 
   // nested_site threads a list of sites that represent nested literals
   // walked in a particular order. So [[1, 2], 1, 2] will have one
   // nested_site, but [[1, 2], 3, [4]] will have a list of two.
-  DECL_ACCESSORS(nested_site, Tagged<Object>)
+  inline Tagged<UnionOf<Smi, AllocationSite>> nested_site() const;
+  inline void set_nested_site(Tagged<UnionOf<Smi, AllocationSite>> value,
+                              WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
 
   // Bitfield containing pretenuring information.
-  DECL_RELAXED_INT32_ACCESSORS(pretenure_data)
+  inline int32_t pretenure_data(RelaxedLoadTag) const;
+  inline void set_pretenure_data(int32_t value, RelaxedStoreTag);
 
-  DECL_INT32_ACCESSORS(pretenure_create_count)
-  DECL_ACCESSORS(dependent_code, Tagged<DependentCode>)
+  inline int32_t pretenure_create_count() const;
+  inline void set_pretenure_create_count(int32_t value);
 
-  // heap->allocation_site_list() points to the last AllocationSite which form
-  // a linked list through the weak_next property. The GC might remove elements
-  // from the list by updateing weak_next.
-  DECL_ACCESSORS(weak_next, Tagged<Object>)
+  inline Tagged<DependentCode> dependent_code() const;
+  inline void set_dependent_code(Tagged<DependentCode> value,
+                                 WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
 
   inline void Initialize();
 
@@ -130,7 +136,8 @@ class AllocationSite : public Struct {
 
   template <AllocationSiteUpdateMode update_or_check =
                 AllocationSiteUpdateMode::kUpdate>
-  static bool DigestTransitionFeedback(DirectHandle<AllocationSite> site,
+  static bool DigestTransitionFeedback(Isolate* isolate,
+                                       DirectHandle<AllocationSite> site,
                                        ElementsKind to_kind);
 
   DECL_PRINTER(AllocationSite)
@@ -140,49 +147,65 @@ class AllocationSite : public Struct {
   static bool ShouldTrack(ElementsKind from, ElementsKind to);
   static inline bool CanTrack(InstanceType type);
 
-  // Layout description.
-  // AllocationSite has to start with TransitionInfoOrboilerPlateOffset
-  // and end with WeakNext field.
-  #define ALLOCATION_SITE_FIELDS(V)                     \
-    V(kStartOffset, 0)                                  \
-    V(kTransitionInfoOrBoilerplateOffset, kTaggedSize)  \
-    V(kNestedSiteOffset, kTaggedSize)                   \
-    V(kDependentCodeOffset, kTaggedSize)                \
-    V(kCommonPointerFieldEndOffset, 0)                  \
-    V(kPretenureDataOffset, kInt32Size)                 \
-    V(kPretenureCreateCountOffset, kInt32Size)          \
-    /* Size of AllocationSite without WeakNext field */ \
-    V(kSizeWithoutWeakNext, 0)                          \
-    V(kWeakNextOffset, kTaggedSize)                     \
-    /* Size of AllocationSite with WeakNext field */    \
-    V(kSizeWithWeakNext, 0)
-
-  DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize, ALLOCATION_SITE_FIELDS)
-  #undef ALLOCATION_SITE_FIELDS
-
   class BodyDescriptor;
 
  private:
   inline bool PretenuringDecisionMade() const;
 
-  OBJECT_CONSTRUCTORS(AllocationSite, Struct);
-};
+ private:
+  friend class CodeStubAssembler;
+  friend class ArrayBuiltinsAssembler;
+  friend class ObjectBuiltinsAssembler;
+  friend class V8HeapExplorer;
 
-class AllocationMemento
-    : public TorqueGeneratedAllocationMemento<AllocationMemento, Struct> {
+  // Contains either a Smi-encoded bitfield or a boilerplate. If it's a Smi the
+  // AllocationSite is for a constructed Array.
+  TaggedMember<UnionOf<Smi, JSObject>> transition_info_or_boilerplate_;
+  TaggedMember<UnionOf<Smi, AllocationSite>> nested_site_;
+  TaggedMember<DependentCode> dependent_code_;
+  std::atomic<int32_t> pretenure_data_;
+  int32_t pretenure_create_count_;
+} V8_OBJECT_END;
+
+V8_OBJECT class AllocationSiteWithWeakNext : public AllocationSite {
  public:
-  DECL_ACCESSORS(allocation_site, Tagged<Object>)
+  // heap->allocation_site_list() points to the last AllocationSite which form
+  // a linked list through the weak_next property. The GC might remove elements
+  // from the list by updating weak_next.
+  inline Tagged<UnionOf<Undefined, AllocationSiteWithWeakNext>> weak_next()
+      const;
+  inline void set_weak_next(
+      Tagged<UnionOf<Undefined, AllocationSiteWithWeakNext>> value,
+      WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+
+ private:
+  friend class CodeStubAssembler;
+  friend class AllocationSite::BodyDescriptor;
+  template <typename T>
+  friend struct WeakListVisitor;
+  friend class V8HeapExplorer;
+
+  TaggedMember<UnionOf<Undefined, AllocationSiteWithWeakNext>> weak_next_;
+} V8_OBJECT_END;
+
+V8_OBJECT class AllocationMemento : public StructLayout {
+ public:
+  inline void set_allocation_site(Tagged<AllocationSite> value,
+                                  WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
 
   inline bool IsValid() const;
   inline Tagged<AllocationSite> GetAllocationSite() const;
   inline Address GetAllocationSiteUnchecked() const;
 
   DECL_PRINTER(AllocationMemento)
+  DECL_VERIFIER(AllocationMemento)
 
-  using BodyDescriptor = StructBodyDescriptor;
+ private:
+  friend class CodeStubAssembler;
+  friend class TorqueGeneratedAllocationMementoAsserts;
 
-  TQ_OBJECT_CONSTRUCTORS(AllocationMemento)
-};
+  TaggedMember<AllocationSite> allocation_site_;
+} V8_OBJECT_END;
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/objects/allocation-site.tq b/deps/v8/src/objects/allocation-site.tq
index f38270e0531aa5..708de712b25033 100644
--- a/deps/v8/src/objects/allocation-site.tq
+++ b/deps/v8/src/objects/allocation-site.tq
@@ -2,8 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-extern class AllocationSite extends Struct;
+extern class AllocationSite extends HeapObject;
 
+@cppObjectLayoutDefinition
 extern class AllocationMemento extends Struct {
   allocation_site: AllocationSite;
 }
diff --git a/deps/v8/src/objects/api-callbacks-inl.h b/deps/v8/src/objects/api-callbacks-inl.h
index 11f0fcd7de02ec..c1c949b8f76af1 100644
--- a/deps/v8/src/objects/api-callbacks-inl.h
+++ b/deps/v8/src/objects/api-callbacks-inl.h
@@ -110,6 +110,79 @@ void AccessorInfo::clear_padding() {
          FIELD_SIZE(kOptionalPaddingOffset));
 }
 
+// For the purpose of checking whether the respective callback field is
+// initialized we can use any of the named/indexed versions.
+#define INTERCEPTOR_INFO_HAS_GETTER(name) \
+  bool InterceptorInfo::has_##name() const { return has_named_##name(); }
+
+INTERCEPTOR_INFO_HAS_GETTER(getter)
+INTERCEPTOR_INFO_HAS_GETTER(setter)
+INTERCEPTOR_INFO_HAS_GETTER(query)
+INTERCEPTOR_INFO_HAS_GETTER(descriptor)
+INTERCEPTOR_INFO_HAS_GETTER(deleter)
+INTERCEPTOR_INFO_HAS_GETTER(definer)
+INTERCEPTOR_INFO_HAS_GETTER(enumerator)
+
+#undef INTERCEPTOR_INFO_HAS_GETTER
+
+LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST_CHECKED2(
+    InterceptorInfo, named_getter, Address, kGetterOffset,
+    kApiNamedPropertyGetterCallbackTag, is_named(),
+    is_named() && (value != kNullAddress))
+LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST_CHECKED2(
+    InterceptorInfo, named_setter, Address, kSetterOffset,
+    kApiNamedPropertySetterCallbackTag, is_named(),
+    is_named() && (value != kNullAddress))
+LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST_CHECKED2(
+    InterceptorInfo, named_query, Address, kQueryOffset,
+    kApiNamedPropertyQueryCallbackTag, is_named(),
+    is_named() && (value != kNullAddress))
+LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST_CHECKED2(
+    InterceptorInfo, named_descriptor, Address, kDescriptorOffset,
+    kApiNamedPropertyDescriptorCallbackTag, is_named(),
+    is_named() && (value != kNullAddress))
+LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST_CHECKED2(
+    InterceptorInfo, named_deleter, Address, kDeleterOffset,
+    kApiNamedPropertyDeleterCallbackTag, is_named(),
+    is_named() && (value != kNullAddress))
+LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST_CHECKED2(
+    InterceptorInfo, named_enumerator, Address, kEnumeratorOffset,
+    kApiNamedPropertyEnumeratorCallbackTag, is_named(),
+    is_named() && (value != kNullAddress))
+LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST_CHECKED2(
+    InterceptorInfo, named_definer, Address, kDefinerOffset,
+    kApiNamedPropertyDefinerCallbackTag, is_named(),
+    is_named() && (value != kNullAddress))
+
+LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST_CHECKED2(
+    InterceptorInfo, indexed_getter, Address, kGetterOffset,
+    kApiIndexedPropertyGetterCallbackTag, !is_named(),
+    !is_named() && (value != kNullAddress))
+LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST_CHECKED2(
+    InterceptorInfo, indexed_setter, Address, kSetterOffset,
+    kApiIndexedPropertySetterCallbackTag, !is_named(),
+    !is_named() && (value != kNullAddress))
+LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST_CHECKED2(
+    InterceptorInfo, indexed_query, Address, kQueryOffset,
+    kApiIndexedPropertyQueryCallbackTag, !is_named(),
+    !is_named() && (value != kNullAddress))
+LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST_CHECKED2(
+    InterceptorInfo, indexed_descriptor, Address, kDescriptorOffset,
+    kApiIndexedPropertyDescriptorCallbackTag, !is_named(),
+    !is_named() && (value != kNullAddress))
+LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST_CHECKED2(
+    InterceptorInfo, indexed_deleter, Address, kDeleterOffset,
+    kApiIndexedPropertyDeleterCallbackTag, !is_named(),
+    !is_named() && (value != kNullAddress))
+LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST_CHECKED2(
+    InterceptorInfo, indexed_enumerator, Address, kEnumeratorOffset,
+    kApiIndexedPropertyEnumeratorCallbackTag, !is_named(),
+    !is_named() && (value != kNullAddress))
+LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST_CHECKED2(
+    InterceptorInfo, indexed_definer, Address, kDefinerOffset,
+    kApiIndexedPropertyDefinerCallbackTag, !is_named(),
+    !is_named() && (value != kNullAddress))
+
 BOOL_ACCESSORS(InterceptorInfo, flags, can_intercept_symbols,
                CanInterceptSymbolsBit::kShift)
 BOOL_ACCESSORS(InterceptorInfo, flags, non_masking, NonMaskingBit::kShift)
@@ -120,6 +193,12 @@ BOOL_ACCESSORS(InterceptorInfo, flags, has_no_side_effect,
 BOOL_ACCESSORS(InterceptorInfo, flags, has_new_callbacks_signature,
                HasNewCallbacksSignatureBit::kShift)
 
+void InterceptorInfo::clear_padding() {
+  if (FIELD_SIZE(kOptionalPaddingOffset) == 0) return;
+  memset(reinterpret_cast<void*>(address() + kOptionalPaddingOffset), 0,
+         FIELD_SIZE(kOptionalPaddingOffset));
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/api-callbacks.h b/deps/v8/src/objects/api-callbacks.h
index f5d44f393c62fe..3ab0005a6dc5b1 100644
--- a/deps/v8/src/objects/api-callbacks.h
+++ b/deps/v8/src/objects/api-callbacks.h
@@ -102,9 +102,59 @@ class AccessCheckInfo
   TQ_OBJECT_CONSTRUCTORS(AccessCheckInfo)
 };
 
+#define INTERCEPTOR_INFO_CALLBACK_LIST(V) \
+  V(Getter, getter)                       \
+  V(Setter, setter)                       \
+  V(Query, query)                         \
+  V(Descriptor, descriptor)               \
+  V(Deleter, deleter)                     \
+  V(Enumerator, enumerator)               \
+  V(Definer, definer)
+
 class InterceptorInfo
-    : public TorqueGeneratedInterceptorInfo<InterceptorInfo, Struct> {
+    : public TorqueGeneratedInterceptorInfo<InterceptorInfo, HeapObject> {
  public:
+  // Convenient predicates without named/indexed prefix.
+  inline bool has_getter() const;
+  inline bool has_setter() const;
+  inline bool has_query() const;
+  inline bool has_descriptor() const;
+  inline bool has_deleter() const;
+  inline bool has_enumerator() const;
+  inline bool has_definer() const;
+
+  // Accessor callbacks for named interceptors.
+  DECL_LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST(named_getter,
+                                                            Address)
+  DECL_LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST(named_setter,
+                                                            Address)
+  DECL_LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST(named_query,
+                                                            Address)
+  DECL_LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST(named_descriptor,
+                                                            Address)
+  DECL_LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST(named_deleter,
+                                                            Address)
+  DECL_LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST(named_enumerator,
+                                                            Address)
+  DECL_LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST(named_definer,
+                                                            Address)
+
+  // Accessor callbacks for indexed interceptors.
+  DECL_LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST(indexed_getter,
+                                                            Address)
+  DECL_LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST(indexed_setter,
+                                                            Address)
+  DECL_LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST(indexed_query,
+                                                            Address)
+  DECL_LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST(indexed_descriptor,
+                                                            Address)
+  DECL_LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST(indexed_deleter,
+                                                            Address)
+  DECL_LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST(indexed_enumerator,
+                                                            Address)
+  DECL_LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST(indexed_definer,
+                                                            Address)
+
   DECL_BOOLEAN_ACCESSORS(can_intercept_symbols)
   DECL_BOOLEAN_ACCESSORS(non_masking)
   DECL_BOOLEAN_ACCESSORS(is_named)
@@ -115,7 +165,16 @@ class InterceptorInfo
 
   DEFINE_TORQUE_GENERATED_INTERCEPTOR_INFO_FLAGS()
 
-  using BodyDescriptor = StructBodyDescriptor;
+  DECL_PRINTER(InterceptorInfo)
+
+  inline void clear_padding();
+
+  class BodyDescriptor;
+
+ private:
+  friend class Factory;
+
+  inline void AllocateExternalPointerEntries(Isolate* isolate);
 
   TQ_OBJECT_CONSTRUCTORS(InterceptorInfo)
 };
diff --git a/deps/v8/src/objects/api-callbacks.tq b/deps/v8/src/objects/api-callbacks.tq
index 88021bdf50aee7..a2a6deb35f2b0b 100644
--- a/deps/v8/src/objects/api-callbacks.tq
+++ b/deps/v8/src/objects/api-callbacks.tq
@@ -10,16 +10,18 @@ bitfield struct InterceptorInfoFlags extends uint31 {
   has_new_callbacks_signature: bool: 1 bit;
 }
 
-extern class InterceptorInfo extends Struct {
-  getter: NonNullForeign|Zero|Undefined;
-  setter: NonNullForeign|Zero|Undefined;
-  query: NonNullForeign|Zero|Undefined;
-  descriptor: NonNullForeign|Zero|Undefined;
-  deleter: NonNullForeign|Zero|Undefined;
-  enumerator: NonNullForeign|Zero|Undefined;
-  definer: NonNullForeign|Zero|Undefined;
+extern class InterceptorInfo extends HeapObject {
   data: Object;
-  flags: SmiTagged<InterceptorInfoFlags>;
+  flags: InterceptorInfoFlags;
+  @if(TAGGED_SIZE_8_BYTES) optional_padding: uint32;
+  @ifnot(TAGGED_SIZE_8_BYTES) optional_padding: void;
+  getter: ExternalPointer;
+  setter: ExternalPointer;
+  query: ExternalPointer;
+  descriptor: ExternalPointer;
+  deleter: ExternalPointer;
+  enumerator: ExternalPointer;
+  definer: ExternalPointer;
 }
 
 extern class AccessCheckInfo extends Struct {
diff --git a/deps/v8/src/objects/backing-store.cc b/deps/v8/src/objects/backing-store.cc
index e75cddf03aeaf7..e4ec161b1f84f6 100644
--- a/deps/v8/src/objects/backing-store.cc
+++ b/deps/v8/src/objects/backing-store.cc
@@ -325,11 +325,9 @@ std::unique_ptr<BackingStore> BackingStore::TryAllocateAndPartiallyCommitMemory(
 #ifdef V8_COMPRESS_POINTERS_IN_MULTIPLE_CAGES
 #ifdef V8_ENABLE_SANDBOX
   CHECK_WITH_MSG(isolate || Sandbox::current(),
-#else
-  CHECK_WITH_MSG(isolate,
-#endif
                  "One must enter an v8::Isolate before allocating resizable "
                  "array backing stores");
+#endif
 #endif
   PageAllocator* page_allocator =
       isolate ? isolate->isolate_group()->GetBackingStorePageAllocator()
diff --git a/deps/v8/src/objects/call-site-info.cc b/deps/v8/src/objects/call-site-info.cc
index 69889203f16aa9..c56c8968c12346 100644
--- a/deps/v8/src/objects/call-site-info.cc
+++ b/deps/v8/src/objects/call-site-info.cc
@@ -323,7 +323,7 @@ DirectHandle<PrimitiveHeapObject> CallSiteInfo::GetFunctionName(
       return isolate->factory()->NewStringFromAsciiChecked(maybe_known_name);
     }
   }
-  DirectHandle<String> name = JSFunction::GetDebugName(function);
+  DirectHandle<String> name = JSFunction::GetDebugName(isolate, function);
   if (name->length() != 0) return name;
   if (info->IsEval()) return isolate->factory()->eval_string();
   return isolate->factory()->null_value();
@@ -346,7 +346,7 @@ DirectHandle<String> CallSiteInfo::GetFunctionDebugName(
 #endif  // V8_ENABLE_WEBASSEMBLY
   DirectHandle<JSFunction> function(Cast<JSFunction>(info->function()),
                                     isolate);
-  DirectHandle<String> name = JSFunction::GetDebugName(function);
+  DirectHandle<String> name = JSFunction::GetDebugName(isolate, function);
   if (name->length() == 0 && info->IsEval()) {
     name = isolate->factory()->eval_string();
   }
@@ -531,7 +531,8 @@ DirectHandle<Object> CallSiteInfo::GetTypeName(
   }
   if (IsJSFunction(*receiver)) {
     DirectHandle<JSFunction> function = Cast<JSFunction>(receiver);
-    DirectHandle<String> class_name = JSFunction::GetDebugName(function);
+    DirectHandle<String> class_name =
+        JSFunction::GetDebugName(isolate, function);
     if (class_name->length() != 0) {
       return class_name;
     }
diff --git a/deps/v8/src/objects/code-inl.h b/deps/v8/src/objects/code-inl.h
index 96f597d05d9cb0..1ef94157f1c3f2 100644
--- a/deps/v8/src/objects/code-inl.h
+++ b/deps/v8/src/objects/code-inl.h
@@ -100,7 +100,11 @@ inline uint16_t Code::parameter_count_without_receiver() const {
 }
 
 inline Tagged<ProtectedFixedArray> Code::deoptimization_data() const {
-  DCHECK(uses_deoptimization_data());
+  // It's important to CHECK that the Code object uses deoptimization data. We
+  // trust optimized code to have deoptimization data here, but the reference to
+  // this code might be corrupted, such that we get type confusion on this field
+  // in cases where we assume that it must be optimized code.
+  SBXCHECK(uses_deoptimization_data());
   return Cast<ProtectedFixedArray>(
       ReadProtectedPointerField(kDeoptimizationDataOrInterpreterDataOffset));
 }
@@ -129,7 +133,11 @@ inline bool Code::has_deoptimization_data_or_interpreter_data() const {
 }
 
 Tagged<TrustedObject> Code::bytecode_or_interpreter_data() const {
-  DCHECK_EQ(kind(), CodeKind::BASELINE);
+  // It's important to CHECK that the Code object is baseline code. We trust
+  // baseline code to have bytecode/interpreter data here, but the reference to
+  // this code might be corrupted, such that we get type confusion on this field
+  // in cases where we assume that it must be baseline code.
+  SBXCHECK_EQ(kind(), CodeKind::BASELINE);
   return ReadProtectedPointerField(kDeoptimizationDataOrInterpreterDataOffset);
 }
 void Code::set_bytecode_or_interpreter_data(Tagged<TrustedObject> value,
@@ -541,7 +549,7 @@ inline void Code::SetMarkedForDeoptimization(Isolate* isolate,
           case LazyDeoptimizeReason::kEmptyContextExtensionChange:
           case LazyDeoptimizeReason::kFrameValueMaterialized:
           case LazyDeoptimizeReason::kPropertyCellChange:
-          case LazyDeoptimizeReason::kScriptContextSlotPropertyChange:
+          case LazyDeoptimizeReason::kContextCellChange:
           case LazyDeoptimizeReason::kPrototypeChange:
           case LazyDeoptimizeReason::kExceptionCaught:
           case LazyDeoptimizeReason::kFieldTypeConstChange:
@@ -621,39 +629,37 @@ Address Code::code_comments() const {
 }
 
 int Code::code_comments_size() const {
-  return builtin_jump_table_info_offset() - code_comments_offset();
+  return jump_table_info_offset() - code_comments_offset();
 }
 
 bool Code::has_code_comments() const { return code_comments_size() > 0; }
 
-int32_t Code::builtin_jump_table_info_offset() const {
-  if (!V8_BUILTIN_JUMP_TABLE_INFO_BOOL) {
+int32_t Code::jump_table_info_offset() const {
+  if constexpr (!V8_JUMP_TABLE_INFO_BOOL) {
     // Redirection needed since the field doesn't exist in this case.
     return unwinding_info_offset();
   }
-  return ReadField<int32_t>(kBuiltinJumpTableInfoOffsetOffset);
+  return ReadField<int32_t>(kJumpTableInfoOffsetOffset);
 }
 
-void Code::set_builtin_jump_table_info_offset(int32_t value) {
-  if (!V8_BUILTIN_JUMP_TABLE_INFO_BOOL) {
+void Code::set_jump_table_info_offset(int32_t value) {
+  if constexpr (!V8_JUMP_TABLE_INFO_BOOL) {
     // Redirection needed since the field doesn't exist in this case.
     return;
   }
   DCHECK_LE(value, metadata_size());
-  WriteField<int32_t>(kBuiltinJumpTableInfoOffsetOffset, value);
+  WriteField<int32_t>(kJumpTableInfoOffsetOffset, value);
 }
 
-Address Code::builtin_jump_table_info() const {
-  return metadata_start() + builtin_jump_table_info_offset();
+Address Code::jump_table_info() const {
+  return metadata_start() + jump_table_info_offset();
 }
 
-int Code::builtin_jump_table_info_size() const {
-  return unwinding_info_offset() - builtin_jump_table_info_offset();
+int Code::jump_table_info_size() const {
+  return unwinding_info_offset() - jump_table_info_offset();
 }
 
-bool Code::has_builtin_jump_table_info() const {
-  return builtin_jump_table_info_size() > 0;
-}
+bool Code::has_jump_table_info() const { return jump_table_info_size() > 0; }
 
 Address Code::unwinding_info_start() const {
   return metadata_start() + unwinding_info_offset();
diff --git a/deps/v8/src/objects/code.h b/deps/v8/src/objects/code.h
index 04e63c77578ca1..abc711fbd52c1b 100644
--- a/deps/v8/src/objects/code.h
+++ b/deps/v8/src/objects/code.h
@@ -53,7 +53,7 @@ enum class LazyDeoptimizeReason : uint8_t;
 //  |           ...            |  <-- MS + handler_table_offset()
 //  |                          |  <-- MS + constant_pool_offset()
 //  |                          |  <-- MS + code_comments_offset()
-//  |                          |  <-- MS + builtin_jump_table_info_offset()
+//  |                          |  <-- MS + jump_table_info_offset()
 //  |                          |  <-- MS + unwinding_info_offset()
 //  +--------------------------+  <-- MetadataEnd()
 //
@@ -121,8 +121,8 @@ class Code : public ExposedTrustedObject {
   // [handler_table_offset]: The offset where the exception handler table
   // starts.
   DECL_PRIMITIVE_ACCESSORS(handler_table_offset, int)
-  // [builtin_jump_table_info offset]: Offset of the builtin jump table info.
-  DECL_PRIMITIVE_ACCESSORS(builtin_jump_table_info_offset, int32_t)
+  // [jump_table_info offset]: Offset of the jump table info.
+  DECL_PRIMITIVE_ACCESSORS(jump_table_info_offset, int32_t)
   // [unwinding_info_offset]: Offset of the unwinding info section.
   DECL_PRIMITIVE_ACCESSORS(unwinding_info_offset, int32_t)
   // [deoptimization_data]: Array containing data for deopt for non-baseline
@@ -247,9 +247,9 @@ class Code : public ExposedTrustedObject {
   inline int code_comments_size() const;
   inline bool has_code_comments() const;
 
-  inline Address builtin_jump_table_info() const;
-  inline int builtin_jump_table_info_size() const;
-  inline bool has_builtin_jump_table_info() const;
+  inline Address jump_table_info() const;
+  inline int jump_table_info_size() const;
+  inline bool has_jump_table_info() const;
 
   inline Address unwinding_info_start() const;
   inline Address unwinding_info_end() const;
@@ -410,8 +410,7 @@ class Code : public ExposedTrustedObject {
   V(kUnwindingInfoOffsetOffset, kInt32Size)                                    \
   V(kConstantPoolOffsetOffset, V8_EMBEDDED_CONSTANT_POOL_BOOL ? kIntSize : 0)  \
   V(kCodeCommentsOffsetOffset, kIntSize)                                       \
-  V(kBuiltinJumpTableInfoOffsetOffset,                                         \
-    V8_BUILTIN_JUMP_TABLE_INFO_BOOL ? kInt32Size : 0)                          \
+  V(kJumpTableInfoOffsetOffset, V8_JUMP_TABLE_INFO_BOOL ? kInt32Size : 0)      \
   /* This field is currently only used during deoptimization. If this space */ \
   /* is ever needed for other purposes, it would probably be possible to */    \
   /* obtain the parameter count from the BytecodeArray instead. */             \
diff --git a/deps/v8/src/objects/compilation-cache-table.cc b/deps/v8/src/objects/compilation-cache-table.cc
index 7c5ee4091d1a0c..6ed5050a000b35 100644
--- a/deps/v8/src/objects/compilation-cache-table.cc
+++ b/deps/v8/src/objects/compilation-cache-table.cc
@@ -159,11 +159,6 @@ class EvalCacheKey : public HashTableKey {
 
   bool IsMatch(Tagged<Object> other) override {
     DisallowGarbageCollection no_gc;
-    if (!IsFixedArray(other)) {
-      DCHECK(IsNumber(other));
-      uint32_t other_hash = static_cast<uint32_t>(Object::NumberValue(other));
-      return Hash() == other_hash;
-    }
     Tagged<FixedArray> other_array = Cast<FixedArray>(other);
     DCHECK(IsSharedFunctionInfo(other_array->get(0)));
     if (*shared_ != other_array->get(0)) return false;
@@ -563,6 +558,25 @@ DirectHandle<CompilationCacheTable> CompilationCacheTable::PutScript(
   return cache;
 }
 
+void CompilationCacheTable::UpdateEval(
+    DirectHandle<CompilationCacheTable> table, DirectHandle<String> src,
+    DirectHandle<SharedFunctionInfo> outer_info,
+    DirectHandle<NativeContext> native_context,
+    DirectHandle<FeedbackCell> feedback_cell, LanguageMode language_mode,
+    int position) {
+  Isolate* isolate = native_context->GetIsolate();
+  src = String::Flatten(isolate, src);
+
+  EvalCacheKey key(src, outer_info, language_mode, position);
+  InternalIndex entry = table->FindEntry(isolate, &key);
+  if (entry.is_not_found()) return;
+
+  if (!IsFixedArray(table->KeyAt(entry))) return;
+  Tagged<Object> obj = table->PrimaryValueAt(entry);
+  if (!IsSharedFunctionInfo(obj)) return;
+  AddToFeedbackCellsMap(table, entry, native_context, feedback_cell);
+}
+
 DirectHandle<CompilationCacheTable> CompilationCacheTable::PutEval(
     DirectHandle<CompilationCacheTable> cache, DirectHandle<String> src,
     DirectHandle<SharedFunctionInfo> outer_info,
@@ -573,36 +587,17 @@ DirectHandle<CompilationCacheTable> CompilationCacheTable::PutEval(
   src = String::Flatten(isolate, src);
   EvalCacheKey key(src, outer_info, value->language_mode(), position);
 
-  // This block handles 'real' insertions, i.e. the initial dummy insert
-  // (below) has already happened earlier.
-  {
-    DirectHandle<Object> k = key.AsHandle(isolate);
-    InternalIndex entry = cache->FindEntry(isolate, &key);
-    if (entry.is_found()) {
-      cache->SetKeyAt(entry, *k);
-      if (cache->PrimaryValueAt(entry) != *value) {
-        cache->SetPrimaryValueAt(entry, *value);
-        // The SFI is changing because the code was aged. Nuke existing feedback
-        // since it can't be reused after this point.
-        cache->SetEvalFeedbackValueAt(entry,
-                                      ReadOnlyRoots(isolate).the_hole_value());
-      }
-      // AddToFeedbackCellsMap may allocate a new sub-array to live in the
-      // entry, but it won't change the cache array. Therefore EntryToIndex
-      // and entry remains correct.
-      AddToFeedbackCellsMap(cache, entry, native_context, feedback_cell);
-      // Add hash again even on cache hit to avoid unnecessary cache delay in
-      // case of hash collisions.
-    }
-  }
-
   // Create a dummy entry to mark that this key has already been inserted once.
   cache = EnsureCapacity(isolate, cache);
   InternalIndex entry = cache->FindInsertionEntry(isolate, key.Hash());
-  DirectHandle<Object> k =
-      isolate->factory()->NewNumber(static_cast<double>(key.Hash()));
+  DirectHandle<Object> k = key.AsHandle(isolate);
   cache->SetKeyAt(entry, *k);
-  cache->SetPrimaryValueAt(entry, Smi::FromInt(kHashGenerations));
+  cache->SetPrimaryValueAt(entry, *value);
+  cache->SetEvalFeedbackValueAt(entry, ReadOnlyRoots(isolate).the_hole_value());
+  // AddToFeedbackCellsMap may allocate a new sub-array to live in the
+  // entry, but it won't change the cache array. Therefore EntryToIndex
+  // and entry remains correct.
+  AddToFeedbackCellsMap(cache, entry, native_context, feedback_cell);
   cache->ElementAdded();
   return cache;
 }
diff --git a/deps/v8/src/objects/compilation-cache-table.h b/deps/v8/src/objects/compilation-cache-table.h
index dcc5cf3cffad64..fc1fe9c03c74d3 100644
--- a/deps/v8/src/objects/compilation-cache-table.h
+++ b/deps/v8/src/objects/compilation-cache-table.h
@@ -142,6 +142,14 @@ class CompilationCacheTable
                                  DirectHandle<SharedFunctionInfo> shared,
                                  DirectHandle<NativeContext> native_context,
                                  LanguageMode language_mode, int position);
+  // Adds a new native-context-specific feedback back to an existing entry.
+  // Bails out if no existing entry was found.
+  static void UpdateEval(DirectHandle<CompilationCacheTable> table,
+                         DirectHandle<String> src,
+                         DirectHandle<SharedFunctionInfo> outer_info,
+                         DirectHandle<NativeContext> native_context,
+                         DirectHandle<FeedbackCell> feedback_cell,
+                         LanguageMode language_mode, int position);
   static DirectHandle<CompilationCacheTable> PutEval(
       DirectHandle<CompilationCacheTable> cache, DirectHandle<String> src,
       DirectHandle<SharedFunctionInfo> outer_info,
diff --git a/deps/v8/src/objects/compressed-slots-inl.h b/deps/v8/src/objects/compressed-slots-inl.h
index f75ac2bbbe382c..f38668b5cebb9a 100644
--- a/deps/v8/src/objects/compressed-slots-inl.h
+++ b/deps/v8/src/objects/compressed-slots-inl.h
@@ -39,17 +39,17 @@ bool CompressedObjectSlot::Relaxed_ContainsMapValue(Address raw_value) const {
 
 Tagged<Object> CompressedObjectSlot::operator*() const {
   Tagged_t value = *location();
-  return Tagged<Object>(TCompressionScheme::DecompressTagged(address(), value));
+  return Tagged<Object>(TCompressionScheme::DecompressTagged(value));
 }
 
 Tagged<Object> CompressedObjectSlot::load() const {
   AtomicTagged_t value = *location();
-  return Tagged<Object>(TCompressionScheme::DecompressTagged(address(), value));
+  return Tagged<Object>(TCompressionScheme::DecompressTagged(value));
 }
 
 Tagged<Object> CompressedObjectSlot::load(PtrComprCageBase cage_base) const {
   Tagged_t value = *location();
-  return Tagged<Object>(TCompressionScheme::DecompressTagged(cage_base, value));
+  return Tagged<Object>(TCompressionScheme::DecompressTagged(value));
 }
 
 void CompressedObjectSlot::store(Tagged<Object> value) const {
@@ -72,18 +72,18 @@ Tagged<Map> CompressedObjectSlot::load_map() const {
 
 Tagged<Object> CompressedObjectSlot::Acquire_Load() const {
   AtomicTagged_t value = AsAtomicTagged::Acquire_Load(location());
-  return Tagged<Object>(TCompressionScheme::DecompressTagged(address(), value));
+  return Tagged<Object>(TCompressionScheme::DecompressTagged(value));
 }
 
 Tagged<Object> CompressedObjectSlot::Relaxed_Load() const {
   AtomicTagged_t value = AsAtomicTagged::Relaxed_Load(location());
-  return Tagged<Object>(TCompressionScheme::DecompressTagged(address(), value));
+  return Tagged<Object>(TCompressionScheme::DecompressTagged(value));
 }
 
 Tagged<Object> CompressedObjectSlot::Relaxed_Load(
     PtrComprCageBase cage_base) const {
   AtomicTagged_t value = AsAtomicTagged::Relaxed_Load(location());
-  return Tagged<Object>(TCompressionScheme::DecompressTagged(cage_base, value));
+  return Tagged<Object>(TCompressionScheme::DecompressTagged(value));
 }
 
 Tagged_t CompressedObjectSlot::Relaxed_Load_Raw() const {
@@ -93,7 +93,7 @@ Tagged_t CompressedObjectSlot::Relaxed_Load_Raw() const {
 // static
 Tagged<Object> CompressedObjectSlot::RawToTagged(PtrComprCageBase cage_base,
                                                  Tagged_t raw) {
-  return Tagged<Object>(TCompressionScheme::DecompressTagged(cage_base, raw));
+  return Tagged<Object>(TCompressionScheme::DecompressTagged(raw));
 }
 
 void CompressedObjectSlot::Relaxed_Store(Tagged<Object> value) const {
@@ -112,8 +112,7 @@ Tagged<Object> CompressedObjectSlot::Release_CompareAndSwap(
   Tagged_t target_ptr = TCompressionScheme::CompressObject(target.ptr());
   Tagged_t result =
       AsAtomicTagged::Release_CompareAndSwap(location(), old_ptr, target_ptr);
-  return Tagged<Object>(
-      TCompressionScheme::DecompressTagged(address(), result));
+  return Tagged<Object>(TCompressionScheme::DecompressTagged(result));
 }
 
 //
@@ -122,21 +121,18 @@ Tagged<Object> CompressedObjectSlot::Release_CompareAndSwap(
 
 Tagged<MaybeObject> CompressedMaybeObjectSlot::operator*() const {
   Tagged_t value = *location();
-  return Tagged<MaybeObject>(
-      TCompressionScheme::DecompressTagged(address(), value));
+  return Tagged<MaybeObject>(TCompressionScheme::DecompressTagged(value));
 }
 
 Tagged<MaybeObject> CompressedMaybeObjectSlot::load() const {
   Tagged_t value = *location();
-  return Tagged<MaybeObject>(
-      TCompressionScheme::DecompressTagged(address(), value));
+  return Tagged<MaybeObject>(TCompressionScheme::DecompressTagged(value));
 }
 
 Tagged<MaybeObject> CompressedMaybeObjectSlot::load(
     PtrComprCageBase cage_base) const {
   Tagged_t value = *location();
-  return Tagged<MaybeObject>(
-      TCompressionScheme::DecompressTagged(cage_base, value));
+  return Tagged<MaybeObject>(TCompressionScheme::DecompressTagged(value));
 }
 
 void CompressedMaybeObjectSlot::store(Tagged<MaybeObject> value) const {
@@ -145,15 +141,13 @@ void CompressedMaybeObjectSlot::store(Tagged<MaybeObject> value) const {
 
 Tagged<MaybeObject> CompressedMaybeObjectSlot::Relaxed_Load() const {
   AtomicTagged_t value = AsAtomicTagged::Relaxed_Load(location());
-  return Tagged<MaybeObject>(
-      TCompressionScheme::DecompressTagged(address(), value));
+  return Tagged<MaybeObject>(TCompressionScheme::DecompressTagged(value));
 }
 
 Tagged<MaybeObject> CompressedMaybeObjectSlot::Relaxed_Load(
     PtrComprCageBase cage_base) const {
   AtomicTagged_t value = AsAtomicTagged::Relaxed_Load(location());
-  return Tagged<MaybeObject>(
-      TCompressionScheme::DecompressTagged(cage_base, value));
+  return Tagged<MaybeObject>(TCompressionScheme::DecompressTagged(value));
 }
 
 Tagged_t CompressedMaybeObjectSlot::Relaxed_Load_Raw() const {
@@ -163,7 +157,7 @@ Tagged_t CompressedMaybeObjectSlot::Relaxed_Load_Raw() const {
 // static
 Tagged<Object> CompressedMaybeObjectSlot::RawToTagged(
     PtrComprCageBase cage_base, Tagged_t raw) {
-  return Tagged<Object>(TCompressionScheme::DecompressTagged(cage_base, raw));
+  return Tagged<Object>(TCompressionScheme::DecompressTagged(raw));
 }
 
 void CompressedMaybeObjectSlot::Relaxed_Store(Tagged<MaybeObject> value) const {
@@ -184,15 +178,15 @@ void CompressedMaybeObjectSlot::Release_CompareAndSwap(
 
 Tagged<HeapObjectReference> CompressedHeapObjectSlot::operator*() const {
   Tagged_t value = *location();
-  return Cast<HeapObjectReference>(Tagged<MaybeObject>(
-      TCompressionScheme::DecompressTagged(address(), value)));
+  return Cast<HeapObjectReference>(
+      Tagged<MaybeObject>(TCompressionScheme::DecompressTagged(value)));
 }
 
 Tagged<HeapObjectReference> CompressedHeapObjectSlot::load(
     PtrComprCageBase cage_base) const {
   Tagged_t value = *location();
-  return Cast<HeapObjectReference>(Tagged<MaybeObject>(
-      TCompressionScheme::DecompressTagged(cage_base, value)));
+  return Cast<HeapObjectReference>(
+      Tagged<MaybeObject>(TCompressionScheme::DecompressTagged(value)));
 }
 
 void CompressedHeapObjectSlot::store(Tagged<HeapObjectReference> value) const {
@@ -203,7 +197,7 @@ Tagged<HeapObject> CompressedHeapObjectSlot::ToHeapObject() const {
   Tagged_t value = *location();
   DCHECK(HAS_STRONG_HEAP_OBJECT_TAG(value));
   return Cast<HeapObject>(
-      Tagged<Object>(TCompressionScheme::DecompressTagged(address(), value)));
+      Tagged<Object>(TCompressionScheme::DecompressTagged(value)));
 }
 
 void CompressedHeapObjectSlot::StoreHeapObject(Tagged<HeapObject> value) const {
@@ -218,8 +212,7 @@ template <typename CompressionScheme, typename TObject, typename Subclass>
 TObject OffHeapCompressedObjectSlotBase<CompressionScheme, TObject,
                                         Subclass>::load() const {
   Tagged_t value = *TSlotBase::location();
-  return TObject(
-      CompressionScheme::DecompressTagged(TSlotBase::address(), value));
+  return TObject(CompressionScheme::DecompressTagged(value));
 }
 
 template <typename CompressionScheme, typename TObject, typename Subclass>
@@ -227,7 +220,7 @@ TObject
 OffHeapCompressedObjectSlotBase<CompressionScheme, TObject, Subclass>::load(
     PtrComprCageBase cage_base) const {
   Tagged_t value = *TSlotBase::location();
-  return TObject(CompressionScheme::DecompressTagged(cage_base, value));
+  return TObject(CompressionScheme::DecompressTagged(value));
 }
 
 template <typename CompressionScheme, typename TObject, typename Subclass>
@@ -240,15 +233,14 @@ template <typename CompressionScheme, typename TObject, typename Subclass>
 TObject OffHeapCompressedObjectSlotBase<CompressionScheme, TObject,
                                         Subclass>::Relaxed_Load() const {
   AtomicTagged_t value = AsAtomicTagged::Relaxed_Load(TSlotBase::location());
-  return TObject(
-      CompressionScheme::DecompressTagged(TSlotBase::address(), value));
+  return TObject(CompressionScheme::DecompressTagged(value));
 }
 
 template <typename CompressionScheme, typename TObject, typename Subclass>
 TObject OffHeapCompressedObjectSlotBase<CompressionScheme, TObject, Subclass>::
     Relaxed_Load(PtrComprCageBase cage_base) const {
   AtomicTagged_t value = AsAtomicTagged::Relaxed_Load(TSlotBase::location());
-  return TObject(CompressionScheme::DecompressTagged(cage_base, value));
+  return TObject(CompressionScheme::DecompressTagged(value));
 }
 
 template <typename CompressionScheme, typename TObject, typename Subclass>
@@ -263,22 +255,21 @@ template <typename CompressionScheme, typename TObject, typename Subclass>
 Tagged<Object> OffHeapCompressedObjectSlotBase<
     CompressionScheme, TObject,
     Subclass>::RawToTagged(PtrComprCageBase cage_base, Tagged_t raw) {
-  return Tagged<Object>(CompressionScheme::DecompressTagged(cage_base, raw));
+  return Tagged<Object>(CompressionScheme::DecompressTagged(raw));
 }
 
 template <typename CompressionScheme, typename TObject, typename Subclass>
 TObject OffHeapCompressedObjectSlotBase<CompressionScheme, TObject,
                                         Subclass>::Acquire_Load() const {
   AtomicTagged_t value = AsAtomicTagged::Acquire_Load(TSlotBase::location());
-  return TObject(
-      CompressionScheme::DecompressTagged(TSlotBase::address(), value));
+  return TObject(CompressionScheme::DecompressTagged(value));
 }
 
 template <typename CompressionScheme, typename TObject, typename Subclass>
 TObject OffHeapCompressedObjectSlotBase<CompressionScheme, TObject, Subclass>::
     Acquire_Load(PtrComprCageBase cage_base) const {
   AtomicTagged_t value = AsAtomicTagged::Acquire_Load(TSlotBase::location());
-  return TObject(CompressionScheme::DecompressTagged(cage_base, value));
+  return TObject(CompressionScheme::DecompressTagged(value));
 }
 
 template <typename CompressionScheme, typename TObject, typename Subclass>
diff --git a/deps/v8/src/objects/contexts-inl.h b/deps/v8/src/objects/contexts-inl.h
index a3d5bbb22fea2b..c08c830aae96a9 100644
--- a/deps/v8/src/objects/contexts-inl.h
+++ b/deps/v8/src/objects/contexts-inl.h
@@ -61,12 +61,41 @@ NEVER_READ_ONLY_SPACE_IMPL(Context)
 
 RELAXED_SMI_ACCESSORS(Context, length, kLengthOffset)
 
-Tagged<Object> Context::get(int index) const {
+bool Context::IsElementTheHole(int index) {
+  return IsTheHole(get(index, kRelaxedLoad));
+}
+
+template <typename MemoryTag>
+Tagged<Object> Context::GetNoCell(int index, MemoryTag tag) {
+  Tagged<Object> value = get(index, tag);
+  DCHECK(!Is<ContextCell>(value));
+  return value;
+}
+
+Tagged<Object> Context::GetNoCell(int index) {
+  return GetNoCell(index, kRelaxedLoad);
+}
+
+template <typename MemoryTag>
+void Context::SetNoCell(int index, Tagged<Object> value, MemoryTag tag,
+                        WriteBarrierMode mode) {
+  DCHECK(!Is<ContextCell>(get(index, kRelaxedLoad)));
+  set(index, value, mode, tag);
+}
+
+void Context::SetNoCell(int index, Tagged<Object> value,
+                        WriteBarrierMode mode) {
+  SetNoCell(index, value, kRelaxedStore, mode);
+}
+
+template <typename MemoryTag>
+Tagged<Object> Context::get(int index, MemoryTag tag) const {
   PtrComprCageBase cage_base = GetPtrComprCageBase(*this);
-  return get(cage_base, index);
+  return get(cage_base, index, tag);
 }
 
-Tagged<Object> Context::get(PtrComprCageBase cage_base, int index) const {
+Tagged<Object> Context::get(PtrComprCageBase cage_base, int index,
+                            RelaxedLoadTag) const {
   DCHECK_LT(static_cast<unsigned int>(index),
             static_cast<unsigned int>(length(kRelaxedLoad)));
   return TaggedField<Object>::Relaxed_Load(cage_base, *this,
@@ -74,6 +103,11 @@ Tagged<Object> Context::get(PtrComprCageBase cage_base, int index) const {
 }
 
 void Context::set(int index, Tagged<Object> value, WriteBarrierMode mode) {
+  set(index, value, mode, kRelaxedStore);
+}
+
+void Context::set(int index, Tagged<Object> value, WriteBarrierMode mode,
+                  RelaxedStoreTag) {
   DCHECK_LT(static_cast<unsigned int>(index),
             static_cast<unsigned int>(length(kRelaxedLoad)));
   const int offset = OffsetOfElementAt(index);
@@ -81,11 +115,6 @@ void Context::set(int index, Tagged<Object> value, WriteBarrierMode mode) {
   CONDITIONAL_WRITE_BARRIER(*this, offset, value, mode);
 }
 
-Tagged<Object> Context::get(int index, AcquireLoadTag tag) const {
-  PtrComprCageBase cage_base = GetPtrComprCageBase(*this);
-  return get(cage_base, index, tag);
-}
-
 Tagged<Object> Context::get(PtrComprCageBase cage_base, int index,
                             AcquireLoadTag) const {
   DCHECK_LT(static_cast<unsigned int>(index),
@@ -110,11 +139,11 @@ void NativeContext::set(int index, Tagged<Object> value, WriteBarrierMode mode,
 ACCESSORS(Context, scope_info, Tagged<ScopeInfo>, kScopeInfoOffset)
 
 Tagged<Object> Context::unchecked_previous() const {
-  return get(PREVIOUS_INDEX);
+  return get(PREVIOUS_INDEX, kRelaxedLoad);
 }
 
 Tagged<Context> Context::previous() const {
-  Tagged<Object> result = get(PREVIOUS_INDEX);
+  Tagged<Object> result = get(PREVIOUS_INDEX, kRelaxedLoad);
   DCHECK(IsBootstrappingOrValidParentContext(result, *this));
   return UncheckedCast<Context>(result);
 }
@@ -123,7 +152,7 @@ void Context::set_previous(Tagged<Context> context, WriteBarrierMode mode) {
 }
 
 Tagged<Object> Context::next_context_link() const {
-  return get(Context::NEXT_CONTEXT_LINK);
+  return get(Context::NEXT_CONTEXT_LINK, kRelaxedLoad);
 }
 
 bool Context::has_extension() const {
@@ -132,7 +161,7 @@ bool Context::has_extension() const {
 
 Tagged<HeapObject> Context::extension() const {
   DCHECK(scope_info()->HasContextExtensionSlot());
-  return Cast<HeapObject>(get(EXTENSION_INDEX));
+  return Cast<HeapObject>(get(EXTENSION_INDEX, kRelaxedLoad));
 }
 
 Tagged<NativeContext> Context::native_context() const {
@@ -175,6 +204,10 @@ bool Context::IsScriptContext() const {
   return map()->instance_type() == SCRIPT_CONTEXT_TYPE;
 }
 
+inline bool Context::HasContextCells() const {
+  return v8_flags.script_context_cells && IsScriptContext();
+}
+
 bool Context::HasSameSecurityTokenAs(Tagged<Context> that) const {
   return this->native_context()->security_token() ==
          that->native_context()->security_token();
@@ -182,22 +215,22 @@ bool Context::HasSameSecurityTokenAs(Tagged<Context> that) const {
 
 bool Context::IsDetached() const { return global_object()->IsDetached(); }
 
-#define NATIVE_CONTEXT_FIELD_ACCESSORS(index, type, name)         \
-  void Context::set_##name(Tagged<UNPAREN(type)> value) {         \
-    DCHECK(IsNativeContext(*this));                               \
-    set(index, value, UPDATE_WRITE_BARRIER, kReleaseStore);       \
-  }                                                               \
-  bool Context::is_##name(Tagged<UNPAREN(type)> value) const {    \
-    DCHECK(IsNativeContext(*this));                               \
-    return Cast<UNPAREN(type)>(get(index)) == value;              \
-  }                                                               \
-  Tagged<UNPAREN(type)> Context::name() const {                   \
-    DCHECK(IsNativeContext(*this));                               \
-    return Cast<UNPAREN(type)>(get(index));                       \
-  }                                                               \
-  Tagged<UNPAREN(type)> Context::name(AcquireLoadTag tag) const { \
-    DCHECK(IsNativeContext(*this));                               \
-    return Cast<UNPAREN(type)>(get(index, tag));                  \
+#define NATIVE_CONTEXT_FIELD_ACCESSORS(index, type, name)          \
+  void Context::set_##name(Tagged<UNPAREN(type)> value) {          \
+    DCHECK(IsNativeContext(*this));                                \
+    set(index, value, UPDATE_WRITE_BARRIER, kReleaseStore);        \
+  }                                                                \
+  bool Context::is_##name(Tagged<UNPAREN(type)> value) const {     \
+    DCHECK(IsNativeContext(*this));                                \
+    return Cast<UNPAREN(type)>(get(index, kRelaxedLoad)) == value; \
+  }                                                                \
+  Tagged<UNPAREN(type)> Context::name() const {                    \
+    DCHECK(IsNativeContext(*this));                                \
+    return Cast<UNPAREN(type)>(get(index, kRelaxedLoad));          \
+  }                                                                \
+  Tagged<UNPAREN(type)> Context::name(AcquireLoadTag tag) const {  \
+    DCHECK(IsNativeContext(*this));                                \
+    return Cast<UNPAREN(type)>(get(index, tag));                   \
   }
 NATIVE_CONTEXT_FIELDS(NATIVE_CONTEXT_FIELD_ACCESSORS)
 #undef NATIVE_CONTEXT_FIELD_ACCESSORS
@@ -261,7 +294,8 @@ Tagged<Map> Context::GetInitialJSArrayMap(ElementsKind kind) const {
   DCHECK(IsNativeContext(*this));
   if (!IsFastElementsKind(kind)) return Map();
   DisallowGarbageCollection no_gc;
-  Tagged<Object> const initial_js_array_map = get(Context::ArrayMapIndex(kind));
+  Tagged<Object> const initial_js_array_map =
+      get(Context::ArrayMapIndex(kind), kRelaxedLoad);
   DCHECK(!IsUndefined(initial_js_array_map));
   return Cast<Map>(initial_js_array_map);
 }
@@ -286,7 +320,8 @@ Tagged<Map> NativeContext::TypedArrayElementsKindToCtorMap(
     ElementsKind element_kind) const {
   int ctor_index = Context::FIRST_FIXED_TYPED_ARRAY_FUN_INDEX + element_kind -
                    ElementsKind::FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND;
-  Tagged<Map> map = Cast<Map>(Cast<JSFunction>(get(ctor_index))->initial_map());
+  Tagged<Map> map =
+      Cast<Map>(Cast<JSFunction>(get(ctor_index, kRelaxedLoad))->initial_map());
   DCHECK_EQ(map->elements_kind(), element_kind);
   DCHECK(InstanceTypeChecker::IsJSTypedArray(map));
   return map;
@@ -297,7 +332,7 @@ Tagged<Map> NativeContext::TypedArrayElementsKindToRabGsabCtorMap(
   int ctor_index = Context::FIRST_RAB_GSAB_TYPED_ARRAY_MAP_INDEX +
                    element_kind -
                    ElementsKind::FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND;
-  Tagged<Map> map = Cast<Map>(get(ctor_index));
+  Tagged<Map> map = Cast<Map>(get(ctor_index, kRelaxedLoad));
   DCHECK_EQ(map->elements_kind(),
             GetCorrespondingRabGsabElementsKind(element_kind));
   DCHECK(InstanceTypeChecker::IsJSTypedArray(map));
@@ -306,6 +341,84 @@ Tagged<Map> NativeContext::TypedArrayElementsKindToRabGsabCtorMap(
 
 OBJECT_CONSTRUCTORS_IMPL(NativeContext, Context)
 
+inline std::ostream& operator<<(std::ostream& os, ContextCell::State state) {
+  switch (state) {
+    case ContextCell::kConst:
+      os << "const";
+      break;
+    case ContextCell::kSmi:
+      os << "smi";
+      break;
+    case ContextCell::kInt32:
+      os << "int32";
+      break;
+    case ContextCell::kFloat64:
+      os << "float64";
+      break;
+    case ContextCell::kDetached:
+      os << "detached";
+      break;
+  }
+  return os;
+}
+
+ContextCell::State ContextCell::state() const {
+  return state_.load(std::memory_order_acquire);
+}
+
+void ContextCell::set_state(ContextCell::State state) {
+  return state_.store(state, std::memory_order_release);
+}
+
+Tagged<DependentCode> ContextCell::dependent_code() const {
+  return dependent_code_.load();
+}
+
+void ContextCell::set_dependent_code(Tagged<DependentCode> value,
+                                     WriteBarrierMode mode) {
+  dependent_code_.store(this, value, mode);
+}
+
+Tagged<JSAny> ContextCell::tagged_value() const {
+  return tagged_value_.Relaxed_Load();
+}
+
+void ContextCell::set_tagged_value(Tagged<JSAny> value, WriteBarrierMode mode) {
+  tagged_value_.Relaxed_Store(this, value, mode);
+}
+
+void ContextCell::set_smi_value(Tagged<Smi> value) {
+  tagged_value_.Relaxed_Store(this, value);
+}
+
+void ContextCell::clear_tagged_value() {
+  set_tagged_value(Smi::FromInt(0), SKIP_WRITE_BARRIER);
+}
+
+void ContextCell::clear_padding() {
+#if TAGGED_SIZE_8_BYTES
+  optional_padding_ = 0;
+#endif  // TAGGED_SIZE_8_BYTES
+}
+
+double ContextCell::float64_value() const {
+  DCHECK_EQ(state(), kFloat64);
+  return double_value_.value();
+}
+
+void ContextCell::set_float64_value(double value) {
+  double_value_.set_value(value);
+}
+
+int32_t ContextCell::int32_value() const {
+  DCHECK_EQ(state(), kInt32);
+  return *reinterpret_cast<const int32_t*>(&double_value_);
+}
+
+void ContextCell::set_int32_value(int32_t value) {
+  *reinterpret_cast<int32_t*>(&double_value_) = value;
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/contexts.cc b/deps/v8/src/objects/contexts.cc
index 03ec85dbfee193..025060a67ec7a9 100644
--- a/deps/v8/src/objects/contexts.cc
+++ b/deps/v8/src/objects/contexts.cc
@@ -13,6 +13,7 @@
 #include "src/debug/debug.h"
 #include "src/execution/isolate-inl.h"
 #include "src/flags/flags.h"
+#include "src/handles/handles.h"
 #include "src/init/bootstrapper.h"
 #include "src/numbers/conversions-inl.h"
 #include "src/objects/dependent-code.h"
@@ -21,6 +22,7 @@
 #include "src/objects/property-cell.h"
 #include "src/objects/string-set-inl.h"
 #include "src/utils/boxed-float.h"
+#include "v8-internal.h"
 
 namespace v8::internal {
 
@@ -59,8 +61,8 @@ Handle<NameToIndexHashTable> AddLocalNamesFromContext(
   for (auto it : ScopeInfo::IterateLocalNames(scope_info)) {
     DirectHandle<Name> name(it->name(), isolate);
     if (ignore_duplicates) {
-      int32_t hash = NameToIndexShape::Hash(roots, name);
-      if (names_table->FindEntry(isolate, roots, name, hash).is_found()) {
+      int32_t hash = NameToIndexShape::Hash(roots, *name);
+      if (names_table->FindEntry(isolate, roots, *name, hash).is_found()) {
         continue;
       }
     }
@@ -118,13 +120,13 @@ void Context::Initialize(Isolate* isolate) {
 bool ScriptContextTable::Lookup(DirectHandle<String> name,
                                 VariableLookupResult* result) {
   DisallowGarbageCollection no_gc;
-  int index = names_to_context_index()->Lookup(name);
+  int index = names_to_context_index()->Lookup(*name);
   if (index == -1) return false;
   DCHECK_LE(0, index);
   DCHECK_LT(index, length(kAcquireLoad));
   Tagged<Context> context = get(index);
   DCHECK(context->IsScriptContext());
-  int slot_index = context->scope_info()->ContextSlotIndex(name, result);
+  int slot_index = context->scope_info()->ContextSlotIndex(*name, result);
   if (slot_index < 0) return false;
   result->context_index = index;
   result->slot_index = slot_index;
@@ -353,7 +355,7 @@ Handle<Object> Context::Lookup(Handle<Context> context, Handle<String> name,
       // for the context index.
       Tagged<ScopeInfo> scope_info = context->scope_info();
       VariableLookupResult lookup_result;
-      int slot_index = scope_info->ContextSlotIndex(name, &lookup_result);
+      int slot_index = scope_info->ContextSlotIndex(*name, &lookup_result);
       DCHECK(slot_index < 0 || slot_index >= MIN_CONTEXT_SLOTS);
       if (slot_index >= 0) {
         // Re-direct lookup to the ScriptContextTable in case we find a hole in
@@ -362,7 +364,7 @@ Handle<Object> Context::Lookup(Handle<Context> context, Handle<String> name,
         // context of the first script that declared a variable, all other
         // script contexts will contain 'the hole' for that particular name.
         if (scope_info->IsReplModeScope() &&
-            IsTheHole(context->get(slot_index), isolate)) {
+            context->IsElementTheHole(slot_index)) {
           context = Handle<Context>(context->previous(), isolate);
           continue;
         }
@@ -425,7 +427,7 @@ Handle<Object> Context::Lookup(Handle<Context> context, Handle<String> name,
       has_seen_debug_evaluate_context = true;
 
       // Check materialized locals.
-      Tagged<Object> ext = context->get(EXTENSION_INDEX);
+      Tagged<Object> ext = context->get(EXTENSION_INDEX, kRelaxedLoad);
       if (IsJSReceiver(ext)) {
         Handle<JSReceiver> extension(Cast<JSReceiver>(ext), isolate);
         LookupIterator it(isolate, extension, name, extension);
@@ -437,7 +439,7 @@ Handle<Object> Context::Lookup(Handle<Context> context, Handle<String> name,
       }
 
       // Check the original context, but do not follow its context chain.
-      Tagged<Object> obj = context->get(WRAPPED_CONTEXT_INDEX);
+      Tagged<Object> obj = context->get(WRAPPED_CONTEXT_INDEX, kRelaxedLoad);
       if (IsContext(obj)) {
         Handle<Context> wrapped_context(Cast<Context>(obj), isolate);
         Handle<Object> result =
@@ -480,46 +482,6 @@ Handle<Object> Context::Lookup(Handle<Context> context, Handle<String> name,
   return Handle<Object>::null();
 }
 
-Tagged<ContextSidePropertyCell> Context::GetOrCreateContextSidePropertyCell(
-    DirectHandle<Context> script_context, size_t index,
-    ContextSidePropertyCell::Property property, Isolate* isolate) {
-  DCHECK(v8_flags.script_context_mutable_heap_number ||
-         v8_flags.const_tracking_let);
-  DCHECK(script_context->IsScriptContext());
-  DCHECK_NE(property, ContextSidePropertyCell::kOther);
-  int side_data_index =
-      static_cast<int>(index - Context::MIN_CONTEXT_EXTENDED_SLOTS);
-  DirectHandle<FixedArray> side_data(
-      Cast<FixedArray>(script_context->get(CONTEXT_SIDE_TABLE_PROPERTY_INDEX)),
-      isolate);
-  Tagged<Object> object = side_data->get(side_data_index);
-  if (!IsContextSidePropertyCell(object)) {
-    // If these CHECKs fail, there's a code path which initializes or assigns a
-    // top-level `let` variable but doesn't update the side data.
-    object = *isolate->factory()->NewContextSidePropertyCell(property);
-    side_data->set(side_data_index, object);
-  }
-  return Cast<ContextSidePropertyCell>(object);
-}
-
-std::optional<ContextSidePropertyCell::Property>
-Context::GetScriptContextSideProperty(size_t index) const {
-  DCHECK(v8_flags.script_context_mutable_heap_number ||
-         v8_flags.const_tracking_let);
-  DCHECK(IsScriptContext());
-  int side_data_index =
-      static_cast<int>(index - Context::MIN_CONTEXT_EXTENDED_SLOTS);
-  Tagged<FixedArray> side_data =
-      Cast<FixedArray>(get(CONTEXT_SIDE_TABLE_PROPERTY_INDEX));
-  Tagged<Object> object = side_data->get(side_data_index);
-  if (IsUndefined(object)) return {};
-  if (IsContextSidePropertyCell(object)) {
-    return Cast<ContextSidePropertyCell>(object)->context_side_property();
-  }
-  CHECK(IsSmi(object));
-  return ContextSidePropertyCell::FromSmi(object.ToSmi());
-}
-
 namespace {
 std::optional<int32_t> DoubleFitsInInt32(double value) {
   constexpr double int32_min = std::numeric_limits<int32_t>::min();
@@ -533,246 +495,162 @@ std::optional<int32_t> DoubleFitsInInt32(double value) {
   return {};
 }
 
-DirectHandle<Object> TryLoadMutableHeapNumber(
-    DirectHandle<Context> script_context, int index, DirectHandle<Object> value,
-    Isolate* isolate) {
-  DCHECK(v8_flags.script_context_mutable_heap_number);
-  DCHECK(script_context->IsScriptContext());
-  if (!IsHeapNumber(*value)) return value;
-  const int side_data_index = index - Context::MIN_CONTEXT_EXTENDED_SLOTS;
-  Tagged<FixedArray> side_data_table = Cast<FixedArray>(
-      script_context->get(Context::CONTEXT_SIDE_TABLE_PROPERTY_INDEX));
-  if (side_data_table == ReadOnlyRoots(isolate).empty_fixed_array()) {
-    // No side data (maybe the context was created while the side data
-    // collection was disabled).
-    return value;
-  }
+V8_INLINE bool IsEmptyDependentCode(Tagged<DependentCode> value,
+                                    Isolate* isolate) {
+  return value == DependentCode::empty_dependent_code(ReadOnlyRoots(isolate));
+}
 
-  Tagged<Object> data = side_data_table->get(side_data_index);
-  ContextSidePropertyCell::Property property;
-  if (IsSmi(data)) {
-    property =
-        static_cast<ContextSidePropertyCell::Property>(data.ToSmi().value());
-  } else if (Is<ContextSidePropertyCell>(data)) {
-    property = Cast<ContextSidePropertyCell>(data)->context_side_property();
-  } else {
-    // We should not reach this point. The debugger has updated the value
-    // without updating the side data table. Fall back to other. There is also
-    // no dependent code to this cell, since this is not a
-    // ContextSidePropertyCell.
-    property = ContextSidePropertyCell::kOther;
-    side_data_table->set(side_data_index, Smi::FromInt(property));
+V8_INLINE void NotifyContextCellStateWillChange(DirectHandle<ContextCell> cell,
+                                                Isolate* isolate) {
+  if (!IsEmptyDependentCode(cell->dependent_code(), isolate)) {
+    DependentCode::DeoptimizeDependencyGroups(
+        isolate, *cell, DependentCode::kContextCellChangedGroup);
   }
-  if (property == ContextSidePropertyCell::kMutableInt32) {
-    int32_t int32_value =
-        static_cast<int32_t>(Cast<HeapNumber>(*value)->value_as_bits());
-    return isolate->factory()->NewHeapNumber(static_cast<double>(int32_value));
-  } else if (property == ContextSidePropertyCell::kMutableHeapNumber) {
-    return isolate->factory()->NewHeapNumber(Cast<HeapNumber>(*value)->value());
+}
+
+V8_INLINE void TransitionContextCellToUntagged(Tagged<HeapNumber> number,
+                                               DirectHandle<ContextCell> cell) {
+  double double_value = number->value();
+  if (auto int32_value = DoubleFitsInInt32(double_value)) {
+    cell->set_int32_value(*int32_value);
+    cell->set_state(ContextCell::kInt32);
   } else {
-    return value;
+    cell->set_float64_value(double_value);
+    cell->set_state(ContextCell::kFloat64);
   }
 }
+
 }  // namespace
 
-DirectHandle<Object> Context::LoadScriptContextElement(
-    DirectHandle<Context> script_context, int index, DirectHandle<Object> value,
-    Isolate* isolate) {
-  DCHECK(v8_flags.script_context_mutable_heap_number);
-  DCHECK(script_context->IsScriptContext());
-  return TryLoadMutableHeapNumber(script_context, index, value, isolate);
+// static
+DirectHandle<Object> Context::Get(DirectHandle<Context> context, int index,
+                                  Isolate* isolate) {
+  DirectHandle<Object> value =
+      handle(context->get(index, kRelaxedLoad), isolate);
+  if (!Is<ContextCell>(value)) {
+    return value;
+  }
+  DCHECK(context->HasContextCells());
+  DirectHandle<ContextCell> cell = Cast<ContextCell>(value);
+  switch (cell->state()) {
+    case ContextCell::kConst:
+    case ContextCell::kSmi:
+      return handle(cell->tagged_value(), isolate);
+    case ContextCell::kInt32:
+      return isolate->factory()->NewHeapNumber(
+          static_cast<double>(cell->int32_value()));
+    case ContextCell::kFloat64:
+      return isolate->factory()->NewHeapNumber(cell->float64_value());
+    case ContextCell::kDetached:
+      UNREACHABLE();
+  }
+  UNREACHABLE();
 }
 
-void Context::StoreScriptContextAndUpdateSlotProperty(
-    DirectHandle<Context> script_context, int index,
-    DirectHandle<Object> new_value, Isolate* isolate) {
-  DCHECK(v8_flags.script_context_mutable_heap_number ||
-         v8_flags.const_tracking_let);
-  DCHECK(script_context->IsScriptContext());
-
-  const int side_data_index = index - Context::MIN_CONTEXT_EXTENDED_SLOTS;
-  DirectHandle<FixedArray> side_data(
-      Cast<FixedArray>(
-          script_context->get(Context::CONTEXT_SIDE_TABLE_PROPERTY_INDEX)),
-      isolate);
-  if (*side_data == ReadOnlyRoots(isolate).empty_fixed_array()) {
-    // No side data (maybe the context was created while the side data
-    // collection was disabled).
-    script_context->set(index, *new_value);
+// static
+void Context::Set(DirectHandle<Context> context, int index,
+                  DirectHandle<Object> new_value, Isolate* isolate) {
+  DirectHandle<Object> old_value(context->get(index, kRelaxedLoad), isolate);
+  if (!context->HasContextCells()) {
+    context->set(index, *new_value);
     return;
   }
 
-  DirectHandle<Object> old_value(script_context->get(index), isolate);
-  if (IsTheHole(*old_value)) {
-    // Setting the initial value. Here we cannot assert the corresponding side
-    // data is `undefined` - that won't hold w/ variable redefinitions in REPL.
-    script_context->set(index, *new_value);
-    side_data->set(side_data_index, ContextSidePropertyCell::Const());
+  if (IsTheHole(*old_value, isolate)) {
+    // Setting the initial value.
+    DirectHandle<ContextCell> cell =
+        isolate->factory()->NewContextCell(Cast<JSAny>(new_value));
+    context->set(index, *cell);
     return;
   }
 
-  // If we are assigning the same value, the property won't change.
-  if (*old_value == *new_value) {
+  if (!Is<ContextCell>(old_value)) {
+    context->set(index, *new_value);
     return;
   }
-  // If both values are HeapNumbers with the same double value, the property
-  // won't change either.
-  if (Is<HeapNumber>(*old_value) && Is<HeapNumber>(*new_value)) {
-    double old_number = Cast<HeapNumber>(*old_value)->value();
-    double new_number = Cast<HeapNumber>(*new_value)->value();
-    if (old_number == new_number && old_number != 0) {
-      return;
-    }
-  }
-
-  // From now on, we know the value is no longer a constant.
-
-  Tagged<Object> data = side_data->get(side_data_index);
-  std::optional<Tagged<ContextSidePropertyCell>> maybe_cell;
-  ContextSidePropertyCell::Property property;
 
-  if (IsSmi(data)) {
-    property = ContextSidePropertyCell::FromSmi(data.ToSmi());
-  } else {
-    CHECK(Is<ContextSidePropertyCell>(data));
-    maybe_cell = Cast<ContextSidePropertyCell>(data);
-    property = maybe_cell.value()->context_side_property();
-  }
-
-  switch (property) {
-    case ContextSidePropertyCell::kConst:
-      if (maybe_cell) {
-        DependentCode::DeoptimizeDependencyGroups(
-            isolate, maybe_cell.value(),
-            DependentCode::kScriptContextSlotPropertyChangedGroup);
+  DirectHandle<ContextCell> cell = Cast<ContextCell>(old_value);
+  switch (cell->state()) {
+    case ContextCell::kConst:
+      // If we are assigning the same value, the property won't change.
+      if (cell->tagged_value() == *new_value) {
+        return;
       }
-      if (v8_flags.script_context_mutable_heap_number) {
-        // It can transition to Smi, MutableInt32, MutableHeapNumber or Other.
-        if (IsHeapNumber(*new_value)) {
-          double double_value = Cast<HeapNumber>(*new_value)->value();
-          auto maybe_int32_value = DoubleFitsInInt32(double_value);
-          if (v8_flags.script_context_mutable_heap_int32 && maybe_int32_value) {
-            auto new_number =
-                isolate->factory()->NewHeapInt32(*maybe_int32_value);
-            script_context->set(index, *new_number);
-            side_data->set(side_data_index,
-                           ContextSidePropertyCell::MutableInt32());
-          } else {
-            auto new_number = isolate->factory()->NewHeapNumber(double_value);
-            script_context->set(index, *new_number);
-            side_data->set(side_data_index,
-                           ContextSidePropertyCell::MutableHeapNumber());
-          }
-        } else {
-          script_context->set(index, *new_value);
-          side_data->set(side_data_index,
-                         IsSmi(*new_value)
-                             ? ContextSidePropertyCell::SmiMarker()
-                             : ContextSidePropertyCell::Other());
+      // If both values are HeapNumbers with the same double value, the property
+      // won't change either.
+      if (Is<HeapNumber>(cell->tagged_value()) && Is<HeapNumber>(*new_value)) {
+        double old_number = Cast<HeapNumber>(cell->tagged_value())->value();
+        double new_number = Cast<HeapNumber>(*new_value)->value();
+        if (old_number == new_number && old_number != 0) {
+          return;
         }
+      }
+      NotifyContextCellStateWillChange(cell, isolate);
+      if (Is<Smi>(*new_value)) {
+        cell->set_smi_value(Cast<Smi>(*new_value));
+        cell->set_state(ContextCell::kSmi);
+      } else if (IsHeapNumber(*new_value)) {
+        TransitionContextCellToUntagged(Cast<HeapNumber>(*new_value), cell);
+        cell->clear_tagged_value();
       } else {
-        // MutableHeapNumber is not supported, just transition the property to
-        // kOther.
-        script_context->set(index, *new_value);
-        side_data->set(side_data_index, ContextSidePropertyCell::Other());
+        context->set(index, *new_value);
+        cell->clear_tagged_value();
+        cell->set_state(ContextCell::kDetached);
       }
-
-      break;
-    case ContextSidePropertyCell::kSmi:
+      return;
+    case ContextCell::kSmi:
       if (IsSmi(*new_value)) {
-        script_context->set(index, *new_value);
+        cell->set_smi_value(Cast<Smi>(*new_value));
+        cell->set_state(ContextCell::kSmi);
       } else {
-        if (maybe_cell) {
-          DependentCode::DeoptimizeDependencyGroups(
-              isolate, maybe_cell.value(),
-              DependentCode::kScriptContextSlotPropertyChangedGroup);
-        }
-        // It can transition to MutableInt32, MutableHeapNumber or Other.
+        NotifyContextCellStateWillChange(cell, isolate);
         if (IsHeapNumber(*new_value)) {
-          double double_value = Cast<HeapNumber>(*new_value)->value();
-          auto maybe_int32_value = DoubleFitsInInt32(double_value);
-          if (v8_flags.script_context_mutable_heap_int32 && maybe_int32_value) {
-            auto new_number =
-                isolate->factory()->NewHeapInt32(*maybe_int32_value);
-            script_context->set(index, *new_number);
-            side_data->set(side_data_index,
-                           ContextSidePropertyCell::MutableInt32());
-          } else {
-            auto new_number = isolate->factory()->NewHeapNumber(double_value);
-            script_context->set(index, *new_number);
-            side_data->set(side_data_index,
-                           ContextSidePropertyCell::MutableHeapNumber());
-          }
+          TransitionContextCellToUntagged(Cast<HeapNumber>(*new_value), cell);
         } else {
-          script_context->set(index, *new_value);
-          side_data->set(side_data_index, ContextSidePropertyCell::Other());
+          context->set(index, *new_value);
+          cell->set_state(ContextCell::kDetached);
         }
+        cell->clear_tagged_value();
       }
-      break;
-    case ContextSidePropertyCell::kMutableInt32: {
-      CHECK(IsHeapNumber(*old_value));
-      DirectHandle<HeapNumber> old_number = Cast<HeapNumber>(old_value);
+      return;
+    case ContextCell::kInt32:
       if (IsSmi(*new_value)) {
-        old_number->set_value_as_bits(
-            (static_cast<uint64_t>(kHoleNanUpper32) << 32) |
-            Cast<Smi>(*new_value).value());
+        cell->set_int32_value(Cast<Smi>(*new_value).value());
+        cell->set_state(ContextCell::kInt32);
       } else if (IsHeapNumber(*new_value)) {
         double double_value = Cast<HeapNumber>(*new_value)->value();
-        auto maybe_int32_value = DoubleFitsInInt32(double_value);
-        if (v8_flags.script_context_mutable_heap_int32 && maybe_int32_value) {
-          old_number->set_value_as_bits(
-              (static_cast<uint64_t>(kHoleNanUpper32) << 32) |
-              *maybe_int32_value);
+        if (auto int32_value = DoubleFitsInInt32(double_value)) {
+          cell->set_int32_value(*int32_value);
+          cell->set_state(ContextCell::kInt32);
         } else {
-          if (maybe_cell) {
-            DependentCode::DeoptimizeDependencyGroups(
-                isolate, maybe_cell.value(),
-                DependentCode::kScriptContextSlotPropertyChangedGroup);
-          }
-          old_number->set_value(double_value);
-          side_data->set(side_data_index,
-                         ContextSidePropertyCell::MutableHeapNumber());
+          NotifyContextCellStateWillChange(cell, isolate);
+          cell->set_float64_value(double_value);
+          cell->set_state(ContextCell::kFloat64);
         }
       } else {
-        if (maybe_cell) {
-          DependentCode::DeoptimizeDependencyGroups(
-              isolate, maybe_cell.value(),
-              DependentCode::kScriptContextSlotPropertyChangedGroup);
-        }
-        // It can only transition to Other.
-        script_context->set(index, *new_value);
-        side_data->set(side_data_index, ContextSidePropertyCell::Other());
+        NotifyContextCellStateWillChange(cell, isolate);
+        context->set(index, *new_value);
+        cell->set_state(ContextCell::kDetached);
       }
-      break;
-    }
-    case ContextSidePropertyCell::kMutableHeapNumber:
-      CHECK(IsHeapNumber(*old_value));
+      return;
+    case ContextCell::kFloat64:
       if (IsSmi(*new_value)) {
-        Cast<HeapNumber>(old_value)->set_value(
+        cell->set_float64_value(
             static_cast<double>(Cast<Smi>(*new_value).value()));
+        cell->set_state(ContextCell::kFloat64);
       } else if (IsHeapNumber(*new_value)) {
-        Cast<HeapNumber>(old_value)->set_value(
-            Cast<HeapNumber>(*new_value)->value());
+        cell->set_float64_value(Cast<HeapNumber>(*new_value)->value());
+        cell->set_state(ContextCell::kFloat64);
       } else {
-        if (maybe_cell) {
-          DependentCode::DeoptimizeDependencyGroups(
-              isolate, maybe_cell.value(),
-              DependentCode::kScriptContextSlotPropertyChangedGroup);
-        }
-        // It can only transition to Other.
-        script_context->set(index, *new_value);
-        side_data->set(side_data_index, ContextSidePropertyCell::Other());
+        NotifyContextCellStateWillChange(cell, isolate);
+        context->set(index, *new_value);
+        cell->set_state(ContextCell::kDetached);
       }
-      break;
-    case ContextSidePropertyCell::kOther:
-      // We should not have a code depending on Other.
-      DCHECK(!maybe_cell.has_value());
-      // No need to update side data, this is a sink state...
-      script_context->set(index, *new_value);
-      break;
-    default:
+      return;
+    case ContextCell::kDetached:
       UNREACHABLE();
   }
+  UNREACHABLE();
 }
 
 bool NativeContext::HasTemplateLiteralObject(Tagged<JSArray> array) {
@@ -904,7 +782,7 @@ void NativeContext::RunPromiseHook(PromiseHookType type,
       UNREACHABLE();
   }
 
-  DirectHandle<Object> hook(isolate->native_context()->get(contextSlot),
+  DirectHandle<Object> hook(isolate->native_context()->GetNoCell(contextSlot),
                             isolate);
   if (IsUndefined(*hook)) return;
 
diff --git a/deps/v8/src/objects/contexts.h b/deps/v8/src/objects/contexts.h
index 1f923c22078358..3138e2dfe4580d 100644
--- a/deps/v8/src/objects/contexts.h
+++ b/deps/v8/src/objects/contexts.h
@@ -6,7 +6,10 @@
 #define V8_OBJECTS_CONTEXTS_H_
 
 #include "include/v8-promise.h"
+#include "src/common/globals.h"
+#include "src/execution/frames.h"
 #include "src/handles/handles.h"
+#include "src/objects/dependent-code.h"
 #include "src/objects/fixed-array.h"
 #include "src/objects/function-kind.h"
 #include "src/objects/ordered-hash-table.h"
@@ -18,13 +21,21 @@
 namespace v8 {
 namespace internal {
 
-class ContextSidePropertyCell;
+namespace maglev {
+class MaglevGraphBuilder;
+class MaglevAssembler;
+}  // namespace maglev
 class JSGlobalObject;
 class JSGlobalProxy;
 class MicrotaskQueue;
 class NativeContext;
 class RegExpMatchInfo;
 struct VariableLookupResult;
+namespace compiler {
+class ContextRef;
+}
+class V8HeapExplorer;
+class JavaScriptFrame;
 
 enum ContextLookupFlags {
   FOLLOW_CONTEXT_CHAIN = 1 << 0,
@@ -315,6 +326,7 @@ enum ContextLookupFlags {
   V(SLOW_TEMPLATE_INSTANTIATIONS_CACHE_INDEX, EphemeronHashTable,              \
     slow_template_instantiations_cache)                                        \
   V(ATOMICS_WAITASYNC_PROMISES, OrderedHashSet, atomics_waitasync_promises)    \
+  V(SET_UINT8_ARRAY_RESULT_MAP, Map, set_unit8_array_result_map)               \
   V(WASM_DEBUG_MAPS, FixedArray, wasm_debug_maps)                              \
   /* Fast Path Protectors */                                                   \
   V(REGEXP_SPECIES_PROTECTOR_INDEX, PropertyCell, regexp_species_protector)    \
@@ -364,6 +376,8 @@ enum ContextLookupFlags {
   V(WASM_SUSPENDING_PROTOTYPE, JSObject, wasm_suspending_prototype)            \
   V(WASM_MEMORY_MAP_DESCRIPTOR_CONSTRUCTOR_INDEX, JSFunction,                  \
     wasm_memory_map_descriptor_constructor)                                    \
+  V(WASM_DESCRIPTOR_OPTIONS_CONSTRUCTOR_INDEX, JSFunction,                     \
+    wasm_descriptor_options_constructor)                                       \
   V(TEMPLATE_WEAKMAP_INDEX, HeapObject, template_weakmap)                      \
   V(TYPED_ARRAY_FUN_INDEX, JSFunction, typed_array_function)                   \
   V(TYPED_ARRAY_PROTOTYPE_INDEX, JSObject, typed_array_prototype)              \
@@ -474,19 +488,23 @@ class Context : public TorqueGeneratedContext<Context, HeapObject> {
   using TorqueGeneratedContext::set_length;  // Non-atomic.
   DECL_RELAXED_INT_ACCESSORS(length)
 
-  // Setter and getter for elements.
-  // Note the plain accessors use relaxed semantics.
-  // TODO(jgruber): Make that explicit through tags.
-  V8_INLINE Tagged<Object> get(int index) const;
-  V8_INLINE Tagged<Object> get(PtrComprCageBase cage_base, int index) const;
-  V8_INLINE void set(int index, Tagged<Object> value,
-                     WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
-  // Accessors with acquire-release semantics.
-  V8_INLINE Tagged<Object> get(int index, AcquireLoadTag) const;
-  V8_INLINE Tagged<Object> get(PtrComprCageBase cage_base, int index,
-                               AcquireLoadTag) const;
-  V8_INLINE void set(int index, Tagged<Object> value, WriteBarrierMode mode,
-                     ReleaseStoreTag);
+  V8_INLINE bool IsElementTheHole(int index);
+
+  template <typename MemoryTag>
+  V8_INLINE Tagged<Object> GetNoCell(int index, MemoryTag tag);
+  template <typename MemoryTag>
+  V8_INLINE void SetNoCell(int index, Tagged<Object> value, MemoryTag tag,
+                           WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+
+  V8_INLINE Tagged<Object> GetNoCell(int index);
+  V8_INLINE void SetNoCell(int index, Tagged<Object> value,
+                           WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+
+  V8_EXPORT_PRIVATE static DirectHandle<Object> Get(
+      DirectHandle<Context> context, int index, Isolate* isolate);
+  V8_EXPORT_PRIVATE static void Set(DirectHandle<Context> context, int index,
+                                    DirectHandle<Object> new_value,
+                                    Isolate* isolate);
 
   static const int kScopeInfoOffset = kElementsOffset;
   static const int kPreviousOffset = kScopeInfoOffset + kTaggedSize;
@@ -556,9 +574,6 @@ class Context : public TorqueGeneratedContext<Context, HeapObject> {
 
     // These slots hold values in debug evaluate contexts.
     WRAPPED_CONTEXT_INDEX = MIN_CONTEXT_EXTENDED_SLOTS,
-
-    // This slot holds the const tracking let side data.
-    CONTEXT_SIDE_TABLE_PROPERTY_INDEX = MIN_CONTEXT_SLOTS,
   };
 
   static const int kExtensionSize =
@@ -628,6 +643,7 @@ class Context : public TorqueGeneratedContext<Context, HeapObject> {
   inline bool IsModuleContext() const;
   inline bool IsEvalContext() const;
   inline bool IsScriptContext() const;
+  inline bool HasContextCells() const;
 
   inline bool HasSameSecurityTokenAs(Tagged<Context> that) const;
 
@@ -680,21 +696,6 @@ class Context : public TorqueGeneratedContext<Context, HeapObject> {
 
   inline Tagged<Map> GetInitialJSArrayMap(ElementsKind kind) const;
 
-  static Tagged<ContextSidePropertyCell> GetOrCreateContextSidePropertyCell(
-      DirectHandle<Context> context, size_t index,
-      ContextSidePropertyCell::Property property, Isolate* isolate);
-
-  std::optional<ContextSidePropertyCell::Property> GetScriptContextSideProperty(
-      size_t index) const;
-
-  static DirectHandle<Object> LoadScriptContextElement(
-      DirectHandle<Context> script_context, int index,
-      DirectHandle<Object> new_value, Isolate* isolate);
-
-  static void StoreScriptContextAndUpdateSlotProperty(
-      DirectHandle<Context> script_context, int index,
-      DirectHandle<Object> new_value, Isolate* isolate);
-
   static const int kNotFound = -1;
 
   // Dispatched behavior.
@@ -707,6 +708,29 @@ class Context : public TorqueGeneratedContext<Context, HeapObject> {
   V8_EXPORT_PRIVATE void VerifyExtensionSlot(Tagged<HeapObject> extension);
 #endif
 
+ protected:
+  // Setter and getter for elements.
+  template <typename MemoryTag>
+  Tagged<Object> get(int index, MemoryTag tag) const;
+
+  // Accessors use relaxed semantics.
+  V8_INLINE Tagged<Object> get(PtrComprCageBase cage_base, int index,
+                               RelaxedLoadTag) const;
+  V8_INLINE void set(int index, Tagged<Object> value,
+                     WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+  V8_INLINE void set(int index, Tagged<Object> value, WriteBarrierMode mode,
+                     RelaxedStoreTag);
+  // Accessors with acquire-release semantics.
+  V8_INLINE Tagged<Object> get(PtrComprCageBase cage_base, int index,
+                               AcquireLoadTag) const;
+  V8_INLINE void set(int index, Tagged<Object> value, WriteBarrierMode mode,
+                     ReleaseStoreTag);
+
+  // These classes can load an element with a context cell.
+  friend class compiler::ContextRef;
+  friend class JavaScriptFrame;
+  friend class V8HeapExplorer;
+
  private:
 #ifdef DEBUG
   // Bootstrapping-aware type checks.
@@ -860,6 +884,65 @@ class ScriptContextTable
 
 using ContextField = Context::Field;
 
+V8_OBJECT class ContextCell : public HeapObjectLayout {
+ public:
+  enum State : int32_t {
+    kConst = 0,
+    kSmi = 1,
+    kInt32 = 2,
+    kFloat64 = 3,
+    kDetached = 4,  // The context cell is not attached to a context anymore.
+  };
+
+  DECL_VERIFIER(ContextCell)
+  DECL_PRINTER(ContextCell)
+
+  inline State state() const;
+  inline void set_state(State state);
+
+  inline Tagged<DependentCode> dependent_code() const;
+  inline void set_dependent_code(Tagged<DependentCode> value,
+                                 WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+
+  inline Tagged<JSAny> tagged_value() const;
+  inline void set_tagged_value(Tagged<JSAny> value,
+                               WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+  inline void clear_tagged_value();
+
+  inline void set_smi_value(Tagged<Smi> value);
+
+  inline int32_t int32_value() const;
+  inline void set_int32_value(int32_t value);
+
+  inline double float64_value() const;
+  inline void set_float64_value(double value);
+
+  inline void clear_padding();
+
+ private:
+  friend class CodeStubAssembler;
+  friend struct ObjectTraits<ContextCell>;
+  friend class TorqueGeneratedContextCellAsserts;
+  friend class maglev::MaglevGraphBuilder;
+  friend class maglev::MaglevAssembler;
+  friend class compiler::AccessBuilder;
+
+  TaggedMember<JSAny> tagged_value_;
+  TaggedMember<DependentCode> dependent_code_;
+  std::atomic<State> state_;
+#if TAGGED_SIZE_8_BYTES
+  uint32_t optional_padding_;
+#endif  // TAGGED_SIZE_8_BYTES
+  UnalignedDoubleMember double_value_;
+} V8_OBJECT_END;
+
+template <>
+struct ObjectTraits<ContextCell> {
+  using BodyDescriptor =
+      FixedBodyDescriptor<offsetof(ContextCell, tagged_value_),
+                          offsetof(ContextCell, state_), sizeof(ContextCell)>;
+};
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/contexts.tq b/deps/v8/src/objects/contexts.tq
index 80df303192e5d1..41b8c92b2fda4f 100644
--- a/deps/v8/src/objects/contexts.tq
+++ b/deps/v8/src/objects/contexts.tq
@@ -22,6 +22,29 @@ extern class ScriptContextTable extends HeapObject {
   objects[capacity]: Context;
 }
 
+@cppObjectLayoutDefinition
+extern class ContextCell extends HeapObject {
+  // TODO(victorgomes): Change the type of tagged_value to JSAny.
+  tagged_value: Object;
+  dependent_code: DependentCode;
+  state: int32;
+  @if(TAGGED_SIZE_8_BYTES) optional_padding: uint32;
+  double_value: float64;
+}
+
+extern operator '.int32_value' macro LoadContextCellInt32Value(ContextCell):
+    int32;
+extern operator '.int32_value=' macro StoreContextCellInt32Value(
+    ContextCell, int32): void;
+
+const kContextCellConst: constexpr int32 generates 'ContextCell::kConst';
+const kContextCellSmi: constexpr int32 generates 'ContextCell::kSmi';
+const kContextCellInt32: constexpr int32 generates 'ContextCell::kInt32';
+const kContextCellFloat64:
+    constexpr int32 generates 'ContextCell::kFloat64';
+const kContextCellDetached:
+    constexpr int32 generates 'ContextCell::kDetached';
+
 extern class AwaitContext extends Context generates 'TNode<Context>';
 extern class BlockContext extends Context generates 'TNode<Context>';
 extern class CatchContext extends Context generates 'TNode<Context>';
@@ -34,11 +57,9 @@ extern class WithContext extends Context generates 'TNode<Context>';
 
 extern class FunctionContext extends Context generates 'TNode<Context>';
 
+extern macro IsEmptyDependentCode(Object): bool;
 extern macro TryFloat64ToInt32(float64): int32 labels Failed;
-extern macro LoadHeapInt32Value(HeapNumber): int32;
-extern macro StoreHeapInt32Value(HeapNumber, int32): void;
-extern macro AllocateHeapInt32WithValue(int32): HeapNumber;
-
+extern macro IsScriptContextCellsFlag(): bool;
 const kInitialContextSlotValue: Smi = 0;
 
 @export
@@ -63,6 +84,10 @@ macro AllocateSyntheticFunctionContext(
   return result;
 }
 
+macro HasContextCells(c: Context): bool {
+  return IsScriptContextCellsFlag() && Is<ScriptContext>(c);
+}
+
 extern class NativeContext extends Context;
 
 type Slot<Container : type extends Context, T : type extends Object> extends
@@ -190,86 +215,91 @@ extern enum ContextSlot extends intptr constexpr 'Context::Field' {
 
   WRAPPED_FUNCTION_MAP_INDEX: Slot<NativeContext, Map>,
 
-  @sameEnumValueAs(MIN_CONTEXT_SLOTS)
-  CONTEXT_SIDE_TABLE_PROPERTY_INDEX: Slot<Context, HeapObject>,
-
   MIN_CONTEXT_SLOTS,
-  MIN_CONTEXT_EXTENDED_SLOTS,
   ...
 }
 
 @export
-macro LoadContextElement(c: Context, i: intptr): Object {
-  return c.elements[i];
+macro LoadContextElementNoCell(c: Context, i: intptr): Object {
+  return LoadContextElementNoCellImpl(c, i);
 }
 
 @export
-macro LoadContextElement(c: Context, i: Smi): Object {
-  return c.elements[i];
+macro LoadContextElementNoCell(c: Context, i: Smi): Object {
+  return LoadContextElementNoCellImpl(c, SmiUntag(i));
 }
 
 @export
-macro LoadContextElement(c: Context, i: constexpr int32): Object {
-  return c.elements[i];
+macro LoadContextElementNoCell(c: Context, i: constexpr int32): Object {
+  return LoadContextElementNoCellImpl(c, i);
 }
 
 @export
-macro LoadScriptContextElement(c: Context, i: intptr): Object {
-  return LoadScriptContextElementImpl(c, i);
+macro LoadContextElement(c: Context, i: intptr): Object {
+  return LoadContextElementImpl(c, i);
 }
 
 @export
-macro LoadScriptContextElement(c: Context, i: Smi): Object {
-  return LoadScriptContextElementImpl(c, SmiUntag(i));
+macro LoadContextElement(c: Context, i: Smi): Object {
+  return LoadContextElementImpl(c, SmiUntag(i));
 }
 
 @export
-macro LoadScriptContextElement(c: Context, i: constexpr int32): Object {
-  return LoadScriptContextElementImpl(c, i);
+macro LoadContextElement(c: Context, i: constexpr int32): Object {
+  return LoadContextElementImpl(c, i);
 }
 
 @export
-macro StoreContextElement(c: Context, i: intptr, o: Object): void {
-  c.elements[i] = o;
+macro StoreContextElementNoCell(c: Context, i: intptr, o: Object): void {
+  StoreContextElementNoCellImpl(c, i, o);
 }
 
 @export
-macro StoreContextElement(c: Context, i: Smi, o: Object): void {
-  c.elements[i] = o;
+macro StoreContextElementNoCell(c: Context, i: Smi, o: Object): void {
+  StoreContextElementNoCellImpl(c, SmiUntag(i), o);
 }
 
 @export
-macro StoreContextElement(c: Context, i: constexpr int32, o: Object): void {
-  c.elements[i] = o;
+macro StoreContextElementNoCell(
+    c: Context, i: constexpr int32, o: Object): void {
+  StoreContextElementNoCellImpl(c, i, o);
 }
 
 @export
-macro StoreContextElementAndUpdateSideData(
-    c: Context, i: intptr, o: Object): void {
-  StoreScriptContextAndUpdateSlotProperty(c, i, o);
+macro StoreContextElement(c: Context, i: intptr, o: Object): void {
+  StoreScriptContextElementImpl(c, i, o);
 }
 
 @export
-macro StoreContextElementAndUpdateSideData(
-    c: Context, i: constexpr int32, o: Object): void {
-  StoreScriptContextAndUpdateSlotProperty(c, i, o);
+macro StoreContextElement(c: Context, i: constexpr int32, o: Object): void {
+  StoreScriptContextElementImpl(c, i, o);
+}
+
+macro LoadContextElementNoCellImpl(c: Context, i: intptr): Object {
+  const val = c.elements[i];
+  dcheck(!Is<ContextCell>(val));
+  return val;
 }
 
-builtin AllocateIfMutableHeapNumberScriptContextSlot(
-    n: Object, c: Object, i: Smi): Object {
+macro StoreContextElementNoCellImpl(c: Context, i: intptr, o: Object): void {
+  dcheck(!Is<ContextCell>(c.elements[i]));
+  c.elements[i] = o;
+}
+
+builtin LoadFromContextCell(_n: Object, c: Object, i: Smi): Object {
   const context = UnsafeCast<Context>(c);
   const index = SmiUntag(i);
-  return TryLoadMutableHeapNumber(context, index, n);
+  return LoadContextElementImpl(context, index);
 }
 
-builtin StoreCurrentScriptContextSlotBaseline(o: Object, i: Smi): JSAny {
+builtin StoreCurrentContextElementBaseline(o: Object, i: Smi): JSAny {
   const context = internal::LoadContextFromBaseline();
   const index = SmiUntag(i);
-  StoreScriptContextAndUpdateSlotProperty(context, index, o);
+  StoreScriptContextElementImpl(context, index, o);
   return Undefined;
 }
 
-builtin StoreScriptContextSlotBaseline(
+builtin StoreContextElementBaseline(
     c: Object, o: Object, i: Smi, d: TaggedIndex): JSAny {
   let context = UnsafeCast<Context>(c);
   let depth = TaggedIndexToIntPtr(d);
@@ -280,251 +310,162 @@ builtin StoreScriptContextSlotBaseline(
   }
 
   const index = SmiUntag(i);
-  StoreScriptContextAndUpdateSlotProperty(context, index, o);
+  StoreScriptContextElementImpl(context, index, o);
   return Undefined;
 }
 
 namespace runtime {
-extern runtime InvalidateDependentCodeForScriptContextSlot(Context, Object):
-    JSAny;
+extern runtime NotifyContextCellStateWillChange(NoContext, ContextCell): JSAny;
 }  // namespace runtime
 
-macro StoreScriptContextAndUpdateSlotProperty(
-    c: Context, index: intptr, newValue: Object): void {
-  const scriptContext = Cast<ScriptContext>(c) otherwise unreachable;
+macro NotifyContextCellStateWillChange(cell: ContextCell): void {
+  if (!IsEmptyDependentCode(cell.dependent_code)) deferred {
+      runtime::NotifyContextCellStateWillChange(kNoContext, cell);
+    }
+}
 
-  const sideData: Object = *ContextSlot(
-      scriptContext, ContextSlot::CONTEXT_SIDE_TABLE_PROPERTY_INDEX);
+macro TransitionContextCellToUntagged(
+    heapNumber: HeapNumber, cell: ContextCell,
+    currentState: constexpr int32): void {
+  try {
+    const int32Value = TryFloat64ToInt32(heapNumber.value) otherwise NotInt32;
+    cell.int32_value = int32Value;
+    cell.state = kContextCellInt32;
+  } label NotInt32 {
+    if constexpr (currentState == kContextCellInt32) {
+      // For states kConst and kSmi, we notify the change before calling
+      // TransitionContextCellToUntagged.
+      NotifyContextCellStateWillChange(cell);
+    }
+    cell.double_value = heapNumber.value;
+    cell.state = kContextCellFloat64;
+  }
+}
 
-  if (sideData == kEmptyFixedArray) {
-    // No side data (maybe the context was created while the side data
-    // collection was disabled).
+macro StoreScriptContextElementImpl(
+    c: Context, index: intptr, newValue: Object): void {
+  const oldValue = c.elements[index];
+  if (!HasContextCells(c)) {
     c.elements[index] = newValue;
     return;
   }
 
-  const sideDataIndex = index - ContextSlot::MIN_CONTEXT_EXTENDED_SLOTS;
-  const sideDataFixedArray: FixedArray =
-      Cast<FixedArray>(sideData) otherwise unreachable;
-
-  const oldValue = c.elements[index];
   if (oldValue == TheHole) {
     // Setting the initial value.
-    dcheck(sideDataFixedArray.objects[sideDataIndex] == Undefined);
-    c.elements[index] = newValue;
-    sideDataFixedArray.objects[sideDataIndex] =
-        SmiTag(kContextSidePropertyConst);
+    c.elements[index] = AllocateContextCell(newValue);
     return;
   }
 
-  // If we are assigning the same value, the property won't change.
-  if (TaggedEqual(oldValue, newValue)) {
+  if (!Is<ContextCell>(oldValue)) {
+    c.elements[index] = newValue;
     return;
   }
-  // If both values are HeapNumbers with the same double value, the property
-  // won't change either.
-  if (Is<HeapNumber>(oldValue) && Is<HeapNumber>(newValue)) {
-    const oldNumber = Cast<HeapNumber>(oldValue) otherwise unreachable;
-    const newNumber = Cast<HeapNumber>(newValue) otherwise unreachable;
-    if (oldNumber.value == newNumber.value && oldNumber.value != 0) {
-      return;
-    }
-  }
 
-  // From now on, we know the value is no longer a constant.
-
-  const data = sideDataFixedArray.objects[sideDataIndex];
-  let maybeCell: Undefined|ContextSidePropertyCell;
-  // TODO(victorgomes): Use Smis to avoid untagging.
-  let property: intptr;
-
-  // From now on, we know the value is no longer a constant. If there's a
-  // DependentCode, invalidate it.
-
-  typeswitch (data) {
-    case (property_raw: Smi): {
-      maybeCell = Undefined;
-      property = SmiUntag(property_raw);
+  const cell = Cast<ContextCell>(oldValue) otherwise unreachable;
+  if (cell.state == kContextCellConst) {
+    const constValue = cell.tagged_value;
+    // If we are assigning the same value, the property won't change.
+    if (TaggedEqual(constValue, newValue)) {
+      return;
     }
-    case (cell: ContextSidePropertyCell): {
-      maybeCell = cell;
-      property = SmiUntag(cell.property_details_raw);
+    // If both values are HeapNumbers with the same double value, the property
+    // won't change either.
+    if (Is<HeapNumber>(constValue) && Is<HeapNumber>(newValue)) {
+      const oldNumber = Cast<HeapNumber>(constValue) otherwise unreachable;
+      const newNumber = Cast<HeapNumber>(newValue) otherwise unreachable;
+      if (oldNumber.value == newNumber.value && oldNumber.value != 0) {
+        return;
+      }
     }
-    case (Object): {
-      // If this is reached, there's a code path which initializes or assigns a
-      // top-level `let` variable but doesn't update the side data.
-      unreachable;
+    NotifyContextCellStateWillChange(cell);
+    typeswitch (newValue) {
+      case (smiNumber: Smi): {
+        cell.state = kContextCellSmi;
+        cell.tagged_value = smiNumber;
+      }
+      case (heapNumber: HeapNumber): {
+        TransitionContextCellToUntagged(heapNumber, cell, kContextCellConst);
+        cell.tagged_value = kZero;
+      }
+      case (Object): {
+        c.elements[index] = newValue;
+        cell.tagged_value = kZero;
+        cell.state = kContextCellDetached;
+      }
     }
+    return;
   }
 
-  if (property == kContextSidePropertyConst) {
-    if (maybeCell != Undefined) deferred {
-        runtime::InvalidateDependentCodeForScriptContextSlot(c, maybeCell);
+  if (cell.state == kContextCellSmi) {
+    typeswitch (newValue) {
+      case (smiNumber: Smi): {
+        cell.tagged_value = smiNumber;
       }
-    if (IsScriptContextMutableHeapNumberFlag()) {
-      // It can transition to Smi, MutableInt32, MutableHeapNumber or Other.
-      if (Is<Smi>(newValue)) {
-        c.elements[index] = newValue;
-        sideDataFixedArray.objects[sideDataIndex] =
-            SmiTag(kContextSidePropertySmi);
-      } else if (Is<HeapNumber>(newValue)) {
-        const newNumber = Cast<HeapNumber>(newValue) otherwise unreachable;
-        try {
-          if (!IsScriptContextMutableHeapInt32Flag()) goto NotInt32;
-          const int32Value =
-              TryFloat64ToInt32(newNumber.value) otherwise NotInt32;
-          c.elements[index] = AllocateHeapInt32WithValue(int32Value);
-          sideDataFixedArray.objects[sideDataIndex] =
-              SmiTag(kContextSidePropertyInt32);
-        } label NotInt32 {
-          c.elements[index] = AllocateHeapNumberWithValue(newNumber.value);
-          sideDataFixedArray.objects[sideDataIndex] =
-              SmiTag(kContextSidePropertyHeapNumber);
-        }
-      } else {
-        c.elements[index] = newValue;
-        sideDataFixedArray.objects[sideDataIndex] =
-            SmiTag(kContextSidePropertyOther);
+      case (heapNumber: HeapNumber): {
+        NotifyContextCellStateWillChange(cell);
+        TransitionContextCellToUntagged(heapNumber, cell, kContextCellSmi);
+        cell.tagged_value = kZero;
       }
-    } else {
-      // MutableHeapNumber is not supported, just transition the property to
-      // kOther.
-      c.elements[index] = newValue;
-      sideDataFixedArray.objects[sideDataIndex] =
-          SmiTag(kContextSidePropertyOther);
-    }
-  } else if (property == kContextSidePropertySmi) {
-    if (Is<Smi>(newValue)) {
-      c.elements[index] = newValue;
-    } else {
-      if (maybeCell != Undefined) deferred {
-          runtime::InvalidateDependentCodeForScriptContextSlot(c, maybeCell);
-        }
-      // It can transition to MutableInt32, MutableHeapNumber or Other.
-      if (Is<HeapNumber>(newValue)) {
-        const newNumber = Cast<HeapNumber>(newValue) otherwise unreachable;
-        try {
-          if (!IsScriptContextMutableHeapInt32Flag()) goto NotInt32;
-          const int32Value =
-              TryFloat64ToInt32(newNumber.value) otherwise NotInt32;
-          c.elements[index] = AllocateHeapInt32WithValue(int32Value);
-          sideDataFixedArray.objects[sideDataIndex] =
-              SmiTag(kContextSidePropertyInt32);
-        } label NotInt32 {
-          c.elements[index] = AllocateHeapNumberWithValue(newNumber.value);
-          sideDataFixedArray.objects[sideDataIndex] =
-              SmiTag(kContextSidePropertyHeapNumber);
-        }
-      } else {
+      case (Object): {
+        NotifyContextCellStateWillChange(cell);
         c.elements[index] = newValue;
-        sideDataFixedArray.objects[sideDataIndex] =
-            SmiTag(kContextSidePropertyOther);
+        cell.tagged_value = kZero;
+        cell.state = kContextCellDetached;
       }
     }
-  } else if (property == kContextSidePropertyInt32) {
-    const oldNumber = Cast<HeapNumber>(oldValue) otherwise unreachable;
-    if (Is<Smi>(newValue)) {
-      const newNumber = Cast<Smi>(newValue) otherwise unreachable;
-      StoreHeapInt32Value(oldNumber, SmiToInt32(newNumber));
-    } else if (Is<HeapNumber>(newValue)) {
-      const newNumber = Cast<HeapNumber>(newValue) otherwise unreachable;
-      try {
-        if (!IsScriptContextMutableHeapInt32Flag()) goto NotInt32;
-        const int32Value =
-            TryFloat64ToInt32(newNumber.value) otherwise NotInt32;
-        StoreHeapInt32Value(oldNumber, int32Value);
-      } label NotInt32 {
-        if (maybeCell != Undefined) deferred {
-            runtime::InvalidateDependentCodeForScriptContextSlot(c, maybeCell);
-          }
-        oldNumber.value = newNumber.value;
-        sideDataFixedArray.objects[sideDataIndex] =
-            SmiTag(kContextSidePropertyHeapNumber);
-      }
-    } else {
-      if (maybeCell != Undefined) deferred {
-          runtime::InvalidateDependentCodeForScriptContextSlot(c, maybeCell);
-        }
-      // It can only transition to Other.
-      c.elements[index] = newValue;
-      sideDataFixedArray.objects[sideDataIndex] =
-          SmiTag(kContextSidePropertyOther);
-    }
-  } else if (property == kContextSidePropertyHeapNumber) {
-    // TODO(victorgomes): Add a helper function to avoid duplication.
-    const oldNumber = Cast<HeapNumber>(oldValue) otherwise unreachable;
-    if (Is<Smi>(newValue)) {
-      const newNumber = Cast<Smi>(newValue) otherwise unreachable;
-      oldNumber.value = SmiToFloat64(newNumber);
-    } else if (Is<HeapNumber>(newValue)) {
-      const newNumber = Cast<HeapNumber>(newValue) otherwise unreachable;
-      oldNumber.value = newNumber.value;
-    } else {
-      if (maybeCell != Undefined) deferred {
-          runtime::InvalidateDependentCodeForScriptContextSlot(c, maybeCell);
-        }
-      c.elements[index] = newValue;
-      // It can only transition to Other.
-      sideDataFixedArray.objects[sideDataIndex] =
-          SmiTag(kContextSidePropertyOther);
-    }
-  } else {
-    dcheck(property == kContextSidePropertyOther);
-    // We should not have a code depending on Other.
-    dcheck(IsUndefined(maybeCell));
-    // No need to update side data, this is a sink state...
-    c.elements[index] = newValue;
+    return;
   }
-}
 
-macro LoadScriptContextElementImpl(c: Context, i: intptr): Object {
-  dcheck(Is<ScriptContext>(c));
-  const val = c.elements[i];
-  return TryLoadMutableHeapNumber(c, i, val);
-}
-
-macro TryLoadMutableHeapNumber(
-    c: Context, index: intptr, val: Object): Object {
-  if (!Is<HeapNumber>(val)) return val;
-  const scriptContext = Cast<ScriptContext>(c) otherwise unreachable;
-
-  const sideData: Object = *ContextSlot(
-      scriptContext, ContextSlot::CONTEXT_SIDE_TABLE_PROPERTY_INDEX);
-
-  if (sideData == kEmptyFixedArray) {
-    // No side data (maybe the context was created while the side data
-    // collection was disabled).
-    return val;
+  if (cell.state == kContextCellInt32) {
+    typeswitch (newValue) {
+      case (smiNumber: Smi): {
+        cell.int32_value = SmiToInt32(smiNumber);
+      }
+      case (heapNumber: HeapNumber): {
+        TransitionContextCellToUntagged(heapNumber, cell, kContextCellInt32);
+      }
+      case (Object): {
+        NotifyContextCellStateWillChange(cell);
+        c.elements[index] = newValue;
+        cell.state = kContextCellDetached;
+      }
+    }
+    return;
   }
 
-  const sideDataIndex = index - ContextSlot::MIN_CONTEXT_EXTENDED_SLOTS;
-  const sideDataFixedArray: FixedArray =
-      Cast<FixedArray>(sideData) otherwise unreachable;
-
-  let property: intptr;
-  typeswitch (sideDataFixedArray.objects[sideDataIndex]) {
-    case (Undefined): {
-      return val;
+  dcheck(cell.state == kContextCellFloat64);
+  typeswitch (newValue) {
+    case (smiNumber: Smi): {
+      cell.double_value = SmiToFloat64(smiNumber);
     }
-    case (cell: ContextSidePropertyCell): {
-      property = SmiUntag(cell.property_details_raw);
-    }
-    case (smi_property: Smi): {
-      property = SmiUntag(smi_property);
+    case (heapNumber: HeapNumber): {
+      cell.double_value = heapNumber.value;
     }
     case (Object): {
-      unreachable;
+      NotifyContextCellStateWillChange(cell);
+      c.elements[index] = newValue;
+      cell.state = kContextCellDetached;
     }
   }
-  if (property == kContextSidePropertyInt32) {
-    const number = Cast<HeapNumber>(val) otherwise unreachable;
-    const int32Value = LoadHeapInt32Value(number);
-    return AllocateHeapNumberWithValue(ChangeInt32ToFloat64(int32Value));
-  } else if (property == kContextSidePropertyHeapNumber) {
-    const number = Cast<HeapNumber>(val) otherwise unreachable;
-    return AllocateHeapNumberWithValue(number.value);
+}
+
+macro LoadContextElementImpl(c: Context, i: intptr): Object {
+  const val = c.elements[i];
+  const cell = Cast<ContextCell>(val) otherwise return val;
+  dcheck(HasContextCells(c));
+  dcheck(kContextCellConst == 0);
+  dcheck(kContextCellSmi == 1);
+  if (cell.state <= kContextCellSmi) {
+    return cell.tagged_value;
+  } else if (cell.state == kContextCellInt32) {
+    // TODO(victorgomes): maybe this has a smi value, so we don't need to
+    // allocate a heap number.
+    return AllocateHeapNumberWithValue(ChangeInt32ToFloat64(cell.int32_value));
   } else {
-    return val;
+    dcheck(cell.state == kContextCellFloat64);
+    // TODO(victorgomes): and in this case tagged_value could have contained the
+    // HeapNumber from which this double_value value was initialized.
+    return AllocateHeapNumberWithValue(cell.double_value);
   }
 }
 
diff --git a/deps/v8/src/objects/cpp-heap-external-object-inl.h b/deps/v8/src/objects/cpp-heap-external-object-inl.h
new file mode 100644
index 00000000000000..7665db8e324156
--- /dev/null
+++ b/deps/v8/src/objects/cpp-heap-external-object-inl.h
@@ -0,0 +1,23 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_CPP_HEAP_EXTERNAL_OBJECT_INL_H_
+#define V8_OBJECTS_CPP_HEAP_EXTERNAL_OBJECT_INL_H_
+
+#include "src/objects/cpp-heap-external-object.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8::internal {
+
+#include "torque-generated/src/objects/cpp-heap-external-object-tq-inl.inc"
+
+TQ_OBJECT_CONSTRUCTORS_IMPL(CppHeapExternalObject)
+
+}  // namespace v8::internal
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_CPP_HEAP_EXTERNAL_OBJECT_INL_H_
diff --git a/deps/v8/src/objects/cpp-heap-external-object.h b/deps/v8/src/objects/cpp-heap-external-object.h
new file mode 100644
index 00000000000000..9537d9c69a6e94
--- /dev/null
+++ b/deps/v8/src/objects/cpp-heap-external-object.h
@@ -0,0 +1,32 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_CPP_HEAP_EXTERNAL_OBJECT_H_
+#define V8_OBJECTS_CPP_HEAP_EXTERNAL_OBJECT_H_
+
+#include "src/objects/heap-object.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8::internal {
+
+#include "torque-generated/src/objects/cpp-heap-external-object-tq.inc"
+
+class CppHeapExternalObject
+    : public TorqueGeneratedCppHeapExternalObject<CppHeapExternalObject,
+                                                  HeapObject> {
+ public:
+  DECL_PRINTER(CppHeapExternalObject)
+
+  class BodyDescriptor;
+
+  TQ_OBJECT_CONSTRUCTORS(CppHeapExternalObject)
+};
+
+}  // namespace v8::internal
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_CPP_HEAP_EXTERNAL_OBJECT_H_
diff --git a/deps/v8/src/objects/cpp-heap-external-object.tq b/deps/v8/src/objects/cpp-heap-external-object.tq
new file mode 100644
index 00000000000000..0c758a178ff1d8
--- /dev/null
+++ b/deps/v8/src/objects/cpp-heap-external-object.tq
@@ -0,0 +1,7 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+extern class CppHeapExternalObject extends HeapObject {
+  cpp_heap_wrappable: CppHeapPointer;
+}
diff --git a/deps/v8/src/objects/cpp-heap-object-wrapper-inl.h b/deps/v8/src/objects/cpp-heap-object-wrapper-inl.h
new file mode 100644
index 00000000000000..20bd9c758e0fd2
--- /dev/null
+++ b/deps/v8/src/objects/cpp-heap-object-wrapper-inl.h
@@ -0,0 +1,79 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_CPP_HEAP_OBJECT_WRAPPER_INL_H_
+#define V8_OBJECTS_CPP_HEAP_OBJECT_WRAPPER_INL_H_
+
+#include "src/objects/cpp-heap-object-wrapper.h"
+// Include the non-inl header before the rest of the headers.
+
+#include "src/heap/heap-write-barrier-inl.h"
+#include "src/objects/heap-object-inl.h"
+
+namespace v8::internal {
+
+// static
+CppHeapObjectWrapper CppHeapObjectWrapper::From(
+    Tagged<CppHeapPointerWrapperObjectT> object) {
+  DCHECK(IsCppHeapPointerWrapperObject(object));
+  if (IsCppHeapExternalObject(object)) {
+    return CppHeapObjectWrapper(Cast<CppHeapExternalObject>(object));
+  }
+  DCHECK(IsJSObject(object));
+  return CppHeapObjectWrapper(Cast<JSObject>(object));
+}
+
+CppHeapObjectWrapper::CppHeapObjectWrapper(Tagged<CppHeapExternalObject> object)
+    : object_(object), offset_(CppHeapExternalObject::kCppHeapWrappableOffset) {
+  DCHECK(IsCppHeapPointerWrapperObject(object));
+}
+
+CppHeapObjectWrapper::CppHeapObjectWrapper(Tagged<JSObject> object)
+    : object_(object),
+      offset_(JSAPIObjectWithEmbedderSlots::kCppHeapWrappableOffset) {
+  DCHECK(IsCppHeapPointerWrapperObject(object));
+  DCHECK(IsJSApiWrapperObject(object));
+  DCHECK(IsJSAPIObjectWithEmbedderSlots(object_) || IsJSSpecialObject(object_));
+}
+
+void CppHeapObjectWrapper::InitializeCppHeapWrapper() {
+  object_->SetupLazilyInitializedCppHeapPointerField(offset_);
+}
+
+template <CppHeapPointerTag lower_bound, CppHeapPointerTag upper_bound>
+void* CppHeapObjectWrapper::GetCppHeapWrappable(
+    IsolateForPointerCompression isolate) const {
+  return reinterpret_cast<void*>(
+      object_->ReadCppHeapPointerField<lower_bound, upper_bound>(offset_,
+                                                                 isolate));
+}
+
+void* CppHeapObjectWrapper::GetCppHeapWrappable(
+    IsolateForPointerCompression isolate,
+    CppHeapPointerTagRange tag_range) const {
+  return reinterpret_cast<void*>(
+      object_->ReadCppHeapPointerField(offset_, isolate, tag_range));
+}
+
+template <CppHeapPointerTag tag>
+void CppHeapObjectWrapper::SetCppHeapWrappable(
+    IsolateForPointerCompression isolate, void* instance) {
+  object_->WriteLazilyInitializedCppHeapPointerField<tag>(
+      offset_, isolate, reinterpret_cast<Address>(instance));
+  WriteBarrier::ForCppHeapPointer(
+      object_, object_->RawCppHeapPointerField(offset_), instance);
+}
+
+void CppHeapObjectWrapper::SetCppHeapWrappable(
+    IsolateForPointerCompression isolate, void* instance,
+    CppHeapPointerTag tag) {
+  object_->WriteLazilyInitializedCppHeapPointerField(
+      offset_, isolate, reinterpret_cast<Address>(instance), tag);
+  WriteBarrier::ForCppHeapPointer(
+      object_, object_->RawCppHeapPointerField(offset_), instance);
+}
+
+}  // namespace v8::internal
+
+#endif  // V8_OBJECTS_CPP_HEAP_OBJECT_WRAPPER_INL_H_
diff --git a/deps/v8/src/objects/cpp-heap-object-wrapper.h b/deps/v8/src/objects/cpp-heap-object-wrapper.h
new file mode 100644
index 00000000000000..012aa5f6d2604e
--- /dev/null
+++ b/deps/v8/src/objects/cpp-heap-object-wrapper.h
@@ -0,0 +1,51 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_CPP_HEAP_OBJECT_WRAPPER_H_
+#define V8_OBJECTS_CPP_HEAP_OBJECT_WRAPPER_H_
+
+#include "src/objects/cpp-heap-external-object.h"
+#include "src/objects/js-objects.h"
+#include "src/objects/union.h"
+#include "src/sandbox/isolate.h"
+
+namespace v8::internal {
+
+// Object types that can have a cpp heap object pointer field.
+using CppHeapPointerWrapperObjectT = UnionOf<JSObject, CppHeapExternalObject>;
+
+// Helper union that doesn't actually exist as type. Used to get and set the cpp
+// heap pointer for objects that are associated with one. Use by value.
+class CppHeapObjectWrapper {
+ public:
+  V8_INLINE static CppHeapObjectWrapper From(
+      Tagged<CppHeapPointerWrapperObjectT> object);
+
+  V8_INLINE explicit CppHeapObjectWrapper(Tagged<JSObject> object);
+  V8_INLINE explicit CppHeapObjectWrapper(Tagged<CppHeapExternalObject> object);
+
+  V8_INLINE void InitializeCppHeapWrapper();
+
+  template <CppHeapPointerTag tag>
+  V8_INLINE void SetCppHeapWrappable(IsolateForPointerCompression isolate,
+                                     void*);
+  V8_INLINE void SetCppHeapWrappable(IsolateForPointerCompression isolate,
+                                     void*, CppHeapPointerTag tag);
+  template <CppHeapPointerTag lower_bound, CppHeapPointerTag upper_bound>
+  V8_INLINE void* GetCppHeapWrappable(
+      IsolateForPointerCompression isolate) const;
+  V8_INLINE void* GetCppHeapWrappable(IsolateForPointerCompression isolate,
+                                      CppHeapPointerTagRange tag_range) const;
+
+ private:
+  static_assert(JSAPIObjectWithEmbedderSlots::kCppHeapWrappableOffset ==
+                JSSpecialObject::kCppHeapWrappableOffset);
+
+  Tagged<CppHeapPointerWrapperObjectT> object_;
+  int offset_;
+};
+
+}  // namespace v8::internal
+
+#endif  // V8_OBJECTS_CPP_HEAP_OBJECT_WRAPPER_H_
diff --git a/deps/v8/src/objects/data-handler-inl.h b/deps/v8/src/objects/data-handler-inl.h
index 2a428a84b23710..7a979dd5e7ecca 100644
--- a/deps/v8/src/objects/data-handler-inl.h
+++ b/deps/v8/src/objects/data-handler-inl.h
@@ -8,7 +8,9 @@
 #include "src/objects/data-handler.h"
 // Include the non-inl header before the rest of the headers.
 
-#include "src/objects/objects-inl.h"  // Needed for write barriers
+#include "src/objects/map.h"
+#include "src/objects/objects.h"
+#include "src/objects/tagged-field-inl.h"
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
@@ -18,18 +20,70 @@ namespace internal {
 
 #include "torque-generated/src/objects/data-handler-tq-inl.inc"
 
-TQ_OBJECT_CONSTRUCTORS_IMPL(DataHandler)
+// static
+constexpr int DataHandler::OffsetOf(int index) {
+  return OFFSET_OF_DATA_START(DataHandler) +
+         index * sizeof(DataHandler::FlexibleDataType);
+}
+// static
+constexpr int DataHandler::SizeFor(int count) {
+  return OFFSET_OF_DATA_START(DataHandler) +
+         count * sizeof(DataHandler::FlexibleDataType);
+}
+
+inline Tagged<UnionOf<Smi, Code>> DataHandler::smi_handler() const {
+  return smi_handler_.load();
+}
+inline void DataHandler::set_smi_handler(Tagged<Smi> value) {
+  smi_handler_.store(this, value, SKIP_WRITE_BARRIER);
+}
+inline void DataHandler::set_smi_handler(Tagged<Code> value,
+                                         WriteBarrierMode mode) {
+  smi_handler_.store(this, value, UPDATE_WRITE_BARRIER);
+}
+
+inline Tagged<UnionOf<Smi, Cell>> DataHandler::validity_cell() const {
+  return validity_cell_.load();
+}
+inline void DataHandler::set_validity_cell(Tagged<UnionOf<Smi, Cell>> value,
+                                           WriteBarrierMode mode) {
+  validity_cell_.store(this, value, mode);
+}
 
-int DataHandler::data_field_count() const {
-  return (map()->instance_size() - kSizeWithData0) / kTaggedSize;
+inline int DataHandler::data_field_count() const {
+  return (map()->instance_size() - OFFSET_OF_DATA_START(DataHandler)) /
+         sizeof(data()[0]);
 }
 
-ACCESSORS_CHECKED(DataHandler, data1, Tagged<MaybeObject>, kData1Offset,
-                  map()->instance_size() >= kSizeWithData1)
-ACCESSORS_CHECKED(DataHandler, data2, Tagged<MaybeObject>, kData2Offset,
-                  map()->instance_size() >= kSizeWithData2)
-ACCESSORS_CHECKED(DataHandler, data3, Tagged<MaybeObject>, kData3Offset,
-                  map()->instance_size() >= kSizeWithData3)
+inline Tagged<MaybeObject> DataHandler::data1() const {
+  DCHECK_GT(data_field_count(), 0);
+  return data()[0].load();
+}
+inline void DataHandler::set_data1(Tagged<MaybeObject> value,
+                                   WriteBarrierMode mode) {
+  DCHECK_GT(data_field_count(), 0);
+  data()[0].store(this, value, mode);
+}
+
+inline Tagged<MaybeObject> DataHandler::data2() const {
+  DCHECK_GT(data_field_count(), 1);
+  return data()[1].load();
+}
+inline void DataHandler::set_data2(Tagged<MaybeObject> value,
+                                   WriteBarrierMode mode) {
+  DCHECK_GT(data_field_count(), 1);
+  data()[1].store(this, value, mode);
+}
+
+inline Tagged<MaybeObject> DataHandler::data3() const {
+  DCHECK_GT(data_field_count(), 2);
+  return data()[2].load();
+}
+inline void DataHandler::set_data3(Tagged<MaybeObject> value,
+                                   WriteBarrierMode mode) {
+  DCHECK_GT(data_field_count(), 2);
+  data()[2].store(this, value, mode);
+}
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/objects/data-handler.h b/deps/v8/src/objects/data-handler.h
index 8674bddf914877..b348d1d481163e 100644
--- a/deps/v8/src/objects/data-handler.h
+++ b/deps/v8/src/objects/data-handler.h
@@ -9,6 +9,7 @@
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
+#include "src/objects/tagged-field.h"
 
 namespace v8 {
 namespace internal {
@@ -17,28 +18,52 @@ namespace internal {
 
 // DataHandler is a base class for load and store handlers that can't be
 // encoded in one Smi. Kind of a handler can be deduced from instance type.
-class DataHandler : public TorqueGeneratedDataHandler<DataHandler, Struct> {
+V8_OBJECT class DataHandler : public StructLayout {
  public:
+  static constexpr int OffsetOf(int index);
+  static constexpr int SizeFor(int count);
+
+  // [smi_handler]: A Smi which encodes a handler or Code object
+  // (we still use code handlers for accessing lexical environment variables,
+  // but soon only smi handlers will remain). See LoadHandler and StoreHandler
+  // for details about encoding.
+  inline Tagged<UnionOf<Smi, Code>> smi_handler() const;
+  inline void set_smi_handler(Tagged<Smi> value);
+  inline void set_smi_handler(Tagged<Code> value,
+                              WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+
+  // [validity_cell]: A validity Cell that guards prototype chain modifications.
+  inline Tagged<UnionOf<Smi, Cell>> validity_cell() const;
+  inline void set_validity_cell(Tagged<UnionOf<Smi, Cell>> value,
+                                WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+
   // Returns number of optional data fields available in the object.
   inline int data_field_count() const;
 
   // [data1-3]: These are optional general-purpose fields whose content and
   // presence depends on the handler kind.
-  DECL_ACCESSORS(data1, Tagged<MaybeObject>)
-  DECL_ACCESSORS(data2, Tagged<MaybeObject>)
-  DECL_ACCESSORS(data3, Tagged<MaybeObject>)
-
-  static const int kSizeWithData0 = kData1Offset;
-  static const int kSizeWithData1 = kData2Offset;
-  static const int kSizeWithData2 = kData3Offset;
-  static const int kSizeWithData3 = kHeaderSize;
+  inline Tagged<MaybeObject> data1() const;
+  inline void set_data1(Tagged<MaybeObject> value,
+                        WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+  inline Tagged<MaybeObject> data2() const;
+  inline void set_data2(Tagged<MaybeObject> value,
+                        WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+  inline Tagged<MaybeObject> data3() const;
+  inline void set_data3(Tagged<MaybeObject> value,
+                        WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
 
   DECL_VERIFIER(DataHandler)
+  DECL_PRINTER(DataHandler)
 
   class BodyDescriptor;
 
-  TQ_OBJECT_CONSTRUCTORS(DataHandler)
-};
+ private:
+  friend class AccessorAssembler;
+
+  TaggedMember<UnionOf<Smi, Code>> smi_handler_;
+  TaggedMember<UnionOf<Smi, Cell>> validity_cell_;
+  FLEXIBLE_ARRAY_MEMBER(TaggedMember<MaybeObject>, data);
+} V8_OBJECT_END;
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/objects/data-handler.tq b/deps/v8/src/objects/data-handler.tq
index 6bf26c2ccc64f3..004fe16aea53d0 100644
--- a/deps/v8/src/objects/data-handler.tq
+++ b/deps/v8/src/objects/data-handler.tq
@@ -5,18 +5,4 @@
 // This class does not use the generated verifier, so if you change anything
 // here, please also update DataHandlerVerify in objects-debug.cc.
 @abstract
-extern class DataHandler extends Struct {
-  // [smi_handler]: A Smi which encodes a handler or Code object
-  // (we still use code handlers for accessing lexical environment variables,
-  // but soon only smi handlers will remain). See LoadHandler and StoreHandler
-  // for details about encoding.
-  smi_handler: Smi|Code;
-
-  // [validity_cell]: A validity Cell that guards prototype chain modifications.
-  validity_cell: Smi|Cell;
-
-  // Space for the following fields may or may not be allocated.
-  data1: MaybeObject;
-  data2: MaybeObject;
-  data3: MaybeObject;
-}
+extern class DataHandler extends Struct;
diff --git a/deps/v8/src/objects/dependent-code.cc b/deps/v8/src/objects/dependent-code.cc
index b757f145f48b25..9979c8a7f5abc4 100644
--- a/deps/v8/src/objects/dependent-code.cc
+++ b/deps/v8/src/objects/dependent-code.cc
@@ -7,6 +7,7 @@
 #include "src/base/bits.h"
 #include "src/deoptimizer/deoptimizer.h"
 #include "src/objects/allocation-site-inl.h"
+#include "src/objects/contexts.h"
 #include "src/objects/dependent-code-inl.h"
 #include "src/objects/map.h"
 
@@ -21,8 +22,8 @@ Tagged<DependentCode> DependentCode::GetDependentCode(
     return Cast<PropertyCell>(object)->dependent_code();
   } else if (IsAllocationSite(object)) {
     return Cast<AllocationSite>(object)->dependent_code();
-  } else if (IsContextSidePropertyCell(object)) {
-    return Cast<ContextSidePropertyCell>(object)->dependent_code();
+  } else if (IsContextCell(object)) {
+    return Cast<ContextCell>(object)->dependent_code();
   } else if (IsScopeInfo(object)) {
     return Cast<ScopeInfo>(object)->dependent_code();
   }
@@ -37,8 +38,8 @@ void DependentCode::SetDependentCode(DirectHandle<HeapObject> object,
     Cast<PropertyCell>(object)->set_dependent_code(*dep);
   } else if (IsAllocationSite(*object)) {
     Cast<AllocationSite>(object)->set_dependent_code(*dep);
-  } else if (IsContextSidePropertyCell(*object)) {
-    Cast<ContextSidePropertyCell>(object)->set_dependent_code(*dep);
+  } else if (IsContextCell(*object)) {
+    Cast<ContextCell>(object)->set_dependent_code(*dep);
   } else if (IsScopeInfo(*object)) {
     Cast<ScopeInfo>(object)->set_dependent_code(*dep);
   } else {
@@ -207,7 +208,7 @@ const char* DependentCode::DependencyGroupName(DependencyGroup group) {
       return "allocation-site-tenuring-changed";
     case kAllocationSiteTransitionChangedGroup:
       return "allocation-site-transition-changed";
-    case kScriptContextSlotPropertyChangedGroup:
+    case kContextCellChangedGroup:
       return "script-context-slot-property-changed";
     case kEmptyContextExtensionGroup:
       return "empty-context-extension";
@@ -236,8 +237,8 @@ LazyDeoptimizeReason DependentCode::DependencyGroupToLazyDeoptReason(
       return LazyDeoptimizeReason::kAllocationSiteTenuringChange;
     case kAllocationSiteTransitionChangedGroup:
       return LazyDeoptimizeReason::kAllocationSiteTransitionChange;
-    case kScriptContextSlotPropertyChangedGroup:
-      return LazyDeoptimizeReason::kScriptContextSlotPropertyChange;
+    case kContextCellChangedGroup:
+      return LazyDeoptimizeReason::kContextCellChange;
     case kEmptyContextExtensionGroup:
       return LazyDeoptimizeReason::kEmptyContextExtensionChange;
   }
diff --git a/deps/v8/src/objects/dependent-code.h b/deps/v8/src/objects/dependent-code.h
index e24b4ac6fc6bba..c1263d3e89ea20 100644
--- a/deps/v8/src/objects/dependent-code.h
+++ b/deps/v8/src/objects/dependent-code.h
@@ -62,7 +62,7 @@ class DependentCode : public WeakArrayList {
     kAllocationSiteTransitionChangedGroup = 1 << 8,
     // Group of code objects that depend on a slot side table property of
     // a ScriptContext not being changed.
-    kScriptContextSlotPropertyChangedGroup = 1 << 9,
+    kContextCellChangedGroup = 1 << 9,
     // Group of code objects that depend on particular context's extension
     // slot to be empty.
     kEmptyContextExtensionGroup = 1 << 10,
diff --git a/deps/v8/src/objects/descriptor-array-inl.h b/deps/v8/src/objects/descriptor-array-inl.h
index a241c1a0a75433..f87013f55f05dc 100644
--- a/deps/v8/src/objects/descriptor-array-inl.h
+++ b/deps/v8/src/objects/descriptor-array-inl.h
@@ -40,6 +40,7 @@ RELAXED_INT16_ACCESSORS(DescriptorArray, number_of_all_descriptors,
 RELAXED_INT16_ACCESSORS(DescriptorArray, number_of_descriptors,
                         kNumberOfDescriptorsOffset)
 RELAXED_UINT32_ACCESSORS(DescriptorArray, raw_gc_state, kRawGcStateOffset)
+RELAXED_UINT32_ACCESSORS(DescriptorArray, flags, kFlagsOffset)
 
 inline int16_t DescriptorArray::number_of_slack_descriptors() const {
   return number_of_all_descriptors() - number_of_descriptors();
@@ -49,6 +50,25 @@ inline int DescriptorArray::number_of_entries() const {
   return number_of_descriptors();
 }
 
+DescriptorArray::FastIterableState DescriptorArray::fast_iterable() const {
+  return FastIterableBits::decode(flags(kRelaxedLoad));
+}
+
+void DescriptorArray::set_fast_iterable(FastIterableState value) {
+  uint32_t f = flags(kRelaxedLoad);
+  f = FastIterableBits::update(f, value);
+  set_flags(f, kRelaxedStore);
+}
+
+void DescriptorArray::set_fast_iterable_if(FastIterableState new_value,
+                                           FastIterableState if_value) {
+  uint32_t f = flags(kRelaxedLoad);
+  if (FastIterableBits::decode(f) == if_value) {
+    f = FastIterableBits::update(f, new_value);
+    set_flags(f, kRelaxedStore);
+  }
+}
+
 void DescriptorArray::CopyEnumCacheFrom(Tagged<DescriptorArray> array) {
   set_enum_cache(array->enum_cache());
 }
@@ -211,6 +231,8 @@ void DescriptorArray::SetKey(InternalIndex descriptor_number,
   int entry_offset = OffsetOfDescriptorAt(descriptor_number.as_int());
   EntryKeyField::Relaxed_Store(*this, entry_offset, key);
   WRITE_BARRIER(*this, entry_offset + kEntryKeyOffset, key);
+  // Conservatively assume that the new key might break fast iteration.
+  set_fast_iterable(FastIterableState::kUnknown);
 }
 
 int DescriptorArray::GetSortedKeyIndex(int descriptor_number) {
@@ -275,6 +297,10 @@ void DescriptorArray::SetDetails(InternalIndex descriptor_number,
   DCHECK_LT(descriptor_number.as_int(), number_of_descriptors());
   int entry_offset = OffsetOfDescriptorAt(descriptor_number.as_int());
   EntryDetailsField::Relaxed_Store(*this, entry_offset, details.AsSmi());
+  // Note: fast_iteration depends on PropertyDetails::location().
+  // However we don't reset it here as all path either go through SetKey(),
+  // which invalidates fast_iteration, or don't change the location
+  // (GeneralizeAllFields()).
 }
 
 int DescriptorArray::GetFieldIndex(InternalIndex descriptor_number) {
@@ -301,12 +327,16 @@ void DescriptorArray::Set(InternalIndex descriptor_number, Tagged<Name> key,
   SetKey(descriptor_number, key);
   SetDetails(descriptor_number, details);
   SetValue(descriptor_number, value);
+  // Resetting the fast iterable state is bottlenecked in SetKey().
+  DCHECK_EQ(fast_iterable(), FastIterableState::kUnknown);
 }
 
 void DescriptorArray::Set(InternalIndex descriptor_number, Descriptor* desc) {
   Tagged<Name> key = *desc->GetKey();
   Tagged<MaybeObject> value = *desc->GetValue();
   Set(descriptor_number, key, value, desc->GetDetails());
+  // Resetting the fast iterable state is bottlenecked in SetKey().
+  DCHECK_EQ(fast_iterable(), FastIterableState::kUnknown);
 }
 
 void DescriptorArray::Append(Descriptor* desc) {
@@ -331,6 +361,9 @@ void DescriptorArray::Append(Descriptor* desc) {
 
   SetSortedKey(insertion, descriptor_number);
 
+  // Resetting the fast iterable state is bottlenecked in SetKey().
+  DCHECK_EQ(fast_iterable(), FastIterableState::kUnknown);
+
   if (V8_LIKELY(collision_hash != desc_hash)) return;
 
   CheckNameCollisionDuringInsertion(desc, desc_hash, insertion);
diff --git a/deps/v8/src/objects/descriptor-array.h b/deps/v8/src/objects/descriptor-array.h
index 979beb9d21b6d9..afd5a9207de2e5 100644
--- a/deps/v8/src/objects/descriptor-array.h
+++ b/deps/v8/src/objects/descriptor-array.h
@@ -13,6 +13,7 @@
 #include "src/objects/objects.h"
 #include "src/objects/struct.h"
 #include "src/utils/utils.h"
+#include "torque-generated/bit-fields.h"
 
 // Has to be the last include (doesn't have include guards):
 #include "src/objects/object-macros.h"
@@ -56,9 +57,30 @@ class DescriptorArray
  public:
   DECL_INT16_ACCESSORS(number_of_all_descriptors)
   DECL_INT16_ACCESSORS(number_of_descriptors)
+  DECL_RELAXED_PRIMITIVE_ACCESSORS(flags, uint32_t)
   inline int16_t number_of_slack_descriptors() const;
   inline int number_of_entries() const;
 
+  enum class FastIterableState : uint8_t {
+    // Descriptors are JSON fast iterable, iff all of the following conditions
+    // are met:
+    // - No key is a symbol.
+    // - All keys are enumberable.
+    // - All keys are one-byte and don't contain any character that requires
+    //   escaping.
+    // - All properties are located in field.
+    kJsonFast = 0b00,
+    kJsonSlow = 0b01,
+    kUnknown = 0b11
+  };
+
+  DEFINE_TORQUE_GENERATED_DESCRIPTOR_ARRAY_FLAGS()
+
+  inline FastIterableState fast_iterable() const;
+  inline void set_fast_iterable(FastIterableState value);
+  inline void set_fast_iterable_if(FastIterableState new_value,
+                                   FastIterableState if_value);
+
   void ClearEnumCache();
   inline void CopyEnumCacheFrom(Tagged<DescriptorArray> array);
   static void InitializeOrChangeEnumCache(
diff --git a/deps/v8/src/objects/descriptor-array.tq b/deps/v8/src/objects/descriptor-array.tq
index e411e1f9362106..64fccff7471911 100644
--- a/deps/v8/src/objects/descriptor-array.tq
+++ b/deps/v8/src/objects/descriptor-array.tq
@@ -15,6 +15,13 @@ struct DescriptorEntry {
       NumberDictionary;
 }
 
+type FastIterableState extends uint8
+    constexpr 'DescriptorArray::FastIterableState';
+
+bitfield struct DescriptorArrayFlags extends uint32 {
+  fast_iterable: FastIterableState: 2 bit;
+}
+
 @generateBodyDescriptor
 @generateUniqueMap
 extern class DescriptorArray extends HeapObject {
@@ -23,6 +30,11 @@ extern class DescriptorArray extends HeapObject {
   // Raw GC state that is maintained during marking.
   // See `DescriptorArrayMarkingState`.
   raw_gc_state: uint32;
+  flags: DescriptorArrayFlags;
+
+  @if(TAGGED_SIZE_8_BYTES) optional_padding: uint32;
+  @ifnot(TAGGED_SIZE_8_BYTES) optional_padding: void;
+
   enum_cache: EnumCache;
   descriptors[number_of_all_descriptors]: DescriptorEntry;
 }
diff --git a/deps/v8/src/objects/dictionary-inl.h b/deps/v8/src/objects/dictionary-inl.h
index 406183bf24527d..01701a7d2a7086 100644
--- a/deps/v8/src/objects/dictionary-inl.h
+++ b/deps/v8/src/objects/dictionary-inl.h
@@ -168,7 +168,7 @@ void Dictionary<Derived, Shape>::SetEntry(InternalIndex entry,
                                           Tagged<Object> value,
                                           PropertyDetails details) {
   DCHECK(Dictionary::kEntrySize == 2 || Dictionary::kEntrySize == 3);
-  DCHECK(!IsName(key) || details.dictionary_index() > 0);
+  DCHECK(!IsName(key) || details.dictionary_index() > 0 || !Shape::kHasDetails);
   int index = DerivedHashTable::EntryToIndex(entry);
   DisallowGarbageCollection no_gc;
   WriteBarrierMode mode = this->GetWriteBarrierMode(no_gc);
@@ -315,6 +315,10 @@ DirectHandle<Map> NumberDictionary::GetMap(RootsTable& roots) {
   return roots.number_dictionary_map();
 }
 
+DirectHandle<Map> SimpleNameDictionary::GetMap(RootsTable& roots) {
+  return roots.simple_name_dictionary_map();
+}
+
 DirectHandle<Map> SimpleNumberDictionary::GetMap(RootsTable& roots) {
   return roots.simple_number_dictionary_map();
 }
diff --git a/deps/v8/src/objects/dictionary.h b/deps/v8/src/objects/dictionary.h
index 2534f6bf14b0f7..c45da9079b2982 100644
--- a/deps/v8/src/objects/dictionary.h
+++ b/deps/v8/src/objects/dictionary.h
@@ -230,6 +230,41 @@ class EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE) BaseNameDictionary
   using Dictionary<Derived, Shape>::FindInsertionEntry;
 };
 
+class SimpleNameDictionaryShape : public BaseNameDictionaryShape {
+ public:
+  static const bool kHasDetails = false;
+  static const bool kMatchNeedsHoleCheck = false;
+  static const int kPrefixSize = 0;
+  static const int kEntrySize = 2;
+
+  template <typename Dictionary>
+  static inline PropertyDetails DetailsAt(Tagged<Dictionary> dict,
+                                          InternalIndex entry) {
+    UNREACHABLE();
+  }
+
+  template <typename Dictionary>
+  static inline void DetailsAtPut(Tagged<Dictionary> dict, InternalIndex entry,
+                                  PropertyDetails value) {
+    UNREACHABLE();
+  }
+};
+
+EXTERN_DECLARE_DICTIONARY(SimpleNameDictionary, SimpleNameDictionaryShape)
+
+// A simple Name-to-Object dictionary.
+class SimpleNameDictionary
+    : public Dictionary<SimpleNameDictionary, SimpleNameDictionaryShape> {
+ public:
+  static inline DirectHandle<Map> GetMap(RootsTable& roots);
+
+  V8_EXPORT_PRIVATE V8_WARN_UNUSED_RESULT static Handle<SimpleNameDictionary>
+  Set(Isolate* isolate, Handle<SimpleNameDictionary> dictionary,
+      DirectHandle<Name> key, DirectHandle<Object> value);
+
+  static const int kEntryValueIndex = 1;
+};
+
 #define EXTERN_DECLARE_BASE_NAME_DICTIONARY(DERIVED, SHAPE)        \
   EXTERN_DECLARE_DICTIONARY(DERIVED, SHAPE)                        \
   extern template class EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE) \
diff --git a/deps/v8/src/objects/elements-inl.h b/deps/v8/src/objects/elements-inl.h
index 01a433ddb24203..b50e5eaa5d3da4 100644
--- a/deps/v8/src/objects/elements-inl.h
+++ b/deps/v8/src/objects/elements-inl.h
@@ -31,10 +31,11 @@ inline MaybeHandle<FixedArray> ElementsAccessor::PrependElementIndices(
                                convert, filter);
 }
 
-inline bool ElementsAccessor::HasElement(Tagged<JSObject> holder,
+inline bool ElementsAccessor::HasElement(Isolate* isolate,
+                                         Tagged<JSObject> holder,
                                          uint32_t index,
                                          PropertyFilter filter) {
-  return HasElement(holder, index, holder->elements(), filter);
+  return HasElement(isolate, holder, index, holder->elements(), filter);
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/elements.cc b/deps/v8/src/objects/elements.cc
index 1858ebedd524f1..0dc0b593ebc145 100644
--- a/deps/v8/src/objects/elements.cc
+++ b/deps/v8/src/objects/elements.cc
@@ -5,7 +5,8 @@
 #include "src/objects/elements.h"
 
 #include "src/base/atomicops.h"
-#include "src/base/safe_conversions.h"
+#include "src/base/numerics/safe_conversions.h"
+#include "src/common/globals.h"
 #include "src/common/message-template.h"
 #include "src/execution/arguments.h"
 #include "src/execution/frames.h"
@@ -496,10 +497,8 @@ void SortIndices(Isolate* isolate, DirectHandle<FixedArray> indices,
   AtomicSlot end(start + sort_size);
   std::sort(start, end, [isolate](Tagged_t elementA, Tagged_t elementB) {
 #ifdef V8_COMPRESS_POINTERS
-    Tagged<Object> a(
-        V8HeapCompressionScheme::DecompressTagged(isolate, elementA));
-    Tagged<Object> b(
-        V8HeapCompressionScheme::DecompressTagged(isolate, elementB));
+    Tagged<Object> a(V8HeapCompressionScheme::DecompressTagged(elementA));
+    Tagged<Object> b(V8HeapCompressionScheme::DecompressTagged(elementB));
 #else
     Tagged<Object> a(elementA);
     Tagged<Object> b(elementB);
@@ -599,9 +598,10 @@ class ElementsAccessorBase : public InternalElementsAccessor {
 
   static ElementsKind kind() { return ElementsTraits::Kind; }
 
-  static void ValidateContents(Tagged<JSObject> holder, size_t length) {}
+  static void ValidateContents(Isolate* isolate, Tagged<JSObject> holder,
+                               size_t length) {}
 
-  static void ValidateImpl(Tagged<JSObject> holder) {
+  static void ValidateImpl(Isolate* isolate, Tagged<JSObject> holder) {
     Tagged<FixedArrayBase> fixed_array_base = holder->elements();
     if (!IsHeapObject(fixed_array_base)) return;
     // Arrays that have been shifted in place can't be verified.
@@ -617,19 +617,19 @@ class ElementsAccessorBase : public InternalElementsAccessor {
     } else {
       length = fixed_array_base->length();
     }
-    Subclass::ValidateContents(holder, length);
+    Subclass::ValidateContents(isolate, holder, length);
   }
 
-  void Validate(Tagged<JSObject> holder) final {
+  void Validate(Isolate* isolate, Tagged<JSObject> holder) final {
     DisallowGarbageCollection no_gc;
-    Subclass::ValidateImpl(holder);
+    Subclass::ValidateImpl(isolate, holder);
   }
 
-  bool HasElement(Tagged<JSObject> holder, uint32_t index,
+  bool HasElement(Isolate* isolate, Tagged<JSObject> holder, uint32_t index,
                   Tagged<FixedArrayBase> backing_store,
                   PropertyFilter filter) final {
-    return Subclass::HasElementImpl(holder->GetIsolate(), holder, index,
-                                    backing_store, filter);
+    return Subclass::HasElementImpl(isolate, holder, index, backing_store,
+                                    filter);
   }
 
   static bool HasElementImpl(Isolate* isolate, Tagged<JSObject> holder,
@@ -640,9 +640,9 @@ class ElementsAccessorBase : public InternalElementsAccessor {
         .is_found();
   }
 
-  bool HasEntry(Tagged<JSObject> holder, InternalIndex entry) final {
-    return Subclass::HasEntryImpl(holder->GetIsolate(), holder->elements(),
-                                  entry);
+  bool HasEntry(Isolate* isolate, Tagged<JSObject> holder,
+                InternalIndex entry) final {
+    return Subclass::HasEntryImpl(isolate, holder->elements(), entry);
   }
 
   static bool HasEntryImpl(Isolate* isolate,
@@ -742,74 +742,81 @@ class ElementsAccessorBase : public InternalElementsAccessor {
     Subclass::SetImpl(holder, entry, value);
   }
 
-  void Reconfigure(DirectHandle<JSObject> object,
+  void Reconfigure(Isolate* isolate, DirectHandle<JSObject> object,
                    DirectHandle<FixedArrayBase> store, InternalIndex entry,
                    DirectHandle<Object> value,
                    PropertyAttributes attributes) final {
-    Subclass::ReconfigureImpl(object, store, entry, value, attributes);
+    Subclass::ReconfigureImpl(isolate, object, store, entry, value, attributes);
   }
 
-  static void ReconfigureImpl(DirectHandle<JSObject> object,
+  static void ReconfigureImpl(Isolate* isolate, DirectHandle<JSObject> object,
                               DirectHandle<FixedArrayBase> store,
                               InternalIndex entry, DirectHandle<Object> value,
                               PropertyAttributes attributes) {
     UNREACHABLE();
   }
 
-  Maybe<bool> Add(DirectHandle<JSObject> object, uint32_t index,
-                  DirectHandle<Object> value, PropertyAttributes attributes,
-                  uint32_t new_capacity) final {
-    return Subclass::AddImpl(object, index, value, attributes, new_capacity);
+  Maybe<bool> Add(Isolate* isolate, DirectHandle<JSObject> object,
+                  uint32_t index, DirectHandle<Object> value,
+                  PropertyAttributes attributes, uint32_t new_capacity) final {
+    return Subclass::AddImpl(isolate, object, index, value, attributes,
+                             new_capacity);
   }
 
-  static Maybe<bool> AddImpl(DirectHandle<JSObject> object, uint32_t index,
-                             DirectHandle<Object> value,
+  static Maybe<bool> AddImpl(Isolate* isolate, DirectHandle<JSObject> object,
+                             uint32_t index, DirectHandle<Object> value,
                              PropertyAttributes attributes,
                              uint32_t new_capacity) {
     UNREACHABLE();
   }
 
-  Maybe<uint32_t> Push(DirectHandle<JSArray> receiver, BuiltinArguments* args,
-                       uint32_t push_size) final {
-    return Subclass::PushImpl(receiver, args, push_size);
+  Maybe<uint32_t> Push(Isolate* isolate, DirectHandle<JSArray> receiver,
+                       BuiltinArguments* args, uint32_t push_size) final {
+    return Subclass::PushImpl(isolate, receiver, args, push_size);
   }
 
-  static Maybe<uint32_t> PushImpl(DirectHandle<JSArray> receiver,
+  static Maybe<uint32_t> PushImpl(Isolate* isolate,
+                                  DirectHandle<JSArray> receiver,
                                   BuiltinArguments* args, uint32_t push_sized) {
     UNREACHABLE();
   }
 
-  Maybe<uint32_t> Unshift(DirectHandle<JSArray> receiver,
+  Maybe<uint32_t> Unshift(Isolate* isolate, DirectHandle<JSArray> receiver,
                           BuiltinArguments* args, uint32_t unshift_size) final {
-    return Subclass::UnshiftImpl(receiver, args, unshift_size);
+    return Subclass::UnshiftImpl(isolate, receiver, args, unshift_size);
   }
 
-  static Maybe<uint32_t> UnshiftImpl(DirectHandle<JSArray> receiver,
+  static Maybe<uint32_t> UnshiftImpl(Isolate* isolate,
+                                     DirectHandle<JSArray> receiver,
                                      BuiltinArguments* args,
                                      uint32_t unshift_size) {
     UNREACHABLE();
   }
 
-  MaybeDirectHandle<Object> Pop(DirectHandle<JSArray> receiver) final {
-    return Subclass::PopImpl(receiver);
+  MaybeDirectHandle<Object> Pop(Isolate* isolate,
+                                DirectHandle<JSArray> receiver) final {
+    return Subclass::PopImpl(isolate, receiver);
   }
 
-  static MaybeDirectHandle<Object> PopImpl(DirectHandle<JSArray> receiver) {
+  static MaybeDirectHandle<Object> PopImpl(Isolate* isolate,
+                                           DirectHandle<JSArray> receiver) {
     UNREACHABLE();
   }
 
-  MaybeDirectHandle<Object> Shift(DirectHandle<JSArray> receiver) final {
-    return Subclass::ShiftImpl(receiver);
+  MaybeDirectHandle<Object> Shift(Isolate* isolate,
+                                  DirectHandle<JSArray> receiver) final {
+    return Subclass::ShiftImpl(isolate, receiver);
   }
 
-  static MaybeDirectHandle<Object> ShiftImpl(DirectHandle<JSArray> receiver) {
+  static MaybeDirectHandle<Object> ShiftImpl(Isolate* isolate,
+                                             DirectHandle<JSArray> receiver) {
     UNREACHABLE();
   }
 
-  Maybe<bool> SetLength(DirectHandle<JSArray> array, uint32_t length) final {
-    return Subclass::SetLengthImpl(
-        array->GetIsolate(), array, length,
-        direct_handle(array->elements(), array->GetIsolate()));
+  Maybe<bool> SetLength(Isolate* isolate, DirectHandle<JSArray> array,
+                        uint32_t length) final {
+    return Subclass::SetLengthImpl(isolate, array, length,
+                                   direct_handle(array->elements(), isolate));
   }
 
   static Maybe<bool> SetLengthImpl(Isolate* isolate,
@@ -824,7 +831,7 @@ class ElementsAccessorBase : public InternalElementsAccessor {
       ElementsKind kind = array->GetElementsKind();
       if (!IsHoleyElementsKind(kind)) {
         kind = GetHoleyElementsKind(kind);
-        JSObject::TransitionElementsKind(array, kind);
+        JSObject::TransitionElementsKind(isolate, array, kind);
       }
     }
 
@@ -835,7 +842,7 @@ class ElementsAccessorBase : public InternalElementsAccessor {
       array->initialize_elements();
     } else if (length <= capacity) {
       if (IsSmiOrObjectElementsKind(kind())) {
-        JSObject::EnsureWritableFastElements(array);
+        JSObject::EnsureWritableFastElements(isolate, array);
         if (array->elements() != *backing_store) {
           backing_store = direct_handle(array->elements(), isolate);
         }
@@ -877,12 +884,13 @@ class ElementsAccessorBase : public InternalElementsAccessor {
       // pre-size an array to then write to it within bounds. A subsequent
       // resizing operation, like Array.p.push, might still trigger a transition
       // to dictionary elements because of sparseness.
-      MAYBE_RETURN(Subclass::GrowCapacityAndConvertImpl(array, new_capacity),
-                   Nothing<bool>());
+      MAYBE_RETURN(
+          Subclass::GrowCapacityAndConvertImpl(isolate, array, new_capacity),
+          Nothing<bool>());
     }
 
     array->set_length(Smi::FromInt(length));
-    JSObject::ValidateElements(*array);
+    JSObject::ValidateElements(isolate, *array);
     return Just(true);
   }
 
@@ -914,17 +922,17 @@ class ElementsAccessorBase : public InternalElementsAccessor {
   }
 
   static MaybeDirectHandle<FixedArrayBase> ConvertElementsWithCapacity(
-      DirectHandle<JSObject> object, DirectHandle<FixedArrayBase> old_elements,
-      ElementsKind from_kind, uint32_t capacity) {
-    return ConvertElementsWithCapacity(object, old_elements, from_kind,
+      Isolate* isolate, DirectHandle<JSObject> object,
+      DirectHandle<FixedArrayBase> old_elements, ElementsKind from_kind,
+      uint32_t capacity) {
+    return ConvertElementsWithCapacity(isolate, object, old_elements, from_kind,
                                        capacity, 0, 0);
   }
 
   static MaybeDirectHandle<FixedArrayBase> ConvertElementsWithCapacity(
-      DirectHandle<JSObject> object, DirectHandle<FixedArrayBase> old_elements,
-      ElementsKind from_kind, uint32_t capacity, uint32_t src_index,
-      uint32_t dst_index) {
-    Isolate* isolate = object->GetIsolate();
+      Isolate* isolate, DirectHandle<JSObject> object,
+      DirectHandle<FixedArrayBase> old_elements, ElementsKind from_kind,
+      uint32_t capacity, uint32_t src_index, uint32_t dst_index) {
     DirectHandle<FixedArrayBase> new_elements;
     // TODO(victorgomes): Retrieve native context in optimized code
     // and remove the check isolate->context().is_null().
@@ -956,9 +964,9 @@ class ElementsAccessorBase : public InternalElementsAccessor {
     return MaybeDirectHandle<FixedArrayBase>(new_elements);
   }
 
-  static void TransitionElementsKindImpl(DirectHandle<JSObject> object,
+  static void TransitionElementsKindImpl(Isolate* isolate,
+                                         DirectHandle<JSObject> object,
                                          DirectHandle<Map> to_map) {
-    Isolate* isolate = object->GetIsolate();
     DirectHandle<Map> from_map(object->map(), isolate);
     ElementsKind from_kind = from_map->elements_kind();
     ElementsKind to_kind = to_map->elements_kind();
@@ -988,8 +996,8 @@ class ElementsAccessorBase : public InternalElementsAccessor {
         static_assert(FixedArray::kMaxLength == FixedDoubleArray::kMaxLength);
         DCHECK_LE(capacity, FixedArray::kMaxLength);
         DirectHandle<FixedArrayBase> elements =
-            ConvertElementsWithCapacity(object, from_elements, from_kind,
-                                        capacity)
+            ConvertElementsWithCapacity(isolate, object, from_elements,
+                                        from_kind, capacity)
                 .ToHandleChecked();
         JSObject::SetMapAndElements(object, to_map, elements);
       }
@@ -1001,44 +1009,46 @@ class ElementsAccessorBase : public InternalElementsAccessor {
     }
   }
 
-  static Maybe<bool> GrowCapacityAndConvertImpl(DirectHandle<JSObject> object,
+  static Maybe<bool> GrowCapacityAndConvertImpl(Isolate* isolate,
+                                                DirectHandle<JSObject> object,
                                                 uint32_t capacity) {
     ElementsKind from_kind = object->GetElementsKind();
     if (IsSmiOrObjectElementsKind(from_kind)) {
       // Array optimizations rely on the prototype lookups of Array objects
       // always returning undefined. If there is a store to the initial
       // prototype object, make sure all of these optimizations are invalidated.
-      object->GetIsolate()->UpdateNoElementsProtectorOnSetLength(object);
+      isolate->UpdateNoElementsProtectorOnSetLength(object);
     }
-    DirectHandle<FixedArrayBase> old_elements(object->elements(),
-                                              object->GetIsolate());
+    DirectHandle<FixedArrayBase> old_elements(object->elements(), isolate);
     // This method should only be called if there's a reason to update the
     // elements.
     DCHECK(IsDoubleElementsKind(from_kind) != IsDoubleElementsKind(kind()) ||
            IsDictionaryElementsKind(from_kind) ||
            static_cast<uint32_t>(old_elements->length()) < capacity);
     return Subclass::BasicGrowCapacityAndConvertImpl(
-        object, old_elements, from_kind, kind(), capacity);
+        isolate, object, old_elements, from_kind, kind(), capacity);
   }
 
   static Maybe<bool> BasicGrowCapacityAndConvertImpl(
-      DirectHandle<JSObject> object, DirectHandle<FixedArrayBase> old_elements,
-      ElementsKind from_kind, ElementsKind to_kind, uint32_t capacity) {
+      Isolate* isolate, DirectHandle<JSObject> object,
+      DirectHandle<FixedArrayBase> old_elements, ElementsKind from_kind,
+      ElementsKind to_kind, uint32_t capacity) {
     DirectHandle<FixedArrayBase> elements;
     ASSIGN_RETURN_ON_EXCEPTION_VALUE(
-        object->GetIsolate(), elements,
-        ConvertElementsWithCapacity(object, old_elements, from_kind, capacity),
+        isolate, elements,
+        ConvertElementsWithCapacity(isolate, object, old_elements, from_kind,
+                                    capacity),
         Nothing<bool>());
 
     if (IsHoleyElementsKind(from_kind)) {
       to_kind = GetHoleyElementsKind(to_kind);
     }
     DirectHandle<Map> new_map =
-        JSObject::GetElementsTransitionMap(object, to_kind);
+        JSObject::GetElementsTransitionMap(isolate, object, to_kind);
     JSObject::SetMapAndElements(object, new_map, elements);
 
     // Transition through the allocation site as well if present.
-    JSObject::UpdateAllocationSite(object, to_kind);
+    JSObject::UpdateAllocationSite(isolate, object, to_kind);
 
     if (v8_flags.trace_elements_transitions) {
       JSObject::PrintElementsTransition(stdout, object, from_kind, old_elements,
@@ -1047,17 +1057,18 @@ class ElementsAccessorBase : public InternalElementsAccessor {
     return Just(true);
   }
 
-  void TransitionElementsKind(DirectHandle<JSObject> object,
+  void TransitionElementsKind(Isolate* isolate, DirectHandle<JSObject> object,
                               DirectHandle<Map> map) final {
-    Subclass::TransitionElementsKindImpl(object, map);
+    Subclass::TransitionElementsKindImpl(isolate, object, map);
   }
 
-  Maybe<bool> GrowCapacityAndConvert(DirectHandle<JSObject> object,
+  Maybe<bool> GrowCapacityAndConvert(Isolate* isolate,
+                                     DirectHandle<JSObject> object,
                                      uint32_t capacity) final {
-    return Subclass::GrowCapacityAndConvertImpl(object, capacity);
+    return Subclass::GrowCapacityAndConvertImpl(isolate, object, capacity);
   }
 
-  Maybe<bool> GrowCapacity(DirectHandle<JSObject> object,
+  Maybe<bool> GrowCapacity(Isolate* isolate, DirectHandle<JSObject> object,
                            uint32_t index) final {
     // This function is intended to be called from optimized code. We don't
     // want to trigger lazy deopts there, so refuse to handle cases that would.
@@ -1065,8 +1076,7 @@ class ElementsAccessorBase : public InternalElementsAccessor {
         object->WouldConvertToSlowElements(index)) {
       return Just(false);
     }
-    DirectHandle<FixedArrayBase> old_elements(object->elements(),
-                                              object->GetIsolate());
+    DirectHandle<FixedArrayBase> old_elements(object->elements(), isolate);
     uint32_t new_capacity = JSObject::NewElementsCapacity(index + 1);
     DCHECK(static_cast<uint32_t>(old_elements->length()) < new_capacity);
     static_assert(FixedArray::kMaxLength == FixedDoubleArray::kMaxLength);
@@ -1077,14 +1087,15 @@ class ElementsAccessorBase : public InternalElementsAccessor {
     }
     DirectHandle<FixedArrayBase> elements;
     ASSIGN_RETURN_ON_EXCEPTION_VALUE(
-        object->GetIsolate(), elements,
-        ConvertElementsWithCapacity(object, old_elements, kind(), new_capacity),
+        isolate, elements,
+        ConvertElementsWithCapacity(isolate, object, old_elements, kind(),
+                                    new_capacity),
         Nothing<bool>());
 
     DCHECK_EQ(object->GetElementsKind(), kind());
     // Transition through the allocation site as well if present.
     if (JSObject::UpdateAllocationSite<AllocationSiteUpdateMode::kCheckOnly>(
-            object, kind())) {
+            isolate, object, kind())) {
       return Just(false);
     }
 
@@ -1092,8 +1103,9 @@ class ElementsAccessorBase : public InternalElementsAccessor {
     return Just(true);
   }
 
-  void Delete(DirectHandle<JSObject> obj, InternalIndex entry) final {
-    Subclass::DeleteImpl(obj, entry);
+  void Delete(Isolate* isolate, DirectHandle<JSObject> obj,
+              InternalIndex entry) final {
+    Subclass::DeleteImpl(isolate, obj, entry);
   }
 
   static void CopyElementsImpl(Isolate* isolate, Tagged<FixedArrayBase> from,
@@ -1150,27 +1162,28 @@ class ElementsAccessorBase : public InternalElementsAccessor {
     UNREACHABLE();
   }
 
-  Tagged<Object> CopyElements(DirectHandle<JSAny> source,
+  Tagged<Object> CopyElements(Isolate* isolate, DirectHandle<JSAny> source,
                               DirectHandle<JSObject> destination, size_t length,
                               size_t offset) final {
-    return Subclass::CopyElementsHandleImpl(source, destination, length,
-                                            offset);
+    return Subclass::CopyElementsHandleImpl(isolate, source, destination,
+                                            length, offset);
   }
 
   static Tagged<Object> CopyElementsHandleImpl(
-      DirectHandle<Object> source, DirectHandle<JSObject> destination,
-      size_t length, size_t offset) {
+      Isolate* isolate, DirectHandle<Object> source,
+      DirectHandle<JSObject> destination, size_t length, size_t offset) {
     UNREACHABLE();
   }
 
   DirectHandle<NumberDictionary> Normalize(
-      DirectHandle<JSObject> object) final {
-    return Subclass::NormalizeImpl(
-        object, direct_handle(object->elements(), object->GetIsolate()));
+      Isolate* isolate, DirectHandle<JSObject> object) final {
+    return Subclass::NormalizeImpl(isolate, object,
+                                   direct_handle(object->elements(), isolate));
   }
 
   static DirectHandle<NumberDictionary> NormalizeImpl(
-      DirectHandle<JSObject> object, DirectHandle<FixedArrayBase> elements) {
+      Isolate* isolate, DirectHandle<JSObject> object,
+      DirectHandle<FixedArrayBase> elements) {
     UNREACHABLE();
   }
 
@@ -1409,16 +1422,18 @@ class ElementsAccessorBase : public InternalElementsAccessor {
     return Subclass::GetCapacityImpl(holder, backing_store);
   }
 
-  static MaybeDirectHandle<Object> FillImpl(DirectHandle<JSObject> receiver,
+  static MaybeDirectHandle<Object> FillImpl(Isolate* isolate,
+                                            DirectHandle<JSObject> receiver,
                                             DirectHandle<Object> obj_value,
                                             size_t start, size_t end) {
     UNREACHABLE();
   }
 
-  MaybeDirectHandle<Object> Fill(DirectHandle<JSObject> receiver,
+  MaybeDirectHandle<Object> Fill(Isolate* isolate,
+                                 DirectHandle<JSObject> receiver,
                                  DirectHandle<Object> obj_value, size_t start,
                                  size_t end) override {
-    return Subclass::FillImpl(receiver, obj_value, start, end);
+    return Subclass::FillImpl(isolate, receiver, obj_value, start, end);
   }
 
   static Maybe<bool> IncludesValueImpl(Isolate* isolate,
@@ -1612,10 +1627,11 @@ class DictionaryElementsAccessor
     UNREACHABLE();
   }
 
-  static void DeleteImpl(DirectHandle<JSObject> obj, InternalIndex entry) {
+  static void DeleteImpl(Isolate* isolate, DirectHandle<JSObject> obj,
+                         InternalIndex entry) {
     DirectHandle<NumberDictionary> dict(Cast<NumberDictionary>(obj->elements()),
-                                        obj->GetIsolate());
-    dict = NumberDictionary::DeleteEntry(obj->GetIsolate(), dict, entry);
+                                        isolate);
+    dict = NumberDictionary::DeleteEntry(isolate, dict, entry);
     obj->set_elements(*dict);
   }
 
@@ -1685,7 +1701,7 @@ class DictionaryElementsAccessor
         ->ValueAtCompareAndSwap(entry, expected, value, tag);
   }
 
-  static void ReconfigureImpl(DirectHandle<JSObject> object,
+  static void ReconfigureImpl(Isolate* isolate, DirectHandle<JSObject> object,
                               DirectHandle<FixedArrayBase> store,
                               InternalIndex entry, DirectHandle<Object> value,
                               PropertyAttributes attributes) {
@@ -1700,19 +1716,19 @@ class DictionaryElementsAccessor
     dictionary->DetailsAtPut(entry, details);
   }
 
-  static Maybe<bool> AddImpl(DirectHandle<JSObject> object, uint32_t index,
-                             DirectHandle<Object> value,
+  static Maybe<bool> AddImpl(Isolate* isolate, DirectHandle<JSObject> object,
+                             uint32_t index, DirectHandle<Object> value,
                              PropertyAttributes attributes,
                              uint32_t new_capacity) {
     PropertyDetails details(PropertyKind::kData, attributes,
                             PropertyCellType::kNoCell);
     DirectHandle<NumberDictionary> dictionary =
         object->HasFastElements() || object->HasFastStringWrapperElements()
-            ? JSObject::NormalizeElements(object)
+            ? JSObject::NormalizeElements(isolate, object)
             : direct_handle(Cast<NumberDictionary>(object->elements()),
-                            object->GetIsolate());
-    DirectHandle<NumberDictionary> new_dictionary = NumberDictionary::Add(
-        object->GetIsolate(), dictionary, index, value, details);
+                            isolate);
+    DirectHandle<NumberDictionary> new_dictionary =
+        NumberDictionary::Add(isolate, dictionary, index, value, details);
     new_dictionary->UpdateMaxNumberKey(index, object);
     if (attributes != NONE) object->RequireSlowElements(*new_dictionary);
     if (dictionary.is_identical_to(new_dictionary)) return Just(true);
@@ -2034,7 +2050,8 @@ class DictionaryElementsAccessor
     return Just<int64_t>(-1);
   }
 
-  static void ValidateContents(Tagged<JSObject> holder, size_t length) {
+  static void ValidateContents(Isolate* isolate, Tagged<JSObject> holder,
+                               size_t length) {
     DisallowGarbageCollection no_gc;
 #if DEBUG
     DCHECK_EQ(holder->map()->elements_kind(), DICTIONARY_ELEMENTS);
@@ -2072,8 +2089,8 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
   using BackingStore = typename KindTraits::BackingStore;
 
   static DirectHandle<NumberDictionary> NormalizeImpl(
-      DirectHandle<JSObject> object, DirectHandle<FixedArrayBase> store) {
-    Isolate* isolate = object->GetIsolate();
+      Isolate* isolate, DirectHandle<JSObject> object,
+      DirectHandle<FixedArrayBase> store) {
     ElementsKind kind = Subclass::kind();
 
     // Ensure that notifications fire if the array or object prototypes are
@@ -2109,12 +2126,11 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
     return dictionary;
   }
 
-  static void DeleteAtEnd(DirectHandle<JSObject> obj,
+  static void DeleteAtEnd(Isolate* isolate, DirectHandle<JSObject> obj,
                           DirectHandle<BackingStore> backing_store,
                           uint32_t entry) {
     uint32_t length = static_cast<uint32_t>(backing_store->length());
     DCHECK_LT(entry, length);
-    Isolate* isolate = obj->GetIsolate();
     for (; entry > 0; entry--) {
       if (!backing_store->is_the_hole(isolate, entry - 1)) break;
     }
@@ -2133,19 +2149,18 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
     isolate->heap()->RightTrimArray(*backing_store, entry, length);
   }
 
-  static void DeleteCommon(DirectHandle<JSObject> obj, uint32_t entry,
-                           DirectHandle<FixedArrayBase> store) {
+  static void DeleteCommon(Isolate* isolate, DirectHandle<JSObject> obj,
+                           uint32_t entry, DirectHandle<FixedArrayBase> store) {
     DCHECK(obj->HasSmiOrObjectElements() || obj->HasDoubleElements() ||
            obj->HasNonextensibleElements() || obj->HasFastArgumentsElements() ||
            obj->HasFastStringWrapperElements());
     DirectHandle<BackingStore> backing_store = Cast<BackingStore>(store);
     if (!IsJSArray(*obj) &&
         entry == static_cast<uint32_t>(store->length()) - 1) {
-      DeleteAtEnd(obj, backing_store, entry);
+      DeleteAtEnd(isolate, obj, backing_store, entry);
       return;
     }
 
-    Isolate* isolate = obj->GetIsolate();
     backing_store->set_the_hole(isolate, entry);
 
     // TODO(verwaest): Move this out of elements.cc.
@@ -2183,7 +2198,7 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
         if (!backing_store->is_the_hole(isolate, i)) break;
       }
       if (i == length) {
-        DeleteAtEnd(obj, backing_store, entry);
+        DeleteAtEnd(isolate, obj, backing_store, entry);
         return;
       }
     }
@@ -2200,23 +2215,23 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
         }
       }
     }
-    JSObject::NormalizeElements(obj);
+    JSObject::NormalizeElements(isolate, obj);
   }
 
-  static void ReconfigureImpl(DirectHandle<JSObject> object,
+  static void ReconfigureImpl(Isolate* isolate, DirectHandle<JSObject> object,
                               DirectHandle<FixedArrayBase> store,
                               InternalIndex entry, DirectHandle<Object> value,
                               PropertyAttributes attributes) {
     DirectHandle<NumberDictionary> dictionary =
-        JSObject::NormalizeElements(object);
-    entry = InternalIndex(
-        dictionary->FindEntry(object->GetIsolate(), entry.as_uint32()));
+        JSObject::NormalizeElements(isolate, object);
+    entry = InternalIndex(dictionary->FindEntry(isolate, entry.as_uint32()));
     DictionaryElementsAccessor::ReconfigureImpl(
-        object, Cast<FixedArrayBase>(dictionary), entry, value, attributes);
+        isolate, object, Cast<FixedArrayBase>(dictionary), entry, value,
+        attributes);
   }
 
-  static Maybe<bool> AddImpl(DirectHandle<JSObject> object, uint32_t index,
-                             DirectHandle<Object> value,
+  static Maybe<bool> AddImpl(Isolate* isolate, DirectHandle<JSObject> object,
+                             uint32_t index, DirectHandle<Object> value,
                              PropertyAttributes attributes,
                              uint32_t new_capacity) {
     DCHECK_EQ(NONE, attributes);
@@ -2226,33 +2241,36 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
         IsDoubleElementsKind(from_kind) != IsDoubleElementsKind(to_kind) ||
         Subclass::GetCapacityImpl(*object, object->elements()) !=
             new_capacity) {
-      MAYBE_RETURN(Subclass::GrowCapacityAndConvertImpl(object, new_capacity),
-                   Nothing<bool>());
+      MAYBE_RETURN(
+          Subclass::GrowCapacityAndConvertImpl(isolate, object, new_capacity),
+          Nothing<bool>());
     } else {
       if (IsFastElementsKind(from_kind) && from_kind != to_kind) {
-        JSObject::TransitionElementsKind(object, to_kind);
+        JSObject::TransitionElementsKind(isolate, object, to_kind);
       }
       if (IsSmiOrObjectElementsKind(from_kind)) {
         DCHECK(IsSmiOrObjectElementsKind(to_kind));
-        JSObject::EnsureWritableFastElements(object);
+        JSObject::EnsureWritableFastElements(isolate, object);
       }
     }
     Subclass::SetImpl(object, InternalIndex(index), *value);
     return Just(true);
   }
 
-  static void DeleteImpl(DirectHandle<JSObject> obj, InternalIndex entry) {
+  static void DeleteImpl(Isolate* isolate, DirectHandle<JSObject> obj,
+                         InternalIndex entry) {
     ElementsKind kind = KindTraits::Kind;
     if (IsFastPackedElementsKind(kind) ||
         kind == PACKED_NONEXTENSIBLE_ELEMENTS) {
-      JSObject::TransitionElementsKind(obj, GetHoleyElementsKind(kind));
+      JSObject::TransitionElementsKind(isolate, obj,
+                                       GetHoleyElementsKind(kind));
     }
     if (IsSmiOrObjectElementsKind(KindTraits::Kind) ||
         IsNonextensibleElementsKind(kind)) {
-      JSObject::EnsureWritableFastElements(obj);
+      JSObject::EnsureWritableFastElements(isolate, obj);
     }
-    DeleteCommon(obj, entry.as_uint32(),
-                 direct_handle(obj->elements(), obj->GetIsolate()));
+    DeleteCommon(isolate, obj, entry.as_uint32(),
+                 direct_handle(obj->elements(), isolate));
   }
 
   static bool HasEntryImpl(Isolate* isolate,
@@ -2296,9 +2314,9 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
     return ExceptionStatus::kSuccess;
   }
 
-  static void ValidateContents(Tagged<JSObject> holder, size_t length) {
+  static void ValidateContents(Isolate* isolate, Tagged<JSObject> holder,
+                               size_t length) {
 #if DEBUG
-    Isolate* isolate = holder->GetIsolate();
     Heap* heap = isolate->heap();
     Tagged<FixedArrayBase> elements = holder->elements();
     Tagged<Map> map = elements->map();
@@ -2342,29 +2360,31 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
 #endif
   }
 
-  static MaybeDirectHandle<Object> PopImpl(DirectHandle<JSArray> receiver) {
-    return Subclass::RemoveElement(receiver, AT_END);
+  static MaybeDirectHandle<Object> PopImpl(Isolate* isolate,
+                                           DirectHandle<JSArray> receiver) {
+    return Subclass::RemoveElement(isolate, receiver, AT_END);
   }
 
-  static MaybeDirectHandle<Object> ShiftImpl(DirectHandle<JSArray> receiver) {
-    return Subclass::RemoveElement(receiver, AT_START);
+  static MaybeDirectHandle<Object> ShiftImpl(Isolate* isolate,
+                                             DirectHandle<JSArray> receiver) {
+    return Subclass::RemoveElement(isolate, receiver, AT_START);
   }
 
-  static Maybe<uint32_t> PushImpl(DirectHandle<JSArray> receiver,
+  static Maybe<uint32_t> PushImpl(Isolate* isolate,
+                                  DirectHandle<JSArray> receiver,
                                   BuiltinArguments* args, uint32_t push_size) {
-    DirectHandle<FixedArrayBase> backing_store(receiver->elements(),
-                                               receiver->GetIsolate());
-    return Subclass::AddArguments(receiver, backing_store, args, push_size,
-                                  AT_END);
+    DirectHandle<FixedArrayBase> backing_store(receiver->elements(), isolate);
+    return Subclass::AddArguments(isolate, receiver, backing_store, args,
+                                  push_size, AT_END);
   }
 
-  static Maybe<uint32_t> UnshiftImpl(DirectHandle<JSArray> receiver,
+  static Maybe<uint32_t> UnshiftImpl(Isolate* isolate,
+                                     DirectHandle<JSArray> receiver,
                                      BuiltinArguments* args,
                                      uint32_t unshift_size) {
-    DirectHandle<FixedArrayBase> backing_store(receiver->elements(),
-                                               receiver->GetIsolate());
-    return Subclass::AddArguments(receiver, backing_store, args, unshift_size,
-                                  AT_START);
+    DirectHandle<FixedArrayBase> backing_store(receiver->elements(), isolate);
+    return Subclass::AddArguments(isolate, receiver, backing_store, args,
+                                  unshift_size, AT_START);
   }
 
   static DirectHandle<FixedArrayBase> MoveElements(
@@ -2395,7 +2415,8 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
     return backing_store;
   }
 
-  static MaybeDirectHandle<Object> FillImpl(DirectHandle<JSObject> receiver,
+  static MaybeDirectHandle<Object> FillImpl(Isolate* isolate,
+                                            DirectHandle<JSObject> receiver,
                                             DirectHandle<Object> obj_value,
                                             size_t start, size_t end) {
     // Ensure indexes are within array bounds
@@ -2404,14 +2425,14 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
 
     // Make sure COW arrays are copied.
     if (IsSmiOrObjectElementsKind(Subclass::kind())) {
-      JSObject::EnsureWritableFastElements(receiver);
+      JSObject::EnsureWritableFastElements(isolate, receiver);
     }
 
     // Make sure we have enough space.
     DCHECK_LE(end, std::numeric_limits<uint32_t>::max());
     if (end > Subclass::GetCapacityImpl(*receiver, receiver->elements())) {
       MAYBE_RETURN_NULL(Subclass::GrowCapacityAndConvertImpl(
-          receiver, static_cast<uint32_t>(end)));
+          isolate, receiver, static_cast<uint32_t>(end)));
       CHECK_EQ(Subclass::kind(), receiver->GetElementsKind());
     }
     DCHECK_LE(end, Subclass::GetCapacityImpl(*receiver, receiver->elements()));
@@ -2581,13 +2602,13 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
     return result;
   }
 
-  static MaybeDirectHandle<Object> RemoveElement(DirectHandle<JSArray> receiver,
+  static MaybeDirectHandle<Object> RemoveElement(Isolate* isolate,
+                                                 DirectHandle<JSArray> receiver,
                                                  Where remove_position) {
-    Isolate* isolate = receiver->GetIsolate();
     ElementsKind kind = KindTraits::Kind;
     if (IsSmiOrObjectElementsKind(kind)) {
       HandleScope scope(isolate);
-      JSObject::EnsureWritableFastElements(receiver);
+      JSObject::EnsureWritableFastElements(isolate, receiver);
     }
     DirectHandle<FixedArrayBase> backing_store(receiver->elements(), isolate);
     uint32_t length = static_cast<uint32_t>(Smi::ToInt(receiver->length()));
@@ -2610,7 +2631,7 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
   }
 
   static Maybe<uint32_t> AddArguments(
-      DirectHandle<JSArray> receiver,
+      Isolate* isolate, DirectHandle<JSArray> receiver,
       DirectHandle<FixedArrayBase> backing_store, BuiltinArguments* args,
       uint32_t add_size, Where add_position) {
     uint32_t length = Smi::ToInt(receiver->length());
@@ -2619,7 +2640,6 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
     // Check we do not overflow the new_length.
     DCHECK(add_size <= static_cast<uint32_t>(Smi::kMaxValue - length));
     uint32_t new_length = length + add_size;
-    Isolate* isolate = receiver->GetIsolate();
 
     if (new_length > elms_len) {
       // New backing storage is needed.
@@ -2629,9 +2649,9 @@ class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
       // Copy over all objects to a new backing_store.
       ASSIGN_RETURN_ON_EXCEPTION_VALUE(
           isolate, backing_store,
-          Subclass::ConvertElementsWithCapacity(receiver, backing_store,
-                                                KindTraits::Kind, capacity, 0,
-                                                copy_dst_index),
+          Subclass::ConvertElementsWithCapacity(isolate, receiver,
+                                                backing_store, KindTraits::Kind,
+                                                capacity, 0, copy_dst_index),
           Nothing<uint32_t>());
       receiver->set_elements(*backing_store);
     } else if (add_position == AT_START) {
@@ -2839,13 +2859,14 @@ class FastNonextensibleObjectElementsAccessor
  public:
   using BackingStore = typename KindTraits::BackingStore;
 
-  static Maybe<uint32_t> PushImpl(DirectHandle<JSArray> receiver,
+  static Maybe<uint32_t> PushImpl(Isolate* isolate,
+                                  DirectHandle<JSArray> receiver,
                                   BuiltinArguments* args, uint32_t push_size) {
     UNREACHABLE();
   }
 
-  static Maybe<bool> AddImpl(DirectHandle<JSObject> object, uint32_t index,
-                             DirectHandle<Object> value,
+  static Maybe<bool> AddImpl(Isolate* isolate, DirectHandle<JSObject> object,
+                             uint32_t index, DirectHandle<Object> value,
                              PropertyAttributes attributes,
                              uint32_t new_capacity) {
     UNREACHABLE();
@@ -2867,8 +2888,9 @@ class FastNonextensibleObjectElementsAccessor
     // Transition to DICTIONARY_ELEMENTS.
     // Convert to dictionary mode.
     DirectHandle<NumberDictionary> new_element_dictionary =
-        old_length == 0 ? isolate->factory()->empty_slow_element_dictionary()
-                        : array->GetElementsAccessor()->Normalize(array);
+        old_length == 0
+            ? isolate->factory()->empty_slow_element_dictionary()
+            : array->GetElementsAccessor()->Normalize(isolate, array);
 
     // Migrate map.
     DirectHandle<Map> new_map =
@@ -2916,37 +2938,41 @@ class FastSealedObjectElementsAccessor
  public:
   using BackingStore = typename KindTraits::BackingStore;
 
-  static DirectHandle<Object> RemoveElement(DirectHandle<JSArray> receiver,
+  static DirectHandle<Object> RemoveElement(Isolate* isolate,
+                                            DirectHandle<JSArray> receiver,
                                             Where remove_position) {
     UNREACHABLE();
   }
 
-  static void DeleteImpl(DirectHandle<JSObject> obj, InternalIndex entry) {
+  static void DeleteImpl(Isolate* isolate, DirectHandle<JSObject> obj,
+                         InternalIndex entry) {
     UNREACHABLE();
   }
 
-  static void DeleteAtEnd(DirectHandle<JSObject> obj,
+  static void DeleteAtEnd(Isolate* isolate, DirectHandle<JSObject> obj,
                           DirectHandle<BackingStore> backing_store,
                           uint32_t entry) {
     UNREACHABLE();
   }
 
-  static void DeleteCommon(DirectHandle<JSObject> obj, uint32_t entry,
-                           DirectHandle<FixedArrayBase> store) {
+  static void DeleteCommon(Isolate* isolate, DirectHandle<JSObject> obj,
+                           uint32_t entry, DirectHandle<FixedArrayBase> store) {
     UNREACHABLE();
   }
 
-  static MaybeDirectHandle<Object> PopImpl(DirectHandle<JSArray> receiver) {
+  static MaybeDirectHandle<Object> PopImpl(Isolate* isolate,
+                                           DirectHandle<JSArray> receiver) {
     UNREACHABLE();
   }
 
-  static Maybe<uint32_t> PushImpl(DirectHandle<JSArray> receiver,
+  static Maybe<uint32_t> PushImpl(Isolate* isolate,
+                                  DirectHandle<JSArray> receiver,
                                   BuiltinArguments* args, uint32_t push_size) {
     UNREACHABLE();
   }
 
-  static Maybe<bool> AddImpl(DirectHandle<JSObject> object, uint32_t index,
-                             DirectHandle<Object> value,
+  static Maybe<bool> AddImpl(Isolate* isolate, DirectHandle<JSObject> object,
+                             uint32_t index, DirectHandle<Object> value,
                              PropertyAttributes attributes,
                              uint32_t new_capacity) {
     UNREACHABLE();
@@ -2968,8 +2994,9 @@ class FastSealedObjectElementsAccessor
     // Transition to DICTIONARY_ELEMENTS.
     // Convert to dictionary mode
     DirectHandle<NumberDictionary> new_element_dictionary =
-        old_length == 0 ? isolate->factory()->empty_slow_element_dictionary()
-                        : array->GetElementsAccessor()->Normalize(array);
+        old_length == 0
+            ? isolate->factory()->empty_slow_element_dictionary()
+            : array->GetElementsAccessor()->Normalize(isolate, array);
 
     // Migrate map.
     DirectHandle<Map> new_map =
@@ -3067,37 +3094,41 @@ class FastFrozenObjectElementsAccessor
     UNREACHABLE();
   }
 
-  static DirectHandle<Object> RemoveElement(DirectHandle<JSArray> receiver,
+  static DirectHandle<Object> RemoveElement(Isolate* isolate,
+                                            DirectHandle<JSArray> receiver,
                                             Where remove_position) {
     UNREACHABLE();
   }
 
-  static void DeleteImpl(DirectHandle<JSObject> obj, InternalIndex entry) {
+  static void DeleteImpl(Isolate* isolate, DirectHandle<JSObject> obj,
+                         InternalIndex entry) {
     UNREACHABLE();
   }
 
-  static void DeleteAtEnd(DirectHandle<JSObject> obj,
+  static void DeleteAtEnd(Isolate* isolate, DirectHandle<JSObject> obj,
                           DirectHandle<BackingStore> backing_store,
                           uint32_t entry) {
     UNREACHABLE();
   }
 
-  static void DeleteCommon(DirectHandle<JSObject> obj, uint32_t entry,
-                           DirectHandle<FixedArrayBase> store) {
+  static void DeleteCommon(Isolate* isolate, DirectHandle<JSObject> obj,
+                           uint32_t entry, DirectHandle<FixedArrayBase> store) {
     UNREACHABLE();
   }
 
-  static MaybeDirectHandle<Object> PopImpl(DirectHandle<JSArray> receiver) {
+  static MaybeDirectHandle<Object> PopImpl(Isolate* isolate,
+                                           DirectHandle<JSArray> receiver) {
     UNREACHABLE();
   }
 
-  static Maybe<uint32_t> PushImpl(DirectHandle<JSArray> receiver,
+  static Maybe<uint32_t> PushImpl(Isolate* isolate,
+                                  DirectHandle<JSArray> receiver,
                                   BuiltinArguments* args, uint32_t push_size) {
     UNREACHABLE();
   }
 
-  static Maybe<bool> AddImpl(DirectHandle<JSObject> object, uint32_t index,
-                             DirectHandle<Object> value,
+  static Maybe<bool> AddImpl(Isolate* isolate, DirectHandle<JSObject> object,
+                             uint32_t index, DirectHandle<Object> value,
                              PropertyAttributes attributes,
                              uint32_t new_capacity) {
     UNREACHABLE();
@@ -3109,7 +3140,7 @@ class FastFrozenObjectElementsAccessor
     UNREACHABLE();
   }
 
-  static void ReconfigureImpl(DirectHandle<JSObject> object,
+  static void ReconfigureImpl(Isolate* isolate, DirectHandle<JSObject> object,
                               DirectHandle<FixedArrayBase> store,
                               InternalIndex entry, DirectHandle<Object> value,
                               PropertyAttributes attributes) {
@@ -3498,7 +3529,8 @@ class TypedElementsAccessor
     UNREACHABLE();
   }
 
-  static void DeleteImpl(DirectHandle<JSObject> obj, InternalIndex entry) {
+  static void DeleteImpl(Isolate* isolate, DirectHandle<JSObject> obj,
+                         InternalIndex entry) {
     // Do nothing.
     //
     // TypedArray elements are configurable to explain detaching, but cannot be
@@ -3529,7 +3561,7 @@ class TypedElementsAccessor
   V8_WARN_UNUSED_RESULT static ExceptionStatus AddElementsToKeyAccumulatorImpl(
       DirectHandle<JSObject> receiver, KeyAccumulator* accumulator,
       AddKeyConversion convert) {
-    Isolate* isolate = receiver->GetIsolate();
+    Isolate* isolate = accumulator->isolate();
     DirectHandle<FixedArrayBase> elements(receiver->elements(), isolate);
     size_t length = AccessorClass::GetCapacityImpl(*receiver, *elements);
     for (size_t i = 0; i < length; i++) {
@@ -3581,7 +3613,8 @@ class TypedElementsAccessor
            search_value;  // Loss of precision.
   }
 
-  static MaybeDirectHandle<Object> FillImpl(DirectHandle<JSObject> receiver,
+  static MaybeDirectHandle<Object> FillImpl(Isolate* isolate,
+                                            DirectHandle<JSObject> receiver,
                                             DirectHandle<Object> value,
                                             size_t start, size_t end) {
     DirectHandle<JSTypedArray> typed_array = Cast<JSTypedArray>(receiver);
@@ -4188,9 +4221,8 @@ class TypedElementsAccessor
   // filled. The caller must do this by passing a source with equal length, if
   // that is required.
   static Tagged<Object> CopyElementsHandleImpl(
-      DirectHandle<JSAny> source, DirectHandle<JSObject> destination,
-      size_t length, size_t offset) {
-    Isolate* isolate = destination->GetIsolate();
+      Isolate* isolate, DirectHandle<JSAny> source,
+      DirectHandle<JSObject> destination, size_t length, size_t offset) {
     if (length == 0) return *isolate->factory()->undefined_value();
 
     DirectHandle<JSTypedArray> destination_ta = Cast<JSTypedArray>(destination);
@@ -4807,8 +4839,8 @@ class SloppyArgumentsElementsAccessor
       DCHECK(!IsTheHole(probe, isolate));
       Tagged<Context> context = elements->context();
       int context_entry = Smi::ToInt(probe);
-      DCHECK(!IsTheHole(context->get(context_entry), isolate));
-      return handle(context->get(context_entry), isolate);
+      DCHECK(!IsTheHole(context->GetNoCell(context_entry), isolate));
+      return handle(context->GetNoCell(context_entry), isolate);
     } else {
       // Entry is not context mapped, defer to the arguments.
       Handle<Object> result = ArgumentsAccessor::GetImpl(
@@ -4817,12 +4849,14 @@ class SloppyArgumentsElementsAccessor
     }
   }
 
-  static void TransitionElementsKindImpl(DirectHandle<JSObject> object,
+  static void TransitionElementsKindImpl(Isolate* isolate,
+                                         DirectHandle<JSObject> object,
                                          DirectHandle<Map> map) {
     UNREACHABLE();
   }
 
-  static Maybe<bool> GrowCapacityAndConvertImpl(DirectHandle<JSObject> object,
+  static Maybe<bool> GrowCapacityAndConvertImpl(Isolate* isolate,
+                                                DirectHandle<JSObject> object,
                                                 uint32_t capacity) {
     UNREACHABLE();
   }
@@ -4845,8 +4879,8 @@ class SloppyArgumentsElementsAccessor
       DCHECK(!IsTheHole(probe));
       Tagged<Context> context = Cast<Context>(elements->context());
       int context_entry = Smi::ToInt(probe);
-      DCHECK(!IsTheHole(context->get(context_entry)));
-      context->set(context_entry, value);
+      DCHECK(!IsTheHole(context->GetNoCell(context_entry)));
+      context->SetNoCell(context_entry, value);
     } else {
       //  Entry is not context mapped defer to arguments.
       Tagged<FixedArray> arguments = elements->arguments();
@@ -4857,8 +4891,8 @@ class SloppyArgumentsElementsAccessor
             Cast<AliasedArgumentsEntry>(current);
         Tagged<Context> context = Cast<Context>(elements->context());
         int context_entry = alias->aliased_context_slot();
-        DCHECK(!IsTheHole(context->get(context_entry)));
-        context->set(context_entry, value);
+        DCHECK(!IsTheHole(context->GetNoCell(context_entry)));
+        context->SetNoCell(context_entry, value);
       } else {
         ArgumentsAccessor::SetImpl(arguments, entry.adjust_down(length), value);
       }
@@ -4987,15 +5021,16 @@ class SloppyArgumentsElementsAccessor
         isolate);
   }
 
-  static void DeleteImpl(DirectHandle<JSObject> obj, InternalIndex entry) {
+  static void DeleteImpl(Isolate* isolate, DirectHandle<JSObject> obj,
+                         InternalIndex entry) {
     DirectHandle<SloppyArgumentsElements> elements(
-        Cast<SloppyArgumentsElements>(obj->elements()), obj->GetIsolate());
+        Cast<SloppyArgumentsElements>(obj->elements()), isolate);
     uint32_t length = elements->length();
     InternalIndex delete_or_entry = entry;
     if (entry.as_uint32() < length) {
       delete_or_entry = InternalIndex::NotFound();
     }
-    Subclass::SloppyDeleteImpl(obj, elements, delete_or_entry);
+    Subclass::SloppyDeleteImpl(isolate, obj, elements, delete_or_entry);
     // SloppyDeleteImpl allocates a new dictionary elements store. For making
     // heap verification happy we postpone clearing out the mapped entry.
     if (entry.as_uint32() < length) {
@@ -5004,7 +5039,7 @@ class SloppyArgumentsElementsAccessor
     }
   }
 
-  static void SloppyDeleteImpl(DirectHandle<JSObject> obj,
+  static void SloppyDeleteImpl(Isolate* isolate, DirectHandle<JSObject> obj,
                                DirectHandle<SloppyArgumentsElements> elements,
                                InternalIndex entry) {
     // Implemented in subclasses.
@@ -5157,17 +5192,16 @@ class SlowSloppyArgumentsElementsAccessor
           Cast<AliasedArgumentsEntry>(*result);
       Tagged<Context> context = elements->context();
       int context_entry = alias->aliased_context_slot();
-      DCHECK(!IsTheHole(context->get(context_entry), isolate));
-      return handle(context->get(context_entry), isolate);
+      DCHECK(!IsTheHole(context->GetNoCell(context_entry), isolate));
+      return handle(context->GetNoCell(context_entry), isolate);
     }
     return result;
   }
-  static void SloppyDeleteImpl(DirectHandle<JSObject> obj,
+  static void SloppyDeleteImpl(Isolate* isolate, DirectHandle<JSObject> obj,
                                DirectHandle<SloppyArgumentsElements> elements,
                                InternalIndex entry) {
     // No need to delete a context mapped entry from the arguments elements.
     if (entry.is_not_found()) return;
-    Isolate* isolate = obj->GetIsolate();
     DirectHandle<NumberDictionary> dict(
         Cast<NumberDictionary>(elements->arguments()), isolate);
     uint32_t length = elements->length();
@@ -5175,18 +5209,17 @@ class SlowSloppyArgumentsElementsAccessor
         NumberDictionary::DeleteEntry(isolate, dict, entry.adjust_down(length));
     elements->set_arguments(*dict);
   }
-  static Maybe<bool> AddImpl(DirectHandle<JSObject> object, uint32_t index,
-                             DirectHandle<Object> value,
+  static Maybe<bool> AddImpl(Isolate* isolate, DirectHandle<JSObject> object,
+                             uint32_t index, DirectHandle<Object> value,
                              PropertyAttributes attributes,
                              uint32_t new_capacity) {
-    Isolate* isolate = object->GetIsolate();
     DirectHandle<SloppyArgumentsElements> elements(
         Cast<SloppyArgumentsElements>(object->elements()), isolate);
     DirectHandle<FixedArrayBase> old_arguments(elements->arguments(), isolate);
     DirectHandle<NumberDictionary> dictionary =
         IsNumberDictionary(*old_arguments)
             ? Cast<NumberDictionary>(old_arguments)
-            : JSObject::NormalizeElements(object);
+            : JSObject::NormalizeElements(isolate, object);
     PropertyDetails details(PropertyKind::kData, attributes,
                             PropertyCellType::kNoCell);
     DirectHandle<NumberDictionary> new_dictionary =
@@ -5198,11 +5231,10 @@ class SlowSloppyArgumentsElementsAccessor
     return Just(true);
   }
 
-  static void ReconfigureImpl(DirectHandle<JSObject> object,
+  static void ReconfigureImpl(Isolate* isolate, DirectHandle<JSObject> object,
                               DirectHandle<FixedArrayBase> store,
                               InternalIndex entry, DirectHandle<Object> value,
                               PropertyAttributes attributes) {
-    Isolate* isolate = object->GetIsolate();
     auto elements = Cast<SloppyArgumentsElements>(store);
     uint32_t length = elements->length();
     if (entry.as_uint32() < length) {
@@ -5211,8 +5243,8 @@ class SlowSloppyArgumentsElementsAccessor
       DCHECK(!IsTheHole(probe, isolate));
       Tagged<Context> context = elements->context();
       int context_entry = Smi::ToInt(probe);
-      DCHECK(!IsTheHole(context->get(context_entry), isolate));
-      context->set(context_entry, *value);
+      DCHECK(!IsTheHole(context->GetNoCell(context_entry), isolate));
+      context->SetNoCell(context_entry, *value);
 
       // Redefining attributes of an aliased element destroys fast aliasing.
       elements->set_mapped_entries(entry.as_uint32(),
@@ -5235,8 +5267,9 @@ class SlowSloppyArgumentsElementsAccessor
       elements->set_arguments(*arguments);
     } else {
       DirectHandle<FixedArrayBase> arguments(elements->arguments(), isolate);
-      DictionaryElementsAccessor::ReconfigureImpl(
-          object, arguments, entry.adjust_down(length), value, attributes);
+      DictionaryElementsAccessor::ReconfigureImpl(isolate, object, arguments,
+                                                  entry.adjust_down(length),
+                                                  value, attributes);
     }
   }
 };
@@ -5261,51 +5294,50 @@ class FastSloppyArgumentsElementsAccessor
   }
 
   static DirectHandle<NumberDictionary> NormalizeImpl(
-      DirectHandle<JSObject> object, DirectHandle<FixedArrayBase> elements) {
-    DirectHandle<FixedArray> arguments =
-        GetArguments(object->GetIsolate(), *elements);
-    return FastHoleyObjectElementsAccessor::NormalizeImpl(object, arguments);
+      Isolate* isolate, DirectHandle<JSObject> object,
+      DirectHandle<FixedArrayBase> elements) {
+    DirectHandle<FixedArray> arguments = GetArguments(isolate, *elements);
+    return FastHoleyObjectElementsAccessor::NormalizeImpl(isolate, object,
+                                                          arguments);
   }
 
   static DirectHandle<NumberDictionary> NormalizeArgumentsElements(
-      DirectHandle<JSObject> object,
+      Isolate* isolate, DirectHandle<JSObject> object,
       DirectHandle<SloppyArgumentsElements> elements, InternalIndex* entry) {
     DirectHandle<NumberDictionary> dictionary =
-        JSObject::NormalizeElements(object);
+        JSObject::NormalizeElements(isolate, object);
     elements->set_arguments(*dictionary);
     // kMaxUInt32 indicates that a context mapped element got deleted. In this
     // case we only normalize the elements (aka. migrate to SLOW_SLOPPY).
     if (entry->is_not_found()) return dictionary;
     uint32_t length = elements->length();
     if (entry->as_uint32() >= length) {
-      *entry =
-          dictionary
-              ->FindEntry(object->GetIsolate(), entry->as_uint32() - length)
-              .adjust_up(length);
+      *entry = dictionary->FindEntry(isolate, entry->as_uint32() - length)
+                   .adjust_up(length);
     }
     return dictionary;
   }
 
-  static void SloppyDeleteImpl(DirectHandle<JSObject> obj,
+  static void SloppyDeleteImpl(Isolate* isolate, DirectHandle<JSObject> obj,
                                DirectHandle<SloppyArgumentsElements> elements,
                                InternalIndex entry) {
     // Always normalize element on deleting an entry.
-    NormalizeArgumentsElements(obj, elements, &entry);
-    SlowSloppyArgumentsElementsAccessor::SloppyDeleteImpl(obj, elements, entry);
+    NormalizeArgumentsElements(isolate, obj, elements, &entry);
+    SlowSloppyArgumentsElementsAccessor::SloppyDeleteImpl(isolate, obj,
+                                                          elements, entry);
   }
 
-  static Maybe<bool> AddImpl(DirectHandle<JSObject> object, uint32_t index,
-                             DirectHandle<Object> value,
+  static Maybe<bool> AddImpl(Isolate* isolate, DirectHandle<JSObject> object,
+                             uint32_t index, DirectHandle<Object> value,
                              PropertyAttributes attributes,
                              uint32_t new_capacity) {
     DCHECK_EQ(NONE, attributes);
-    Isolate* isolate = object->GetIsolate();
     DirectHandle<SloppyArgumentsElements> elements(
         Cast<SloppyArgumentsElements>(object->elements()), isolate);
     DirectHandle<FixedArray> old_arguments(elements->arguments(), isolate);
     if (IsNumberDictionary(*old_arguments) ||
         static_cast<uint32_t>(old_arguments->length()) < new_capacity) {
-      MAYBE_RETURN(GrowCapacityAndConvertImpl(object, new_capacity),
+      MAYBE_RETURN(GrowCapacityAndConvertImpl(isolate, object, new_capacity),
                    Nothing<bool>());
     }
     Tagged<FixedArray> arguments = elements->arguments();
@@ -5319,16 +5351,16 @@ class FastSloppyArgumentsElementsAccessor
     return Just(true);
   }
 
-  static void ReconfigureImpl(DirectHandle<JSObject> object,
+  static void ReconfigureImpl(Isolate* isolate, DirectHandle<JSObject> object,
                               DirectHandle<FixedArrayBase> store,
                               InternalIndex entry, DirectHandle<Object> value,
                               PropertyAttributes attributes) {
     DCHECK_EQ(object->elements(), *store);
     DirectHandle<SloppyArgumentsElements> elements(
-        Cast<SloppyArgumentsElements>(*store), object->GetIsolate());
-    NormalizeArgumentsElements(object, elements, &entry);
-    SlowSloppyArgumentsElementsAccessor::ReconfigureImpl(object, store, entry,
-                                                         value, attributes);
+        Cast<SloppyArgumentsElements>(*store), isolate);
+    NormalizeArgumentsElements(isolate, object, elements, &entry);
+    SlowSloppyArgumentsElementsAccessor::ReconfigureImpl(
+        isolate, object, store, entry, value, attributes);
   }
 
   static void CopyElementsImpl(Isolate* isolate, Tagged<FixedArrayBase> from,
@@ -5346,9 +5378,9 @@ class FastSloppyArgumentsElementsAccessor
     }
   }
 
-  static Maybe<bool> GrowCapacityAndConvertImpl(DirectHandle<JSObject> object,
+  static Maybe<bool> GrowCapacityAndConvertImpl(Isolate* isolate,
+                                                DirectHandle<JSObject> object,
                                                 uint32_t capacity) {
-    Isolate* isolate = object->GetIsolate();
     DirectHandle<SloppyArgumentsElements> elements(
         Cast<SloppyArgumentsElements>(object->elements()), isolate);
     DirectHandle<FixedArray> old_arguments(
@@ -5361,13 +5393,14 @@ class FastSloppyArgumentsElementsAccessor
     DirectHandle<FixedArrayBase> arguments;
     ASSIGN_RETURN_ON_EXCEPTION_VALUE(
         isolate, arguments,
-        ConvertElementsWithCapacity(object, old_arguments, from_kind, capacity),
+        ConvertElementsWithCapacity(isolate, object, old_arguments, from_kind,
+                                    capacity),
         Nothing<bool>());
     DirectHandle<Map> new_map = JSObject::GetElementsTransitionMap(
-        object, FAST_SLOPPY_ARGUMENTS_ELEMENTS);
+        isolate, object, FAST_SLOPPY_ARGUMENTS_ELEMENTS);
     JSObject::MigrateToMap(isolate, object, new_map);
     elements->set_arguments(Cast<FixedArray>(*arguments));
-    JSObject::ValidateElements(*object);
+    JSObject::ValidateElements(isolate, *object);
     return Just(true);
   }
 };
@@ -5379,12 +5412,11 @@ class StringWrapperElementsAccessor
   static Handle<Object> GetInternalImpl(Isolate* isolate,
                                         DirectHandle<JSObject> holder,
                                         InternalIndex entry) {
-    return GetImpl(holder, entry);
+    return GetImpl(isolate, holder, entry);
   }
 
-  static Handle<Object> GetImpl(DirectHandle<JSObject> holder,
+  static Handle<Object> GetImpl(Isolate* isolate, DirectHandle<JSObject> holder,
                                 InternalIndex entry) {
-    Isolate* isolate = holder->GetIsolate();
     DirectHandle<String> string(GetString(*holder), isolate);
     uint32_t length = static_cast<uint32_t>(string->length());
     if (entry.as_uint32() < length) {
@@ -5427,12 +5459,14 @@ class StringWrapperElementsAccessor
     return backing_store_entry.adjust_up(length);
   }
 
-  static void DeleteImpl(DirectHandle<JSObject> holder, InternalIndex entry) {
+  static void DeleteImpl(Isolate* isolate, DirectHandle<JSObject> holder,
+                         InternalIndex entry) {
     uint32_t length = static_cast<uint32_t>(GetString(*holder)->length());
     if (entry.as_uint32() < length) {
       return;  // String contents can't be deleted.
     }
-    BackingStoreAccessor::DeleteImpl(holder, entry.adjust_down(length));
+    BackingStoreAccessor::DeleteImpl(isolate, holder,
+                                     entry.adjust_down(length));
   }
 
   static void SetImpl(DirectHandle<JSObject> holder, InternalIndex entry,
@@ -5445,8 +5479,8 @@ class StringWrapperElementsAccessor
                                   value);
   }
 
-  static Maybe<bool> AddImpl(DirectHandle<JSObject> object, uint32_t index,
-                             DirectHandle<Object> value,
+  static Maybe<bool> AddImpl(Isolate* isolate, DirectHandle<JSObject> object,
+                             uint32_t index, DirectHandle<Object> value,
                              PropertyAttributes attributes,
                              uint32_t new_capacity) {
     DCHECK(index >= static_cast<uint32_t>(GetString(*object)->length()));
@@ -5456,15 +5490,15 @@ class StringWrapperElementsAccessor
         (object->GetElementsKind() == SLOW_STRING_WRAPPER_ELEMENTS ||
          BackingStoreAccessor::GetCapacityImpl(*object, object->elements()) !=
              new_capacity)) {
-      MAYBE_RETURN(GrowCapacityAndConvertImpl(object, new_capacity),
+      MAYBE_RETURN(GrowCapacityAndConvertImpl(isolate, object, new_capacity),
                    Nothing<bool>());
     }
-    BackingStoreAccessor::AddImpl(object, index, value, attributes,
+    BackingStoreAccessor::AddImpl(isolate, object, index, value, attributes,
                                   new_capacity);
     return Just(true);
   }
 
-  static void ReconfigureImpl(DirectHandle<JSObject> object,
+  static void ReconfigureImpl(Isolate* isolate, DirectHandle<JSObject> object,
                               DirectHandle<FixedArrayBase> store,
                               InternalIndex entry, DirectHandle<Object> value,
                               PropertyAttributes attributes) {
@@ -5473,13 +5507,13 @@ class StringWrapperElementsAccessor
       return;  // String contents can't be reconfigured.
     }
     BackingStoreAccessor::ReconfigureImpl(
-        object, store, entry.adjust_down(length), value, attributes);
+        isolate, object, store, entry.adjust_down(length), value, attributes);
   }
 
   V8_WARN_UNUSED_RESULT static ExceptionStatus AddElementsToKeyAccumulatorImpl(
       DirectHandle<JSObject> receiver, KeyAccumulator* accumulator,
       AddKeyConversion convert) {
-    Isolate* isolate = receiver->GetIsolate();
+    Isolate* isolate = accumulator->isolate();
     DirectHandle<String> string(GetString(*receiver), isolate);
     string = String::Flatten(isolate, string);
     uint32_t length = static_cast<uint32_t>(string->length());
@@ -5506,24 +5540,24 @@ class StringWrapperElementsAccessor
                                                            backing_store, keys);
   }
 
-  static Maybe<bool> GrowCapacityAndConvertImpl(DirectHandle<JSObject> object,
+  static Maybe<bool> GrowCapacityAndConvertImpl(Isolate* isolate,
+                                                DirectHandle<JSObject> object,
                                                 uint32_t capacity) {
-    DirectHandle<FixedArrayBase> old_elements(object->elements(),
-                                              object->GetIsolate());
+    DirectHandle<FixedArrayBase> old_elements(object->elements(), isolate);
     ElementsKind from_kind = object->GetElementsKind();
     if (from_kind == FAST_STRING_WRAPPER_ELEMENTS) {
       // The optimizing compiler relies on the prototype lookups of String
       // objects always returning undefined. If there's a store to the
       // initial String.prototype object, make sure all the optimizations
       // are invalidated.
-      object->GetIsolate()->UpdateNoElementsProtectorOnSetLength(object);
+      isolate->UpdateNoElementsProtectorOnSetLength(object);
     }
     // This method should only be called if there's a reason to update the
     // elements.
     DCHECK(from_kind == SLOW_STRING_WRAPPER_ELEMENTS ||
            static_cast<uint32_t>(old_elements->length()) < capacity);
     return Subclass::BasicGrowCapacityAndConvertImpl(
-        object, old_elements, from_kind, FAST_STRING_WRAPPER_ELEMENTS,
+        isolate, object, old_elements, from_kind, FAST_STRING_WRAPPER_ELEMENTS,
         capacity);
   }
 
@@ -5565,8 +5599,10 @@ class FastStringWrapperElementsAccessor
           ElementsKindTraits<FAST_STRING_WRAPPER_ELEMENTS>> {
  public:
   static DirectHandle<NumberDictionary> NormalizeImpl(
-      DirectHandle<JSObject> object, DirectHandle<FixedArrayBase> elements) {
-    return FastHoleyObjectElementsAccessor::NormalizeImpl(object, elements);
+      Isolate* isolate, DirectHandle<JSObject> object,
+      DirectHandle<FixedArrayBase> elements) {
+    return FastHoleyObjectElementsAccessor::NormalizeImpl(isolate, object,
+                                                          elements);
   }
 };
 
@@ -5584,43 +5620,43 @@ class SlowStringWrapperElementsAccessor
 }  // namespace
 
 MaybeDirectHandle<Object> ArrayConstructInitializeElements(
-    DirectHandle<JSArray> array, JavaScriptArguments* args) {
+    Isolate* isolate, DirectHandle<JSArray> array, JavaScriptArguments* args) {
   if (args->length() == 0) {
     // Optimize the case where there are no parameters passed.
-    JSArray::Initialize(array, JSArray::kPreallocatedArrayElements);
+    JSArray::Initialize(isolate, array, JSArray::kPreallocatedArrayElements);
     return array;
 
   } else if (args->length() == 1 && IsNumber(*args->at(0))) {
     uint32_t length;
     if (!Object::ToArrayLength(*args->at(0), &length)) {
-      return ThrowArrayLengthRangeError(array->GetIsolate());
+      return ThrowArrayLengthRangeError(isolate);
     }
 
     // Optimize the case where there is one argument and the argument is a small
     // smi.
     if (length > 0 && length < JSArray::kInitialMaxFastElementArray) {
       ElementsKind elements_kind = array->GetElementsKind();
-      JSArray::Initialize(array, length, length);
+      JSArray::Initialize(isolate, array, length, length);
 
       if (!IsHoleyElementsKind(elements_kind)) {
         elements_kind = GetHoleyElementsKind(elements_kind);
-        JSObject::TransitionElementsKind(array, elements_kind);
+        JSObject::TransitionElementsKind(isolate, array, elements_kind);
       }
     } else if (length == 0) {
-      JSArray::Initialize(array, JSArray::kPreallocatedArrayElements);
+      JSArray::Initialize(isolate, array, JSArray::kPreallocatedArrayElements);
     } else {
       // Take the argument as the length.
-      JSArray::Initialize(array, 0);
-      MAYBE_RETURN_NULL(JSArray::SetLength(array, length));
+      JSArray::Initialize(isolate, array, 0);
+      MAYBE_RETURN_NULL(JSArray::SetLength(isolate, array, length));
     }
     return array;
   }
 
-  Factory* factory = array->GetIsolate()->factory();
+  Factory* factory = isolate->factory();
 
   // Set length and elements on the array.
   int number_of_elements = args->length();
-  JSObject::EnsureCanContainElements(array, args, number_of_elements,
+  JSObject::EnsureCanContainElements(isolate, array, args, number_of_elements,
                                      ALLOW_CONVERTED_DOUBLE_ELEMENTS);
 
   // Allocate an appropriately typed elements array.
diff --git a/deps/v8/src/objects/elements.h b/deps/v8/src/objects/elements.h
index a693a9c8c6e70e..b3c824a9667ba8 100644
--- a/deps/v8/src/objects/elements.h
+++ b/deps/v8/src/objects/elements.h
@@ -33,7 +33,7 @@ class ElementsAccessor {
 
   // Checks the elements of an object for consistency, asserting when a problem
   // is found.
-  virtual void Validate(Tagged<JSObject> obj) = 0;
+  virtual void Validate(Isolate* isolate, Tagged<JSObject> obj) = 0;
 
   // Returns true if a holder contains an element with the specified index
   // without iterating up the prototype chain. The first version takes the
@@ -45,16 +45,18 @@ class ElementsAccessor {
   // Note that only Dictionary elements have custom
   // PropertyAttributes associated, hence the |filter| argument is ignored for
   // all but DICTIONARY_ELEMENTS and SLOW_SLOPPY_ARGUMENTS_ELEMENTS.
-  virtual bool HasElement(Tagged<JSObject> holder, uint32_t index,
-                          Tagged<FixedArrayBase> backing_store,
+  virtual bool HasElement(Isolate* isolate, Tagged<JSObject> holder,
+                          uint32_t index, Tagged<FixedArrayBase> backing_store,
                           PropertyFilter filter = ALL_PROPERTIES) = 0;
 
-  inline bool HasElement(Tagged<JSObject> holder, uint32_t index,
+  inline bool HasElement(Isolate* isolate, Tagged<JSObject> holder,
+                         uint32_t index,
                          PropertyFilter filter = ALL_PROPERTIES);
 
   // Note: this is currently not implemented for string wrapper and
   // typed array elements.
-  virtual bool HasEntry(Tagged<JSObject> holder, InternalIndex entry) = 0;
+  virtual bool HasEntry(Isolate* isolate, Tagged<JSObject> holder,
+                        InternalIndex entry) = 0;
 
   virtual Handle<Object> Get(Isolate* isolate, DirectHandle<JSObject> holder,
                              InternalIndex entry) = 0;
@@ -76,7 +78,7 @@ class ElementsAccessor {
   // have non-deletable elements can only be shrunk to the size of highest
   // element that is non-deletable.
   V8_WARN_UNUSED_RESULT virtual Maybe<bool> SetLength(
-      DirectHandle<JSArray> holder, uint32_t new_length) = 0;
+      Isolate* isolate, DirectHandle<JSArray> holder, uint32_t new_length) = 0;
 
   // Copy all indices that have elements from |object| into the given
   // KeyAccumulator. For Dictionary-based element-kinds we filter out elements
@@ -107,14 +109,15 @@ class ElementsAccessor {
       DirectHandle<JSObject> receiver, KeyAccumulator* accumulator,
       AddKeyConversion convert) = 0;
 
-  virtual void TransitionElementsKind(DirectHandle<JSObject> object,
+  virtual void TransitionElementsKind(Isolate* isolate,
+                                      DirectHandle<JSObject> object,
                                       DirectHandle<Map> map) = 0;
   V8_WARN_UNUSED_RESULT virtual Maybe<bool> GrowCapacityAndConvert(
-      DirectHandle<JSObject> object, uint32_t capacity) = 0;
+      Isolate* isolate, DirectHandle<JSObject> object, uint32_t capacity) = 0;
   // Unlike GrowCapacityAndConvert do not attempt to convert the backing store
   // and simply return false in this case.
   V8_WARN_UNUSED_RESULT virtual Maybe<bool> GrowCapacity(
-      DirectHandle<JSObject> object, uint32_t index) = 0;
+      Isolate* isolate, DirectHandle<JSObject> object, uint32_t index) = 0;
 
   static void InitializeOncePerProcess();
   static void TearDown();
@@ -138,7 +141,8 @@ class ElementsAccessor {
       Isolate* isolate, DirectHandle<JSObject> holder, InternalIndex entry,
       Tagged<Object> expected, Tagged<Object> value, SeqCstAccessTag tag) = 0;
 
-  V8_WARN_UNUSED_RESULT virtual Maybe<bool> Add(DirectHandle<JSObject> object,
+  V8_WARN_UNUSED_RESULT virtual Maybe<bool> Add(Isolate* isolate,
+                                                DirectHandle<JSObject> object,
                                                 uint32_t index,
                                                 DirectHandle<Object> value,
                                                 PropertyAttributes attributes,
@@ -149,28 +153,28 @@ class ElementsAccessor {
                                       uint32_t result_length);
 
   V8_WARN_UNUSED_RESULT virtual Maybe<uint32_t> Push(
-      DirectHandle<JSArray> receiver, BuiltinArguments* args,
+      Isolate* isolate, DirectHandle<JSArray> receiver, BuiltinArguments* args,
       uint32_t push_size) = 0;
 
   V8_WARN_UNUSED_RESULT virtual Maybe<uint32_t> Unshift(
-      DirectHandle<JSArray> receiver, BuiltinArguments* args,
+      Isolate* isolate, DirectHandle<JSArray> receiver, BuiltinArguments* args,
       uint32_t unshift_size) = 0;
 
   V8_WARN_UNUSED_RESULT virtual MaybeDirectHandle<Object> Pop(
-      DirectHandle<JSArray> receiver) = 0;
+      Isolate* isolate, DirectHandle<JSArray> receiver) = 0;
 
   V8_WARN_UNUSED_RESULT virtual MaybeDirectHandle<Object> Shift(
-      DirectHandle<JSArray> receiver) = 0;
+      Isolate* isolate, DirectHandle<JSArray> receiver) = 0;
 
   virtual DirectHandle<NumberDictionary> Normalize(
-      DirectHandle<JSObject> object) = 0;
+      Isolate* isolate, DirectHandle<JSObject> object) = 0;
 
   virtual size_t GetCapacity(Tagged<JSObject> holder,
                              Tagged<FixedArrayBase> backing_store) = 0;
 
   V8_WARN_UNUSED_RESULT virtual MaybeDirectHandle<Object> Fill(
-      DirectHandle<JSObject> receiver, DirectHandle<Object> obj_value,
-      size_t start, size_t end) = 0;
+      Isolate* isolate, DirectHandle<JSObject> receiver,
+      DirectHandle<Object> obj_value, size_t start, size_t end) = 0;
 
   // Check an Object's own elements for an element (using SameValueZero
   // semantics)
@@ -198,7 +202,8 @@ class ElementsAccessor {
                             DirectHandle<FixedArrayBase> destination,
                             int size) = 0;
 
-  virtual Tagged<Object> CopyElements(DirectHandle<JSAny> source,
+  virtual Tagged<Object> CopyElements(Isolate* isolate,
+                                      DirectHandle<JSAny> source,
                                       DirectHandle<JSObject> destination,
                                       size_t length, size_t offset) = 0;
 
@@ -227,13 +232,14 @@ class ElementsAccessor {
 
   virtual PropertyDetails GetDetails(Tagged<JSObject> holder,
                                      InternalIndex entry) = 0;
-  virtual void Reconfigure(DirectHandle<JSObject> object,
+  virtual void Reconfigure(Isolate* isolate, DirectHandle<JSObject> object,
                            DirectHandle<FixedArrayBase> backing_store,
                            InternalIndex entry, DirectHandle<Object> value,
                            PropertyAttributes attributes) = 0;
 
   // Deletes an element in an object.
-  virtual void Delete(DirectHandle<JSObject> holder, InternalIndex entry) = 0;
+  virtual void Delete(Isolate* isolate, DirectHandle<JSObject> holder,
+                      InternalIndex entry) = 0;
 
   // NOTE: this method violates the handlified function signature convention:
   // raw pointer parameter |source_holder| in the function that allocates.
@@ -249,7 +255,7 @@ class ElementsAccessor {
 };
 
 V8_WARN_UNUSED_RESULT MaybeDirectHandle<Object>
-ArrayConstructInitializeElements(DirectHandle<JSArray> array,
+ArrayConstructInitializeElements(Isolate* isolate, DirectHandle<JSArray> array,
                                  JavaScriptArguments* args);
 
 // Called directly from CSA.
diff --git a/deps/v8/src/objects/feedback-vector-inl.h b/deps/v8/src/objects/feedback-vector-inl.h
index 9be7e18473ad43..5b4f677e5aad3d 100644
--- a/deps/v8/src/objects/feedback-vector-inl.h
+++ b/deps/v8/src/objects/feedback-vector-inl.h
@@ -117,6 +117,7 @@ int FeedbackMetadata::GetSlotSize(FeedbackSlotKind kind) {
     case FeedbackSlotKind::kSetKeyedStrict:
     case FeedbackSlotKind::kStoreInArrayLiteral:
     case FeedbackSlotKind::kDefineKeyedOwnPropertyInLiteral:
+    case FeedbackSlotKind::kStringAddAndInternalize:
       return 2;
 
     case FeedbackSlotKind::kInvalid:
@@ -416,6 +417,8 @@ CompareOperationHint CompareOperationHintFromFeedback(int type_feedback) {
     return CompareOperationHint::kNumber;
   } else if (Is<CompareOperationFeedback::kNumberOrBoolean>(type_feedback)) {
     return CompareOperationHint::kNumberOrBoolean;
+  } else if (Is<CompareOperationFeedback::kNumberOrOddball>(type_feedback)) {
+    return CompareOperationHint::kNumberOrOddball;
   }
 
   if (Is<CompareOperationFeedback::kInternalizedString>(type_feedback)) {
diff --git a/deps/v8/src/objects/feedback-vector.cc b/deps/v8/src/objects/feedback-vector.cc
index f84228e34965cc..8b1b5326ef76c6 100644
--- a/deps/v8/src/objects/feedback-vector.cc
+++ b/deps/v8/src/objects/feedback-vector.cc
@@ -197,6 +197,8 @@ const char* FeedbackMetadata::Kind2String(FeedbackSlotKind kind) {
       return "CloneObject";
     case FeedbackSlotKind::kJumpLoop:
       return "JumpLoop";
+    case FeedbackSlotKind::kStringAddAndInternalize:
+      return "StringAddAndInternalize";
   }
 }
 
@@ -319,6 +321,9 @@ Handle<FeedbackVector> FeedbackVector::New(
       case FeedbackSlotKind::kInstanceOf:
         vector->Set(slot, *uninitialized_sentinel, SKIP_WRITE_BARRIER);
         break;
+      case FeedbackSlotKind::kStringAddAndInternalize:
+        vector->Set(slot, Smi::zero(), SKIP_WRITE_BARRIER);
+        break;
 
       case FeedbackSlotKind::kInvalid:
         UNREACHABLE();
@@ -696,6 +701,17 @@ bool FeedbackNexus::Clear(ClearBehavior behavior) {
       }
       break;
 
+    case FeedbackSlotKind::kStringAddAndInternalize:
+      if (V8_LIKELY(behavior == ClearBehavior::kDefault)) {
+        // We don't clear these, either.
+      } else if (!IsCleared()) {
+        DCHECK_EQ(behavior, ClearBehavior::kClearAll);
+        SetFeedback(Smi::zero(), SKIP_WRITE_BARRIER, UninitializedSentinel(),
+                    SKIP_WRITE_BARRIER);
+        feedback_updated = true;
+      }
+      break;
+
     case FeedbackSlotKind::kInvalid:
       UNREACHABLE();
   }
@@ -842,7 +858,8 @@ InlineCacheState FeedbackNexus::ic_state() const {
       CHECK_EQ(feedback, UninitializedSentinel());
       return InlineCacheState::UNINITIALIZED;
     }
-    case FeedbackSlotKind::kBinaryOp: {
+    case FeedbackSlotKind::kBinaryOp:
+    case FeedbackSlotKind::kStringAddAndInternalize: {
       BinaryOperationHint hint = GetBinaryOperationFeedback();
       if (hint == BinaryOperationHint::kNone) {
         return InlineCacheState::UNINITIALIZED;
@@ -1370,7 +1387,8 @@ IcCheckType FeedbackNexus::GetKeyType() const {
 }
 
 BinaryOperationHint FeedbackNexus::GetBinaryOperationFeedback() const {
-  DCHECK_EQ(kind(), FeedbackSlotKind::kBinaryOp);
+  DCHECK(kind() == FeedbackSlotKind::kBinaryOp ||
+         kind() == FeedbackSlotKind::kStringAddAndInternalize);
   int feedback = GetFeedback().ToSmi().value();
   return BinaryOperationHintFromFeedback(feedback);
 }
diff --git a/deps/v8/src/objects/feedback-vector.h b/deps/v8/src/objects/feedback-vector.h
index b4a65ea6d4b0cd..267348873011ed 100644
--- a/deps/v8/src/objects/feedback-vector.h
+++ b/deps/v8/src/objects/feedback-vector.h
@@ -74,6 +74,7 @@ enum class FeedbackSlotKind : uint8_t {
   kInstanceOf,
   kTypeOf,
   kCloneObject,
+  kStringAddAndInternalize,
   kJumpLoop,
 
   kLast = kJumpLoop  // Always update this if the list above changes.
@@ -673,6 +674,10 @@ class V8_EXPORT_PRIVATE FeedbackVectorSpec {
     return AddSlot(FeedbackSlotKind::kJumpLoop);
   }
 
+  FeedbackSlot AddStringAddAndInternalizeICSlot() {
+    return AddSlot(FeedbackSlotKind::kStringAddAndInternalize);
+  }
+
 #ifdef OBJECT_PRINT
   // For gdb debugging.
   void Print();
diff --git a/deps/v8/src/objects/fixed-array-inl.h b/deps/v8/src/objects/fixed-array-inl.h
index 696deaf3187471..20968e2bb2f610 100644
--- a/deps/v8/src/objects/fixed-array-inl.h
+++ b/deps/v8/src/objects/fixed-array-inl.h
@@ -335,7 +335,8 @@ Handle<TrustedFixedArray> TrustedFixedArray::New(IsolateT* isolate,
 // static
 template <class IsolateT>
 Handle<ProtectedFixedArray> ProtectedFixedArray::New(IsolateT* isolate,
-                                                     int capacity) {
+                                                     int capacity,
+                                                     bool shared) {
   if (V8_UNLIKELY(static_cast<unsigned>(capacity) >
                   ProtectedFixedArray::kMaxLength)) {
     FATAL("Fatal JavaScript invalid size error %d (see crbug.com/1201626)",
@@ -343,8 +344,9 @@ Handle<ProtectedFixedArray> ProtectedFixedArray::New(IsolateT* isolate,
   }
 
   std::optional<DisallowGarbageCollection> no_gc;
-  Handle<ProtectedFixedArray> result = Cast<ProtectedFixedArray>(
-      Allocate(isolate, capacity, &no_gc, AllocationType::kTrusted));
+  Handle<ProtectedFixedArray> result = Cast<ProtectedFixedArray>(Allocate(
+      isolate, capacity, &no_gc,
+      shared ? AllocationType::kSharedTrusted : AllocationType::kTrusted));
   MemsetTagged((*result)->RawFieldOfFirstElement(), Smi::zero(), capacity);
   return result;
 }
diff --git a/deps/v8/src/objects/fixed-array.h b/deps/v8/src/objects/fixed-array.h
index 19c4a6fb6112b3..36cb7ff88c996d 100644
--- a/deps/v8/src/objects/fixed-array.h
+++ b/deps/v8/src/objects/fixed-array.h
@@ -339,8 +339,8 @@ V8_OBJECT class ProtectedFixedArray
   // Allocate a new ProtectedFixedArray of the given capacity, initialized with
   // Smi::zero().
   template <class IsolateT>
-  static inline Handle<ProtectedFixedArray> New(IsolateT* isolate,
-                                                int capacity);
+  static inline Handle<ProtectedFixedArray> New(IsolateT* isolate, int capacity,
+                                                bool shared = false);
 
   DECL_PRINTER(ProtectedFixedArray)
   DECL_VERIFIER(ProtectedFixedArray)
diff --git a/deps/v8/src/objects/foreign-inl.h b/deps/v8/src/objects/foreign-inl.h
index 068f81485bc183..9b591a7b1083e5 100644
--- a/deps/v8/src/objects/foreign-inl.h
+++ b/deps/v8/src/objects/foreign-inl.h
@@ -48,12 +48,16 @@ void Foreign::init_foreign_address(IsolateForSandbox isolate,
   InitExternalPointerField<tag>(kForeignAddressOffset, isolate, initial_value);
 }
 
-Address Foreign::foreign_address_unchecked() const {
-  IsolateForSandbox isolate = GetIsolateForSandbox(*this);
+Address Foreign::foreign_address_unchecked(IsolateForSandbox isolate) const {
   return ReadExternalPointerField<kAnyForeignExternalPointerTagRange>(
       kForeignAddressOffset, isolate);
 }
 
+Address Foreign::foreign_address_unchecked() const {
+  IsolateForSandbox isolate = GetCurrentIsolateForSandbox();
+  return foreign_address_unchecked(isolate);
+}
+
 ExternalPointerTag Foreign::GetTag() const {
 #ifdef V8_ENABLE_SANDBOX
   ExternalPointerHandle handle =
diff --git a/deps/v8/src/objects/foreign.h b/deps/v8/src/objects/foreign.h
index 0aa0b9ace5a348..365450ba2c4ccf 100644
--- a/deps/v8/src/objects/foreign.h
+++ b/deps/v8/src/objects/foreign.h
@@ -33,6 +33,7 @@ class Foreign : public TorqueGeneratedForeign<Foreign, HeapObject> {
 
   // Load the address without performing a type check. Only use this when the
   // returned pointer will not be dereferenced.
+  inline Address foreign_address_unchecked(IsolateForSandbox isolate) const;
   inline Address foreign_address_unchecked() const;
 
   // Get the tag of this foreign from the external pointer table. Non-sandbox
diff --git a/deps/v8/src/objects/hash-table-inl.h b/deps/v8/src/objects/hash-table-inl.h
index 20dabe2f310703..3c5925c3cb75ae 100644
--- a/deps/v8/src/objects/hash-table-inl.h
+++ b/deps/v8/src/objects/hash-table-inl.h
@@ -278,8 +278,8 @@ uint32_t RegisteredSymbolTableShape::HashForObject(ReadOnlyRoots roots,
   return Cast<String>(object)->EnsureHash();
 }
 
-bool NameToIndexShape::IsMatch(DirectHandle<Name> key, Tagged<Object> other) {
-  return *key == other;
+bool NameToIndexShape::IsMatch(Tagged<Name> key, Tagged<Object> other) {
+  return key == other;
 }
 
 uint32_t NameToIndexShape::HashForObject(ReadOnlyRoots roots,
@@ -287,7 +287,7 @@ uint32_t NameToIndexShape::HashForObject(ReadOnlyRoots roots,
   return Cast<Name>(other)->hash();
 }
 
-uint32_t NameToIndexShape::Hash(ReadOnlyRoots roots, DirectHandle<Name> key) {
+uint32_t NameToIndexShape::Hash(ReadOnlyRoots roots, Tagged<Name> key) {
   return key->hash();
 }
 
@@ -307,7 +307,7 @@ Handle<NameToIndexHashTable> NameToIndexHashTable::Add(
     DirectHandle<Name> key, int32_t index) {
   DCHECK_GE(index, 0);
   // Validate that the key is absent.
-  SLOW_DCHECK(table->FindEntry(isolate, key).is_not_found());
+  SLOW_DCHECK(table->FindEntry(isolate, *key).is_not_found());
   // Check whether the dictionary should be extended.
   table = EnsureCapacity(isolate, table);
   DisallowGarbageCollection no_gc;
diff --git a/deps/v8/src/objects/hash-table.h b/deps/v8/src/objects/hash-table.h
index 033d6908c6ab0a..7b36398289339b 100644
--- a/deps/v8/src/objects/hash-table.h
+++ b/deps/v8/src/objects/hash-table.h
@@ -518,13 +518,12 @@ class V8_EXPORT_PRIVATE ObjectHashSet
   inline bool Has(Isolate* isolate, DirectHandle<Object> key);
 };
 
-class NameToIndexShape : public BaseShape<DirectHandle<Name>> {
+class NameToIndexShape : public BaseShape<Tagged<Name>> {
  public:
-  static inline bool IsMatch(DirectHandle<Name> key, Tagged<Object> other);
-  static inline uint32_t Hash(ReadOnlyRoots roots, DirectHandle<Name> key);
+  static inline bool IsMatch(Tagged<Name> key, Tagged<Object> other);
+  static inline uint32_t Hash(ReadOnlyRoots roots, Tagged<Name> key);
   static inline uint32_t HashForObject(ReadOnlyRoots roots,
                                        Tagged<Object> object);
-  static inline DirectHandle<Object> AsHandle(DirectHandle<Name> key);
   static const int kPrefixSize = 0;
   static const int kEntryValueIndex = 1;
   static const int kEntrySize = 2;
@@ -539,7 +538,7 @@ class V8_EXPORT_PRIVATE NameToIndexHashTable
   static const int kEntryValueIndex = NameToIndexShape::kEntryValueIndex;
 
   inline static DirectHandle<Map> GetMap(RootsTable& roots);
-  int Lookup(DirectHandle<Name> key);
+  int Lookup(Tagged<Name> key);
 
   // Returns the value at entry.
   Tagged<Object> ValueAt(InternalIndex entry);
diff --git a/deps/v8/src/objects/heap-object.h b/deps/v8/src/objects/heap-object.h
index f1d04b536b2a47..086593f0389221 100644
--- a/deps/v8/src/objects/heap-object.h
+++ b/deps/v8/src/objects/heap-object.h
@@ -37,6 +37,8 @@ V8_OBJECT class HeapObjectLayout {
   inline Tagged<Map> map() const;
   inline Tagged<Map> map(AcquireLoadTag) const;
 
+  inline MapWord map_word(RelaxedLoadTag) const;
+
   inline void set_map(Isolate* isolate, Tagged<Map> value);
   template <typename IsolateT>
   inline void set_map(IsolateT* isolate, Tagged<Map> value, ReleaseStoreTag);
@@ -324,6 +326,14 @@ class HeapObject : public TaggedImpl<HeapObjectReferenceType::STRONG, Address> {
   // with a nullptr value.
   inline void SetupLazilyInitializedExternalPointerField(size_t offset);
 
+  // Returns true if the lazily-initializer external pointer field still
+  // contains the initial value. If the sandbox is enabled, returns true if
+  // the field is not equal to kNullExternalPointerHandle (this check will
+  // *not* try to read the actual value from the table). If the sandbox
+  // is disabled, returns true if the field is not equal to kNullAddress.
+  inline bool IsLazilyInitializedExternalPointerFieldInitialized(
+      size_t offset) const;
+
   // Writes and possibly initializes a lazily-initialized external pointer
   // field. When the sandbox is enabled, a lazily initialized external pointer
   // field initially contains the kNullExternalPointerHandle and will only be
diff --git a/deps/v8/src/objects/instance-type-checker.h b/deps/v8/src/objects/instance-type-checker.h
index 34f37324e4b4bb..32f3a27a068091 100644
--- a/deps/v8/src/objects/instance-type-checker.h
+++ b/deps/v8/src/objects/instance-type-checker.h
@@ -32,10 +32,12 @@ class Map;
 
 #define INSTANCE_TYPE_CHECKERS_CUSTOM(V) \
   V(AbstractCode)                        \
+  V(CppHeapPointerWrapperObject)         \
   V(ExternalString)                      \
   V(FreeSpaceOrFiller)                   \
   V(GcSafeCode)                          \
   V(InternalizedString)                  \
+  V(JSApiWrapperObject)                  \
   V(MaybeReadOnlyJSObject)               \
   V(PropertyDictionary)
 
diff --git a/deps/v8/src/objects/instance-type-inl.h b/deps/v8/src/objects/instance-type-inl.h
index 36388d74a55455..b143e49f084587 100644
--- a/deps/v8/src/objects/instance-type-inl.h
+++ b/deps/v8/src/objects/instance-type-inl.h
@@ -358,7 +358,8 @@ V8_INLINE bool IsUncachedExternalString(Tagged<Map> map_object) {
 }
 
 V8_INLINE constexpr bool IsConsString(InstanceType instance_type) {
-  return (instance_type & kStringRepresentationMask) == kConsStringTag;
+  return (instance_type & (kIsNotStringMask | kStringRepresentationMask)) ==
+         kConsStringTag;
 }
 
 V8_INLINE bool IsConsString(Tagged<Map> map_object) {
@@ -371,7 +372,8 @@ V8_INLINE bool IsConsString(Tagged<Map> map_object) {
 }
 
 V8_INLINE constexpr bool IsSlicedString(InstanceType instance_type) {
-  return (instance_type & kStringRepresentationMask) == kSlicedStringTag;
+  return (instance_type & (kIsNotStringMask | kStringRepresentationMask)) ==
+         kSlicedStringTag;
 }
 
 V8_INLINE bool IsSlicedString(Tagged<Map> map_object) {
@@ -384,7 +386,8 @@ V8_INLINE bool IsSlicedString(Tagged<Map> map_object) {
 }
 
 V8_INLINE constexpr bool IsThinString(InstanceType instance_type) {
-  return (instance_type & kStringRepresentationMask) == kThinStringTag;
+  return (instance_type & (kIsNotStringMask | kStringRepresentationMask)) ==
+         kThinStringTag;
 }
 
 V8_INLINE bool IsThinString(Tagged<Map> map_object) {
@@ -487,13 +490,11 @@ V8_INLINE constexpr bool IsNativeContextSpecific(InstanceType instance_type) {
 
   // Most of the JSReceivers are tied to some native context modulo the
   // following exceptions.
-  if (instance_type == JS_MESSAGE_OBJECT_TYPE ||
-      instance_type == JS_EXTERNAL_OBJECT_TYPE) {
+  if (IsMaybeReadOnlyJSObject(instance_type)) {
     // These JSObject types are wrappers around a set of primitive values
     // and exist only for the purpose of passing the data across V8 Api.
     // Thus they are not tied to any native context.
     return false;
-
   } else if (InstanceTypeChecker::IsAlwaysSharedSpaceJSObject(instance_type)) {
     // JSObjects allocated in shared space are never tied to a native context.
     return false;
@@ -511,6 +512,25 @@ V8_INLINE bool IsNativeContextSpecificMap(Tagged<Map> map_object) {
   return IsNativeContextSpecific(map_object->instance_type());
 }
 
+V8_INLINE constexpr bool IsJSApiWrapperObject(InstanceType instance_type) {
+  return IsJSAPIObjectWithEmbedderSlots(instance_type) ||
+         IsJSSpecialObject(instance_type);
+}
+
+V8_INLINE bool IsJSApiWrapperObject(Tagged<Map> map_object) {
+  return IsJSApiWrapperObject(map_object->instance_type());
+}
+
+V8_INLINE constexpr bool IsCppHeapPointerWrapperObject(
+    InstanceType instance_type) {
+  return IsJSApiWrapperObject(instance_type) ||
+         IsCppHeapExternalObject(instance_type);
+}
+
+V8_INLINE bool IsCppHeapPointerWrapperObject(Tagged<Map> map_object) {
+  return IsCppHeapPointerWrapperObject(map_object->instance_type());
+}
+
 }  // namespace InstanceTypeChecker
 
 #define TYPE_CHECKER(type, ...)                \
diff --git a/deps/v8/src/objects/instance-type.h b/deps/v8/src/objects/instance-type.h
index c29243b3e05105..52d34944b7ae02 100644
--- a/deps/v8/src/objects/instance-type.h
+++ b/deps/v8/src/objects/instance-type.h
@@ -318,13 +318,12 @@ V8_EXPORT_PRIVATE std::string ToString(InstanceType instance_type);
 #define UNIQUE_INSTANCE_TYPE_MAP_LIST_GENERATOR(V, _)                 \
   UNIQUE_LEAF_INSTANCE_TYPE_MAP_LIST_GENERATOR(V, _)                  \
   V(_, ByteArrayMap, byte_array_map, ByteArray)                       \
+  V(_, ContextCellMap, context_cell_map, ContextCell)                 \
   V(_, NameDictionaryMap, name_dictionary_map, NameDictionary)        \
   V(_, OrderedNameDictionaryMap, ordered_name_dictionary_map,         \
     OrderedNameDictionary)                                            \
   V(_, GlobalDictionaryMap, global_dictionary_map, GlobalDictionary)  \
   V(_, GlobalPropertyCellMap, global_property_cell_map, PropertyCell) \
-  V(_, GlobalContextSidePropertyCellMap,                              \
-    global_context_side_property_cell_map, ContextSidePropertyCell)   \
   V(_, HeapNumberMap, heap_number_map, HeapNumber)                    \
   V(_, WeakFixedArrayMap, weak_fixed_array_map, WeakFixedArray)       \
   V(_, ScopeInfoMap, scope_info_map, ScopeInfo)                       \
diff --git a/deps/v8/src/objects/intl-objects.cc b/deps/v8/src/objects/intl-objects.cc
index a861937c1c8450..a7cc46fa8f194f 100644
--- a/deps/v8/src/objects/intl-objects.cc
+++ b/deps/v8/src/objects/intl-objects.cc
@@ -525,7 +525,8 @@ Handle<JSObject> InnerAddElement(Isolate* isolate, DirectHandle<JSArray> array,
   JSObject::AddProperty(isolate, element, factory->value_string(), value, NONE);
   // TODO(victorgomes): Temporarily forcing a fatal error here in case of
   // overflow, until Intl::AddElement can handle exceptions.
-  if (JSObject::AddDataElement(array, index, element, NONE).IsNothing()) {
+  if (JSObject::AddDataElement(isolate, array, index, element, NONE)
+          .IsNothing()) {
     FATAL("Fatal JavaScript invalid size error when adding element");
     UNREACHABLE();
   }
@@ -677,13 +678,13 @@ MaybeDirectHandle<Object> Intl::LegacyUnwrapReceiver(
 
 namespace {
 
-bool IsTwoLetterLanguage(const std::string& locale) {
+bool IsTwoLetterLanguage(std::string_view locale) {
   // Two letters, both in range 'a'-'z'...
   return locale.length() == 2 && IsAsciiLower(locale[0]) &&
          IsAsciiLower(locale[1]);
 }
 
-bool IsDeprecatedOrLegacyLanguage(const std::string& locale) {
+bool IsDeprecatedOrLegacyLanguage(std::string_view locale) {
   //  Check if locale is one of the deprecated language tags:
   return locale == "in" || locale == "iw" || locale == "ji" || locale == "jw" ||
          locale == "mo" ||
@@ -691,27 +692,50 @@ bool IsDeprecatedOrLegacyLanguage(const std::string& locale) {
          locale == "sh" || locale == "tl" || locale == "no";
 }
 
-bool IsStructurallyValidLanguageTag(const std::string& tag) {
+bool IsStructurallyValidLanguageTag(std::string_view tag) {
   return JSLocale::StartsWithUnicodeLanguageId(tag);
 }
 
-// Canonicalize the locale.
-// https://tc39.github.io/ecma402/#sec-canonicalizelanguagetag,
-// including type check and structural validity check.
 Maybe<std::string> CanonicalizeLanguageTag(Isolate* isolate,
-                                           const std::string& locale_in) {
-  std::string locale = locale_in;
+                                           DirectHandle<Object> locale_in) {
+  DirectHandle<String> locale_str;
+  // This does part of the validity checking spec'ed in CanonicalizeLocaleList:
+  // 7c ii. If Type(kValue) is not String or Object, throw a TypeError
+  // exception.
+  // 7c iii. Let tag be ? ToString(kValue).
+  // 7c iv. If IsStructurallyValidLanguageTag(tag) is false, throw a
+  // RangeError exception.
+
+  if (IsString(*locale_in)) {
+    locale_str = Cast<String>(locale_in);
+  } else if (IsJSReceiver(*locale_in)) {
+    ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, locale_str,
+                                     Object::ToString(isolate, locale_in),
+                                     Nothing<std::string>());
+  } else {
+    THROW_NEW_ERROR_RETURN_VALUE(isolate,
+                                 NewTypeError(MessageTemplate::kLanguageID),
+                                 Nothing<std::string>());
+  }
+  std::string locale(locale_str->ToCString().get());
+  return Intl::ValidateAndCanonicalizeUnicodeLocaleId(isolate, locale);
+}
 
-  if (locale.empty() ||
-      !String::IsAscii(locale.data(), static_cast<int>(locale.length()))) {
+}  // anonymous namespace
+
+// static
+Maybe<std::string> Intl::ValidateAndCanonicalizeUnicodeLocaleId(
+    Isolate* isolate, std::string_view locale_in) {
+  if (!IsStructurallyValidLanguageTag(locale_in)) {
     THROW_NEW_ERROR_RETURN_VALUE(
         isolate,
-        NewRangeError(
-            MessageTemplate::kInvalidLanguageTag,
-            isolate->factory()->NewStringFromAsciiChecked(locale.c_str())),
+        NewRangeError(MessageTemplate::kInvalidLanguageTag,
+                      isolate->factory()->NewStringFromAsciiChecked(locale_in)),
         Nothing<std::string>());
   }
 
+  std::string locale(locale_in);
+
   // Optimize for the most common case: a 2-letter language code in the
   // canonical form/lowercase that is not one of the deprecated codes
   // (in, iw, ji, jw). Don't check for ~70 of 3-letter deprecated language
@@ -773,39 +797,6 @@ Maybe<std::string> CanonicalizeLanguageTag(Isolate* isolate,
   return maybe_to_language_tag;
 }
 
-Maybe<std::string> CanonicalizeLanguageTag(Isolate* isolate,
-                                           DirectHandle<Object> locale_in) {
-  DirectHandle<String> locale_str;
-  // This does part of the validity checking spec'ed in CanonicalizeLocaleList:
-  // 7c ii. If Type(kValue) is not String or Object, throw a TypeError
-  // exception.
-  // 7c iii. Let tag be ? ToString(kValue).
-  // 7c iv. If IsStructurallyValidLanguageTag(tag) is false, throw a
-  // RangeError exception.
-
-  if (IsString(*locale_in)) {
-    locale_str = Cast<String>(locale_in);
-  } else if (IsJSReceiver(*locale_in)) {
-    ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, locale_str,
-                                     Object::ToString(isolate, locale_in),
-                                     Nothing<std::string>());
-  } else {
-    THROW_NEW_ERROR_RETURN_VALUE(isolate,
-                                 NewTypeError(MessageTemplate::kLanguageID),
-                                 Nothing<std::string>());
-  }
-  std::string locale(locale_str->ToCString().get());
-
-  if (!IsStructurallyValidLanguageTag(locale)) {
-    THROW_NEW_ERROR_RETURN_VALUE(
-        isolate, NewRangeError(MessageTemplate::kLocaleBadParameters),
-        Nothing<std::string>());
-  }
-  return CanonicalizeLanguageTag(isolate, locale);
-}
-
-}  // anonymous namespace
-
 Maybe<std::vector<std::string>> Intl::CanonicalizeLocaleList(
     Isolate* isolate, DirectHandle<Object> locales,
     bool only_return_one_result) {
@@ -2105,7 +2096,7 @@ MaybeDirectHandle<JSArray> CreateArrayFromList(
     DirectHandle<String> value =
         factory->NewStringFromUtf8(base::CStrVector(part.c_str()))
             .ToHandleChecked();
-    MAYBE_RETURN(JSObject::AddDataElement(array, i, value, attr), {});
+    MAYBE_RETURN(JSObject::AddDataElement(isolate, array, i, value, attr), {});
   }
   // 5. Return array.
   return array;
diff --git a/deps/v8/src/objects/intl-objects.h b/deps/v8/src/objects/intl-objects.h
index 07a7c4d3413919..a832d1a5c378ba 100644
--- a/deps/v8/src/objects/intl-objects.h
+++ b/deps/v8/src/objects/intl-objects.h
@@ -108,6 +108,12 @@ class Intl {
 
   static Maybe<std::string> ToLanguageTag(const icu::Locale& locale);
 
+  // Validate and canonicalize the locale.
+  // https://tc39.es/ecma402/#sec-isstructurallyvalidlanguagetag
+  // https://tc39.es/ecma402/#sec-canonicalizeunicodelocaleid
+  static Maybe<std::string> ValidateAndCanonicalizeUnicodeLocaleId(
+      Isolate* isolate, std::string_view locale);
+
   // Get the name of the numbering system from locale.
   // ICU doesn't expose numbering system in any way, so we have to assume that
   // for given locale NumberingSystem constructor produces the same digits as
diff --git a/deps/v8/src/objects/js-array-buffer-inl.h b/deps/v8/src/objects/js-array-buffer-inl.h
index 818868b8aa4a90..fa133d98014144 100644
--- a/deps/v8/src/objects/js-array-buffer-inl.h
+++ b/deps/v8/src/objects/js-array-buffer-inl.h
@@ -218,6 +218,24 @@ bool JSArrayBufferView::WasDetached() const {
   return Cast<JSArrayBuffer>(buffer())->was_detached();
 }
 
+bool JSArrayBufferView::IsDetachedOrOutOfBounds() const {
+  auto backing_buffer = Cast<JSArrayBuffer>(buffer());
+  if (backing_buffer->was_detached()) {
+    return true;
+  }
+  if (!is_backed_by_rab()) {
+    // TypedArrays backed by GSABs or regular AB/SABs are never out of bounds.
+    // This shortcut is load-bearing; this enables determining
+    // IsDetachedOrOutOfBounds without consulting the BackingStore.
+    return false;
+  }
+  size_t buffer_byte_length =
+      backing_buffer->GetBackingStore()->byte_length();
+  // Length-tracking ArrayBufferViews have byte_length() == 0, so this math
+  // works.
+  return byte_offset() + byte_length() > buffer_byte_length;
+}
+
 BIT_FIELD_ACCESSORS(JSArrayBufferView, bit_field, is_length_tracking,
                     JSArrayBufferView::IsLengthTrackingBit)
 BIT_FIELD_ACCESSORS(JSArrayBufferView, bit_field, is_backed_by_rab,
@@ -251,19 +269,6 @@ bool JSTypedArray::IsOutOfBounds() const {
   return out_of_bounds;
 }
 
-bool JSTypedArray::IsDetachedOrOutOfBounds() const {
-  if (WasDetached()) {
-    return true;
-  }
-  if (!is_backed_by_rab()) {
-    // TypedArrays backed by GSABs or regular AB/SABs are never out of bounds.
-    // This shortcut is load-bearing; this enables determining
-    // IsDetachedOrOutOfBounds without consulting the BackingStore.
-    return false;
-  }
-  return IsOutOfBounds();
-}
-
 // static
 inline void JSTypedArray::ForFixedTypedArray(ExternalArrayType array_type,
                                              size_t* element_size,
diff --git a/deps/v8/src/objects/js-array-buffer.h b/deps/v8/src/objects/js-array-buffer.h
index 902b222388b820..54d31f12be83a2 100644
--- a/deps/v8/src/objects/js-array-buffer.h
+++ b/deps/v8/src/objects/js-array-buffer.h
@@ -314,6 +314,7 @@ class JSArrayBufferView
   DEFINE_TORQUE_GENERATED_JS_ARRAY_BUFFER_VIEW_FLAGS()
 
   inline bool WasDetached() const;
+  inline bool IsDetachedOrOutOfBounds() const;
 
   DECL_BOOLEAN_ACCESSORS(is_length_tracking)
   DECL_BOOLEAN_ACCESSORS(is_backed_by_rab)
@@ -368,7 +369,6 @@ class JSTypedArray
   inline size_t GetLength() const;
   inline size_t GetByteLength() const;
   inline bool IsOutOfBounds() const;
-  inline bool IsDetachedOrOutOfBounds() const;
 
   static inline void ForFixedTypedArray(ExternalArrayType array_type,
                                         size_t* element_size,
diff --git a/deps/v8/src/objects/js-array-inl.h b/deps/v8/src/objects/js-array-inl.h
index 5b9655532e0a62..54b8acdd6bfb07 100644
--- a/deps/v8/src/objects/js-array-inl.h
+++ b/deps/v8/src/objects/js-array-inl.h
@@ -46,9 +46,9 @@ bool JSArray::SetLengthWouldNormalize(Heap* heap, uint32_t new_length) {
   return new_length > kMaxFastArrayLength;
 }
 
-void JSArray::SetContent(DirectHandle<JSArray> array,
+void JSArray::SetContent(Isolate* isolate, DirectHandle<JSArray> array,
                          DirectHandle<FixedArrayBase> storage) {
-  EnsureCanContainElements(array, storage, storage->length(),
+  EnsureCanContainElements(isolate, array, storage, storage->length(),
                            ALLOW_COPIED_DOUBLE_ELEMENTS);
 #ifdef DEBUG
   ReadOnlyRoots roots = GetReadOnlyRoots();
diff --git a/deps/v8/src/objects/js-array.h b/deps/v8/src/objects/js-array.h
index c4b4452d07baa6..6e2a4fc10bca2f 100644
--- a/deps/v8/src/objects/js-array.h
+++ b/deps/v8/src/objects/js-array.h
@@ -50,7 +50,8 @@ class JSArray : public TorqueGeneratedJSArray<JSArray, JSObject> {
   // Initialize the array with the given capacity. The function may
   // fail due to out-of-memory situations, but only if the requested
   // capacity is non-zero.
-  V8_EXPORT_PRIVATE static void Initialize(DirectHandle<JSArray> array,
+  V8_EXPORT_PRIVATE static void Initialize(Isolate* isolate,
+                                           DirectHandle<JSArray> array,
                                            int capacity, int length = 0);
 
   // If the JSArray has fast elements, and new_length would result in
@@ -59,11 +60,12 @@ class JSArray : public TorqueGeneratedJSArray<JSArray, JSObject> {
   static inline bool SetLengthWouldNormalize(Heap* heap, uint32_t new_length);
 
   // Initializes the array to a certain length.
-  V8_EXPORT_PRIVATE static Maybe<bool> SetLength(DirectHandle<JSArray> array,
+  V8_EXPORT_PRIVATE static Maybe<bool> SetLength(Isolate* isolate,
+                                                 DirectHandle<JSArray> array,
                                                  uint32_t length);
 
   // Set the content of the array to the content of storage.
-  static inline void SetContent(DirectHandle<JSArray> array,
+  static inline void SetContent(Isolate* isolate, DirectHandle<JSArray> array,
                                 DirectHandle<FixedArrayBase> storage);
 
   // ES6 9.4.2.1
@@ -143,7 +145,7 @@ class JSArray : public TorqueGeneratedJSArray<JSArray, JSObject> {
 
   static const int kInitialMaxFastElementArray =
       (kMaxRegularHeapObjectSize - sizeof(FixedArray) - kHeaderSize -
-       AllocationMemento::kSize) >>
+       sizeof(AllocationMemento)) >>
       kDoubleSizeLog2;
 
   TQ_OBJECT_CONSTRUCTORS(JSArray)
diff --git a/deps/v8/src/objects/js-atomics-synchronization.cc b/deps/v8/src/objects/js-atomics-synchronization.cc
index 4bf08b59c76e40..804ef14ebd4b94 100644
--- a/deps/v8/src/objects/js-atomics-synchronization.cc
+++ b/deps/v8/src/objects/js-atomics-synchronization.cc
@@ -51,9 +51,9 @@ MaybeDirectHandle<Context> SetAsyncUnlockHandlers(
   DirectHandle<Context> handlers_context =
       isolate->factory()->NewBuiltinContext(
           isolate->native_context(), JSAtomicsMutex::kAsyncContextLength);
-  handlers_context->set(JSAtomicsMutex::kMutexAsyncContextSlot, *mutex);
-  handlers_context->set(JSAtomicsMutex::kUnlockedPromiseAsyncContextSlot,
-                        *unlocked_promise);
+  handlers_context->SetNoCell(JSAtomicsMutex::kMutexAsyncContextSlot, *mutex);
+  handlers_context->SetNoCell(JSAtomicsMutex::kUnlockedPromiseAsyncContextSlot,
+                              *unlocked_promise);
 
   DirectHandle<SharedFunctionInfo> resolve_info(
       isolate->heap()->atomics_mutex_async_unlock_resolve_handler_sfi(),
@@ -853,8 +853,8 @@ MaybeDirectHandle<JSPromise> JSAtomicsMutex::LockOrEnqueuePromise(
   DirectHandle<Foreign> wrapper =
       requester->factory()->NewForeign<kWaiterQueueForeignTag>(
           reinterpret_cast<Address>(waiter_node));
-  handlers_context->set(JSAtomicsMutex::kAsyncLockedWaiterAsyncContextSlot,
-                        *wrapper);
+  handlers_context->SetNoCell(
+      JSAtomicsMutex::kAsyncLockedWaiterAsyncContextSlot, *wrapper);
   return unlocked_promise;
 }
 
@@ -1293,8 +1293,8 @@ MaybeDirectHandle<JSReceiver> JSAtomicsCondition::WaitAsync(
   DirectHandle<Context> handler_context =
       requester->factory()->NewBuiltinContext(requester->native_context(),
                                               kAsyncContextLength);
-  handler_context->set(kMutexAsyncContextSlot, *mutex);
-  handler_context->set(kConditionVariableAsyncContextSlot, *cv);
+  handler_context->SetNoCell(kMutexAsyncContextSlot, *mutex);
+  handler_context->SetNoCell(kConditionVariableAsyncContextSlot, *cv);
 
   DirectHandle<SharedFunctionInfo> info(
       requester->heap()->atomics_condition_acquire_lock_sfi(), requester);
diff --git a/deps/v8/src/objects/js-date-time-format.cc b/deps/v8/src/objects/js-date-time-format.cc
index edbb3f0a1b176f..b4d2a56931f25c 100644
--- a/deps/v8/src/objects/js-date-time-format.cc
+++ b/deps/v8/src/objects/js-date-time-format.cc
@@ -2877,7 +2877,7 @@ MaybeDirectHandle<JSArray> FieldPositionIteratorToArray(
                        IcuDateFieldIdToDateType(-1, isolate), substring);
     }
   }
-  JSObject::ValidateElements(*result);
+  JSObject::ValidateElements(isolate, *result);
   return result;
 }
 
@@ -2998,7 +2998,7 @@ std::optional<MaybeDirectHandle<JSArray>> FormattedDateIntervalToJSArray(
     THROW_NEW_ERROR(isolate, NewTypeError(MessageTemplate::kIcuError));
   }
 
-  JSObject::ValidateElements(*array);
+  JSObject::ValidateElements(isolate, *array);
   if (output_range) return array;
   return std::nullopt;
 }
diff --git a/deps/v8/src/objects/js-disposable-stack-inl.h b/deps/v8/src/objects/js-disposable-stack-inl.h
index 5e33e0b4d6ff6f..1d44d1698aae30 100644
--- a/deps/v8/src/objects/js-disposable-stack-inl.h
+++ b/deps/v8/src/objects/js-disposable-stack-inl.h
@@ -158,7 +158,7 @@ JSDisposableStackBase::CheckValueAndGetDisposeMethod(Isolate* isolate,
                 isolate->native_context(),
                 static_cast<int>(
                     AsyncDisposeFromSyncDisposeContextSlots::kLength));
-        async_dispose_from_sync_dispose_context->set(
+        async_dispose_from_sync_dispose_context->SetNoCell(
             static_cast<int>(AsyncDisposeFromSyncDisposeContextSlots::kMethod),
             *method);
 
diff --git a/deps/v8/src/objects/js-disposable-stack.cc b/deps/v8/src/objects/js-disposable-stack.cc
index c72439f8d4327f..b581a2407130e2 100644
--- a/deps/v8/src/objects/js-disposable-stack.cc
+++ b/deps/v8/src/objects/js-disposable-stack.cc
@@ -235,11 +235,11 @@ Maybe<bool> JSAsyncDisposableStack::NextDisposeAsyncIteration(
                 static_cast<int>(
                     JSDisposableStackBase::AsyncDisposableStackContextSlots::
                         kLength));
-        async_disposable_stack_context->set(
+        async_disposable_stack_context->SetNoCell(
             static_cast<int>(JSDisposableStackBase::
                                  AsyncDisposableStackContextSlots::kStack),
             *async_disposable_stack);
-        async_disposable_stack_context->set(
+        async_disposable_stack_context->SetNoCell(
             static_cast<int>(
                 JSDisposableStackBase::AsyncDisposableStackContextSlots::
                     kOuterPromise),
diff --git a/deps/v8/src/objects/js-duration-format.cc b/deps/v8/src/objects/js-duration-format.cc
index 5a9414b853e9ac..4524d71def3176 100644
--- a/deps/v8/src/objects/js-duration-format.cc
+++ b/deps/v8/src/objects/js-duration-format.cc
@@ -1118,7 +1118,7 @@ MaybeDirectHandle<JSArray> FormattedListToJSArray(
   if (U_FAILURE(status)) {
     THROW_NEW_ERROR(isolate, NewTypeError(MessageTemplate::kIcuError));
   }
-  JSObject::ValidateElements(*array);
+  JSObject::ValidateElements(isolate, *array);
   return array;
 }
 
diff --git a/deps/v8/src/objects/js-function-inl.h b/deps/v8/src/objects/js-function-inl.h
index cadbc3a3a75df7..da77a9c6e0913a 100644
--- a/deps/v8/src/objects/js-function-inl.h
+++ b/deps/v8/src/objects/js-function-inl.h
@@ -59,10 +59,10 @@ bool JSFunction::ChecksTieringState(IsolateForSandbox isolate) {
   return code(isolate)->checks_tiering_state();
 }
 
-void JSFunction::CompleteInobjectSlackTrackingIfActive() {
+void JSFunction::CompleteInobjectSlackTrackingIfActive(Isolate* isolate) {
   if (!has_prototype_slot()) return;
   if (has_initial_map() && initial_map()->IsInobjectSlackTrackingInProgress()) {
-    MapUpdater::CompleteInobjectSlackTracking(GetIsolate(), initial_map());
+    MapUpdater::CompleteInobjectSlackTracking(isolate, initial_map());
   }
 }
 
@@ -92,10 +92,11 @@ void JSFunction::UpdateOptimizedCode(Isolate* isolate, Tagged<Code> code,
   // Required for being able to deoptimize this code.
   code->set_js_dispatch_handle(dispatch_handle());
 #endif  // V8_ENABLE_LEAPTIERING
-  UpdateCodeImpl(code, mode, false);
+  UpdateCodeImpl(isolate, code, mode, false);
 }
 
-void JSFunction::UpdateCodeImpl(Tagged<Code> value, WriteBarrierMode mode,
+void JSFunction::UpdateCodeImpl(Isolate* isolate, Tagged<Code> value,
+                                WriteBarrierMode mode,
                                 bool keep_tiering_request) {
   DisallowGarbageCollection no_gc;
 
@@ -114,8 +115,7 @@ void JSFunction::UpdateCodeImpl(Tagged<Code> value, WriteBarrierMode mode,
 
   if (V8_UNLIKELY(v8_flags.log_function_events)) {
     IsolateGroup::current()->js_dispatch_table()->SetTieringRequest(
-        dispatch_handle(), TieringBuiltin::kFunctionLogNextExecution,
-        GetIsolate());
+        dispatch_handle(), TieringBuiltin::kFunctionLogNextExecution, isolate);
   }
 #else
   WriteCodePointerField(kCodeOffset, value);
@@ -127,18 +127,20 @@ void JSFunction::UpdateCodeImpl(Tagged<Code> value, WriteBarrierMode mode,
 #endif  // V8_ENABLE_LEAPTIERING
 }
 
-void JSFunction::UpdateCode(Tagged<Code> code, WriteBarrierMode mode) {
+void JSFunction::UpdateCode(Isolate* isolate, Tagged<Code> code,
+                            WriteBarrierMode mode) {
   // Optimized code must go through UpdateOptimized code, which sets a
   // back-reference in the code object to the dispatch handle for
   // deoptimization.
   CHECK(!code->is_optimized_code());
-  UpdateCodeImpl(code, mode, false);
+  UpdateCodeImpl(isolate, code, mode, false);
 }
 
-inline void JSFunction::UpdateCodeKeepTieringRequests(Tagged<Code> code,
+inline void JSFunction::UpdateCodeKeepTieringRequests(Isolate* isolate,
+                                                      Tagged<Code> code,
                                                       WriteBarrierMode mode) {
   CHECK(!code->is_optimized_code());
-  UpdateCodeImpl(code, mode, true);
+  UpdateCodeImpl(isolate, code, mode, true);
 }
 
 Tagged<Code> JSFunction::code(IsolateForSandbox isolate) const {
@@ -403,7 +405,7 @@ void JSFunction::ResetTieringRequests() {
 #endif  // V8_ENABLE_LEAPTIERING
 }
 
-void JSFunction::SetTieringInProgress(bool in_progress,
+void JSFunction::SetTieringInProgress(Isolate* isolate, bool in_progress,
                                       BytecodeOffset osr_offset) {
   if (!has_feedback_vector()) return;
   if (osr_offset.IsNone()) {
@@ -411,14 +413,14 @@ void JSFunction::SetTieringInProgress(bool in_progress,
     bool was_in_progress = tiering_in_progress();
     feedback_vector()->set_tiering_in_progress(in_progress);
     if (!in_progress && was_in_progress) {
-      SetInterruptBudget(GetIsolate(), BudgetModification::kReduce);
+      SetInterruptBudget(isolate, BudgetModification::kReduce);
     }
 #else
     if (in_progress) {
       feedback_vector()->set_tiering_state(TieringState::kInProgress);
     } else if (tiering_in_progress()) {
       feedback_vector()->reset_tiering_state();
-      SetInterruptBudget(GetIsolate(), BudgetModification::kReduce);
+      SetInterruptBudget(isolate, BudgetModification::kReduce);
     }
 #endif  // V8_ENABLE_LEAPTIERING
   } else {
@@ -589,7 +591,7 @@ void JSFunction::ResetIfCodeFlushed(
     // Bytecode was flushed and function is now uncompiled, reset JSFunction
     // by setting code to CompileLazy and clearing the feedback vector.
     ResetTieringRequests();
-    UpdateCode(*BUILTIN_CODE(isolate, CompileLazy));
+    UpdateCode(isolate, *BUILTIN_CODE(isolate, CompileLazy));
     raw_feedback_cell()->reset_feedback_vector(gc_notify_updated_slot);
     return;
   }
@@ -599,7 +601,7 @@ void JSFunction::ResetIfCodeFlushed(
   if (kBaselineCodeCanFlush && NeedsResetDueToFlushedBaselineCode(isolate)) {
     // Flush baseline code from the closure if required
     ResetTieringRequests();
-    UpdateCode(*BUILTIN_CODE(isolate, InterpreterEntryTrampoline));
+    UpdateCode(isolate, *BUILTIN_CODE(isolate, InterpreterEntryTrampoline));
   }
 }
 
diff --git a/deps/v8/src/objects/js-function.cc b/deps/v8/src/objects/js-function.cc
index 22df966c8ffd04..3594683a1df41a 100644
--- a/deps/v8/src/objects/js-function.cc
+++ b/deps/v8/src/objects/js-function.cc
@@ -507,8 +507,7 @@ Maybe<int> JSBoundFunction::GetLength(Isolate* isolate,
 
 // static
 DirectHandle<String> JSBoundFunction::ToString(
-    DirectHandle<JSBoundFunction> function) {
-  Isolate* const isolate = function->GetIsolate();
+    Isolate* isolate, DirectHandle<JSBoundFunction> function) {
   return isolate->factory()->function_native_code_string();
 }
 
@@ -552,8 +551,7 @@ Maybe<int> JSWrappedFunction::GetLength(
 
 // static
 DirectHandle<String> JSWrappedFunction::ToString(
-    DirectHandle<JSWrappedFunction> function) {
-  Isolate* const isolate = function->GetIsolate();
+    Isolate* isolate, DirectHandle<JSWrappedFunction> function) {
   return isolate->factory()->function_native_code_string();
 }
 
@@ -621,8 +619,7 @@ Handle<String> JSFunction::GetName(Isolate* isolate,
 
 // static
 void JSFunction::EnsureClosureFeedbackCellArray(
-    DirectHandle<JSFunction> function) {
-  Isolate* const isolate = function->GetIsolate();
+    Isolate* isolate, DirectHandle<JSFunction> function) {
   DCHECK(function->shared()->is_compiled());
   DCHECK(function->shared()->HasFeedbackMetadata());
 #if V8_ENABLE_WEBASSEMBLY
@@ -705,7 +702,7 @@ void JSFunction::CreateAndAttachFeedbackVector(
   DirectHandle<SharedFunctionInfo> shared(function->shared(), isolate);
   DCHECK(function->shared()->HasBytecodeArray());
 
-  EnsureClosureFeedbackCellArray(function);
+  EnsureClosureFeedbackCellArray(isolate, function);
   DirectHandle<ClosureFeedbackCellArray> closure_feedback_cell_array(
       function->closure_feedback_cell_array(), isolate);
   DirectHandle<FeedbackVector> feedback_vector = FeedbackVector::New(
@@ -743,9 +740,9 @@ void JSFunction::CreateAndAttachFeedbackVector(
 
 // static
 void JSFunction::InitializeFeedbackCell(
-    DirectHandle<JSFunction> function, IsCompiledScope* is_compiled_scope,
+    Isolate* isolate, DirectHandle<JSFunction> function,
+    IsCompiledScope* is_compiled_scope,
     bool reset_budget_for_feedback_allocation) {
-  Isolate* const isolate = function->GetIsolate();
 #if V8_ENABLE_WEBASSEMBLY
   // The following checks ensure that the feedback vectors are compatible with
   // the feedback metadata. For Asm / Wasm functions we never allocate / use
@@ -789,7 +786,7 @@ void JSFunction::InitializeFeedbackCell(
       function->SetInterruptBudget(isolate, BudgetModification::kReset);
     }
   } else {
-    EnsureClosureFeedbackCellArray(function);
+    EnsureClosureFeedbackCellArray(isolate, function);
   }
 #ifdef V8_ENABLE_SPARKPLUG
   // TODO(jgruber): Unduplicate these conditions from tiering-manager.cc.
@@ -820,7 +817,7 @@ void SetInstancePrototype(Isolate* isolate, DirectHandle<JSFunction> function,
     // copy containing the new prototype.  Also complete any in-object
     // slack tracking that is in progress at this point because it is
     // still tracking the old copy.
-    function->CompleteInobjectSlackTrackingIfActive();
+    function->CompleteInobjectSlackTrackingIfActive(isolate);
 
     DirectHandle<Map> initial_map(function->initial_map(), isolate);
 
@@ -859,11 +856,11 @@ void SetInstancePrototype(Isolate* isolate, DirectHandle<JSFunction> function,
 
 }  // anonymous namespace
 
-void JSFunction::SetPrototype(DirectHandle<JSFunction> function,
+void JSFunction::SetPrototype(Isolate* isolate,
+                              DirectHandle<JSFunction> function,
                               DirectHandle<Object> value) {
   DCHECK(IsConstructor(*function) ||
          IsGeneratorFunction(function->shared()->kind()));
-  Isolate* isolate = function->GetIsolate();
   DirectHandle<JSReceiver> construct_prototype;
 
   // If the value is not a JSReceiver, store the value in the map's
@@ -931,12 +928,12 @@ void JSFunction::SetInitialMap(Isolate* isolate,
   }
 }
 
-void JSFunction::EnsureHasInitialMap(DirectHandle<JSFunction> function) {
+void JSFunction::EnsureHasInitialMap(Isolate* isolate,
+                                     DirectHandle<JSFunction> function) {
   DCHECK(function->has_prototype_slot());
   DCHECK(IsConstructor(*function) ||
          IsResumableFunction(function->shared()->kind()));
   if (function->has_initial_map()) return;
-  Isolate* isolate = function->GetIsolate();
 
   int expected_nof_properties =
       CalculateExpectedNofProperties(isolate, function);
@@ -1106,7 +1103,7 @@ bool CanSubclassHaveInobjectProperties(InstanceType instance_type) {
     case MAP_TYPE:
     case ODDBALL_TYPE:
     case PROPERTY_CELL_TYPE:
-    case CONTEXT_SIDE_PROPERTY_CELL_TYPE:
+    case CONTEXT_CELL_TYPE:
     case SHARED_FUNCTION_INFO_TYPE:
     case SYMBOL_TYPE:
     case ALLOCATION_SITE_TYPE:
@@ -1191,7 +1188,7 @@ bool FastInitializeDerivedMap(Isolate* isolate,
 MaybeHandle<Map> JSFunction::GetDerivedMap(
     Isolate* isolate, DirectHandle<JSFunction> constructor,
     DirectHandle<JSReceiver> new_target) {
-  EnsureHasInitialMap(constructor);
+  EnsureHasInitialMap(isolate, constructor);
 
   DirectHandle<Map> constructor_initial_map(constructor->initial_map(),
                                             isolate);
@@ -1220,7 +1217,7 @@ MaybeHandle<Map> JSFunction::GetDerivedMap(
       Cast<JSFunction>(new_target)->has_prototype_slot()) {
     DirectHandle<JSFunction> function = Cast<JSFunction>(new_target);
     // Make sure the new.target.prototype is cached.
-    EnsureHasInitialMap(function);
+    EnsureHasInitialMap(isolate, function);
     prototype = direct_handle(function->prototype(), isolate);
   } else {
     // The new.target is a constructor but it's not a JSFunction with
@@ -1232,7 +1229,7 @@ MaybeHandle<Map> JSFunction::GetDerivedMap(
         JSReceiver::GetProperty(isolate, new_target, prototype_string));
     // The above prototype lookup might change the constructor and its
     // prototype, hence we have to reload the initial map.
-    EnsureHasInitialMap(constructor);
+    EnsureHasInitialMap(isolate, constructor);
     constructor_initial_map =
         direct_handle(constructor->initial_map(), isolate);
   }
@@ -1251,7 +1248,7 @@ MaybeHandle<Map> JSFunction::GetDerivedMap(
     int index = IsSmi(*maybe_index) ? Smi::ToInt(*maybe_index)
                                     : Context::OBJECT_FUNCTION_INDEX;
     DirectHandle<JSFunction> realm_constructor(
-        Cast<JSFunction>(native_context->get(index)), isolate);
+        Cast<JSFunction>(native_context->GetNoCell(index)), isolate);
     prototype = direct_handle(realm_constructor->prototype(), isolate);
   }
   DCHECK_EQ(constructor_initial_map->constructor_or_back_pointer(),
@@ -1301,10 +1298,10 @@ MaybeDirectHandle<Map> JSFunction::GetDerivedRabGsabTypedArrayMap(
     Tagged<NativeContext> context = isolate->context()->native_context();
     int ctor_index =
         TypedArrayElementsKindToConstructorIndex(map->elements_kind());
-    if (*new_target == context->get(ctor_index)) {
+    if (*new_target == context->GetNoCell(ctor_index)) {
       ctor_index =
           TypedArrayElementsKindToRabGsabCtorIndex(map->elements_kind());
-      return direct_handle(Cast<Map>(context->get(ctor_index)), isolate);
+      return direct_handle(Cast<Map>(context->GetNoCell(ctor_index)), isolate);
     }
   }
 
@@ -1379,14 +1376,13 @@ bool UseFastFunctionNameLookup(Isolate* isolate, Tagged<Map> map) {
 }  // namespace
 
 DirectHandle<String> JSFunction::GetDebugName(
-    DirectHandle<JSFunction> function) {
+    Isolate* isolate, DirectHandle<JSFunction> function) {
   // Below we use the same fast-path that we already established for
   // Function.prototype.bind(), where we avoid a slow "name" property
   // lookup if the DescriptorArray for the |function| still has the
   // "name" property at the original spot and that property is still
   // implemented via an AccessorInfo (which effectively means that
   // it must be the FunctionNameGetter).
-  Isolate* isolate = function->GetIsolate();
   if (!UseFastFunctionNameLookup(isolate, function->map())) {
     // Normally there should be an else case for the fast-path check
     // above, which should invoke JSFunction::GetName(), since that's
@@ -1403,9 +1399,8 @@ DirectHandle<String> JSFunction::GetDebugName(
       isolate, direct_handle(function->shared(), isolate));
 }
 
-bool JSFunction::SetName(DirectHandle<JSFunction> function,
+bool JSFunction::SetName(Isolate* isolate, DirectHandle<JSFunction> function,
                          DirectHandle<Name> name, DirectHandle<String> prefix) {
-  Isolate* isolate = function->GetIsolate();
   DirectHandle<String> function_name;
   ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, function_name,
                                    Name::ToFunctionName(isolate, name), false);
@@ -1440,8 +1435,8 @@ DirectHandle<String> NativeCodeFunctionSourceString(
 }  // namespace
 
 // static
-DirectHandle<String> JSFunction::ToString(DirectHandle<JSFunction> function) {
-  Isolate* const isolate = function->GetIsolate();
+DirectHandle<String> JSFunction::ToString(Isolate* isolate,
+                                          DirectHandle<JSFunction> function) {
   DirectHandle<SharedFunctionInfo> shared_info(function->shared(), isolate);
 
   // Check if {function} should hide its source code.
@@ -1574,8 +1569,7 @@ void JSFunction::CalculateInstanceSizeHelper(InstanceType instance_type,
            static_cast<unsigned>(JSObject::kMaxInstanceSize));
 }
 
-void JSFunction::ClearAllTypeFeedbackInfoForTesting() {
-  Isolate* isolate = GetIsolate();
+void JSFunction::ClearAllTypeFeedbackInfoForTesting(Isolate* isolate) {
   ResetIfCodeFlushed(isolate);
   if (has_feedback_vector()) {
     Tagged<FeedbackVector> vector = feedback_vector();
diff --git a/deps/v8/src/objects/js-function.h b/deps/v8/src/objects/js-function.h
index 354e65b7aa4db7..9808b7253f4169 100644
--- a/deps/v8/src/objects/js-function.h
+++ b/deps/v8/src/objects/js-function.h
@@ -57,7 +57,8 @@ class JSBoundFunction
 
   // The bound function's string representation implemented according
   // to ES6 section 19.2.3.5 Function.prototype.toString ( ).
-  static DirectHandle<String> ToString(DirectHandle<JSBoundFunction> function);
+  static DirectHandle<String> ToString(Isolate* isolate,
+                                       DirectHandle<JSBoundFunction> function);
 
   TQ_OBJECT_CONSTRUCTORS(JSBoundFunction)
 };
@@ -83,7 +84,7 @@ class JSWrappedFunction
   // The wrapped function's string representation implemented according
   // to ES6 section 19.2.3.5 Function.prototype.toString ( ).
   static DirectHandle<String> ToString(
-      DirectHandle<JSWrappedFunction> function);
+      Isolate* isolate, DirectHandle<JSWrappedFunction> function);
 
   TQ_OBJECT_CONSTRUCTORS(JSWrappedFunction)
 };
@@ -136,10 +137,10 @@ class JSFunction : public TorqueGeneratedJSFunction<
       Isolate* isolate, Tagged<Code> code,
       WriteBarrierMode mode = WriteBarrierMode::UPDATE_WRITE_BARRIER);
   inline void UpdateCode(
-      Tagged<Code> code,
+      Isolate* isolate, Tagged<Code> code,
       WriteBarrierMode mode = WriteBarrierMode::UPDATE_WRITE_BARRIER);
   inline void UpdateCodeKeepTieringRequests(
-      Tagged<Code> code,
+      Isolate* isolate, Tagged<Code> code,
       WriteBarrierMode mode = WriteBarrierMode::UPDATE_WRITE_BARRIER);
 
   // Returns the raw content of the Code field. When reading from a background
@@ -253,7 +254,8 @@ class JSFunction : public TorqueGeneratedJSFunction<
   inline bool IsTieringRequestedOrInProgress() const;
 
   inline void SetTieringInProgress(
-      bool in_progress, BytecodeOffset osr_offset = BytecodeOffset::None());
+      Isolate* isolate, bool in_progress,
+      BytecodeOffset osr_offset = BytecodeOffset::None());
   inline void ResetTieringRequests();
 
   inline bool osr_tiering_in_progress();
@@ -269,7 +271,7 @@ class JSFunction : public TorqueGeneratedJSFunction<
   int ComputeInstanceSizeWithMinSlack(Isolate* isolate);
 
   // Completes inobject slack tracking on initial map if it is active.
-  inline void CompleteInobjectSlackTrackingIfActive();
+  inline void CompleteInobjectSlackTrackingIfActive(Isolate* isolate);
 
   // [raw_feedback_cell]: Gives raw access to the FeedbackCell used to hold the
   /// FeedbackVector eventually. Generally this shouldn't be used to get the
@@ -300,19 +302,21 @@ class JSFunction : public TorqueGeneratedJSFunction<
   // lazily.
   inline bool has_closure_feedback_cell_array() const;
   inline Tagged<ClosureFeedbackCellArray> closure_feedback_cell_array() const;
-  static void EnsureClosureFeedbackCellArray(DirectHandle<JSFunction> function);
+  static void EnsureClosureFeedbackCellArray(Isolate* isolate,
+                                             DirectHandle<JSFunction> function);
 
   // Initializes the feedback cell of |function|. In lite mode, this would be
   // initialized to the closure feedback cell array that holds the feedback
   // cells for create closure calls from this function. In the regular mode,
   // this allocates feedback vector.
-  static void InitializeFeedbackCell(DirectHandle<JSFunction> function,
+  static void InitializeFeedbackCell(Isolate* isolate,
+                                     DirectHandle<JSFunction> function,
                                      IsCompiledScope* compiled_scope,
                                      bool reset_budget_for_feedback_allocation);
 
   // Unconditionally clear the type feedback vector, even those that we usually
   // keep (e.g.: BinaryOp feedback).
-  void ClearAllTypeFeedbackInfoForTesting();
+  void ClearAllTypeFeedbackInfoForTesting(Isolate* isolate);
 
   // Resets function to clear compiled data after bytecode has been flushed.
   inline bool NeedsResetDueToFlushedBytecode(Isolate* isolate);
@@ -347,7 +351,7 @@ class JSFunction : public TorqueGeneratedJSFunction<
 
   DECL_GETTER(has_initial_map, bool)
   V8_EXPORT_PRIVATE static void EnsureHasInitialMap(
-      DirectHandle<JSFunction> function);
+      Isolate* isolate, DirectHandle<JSFunction> function);
 
   // Creates a map that matches the constructor's initial map, but with
   // [[prototype]] being new.target.prototype. Because new.target can be a
@@ -378,7 +382,7 @@ class JSFunction : public TorqueGeneratedJSFunction<
   DECL_GETTER(instance_prototype, Tagged<JSPrototype>)
   DECL_GETTER(has_prototype_property, bool)
   DECL_GETTER(PrototypeRequiresRuntimeLookup, bool)
-  static void SetPrototype(DirectHandle<JSFunction> function,
+  static void SetPrototype(Isolate* isolate, DirectHandle<JSFunction> function,
                            DirectHandle<Object> value);
 
   // Returns if this function has been compiled to native code yet.
@@ -413,17 +417,20 @@ class JSFunction : public TorqueGeneratedJSFunction<
   // Because of the way this abstract operation is used in the spec,
   // it should never fail, but in practice it will fail if the generated
   // function name's length exceeds String::kMaxLength.
-  static V8_WARN_UNUSED_RESULT bool SetName(DirectHandle<JSFunction> function,
+  static V8_WARN_UNUSED_RESULT bool SetName(Isolate* isolate,
+                                            DirectHandle<JSFunction> function,
                                             DirectHandle<Name> name,
                                             DirectHandle<String> prefix);
 
   // The function's name if it is configured, otherwise shared function info
   // debug name.
-  static DirectHandle<String> GetDebugName(DirectHandle<JSFunction> function);
+  static DirectHandle<String> GetDebugName(Isolate* isolate,
+                                           DirectHandle<JSFunction> function);
 
   // The function's string representation implemented according to
   // ES6 section 19.2.3.5 Function.prototype.toString ( ).
-  static DirectHandle<String> ToString(DirectHandle<JSFunction> function);
+  static DirectHandle<String> ToString(Isolate* isolate,
+                                       DirectHandle<JSFunction> function);
 
   class BodyDescriptor;
 
@@ -445,8 +452,8 @@ class JSFunction : public TorqueGeneratedJSFunction<
   inline void set_tiering_state(IsolateForSandbox isolate, TieringState state);
 #endif  // !V8_ENABLE_LEAPTIERING
 
-  inline void UpdateCodeImpl(Tagged<Code> code, WriteBarrierMode mode,
-                             bool keep_tiering_request);
+  inline void UpdateCodeImpl(Isolate* isolate, Tagged<Code> code,
+                             WriteBarrierMode mode, bool keep_tiering_request);
 
   // Updates the Code in this function's dispatch table entry.
   inline void UpdateDispatchEntry(
diff --git a/deps/v8/src/objects/js-list-format.cc b/deps/v8/src/objects/js-list-format.cc
index d5dacda547b667..97a0f6a8f5162b 100644
--- a/deps/v8/src/objects/js-list-format.cc
+++ b/deps/v8/src/objects/js-list-format.cc
@@ -266,7 +266,7 @@ MaybeDirectHandle<JSArray> FormattedListToJSArray(
   if (U_FAILURE(status)) {
     THROW_NEW_ERROR(isolate, NewTypeError(MessageTemplate::kIcuError));
   }
-  JSObject::ValidateElements(*array);
+  JSObject::ValidateElements(isolate, *array);
   return array;
 }
 
diff --git a/deps/v8/src/objects/js-locale.cc b/deps/v8/src/objects/js-locale.cc
index 6d2799d10b3eb2..4782d1c66f51a9 100644
--- a/deps/v8/src/objects/js-locale.cc
+++ b/deps/v8/src/objects/js-locale.cc
@@ -139,7 +139,7 @@ DirectHandle<Object> UnicodeKeywordValue(Isolate* isolate,
   return isolate->factory()->NewStringFromAsciiChecked(value.c_str());
 }
 
-bool IsCheckRange(const std::string& str, size_t min, size_t max,
+bool IsCheckRange(std::string_view str, size_t min, size_t max,
                   bool(range_check_func)(char)) {
   if (!base::IsInRange(str.length(), min, max)) return false;
   for (size_t i = 0; i < str.length(); i++) {
@@ -147,51 +147,51 @@ bool IsCheckRange(const std::string& str, size_t min, size_t max,
   }
   return true;
 }
-bool IsAlpha(const std::string& str, size_t min, size_t max) {
+bool IsAlpha(std::string_view str, size_t min, size_t max) {
   return IsCheckRange(str, min, max, [](char c) -> bool {
     return base::IsInRange(c, 'a', 'z') || base::IsInRange(c, 'A', 'Z');
   });
 }
 
-bool IsDigit(const std::string& str, size_t min, size_t max) {
+bool IsDigit(std::string_view str, size_t min, size_t max) {
   return IsCheckRange(str, min, max, [](char c) -> bool {
     return base::IsInRange(c, '0', '9');
   });
 }
 
-bool IsAlphanum(const std::string& str, size_t min, size_t max) {
+bool IsAlphanum(std::string_view str, size_t min, size_t max) {
   return IsCheckRange(str, min, max, [](char c) -> bool {
     return base::IsInRange(c, 'a', 'z') || base::IsInRange(c, 'A', 'Z') ||
            base::IsInRange(c, '0', '9');
   });
 }
 
-bool IsUnicodeLanguageSubtag(const std::string& value) {
+bool IsUnicodeLanguageSubtag(std::string_view value) {
   // unicode_language_subtag = alpha{2,3} | alpha{5,8};
   return IsAlpha(value, 2, 3) || IsAlpha(value, 5, 8);
 }
 
-bool IsUnicodeScriptSubtag(const std::string& value) {
+bool IsUnicodeScriptSubtag(std::string_view value) {
   // unicode_script_subtag = alpha{4} ;
   return IsAlpha(value, 4, 4);
 }
 
-bool IsUnicodeRegionSubtag(const std::string& value) {
+bool IsUnicodeRegionSubtag(std::string_view value) {
   // unicode_region_subtag = (alpha{2} | digit{3});
   return IsAlpha(value, 2, 2) || IsDigit(value, 3, 3);
 }
 
-bool IsDigitAlphanum3(const std::string& value) {
+bool IsDigitAlphanum3(std::string_view value) {
   return value.length() == 4 && base::IsInRange(value[0], '0', '9') &&
          IsAlphanum(value.substr(1), 3, 3);
 }
 
-bool IsUnicodeVariantSubtag(const std::string& value) {
+bool IsUnicodeVariantSubtag(std::string_view value) {
   // unicode_variant_subtag = (alphanum{5,8} | digit alphanum{3}) ;
   return IsAlphanum(value, 5, 8) || IsDigitAlphanum3(value);
 }
 
-bool IsExtensionSingleton(const std::string& value) {
+bool IsExtensionSingleton(std::string_view value) {
   return IsAlphanum(value, 1, 1);
 }
 
@@ -203,8 +203,8 @@ int32_t weekdayFromEDaysOfWeek(icu::Calendar::EDaysOfWeek eDaysOfWeek) {
 
 // Implemented as iteration instead of recursion to avoid stack overflow for
 // very long input strings.
-bool JSLocale::Is38AlphaNumList(const std::string& in) {
-  std::string value = in;
+bool JSLocale::Is38AlphaNumList(std::string_view in) {
+  std::string_view value = in;
   while (true) {
     std::size_t found_dash = value.find('-');
     if (found_dash == std::string::npos) {
@@ -215,23 +215,28 @@ bool JSLocale::Is38AlphaNumList(const std::string& in) {
   }
 }
 
-bool JSLocale::Is3Alpha(const std::string& value) {
-  return IsAlpha(value, 3, 3);
-}
+bool JSLocale::Is3Alpha(std::string_view value) { return IsAlpha(value, 3, 3); }
 
 // TODO(ftang) Replace the following check w/ icu::LocaleBuilder
 // once ICU64 land in March 2019.
-bool JSLocale::StartsWithUnicodeLanguageId(const std::string& value) {
+bool JSLocale::StartsWithUnicodeLanguageId(std::string_view value) {
   // unicode_language_id =
   // unicode_language_subtag (sep unicode_script_subtag)?
   //   (sep unicode_region_subtag)? (sep unicode_variant_subtag)* ;
-  std::vector<std::string> tokens;
-  std::string token;
-  std::istringstream token_stream(value);
-  while (std::getline(token_stream, token, '-')) {
-    tokens.push_back(token);
+  if (value.empty()) return false;
+  std::vector<std::string_view> tokens;
+  size_t token_start = 0;
+  size_t token_end;
+  for (token_end = 0; token_end < value.size(); ++token_end) {
+    if (value[token_end] == '-') {
+      tokens.emplace_back(&value[token_start], token_end - token_start);
+      token_start = token_end + 1;
+    }
   }
-  if (tokens.empty()) return false;
+  if (token_start != token_end) {
+    tokens.emplace_back(&value[token_start], token_end - token_start);
+  }
+  DCHECK(!tokens.empty());
 
   // length >= 1
   if (!IsUnicodeLanguageSubtag(tokens[0])) return false;
@@ -774,7 +779,10 @@ DirectHandle<Object> JSLocale::Language(Isolate* isolate,
                                         DirectHandle<JSLocale> locale) {
   Factory* factory = isolate->factory();
   const char* language = locale->icu_locale()->raw()->getLanguage();
-  if (strlen(language) == 0) return factory->undefined_value();
+  constexpr const char kUnd[] = "und";
+  if (strlen(language) == 0) {
+    language = kUnd;
+  }
   return factory->NewStringFromAsciiChecked(language);
 }
 
diff --git a/deps/v8/src/objects/js-locale.h b/deps/v8/src/objects/js-locale.h
index 51eebbf18d3978..db1d9148589f02 100644
--- a/deps/v8/src/objects/js-locale.h
+++ b/deps/v8/src/objects/js-locale.h
@@ -83,14 +83,14 @@ class JSLocale : public TorqueGeneratedJSLocale<JSLocale, JSObject> {
   static std::string ToString(DirectHandle<JSLocale> locale);
 
   // Help function to validate locale by other Intl objects.
-  static bool StartsWithUnicodeLanguageId(const std::string& value);
+  static bool StartsWithUnicodeLanguageId(std::string_view value);
 
   // Help function to check well-formed
   // "(3*8alphanum) *("-" (3*8alphanum)) sequence" sequence
-  static bool Is38AlphaNumList(const std::string& value);
+  static bool Is38AlphaNumList(std::string_view value);
 
   // Help function to check well-formed "3alpha"
-  static bool Is3Alpha(const std::string& value);
+  static bool Is3Alpha(std::string_view value);
 
   DECL_ACCESSORS(icu_locale, Tagged<Managed<icu::Locale>>)
 
diff --git a/deps/v8/src/objects/js-number-format.cc b/deps/v8/src/objects/js-number-format.cc
index d47185bed04540..721d428af135b2 100644
--- a/deps/v8/src/objects/js-number-format.cc
+++ b/deps/v8/src/objects/js-number-format.cc
@@ -1482,6 +1482,14 @@ MaybeDirectHandle<JSNumberFormat> JSNumberFormat::New(
 
 namespace {
 
+template <typename StringHandle>
+int32_t SignedStringLength(StringHandle string) {
+  uint32_t unsigned_length = string->length();
+  static_assert(String::kMaxLength < std::numeric_limits<int32_t>::max());
+  SBXCHECK_LE(unsigned_length, String::kMaxLength);
+  return static_cast<int32_t>(unsigned_length);
+}
+
 icu::number::FormattedNumber FormatDecimalString(
     Isolate* isolate,
     const icu::number::LocalizedNumberFormatter& number_format,
@@ -1489,7 +1497,7 @@ icu::number::FormattedNumber FormatDecimalString(
   string = String::Flatten(isolate, string);
   DisallowGarbageCollection no_gc;
   const String::FlatContent& flat = string->GetFlatContent(no_gc);
-  int32_t length = static_cast<int32_t>(string->length());
+  int32_t length = SignedStringLength(string);
   if (flat.IsOneByte()) {
     const char* char_buffer =
         reinterpret_cast<const char*>(flat.ToOneByteVector().begin());
@@ -1532,7 +1540,7 @@ Maybe<icu::number::FormattedNumber> IcuFormatNumber(
     big_int_string = String::Flatten(isolate, big_int_string);
     DisallowGarbageCollection no_gc;
     const String::FlatContent& flat = big_int_string->GetFlatContent(no_gc);
-    int32_t length = static_cast<int32_t>(big_int_string->length());
+    int32_t length = SignedStringLength(big_int_string);
     DCHECK(flat.IsOneByte());
     const char* char_buffer =
         reinterpret_cast<const char*>(flat.ToOneByteVector().begin());
@@ -1545,7 +1553,7 @@ Maybe<icu::number::FormattedNumber> IcuFormatNumber(
           String::Flatten(isolate, Cast<String>(numeric_obj));
       DisallowGarbageCollection no_gc;
       const String::FlatContent& flat = string->GetFlatContent(no_gc);
-      int32_t length = static_cast<int32_t>(string->length());
+      int32_t length = SignedStringLength(string);
       if (flat.IsOneByte()) {
         const char* char_buffer =
             reinterpret_cast<const char*>(flat.ToOneByteVector().begin());
@@ -1782,7 +1790,7 @@ Maybe<icu::Formattable> IntlMathematicalValue::ToFormattable(
   {
     DisallowGarbageCollection no_gc;
     const String::FlatContent& flat = string->GetFlatContent(no_gc);
-    int32_t length = static_cast<int32_t>(string->length());
+    int32_t length = SignedStringLength(string);
     if (flat.IsOneByte()) {
       icu::Formattable result(
           {reinterpret_cast<const char*>(flat.ToOneByteVector().begin()),
@@ -1984,7 +1992,7 @@ Maybe<int> ConstructParts(Isolate* isolate,
     }
     ++index;
   }
-  JSObject::ValidateElements(*result);
+  JSObject::ValidateElements(isolate, *result);
   return Just(index);
 }
 
diff --git a/deps/v8/src/objects/js-objects-inl.h b/deps/v8/src/objects/js-objects-inl.h
index d9ef8fbd94e0c5..67e549a9555fb3 100644
--- a/deps/v8/src/objects/js-objects-inl.h
+++ b/deps/v8/src/objects/js-objects-inl.h
@@ -13,6 +13,8 @@
 #include "src/common/globals.h"
 #include "src/heap/heap-layout-inl.h"
 #include "src/heap/heap-write-barrier.h"
+#include "src/objects/cpp-heap-external-object.h"
+#include "src/objects/cpp-heap-object-wrapper.h"
 #include "src/objects/dictionary.h"
 #include "src/objects/elements.h"
 #include "src/objects/embedder-data-slot-inl.h"
@@ -163,20 +165,21 @@ RELAXED_ACCESSORS(JSReceiver, raw_properties_or_hash, Tagged<Object>,
                   kPropertiesOrHashOffset)
 
 void JSObject::EnsureCanContainHeapObjectElements(
-    DirectHandle<JSObject> object) {
-  JSObject::ValidateElements(*object);
+    Isolate* isolate, DirectHandle<JSObject> object) {
+  JSObject::ValidateElements(isolate, *object);
   ElementsKind elements_kind = object->map()->elements_kind();
   if (!IsObjectElementsKind(elements_kind)) {
     if (IsHoleyElementsKind(elements_kind)) {
-      TransitionElementsKind(object, HOLEY_ELEMENTS);
+      TransitionElementsKind(isolate, object, HOLEY_ELEMENTS);
     } else {
-      TransitionElementsKind(object, PACKED_ELEMENTS);
+      TransitionElementsKind(isolate, object, PACKED_ELEMENTS);
     }
   }
 }
 
 template <typename TSlot>
-void JSObject::EnsureCanContainElements(DirectHandle<JSObject> object,
+void JSObject::EnsureCanContainElements(Isolate* isolate,
+                                        DirectHandle<JSObject> object,
                                         TSlot objects, uint32_t count,
                                         EnsureElementsMode mode) {
   static_assert(std::is_same<TSlot, FullObjectSlot>::value ||
@@ -221,11 +224,12 @@ void JSObject::EnsureCanContainElements(DirectHandle<JSObject> object,
     }
   }
   if (target_kind != current_kind) {
-    TransitionElementsKind(object, target_kind);
+    TransitionElementsKind(isolate, object, target_kind);
   }
 }
 
-void JSObject::EnsureCanContainElements(DirectHandle<JSObject> object,
+void JSObject::EnsureCanContainElements(Isolate* isolate,
+                                        DirectHandle<JSObject> object,
                                         DirectHandle<FixedArrayBase> elements,
                                         uint32_t length,
                                         EnsureElementsMode mode) {
@@ -237,22 +241,22 @@ void JSObject::EnsureCanContainElements(DirectHandle<JSObject> object,
       mode = DONT_ALLOW_DOUBLE_ELEMENTS;
     }
     ObjectSlot objects = Cast<FixedArray>(elements)->RawFieldOfFirstElement();
-    EnsureCanContainElements(object, objects, length, mode);
+    EnsureCanContainElements(isolate, object, objects, length, mode);
     return;
   }
 
   DCHECK(mode == ALLOW_COPIED_DOUBLE_ELEMENTS);
   if (object->GetElementsKind() == HOLEY_SMI_ELEMENTS) {
-    TransitionElementsKind(object, HOLEY_DOUBLE_ELEMENTS);
+    TransitionElementsKind(isolate, object, HOLEY_DOUBLE_ELEMENTS);
   } else if (object->GetElementsKind() == PACKED_SMI_ELEMENTS) {
     auto double_array = Cast<FixedDoubleArray>(elements);
     for (uint32_t i = 0; i < length; ++i) {
       if (double_array->is_the_hole(i)) {
-        TransitionElementsKind(object, HOLEY_DOUBLE_ELEMENTS);
+        TransitionElementsKind(isolate, object, HOLEY_DOUBLE_ELEMENTS);
         return;
       }
     }
-    TransitionElementsKind(object, PACKED_DOUBLE_ELEMENTS);
+    TransitionElementsKind(isolate, object, PACKED_DOUBLE_ELEMENTS);
   }
 }
 
@@ -644,50 +648,6 @@ TQ_OBJECT_CONSTRUCTORS_IMPL(JSExternalObject)
 EXTERNAL_POINTER_ACCESSORS(JSExternalObject, value, void*, kValueOffset,
                            kExternalObjectValueTag)
 
-JSApiWrapper::JSApiWrapper(Tagged<JSObject> object) : object_(object) {
-  DCHECK(IsJSApiWrapperObject(object));
-}
-
-template <CppHeapPointerTag lower_bound, CppHeapPointerTag upper_bound>
-void* JSApiWrapper::GetCppHeapWrappable(
-    IsolateForPointerCompression isolate) const {
-  return reinterpret_cast<void*>(
-      object_->ReadCppHeapPointerField<lower_bound, upper_bound>(
-          kCppHeapWrappableOffset, isolate));
-}
-
-void* JSApiWrapper::GetCppHeapWrappable(
-    IsolateForPointerCompression isolate,
-    CppHeapPointerTagRange tag_range) const {
-  return reinterpret_cast<void*>(object_->ReadCppHeapPointerField(
-      kCppHeapWrappableOffset, isolate, tag_range));
-}
-
-template <CppHeapPointerTag tag>
-void JSApiWrapper::SetCppHeapWrappable(IsolateForPointerCompression isolate,
-                                       void* instance) {
-  object_->WriteLazilyInitializedCppHeapPointerField<tag>(
-      JSAPIObjectWithEmbedderSlots::kCppHeapWrappableOffset, isolate,
-      reinterpret_cast<Address>(instance));
-  WriteBarrier::ForCppHeapPointer(
-      object_,
-      object_->RawCppHeapPointerField(
-          JSAPIObjectWithEmbedderSlots::kCppHeapWrappableOffset),
-      instance);
-}
-
-void JSApiWrapper::SetCppHeapWrappable(IsolateForPointerCompression isolate,
-                                       void* instance, CppHeapPointerTag tag) {
-  object_->WriteLazilyInitializedCppHeapPointerField(
-      JSAPIObjectWithEmbedderSlots::kCppHeapWrappableOffset, isolate,
-      reinterpret_cast<Address>(instance), tag);
-  WriteBarrier::ForCppHeapPointer(
-      object_,
-      object_->RawCppHeapPointerField(
-          JSAPIObjectWithEmbedderSlots::kCppHeapWrappableOffset),
-      instance);
-}
-
 bool JSMessageObject::DidEnsureSourcePositionsAvailable() const {
   return shared_info() == Smi::zero();
 }
@@ -1043,6 +1003,9 @@ inline int JSGlobalProxy::SizeWithEmbedderFields(int embedder_field_count) {
 ACCESSORS(JSIteratorResult, value, Tagged<Object>, kValueOffset)
 ACCESSORS(JSIteratorResult, done, Tagged<Object>, kDoneOffset)
 
+ACCESSORS(JSUint8ArraySetFromResult, read, Tagged<Object>, kReadOffset)
+ACCESSORS(JSUint8ArraySetFromResult, written, Tagged<Object>, kWrittenOffset)
+
 // If the fast-case backing storage takes up much more memory than a dictionary
 // backing storage would, the object should have slow elements.
 // static
diff --git a/deps/v8/src/objects/js-objects.cc b/deps/v8/src/objects/js-objects.cc
index df81ac01b43d63..00d567bc1f446d 100644
--- a/deps/v8/src/objects/js-objects.cc
+++ b/deps/v8/src/objects/js-objects.cc
@@ -104,7 +104,7 @@ Maybe<bool> JSReceiver::HasProperty(LookupIterator* it) {
         return JSProxy::HasProperty(it->isolate(), it->GetHolder<JSProxy>(),
                                     it->GetName());
       case LookupIterator::WASM_OBJECT:
-        return Just(false);
+        continue;  // Continue to the prototype, if present.
       case LookupIterator::INTERCEPTOR: {
         Maybe<PropertyAttributes> result =
             JSObject::GetPropertyAttributesWithInterceptor(it);
@@ -166,9 +166,10 @@ Handle<Object> JSReceiver::GetDataProperty(LookupIterator* it,
         if (!it->isolate()->context().is_null() && it->HasAccess()) continue;
         [[fallthrough]];
       case LookupIterator::JSPROXY:
-      case LookupIterator::WASM_OBJECT:
         it->NotFound();
         return it->isolate()->factory()->undefined_value();
+      case LookupIterator::WASM_OBJECT:
+        continue;  // Continue to the prototype, if present.
       case LookupIterator::ACCESSOR:
         // TODO(verwaest): For now this doesn't call into AccessorInfo, since
         // clients don't need it. Update once relevant.
@@ -1190,7 +1191,7 @@ MaybeHandle<JSAny> GetPropertyWithInterceptorInternal(
   // interceptor calls.
   AssertNoContextChange ncc(isolate);
 
-  if (IsUndefined(interceptor->getter(), isolate)) {
+  if (!interceptor->has_getter()) {
     return isolate->factory()->undefined_value();
   }
 
@@ -1237,7 +1238,7 @@ Maybe<PropertyAttributes> GetPropertyAttributesWithInterceptorInternal(
   }
   PropertyCallbackArguments args(isolate, interceptor->data(), *receiver,
                                  *holder, Just(kDontThrow));
-  if (!IsUndefined(interceptor->query(), isolate)) {
+  if (interceptor->has_query()) {
     DirectHandle<Object> result;
     if (it->IsElement(*holder)) {
       result = args.CallIndexedQuery(interceptor, it->array_index());
@@ -1261,7 +1262,7 @@ Maybe<PropertyAttributes> GetPropertyAttributesWithInterceptorInternal(
       }
       return Just(static_cast<PropertyAttributes>(value));
     }
-  } else if (!IsUndefined(interceptor->getter(), isolate)) {
+  } else if (interceptor->has_getter()) {
     // TODO(verwaest): Use GetPropertyWithInterceptor?
     DirectHandle<Object> result;
     if (it->IsElement(*holder)) {
@@ -1289,7 +1290,7 @@ Maybe<InterceptorResult> SetPropertyWithInterceptorInternal(
   // interceptor calls.
   AssertNoContextChange ncc(isolate);
 
-  if (IsUndefined(interceptor->setter(), isolate)) {
+  if (!interceptor->has_setter()) {
     return Just(InterceptorResult::kNotIntercepted);
   }
 
@@ -1319,7 +1320,7 @@ Maybe<InterceptorResult> DefinePropertyWithInterceptorInternal(
   // interceptor calls.
   AssertNoContextChange ncc(isolate);
 
-  if (IsUndefined(interceptor->definer(), isolate)) {
+  if (!interceptor->has_definer()) {
     return Just(InterceptorResult::kNotIntercepted);
   }
 
@@ -1854,7 +1855,7 @@ Maybe<bool> GetPropertyDescriptorWithInterceptor(LookupIterator* it,
   }
   if (interceptor.is_null()) return Just(false);
   Isolate* isolate = it->isolate();
-  if (IsUndefined(interceptor->descriptor(), isolate)) return Just(false);
+  if (!interceptor->has_descriptor()) return Just(false);
 
   Handle<JSAny> result;
   DirectHandle<JSObject> holder = it->GetHolder<JSObject>();
@@ -2433,12 +2434,12 @@ MaybeDirectHandle<JSObject> JSObject::ObjectCreate(
   return isolate->factory()->NewFastOrSlowJSObjectFromMap(map);
 }
 
-void JSObject::EnsureWritableFastElements(DirectHandle<JSObject> object) {
+void JSObject::EnsureWritableFastElements(Isolate* isolate,
+                                          DirectHandle<JSObject> object) {
   DCHECK(object->HasSmiOrObjectElements() ||
          object->HasFastStringWrapperElements() ||
          object->HasAnyNonextensibleElements());
   Tagged<FixedArray> raw_elems = Cast<FixedArray>(object->elements());
-  Isolate* isolate = object->GetIsolate();
   if (raw_elems->map() != ReadOnlyRoots(isolate).fixed_cow_array_map()) return;
   DirectHandle<FixedArray> elems(raw_elems, isolate);
   DirectHandle<FixedArray> writable_elems =
@@ -2655,6 +2656,8 @@ int JSObject::GetHeaderSize(InstanceType type,
       return WasmExceptionPackage::kHeaderSize;
     case WASM_SUSPENDING_OBJECT_TYPE:
       return WasmSuspendingObject::kHeaderSize;
+    case WASM_DESCRIPTOR_OPTIONS_TYPE:
+      return WasmDescriptorOptions::kHeaderSize;
 #endif  // V8_ENABLE_WEBASSEMBLY
     default: {
       // Special type check for API Objects because they are in a large variable
@@ -2926,6 +2929,9 @@ void JSObject::JSObjectShortPrint(StringStream* accumulator) {
     case JS_EXTERNAL_OBJECT_TYPE:
       accumulator->Add("<JSExternalObject>");
       break;
+    case CPP_HEAP_EXTERNAL_OBJECT_TYPE:
+      accumulator->Add("<CppHeapExternalObject>");
+      break;
 
     default: {
       Tagged<Map> map_of_this = map();
@@ -3482,27 +3488,27 @@ Maybe<InterceptorResult> JSObject::SetPropertyWithInterceptor(
 }
 
 DirectHandle<Map> JSObject::GetElementsTransitionMap(
-    DirectHandle<JSObject> object, ElementsKind to_kind) {
-  DirectHandle<Map> map(object->map(), object->GetIsolate());
-  return Map::TransitionElementsTo(object->GetIsolate(), map, to_kind);
+    Isolate* isolate, DirectHandle<JSObject> object, ElementsKind to_kind) {
+  DirectHandle<Map> map(object->map(), isolate);
+  return Map::TransitionElementsTo(isolate, map, to_kind);
 }
 
-void JSObject::AllocateStorageForMap(DirectHandle<JSObject> object,
+void JSObject::AllocateStorageForMap(Isolate* isolate,
+                                     DirectHandle<JSObject> object,
                                      DirectHandle<Map> map) {
   DCHECK(object->map()->GetInObjectProperties() ==
          map->GetInObjectProperties());
   ElementsKind obj_kind = object->map()->elements_kind();
   ElementsKind map_kind = map->elements_kind();
-  Isolate* isolate = object->GetIsolate();
   if (map_kind != obj_kind) {
     ElementsKind to_kind = GetMoreGeneralElementsKind(map_kind, obj_kind);
     if (IsDictionaryElementsKind(obj_kind)) {
       to_kind = obj_kind;
     }
     if (IsDictionaryElementsKind(to_kind)) {
-      NormalizeElements(object);
+      NormalizeElements(isolate, object);
     } else {
-      TransitionElementsKind(object, to_kind);
+      TransitionElementsKind(isolate, object, to_kind);
     }
     map = MapUpdater{isolate, map}.ReconfigureElementsKind(to_kind);
   }
@@ -4060,9 +4066,8 @@ void JSObject::RequireSlowElements(Tagged<NumberDictionary> dictionary) {
 }
 
 DirectHandle<NumberDictionary> JSObject::NormalizeElements(
-    DirectHandle<JSObject> object) {
+    Isolate* isolate, DirectHandle<JSObject> object) {
   DCHECK(!object->HasTypedArrayOrRabGsabTypedArrayElements());
-  Isolate* isolate = object->GetIsolate();
   bool is_sloppy_arguments = object->HasSloppyArgumentsElements();
   {
     DisallowGarbageCollection no_gc;
@@ -4083,7 +4088,7 @@ DirectHandle<NumberDictionary> JSObject::NormalizeElements(
          object->HasSealedElements() || object->HasNonextensibleElements());
 
   DirectHandle<NumberDictionary> dictionary =
-      object->GetElementsAccessor()->Normalize(object);
+      object->GetElementsAccessor()->Normalize(isolate, object);
 
   // Switch to using the dictionary as the backing storage for elements.
   ElementsKind target_kind =
@@ -4091,7 +4096,7 @@ DirectHandle<NumberDictionary> JSObject::NormalizeElements(
       : object->HasFastStringWrapperElements() ? SLOW_STRING_WRAPPER_ELEMENTS
                                                : DICTIONARY_ELEMENTS;
   DirectHandle<Map> new_map =
-      JSObject::GetElementsTransitionMap(object, target_kind);
+      JSObject::GetElementsTransitionMap(isolate, object, target_kind);
   // Set the new map first to satisfy the elements type assert in
   // set_elements().
   JSObject::MigrateToMap(isolate, object, new_map);
@@ -4126,7 +4131,7 @@ Maybe<InterceptorResult> JSObject::DeletePropertyWithInterceptor(
 
   DCHECK_EQ(LookupIterator::INTERCEPTOR, it->state());
   DirectHandle<InterceptorInfo> interceptor(it->GetInterceptor());
-  if (IsUndefined(interceptor->deleter(), isolate)) {
+  if (!interceptor->has_deleter()) {
     return Just(InterceptorResult::kNotIntercepted);
   }
   DirectHandle<JSObject> holder = it->GetHolder<JSObject>();
@@ -4311,7 +4316,8 @@ Maybe<bool> JSObject::PreventExtensions(Isolate* isolate,
   DCHECK(!object->HasTypedArrayOrRabGsabTypedArrayElements());
 
   // Normalize fast elements.
-  DirectHandle<NumberDictionary> dictionary = NormalizeElements(object);
+  DirectHandle<NumberDictionary> dictionary =
+      NormalizeElements(isolate, object);
   DCHECK(object->HasDictionaryElements() || object->HasSlowArgumentsElements());
 
   // Make sure that we never go back to fast case.
@@ -4393,7 +4399,7 @@ DirectHandle<NumberDictionary> CreateElementDictionary(
                      : object->elements()->length();
     new_element_dictionary =
         length == 0 ? isolate->factory()->empty_slow_element_dictionary()
-                    : object->GetElementsAccessor()->Normalize(object);
+                    : object->GetElementsAccessor()->Normalize(isolate, object);
   }
   return new_element_dictionary;
 }
@@ -4485,11 +4491,11 @@ Maybe<bool> JSObject::PreventExtensionsWithTransition(
   switch (object->map()->elements_kind()) {
     case PACKED_SMI_ELEMENTS:
     case PACKED_DOUBLE_ELEMENTS:
-      JSObject::TransitionElementsKind(object, PACKED_ELEMENTS);
+      JSObject::TransitionElementsKind(isolate, object, PACKED_ELEMENTS);
       break;
     case HOLEY_SMI_ELEMENTS:
     case HOLEY_DOUBLE_ELEMENTS:
-      JSObject::TransitionElementsKind(object, HOLEY_ELEMENTS);
+      JSObject::TransitionElementsKind(isolate, object, HOLEY_ELEMENTS);
       break;
     default:
       break;
@@ -5339,18 +5345,20 @@ void JSObject::SetImmutableProto(Isolate* isolate,
   object->set_map(isolate, *new_map, kReleaseStore);
 }
 
-void JSObject::EnsureCanContainElements(DirectHandle<JSObject> object,
+void JSObject::EnsureCanContainElements(Isolate* isolate,
+                                        DirectHandle<JSObject> object,
                                         JavaScriptArguments* args,
                                         uint32_t arg_count,
                                         EnsureElementsMode mode) {
-  return EnsureCanContainElements(
-      object, FullObjectSlot(args->address_of_arg_at(0)), arg_count, mode);
+  return EnsureCanContainElements(isolate, object,
+                                  FullObjectSlot(args->address_of_arg_at(0)),
+                                  arg_count, mode);
 }
 
-void JSObject::ValidateElements(Tagged<JSObject> object) {
+void JSObject::ValidateElements(Isolate* isolate, Tagged<JSObject> object) {
 #ifdef ENABLE_SLOW_DCHECKS
   if (v8_flags.enable_slow_asserts) {
-    object->GetElementsAccessor()->Validate(object);
+    object->GetElementsAccessor()->Validate(isolate, object);
   }
 #endif
 }
@@ -5419,11 +5427,10 @@ static ElementsKind BestFittingFastElementsKind(Tagged<JSObject> object) {
 }
 
 // static
-Maybe<bool> JSObject::AddDataElement(DirectHandle<JSObject> object,
+Maybe<bool> JSObject::AddDataElement(Isolate* isolate,
+                                     DirectHandle<JSObject> object,
                                      uint32_t index, DirectHandle<Object> value,
                                      PropertyAttributes attributes) {
-  Isolate* isolate = object->GetIsolate();
-
   DCHECK(object->map(isolate)->is_extensible());
 
   uint32_t old_length = 0;
@@ -5464,8 +5471,9 @@ Maybe<bool> JSObject::AddDataElement(DirectHandle<JSObject> object,
   }
   to = GetMoreGeneralElementsKind(kind, to);
   ElementsAccessor* accessor = ElementsAccessor::ForKind(to);
-  MAYBE_RETURN(accessor->Add(object, index, value, attributes, new_capacity),
-               Nothing<bool>());
+  MAYBE_RETURN(
+      accessor->Add(isolate, object, index, value, attributes, new_capacity),
+      Nothing<bool>());
 
   if (IsJSArray(*object, isolate) && index >= old_length) {
     DirectHandle<Number> new_length =
@@ -5476,7 +5484,8 @@ Maybe<bool> JSObject::AddDataElement(DirectHandle<JSObject> object,
 }
 
 template <AllocationSiteUpdateMode update_or_check>
-bool JSObject::UpdateAllocationSite(DirectHandle<JSObject> object,
+bool JSObject::UpdateAllocationSite(Isolate* isolate,
+                                    DirectHandle<JSObject> object,
                                     ElementsKind to_kind) {
   if (!IsJSArray(*object)) return false;
 
@@ -5488,7 +5497,7 @@ bool JSObject::UpdateAllocationSite(DirectHandle<JSObject> object,
   {
     DisallowGarbageCollection no_gc;
 
-    Heap* heap = object->GetHeap();
+    Heap* heap = isolate->heap();
     Tagged<AllocationMemento> memento =
         PretenuringHandler::FindAllocationMemento<
             PretenuringHandler::kForRuntime>(heap, object->map(), *object);
@@ -5497,18 +5506,19 @@ bool JSObject::UpdateAllocationSite(DirectHandle<JSObject> object,
     // Walk through to the Allocation Site
     site = direct_handle(memento->GetAllocationSite(), heap->isolate());
   }
-  return AllocationSite::DigestTransitionFeedback<update_or_check>(site,
-                                                                   to_kind);
+  return AllocationSite::DigestTransitionFeedback<update_or_check>(
+      isolate, site, to_kind);
 }
 
 template bool
 JSObject::UpdateAllocationSite<AllocationSiteUpdateMode::kCheckOnly>(
-    DirectHandle<JSObject> object, ElementsKind to_kind);
+    Isolate* isolate, DirectHandle<JSObject> object, ElementsKind to_kind);
 
 template bool JSObject::UpdateAllocationSite<AllocationSiteUpdateMode::kUpdate>(
-    DirectHandle<JSObject> object, ElementsKind to_kind);
+    Isolate* isolate, DirectHandle<JSObject> object, ElementsKind to_kind);
 
-void JSObject::TransitionElementsKind(DirectHandle<JSObject> object,
+void JSObject::TransitionElementsKind(Isolate* isolate,
+                                      DirectHandle<JSObject> object,
                                       ElementsKind to_kind) {
   ElementsKind from_kind = object->GetElementsKind();
 
@@ -5524,13 +5534,13 @@ void JSObject::TransitionElementsKind(DirectHandle<JSObject> object,
   DCHECK(IsFastElementsKind(to_kind) || IsNonextensibleElementsKind(to_kind));
   DCHECK_NE(TERMINAL_FAST_ELEMENTS_KIND, from_kind);
 
-  UpdateAllocationSite(object, to_kind);
-  Isolate* isolate = object->GetIsolate();
+  UpdateAllocationSite(isolate, object, to_kind);
   if (object->elements() == ReadOnlyRoots(isolate).empty_fixed_array() ||
       IsDoubleElementsKind(from_kind) == IsDoubleElementsKind(to_kind)) {
     // No change is needed to the elements() buffer, the transition
     // only requires a map change.
-    DirectHandle<Map> new_map = GetElementsTransitionMap(object, to_kind);
+    DirectHandle<Map> new_map =
+        GetElementsTransitionMap(isolate, object, to_kind);
     JSObject::MigrateToMap(isolate, object, new_map);
     if (v8_flags.trace_elements_transitions) {
       DirectHandle<FixedArrayBase> elms(object->elements(), isolate);
@@ -5541,7 +5551,7 @@ void JSObject::TransitionElementsKind(DirectHandle<JSObject> object,
            (IsDoubleElementsKind(from_kind) && IsObjectElementsKind(to_kind)));
     uint32_t c = static_cast<uint32_t>(object->elements()->length());
     if (ElementsAccessor::ForKind(to_kind)
-            ->GrowCapacityAndConvert(object, c)
+            ->GrowCapacityAndConvert(isolate, object, c)
             .IsNothing()) {
       // TODO(victorgomes): Temporarily forcing a fatal error here in case of
       // overflow, until all users of TransitionElementsKind can handle
diff --git a/deps/v8/src/objects/js-objects.h b/deps/v8/src/objects/js-objects.h
index eb98bc2208268a..a7f1c8b2f65fbb 100644
--- a/deps/v8/src/objects/js-objects.h
+++ b/deps/v8/src/objects/js-objects.h
@@ -464,7 +464,8 @@ class JSObject : public TorqueGeneratedJSObject<JSObject, JSReceiver> {
   DECL_GETTER(element_dictionary, Tagged<NumberDictionary>)
 
   // Requires: HasFastElements().
-  static void EnsureWritableFastElements(DirectHandle<JSObject> object);
+  static void EnsureWritableFastElements(Isolate* isolate,
+                                         DirectHandle<JSObject> object);
 
   V8_WARN_UNUSED_RESULT static Maybe<InterceptorResult>
   SetPropertyWithInterceptor(LookupIterator* it,
@@ -529,12 +530,13 @@ class JSObject : public TorqueGeneratedJSObject<JSObject, JSReceiver> {
                           PropertyAttributes attributes);
 
   V8_EXPORT_PRIVATE static Maybe<bool> AddDataElement(
-      DirectHandle<JSObject> receiver, uint32_t index,
+      Isolate* isolate, DirectHandle<JSObject> receiver, uint32_t index,
       DirectHandle<Object> value, PropertyAttributes attributes);
 
   // Extend the receiver with a single fast property appeared first in the
   // passed map. This also extends the property backing store if necessary.
-  static void AllocateStorageForMap(DirectHandle<JSObject> object,
+  static void AllocateStorageForMap(Isolate* isolate,
+                                    DirectHandle<JSObject> object,
                                     DirectHandle<Map> map);
 
   // Migrates the given object to a map whose field representations are the
@@ -622,22 +624,25 @@ class JSObject : public TorqueGeneratedJSObject<JSObject, JSReceiver> {
   V8_WARN_UNUSED_RESULT static MaybeHandle<JSAny> GetPropertyWithInterceptor(
       LookupIterator* it, bool* done);
 
-  static void ValidateElements(Tagged<JSObject> object);
+  static void ValidateElements(Isolate* isolate, Tagged<JSObject> object);
 
   // Makes sure that this object can contain HeapObject as elements.
   static inline void EnsureCanContainHeapObjectElements(
-      DirectHandle<JSObject> obj);
+      Isolate* isolate, DirectHandle<JSObject> obj);
 
   // Makes sure that this object can contain the specified elements.
   // TSlot here is either ObjectSlot or FullObjectSlot.
   template <typename TSlot>
-  static inline void EnsureCanContainElements(DirectHandle<JSObject> object,
+  static inline void EnsureCanContainElements(Isolate* isolate,
+                                              DirectHandle<JSObject> object,
                                               TSlot elements, uint32_t count,
                                               EnsureElementsMode mode);
   static inline void EnsureCanContainElements(
-      DirectHandle<JSObject> object, DirectHandle<FixedArrayBase> elements,
-      uint32_t length, EnsureElementsMode mode);
-  static void EnsureCanContainElements(DirectHandle<JSObject> object,
+      Isolate* isolate, DirectHandle<JSObject> object,
+      DirectHandle<FixedArrayBase> elements, uint32_t length,
+      EnsureElementsMode mode);
+  static void EnsureCanContainElements(Isolate* isolate,
+                                       DirectHandle<JSObject> object,
                                        JavaScriptArguments* arguments,
                                        uint32_t arg_count,
                                        EnsureElementsMode mode);
@@ -667,7 +672,8 @@ class JSObject : public TorqueGeneratedJSObject<JSObject, JSReceiver> {
   // These methods do not perform access checks!
   template <AllocationSiteUpdateMode update_or_check =
                 AllocationSiteUpdateMode::kUpdate>
-  static bool UpdateAllocationSite(DirectHandle<JSObject> object,
+  static bool UpdateAllocationSite(Isolate* isolate,
+                                   DirectHandle<JSObject> object,
                                    ElementsKind to_kind);
 
   // Lookup interceptors are used for handling properties controlled by host
@@ -712,9 +718,9 @@ class JSObject : public TorqueGeneratedJSObject<JSObject, JSReceiver> {
   // Returns a new map with all transitions dropped from the object's current
   // map and the ElementsKind set.
   static DirectHandle<Map> GetElementsTransitionMap(
-      DirectHandle<JSObject> object, ElementsKind to_kind);
+      Isolate* isolate, DirectHandle<JSObject> object, ElementsKind to_kind);
   V8_EXPORT_PRIVATE static void TransitionElementsKind(
-      DirectHandle<JSObject> object, ElementsKind to_kind);
+      Isolate* isolate, DirectHandle<JSObject> object, ElementsKind to_kind);
 
   // Always use this to migrate an object to a new map.
   // |expected_additional_properties| is only used for fast-to-slow transitions
@@ -749,7 +755,7 @@ class JSObject : public TorqueGeneratedJSObject<JSObject, JSReceiver> {
   // Convert and update the elements backing store to be a
   // NumberDictionary dictionary.  Returns the backing after conversion.
   V8_EXPORT_PRIVATE static DirectHandle<NumberDictionary> NormalizeElements(
-      DirectHandle<JSObject> object);
+      Isolate* isolate, DirectHandle<JSObject> object);
 
   void RequireSlowElements(Tagged<NumberDictionary> dictionary);
 
@@ -1082,31 +1088,6 @@ class JSSpecialObject
   TQ_OBJECT_CONSTRUCTORS(JSSpecialObject)
 };
 
-// Helper union that doesn't actually exist as type. Use by value.
-class JSApiWrapper {
- public:
-  V8_INLINE explicit JSApiWrapper(Tagged<JSObject> object);
-
-  template <CppHeapPointerTag tag>
-  V8_INLINE void SetCppHeapWrappable(IsolateForPointerCompression isolate,
-                                     void*);
-  V8_INLINE void SetCppHeapWrappable(IsolateForPointerCompression isolate,
-                                     void*, CppHeapPointerTag tag);
-  template <CppHeapPointerTag lower_bound, CppHeapPointerTag upper_bound>
-  V8_INLINE void* GetCppHeapWrappable(
-      IsolateForPointerCompression isolate) const;
-  V8_INLINE void* GetCppHeapWrappable(IsolateForPointerCompression isolate,
-                                      CppHeapPointerTagRange tag_range) const;
-
- private:
-  static_assert(JSAPIObjectWithEmbedderSlots::kCppHeapWrappableOffset ==
-                JSSpecialObject::kCppHeapWrappableOffset);
-  static constexpr int kCppHeapWrappableOffset =
-      JSAPIObjectWithEmbedderSlots::kCppHeapWrappableOffset;
-
-  Tagged<JSObject> object_;
-};
-
 // JSAccessorPropertyDescriptor is just a JSObject with a specific initial
 // map. This initial map adds in-object properties for "get", "set",
 // "enumerable" and "configurable" properties, as assigned by the
@@ -1471,6 +1452,32 @@ class JSPromiseWithResolversResult : public JSObject {
   OBJECT_CONSTRUCTORS(JSPromiseWithResolversResult, JSObject);
 };
 
+// JSUint8ArraySetFromResult is just a JSObject with a specific initial map.
+// This initial map adds in-object properties for "read" and "written",
+class JSUint8ArraySetFromResult : public JSObject {
+ public:
+  DECL_ACCESSORS(read, Tagged<Object>)
+
+  DECL_ACCESSORS(written, Tagged<Object>)
+
+  // Layout description.
+#define JS_UINT8_ARRAY_SET_FROM_RESULT_FIELDS(V) \
+  V(kReadOffset, kTaggedSize)                    \
+  V(kWrittenOffset, kTaggedSize)                 \
+  /* Total size. */                              \
+  V(kSize, 0)
+
+  DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
+                                JS_UINT8_ARRAY_SET_FROM_RESULT_FIELDS)
+#undef JS_UINT8_ARRAY_SET_FROM_RESULT_FIELDS
+
+  // Indices of in-object properties.
+  static const int kReadIndex = 0;
+  static const int kWrittenIndex = 1;
+
+  OBJECT_CONSTRUCTORS(JSUint8ArraySetFromResult, JSObject);
+};
+
 }  // namespace v8::internal
 
 #include "src/objects/object-macros-undef.h"
diff --git a/deps/v8/src/objects/js-regexp.cc b/deps/v8/src/objects/js-regexp.cc
index 624d2adec0ac29..ddd3923460f63e 100644
--- a/deps/v8/src/objects/js-regexp.cc
+++ b/deps/v8/src/objects/js-regexp.cc
@@ -31,7 +31,7 @@ DirectHandle<JSRegExpResultIndices> JSRegExpResultIndices::BuildIndices(
   int num_results = num_indices >> 1;
   DirectHandle<FixedArray> indices_array =
       isolate->factory()->NewFixedArray(num_results);
-  JSArray::SetContent(indices, indices_array);
+  JSArray::SetContent(isolate, indices, indices_array);
 
   for (int i = 0; i < num_results; i++) {
     const int start_offset =
diff --git a/deps/v8/src/objects/js-relative-time-format.cc b/deps/v8/src/objects/js-relative-time-format.cc
index 84f890f09733bb..22fe8ec2d44485 100644
--- a/deps/v8/src/objects/js-relative-time-format.cc
+++ b/deps/v8/src/objects/js-relative-time-format.cc
@@ -486,7 +486,7 @@ MaybeDirectHandle<JSArray> FormatToJSArray(
     MAYBE_RETURN(maybe_added, DirectHandle<JSArray>());
   }
 
-  JSObject::ValidateElements(*array);
+  JSObject::ValidateElements(isolate, *array);
   return array;
 }
 
diff --git a/deps/v8/src/objects/js-segment-iterator.cc b/deps/v8/src/objects/js-segment-iterator.cc
index 923609506627d6..6efb16c8c1b2df 100644
--- a/deps/v8/src/objects/js-segment-iterator.cc
+++ b/deps/v8/src/objects/js-segment-iterator.cc
@@ -135,11 +135,10 @@ MaybeDirectHandle<JSReceiver> JSSegmentIterator::Next(
     DisallowHeapAllocation no_gc;
     // We can skip write barriers because {segment_data} is the last object
     // that was allocated.
-    raw->set_segment(
-        code <= unibrow::Latin1::kMaxChar
-            ? Cast<String>(factory->single_character_string_table()->get(code))
-            : *segment,
-        SKIP_WRITE_BARRIER);
+    raw->set_segment(code <= unibrow::Latin1::kMaxChar
+                         ? ReadOnlyRoots(isolate).single_character_string(code)
+                         : *segment,
+                     SKIP_WRITE_BARRIER);
     raw->set_index(
         Smi::IsValid(start_index) ? Smi::FromInt(start_index) : *index,
         SKIP_WRITE_BARRIER);
diff --git a/deps/v8/src/objects/keys.cc b/deps/v8/src/objects/keys.cc
index 7a6f0362c0311c..c4f3794c8ae4c3 100644
--- a/deps/v8/src/objects/keys.cc
+++ b/deps/v8/src/objects/keys.cc
@@ -702,7 +702,7 @@ KeyAccumulator::FilterForEnumerableProperties(
 
   size_t length = accessor->GetCapacity(*result, result->elements());
   for (InternalIndex entry : InternalIndex::Range(length)) {
-    if (!accessor->HasEntry(*result, entry)) continue;
+    if (!accessor->HasEntry(isolate(), *result, entry)) continue;
 
     // args are invalid after args.Call(), create a new one in every iteration.
     // Query callbacks are not expected to have side effects.
@@ -739,7 +739,8 @@ Maybe<bool> KeyAccumulator::CollectInterceptorKeysInternal(
   PropertyCallbackArguments enum_args(isolate_, interceptor->data(), *receiver,
                                       *object, Just(kDontThrow));
 
-  if (IsUndefined(interceptor->enumerator(), isolate_)) {
+  DCHECK_EQ(interceptor->is_named(), type == kNamed);
+  if (!interceptor->has_enumerator()) {
     return Just(true);
   }
   DirectHandle<JSObjectOrUndefined> maybe_result;
@@ -759,8 +760,7 @@ Maybe<bool> KeyAccumulator::CollectInterceptorKeysInternal(
   // happened up to this point.
   enum_args.AcceptSideEffects();
 
-  if ((filter_ & ONLY_ENUMERABLE) &&
-      !IsUndefined(interceptor->query(), isolate_)) {
+  if ((filter_ & ONLY_ENUMERABLE) && interceptor->has_query()) {
     RETURN_NOTHING_IF_NOT_SUCCESSFUL(FilterForEnumerableProperties(
         receiver, object, interceptor, result, type));
   } else {
diff --git a/deps/v8/src/objects/literal-objects.cc b/deps/v8/src/objects/literal-objects.cc
index 39c642b3de47d9..427185aebe16d3 100644
--- a/deps/v8/src/objects/literal-objects.cc
+++ b/deps/v8/src/objects/literal-objects.cc
@@ -126,7 +126,7 @@ void AddToDescriptorArrayTemplate(
         descriptor_array_template->Set(entry, &d);
         pair = *new_pair;
       }
-      SetAccessorPlaceholderIndices(*pair, value_kind, Cast<Smi>(*value),
+      SetAccessorPlaceholderIndices(pair, value_kind, Cast<Smi>(*value),
                                     kReleaseStore);
     }
   }
diff --git a/deps/v8/src/objects/lookup.cc b/deps/v8/src/objects/lookup.cc
index 5ec2b0e8aa3860..b17cced00c50d6 100644
--- a/deps/v8/src/objects/lookup.cc
+++ b/deps/v8/src/objects/lookup.cc
@@ -399,13 +399,13 @@ void LookupIterator::PrepareForDataProperty(DirectHandle<Object> value) {
     to = GetMoreGeneralElementsKind(kind, to);
 
     if (kind != to) {
-      JSObject::TransitionElementsKind(holder_obj, to);
+      JSObject::TransitionElementsKind(isolate(), holder_obj, to);
     }
 
     // Copy the backing store if it is copy-on-write.
     if (IsSmiOrObjectElementsKind(to) || IsSealedElementsKind(to) ||
         IsNonextensibleElementsKind(to)) {
-      JSObject::EnsureWritableFastElements(holder_obj);
+      JSObject::EnsureWritableFastElements(isolate(), holder_obj);
     }
     return;
   }
@@ -527,7 +527,7 @@ void LookupIterator::ReconfigureDataProperty(DirectHandle<Object> value,
     DirectHandle<FixedArrayBase> elements(holder_obj->elements(isolate_),
                                           isolate());
     holder_obj->GetElementsAccessor(isolate_)->Reconfigure(
-        holder_obj, elements, number_, value, attributes);
+        isolate_, holder_obj, elements, number_, value, attributes);
     ReloadPropertyInformation<true>();
   } else if (holder_obj->HasFastProperties(isolate_)) {
     DirectHandle<Map> old_map(holder_obj->map(isolate_), isolate_);
@@ -761,7 +761,7 @@ void LookupIterator::Delete() {
   if (IsElement(*holder)) {
     DirectHandle<JSObject> object = Cast<JSObject>(holder);
     ElementsAccessor* accessor = object->GetElementsAccessor(isolate_);
-    accessor->Delete(object, number_);
+    accessor->Delete(isolate_, object, number_);
   } else {
     DCHECK(!name()->IsPrivateName());
     bool is_prototype_map = holder->map(isolate_)->is_prototype_map();
@@ -867,7 +867,7 @@ void LookupIterator::TransitionToAccessorPair(DirectHandle<Object> pair,
     // TODO(verwaest): Move code into the element accessor.
     isolate_->CountUsage(v8::Isolate::kIndexAccessor);
     DirectHandle<NumberDictionary> dictionary =
-        JSObject::NormalizeElements(receiver);
+        JSObject::NormalizeElements(isolate_, receiver);
 
     dictionary = NumberDictionary::Set(isolate_, dictionary, array_index(),
                                        pair, receiver, details);
@@ -906,7 +906,8 @@ void LookupIterator::TransitionToAccessorPair(DirectHandle<Object> pair,
 }
 
 bool LookupIterator::HolderIsReceiver() const {
-  DCHECK(has_property_ || state_ == INTERCEPTOR || state_ == JSPROXY);
+  DCHECK(has_property_ || state_ == INTERCEPTOR || state_ == JSPROXY ||
+         state_ == TYPED_ARRAY_INDEX_NOT_FOUND);
   // Optimization that only works if configuration_ is not mutable.
   if (!check_prototype_chain()) return true;
   return *receiver_ == *holder_;
@@ -1323,10 +1324,10 @@ LookupIterator::State LookupIterator::LookupInSpecialHolder(
       return LookupInRegularHolder<is_element>(map, holder);
     case ACCESSOR:
     case DATA:
+    case WASM_OBJECT:
       return NOT_FOUND;
     case TYPED_ARRAY_INDEX_NOT_FOUND:
     case JSPROXY:
-    case WASM_OBJECT:
     case TRANSITION:
       UNREACHABLE();
   }
@@ -1465,7 +1466,7 @@ bool LookupIterator::LookupCachedProperty(
   DCHECK_EQ(state(), LookupIterator::ACCESSOR);
   DCHECK(IsAccessorPair(*GetAccessors(), isolate_));
 
-  Tagged<Object> getter = accessor_pair->getter(isolate_);
+  Tagged<Object> getter = accessor_pair->getter();
   std::optional<Tagged<Name>> maybe_name =
       FunctionTemplateInfo::TryGetCachedPropertyName(isolate(), getter);
   if (!maybe_name.has_value()) return false;
@@ -1555,7 +1556,7 @@ ConcurrentLookupIterator::TryGetOwnConstantElement(
   // - elements[i] (immutable if constant; be careful around dictionaries).
   // - holder.AsJSPrimitiveWrapper.value.AsString.length (immutable).
   // - holder.AsJSPrimitiveWrapper.value.AsString[i] (immutable).
-  // - single_character_string_table()->get().
+  // - roots.single_character_string(charcode).
 
   if (IsFrozenElementsKind(elements_kind)) {
     if (!IsFixedArray(elements)) return kGaveUp;
@@ -1623,13 +1624,10 @@ ConcurrentLookupIterator::Result ConcurrentLookupIterator::TryGetOwnChar(
 
   if (charcode > unibrow::Latin1::kMaxChar) return kGaveUp;
 
-  Tagged<Object> value =
-      isolate->factory()->single_character_string_table()->get(charcode,
-                                                               kRelaxedLoad);
-
-  DCHECK_NE(value, ReadOnlyRoots(isolate).undefined_value());
+  ReadOnlyRoots roots(isolate);
+  Tagged<String> value = roots.single_character_string(charcode);
 
-  *result_out = Cast<String>(value);
+  *result_out = value;
   return kPresent;
 }
 
@@ -1657,8 +1655,8 @@ ConcurrentLookupIterator::TryGetPropertyCell(
 
     std::optional<Tagged<Name>> maybe_cached_property_name =
         FunctionTemplateInfo::TryGetCachedPropertyName(
-            isolate, Cast<AccessorPair>(maybe_accessor_pair)
-                         ->getter(isolate, kAcquireLoad));
+            isolate,
+            Cast<AccessorPair>(maybe_accessor_pair)->getter(kAcquireLoad));
     if (!maybe_cached_property_name.has_value()) return {};
 
     maybe_cell = dict->TryFindPropertyCellForConcurrentLookupIterator(
diff --git a/deps/v8/src/objects/managed-inl.h b/deps/v8/src/objects/managed-inl.h
index c5fa186abd379e..cb4fb24b0c64e8 100644
--- a/deps/v8/src/objects/managed-inl.h
+++ b/deps/v8/src/objects/managed-inl.h
@@ -51,7 +51,7 @@ DirectHandle<Managed<CppType>> Managed<CppType>::From(
 template <class CppType>
 DirectHandle<TrustedManaged<CppType>> TrustedManaged<CppType>::From(
     Isolate* isolate, size_t estimated_size,
-    std::shared_ptr<CppType> shared_ptr) {
+    std::shared_ptr<CppType> shared_ptr, bool shared) {
   auto destructor = new ManagedPtrDestructor(
       estimated_size, new std::shared_ptr<CppType>{std::move(shared_ptr)},
       detail::Destructor<CppType>);
@@ -59,7 +59,7 @@ DirectHandle<TrustedManaged<CppType>> TrustedManaged<CppType>::From(
       reinterpret_cast<v8::Isolate*>(isolate), estimated_size);
   DirectHandle<TrustedManaged<CppType>> handle =
       Cast<TrustedManaged<CppType>>(isolate->factory()->NewTrustedForeign(
-          reinterpret_cast<Address>(destructor)));
+          reinterpret_cast<Address>(destructor), shared));
   IndirectHandle<Object> global_handle =
       isolate->global_handles()->Create(*handle);
   destructor->global_handle_location_ = global_handle.location();
diff --git a/deps/v8/src/objects/managed.h b/deps/v8/src/objects/managed.h
index 27b558b128f173..3ee2408064bc83 100644
--- a/deps/v8/src/objects/managed.h
+++ b/deps/v8/src/objects/managed.h
@@ -161,7 +161,7 @@ class TrustedManaged : public TrustedForeign {
   // {std::unique_ptr} (which will implicitly convert to {std::shared_ptr}).
   static DirectHandle<TrustedManaged<CppType>> From(
       Isolate* isolate, size_t estimated_size,
-      std::shared_ptr<CppType> shared_ptr);
+      std::shared_ptr<CppType> shared_ptr, bool shared);
 
  private:
   friend class Tagged<TrustedManaged>;
diff --git a/deps/v8/src/objects/map.cc b/deps/v8/src/objects/map.cc
index c9ab8c7c7e07e6..35e4e90895c135 100644
--- a/deps/v8/src/objects/map.cc
+++ b/deps/v8/src/objects/map.cc
@@ -43,7 +43,7 @@ Tagged<Map> Map::GetPrototypeChainRootMap(Isolate* isolate) const {
   if (constructor_function_index != Map::kNoConstructorFunctionIndex) {
     Tagged<Context> native_context = isolate->context()->native_context();
     Tagged<JSFunction> constructor_function =
-        Cast<JSFunction>(native_context->get(constructor_function_index));
+        Cast<JSFunction>(native_context->GetNoCell(constructor_function_index));
     return constructor_function->initial_map();
   }
   return ReadOnlyRoots(isolate).null_value()->map();
@@ -56,7 +56,8 @@ std::optional<Tagged<JSFunction>> Map::GetConstructorFunction(
   if (IsPrimitiveMap(map)) {
     int const constructor_function_index = map->GetConstructorFunctionIndex();
     if (constructor_function_index != kNoConstructorFunctionIndex) {
-      return Cast<JSFunction>(native_context->get(constructor_function_index));
+      return Cast<JSFunction>(
+          native_context->GetNoCell(constructor_function_index));
     }
   }
   return {};
@@ -115,6 +116,7 @@ VisitorId Map::GetVisitorId(Tagged<Map> map) {
     case ORDERED_HASH_SET_TYPE:
     case ORDERED_NAME_DICTIONARY_TYPE:
     case NAME_DICTIONARY_TYPE:
+    case SIMPLE_NAME_DICTIONARY_TYPE:
     case GLOBAL_DICTIONARY_TYPE:
     case NUMBER_DICTIONARY_TYPE:
     case SIMPLE_NUMBER_DICTIONARY_TYPE:
@@ -137,6 +139,9 @@ VisitorId Map::GetVisitorId(Tagged<Map> map) {
     case NATIVE_CONTEXT_TYPE:
       return kVisitNativeContext;
 
+    case CONTEXT_CELL_TYPE:
+      return kVisitContextCell;
+
     case EPHEMERON_HASH_TABLE_TYPE:
       return kVisitEphemeronHashTable;
 
@@ -164,9 +169,6 @@ VisitorId Map::GetVisitorId(Tagged<Map> map) {
     case PROPERTY_CELL_TYPE:
       return kVisitPropertyCell;
 
-    case CONTEXT_SIDE_PROPERTY_CELL_TYPE:
-      return kVisitContextSidePropertyCell;
-
     case TRANSITION_ARRAY_TYPE:
       return kVisitTransitionArray;
 
@@ -177,6 +179,9 @@ VisitorId Map::GetVisitorId(Tagged<Map> map) {
     case ACCESSOR_INFO_TYPE:
       return kVisitAccessorInfo;
 
+    case INTERCEPTOR_INFO_TYPE:
+      return kVisitInterceptorInfo;
+
     case FUNCTION_TEMPLATE_INFO_TYPE:
       return kVisitFunctionTemplateInfo;
 
@@ -336,6 +341,9 @@ VisitorId Map::GetVisitorId(Tagged<Map> map) {
     case JS_SPECIAL_API_OBJECT_TYPE:
       return kVisitJSApiObject;
 
+    case CPP_HEAP_EXTERNAL_OBJECT_TYPE:
+      return kVisitCppHeapExternalObject;
+
     case JS_DATE_TYPE:
       return kVisitJSDate;
 
@@ -384,7 +392,6 @@ VisitorId Map::GetVisitorId(Tagged<Map> map) {
     case ENUM_CACHE_TYPE:
     case ERROR_STACK_DATA_TYPE:
     case FUNCTION_TEMPLATE_RARE_DATA_TYPE:
-    case INTERCEPTOR_INFO_TYPE:
     case MODULE_REQUEST_TYPE:
     case PROMISE_CAPABILITY_TYPE:
     case PROMISE_REACTION_TYPE:
@@ -435,8 +442,6 @@ VisitorId Map::GetVisitorId(Tagged<Map> map) {
 #if V8_ENABLE_WEBASSEMBLY
     case WASM_ARRAY_TYPE:
       return kVisitWasmArray;
-    case WASM_CONTINUATION_OBJECT_TYPE:
-      return kVisitWasmContinuationObject;
     case WASM_MEMORY_MAP_DESCRIPTOR_TYPE:
       return kVisitWasmMemoryMapDescriptor;
     case WASM_FUNC_REF_TYPE:
@@ -453,6 +458,8 @@ VisitorId Map::GetVisitorId(Tagged<Map> map) {
       return kVisitWasmResumeData;
     case WASM_STRUCT_TYPE:
       return kVisitWasmStruct;
+    case WASM_DESCRIPTOR_OPTIONS_TYPE:
+      return kVisitWasmDescriptorOptions;
     case WASM_SUSPENDER_OBJECT_TYPE:
       return kVisitWasmSuspenderObject;
     case WASM_SUSPENDING_OBJECT_TYPE:
@@ -1093,7 +1100,7 @@ DirectHandle<Map> Map::TransitionElementsTo(Isolate* isolate,
     DisallowGarbageCollection no_gc;
     if (native_context->GetInitialJSArrayMap(from_kind) == *map) {
       Tagged<Object> maybe_transitioned_map =
-          native_context->get(Context::ArrayMapIndex(to_kind));
+          native_context->GetNoCell(Context::ArrayMapIndex(to_kind));
       if (IsMap(maybe_transitioned_map)) {
         return direct_handle(Cast<Map>(maybe_transitioned_map), isolate);
       }
@@ -1740,7 +1747,7 @@ DirectHandle<Map> Map::AsLanguageMode(
   // using |strict_function_transition_symbol| as a key.
   if (is_sloppy(shared_info->language_mode())) return initial_map;
 
-  DirectHandle<Map> function_map(Cast<Map>(isolate->native_context()->get(
+  DirectHandle<Map> function_map(Cast<Map>(isolate->native_context()->GetNoCell(
                                      shared_info->function_map_index())),
                                  isolate);
 
diff --git a/deps/v8/src/objects/map.h b/deps/v8/src/objects/map.h
index 57c17f61e2ed11..8ba275233b4473 100644
--- a/deps/v8/src/objects/map.h
+++ b/deps/v8/src/objects/map.h
@@ -49,7 +49,8 @@ enum InstanceType : uint16_t;
   V(Cell)                             \
   V(CodeWrapper)                      \
   V(ConsString)                       \
-  V(ContextSidePropertyCell)          \
+  V(ContextCell)                      \
+  V(CppHeapExternalObject)            \
   V(DataHandler)                      \
   V(DebugInfo)                        \
   V(EmbedderDataArray)                \
@@ -60,6 +61,7 @@ enum InstanceType : uint16_t;
   V(FreeSpace)                        \
   V(FunctionTemplateInfo)             \
   V(Hole)                             \
+  V(InterceptorInfo)                  \
   V(JSApiObject)                      \
   V(JSArrayBuffer)                    \
   V(JSDataViewOrRabGsabDataView)      \
@@ -98,7 +100,6 @@ enum InstanceType : uint16_t;
   V(ThinString)                       \
   V(TransitionArray)                  \
   IF_WASM(V, WasmArray)               \
-  IF_WASM(V, WasmContinuationObject)  \
   IF_WASM(V, WasmFuncRef)             \
   IF_WASM(V, WasmGlobalObject)        \
   IF_WASM(V, WasmInstanceObject)      \
@@ -106,6 +107,7 @@ enum InstanceType : uint16_t;
   IF_WASM(V, WasmMemoryObject)        \
   IF_WASM(V, WasmResumeData)          \
   IF_WASM(V, WasmStruct)              \
+  IF_WASM(V, WasmDescriptorOptions)   \
   IF_WASM(V, WasmSuspenderObject)     \
   IF_WASM(V, WasmSuspendingObject)    \
   IF_WASM(V, WasmTableObject)         \
diff --git a/deps/v8/src/objects/maybe-object-inl.h b/deps/v8/src/objects/maybe-object-inl.h
index 5a2ad9f476a2bf..7696f13bd106f4 100644
--- a/deps/v8/src/objects/maybe-object-inl.h
+++ b/deps/v8/src/objects/maybe-object-inl.h
@@ -23,8 +23,8 @@ inline Tagged<ClearedWeakValue> ClearedValue(PtrComprCageBase cage_base) {
 #ifdef V8_COMPRESS_POINTERS
   // This is necessary to make pointer decompression computation also
   // suitable for cleared weak references.
-  value = V8HeapCompressionScheme::DecompressTagged(
-      cage_base, kClearedWeakHeapObjectLower32);
+  value =
+      V8HeapCompressionScheme::DecompressTagged(kClearedWeakHeapObjectLower32);
 #else
   value = kClearedWeakHeapObjectLower32;
 #endif
@@ -37,7 +37,6 @@ inline Tagged<ClearedWeakValue> ClearedTrustedValue() {
 #ifdef V8_COMPRESS_POINTERS
   return Tagged<ClearedWeakValue>(
       TrustedSpaceCompressionScheme::DecompressTagged(
-          TrustedSpaceCompressionScheme::base(),
           kClearedWeakHeapObjectLower32));
 #else
   return Tagged<ClearedWeakValue>(kClearedWeakHeapObjectLower32);
diff --git a/deps/v8/src/objects/module.cc b/deps/v8/src/objects/module.cc
index 0f2497c60208f7..6ce67230b413a1 100644
--- a/deps/v8/src/objects/module.cc
+++ b/deps/v8/src/objects/module.cc
@@ -368,7 +368,7 @@ DirectHandle<JSModuleNamespace> Module::GetModuleNamespace(
   JSObject::NormalizeProperties(isolate, ns, CLEAR_INOBJECT_PROPERTIES,
                                 static_cast<int>(names.size()),
                                 "JSModuleNamespace");
-  JSObject::NormalizeElements(ns);
+  JSObject::NormalizeElements(isolate, ns);
   for (const auto& name : names) {
     uint32_t index = 0;
     if (name->AsArrayIndex(&index)) {
diff --git a/deps/v8/src/objects/object-list-macros.h b/deps/v8/src/objects/object-list-macros.h
index 9dc7a1722de0db..f201d2df21e68a 100644
--- a/deps/v8/src/objects/object-list-macros.h
+++ b/deps/v8/src/objects/object-list-macros.h
@@ -108,9 +108,10 @@ namespace internal {
   V(Cell)                                       \
   V(CompilationCacheTable)                      \
   V(ConsString)                                 \
-  V(ContextSidePropertyCell)                    \
   V(Context)                                    \
+  V(ContextCell)                                \
   V(CoverageInfo)                               \
+  V(CppHeapExternalObject)                      \
   V(DataHandler)                                \
   V(DeoptimizationData)                         \
   V(DependentCode)                              \
@@ -132,6 +133,7 @@ namespace internal {
   V(GcSafeCode)                                 \
   V(GlobalDictionary)                           \
   V(HeapNumber)                                 \
+  V(InterceptorInfo)                            \
   V(InternalizedString)                         \
   V(JSArgumentsObject)                          \
   V(JSArray)                                    \
@@ -236,6 +238,7 @@ namespace internal {
   V(SeqString)                                  \
   V(SeqTwoByteString)                           \
   V(SharedFunctionInfo)                         \
+  V(SimpleNameDictionary)                       \
   V(SimpleNumberDictionary)                     \
   V(SlicedString)                               \
   V(SmallOrderedHashMap)                        \
@@ -267,7 +270,6 @@ namespace internal {
   V(TurboshaftWord64SetType)                    \
   V(TurboshaftWord64Type)                       \
   IF_WASM(V, WasmArray)                         \
-  IF_WASM(V, WasmContinuationObject)            \
   IF_WASM(V, WasmExceptionPackage)              \
   IF_WASM(V, WasmFuncRef)                       \
   IF_WASM(V, WasmGlobalObject)                  \
@@ -279,6 +281,7 @@ namespace internal {
   IF_WASM(V, WasmObject)                        \
   IF_WASM(V, WasmResumeData)                    \
   IF_WASM(V, WasmStruct)                        \
+  IF_WASM(V, WasmDescriptorOptions)             \
   IF_WASM(V, WasmSuspenderObject)               \
   IF_WASM(V, WasmSuspendingObject)              \
   IF_WASM(V, WasmTableObject)                   \
@@ -410,11 +413,13 @@ namespace internal {
   V(CallableJSFunction)                      \
   V(CallableJSProxy)                         \
   V(CatchContext)                            \
+  V(CppHeapPointerWrapperObject)             \
   V(DebugEvaluateContext)                    \
   V(EvalContext)                             \
   V(FreeSpaceOrFiller)                       \
   V(FunctionContext)                         \
   V(JSApiObject)                             \
+  V(JSApiWrapperObject)                      \
   V(JSClassConstructor)                      \
   V(JSLastDummyApiObject)                    \
   V(JSPromiseConstructor)                    \
diff --git a/deps/v8/src/objects/object-macros.h b/deps/v8/src/objects/object-macros.h
index 218518ca7a7d29..c159d847e43ff1 100644
--- a/deps/v8/src/objects/object-macros.h
+++ b/deps/v8/src/objects/object-macros.h
@@ -453,6 +453,53 @@
                 kRelaxedStore);                                      \
   }
 
+// Host objects in ReadOnlySpace can't define the isolate-less accessor.
+#define DECL_LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST(name, type) \
+  inline void init_##name();                                                  \
+  inline bool has_##name() const;                                             \
+  inline type name(i::IsolateForSandbox isolate) const;                       \
+  inline void set_##name(i::IsolateForSandbox isolate, const type value);
+
+// Host objects in ReadOnlySpace can't define the isolate-less accessor.
+#define LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST_CHECKED2(      \
+    holder, name, type, offset, tag, get_condition, set_condition)          \
+  void holder::init_##name() {                                              \
+    HeapObject::SetupLazilyInitializedExternalPointerField(offset);         \
+  }                                                                         \
+  bool holder::has_##name() const {                                         \
+    return HeapObject::IsLazilyInitializedExternalPointerFieldInitialized(  \
+        offset);                                                            \
+  }                                                                         \
+  type holder::name(i::IsolateForSandbox isolate) const {                   \
+    DCHECK(get_condition);                                                  \
+    /* This is a workaround for MSVC error C2440 not allowing  */           \
+    /* reinterpret casts to the same type. */                               \
+    struct C2440 {};                                                        \
+    Address result =                                                        \
+        HeapObject::ReadExternalPointerField<tag>(offset, isolate);         \
+    return reinterpret_cast<type>(reinterpret_cast<C2440*>(result));        \
+  }                                                                         \
+  void holder::set_##name(i::IsolateForSandbox isolate, const type value) { \
+    DCHECK(set_condition);                                                  \
+    /* This is a workaround for MSVC error C2440 not allowing  */           \
+    /* reinterpret casts to the same type. */                               \
+    struct C2440 {};                                                        \
+    Address the_value =                                                     \
+        reinterpret_cast<Address>(reinterpret_cast<const C2440*>(value));   \
+    HeapObject::WriteLazilyInitializedExternalPointerField<tag>(            \
+        offset, isolate, the_value);                                        \
+  }
+
+#define LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST_CHECKED( \
+    holder, name, type, offset, tag, condition)                       \
+  LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST_CHECKED2(      \
+      holder, name, type, offset, tag, condition, condition)
+
+#define LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST(    \
+    holder, name, type, offset, tag)                             \
+  LAZY_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST_CHECKED2( \
+      holder, name, type, offset, tag, true, true)
+
 // Host objects in ReadOnlySpace can't define the isolate-less accessor.
 #define DECL_EXTERNAL_POINTER_ACCESSORS_MAYBE_READ_ONLY_HOST(name, type) \
   inline type name(i::IsolateForSandbox isolate) const;                  \
diff --git a/deps/v8/src/objects/objects-body-descriptors-inl.h b/deps/v8/src/objects/objects-body-descriptors-inl.h
index b6fd14304ba838..1dfd2ba7f54394 100644
--- a/deps/v8/src/objects/objects-body-descriptors-inl.h
+++ b/deps/v8/src/objects/objects-body-descriptors-inl.h
@@ -186,6 +186,25 @@ class JSAPIObjectWithEmbedderSlots::BodyDescriptor
   }
 };
 
+class CppHeapExternalObject::BodyDescriptor final : public BodyDescriptorBase {
+ public:
+  template <typename ObjectVisitor>
+  static inline void IterateBody(Tagged<Map> map, Tagged<HeapObject> obj,
+                                 int object_size, ObjectVisitor* v) {
+    static_assert(CppHeapExternalObject::kCppHeapWrappableOffsetEnd + 1 ==
+                  CppHeapExternalObject::kHeaderSize);
+    v->VisitCppHeapPointer(obj,
+                           obj->RawCppHeapPointerField(
+                               CppHeapExternalObject::kCppHeapWrappableOffset));
+    DCHECK_EQ(object_size, kHeaderSize);
+  }
+
+  static inline int SizeOf(Tagged<Map> map, Tagged<HeapObject> object) {
+    DCHECK_EQ(map->instance_size(), kHeaderSize);
+    return kHeaderSize;
+  }
+};
+
 template <typename ObjectVisitor>
 DISABLE_CFI_PERF void BodyDescriptorBase::IteratePointers(
     Tagged<HeapObject> obj, int start_offset, int end_offset,
@@ -507,24 +526,29 @@ class JSFinalizationRegistry::BodyDescriptor final : public BodyDescriptorBase {
 
 class AllocationSite::BodyDescriptor final : public BodyDescriptorBase {
  public:
-  static_assert(AllocationSite::kCommonPointerFieldEndOffset ==
-                AllocationSite::kPretenureDataOffset);
-  static_assert(AllocationSite::kPretenureDataOffset + kInt32Size ==
-                AllocationSite::kPretenureCreateCountOffset);
-  static_assert(AllocationSite::kPretenureCreateCountOffset + kInt32Size ==
-                AllocationSite::kWeakNextOffset);
+  static constexpr int kCommonPointerFieldsStart = sizeof(HeapObjectLayout);
+  static constexpr int kCommonPointerFieldsEnd =
+      offsetof(AllocationSite, dependent_code_) + kTaggedSize;
+
+  static_assert(kCommonPointerFieldsEnd ==
+                offsetof(AllocationSite, pretenure_data_));
+  static_assert(offsetof(AllocationSite, pretenure_data_) + kInt32Size ==
+                offsetof(AllocationSite, pretenure_create_count_));
+  static_assert(offsetof(AllocationSite, pretenure_create_count_) +
+                    kInt32Size ==
+                offsetof(AllocationSiteWithWeakNext, weak_next_));
 
   template <typename ObjectVisitor>
   static inline void IterateBody(Tagged<Map> map, Tagged<HeapObject> obj,
                                  int object_size, ObjectVisitor* v) {
     // Iterate over all the common pointer fields
-    IteratePointers(obj, AllocationSite::kStartOffset,
-                    AllocationSite::kCommonPointerFieldEndOffset, v);
+    IteratePointers(obj, kCommonPointerFieldsStart, kCommonPointerFieldsEnd, v);
     // Skip PretenureDataOffset and PretenureCreateCount which are Int32 fields.
     // Visit weak_next only if it has weak_next field.
-    if (object_size == AllocationSite::kSizeWithWeakNext) {
-      IterateCustomWeakPointers(obj, AllocationSite::kWeakNextOffset,
-                                AllocationSite::kSizeWithWeakNext, v);
+    if (object_size == sizeof(AllocationSiteWithWeakNext)) {
+      IterateCustomWeakPointers(
+          obj, offsetof(AllocationSiteWithWeakNext, weak_next_),
+          sizeof(AllocationSiteWithWeakNext), v);
     }
   }
 
@@ -1060,8 +1084,11 @@ class WasmTrustedInstanceData::BodyDescriptor final
   template <typename ObjectVisitor>
   static inline void IterateBody(Tagged<Map> map, Tagged<HeapObject> obj,
                                  int object_size, ObjectVisitor* v) {
-    IterateSelfIndirectPointer(obj, kWasmTrustedInstanceDataIndirectPointerTag,
-                               v);
+    bool shared = HeapLayout::InAnySharedSpace(obj);
+    IndirectPointerTag tag =
+        shared ? kSharedWasmTrustedInstanceDataIndirectPointerTag
+               : kWasmTrustedInstanceDataIndirectPointerTag;
+    IterateSelfIndirectPointer(obj, tag, v);
     for (uint16_t offset : kTaggedFieldOffsets) {
       IteratePointer(obj, offset, v);
     }
@@ -1141,7 +1168,10 @@ class WasmDispatchTable::BodyDescriptor final : public BodyDescriptorBase {
   template <typename ObjectVisitor>
   static inline void IterateBody(Tagged<Map> map, Tagged<HeapObject> obj,
                                  int object_size, ObjectVisitor* v) {
-    IterateSelfIndirectPointer(obj, kWasmDispatchTableIndirectPointerTag, v);
+    bool shared = HeapLayout::InAnySharedSpace(obj);
+    IndirectPointerTag tag = shared ? kSharedWasmDispatchTableIndirectPointerTag
+                                    : kWasmDispatchTableIndirectPointerTag;
+    IterateSelfIndirectPointer(obj, tag, v);
     IterateProtectedPointer(obj, kProtectedOffheapDataOffset, v);
     IterateProtectedPointer(obj, kProtectedUsesOffset, v);
     int length = Cast<WasmDispatchTable>(obj)->length(kAcquireLoad);
@@ -1312,12 +1342,13 @@ class DataHandler::BodyDescriptor final : public BodyDescriptorBase {
   template <typename ObjectVisitor>
   static inline void IterateBody(Tagged<Map> map, Tagged<HeapObject> obj,
                                  int object_size, ObjectVisitor* v) {
-    static_assert(kSmiHandlerOffset < kData1Offset,
-                  "Field order must be in sync with this iteration code");
-    static_assert(kData1Offset < kSizeWithData1,
-                  "Field order must be in sync with this iteration code");
-    IteratePointers(obj, kSmiHandlerOffset, kData1Offset, v);
-    IterateMaybeWeakPointers(obj, kData1Offset, object_size, v);
+    static_assert(
+        offsetof(DataHandler, smi_handler_) < OFFSET_OF_DATA_START(DataHandler),
+        "Field order must be in sync with this iteration code");
+    IteratePointers(obj, offsetof(DataHandler, smi_handler_),
+                    OFFSET_OF_DATA_START(DataHandler), v);
+    IterateMaybeWeakPointers(obj, OFFSET_OF_DATA_START(DataHandler),
+                             object_size, v);
   }
 
   static inline int SizeOf(Tagged<Map> map, Tagged<HeapObject> object) {
@@ -1465,6 +1496,49 @@ class AccessorInfo::BodyDescriptor final : public BodyDescriptorBase {
   }
 };
 
+class InterceptorInfo::BodyDescriptor final : public BodyDescriptorBase {
+ public:
+  static_assert(InterceptorInfo::kEndOfStrongFieldsOffset ==
+                InterceptorInfo::kFlagsOffset);
+  static_assert(InterceptorInfo::kFlagsOffset < InterceptorInfo::kGetterOffset);
+  static_assert(InterceptorInfo::kGetterOffset <
+                InterceptorInfo::kSetterOffset);
+  static_assert(InterceptorInfo::kSetterOffset < InterceptorInfo::kQueryOffset);
+  static_assert(InterceptorInfo::kQueryOffset <
+                InterceptorInfo::kDescriptorOffset);
+  static_assert(InterceptorInfo::kDescriptorOffset <
+                InterceptorInfo::kDeleterOffset);
+  static_assert(InterceptorInfo::kDeleterOffset <
+                InterceptorInfo::kEnumeratorOffset);
+  static_assert(InterceptorInfo::kEnumeratorOffset <
+                InterceptorInfo::kDefinerOffset);
+  static_assert(InterceptorInfo::kDefinerOffsetEnd + 1 ==
+                InterceptorInfo::kSize);
+
+  template <typename ObjectVisitor>
+  static inline void IterateBody(Tagged<Map> map, Tagged<HeapObject> obj,
+                                 int object_size, ObjectVisitor* v) {
+    IteratePointers(obj, HeapObject::kHeaderSize,
+                    InterceptorInfo::kEndOfStrongFieldsOffset, v);
+
+    const bool is_named = Cast<InterceptorInfo>(obj)->is_named();
+
+#define VISIT_FIELD(Name, name)                                \
+  v->VisitExternalPointer(                                     \
+      obj, obj->RawExternalPointerField(                       \
+               InterceptorInfo::k##Name##Offset,               \
+               is_named ? kApiNamedProperty##Name##CallbackTag \
+                        : kApiIndexedProperty##Name##CallbackTag));
+
+    INTERCEPTOR_INFO_CALLBACK_LIST(VISIT_FIELD)
+#undef VISIT_FIELD
+  }
+
+  static inline int SizeOf(Tagged<Map> map, Tagged<HeapObject> object) {
+    return kSize;
+  }
+};
+
 class FunctionTemplateInfo::BodyDescriptor final : public BodyDescriptorBase {
  public:
   template <typename ObjectVisitor>
diff --git a/deps/v8/src/objects/objects-definitions.h b/deps/v8/src/objects/objects-definitions.h
index b786866fa45735..fc0172f91fb699 100644
--- a/deps/v8/src/objects/objects-definitions.h
+++ b/deps/v8/src/objects/objects-definitions.h
@@ -162,7 +162,6 @@ namespace internal {
   V(_, ERROR_STACK_DATA_TYPE, ErrorStackData, error_stack_data)               \
   V(_, FUNCTION_TEMPLATE_RARE_DATA_TYPE, FunctionTemplateRareData,            \
     function_template_rare_data)                                              \
-  V(_, INTERCEPTOR_INFO_TYPE, InterceptorInfo, interceptor_info)              \
   V(_, MODULE_REQUEST_TYPE, ModuleRequest, module_request)                    \
   V(_, PROMISE_CAPABILITY_TYPE, PromiseCapability, promise_capability)        \
   V(_, PROMISE_REACTION_TYPE, PromiseReaction, promise_reaction)              \
diff --git a/deps/v8/src/objects/objects-inl.h b/deps/v8/src/objects/objects-inl.h
index ff5ca70f3fdce7..94798cf5e22012 100644
--- a/deps/v8/src/objects/objects-inl.h
+++ b/deps/v8/src/objects/objects-inl.h
@@ -28,6 +28,7 @@
 #include "src/heap/heap-write-barrier-inl.h"
 #include "src/heap/read-only-heap-inl.h"
 #include "src/numbers/conversions-inl.h"
+#include "src/objects/allocation-site.h"
 #include "src/objects/casting.h"
 #include "src/objects/deoptimization-data.h"
 #include "src/objects/heap-number-inl.h"
@@ -197,10 +198,12 @@ bool IsNullOrUndefined(Tagged<HeapObject> obj) {
 bool IsZero(Tagged<Object> obj) { return obj == Smi::zero(); }
 
 bool IsPublicSymbol(Tagged<Object> obj) {
-  return IsSymbol(obj) && !Cast<Symbol>(obj)->is_private();
+  Tagged<Symbol> symbol;
+  return TryCast<Symbol>(obj, &symbol) && !symbol->is_private();
 }
 bool IsPrivateSymbol(Tagged<Object> obj) {
-  return IsSymbol(obj) && Cast<Symbol>(obj)->is_private();
+  Tagged<Symbol> symbol;
+  return TryCast<Symbol>(obj, &symbol) && symbol->is_private();
 }
 
 bool IsNoSharedNameSentinel(Tagged<Object> obj) {
@@ -257,6 +260,14 @@ struct CastTraits<JSAny> {
     return IsPrimitive(value) || IsJSReceiver(value);
   }
 };
+template <>
+struct CastTraits<AllocationSiteWithWeakNext> {
+  template <typename From>
+  static inline bool AllowFrom(Tagged<From> value) {
+    Tagged<AllocationSite> site;
+    return TryCast<AllocationSite>(value, &site) && site->HasWeakNext();
+  }
+};
 
 template <>
 struct CastTraits<FieldType> {
@@ -291,6 +302,8 @@ template <>
 struct CastTraits<FreshlyAllocatedBigInt> : public CastTraits<BigInt> {};
 template <>
 struct CastTraits<JSIteratorResult> : public CastTraits<JSObject> {};
+template <>
+struct CastTraits<JSUint8ArraySetFromResult> : public CastTraits<JSObject> {};
 
 template <>
 struct CastTraits<DeoptimizationFrameTranslation>
@@ -400,16 +413,6 @@ bool IsJSObjectThatCanBeTrackedAsPrototype(Tagged<HeapObject> obj) {
   return IsJSObject(obj) && !HeapLayout::InWritableSharedSpace(*obj);
 }
 
-bool IsJSApiWrapperObject(Tagged<Map> map) {
-  const InstanceType instance_type = map->instance_type();
-  return InstanceTypeChecker::IsJSAPIObjectWithEmbedderSlots(instance_type) ||
-         InstanceTypeChecker::IsJSSpecialObject(instance_type);
-}
-
-bool IsJSApiWrapperObject(Tagged<HeapObject> js_obj) {
-  return IsJSApiWrapperObject(js_obj->map());
-}
-
 DEF_HEAP_OBJECT_PREDICATE(HeapObject, IsUniqueName) {
   return IsInternalizedString(obj, cage_base) || IsSymbol(obj, cage_base);
 }
@@ -652,6 +655,12 @@ DEF_HEAP_OBJECT_PREDICATE(HeapObject, IsAccessCheckNeeded) {
   bool Is##Name(HeapObject obj, PtrComprCageBase cage_base) {               \
     static_assert(kTaggedCanConvertToRawObjects);                           \
     return Is##Name(Tagged<HeapObject>(obj), cage_base);                    \
+  }                                                                         \
+  bool Is##Name(const HeapObjectLayout* obj) {                              \
+    return Is##Name(Tagged<HeapObject>(obj));                               \
+  }                                                                         \
+  bool Is##Name(const HeapObjectLayout* obj, PtrComprCageBase cage_base) {  \
+    return Is##Name(Tagged<HeapObject>(obj), cage_base);                    \
   }
 // static
 STRUCT_LIST(MAKE_STRUCT_PREDICATE)
@@ -1006,6 +1015,19 @@ void HeapObject::SetupLazilyInitializedExternalPointerField(size_t offset) {
 #endif  // V8_ENABLE_SANDBOX
 }
 
+bool HeapObject::IsLazilyInitializedExternalPointerFieldInitialized(
+    size_t offset) const {
+#ifdef V8_ENABLE_SANDBOX
+  auto location =
+      reinterpret_cast<ExternalPointerHandle*>(field_address(offset));
+  ExternalPointerHandle handle = base::AsAtomic32::Relaxed_Load(location);
+  return handle != kNullExternalPointerHandle;
+#else
+  return ReadMaybeUnalignedValue<Address>(field_address(offset)) !=
+         kNullAddress;
+#endif  // V8_ENABLE_SANDBOX
+}
+
 template <ExternalPointerTag tag>
 void HeapObject::WriteLazilyInitializedExternalPointerField(
     size_t offset, IsolateForSandbox isolate, Address value) {
@@ -1056,7 +1078,9 @@ void HeapObject::InitSelfIndirectPointerField(
     TrustedPointerPublishingScope* opt_publishing_scope) {
   DCHECK(IsExposedTrustedObject(*this));
   InstanceType instance_type = map()->instance_type();
-  IndirectPointerTag tag = IndirectPointerTagFromInstanceType(instance_type);
+  bool shared = HeapLayout::InAnySharedSpace(*this);
+  IndirectPointerTag tag =
+      IndirectPointerTagFromInstanceType(instance_type, shared);
   i::InitSelfIndirectPointerField(field_address(offset), isolate, *this, tag,
                                   opt_publishing_scope);
 }
@@ -1335,6 +1359,11 @@ Tagged<Map> HeapObjectLayout::map(AcquireLoadTag) const {
   return Tagged<HeapObject>(this)->map(kAcquireLoad);
 }
 
+MapWord HeapObjectLayout::map_word(RelaxedLoadTag) const {
+  // TODO(leszeks): Support MapWord members and access via that instead.
+  return Tagged<HeapObject>(this)->map_word(kRelaxedLoad);
+}
+
 void HeapObjectLayout::set_map(Isolate* isolate, Tagged<Map> value) {
   // TODO(leszeks): Support MapWord members and access via that instead.
   return Tagged<HeapObject>(this)->set_map(isolate, value);
@@ -1874,6 +1903,11 @@ bool IsShared(Tagged<Object> obj) {
     case SHARED_UNCACHED_EXTERNAL_ONE_BYTE_STRING_TYPE:
       DCHECK(HeapLayout::InAnySharedSpace(object));
       return true;
+#if V8_ENABLE_WEBASSEMBLY
+    case WASM_STRUCT_TYPE:
+    case WASM_ARRAY_TYPE:
+      return HeapLayout::InAnySharedSpace(object);
+#endif
     case INTERNALIZED_TWO_BYTE_STRING_TYPE:
     case INTERNALIZED_ONE_BYTE_STRING_TYPE:
     case EXTERNAL_INTERNALIZED_TWO_BYTE_STRING_TYPE:
@@ -1910,10 +1944,14 @@ bool Object::CanBeHeldWeakly(Tagged<Object> obj) {
     // TODO(v8:12547) Shared structs and arrays should only be able to point
     // to shared values in weak collections. For now, disallow them as weak
     // collection keys.
-    if (v8_flags.harmony_struct) {
-      return !IsJSSharedStruct(obj) && !IsJSSharedArray(obj);
-    }
-    return true;
+    return (!v8_flags.harmony_struct ||
+            (!IsJSSharedStruct(obj) && !IsJSSharedArray(obj)))
+#if V8_ENABLE_WEBASSEMBLY
+           && (!v8_flags.experimental_wasm_shared ||
+               (!((IsWasmStruct(obj) || IsWasmArray(obj)) &&
+                  HeapLayout::InAnySharedSpace(Cast<HeapObject>(obj)))))
+#endif
+        ;
   }
   return IsSymbol(obj) && !Cast<Symbol>(obj)->is_in_public_symbol_table();
 }
diff --git a/deps/v8/src/objects/objects.cc b/deps/v8/src/objects/objects.cc
index 14013579bd56b5..3e8fa8d3368f88 100644
--- a/deps/v8/src/objects/objects.cc
+++ b/deps/v8/src/objects/objects.cc
@@ -143,9 +143,8 @@ ShouldThrow GetShouldThrow(Isolate* isolate, Maybe<ShouldThrow> should_throw) {
   LanguageMode mode = isolate->context()->scope_info()->language_mode();
   if (mode == LanguageMode::kStrict) return kThrowOnError;
 
-  for (StackFrameIterator it(isolate, isolate->thread_local_top(),
-                             StackFrameIterator::NoHandles{});
-       !it.done(); it.Advance()) {
+  for (StackFrameIterator it(isolate, isolate->thread_local_top()); !it.done();
+       it.Advance()) {
     if (!it.frame()->is_javascript()) continue;
 
     // Get the language mode from closure.
@@ -293,7 +292,7 @@ MaybeHandle<JSReceiver> Object::ToObjectImpl(Isolate* isolate,
                       NewTypeError(MessageTemplate::kUndefinedOrNullToObject));
     }
     constructor = direct_handle(
-        Cast<JSFunction>(native_context->get(constructor_function_index)),
+        Cast<JSFunction>(native_context->GetNoCell(constructor_function_index)),
         isolate);
   }
   Handle<JSObject> result = isolate->factory()->NewJSObject(constructor);
@@ -601,12 +600,14 @@ MaybeDirectHandle<String> Object::NoSideEffectsToMaybeString(
     // -- F u n c t i o n
     DirectHandle<String> fun_str;
     if (IsJSBoundFunction(*input)) {
-      fun_str = JSBoundFunction::ToString(Cast<JSBoundFunction>(input));
+      fun_str =
+          JSBoundFunction::ToString(isolate, Cast<JSBoundFunction>(input));
     } else if (IsJSWrappedFunction(*input)) {
-      fun_str = JSWrappedFunction::ToString(Cast<JSWrappedFunction>(input));
+      fun_str =
+          JSWrappedFunction::ToString(isolate, Cast<JSWrappedFunction>(input));
     } else {
       DCHECK(IsJSFunction(*input));
-      fun_str = JSFunction::ToString(Cast<JSFunction>(input));
+      fun_str = JSFunction::ToString(isolate, Cast<JSFunction>(input));
     }
 
     if (fun_str->length() > 128) {
@@ -1277,7 +1278,7 @@ MaybeHandle<Object> Object::GetProperty(LookupIterator* it,
         return result;
       }
       case LookupIterator::WASM_OBJECT:
-        return it->isolate()->factory()->undefined_value();
+        continue;  // Continue to the prototype, if present.
       case LookupIterator::INTERCEPTOR: {
         bool done;
         Handle<JSAny> result;
@@ -1915,6 +1916,8 @@ void Smi::SmiPrint(Tagged<Smi> smi, std::ostream& os) { os << smi.value(); }
 
 void Struct::BriefPrintDetails(std::ostream& os) {}
 
+void StructLayout::BriefPrintDetails(std::ostream& os) {}
+
 void Tuple2::BriefPrintDetails(std::ostream& os) {
   os << " " << Brief(value1()) << ", " << Brief(value2());
 }
@@ -2185,6 +2188,9 @@ void HeapObject::RehashBasedOnMap(IsolateT* isolate) {
     case NUMBER_DICTIONARY_TYPE:
       Cast<NumberDictionary>(*this)->Rehash(isolate);
       break;
+    case SIMPLE_NAME_DICTIONARY_TYPE:
+      Cast<SimpleNameDictionary>(*this)->Rehash(isolate);
+      break;
     case SIMPLE_NUMBER_DICTIONARY_TYPE:
       Cast<SimpleNumberDictionary>(*this)->Rehash(isolate);
       break;
@@ -2296,8 +2302,7 @@ Maybe<bool> Object::SetPropertyInternal(LookupIterator* it,
       }
 
       case LookupIterator::WASM_OBJECT:
-        RETURN_FAILURE(it->isolate(), kThrowOnError,
-                       NewTypeError(MessageTemplate::kWasmObjectsAreOpaque));
+        continue;  // Continue to the prototype, if present.
 
       case LookupIterator::INTERCEPTOR: {
         if (it->HolderIsReceiverOrHiddenPrototype()) {
@@ -2364,22 +2369,30 @@ Maybe<bool> Object::SetPropertyInternal(LookupIterator* it,
         // perform the possibly effectful ToNumber (or ToBigInt) operation
         // anyways.
         DirectHandle<JSTypedArray> holder = it->GetHolder<JSTypedArray>();
-        DirectHandle<Object> converted_value;
-        if (holder->type() == kExternalBigInt64Array ||
-            holder->type() == kExternalBigUint64Array) {
-          ASSIGN_RETURN_ON_EXCEPTION_VALUE(
-              it->isolate(), converted_value,
-              BigInt::FromObject(it->isolate(), value), Nothing<bool>());
-        } else {
-          ASSIGN_RETURN_ON_EXCEPTION_VALUE(
-              it->isolate(), converted_value,
-              Object::ToNumber(it->isolate(), value), Nothing<bool>());
-        }
 
-        // For RAB/GSABs, the above conversion might grow the buffer so that the
-        // index is no longer out of bounds. Redo the bounds check and try
-        // again.
-        it->RecheckTypedArrayBounds();
+        // The index found case uses HolderIsReceiverOrHiddenPrototype()
+        // in below "case LookupIterator::DATA" to check
+        // "i. If SameValue(O, Receiver) is true..." of the spec.
+        // https://tc39.es/ecma262/#sec-typedarray-set
+        if (it->HolderIsReceiver()) {
+          DirectHandle<Object> converted_value;
+
+          if (holder->type() == kExternalBigInt64Array ||
+              holder->type() == kExternalBigUint64Array) {
+            ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+                it->isolate(), converted_value,
+                BigInt::FromObject(it->isolate(), value), Nothing<bool>());
+          } else {
+            ASSIGN_RETURN_ON_EXCEPTION_VALUE(
+                it->isolate(), converted_value,
+                Object::ToNumber(it->isolate(), value), Nothing<bool>());
+          }
+          // For RAB/GSABs, the above conversion might grow the buffer so that
+          // the index is no longer out of bounds. Redo the bounds check and try
+          // again.
+          it->RecheckTypedArrayBounds();
+          value = converted_value;
+        }
         if (it->state() != LookupIterator::DATA) {
           // Still out of bounds.
           DCHECK_EQ(it->state(), LookupIterator::TYPED_ARRAY_INDEX_NOT_FOUND);
@@ -2394,7 +2407,6 @@ Maybe<bool> Object::SetPropertyInternal(LookupIterator* it,
           // (v8:4901)
           return Just(true);
         }
-        value = converted_value;
         [[fallthrough]];
       }
 
@@ -2696,6 +2708,10 @@ Maybe<bool> Object::AddDataProperty(LookupIterator* it,
   Isolate* isolate = it->isolate();
 
   if (it->ExtendingNonExtensible(receiver)) {
+    if (IsWasmObject(*receiver)) {
+      RETURN_FAILURE(it->isolate(), kThrowOnError,
+                     NewTypeError(MessageTemplate::kWasmObjectsAreOpaque));
+    }
     bool is_shared_object = IsAlwaysSharedSpaceJSObject(*receiver);
     RETURN_FAILURE(
         isolate, GetShouldThrow(it->isolate(), should_throw),
@@ -2713,7 +2729,7 @@ Maybe<bool> Object::AddDataProperty(LookupIterator* it,
     if (IsJSArray(*receiver)) {
       DirectHandle<JSArray> array = Cast<JSArray>(receiver);
       if (JSArray::WouldChangeReadOnlyLength(array, it->array_index())) {
-        RETURN_FAILURE(isolate, GetShouldThrow(it->isolate(), should_throw),
+        RETURN_FAILURE(isolate, GetShouldThrow(isolate, should_throw),
                        NewTypeError(MessageTemplate::kStrictReadOnlyProperty,
                                     isolate->factory()->length_string(),
                                     Object::TypeOf(isolate, array), array));
@@ -2721,10 +2737,10 @@ Maybe<bool> Object::AddDataProperty(LookupIterator* it,
     }
 
     DirectHandle<JSObject> receiver_obj = Cast<JSObject>(receiver);
-    MAYBE_RETURN(JSObject::AddDataElement(receiver_obj, it->array_index(),
-                                          value, attributes),
+    MAYBE_RETURN(JSObject::AddDataElement(isolate, receiver_obj,
+                                          it->array_index(), value, attributes),
                  Nothing<bool>());
-    JSObject::ValidateElements(*receiver_obj);
+    JSObject::ValidateElements(isolate, *receiver_obj);
     return Just(true);
   }
 
@@ -3286,7 +3302,7 @@ Maybe<bool> JSArray::ArraySetLength(Isolate* isolate, DirectHandle<JSArray> a,
     // (Not needed.)
   }
   // Most of steps 16 through 19 is implemented by JSArray::SetLength.
-  MAYBE_RETURN(JSArray::SetLength(a, new_len), Nothing<bool>());
+  MAYBE_RETURN(JSArray::SetLength(isolate, a, new_len), Nothing<bool>());
   // Steps 19d-ii, 20.
   if (!new_writable) {
     PropertyDescriptor readonly;
@@ -3896,6 +3912,8 @@ void DescriptorArray::Initialize(Tagged<EnumCache> empty_enum_cache,
   set_number_of_descriptors(nof_descriptors);
   set_raw_gc_state(raw_gc_state, kRelaxedStore);
   set_enum_cache(empty_enum_cache, SKIP_WRITE_BARRIER);
+  set_flags(FastIterableBits::encode(FastIterableState::kUnknown),
+            kRelaxedStore);
   MemsetTagged(GetDescriptorSlot(0), undefined_value,
                number_of_all_descriptors() * kEntrySize);
 }
@@ -3907,6 +3925,8 @@ void DescriptorArray::ClearEnumCache() {
 void DescriptorArray::Replace(InternalIndex index, Descriptor* descriptor) {
   descriptor->SetSortedKeyIndex(GetSortedKeyIndex(index.as_int()));
   Set(index, descriptor);
+  // Resetting the fast iterable state is bottlenecked in SetKey().
+  DCHECK_EQ(fast_iterable(), FastIterableState::kUnknown);
 }
 
 // static
@@ -4446,8 +4466,19 @@ void Script::TraceScriptRundownSources() {
   Tagged<String> source = Cast<String>(this->source());
   auto script_id = this->id();
   int32_t source_length = source->length();
-  const int32_t kSplitMaxLength = 1000000;
-  if (source_length <= kSplitMaxLength) {
+
+  const int32_t kSourceMaxLength = 25000000;  // 25mb
+  const int32_t kSplitMaxLength = 1000000;    // 1mb
+  if (source_length > kSourceMaxLength) {
+    auto value = v8::tracing::TracedValue::Create();
+    value->SetUnsignedInteger("isolate", isolate->debug()->IsolateId());
+    value->SetInteger("scriptId", script_id);
+    value->SetInteger("length", source_length);
+    value->SetInteger("limit", kSourceMaxLength);
+    TRACE_EVENT1(
+        TRACE_DISABLED_BY_DEFAULT("devtools.v8-source-rundown-sources"),
+        "TooLargeScriptCatchup", "data", std::move(value));
+  } else if (source_length <= kSplitMaxLength) {
     auto value = v8::tracing::TracedValue::Create();
     value->SetUnsignedInteger("isolate", isolate->debug()->IsolateId());
     value->SetInteger("scriptId", script_id);
@@ -4800,20 +4831,20 @@ Tagged<Script> Script::Iterator::Next() {
 }
 
 // static
-void JSArray::Initialize(DirectHandle<JSArray> array, int capacity,
-                         int length) {
+void JSArray::Initialize(Isolate* isolate, DirectHandle<JSArray> array,
+                         int capacity, int length) {
   DCHECK_GE(capacity, 0);
-  array->GetIsolate()->factory()->NewJSArrayStorage(
+  isolate->factory()->NewJSArrayStorage(
       array, length, capacity,
       ArrayStorageAllocationMode::INITIALIZE_ARRAY_ELEMENTS_WITH_HOLE);
 }
 
-Maybe<bool> JSArray::SetLength(DirectHandle<JSArray> array,
+Maybe<bool> JSArray::SetLength(Isolate* isolate, DirectHandle<JSArray> array,
                                uint32_t new_length) {
   if (array->SetLengthWouldNormalize(new_length)) {
-    JSObject::NormalizeElements(array);
+    JSObject::NormalizeElements(isolate, array);
   }
-  return array->GetElementsAccessor()->SetLength(array, new_length);
+  return array->GetElementsAccessor()->SetLength(isolate, array, new_length);
 }
 
 // ES6: 9.5.2 [[SetPrototypeOf]] (V)
@@ -4912,8 +4943,9 @@ bool AllocationSite::IsNested() {
   DCHECK(v8_flags.trace_track_allocation_sites);
   Tagged<Object> current = boilerplate()->GetHeap()->allocation_sites_list();
   while (IsAllocationSite(current)) {
-    Tagged<AllocationSite> current_site = Cast<AllocationSite>(current);
-    if (current_site->nested_site() == *this) {
+    Tagged<AllocationSiteWithWeakNext> current_site =
+        Cast<AllocationSiteWithWeakNext>(current);
+    if (current_site->nested_site() == this) {
       return true;
     }
     current = current_site->weak_next();
@@ -5853,6 +5885,13 @@ Handle<SimpleNumberDictionary> SimpleNumberDictionary::Set(
   return AtPut(isolate, dictionary, key, value, PropertyDetails::Empty());
 }
 
+// static
+Handle<SimpleNameDictionary> SimpleNameDictionary::Set(
+    Isolate* isolate, Handle<SimpleNameDictionary> dictionary,
+    DirectHandle<Name> key, DirectHandle<Object> value) {
+  return AtPut(isolate, dictionary, key, value, PropertyDetails::Empty());
+}
+
 void NumberDictionary::UpdateMaxNumberKey(
     uint32_t key, DirectHandle<JSObject> dictionary_holder) {
   DisallowGarbageCollection no_gc;
@@ -6009,7 +6048,7 @@ Tagged<Object> ObjectHashTableBase<Derived, Shape>::Lookup(
 
 // The implementation should be in sync with
 // CodeStubAssembler::NameToIndexHashTableLookup.
-int NameToIndexHashTable::Lookup(DirectHandle<Name> key) {
+int NameToIndexHashTable::Lookup(Tagged<Name> key) {
   DisallowGarbageCollection no_gc;
   PtrComprCageBase cage_base = GetPtrComprCageBase(this);
   ReadOnlyRoots roots = GetReadOnlyRoots();
@@ -6835,6 +6874,7 @@ EXTERN_DEFINE_MULTI_OBJECT_BASE_HASH_TABLE(ObjectTwoHashTable, 2)
 
 EXTERN_DEFINE_DICTIONARY(SimpleNumberDictionary, SimpleNumberDictionaryShape)
 EXTERN_DEFINE_DICTIONARY(NumberDictionary, NumberDictionaryShape)
+EXTERN_DEFINE_DICTIONARY(SimpleNameDictionary, SimpleNameDictionaryShape)
 
 template V8_EXPORT_PRIVATE void
 Dictionary<NumberDictionary, NumberDictionaryShape>::UncheckedAdd<
diff --git a/deps/v8/src/objects/objects.h b/deps/v8/src/objects/objects.h
index 13beef5283bc42..3e04f559691e1f 100644
--- a/deps/v8/src/objects/objects.h
+++ b/deps/v8/src/objects/objects.h
@@ -730,9 +730,6 @@ V8_INLINE bool IsWasmObject(T obj, Isolate* = nullptr) {
 V8_INLINE bool IsJSObjectThatCanBeTrackedAsPrototype(Tagged<Object> obj);
 V8_INLINE bool IsJSObjectThatCanBeTrackedAsPrototype(Tagged<HeapObject> obj);
 
-V8_INLINE bool IsJSApiWrapperObject(Tagged<HeapObject> obj);
-V8_INLINE bool IsJSApiWrapperObject(Tagged<Map> map);
-
 #define DECL_STRUCT_PREDICATE(NAME, Name, name) \
   V8_INLINE bool Is##Name(Tagged<Object> obj);  \
   V8_INLINE bool Is##Name(Tagged<Object> obj, PtrComprCageBase cage_base);
diff --git a/deps/v8/src/objects/property-cell-inl.h b/deps/v8/src/objects/property-cell-inl.h
index 595dae4003c1e8..94a06834d4f524 100644
--- a/deps/v8/src/objects/property-cell-inl.h
+++ b/deps/v8/src/objects/property-cell-inl.h
@@ -70,19 +70,6 @@ void PropertyCell::Transition(PropertyDetails new_details,
   set_property_details_raw(new_details.AsSmi(), kReleaseStore);
 }
 
-TQ_OBJECT_CONSTRUCTORS_IMPL(ContextSidePropertyCell)
-
-RELEASE_ACQUIRE_ACCESSORS(ContextSidePropertyCell, context_side_property_raw,
-                          Tagged<Smi>, kPropertyDetailsRawOffset)
-
-ACCESSORS(ContextSidePropertyCell, dependent_code, Tagged<DependentCode>,
-          kDependentCodeOffset)
-
-ContextSidePropertyCell::Property
-ContextSidePropertyCell::context_side_property() const {
-  return FromSmi(context_side_property_raw(kAcquireLoad));
-}
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/property-cell.h b/deps/v8/src/objects/property-cell.h
index 33c71895cf1ccc..f93414c024a14b 100644
--- a/deps/v8/src/objects/property-cell.h
+++ b/deps/v8/src/objects/property-cell.h
@@ -97,68 +97,6 @@ class PropertyCell
 #endif  // DEBUG
 };
 
-class ContextSidePropertyCell
-    : public TorqueGeneratedContextSidePropertyCell<ContextSidePropertyCell,
-                                                    HeapObject> {
- public:
-  // Keep in sync with property-cell.tq.
-  // This enum tracks a property of a ScriptContext slot.
-  // The property determines how the slot's value can be accessed and modified.
-  enum Property {
-    kOther = 0,  // The slot holds an arbitrary tagged value. kOther is a sink
-                 // state and cannot transition to any other state.
-    kConst = 1,  // The slot holds a constant value. kConst can transition to
-                 // any other state.
-    kSmi = 2,    // The slot holds a Smi. kSmi can transition to kMutableInt32,
-                 // kMutableHeapNumber, or kOther.
-    kMutableInt32 =
-        3,  // // The slot holds a HeapNumber that can be mutated in-place by
-            // optimized code. This HeapNumber should never leak from the slot.
-            // It contains a Int32 value as double. kMutableInt32 can transition
-            // to kMutableHeapNumber or kOther.
-    kMutableHeapNumber =
-        4,  // The slot holds a HeapNumber that can be mutated in-place by
-            // optimized code. This HeapNumber should never leak from the slot.
-            // kMutableHeapNumber can only transition to kOther.
-  };
-
-  static Tagged<Smi> Const() { return Smi::FromInt(Property::kConst); }
-  static Tagged<Smi> SmiMarker() { return Smi::FromInt(Property::kSmi); }
-  static Tagged<Smi> MutableInt32() {
-    return Smi::FromInt(Property::kMutableInt32);
-  }
-  static Tagged<Smi> MutableHeapNumber() {
-    return Smi::FromInt(Property::kMutableHeapNumber);
-  }
-  static Tagged<Smi> Other() { return Smi::FromInt(Property::kOther); }
-
-  static Property FromSmi(Tagged<Smi> smi) {
-    int value = smi.value();
-    DCHECK_GE(value, 0);
-    DCHECK_LE(value, kMutableHeapNumber);
-    return static_cast<Property>(value);
-  }
-
-  inline Property context_side_property() const;
-
-  // [context_side_property_raw]: details of the context slot property.
-  DECL_RELEASE_ACQUIRE_ACCESSORS(context_side_property_raw, Tagged<Smi>)
-
-  // [dependent_code]: code that depends on the constness of the value.
-  DECL_ACCESSORS(dependent_code, Tagged<DependentCode>)
-
-  DECL_PRINTER(ContextSidePropertyCell)
-  DECL_VERIFIER(ContextSidePropertyCell)
-
-  using BodyDescriptor =
-      FixedBodyDescriptor<kDependentCodeOffset, kSize, kSize>;
-
-  TQ_OBJECT_CONSTRUCTORS(ContextSidePropertyCell)
-
- private:
-  friend class Factory;
-};
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/property-cell.tq b/deps/v8/src/objects/property-cell.tq
index edaba457cef1ac..53b3d4d7d61155 100644
--- a/deps/v8/src/objects/property-cell.tq
+++ b/deps/v8/src/objects/property-cell.tq
@@ -9,17 +9,3 @@ extern class PropertyCell extends HeapObject {
   value: Object;
   dependent_code: DependentCode;
 }
-
-// Used for const-tracking and slot representation of ScriptContexts.
-extern class ContextSidePropertyCell extends HeapObject {
-  property_details_raw: Smi;
-  dependent_code: DependentCode;
-}
-
-// TODO(victorgomes): Use constexpr generate to ensure that these values are
-// defined in one place.
-const kContextSidePropertyOther: intptr = 0;
-const kContextSidePropertyConst: intptr = 1;
-const kContextSidePropertySmi: intptr = 2;
-const kContextSidePropertyInt32: intptr = 3;
-const kContextSidePropertyHeapNumber: intptr = 4;
diff --git a/deps/v8/src/objects/scope-info.cc b/deps/v8/src/objects/scope-info.cc
index 94259dcbd942b7..40eb6b667b9b98 100644
--- a/deps/v8/src/objects/scope-info.cc
+++ b/deps/v8/src/objects/scope-info.cc
@@ -190,9 +190,9 @@ Handle<ScopeInfo> ScopeInfo::Create(IsolateT* isolate, Zone* zone, Scope* scope,
           ? scope->AsClassScope()->brand() != nullptr
           : scope->IsConstructorScope() &&
                 scope->AsDeclarationScope()->class_scope_has_private_brand();
-  const bool should_save_class_variable_index =
+  const bool should_save_class_variable =
       scope->is_class_scope()
-          ? scope->AsClassScope()->should_save_class_variable_index()
+          ? scope->AsClassScope()->should_save_class_variable()
           : false;
   const bool has_function_name =
       function_name_info != VariableAllocationInfo::NONE;
@@ -229,7 +229,7 @@ Handle<ScopeInfo> ScopeInfo::Create(IsolateT* isolate, Zone* zone, Scope* scope,
   const int has_dependent_code = sloppy_eval_can_extend_vars;
   const int length =
       kVariablePartIndex + local_names_container_size + context_local_count +
-      (should_save_class_variable_index ? 1 : 0) +
+      (should_save_class_variable ? 1 : 0) +
       (has_function_name ? kFunctionNameEntries : 0) +
       (has_inferred_function_name ? 1 : 0) + (has_outer_scope_info ? 1 : 0) +
       (scope->is_module_scope()
@@ -270,7 +270,7 @@ Handle<ScopeInfo> ScopeInfo::Create(IsolateT* isolate, Zone* zone, Scope* scope,
         DeclarationScopeBit::encode(scope->is_declaration_scope()) |
         ReceiverVariableBits::encode(receiver_info) |
         ClassScopeHasPrivateBrandBit::encode(has_brand) |
-        HasSavedClassVariableBit::encode(should_save_class_variable_index) |
+        HasSavedClassVariableBit::encode(should_save_class_variable) |
         HasNewTargetBit::encode(has_new_target) |
         FunctionVariableBits::encode(function_name_info) |
         HasInferredFunctionNameBit::encode(has_inferred_function_name) |
@@ -390,21 +390,16 @@ Handle<ScopeInfo> ScopeInfo::Create(IsolateT* isolate, Zone* zone, Scope* scope,
     index += local_names_container_size + context_local_count;
 
     DCHECK_EQ(index, scope_info->SavedClassVariableInfoIndex());
-    // If the scope is a class scope and has used static private methods, save
-    // the context slot index of the class variable.
-    // Store the class variable index.
-    if (should_save_class_variable_index) {
+    // If the scope is a class scope and has used static private methods,
+    // save context slot index if locals are inlined, otherwise save the name.
+    if (should_save_class_variable) {
       Variable* class_variable = scope->AsClassScope()->class_variable();
       DCHECK_EQ(class_variable->location(), VariableLocation::CONTEXT);
-      int local_index;
       if (has_inlined_local_names) {
-        local_index = class_variable->index();
+        scope_info->set(index++, Smi::FromInt(class_variable->index()));
       } else {
-        DirectHandle<Name> name = class_variable->name();
-        InternalIndex entry = local_names_hashtable->FindEntry(isolate, name);
-        local_index = entry.as_int();
+        scope_info->set(index++, *class_variable->name());
       }
-      scope_info->set(index++, Smi::FromInt(local_index));
     }
 
     // If present, add the function variable name and its index.
@@ -549,7 +544,6 @@ DirectHandle<ScopeInfo> ScopeInfo::CreateForBootstrapping(
                                  (type == BootstrappingType::kShadowRealm);
   const bool is_script = type == BootstrappingType::kScript;
   const bool is_shadow_realm = type == BootstrappingType::kShadowRealm;
-  const bool has_const_tracking_let_side_data = is_script;
   const int context_local_count =
       is_empty_function || is_native_context ? 0 : 1;
   const bool has_inferred_function_name = is_empty_function;
@@ -587,8 +581,7 @@ DirectHandle<ScopeInfo> ScopeInfo::CreateForBootstrapping(
       IsDebugEvaluateScopeBit::encode(false) |
       ForceContextAllocationBit::encode(false) |
       PrivateNameLookupSkipsOuterClassBit::encode(false) |
-      HasContextExtensionSlotBit::encode(is_native_context ||
-                                         has_const_tracking_let_side_data) |
+      HasContextExtensionSlotBit::encode(is_native_context) |
       IsHiddenBit::encode(false) | IsWrappedFunctionBit::encode(false);
   Tagged<ScopeInfo> raw_scope_info = *scope_info;
   raw_scope_info->set_flags(flags, kRelaxedStore);
@@ -1010,16 +1003,16 @@ int ScopeInfo::InlinedLocalNamesLookup(Tagged<String> name) {
   return -1;
 }
 
-int ScopeInfo::ContextSlotIndex(DirectHandle<String> name,
+int ScopeInfo::ContextSlotIndex(Tagged<String> name,
                                 VariableLookupResult* lookup_result) {
   DisallowGarbageCollection no_gc;
-  DCHECK(IsInternalizedString(*name));
+  DCHECK(IsInternalizedString(name));
   DCHECK_NOT_NULL(lookup_result);
 
   if (this->IsEmpty()) return -1;
 
   int index = HasInlinedLocalNames()
-                  ? InlinedLocalNamesLookup(*name)
+                  ? InlinedLocalNamesLookup(name)
                   : context_local_names_hashtable()->Lookup(name);
 
   if (index != -1) {
@@ -1036,28 +1029,31 @@ int ScopeInfo::ContextSlotIndex(DirectHandle<String> name,
   return -1;
 }
 
-int ScopeInfo::ContextSlotIndex(DirectHandle<String> name) {
+int ScopeInfo::ContextSlotIndex(Tagged<String> name) {
   VariableLookupResult lookup_result;
   return ContextSlotIndex(name, &lookup_result);
 }
 
 std::pair<Tagged<String>, int> ScopeInfo::SavedClassVariable() const {
   DCHECK(HasSavedClassVariableBit::decode(Flags()));
+  auto class_variable_info = saved_class_variable_info();
   if (HasInlinedLocalNames()) {
     // The saved class variable info corresponds to the context slot index.
-    int index = saved_class_variable_info() - Context::MIN_CONTEXT_SLOTS;
+    DCHECK(class_variable_info.IsSmi());
+    int index =
+        class_variable_info.ToSmi().value() - Context::MIN_CONTEXT_SLOTS;
     DCHECK_GE(index, 0);
     DCHECK_LT(index, ContextLocalCount());
     Tagged<String> name = ContextInlinedLocalName(index);
     return std::make_pair(name, index);
   } else {
-    // The saved class variable info corresponds to the offset in the hash
-    // table storage.
-    InternalIndex entry(saved_class_variable_info());
+    // The saved class variable info corresponds to the name.
+    Tagged<Name> name = Cast<Name>(class_variable_info);
     Tagged<NameToIndexHashTable> table = context_local_names_hashtable();
-    Tagged<Object> name = table->KeyAt(entry);
+    int index = table->Lookup(name);
+    DCHECK_GE(index, 0);
     DCHECK(IsString(name));
-    return std::make_pair(Cast<String>(name), table->IndexAt(entry));
+    return std::make_pair(Cast<String>(name), index);
   }
 }
 
diff --git a/deps/v8/src/objects/scope-info.h b/deps/v8/src/objects/scope-info.h
index 4de0d6337aee8f..c14e74755003b9 100644
--- a/deps/v8/src/objects/scope-info.h
+++ b/deps/v8/src/objects/scope-info.h
@@ -193,8 +193,8 @@ class ScopeInfo : public TorqueGeneratedScopeInfo<ScopeInfo, HeapObject> {
   // returns a value < 0. The name must be an internalized string.
   // If the slot is present and mode != nullptr, sets *mode to the corresponding
   // mode for that variable.
-  int ContextSlotIndex(DirectHandle<String> name);
-  int ContextSlotIndex(DirectHandle<String> name,
+  int ContextSlotIndex(Tagged<String> name);
+  int ContextSlotIndex(Tagged<String> name,
                        VariableLookupResult* lookup_result);
 
   // Lookup metadata of a MODULE-allocated variable.  Return 0 if there is no
diff --git a/deps/v8/src/objects/scope-info.tq b/deps/v8/src/objects/scope-info.tq
index a542de97668ecc..9a0e7fcb96a073 100644
--- a/deps/v8/src/objects/scope-info.tq
+++ b/deps/v8/src/objects/scope-info.tq
@@ -156,9 +156,8 @@ extern class ScopeInfo extends HeapObject {
 
   // If the scope is a class scope and it has static private methods that
   // may be accessed directly or through eval, one slot is reserved to hold
-  // the offset in the field storage of the hash table (or the slot index if
-  // local names are inlined) for the class variable.
-  saved_class_variable_info?[flags.has_saved_class_variable]: Smi;
+  // the name of the class variable or the slot index if locals are inlined.
+  saved_class_variable_info?[flags.has_saved_class_variable]: Smi|Name;
 
   // If the scope belongs to a named function expression this part contains
   // information about the function variable. It always occupies two array
diff --git a/deps/v8/src/objects/script.tq b/deps/v8/src/objects/script.tq
index cb4335031081c5..be85d47d28625c 100644
--- a/deps/v8/src/objects/script.tq
+++ b/deps/v8/src/objects/script.tq
@@ -62,6 +62,9 @@ extern class Script extends Struct {
   // [source_mapping_url]: sourceMappingURL magic comment
   source_mapping_url: Object;
 
+  // [debug_id]: debugId magic comment
+  debug_id: String|Undefined;
+
   // [host_defined_options]: Options defined by the embedder.
   host_defined_options: FixedArray;
 
diff --git a/deps/v8/src/objects/shared-function-info-inl.h b/deps/v8/src/objects/shared-function-info-inl.h
index 459ffd79e2fbe6..bc383e145ea017 100644
--- a/deps/v8/src/objects/shared-function-info-inl.h
+++ b/deps/v8/src/objects/shared-function-info-inl.h
@@ -528,11 +528,6 @@ void SharedFunctionInfo::DontAdaptArguments() {
   TorqueGeneratedClass::set_formal_parameter_count(kDontAdaptArgumentsSentinel);
 }
 
-bool SharedFunctionInfo::IsDontAdaptArguments() const {
-  return TorqueGeneratedClass::formal_parameter_count() ==
-         kDontAdaptArgumentsSentinel;
-}
-
 DEF_ACQUIRE_GETTER(SharedFunctionInfo, scope_info, Tagged<ScopeInfo>) {
   Tagged<Object> maybe_scope_info = name_or_scope_info(cage_base, kAcquireLoad);
   if (IsScopeInfo(maybe_scope_info, cage_base)) {
@@ -656,33 +651,74 @@ IsCompiledScope SharedFunctionInfo::is_compiled_scope(IsolateT* isolate) const {
 }
 
 IsCompiledScope::IsCompiledScope(const Tagged<SharedFunctionInfo> shared,
-                                 Isolate* isolate)
-    : is_compiled_(shared->is_compiled()) {
-  if (shared->HasBaselineCode()) {
-    retain_code_ = handle(shared->baseline_code(kAcquireLoad), isolate);
-  } else if (shared->HasBytecodeArray()) {
-    retain_code_ = handle(shared->GetBytecodeArray(isolate), isolate);
+                                 Isolate* isolate) {
+  Tagged<Object> data_obj = shared->GetTrustedData();
+  if (Tagged<HeapObject> data; TryCast<HeapObject>(data_obj, &data)) {
+    if (Tagged<Code> code; TryCast<Code>(data, &code)) {
+      DCHECK_EQ(code->kind(), CodeKind::BASELINE);
+      data = code->bytecode_or_interpreter_data();
+    }
+    // Unlike GetBytecodeArray, we don't bother checking for DebugInfo here. If
+    // there is DebugInfo, then it will hold both the debug and original
+    // BytecodeArray strongly, so it doesn't matter which of those we hold.
+    if (Tagged<BytecodeArray> bytecode;
+        TryCast<BytecodeArray>(data, &bytecode)) {
+      retain_code_ = handle(bytecode, isolate);
+      is_compiled_ = true;
+    } else if (Tagged<InterpreterData> interpreter_data;
+               TryCast<InterpreterData>(data, &interpreter_data)) {
+      retain_code_ = handle(interpreter_data->bytecode_array(), isolate);
+      is_compiled_ = true;
+    } else if (Is<UncompiledData>(data)) {
+      retain_code_ = {};
+      is_compiled_ = false;
+    } else {
+      retain_code_ = {};
+      is_compiled_ = shared->is_compiled();
+    }
   } else {
-    retain_code_ = MaybeHandle<HeapObject>();
+    retain_code_ = {};
+    is_compiled_ = shared->is_compiled();
   }
 
   DCHECK_IMPLIES(!retain_code_.is_null(), is_compiled());
+  DCHECK_EQ(shared->is_compiled(), is_compiled());
 }
 
 IsCompiledScope::IsCompiledScope(const Tagged<SharedFunctionInfo> shared,
-                                 LocalIsolate* isolate)
-    : is_compiled_(shared->is_compiled()) {
-  if (shared->HasBaselineCode()) {
-    retain_code_ = isolate->heap()->NewPersistentHandle(
-        shared->baseline_code(kAcquireLoad));
-  } else if (shared->HasBytecodeArray()) {
-    retain_code_ =
-        isolate->heap()->NewPersistentHandle(shared->GetBytecodeArray(isolate));
+                                 LocalIsolate* isolate) {
+  Tagged<Object> data_obj = shared->GetTrustedData();
+  if (Tagged<HeapObject> data; TryCast<HeapObject>(data_obj, &data)) {
+    if (Tagged<Code> code; TryCast<Code>(data, &code)) {
+      DCHECK(code->kind() == CodeKind::BASELINE);
+      data = code->bytecode_or_interpreter_data();
+    }
+    // Unlike GetBytecodeArray, we don't bother checking for DebugInfo here. If
+    // there is DebugInfo, then it will hold both the debug and original
+    // BytecodeArray strongly, so it doesn't matter which of those we hold.
+    if (Tagged<BytecodeArray> bytecode;
+        TryCast<BytecodeArray>(data, &bytecode)) {
+      retain_code_ = isolate->heap()->NewPersistentHandle(bytecode);
+      is_compiled_ = true;
+    } else if (Tagged<InterpreterData> interpreter_data;
+               TryCast<InterpreterData>(data, &interpreter_data)) {
+      retain_code_ = isolate->heap()->NewPersistentHandle(
+          interpreter_data->bytecode_array());
+      is_compiled_ = true;
+    } else if (Is<UncompiledData>(data)) {
+      retain_code_ = {};
+      is_compiled_ = false;
+    } else {
+      retain_code_ = {};
+      is_compiled_ = shared->is_compiled();
+    }
   } else {
-    retain_code_ = MaybeHandle<HeapObject>();
+    retain_code_ = {};
+    is_compiled_ = shared->is_compiled();
   }
 
   DCHECK_IMPLIES(!retain_code_.is_null(), is_compiled());
+  DCHECK_EQ(shared->is_compiled(), is_compiled());
 }
 
 bool SharedFunctionInfo::has_simple_parameters() {
diff --git a/deps/v8/src/objects/shared-function-info.cc b/deps/v8/src/objects/shared-function-info.cc
index a94d079d86d8e5..b916c0bcbc378b 100644
--- a/deps/v8/src/objects/shared-function-info.cc
+++ b/deps/v8/src/objects/shared-function-info.cc
@@ -773,8 +773,10 @@ void SharedFunctionInfo::UpdateFromFunctionLiteralForLiveEdit(
     // Updating the ScopeInfo is safe since they are identical modulo
     // source positions.
     Tagged<ScopeInfo> new_scope_info = *lit->scope()->scope_info();
-    DCHECK(new_scope_info->Equals(Cast<ScopeInfo>(maybe_scope_info), true));
-    SetScopeInfo(new_scope_info);
+    Tagged<ScopeInfo> old_scope_info = Cast<ScopeInfo>(maybe_scope_info);
+    DCHECK(new_scope_info->Equals(old_scope_info, true));
+    old_scope_info->SetPositionInfo(new_scope_info->position_info_start(),
+                                    new_scope_info->position_info_end());
   } else if (!is_compiled()) {
     CHECK(HasUncompiledData());
     if (HasUncompiledDataWithPreparseData()) {
@@ -892,4 +894,38 @@ bool SharedFunctionInfo::UniqueIdsAreUnique(Isolate* isolate) {
 }
 #endif  // DEBUG
 
+std::ostream& operator<<(std::ostream& os,
+                         SharedFunctionInfo::Inlineability i) {
+  switch (i) {
+    case SharedFunctionInfo::Inlineability::kHasNoScript:
+      os << "has no script";
+      break;
+    case SharedFunctionInfo::Inlineability::kNeedsBinaryCoverage:
+      os << "needs binary coverage";
+      break;
+    case SharedFunctionInfo::Inlineability::kIsBuiltin:
+      os << "is builtin";
+      break;
+    case SharedFunctionInfo::Inlineability::kIsNotUserCode:
+      os << "is not user code";
+      break;
+    case SharedFunctionInfo::Inlineability::kHasNoBytecode:
+      os << "has no bytecode";
+      break;
+    case SharedFunctionInfo::Inlineability::kExceedsBytecodeLimit:
+      os << "exceeds bytecode limit";
+      break;
+    case SharedFunctionInfo::Inlineability::kMayContainBreakPoints:
+      os << "may contain breakpoints";
+      break;
+    case SharedFunctionInfo::Inlineability::kHasOptimizationDisabled:
+      os << "has optimization disabled";
+      break;
+    case SharedFunctionInfo::Inlineability::kIsInlineable:
+      os << "is inlineable (!)";
+      break;
+  }
+  return os;
+}
+
 }  // namespace v8::internal
diff --git a/deps/v8/src/objects/shared-function-info.h b/deps/v8/src/objects/shared-function-info.h
index cfe0f547fa2085..e31b37be3bc1e4 100644
--- a/deps/v8/src/objects/shared-function-info.h
+++ b/deps/v8/src/objects/shared-function-info.h
@@ -308,13 +308,17 @@ class SharedFunctionInfo
 
   // [internal formal parameter count]: The declared number of parameters.
   // For subclass constructors, also includes new.target.
-  // The size of function's frame is
-  // internal_formal_parameter_count_with_receiver.
   //
-  // NOTE: this API should be considered DEPRECATED. Please obtain the
-  // parameter count from the Code/BytecodeArray or another trusted source
-  // instead. See also crbug.com/40931165.
-  // TODO(saelo): mark as V8_DEPRECATE_SOON once the remaining users are fixed.
+  // NOTE: SharedFunctionInfo objects are located inside the sandbox, so an
+  // attacker able to corrupt in-sandbox memory can change this field
+  // arbitrarily. As such, it is not safe to use this field for invoking a
+  // JSFunction or computing the size of stack frames (or similar use-cases
+  // that involve accessing out-of-sandbox memory such as the stack). Instead,
+  // for such purposes, a trusted parameter count must be used, the source of
+  // which depends on the concrete use case. For example, a (trusted) parameter
+  // count can be obtained from a BytecodeArray (e.g. for interpreting
+  // bytecode), a Code object (e.g. for deoptimizing optimized code), or the
+  // JSDispatchTable (e.g. for invoking a JSFunction).
   inline void set_internal_formal_parameter_count(int value);
   inline uint16_t internal_formal_parameter_count_with_receiver() const;
   inline uint16_t internal_formal_parameter_count_without_receiver() const;
@@ -327,7 +331,6 @@ class SharedFunctionInfo
   // Set the formal parameter count so the function code will be
   // called without using argument adaptor frames.
   inline void DontAdaptArguments();
-  inline bool IsDontAdaptArguments() const;
 
   // Accessors for the data associated with this SFI.
   //
@@ -830,6 +833,8 @@ class SharedFunctionInfo
   TQ_OBJECT_CONSTRUCTORS(SharedFunctionInfo)
 };
 
+std::ostream& operator<<(std::ostream& os, SharedFunctionInfo::Inlineability i);
+
 // A SharedFunctionInfoWrapper wraps a SharedFunctionInfo from trusted space.
 // It can be useful when a protected pointer reference to a SharedFunctionInfo
 // is needed, for example for a ProtectedFixedArray.
@@ -875,13 +880,13 @@ class V8_NODISCARD IsCompiledScope {
                          Isolate* isolate);
   inline IsCompiledScope(const Tagged<SharedFunctionInfo> shared,
                          LocalIsolate* isolate);
-  inline IsCompiledScope() : retain_code_(), is_compiled_(false) {}
+  inline IsCompiledScope() = default;
 
   inline bool is_compiled() const { return is_compiled_; }
 
  private:
-  MaybeHandle<HeapObject> retain_code_;
-  bool is_compiled_;
+  MaybeHandle<HeapObject> retain_code_ = {};
+  bool is_compiled_ = false;
 };
 
 std::ostream& operator<<(std::ostream& os, const SourceCodeOf& v);
diff --git a/deps/v8/src/objects/shared-function-info.tq b/deps/v8/src/objects/shared-function-info.tq
index e610c2ca0e27c4..bda977f1e67f18 100644
--- a/deps/v8/src/objects/shared-function-info.tq
+++ b/deps/v8/src/objects/shared-function-info.tq
@@ -85,6 +85,17 @@ extern class SharedFunctionInfo extends HeapObject {
   // value kDontAdaptArgumentsSentinel to indicate that arguments are passed
   // unaltered).
   // In contrast to [length], formal_parameter_count includes the receiver.
+  //
+  // NOTE: SharedFunctionInfo objects are located inside the sandbox, so an
+  // attacker able to corrupt in-sandbox memory can change this field
+  // arbitrarily. As such, it is not safe to use this field for invoking a
+  // JSFunction or computing the size of stack frames (or similar use-cases
+  // that involve accessing out-of-sandbox memory such as the stack). Instead,
+  // for such purposes, a trusted parameter count must be used, the source of
+  // which depends on the concrete use case. For example, a (trusted) parameter
+  // count can be obtained from a BytecodeArray (e.g. for interpreting
+  // bytecode), a Code object (e.g. for deoptimizing optimized code), or the
+  // JSDispatchTable (e.g. for invoking a JSFunction).
   formal_parameter_count: uint16;
   function_token_offset: uint16;
   // [expected_nof_properties]: Expected number of properties for the
diff --git a/deps/v8/src/objects/simd.cc b/deps/v8/src/objects/simd.cc
index 296fc44403d609..690326b95b1e75 100644
--- a/deps/v8/src/objects/simd.cc
+++ b/deps/v8/src/objects/simd.cc
@@ -638,11 +638,33 @@ Maybe<uint8_t> HexToUint8(base::uc16 hex) {
   return Nothing<uint8_t>();
 }
 
+template <typename T>
+std::optional<uint8_t> HandleRemainingHexValues(
+    const base::Vector<T>& input_vector, size_t i) {
+  T higher = input_vector[i];
+  T lower = input_vector[i + 1];
+
+  uint8_t result_high = 0;
+  Maybe<uint8_t> maybe_result_high = HexToUint8(higher);
+  if (!maybe_result_high.To(&result_high)) {
+    return {};
+  }
+
+  uint8_t result_low = 0;
+  Maybe<uint8_t> maybe_result_low = HexToUint8(lower);
+  if (!maybe_result_low.To(&result_low)) {
+    return {};
+  }
+
+  result_high <<= 4;
+  uint8_t result = result_high + result_low;
+  return result;
+}
+
 #ifdef __SSE3__
-const __m128i all_11 = _mm_set1_epi8(11);
-__m128i char_0 = _mm_set1_epi8('0');
+const __m128i char_0 = _mm_set1_epi8('0');
 
-inline __m128i HexToUint8FastWithSSE(__m128i nibbles) {
+inline std::optional<__m128i> HexToUint8FastWithSSE(__m128i nibbles) {
   // Example:
   // nibbles: {0x36, 0x66, 0x66, 0x32, 0x31, 0x32, 0x31, 0x32, 0x36, 0x66, 0x66,
   // 0x32, 0x31, 0x32, 0x31, 0x66}
@@ -691,7 +713,7 @@ inline __m128i HexToUint8FastWithSSE(__m128i nibbles) {
 
   if (_mm_movemask_epi8(_mm_cmpeq_epi8(
           combined_mask, _mm_set1_epi64x(0xffffffffffffffff))) != 0xFFFF) {
-    return all_11;
+    return {};
   }
 
   // Combine the results using bitwise OR
@@ -701,57 +723,59 @@ inline __m128i HexToUint8FastWithSSE(__m128i nibbles) {
 }
 
 template <typename T>
-bool Uint8ArrayFromHexWithSSE(base::Vector<T> input_vector,
-                              DirectHandle<JSArrayBuffer> buffer,
-                              size_t output_length) {
-  CHECK_EQ(buffer->GetByteLength(), output_length);
-  // Example:
-  // input_vector: 666f6f6261726172666f6f62617261ff
+bool Uint8ArrayFromHexWithSSE(const base::Vector<T>& input_vector,
+                              uint8_t* buffer, size_t output_length) {
+  //  Example:
+  //  input_vector: 666f6f6261726172666f6f62617261ff
   size_t i;
 
   for (i = 0; i + 32 <= output_length * 2; i += 32) {
     // Load first batch of 16 hex characters into an SSE register
     // {0x36, 0x36, 0x36, 0x66, 0x36, 0x66, 0x36, 0x32, 0x36, 0x31,
     //         0x37, 0x32, 0x36, 0x31, 0x37, 0x32}
-    __m128i first_patch =
+    __m128i first_batch =
         _mm_loadu_si128(reinterpret_cast<const __m128i*>(&input_vector[i]));
     // Handle TwoByteStrings
     if constexpr (std::is_same_v<T, const base::uc16>) {
-      __m128i second_part_first_patch = _mm_loadu_si128(
+      __m128i second_part_first_batch = _mm_loadu_si128(
           reinterpret_cast<const __m128i*>(&input_vector[i + 8]));
 
-      first_patch = _mm_packus_epi16(first_patch, second_part_first_patch);
+      first_batch = _mm_packus_epi16(first_batch, second_part_first_batch);
     }
 
     // Load second batch of 16 hex characters into an SSE register
     // {0x36, 0x36, 0x36, 0x66, 0x36, 0x66, 0x36, 0x32, 0x36, 0x31, 0x37, 0x32,
     // 0x36, 0x31, 0x66, 0x66}
-    __m128i second_patch = _mm_loadu_si128(
+    __m128i second_batch = _mm_loadu_si128(
         reinterpret_cast<const __m128i*>(&input_vector[i + 16]));
     if constexpr (std::is_same_v<T, const base::uc16>) {
-      __m128i second_part_second_patch = _mm_loadu_si128(
+      __m128i second_part_second_batch = _mm_loadu_si128(
           reinterpret_cast<const __m128i*>(&input_vector[i + 24]));
 
-      second_patch = _mm_packus_epi16(second_patch, second_part_second_patch);
+      second_batch = _mm_packus_epi16(second_batch, second_part_second_batch);
     }
 
     __m128i mask = _mm_set1_epi64((__m64)0x00ff00ff00ff00ff);
 
+    // low nibbles are values with even indexes in fist_batch.
     // {0x36, 0x0, 0x66, 0x0, 0x66, 0x0, 0x32, 0x0, 0x31, 0x0,
     //             0x32, 0x0, 0x31, 0x0, 0x32, 0x0}
-    __m128i first_batch_lo_nibbles = _mm_srli_epi16(first_patch, 8);
+    __m128i first_batch_lo_nibbles = _mm_srli_epi16(first_batch, 8);
 
+    // high nibbles are values with odd indexes in first_batch.
     // {0x36, 0x0, 0x36, 0x0, 0x36, 0x0, 0x36, 0x0, 0x36, 0x0,
     //              0x37, 0x0, 0x36, 0x0, 0x37, 0x0}
-    __m128i first_batch_hi_nibbles = _mm_and_si128(first_patch, mask);
+    __m128i first_batch_hi_nibbles = _mm_and_si128(first_batch, mask);
 
+    // low nibbles are values with even indexes in second_batch.
     // {0x36, 0x0, 0x66, 0x0, 0x66, 0x0, 0x32, 0x0, 0x31, 0x0,
     //             0x32, 0x0, 0x31, 0x0, 0x66, 0x0}
-    __m128i second_batch_lo_nibbles = _mm_srli_epi16(second_patch, 8);
+    __m128i second_batch_lo_nibbles = _mm_srli_epi16(second_batch, 8);
 
+    // high nibbles are values with odd indexes in second_batch.
     // {0x36, 0x0, 0x36, 0x0, 0x36, 0x0, 0x36, 0x0, 0x36, 0x0,
     //              0x37, 0x0, 0x36, 0x0, 0x66, 0x0}
-    __m128i second_batch_hi_nibbles = _mm_and_si128(second_patch, mask);
+    __m128i second_batch_hi_nibbles = _mm_and_si128(second_batch, mask);
 
     // Append first_batch_lo_nibbles and second_batch_lo_nibbles and
     // remove 0x0 values
@@ -767,76 +791,246 @@ bool Uint8ArrayFromHexWithSSE(base::Vector<T> input_vector,
     __m128i hi_nibbles =
         _mm_packus_epi16(first_batch_hi_nibbles, second_batch_hi_nibbles);
 
+    // mapping low nibbles to uint8_t values.
     // {0x6, 0xf, 0xf, 0x2, 0x1, 0x2, 0x1, 0x2, 0x6, 0xf, 0xf, 0x2, 0x1, 0x2,
     // 0x1, 0xf}
-    __m128i uint8_low_nibbles = HexToUint8FastWithSSE(lo_nibbles);
-    // If any of the values was invalid hex value, we got all_11 vector as a
-    // result.
-    if (_mm_movemask_epi8(_mm_cmpeq_epi8(uint8_low_nibbles, all_11)) ==
-        0xFFFF) {
+    std::optional<__m128i> maybe_uint8_low_nibbles =
+        HexToUint8FastWithSSE(lo_nibbles);
+
+    // Check if it is {} (includes invalid hex values)
+    if (!maybe_uint8_low_nibbles.has_value()) {
       return false;
     }
+    __m128i uint8_low_nibbles = maybe_uint8_low_nibbles.value();
 
+    // mapping high nibbles to uint8_t values.
     // {0x6, 0x6, 0x6, 0x6, 0x6, 0x7, 0x6, 0x7, 0x6, 0x6, 0x6, 0x6, 0x6, 0x7,
     // 0x6, 0xf}
-    __m128i uint8_high_nibbles = HexToUint8FastWithSSE(hi_nibbles);
-    // If any of the values was invalid hex value, we got all_11 vector as a
-    // result.
-    if (_mm_movemask_epi8(_mm_cmpeq_epi8(uint8_high_nibbles, all_11)) ==
-        0xFFFF) {
+    std::optional<__m128i> maybe_uint8_high_nibbles =
+        HexToUint8FastWithSSE(hi_nibbles);
+
+    // Check if it is {} (includes invalid hex values)
+    if (!maybe_uint8_high_nibbles.has_value()) {
       return false;
     }
+    __m128i uint8_high_nibbles = maybe_uint8_high_nibbles.value();
 
+    // shift uint8_t values of high nibbles to be able to combine with low
+    // uint8_t values.
     // {0x60, 0x60, 0x60, 0x60, 0x60, 0x70, 0x60, 0x70, 0x60, 0x60, 0x60, 0x60,
     // 0x60, 0x70, 0x60, 0xf0}
     __m128i uint8_shifted_high_nibbles = _mm_slli_epi64(uint8_high_nibbles, 4);
 
-    // {0x66, 0x6f, 0x6f, 0x62, 0x61, 0x72, 0x61, 0x72, 0x66, 0x6f, 0x6f, 0x62,
-    // 0x61, 0x72, 0x61, 0xff}
+    // final result of combining pairs of uint8_t values of low and high
+    // nibbles.
+    // {0x66, 0x6f, 0x6f, 0x62, 0x61, 0x72, 0x61, 0x72, 0x66, 0x6f,
+    // 0x6f, 0x62, 0x61, 0x72, 0x61, 0xff}
     __m128i final_result =
         _mm_or_si128(uint8_shifted_high_nibbles, uint8_low_nibbles);
 
     // store result in a buffer and it is equivalent to
     // [102,111,111,98,97,114,97,114,102,111,111,98,97,114,97,255]
-    _mm_storeu_si128(reinterpret_cast<__m128i*>(&(static_cast<uint8_t*>(
-                         buffer->backing_store())[i / 2])),
+    _mm_storeu_si128(reinterpret_cast<__m128i*>(&(buffer[i / 2])),
                      final_result);
   }
 
   // Handle remaining values
+  std::optional<uint8_t> result = 0;
   for (size_t j = i; j < output_length * 2; j += 2) {
-    T higher = input_vector[j];
-    T lower = input_vector[j + 1];
+    result = HandleRemainingHexValues(input_vector, j);
+    if (result.has_value()) {
+      buffer[j / 2] = result.value();
+    } else {
+      return false;
+    }
+  }
+
+  return true;
+}
+#endif
+
+#ifdef NEON64
+
+inline std::optional<uint8x16_t> HexToUint8FastWithNeon(uint8x16_t nibbles) {
+  // Example:
+  // nibbles: (0x36, 0x66, 0x46, 0x32, 0x31, 0x32, 0x31, 0x32, 0x36, 0x66, 0x66,
+  // 0x32, 0x31, 0x32, 0x31, 0x66)
+
+  uint8x16_t char_0 = vdupq_n_u8('0');
+  uint8x16_t char_a = vdupq_n_u8('a');
+  uint8x16_t char_A = vdupq_n_u8('A');
+  uint8x16_t all_10 = vdupq_n_u8(10);
+  uint8x16_t all_6 = vdupq_n_u8(6);
+
+  // Create masks and nibbles for different character ranges
+  // Valid hexadecimal values are 0-9, a-f and A-F.
+  // mask_09 is 0xff when the corresponding value in nibbles is in range
+  // of 0 to 9. nibbles_09 is value-'0' and 0x0 for the rest of the values.
+  // Similar description apply to mask_af, mask_AF, nibbles_af and nibbles_af.
+
+  // mask_09: (0xff, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00,
+  // 0xff, 0xff, 0xff, 0xff, 0x00)
+  // nibbles_09: (0x06, 0x00, 0x00, 0x02, 0x01, 0x02, 0x01, 0x02,
+  // 0x06, 0x00, 0x00, 0x02, 0x01, 0x02, 0x01, 0x00)
+  uint8x16_t nibbles_09 = vsubq_u8(nibbles, char_0);
+  uint8x16_t mask_09 = vcgtq_u8(all_10, nibbles_09);
+  nibbles_09 = vandq_u8(nibbles_09, mask_09);
+
+  // mask_af: (0x00, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff,
+  // 0x00, 0x00, 0x00, 0x00, 0xff)
+  // nibbles_af: (0x00, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  // 0x00, 0x0f, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x0f)
+  uint8x16_t nibbles_af = vsubq_u8(nibbles, char_a);
+  uint8x16_t mask_af = vcgtq_u8(all_6, nibbles_af);
+  nibbles_af = vandq_u8(vaddq_u8(nibbles_af, all_10), mask_af);
+
+  // mask_AF: (0x00, 0x00, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+  // 0x00, 0x00, 0x00, 0x00, 0x00)
+  // nibbles_AF: (0x00, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00,
+  // 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00)
+  uint8x16_t nibbles_AF = vsubq_u8(nibbles, char_A);
+  uint8x16_t mask_AF = vcgtq_u8(all_6, nibbles_AF);
+  nibbles_AF = vandq_u8(vaddq_u8(nibbles_AF, all_10), mask_AF);
+
+  // Combine masks to check if all nibbles are valid hex values
+  // (0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+  // 0xff, 0xff, 0xff, 0xff)
+  uint8x16_t combined_mask = vorrq_u8(vorrq_u8(mask_af, mask_AF), mask_09);
+
+  // Check if all bytes are 0xFF
+  if (vminvq_u8(combined_mask) != 0xFF) return {};
+
+  // Combine the results using bitwise OR
+  // returns (0x06, 0x0f, 0x0f, 0x02, 0x01, 0x02, 0x01, 0x02, 0x06, 0x0f, 0x0f,
+  // 0x02, 0x01, 0x02, 0x01, 0x0f)
+  return vorrq_u8(vorrq_u8(nibbles_af, nibbles_AF), nibbles_09);
+}
 
-    uint8_t result = 0;
-    Maybe<uint8_t> maybe_result = HexToUint8(higher);
-    if (!maybe_result.To(&result)) {
+template <typename T>
+bool Uint8ArrayFromHexWithNeon(const base::Vector<T>& input_vector,
+                               uint8_t* buffer, size_t output_length) {
+  // Example: 666f6F6261726172666f6f62617261ff
+
+  size_t i;
+  for (i = 0; i + 32 <= output_length * 2; i += 32) {
+    // Load first batch of 16 hex characters into a Neon register
+    // (0x36, 0x36, 0x36, 0x66, 0x36, 0x46, 0x36, 0x32, 0x36, 0x31, 0x37, 0x32,
+    // 0x36, 0x31, 0x37, 0x32)
+    uint8x16_t first_batch =
+        vld1q_u8(reinterpret_cast<const uint8_t*>(&input_vector[i]));
+
+    // Handle TwoByteStrings
+    if constexpr (std::is_same_v<T, const base::uc16>) {
+      uint8x16_t second_part_first_batch =
+          vld1q_u8(reinterpret_cast<const uint8_t*>(&input_vector[i + 8]));
+      first_batch =
+          vmovn_high_u16(vmovn_u16(first_batch), second_part_first_batch);
+    }
+
+    // Load second batch of 16 hex characters into a Neon register
+    // (0x36, 0x36, 0x36, 0x66, 0x36, 0x66, 0x36, 0x32, 0x36, 0x31, 0x37, 0x32,
+    // 0x36, 0x31, 0x66, 0x66)
+    uint8x16_t second_batch =
+        vld1q_u8(reinterpret_cast<const uint8_t*>(&input_vector[i + 16]));
+
+    if constexpr (std::is_same_v<T, const base::uc16>) {
+      uint8x16_t second_part_second_batch =
+          vld1q_u8(reinterpret_cast<const uint8_t*>(&input_vector[i + 24]));
+      second_batch =
+          vmovn_high_u16(vmovn_u16(second_batch), second_part_second_batch);
+    }
+
+    // low nibbles are values with even indexes in fist_batch.
+    // (0x36, 0x00, 0x66, 0x00, 0x46, 0x00, 0x32, 0x00, 0x31, 0x00, 0x32, 0x00,
+    // 0x31, 0x00, 0x32, 0x00)
+    uint8x16_t first_batch_lo_nibbles =
+        vreinterpretq_u8_u16(vshrq_n_u16(vreinterpretq_u16_u8(first_batch), 8));
+
+    // low nibbles are values with even indexes in second_batch.
+    // (0x36, 0x00, 0x66, 0x00, 0x66, 0x00, 0x32, 0x00, 0x31, 0x00, 0x32, 0x00,
+    // 0x31, 0x00, 0x66, 0x00)
+    uint8x16_t second_batch_lo_nibbles = vreinterpretq_u8_u16(
+        vshrq_n_u16(vreinterpretq_u16_u8(second_batch), 8));
+
+    // Append low nibbles of first batch and second batch and remove 0x00s.
+    // (0x36, 0x66, 0x46, 0x32, 0x31, 0x32, 0x31, 0x32, 0x36, 0x66, 0x66, 0x32,
+    // 0x31, 0x32, 0x31, 0x66)
+    uint8x16_t lo_nibbles = vmovn_high_u16(vmovn_u16(first_batch_lo_nibbles),
+                                           second_batch_lo_nibbles);
+
+    // high nibbles are values with odd indexes in loaded batchs.
+    // vmovn_high_u16 and vmovn_u16 narrow input words by dropping most
+    // significant byte. (0x36, 0x36, 0x36, 0x36, 0x36, 0x37, 0x36, 0x37, 0x36,
+    // 0x36, 0x36, 0x36, 0x36, 0x37, 0x36, 0x66)
+    uint8x16_t hi_nibbles =
+        vmovn_high_u16(vmovn_u16(first_batch), second_batch);
+
+    // mapping low nibbles to uint8_t values.
+    // (0x06, 0x0f, 0x0f, 0x02, 0x01, 0x02, 0x01, 0x02, 0x06, 0x0f, 0x0f, 0x02,
+    // 0x01, 0x02, 0x01, 0x0f)
+    std::optional<uint8x16_t> maybe_uint8_low_nibbles =
+        HexToUint8FastWithNeon(lo_nibbles);
+
+    // Check if it is {} (includes invalid hex values)
+    if (!maybe_uint8_low_nibbles.has_value()) {
       return false;
     }
+    uint8x16_t uint8_low_nibbles = maybe_uint8_low_nibbles.value();
+
+    // mapping high nibbles to uint8_t values.
+    // (0x06, 0x06, 0x06, 0x06, 0x06, 0x07, 0x06, 0x07, 0x06, 0x06, 0x06, 0x06,
+    // 0x06, 0x07, 0x06, 0x0f)
+    std::optional<uint8x16_t> maybe_uint8_high_nibbles =
+        HexToUint8FastWithNeon(hi_nibbles);
 
-    uint8_t result_low = 0;
-    Maybe<uint8_t> maybe_result_low = HexToUint8(lower);
-    if (!maybe_result_low.To(&result_low)) {
+    // Check if it is {} (includes invalid hex values)
+    if (!maybe_uint8_high_nibbles.has_value()) {
       return false;
     }
+    uint8x16_t uint8_high_nibbles = maybe_uint8_high_nibbles.value();
+
+    // shift uint8_t values of high nibbles to be able to combine with low
+    // uint8_t values.
+    // (0x60, 0x60, 0x60, 0x60, 0x60, 0x70, 0x60, 0x70, 0x60, 0x60, 0x60, 0x60,
+    // 0x60, 0x70, 0x60, 0xf0)
+    uint8x16_t uint8_shifted_high_nibbles =
+        vshlq_n_u64(vreinterpretq_u64_u8(uint8_high_nibbles), 4);
+
+    // final result of combining pairs of uint8_t values of low and high
+    // nibbles.
+    // (0x66, 0x6f, 0x6f, 0x62, 0x61, 0x72, 0x61, 0x72, 0x66, 0x6f,
+    // 0x6f, 0x62, 0x61, 0x72, 0x61, 0xff)
+    uint8x16_t final_result =
+        vorrq_u8(uint8_shifted_high_nibbles, uint8_low_nibbles);
 
-    result <<= 4;
-    result += result_low;
-    static_cast<uint8_t*>(buffer->backing_store())[j / 2] = result;
+    // store result in a buffer and it is equivalent to
+    // [102,111,111,98,97,114,97,114,102,111,111,98,97,114,97,255]
+    vst1q_u8(buffer + i / 2, final_result);
   }
 
+  // Handle remaining values
+  std::optional<uint8_t> result = 0;
+  for (size_t j = i; j < output_length * 2; j += 2) {
+    result = HandleRemainingHexValues(input_vector, j);
+    if (result.has_value()) {
+      buffer[j / 2] = result.value();
+    } else {
+      return false;
+    }
+  }
   return true;
 }
+
 #endif
 
 }  // namespace
 
 template <typename T>
-bool ArrayBufferFromHex(base::Vector<T> input_vector,
-                        DirectHandle<JSArrayBuffer> buffer,
+bool ArrayBufferFromHex(const base::Vector<T>& input_vector, uint8_t* buffer,
                         size_t output_length) {
   size_t input_length = input_vector.size();
-  DCHECK_EQ(output_length, input_length / 2);
+  DCHECK_LE(output_length, input_length / 2);
+
 #ifdef __SSE3__
   if (get_vectorization_kind() == SimdKinds::kAVX2 ||
       get_vectorization_kind() == SimdKinds::kSSE) {
@@ -844,36 +1038,31 @@ bool ArrayBufferFromHex(base::Vector<T> input_vector,
   }
 #endif
 
+#ifdef NEON64
+  if (get_vectorization_kind() == SimdKinds::kNeon) {
+    return Uint8ArrayFromHexWithNeon(input_vector, buffer, output_length);
+  }
+#endif
+
   size_t index = 0;
+  std::optional<uint8_t> result = 0;
   for (uint32_t i = 0; i < input_length; i += 2) {
-    T higher = input_vector[i];
-    T lower = input_vector[i + 1];
-
-    uint8_t result = 0;
-    Maybe<uint8_t> maybe_result = HexToUint8(higher);
-    if (!maybe_result.To(&result)) {
-      return false;
-    }
-
-    uint8_t result_low = 0;
-    Maybe<uint8_t> maybe_result_low = HexToUint8(lower);
-    if (!maybe_result_low.To(&result_low)) {
+    result = HandleRemainingHexValues(input_vector, i);
+    if (result.has_value()) {
+      buffer[index++] = result.value();
+    } else {
       return false;
     }
-
-    result <<= 4;
-    result += result_low;
-    reinterpret_cast<uint8_t*>(buffer->backing_store())[index++] = result;
   }
   return true;
 }
 
-template bool ArrayBufferFromHex(base::Vector<const uint8_t> input_vector,
-                                 DirectHandle<JSArrayBuffer> buffer,
-                                 size_t output_length);
-template bool ArrayBufferFromHex(base::Vector<const base::uc16> input_vector,
-                                 DirectHandle<JSArrayBuffer> buffer,
-                                 size_t output_length);
+template bool ArrayBufferFromHex(
+    const base::Vector<const uint8_t>& input_vector, uint8_t* buffer,
+    size_t output_length);
+template bool ArrayBufferFromHex(
+    const base::Vector<const base::uc16>& input_vector, uint8_t* buffer,
+    size_t output_length);
 
 #ifdef NEON64
 #undef NEON64
diff --git a/deps/v8/src/objects/simd.h b/deps/v8/src/objects/simd.h
index 81613752bd3925..f7aab77b2342a7 100644
--- a/deps/v8/src/objects/simd.h
+++ b/deps/v8/src/objects/simd.h
@@ -23,8 +23,7 @@ uintptr_t ArrayIndexOfIncludesDouble(Address array_start, uintptr_t array_len,
 Tagged<Object> Uint8ArrayToHex(const char* bytes, size_t length,
                                DirectHandle<SeqOneByteString> string_output);
 template <typename T>
-bool ArrayBufferFromHex(base::Vector<T> input_vector,
-                        DirectHandle<JSArrayBuffer> buffer,
+bool ArrayBufferFromHex(const base::Vector<T>& input_vector, uint8_t* buffer,
                         size_t output_length);
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/slots-inl.h b/deps/v8/src/objects/slots-inl.h
index 962c6e6a5ce49c..317f787a348470 100644
--- a/deps/v8/src/objects/slots-inl.h
+++ b/deps/v8/src/objects/slots-inl.h
@@ -194,6 +194,14 @@ void FullHeapObjectSlot::StoreHeapObject(Tagged<HeapObject> value) const {
   *location() = value.ptr();
 }
 
+void ExternalPointerSlot::init_lazily_initialized() {
+#ifdef V8_ENABLE_SANDBOX
+  Relaxed_StoreHandle(kNullExternalPointerHandle);
+#else
+  WriteMaybeUnalignedValue<Address>(address(), kNullAddress);
+#endif  // V8_ENABLE_SANDBOX
+}
+
 void ExternalPointerSlot::init(IsolateForSandbox isolate,
                                Tagged<HeapObject> host, Address value,
                                ExternalPointerTag tag) {
@@ -249,6 +257,17 @@ void ExternalPointerSlot::store(IsolateForSandbox isolate, Address value,
 #endif  // V8_ENABLE_SANDBOX
 }
 
+ExternalPointerTag ExternalPointerSlot::load_tag(IsolateForSandbox isolate) {
+#ifdef V8_ENABLE_SANDBOX
+  const ExternalPointerTable& table =
+      isolate.GetExternalPointerTableFor(tag_range_);
+  ExternalPointerHandle handle = Relaxed_LoadHandle();
+  return table.GetTag(handle);
+#else
+  return kExternalPointerNullTag;
+#endif  // V8_ENABLE_SANDBOX
+}
+
 ExternalPointerSlot::RawContent
 ExternalPointerSlot::GetAndClearContentForSerialization(
     const DisallowGarbageCollection& no_gc) {
diff --git a/deps/v8/src/objects/slots.h b/deps/v8/src/objects/slots.h
index 60e4988212d8f9..7932e597c24260 100644
--- a/deps/v8/src/objects/slots.h
+++ b/deps/v8/src/objects/slots.h
@@ -357,6 +357,8 @@ class ExternalPointerSlot
   {
   }
 
+  inline void init_lazily_initialized();
+
   inline void init(IsolateForSandbox isolate, Tagged<HeapObject> host,
                    Address value, ExternalPointerTag tag);
 
@@ -383,6 +385,9 @@ class ExternalPointerSlot
   inline void store(IsolateForSandbox isolate, Address value,
                     ExternalPointerTag tag);
 
+  // Loads tag value from the external pointer table.
+  inline ExternalPointerTag load_tag(IsolateForSandbox isolate);
+
   // ExternalPointerSlot serialization support.
   // These methods can be used to clear an external pointer slot prior to
   // serialization and restore it afterwards. This is useful in cases where the
diff --git a/deps/v8/src/objects/source-text-module.cc b/deps/v8/src/objects/source-text-module.cc
index 3edf2310733fcd..ed807634b871ff 100644
--- a/deps/v8/src/objects/source-text-module.cc
+++ b/deps/v8/src/objects/source-text-module.cc
@@ -1059,8 +1059,8 @@ Maybe<bool> SourceTextModule::ExecuteAsyncModule(
       isolate->factory()->NewBuiltinContext(
           isolate->native_context(),
           ExecuteAsyncModuleContextSlots::kContextLength);
-  execute_async_module_context->set(ExecuteAsyncModuleContextSlots::kModule,
-                                    *module);
+  execute_async_module_context->SetNoCell(
+      ExecuteAsyncModuleContextSlots::kModule, *module);
 
   // 4. Let fulfilledClosure be a new Abstract Closure with no parameters that
   //    captures module and performs the following steps when called:
diff --git a/deps/v8/src/objects/string.cc b/deps/v8/src/objects/string.cc
index f716ae94734428..48193b85eb6986 100644
--- a/deps/v8/src/objects/string.cc
+++ b/deps/v8/src/objects/string.cc
@@ -1139,6 +1139,22 @@ size_t String::WriteUtf8(Isolate* isolate, DirectHandle<String> string,
   return encoding_result.bytes_written;
 }
 
+// LINT.IfChange(StringDoesNotContainEscapeCharacters)
+// static
+bool String::DoesNotContainEscapeCharacters(Tagged<String> string) {
+  // This method is not optimized. It is only meant to be used in verification
+  // code.
+  bool requires_escape = false;
+  StringCharacterStream stream(string);
+  while (stream.HasMore() && !requires_escape) {
+    uint16_t c = stream.GetNext();
+    requires_escape =
+        c < 0x20 || c == 0x22 || c == 0x5c || (c >= 0xD800 && c <= 0xDFFF);
+  }
+  return !requires_escape;
+}
+// LINT.ThenChange(/src/json/json-stringifier.cc:StringDoesNotContainEscapeCharacters)
+
 template <typename SourceChar>
 static void CalculateLineEndsImpl(String::LineEndsVector* line_ends,
                                   base::Vector<const SourceChar> src,
@@ -1322,10 +1338,6 @@ bool String::SlowEquals(Isolate* isolate, DirectHandle<String> one,
     if (one_hash != two_hash) return false;
   }
 
-  // We know the strings are both non-empty. Compare the first chars
-  // before we try to flatten the strings.
-  if (one->Get(0) != two->Get(0)) return false;
-
   one = String::Flatten(isolate, one);
   two = String::Flatten(isolate, two);
 
diff --git a/deps/v8/src/objects/string.h b/deps/v8/src/objects/string.h
index 3a4d45102ba312..c44a54727be467 100644
--- a/deps/v8/src/objects/string.h
+++ b/deps/v8/src/objects/string.h
@@ -581,6 +581,8 @@ V8_OBJECT class String : public Name {
                                    length);
   }
 
+  static bool DoesNotContainEscapeCharacters(Tagged<String> string);
+
   static inline uint32_t NonOneByteStart(const base::uc16* chars,
                                          uint32_t length) {
     DCHECK(IsAligned(reinterpret_cast<Address>(chars), sizeof(base::uc16)));
diff --git a/deps/v8/src/objects/struct-inl.h b/deps/v8/src/objects/struct-inl.h
index fc514e56935fbf..4e648be34de2b8 100644
--- a/deps/v8/src/objects/struct-inl.h
+++ b/deps/v8/src/objects/struct-inl.h
@@ -22,12 +22,18 @@ namespace internal {
 #include "torque-generated/src/objects/struct-tq-inl.inc"
 
 TQ_OBJECT_CONSTRUCTORS_IMPL(Struct)
-TQ_OBJECT_CONSTRUCTORS_IMPL(Tuple2)
-TQ_OBJECT_CONSTRUCTORS_IMPL(AccessorPair)
 
-NEVER_READ_ONLY_SPACE_IMPL(AccessorPair)
+Tagged<Object> Tuple2::value1() const { return value1_.load(); }
+void Tuple2::set_value1(Tagged<Object> value, WriteBarrierMode mode) {
+  value1_.store(this, value, mode);
+}
 
-TQ_OBJECT_CONSTRUCTORS_IMPL(ClassPositions)
+Tagged<Object> Tuple2::value2() const { return value2_.load(); }
+void Tuple2::set_value2(Tagged<Object> value, WriteBarrierMode mode) {
+  value2_.store(this, value, mode);
+}
+
+NEVER_READ_ONLY_SPACE_IMPL(AccessorPair)
 
 Tagged<Object> AccessorPair::get(AccessorComponent component) {
   return component == ACCESSOR_GETTER ? getter() : setter();
@@ -50,8 +56,31 @@ void AccessorPair::set(AccessorComponent component, Tagged<Object> value,
   }
 }
 
-RELEASE_ACQUIRE_ACCESSORS(AccessorPair, getter, Tagged<Object>, kGetterOffset)
-RELEASE_ACQUIRE_ACCESSORS(AccessorPair, setter, Tagged<Object>, kSetterOffset)
+Tagged<Object> AccessorPair::getter() const { return getter_.load(); }
+void AccessorPair::set_getter(Tagged<Object> value, WriteBarrierMode mode) {
+  getter_.store(this, value, mode);
+}
+
+Tagged<Object> AccessorPair::getter(AcquireLoadTag) const {
+  return getter_.Acquire_Load();
+}
+void AccessorPair::set_getter(Tagged<Object> value, ReleaseStoreTag,
+                              WriteBarrierMode mode) {
+  getter_.Release_Store(this, value, mode);
+}
+
+Tagged<Object> AccessorPair::setter() const { return setter_.load(); }
+void AccessorPair::set_setter(Tagged<Object> value, WriteBarrierMode mode) {
+  setter_.store(this, value, mode);
+}
+
+Tagged<Object> AccessorPair::setter(AcquireLoadTag) const {
+  return setter_.Acquire_Load();
+}
+void AccessorPair::set_setter(Tagged<Object> value, ReleaseStoreTag,
+                              WriteBarrierMode mode) {
+  setter_.Release_Store(this, value, mode);
+}
 
 void AccessorPair::SetComponents(Tagged<Object> getter, Tagged<Object> setter) {
   if (!IsNull(getter)) set_getter(getter);
@@ -63,6 +92,16 @@ bool AccessorPair::Equals(Tagged<Object> getter_value,
   return (getter() == getter_value) && (setter() == setter_value);
 }
 
+int ClassPositions::start() const { return start_.load().value(); }
+void ClassPositions::set_start(int value) {
+  start_.store(this, Smi::FromInt(value));
+}
+
+int ClassPositions::end() const { return end_.load().value(); }
+void ClassPositions::set_end(int value) {
+  end_.store(this, Smi::FromInt(value));
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/objects/struct.h b/deps/v8/src/objects/struct.h
index 488cf879cd8b8e..8abb77909860ea 100644
--- a/deps/v8/src/objects/struct.h
+++ b/deps/v8/src/objects/struct.h
@@ -29,14 +29,37 @@ class Struct : public TorqueGeneratedStruct<Struct, HeapObject> {
   TQ_OBJECT_CONSTRUCTORS(Struct)
 };
 
-class Tuple2 : public TorqueGeneratedTuple2<Tuple2, Struct> {
+// Temporary mirror of Struct for subtypes with the new layout.
+V8_OBJECT class StructLayout : public HeapObjectLayout {
  public:
   void BriefPrintDetails(std::ostream& os);
 
+  DECL_VERIFIER(Struct)
+
   using BodyDescriptor = StructBodyDescriptor;
+} V8_OBJECT_END;
+static_assert(sizeof(StructLayout) == sizeof(HeapObjectLayout));
 
-  TQ_OBJECT_CONSTRUCTORS(Tuple2)
-};
+V8_OBJECT class Tuple2 : public StructLayout {
+ public:
+  void BriefPrintDetails(std::ostream& os);
+
+  inline Tagged<Object> value1() const;
+  inline void set_value1(Tagged<Object> value,
+                         WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+
+  inline Tagged<Object> value2() const;
+  inline void set_value2(Tagged<Object> value,
+                         WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+
+  DECL_VERIFIER(Tuple2)
+  DECL_PRINTER(Tuple2)
+
+ private:
+  friend class TorqueGeneratedTuple2Asserts;
+  TaggedMember<Object> value1_;
+  TaggedMember<Object> value2_;
+} V8_OBJECT_END;
 
 // Support for JavaScript accessors: A pair of a getter and a setter. Each
 // accessor can either be
@@ -44,7 +67,7 @@ class Tuple2 : public TorqueGeneratedTuple2<Tuple2, Struct> {
 //   * a FunctionTemplateInfo: a real (lazy) accessor
 //   * undefined: considered an accessor by the spec, too, strangely enough
 //   * null: an accessor which has not been set
-class AccessorPair : public TorqueGeneratedAccessorPair<AccessorPair, Struct> {
+V8_OBJECT class AccessorPair : public StructLayout {
  public:
   NEVER_READ_ONLY_SPACE
   static DirectHandle<AccessorPair> Copy(Isolate* isolate,
@@ -55,13 +78,19 @@ class AccessorPair : public TorqueGeneratedAccessorPair<AccessorPair, Struct> {
   inline void set(AccessorComponent component, Tagged<Object> value,
                   ReleaseStoreTag tag);
 
-  using TorqueGeneratedAccessorPair::getter;
-  using TorqueGeneratedAccessorPair::set_getter;
-  DECL_RELEASE_ACQUIRE_ACCESSORS(getter, Tagged<Object>)
+  inline Tagged<Object> getter() const;
+  inline void set_getter(Tagged<Object> value,
+                         WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+  inline Tagged<Object> getter(AcquireLoadTag) const;
+  inline void set_getter(Tagged<Object> value, ReleaseStoreTag,
+                         WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
 
-  using TorqueGeneratedAccessorPair::set_setter;
-  using TorqueGeneratedAccessorPair::setter;
-  DECL_RELEASE_ACQUIRE_ACCESSORS(setter, Tagged<Object>)
+  inline Tagged<Object> setter() const;
+  inline void set_setter(Tagged<Object> value,
+                         WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
+  inline Tagged<Object> setter(AcquireLoadTag) const;
+  inline void set_setter(Tagged<Object> value, ReleaseStoreTag,
+                         WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
 
   // Note: Returns undefined if the component is not set.
   static Handle<JSAny> GetComponent(Isolate* isolate,
@@ -74,21 +103,38 @@ class AccessorPair : public TorqueGeneratedAccessorPair<AccessorPair, Struct> {
 
   inline bool Equals(Tagged<Object> getter_value, Tagged<Object> setter_value);
 
-  using BodyDescriptor = StructBodyDescriptor;
+  DECL_VERIFIER(AccessorPair)
+  DECL_PRINTER(AccessorPair)
 
-  TQ_OBJECT_CONSTRUCTORS(AccessorPair)
-};
+ private:
+  friend class CodeStubAssembler;
+  friend class V8HeapExplorer;
+  friend class TorqueGeneratedAccessorPairAsserts;
 
-class ClassPositions
-    : public TorqueGeneratedClassPositions<ClassPositions, Struct> {
+  TaggedMember<Object> getter_;
+  TaggedMember<Object> setter_;
+} V8_OBJECT_END;
+
+V8_OBJECT class ClassPositions : public StructLayout {
  public:
+  inline int start() const;
+  inline void set_start(int value);
+
+  inline int end() const;
+  inline void set_end(int value);
+
   // Dispatched behavior.
   void BriefPrintDetails(std::ostream& os);
 
-  using BodyDescriptor = StructBodyDescriptor;
+  DECL_VERIFIER(ClassPositions)
+  DECL_PRINTER(ClassPositions)
 
-  TQ_OBJECT_CONSTRUCTORS(ClassPositions)
-};
+ private:
+  friend class TorqueGeneratedClassPositionsAsserts;
+
+  TaggedMember<Smi> start_;
+  TaggedMember<Smi> end_;
+} V8_OBJECT_END;
 
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/objects/struct.tq b/deps/v8/src/objects/struct.tq
index d91ce535b2a762..e4235e53dae2b2 100644
--- a/deps/v8/src/objects/struct.tq
+++ b/deps/v8/src/objects/struct.tq
@@ -5,17 +5,8 @@
 @abstract
 extern class Struct extends HeapObject {}
 
-extern class Tuple2 extends Struct {
-  value1: Object;
-  value2: Object;
-}
+extern class Tuple2 extends Struct;
 
-extern class ClassPositions extends Struct {
-  start: Smi;
-  end: Smi;
-}
+extern class ClassPositions extends Struct;
 
-extern class AccessorPair extends Struct {
-  getter: Object;
-  setter: Object;
-}
+extern class AccessorPair extends Struct;
diff --git a/deps/v8/src/objects/tagged-field-inl.h b/deps/v8/src/objects/tagged-field-inl.h
index 091938199dd4a1..0da20433e5bceb 100644
--- a/deps/v8/src/objects/tagged-field-inl.h
+++ b/deps/v8/src/objects/tagged-field-inl.h
@@ -24,8 +24,7 @@ Address TaggedMember<T, CompressionScheme>::tagged_to_full(
     DCHECK(HAS_SMI_TAG(tagged_value));
     return CompressionScheme::DecompressTaggedSigned(tagged_value);
   } else {
-    return CompressionScheme::DecompressTagged(CompressionScheme::base(),
-                                               tagged_value);
+    return CompressionScheme::DecompressTagged(tagged_value);
   }
 #else
   return tagged_value;
@@ -189,7 +188,7 @@ Address TaggedField<T, kFieldOffset, CompressionScheme>::tagged_to_full(
     DCHECK(HAS_SMI_TAG(tagged_value));
     return CompressionScheme::DecompressTaggedSigned(tagged_value);
   } else {
-    return CompressionScheme::DecompressTagged(on_heap_addr, tagged_value);
+    return CompressionScheme::DecompressTagged(tagged_value);
   }
 #else
   return tagged_value;
diff --git a/deps/v8/src/objects/tagged-impl-inl.h b/deps/v8/src/objects/tagged-impl-inl.h
index fbce34e663a256..3527446a769fdb 100644
--- a/deps/v8/src/objects/tagged-impl-inl.h
+++ b/deps/v8/src/objects/tagged-impl-inl.h
@@ -116,7 +116,7 @@ bool TaggedImpl<kRefType, StorageType>::GetHeapObjectIfStrong(
   if (IsStrong()) {
     *result = Cast<HeapObject>(
         Tagged<Object>(V8HeapCompressionScheme::DecompressTagged(
-            isolate, static_cast<Tagged_t>(ptr_))));
+            static_cast<Tagged_t>(ptr_))));
     return true;
   }
   return false;
@@ -140,9 +140,8 @@ Tagged<HeapObject> TaggedImpl<kRefType, StorageType>::GetHeapObjectAssumeStrong(
   if (kIsFull) return GetHeapObjectAssumeStrong();
   // Implementation for compressed pointers.
   DCHECK(IsStrong());
-  return Cast<HeapObject>(
-      Tagged<Object>(V8HeapCompressionScheme::DecompressTagged(
-          isolate, static_cast<Tagged_t>(ptr_))));
+  return Cast<HeapObject>(Tagged<Object>(
+      V8HeapCompressionScheme::DecompressTagged(static_cast<Tagged_t>(ptr_))));
 }
 
 //
@@ -230,12 +229,12 @@ Tagged<HeapObject> TaggedImpl<kRefType, StorageType>::GetHeapObject(
     DCHECK(!IsCleared());
     return Cast<HeapObject>(
         Tagged<Object>(V8HeapCompressionScheme::DecompressTagged(
-            isolate, static_cast<Tagged_t>(ptr_) & ~kWeakHeapObjectMask)));
+            static_cast<Tagged_t>(ptr_) & ~kWeakHeapObjectMask)));
   } else {
     DCHECK(!HAS_WEAK_HEAP_OBJECT_TAG(ptr_));
     return Cast<HeapObject>(
         Tagged<Object>(V8HeapCompressionScheme::DecompressTagged(
-            isolate, static_cast<Tagged_t>(ptr_))));
+            static_cast<Tagged_t>(ptr_))));
   }
 }
 
diff --git a/deps/v8/src/objects/tagged-impl.cc b/deps/v8/src/objects/tagged-impl.cc
index 1f8b74d79e7ee5..982fd9533da9d3 100644
--- a/deps/v8/src/objects/tagged-impl.cc
+++ b/deps/v8/src/objects/tagged-impl.cc
@@ -23,6 +23,7 @@ namespace internal {
 
 #if defined(V8_EXTERNAL_CODE_SPACE) || defined(V8_ENABLE_SANDBOX)
 bool CheckObjectComparisonAllowed(Address a, Address b) {
+  // LINT.IfChange(CheckObjectComparisonAllowed)
   if (!HAS_STRONG_HEAP_OBJECT_TAG(a) || !HAS_STRONG_HEAP_OBJECT_TAG(b)) {
     return true;
   }
@@ -39,6 +40,7 @@ bool CheckObjectComparisonAllowed(Address a, Address b) {
            HeapLayout::InTrustedSpace(obj_b));
 #endif
   return true;
+  // LINT.ThenChange(src/codegen/code-stub-assembler.cc:CheckObjectComparisonAllowed)
 }
 #endif  // defined(V8_EXTERNAL_CODE_SPACE) || defined(V8_ENABLE_SANDBOX)
 
diff --git a/deps/v8/src/objects/tagged-value-inl.h b/deps/v8/src/objects/tagged-value-inl.h
index 5e6275992c2e60..336ef1c76806a1 100644
--- a/deps/v8/src/objects/tagged-value-inl.h
+++ b/deps/v8/src/objects/tagged-value-inl.h
@@ -33,7 +33,7 @@ Tagged<Object> StrongTaggedValue::ToObject(Isolate* isolate,
                                            StrongTaggedValue object) {
 #ifdef V8_COMPRESS_POINTERS
   return Tagged<Object>(
-      V8HeapCompressionScheme::DecompressTagged(isolate, object.ptr()));
+      V8HeapCompressionScheme::DecompressTagged(object.ptr()));
 #else
   return Tagged<Object>(object.ptr());
 #endif
@@ -53,7 +53,7 @@ Tagged<MaybeObject> TaggedValue::ToMaybeObject(Isolate* isolate,
                                                TaggedValue object) {
 #ifdef V8_COMPRESS_POINTERS
   return Tagged<MaybeObject>(
-      V8HeapCompressionScheme::DecompressTagged(isolate, object.ptr()));
+      V8HeapCompressionScheme::DecompressTagged(object.ptr()));
 #else
   return Tagged<MaybeObject>(object.ptr());
 #endif
diff --git a/deps/v8/src/objects/tagged.h b/deps/v8/src/objects/tagged.h
index 6d6f18d57290b5..363c3d0b772c08 100644
--- a/deps/v8/src/objects/tagged.h
+++ b/deps/v8/src/objects/tagged.h
@@ -274,6 +274,14 @@ struct is_complex_subtype<Derived, TrustedObject,
                               std::is_base_of<TrustedObjectLayout, Derived>>>>
     : public std::true_type {};
 
+class StructLayout;
+template <typename Derived>
+struct is_complex_subtype<Derived, Struct,
+                          std::enable_if_t<std::disjunction_v<
+                              std::is_base_of<Struct, Derived>,
+                              std::is_base_of<StructLayout, Derived>>>>
+    : public std::true_type {};
+
 template <typename Derived, typename... BaseTs>
 struct is_complex_subtype<Derived, Union<BaseTs...>>
     : public std::disjunction<is_subtype<Derived, BaseTs>...> {};
diff --git a/deps/v8/src/objects/templates.cc b/deps/v8/src/objects/templates.cc
index d94cc9c6060ad1..801e365d4469dc 100644
--- a/deps/v8/src/objects/templates.cc
+++ b/deps/v8/src/objects/templates.cc
@@ -187,6 +187,16 @@ const CFunctionInfo* FunctionTemplateInfo::GetCSignature(Isolate* isolate,
                    ->get(index * kFunctionOverloadEntrySize + 1));
 }
 
+// static
+void ObjectTemplateInfo::SealAndPrepareForPromotionToReadOnly(
+    Isolate* isolate, DirectHandle<ObjectTemplateInfo> info) {
+  if (info->should_promote_to_read_only()) return;
+  CHECK(!HeapLayout::InReadOnlySpace(*info));
+
+  info->EnsureHasSerialNumber(isolate);
+  info->set_should_promote_to_read_only(true);
+}
+
 // static
 DirectHandle<DictionaryTemplateInfo> DictionaryTemplateInfo::Create(
     Isolate* isolate, const v8::MemorySpan<const std::string_view>& names) {
diff --git a/deps/v8/src/objects/templates.h b/deps/v8/src/objects/templates.h
index 9622c0abfc82d5..ccc3087731260c 100644
--- a/deps/v8/src/objects/templates.h
+++ b/deps/v8/src/objects/templates.h
@@ -320,6 +320,9 @@ class ObjectTemplateInfo
   // chain till a function template that has an instance template is found.
   inline Tagged<ObjectTemplateInfo> GetParent(Isolate* isolate);
 
+  static void SealAndPrepareForPromotionToReadOnly(
+      Isolate* isolate, DirectHandle<ObjectTemplateInfo> info);
+
   using BodyDescriptor = StructBodyDescriptor;
 
  private:
diff --git a/deps/v8/src/objects/value-serializer.cc b/deps/v8/src/objects/value-serializer.cc
index 92429393137c62..72c1e37c0e98ea 100644
--- a/deps/v8/src/objects/value-serializer.cc
+++ b/deps/v8/src/objects/value-serializer.cc
@@ -594,8 +594,13 @@ Maybe<bool> ValueSerializer::WriteJSReceiver(
 
   // Eliminate callable and exotic objects, which should not be serialized.
   InstanceType instance_type = receiver->map()->instance_type();
-  if (IsCallable(*receiver) || (IsSpecialReceiverInstanceType(instance_type) &&
-                                instance_type != JS_SPECIAL_API_OBJECT_TYPE)) {
+  if (IsCallable(*receiver) ||
+      (IsSpecialReceiverInstanceType(instance_type) &&
+       instance_type != JS_SPECIAL_API_OBJECT_TYPE
+#if V8_ENABLE_WEBASSEMBLY
+       && instance_type != WASM_STRUCT_TYPE && instance_type != WASM_ARRAY_TYPE
+#endif
+       )) {
     return ThrowDataCloneError(MessageTemplate::kDataCloneError, receiver);
   }
 
@@ -663,6 +668,12 @@ Maybe<bool> ValueSerializer::WriteJSReceiver(
       return WriteWasmModule(Cast<WasmModuleObject>(receiver));
     case WASM_MEMORY_OBJECT_TYPE:
       return WriteWasmMemory(Cast<WasmMemoryObject>(receiver));
+    case WASM_STRUCT_TYPE:
+    case WASM_ARRAY_TYPE:
+      if (HeapLayout::InAnySharedSpace(*receiver)) {
+        return WriteSharedObject(receiver);
+      }
+      break;
 #endif  // V8_ENABLE_WEBASSEMBLY
     default:
       break;
@@ -1839,7 +1850,8 @@ MaybeDirectHandle<JSArray> ValueDeserializer::ReadSparseJSArray() {
   HandleScope scope(isolate_);
   DirectHandle<JSArray> array =
       isolate_->factory()->NewJSArray(0, TERMINAL_FAST_ELEMENTS_KIND);
-  MAYBE_RETURN(JSArray::SetLength(array, length), MaybeDirectHandle<JSArray>());
+  MAYBE_RETURN(JSArray::SetLength(isolate_, array, length),
+               MaybeDirectHandle<JSArray>());
   AddObjectWithID(id, array);
 
   uint32_t num_properties;
@@ -2505,9 +2517,9 @@ MaybeDirectHandle<JSObject> ValueDeserializer::ReadHostObject() {
 // Copies a vector of property values into an object, given the map that should
 // be used.
 static void CommitProperties(
-    DirectHandle<JSObject> object, DirectHandle<Map> map,
+    Isolate* isolate, DirectHandle<JSObject> object, DirectHandle<Map> map,
     base::Vector<const DirectHandle<Object>> properties) {
-  JSObject::AllocateStorageForMap(object, map);
+  JSObject::AllocateStorageForMap(isolate, object, map);
   DCHECK(!object->map()->is_dictionary_map());
 
   DisallowGarbageCollection no_gc;
@@ -2546,7 +2558,7 @@ Maybe<uint32_t> ValueDeserializer::ReadJSObjectProperties(
       if (!PeekTag().To(&tag)) return Nothing<uint32_t>();
       if (tag == end_tag) {
         ConsumeTag(end_tag);
-        CommitProperties(object, map, base::VectorOf(properties));
+        CommitProperties(isolate_, object, map, base::VectorOf(properties));
         CHECK_LT(properties.size(), std::numeric_limits<uint32_t>::max());
         return Just(static_cast<uint32_t>(properties.size()));
       }
@@ -2654,7 +2666,7 @@ Maybe<uint32_t> ValueDeserializer::ReadJSObjectProperties(
       DCHECK(!transitioning);
       CHECK_LT(properties.size(), std::numeric_limits<uint32_t>::max());
       CHECK(!map->is_dictionary_map());
-      CommitProperties(object, map, base::VectorOf(properties));
+      CommitProperties(isolate_, object, map, base::VectorOf(properties));
       num_properties = static_cast<uint32_t>(properties.size());
 
       // We checked earlier that IsValidObjectKey(key).
@@ -2805,7 +2817,7 @@ ValueDeserializer::ReadObjectUsingEntireBufferForLegacyFormat() {
 
         DirectHandle<JSArray> js_array =
             isolate_->factory()->NewJSArray(0, TERMINAL_FAST_ELEMENTS_KIND);
-        MAYBE_RETURN_NULL(JSArray::SetLength(js_array, length));
+        MAYBE_RETURN_NULL(JSArray::SetLength(isolate_, js_array, length));
         size_t begin_properties =
             stack.size() - 2 * static_cast<size_t>(num_properties);
         if (num_properties &&
diff --git a/deps/v8/src/parsing/parser-base.h b/deps/v8/src/parsing/parser-base.h
index e9d0cc5a18a57b..55452b28675e60 100644
--- a/deps/v8/src/parsing/parser-base.h
+++ b/deps/v8/src/parsing/parser-base.h
@@ -5278,12 +5278,11 @@ typename ParserBase<Impl>::ExpressionT ParserBase<Impl>::ParseClassLiteral(
         class_scope->DeclareStaticHomeObjectVariable(ast_value_factory());
   }
 
-  bool should_save_class_variable_index =
-      class_scope->should_save_class_variable_index();
-  if (!class_info.is_anonymous || should_save_class_variable_index) {
+  bool should_save_class_variable = class_scope->should_save_class_variable();
+  if (!class_info.is_anonymous || should_save_class_variable) {
     impl()->DeclareClassVariable(class_scope, name, &class_info,
                                  class_token_pos);
-    if (should_save_class_variable_index) {
+    if (should_save_class_variable) {
       class_scope->class_variable()->set_is_used();
       class_scope->class_variable()->ForceContextAllocation();
     }
diff --git a/deps/v8/src/parsing/parser.cc b/deps/v8/src/parsing/parser.cc
index c1364b9151fc24..6ae1efd4d90ccd 100644
--- a/deps/v8/src/parsing/parser.cc
+++ b/deps/v8/src/parsing/parser.cc
@@ -303,29 +303,45 @@ bool Parser::ShortcutLiteralBinaryExpression(Expression** x, Expression* y,
     }
   }
 
-  // Constant fold string concatenation.
+  // Constant fold string concatenation:
+  //   "abc" + "def" -> "abcdef"
+  // Note that this only works for folding into the LHS of a left-associative
+  // binary expression. String concatenation folding on the RHS is handled by
+  // `CollapseNaryExpression`, which can't re-use this method since non-string
+  // literal concatenation is not commutative.
   if (op == Token::kAdd) {
-    // Only consider string concatenation of two strings.
     // TODO(leszeks): We could also eagerly convert other literals to string if
     // one side of the addition is a string.
-    if (y->IsStringLiteral()) {
-      if ((*x)->IsStringLiteral()) {
-        const AstRawString* x_val = (*x)->AsLiteral()->AsRawString();
-        const AstRawString* y_val = y->AsLiteral()->AsRawString();
-        AstConsString* cons = ast_value_factory()->NewConsString(x_val, y_val);
-        *x = factory()->NewConsStringLiteral(cons, (*x)->position());
-        return true;
-      }
-      if ((*x)->IsConsStringLiteral()) {
-        const AstRawString* y_val = y->AsLiteral()->AsRawString();
-        (*x)->AsLiteral()->AsConsString()->AddString(zone(), y_val);
-        return true;
-      }
+    if (ShortcutStringLiteralAppendExpression(x, y)) {
+      return true;
     }
   }
   return false;
 }
 
+bool Parser::ShortcutStringLiteralAppendExpression(Expression** x,
+                                                   Expression* y) {
+  if (!y->IsStringLiteral()) return false;
+  const AstRawString* y_val = y->AsLiteral()->AsRawString();
+
+  // Only consider string concatenation of two strings.
+  // TODO(leszeks): We could also eagerly convert other literals to string if
+  // one side of the addition is a string. We'd have to be careful around
+  // associativity though, in case x is the RHS-most expression of an n-ary
+  // addition.
+  if ((*x)->IsStringLiteral()) {
+    const AstRawString* x_val = (*x)->AsLiteral()->AsRawString();
+    AstConsString* cons = ast_value_factory()->NewConsString(x_val, y_val);
+    *x = factory()->NewConsStringLiteral(cons, (*x)->position());
+    return true;
+  }
+  if ((*x)->IsConsStringLiteral()) {
+    (*x)->AsLiteral()->AsConsString()->AddString(zone(), y_val);
+    return true;
+  }
+  return false;
+}
+
 bool Parser::CollapseConditionalChain(Expression** x, Expression* cond,
                                       Expression* then_expression,
                                       Expression* else_expression, int pos,
@@ -377,10 +393,19 @@ bool Parser::CollapseNaryExpression(Expression** x, Expression* y,
     return false;
   }
 
-  // Append our current expression to the nary operation.
-  // TODO(leszeks): Do some literal collapsing here if we're appending Smi or
-  // String literals.
-  nary->AddSubsequent(y, pos);
+  Expression* last = nary->last();
+  // Try to shortcut sequential string literal appends:
+  //  expr + "abc" + "def" -> expr + "abcdef"
+  // Folding on the LHS of expr is handled by the more general
+  // ShortcutLiteralBinaryExpression, this is a special case for RHS string
+  // literal concatenation since this is commutative.
+  if (op == Token::kAdd && ShortcutStringLiteralAppendExpression(&last, y)) {
+    // Append our current expression to the nary operation.
+    nary->UpdateLast(last);
+  } else {
+    // Otherwise append our current expression to the nary operation.
+    nary->AddSubsequent(y, pos);
+  }
   nary->clear_parenthesized();
   AppendNaryOperationSourceRange(nary, range);
 
@@ -691,7 +716,7 @@ void Parser::ParseProgram(Isolate* isolate, DirectHandle<Script> script,
 
   scanner_.Initialize();
   FunctionLiteral* result = DoParseProgram(isolate, info);
-  HandleSourceURLComments(isolate, script);
+  HandleDebugMagicComments(isolate, script);
   if (result == nullptr) return;
   MaybeProcessSourceRanges(info, result, stack_limit_);
   PostProcessParseResult(isolate, info, result);
@@ -3390,8 +3415,8 @@ void Parser::InsertSloppyBlockFunctionVarBindings(DeclarationScope* scope) {
 // Parser support
 
 template <typename IsolateT>
-void Parser::HandleSourceURLComments(IsolateT* isolate,
-                                     DirectHandle<Script> script) {
+void Parser::HandleDebugMagicComments(IsolateT* isolate,
+                                      DirectHandle<Script> script) {
   DirectHandle<String> source_url = scanner_.SourceUrl(isolate);
   if (!source_url.is_null()) {
     script->set_source_url(*source_url);
@@ -3403,12 +3428,17 @@ void Parser::HandleSourceURLComments(IsolateT* isolate,
       IsUndefined(script->source_mapping_url(isolate), isolate)) {
     script->set_source_mapping_url(*source_mapping_url);
   }
+
+  DirectHandle<String> debug_id = scanner_.DebugId(isolate);
+  if (!debug_id.is_null()) {
+    script->set_debug_id(*debug_id);
+  }
 }
 
-template void Parser::HandleSourceURLComments(Isolate* isolate,
-                                              DirectHandle<Script> script);
-template void Parser::HandleSourceURLComments(LocalIsolate* isolate,
-                                              DirectHandle<Script> script);
+template void Parser::HandleDebugMagicComments(Isolate* isolate,
+                                               DirectHandle<Script> script);
+template void Parser::HandleDebugMagicComments(LocalIsolate* isolate,
+                                               DirectHandle<Script> script);
 
 void Parser::UpdateStatistics(Isolate* isolate, DirectHandle<Script> script) {
   CHECK_NOT_NULL(isolate);
@@ -3509,7 +3539,7 @@ void Parser::ParseOnBackground(LocalIsolate* isolate, ParseInfo* info,
   });
   // We need to unpark by now though, to be able to internalize.
   if (flags().is_toplevel()) {
-    HandleSourceURLComments(isolate, script);
+    HandleDebugMagicComments(isolate, script);
   }
   if (result == nullptr) return;
   PostProcessParseResult(isolate, info, result);
diff --git a/deps/v8/src/parsing/parser.h b/deps/v8/src/parsing/parser.h
index 084329bdd97dd6..868ec17f92d7cd 100644
--- a/deps/v8/src/parsing/parser.h
+++ b/deps/v8/src/parsing/parser.h
@@ -170,7 +170,7 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
       base::SmallVector<v8::Isolate::UseCounterFeature, 8>* use_counters,
       int* preparse_skipped);
   template <typename IsolateT>
-  void HandleSourceURLComments(IsolateT* isolate, DirectHandle<Script> script);
+  void HandleDebugMagicComments(IsolateT* isolate, DirectHandle<Script> script);
 
  private:
   friend class ParserBase<Parser>;
@@ -687,6 +687,9 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
   // case, *x will be changed to an expression which is the computed value.
   bool ShortcutLiteralBinaryExpression(Expression** x, Expression* y,
                                        Token::Value op, int pos);
+  // Returns true if we have two string literals passed into an add. In that
+  // case, *x will be changed to an expression which is the concatenated string.
+  bool ShortcutStringLiteralAppendExpression(Expression** x, Expression* y);
 
   bool CollapseConditionalChain(Expression** x, Expression* cond,
                                 Expression* then_expression,
diff --git a/deps/v8/src/parsing/preparse-data.cc b/deps/v8/src/parsing/preparse-data.cc
index 34756b5fd57e50..65d6a6cb5d5efb 100644
--- a/deps/v8/src/parsing/preparse-data.cc
+++ b/deps/v8/src/parsing/preparse-data.cc
@@ -373,7 +373,7 @@ void PreparseDataBuilder::SaveDataForScope(Scope* scope) {
               ->needs_private_name_context_chain_recalc()) |
       ShouldSaveClassVariableIndexField::encode(
           scope->is_class_scope() &&
-          scope->AsClassScope()->should_save_class_variable_index());
+          scope->AsClassScope()->should_save_class_variable());
   byte_data_.Reserve(kUint8Size);
   byte_data_.WriteUint8(scope_data_flags);
 
@@ -691,7 +691,7 @@ void BaseConsumedPreparseData<Data>::RestoreDataForScope(
     }
     var->set_is_used();
     var->ForceContextAllocation();
-    scope->AsClassScope()->set_should_save_class_variable_index();
+    scope->AsClassScope()->set_should_save_class_variable();
   }
 
   if (scope->is_function_scope()) {
diff --git a/deps/v8/src/parsing/scanner.cc b/deps/v8/src/parsing/scanner.cc
index 2236fe9a1878e9..81f617730a31ae 100644
--- a/deps/v8/src/parsing/scanner.cc
+++ b/deps/v8/src/parsing/scanner.cc
@@ -309,6 +309,9 @@ void Scanner::TryToParseMagicComment(base::uc32 hash_or_at_sign) {
                  base::StaticOneByteVector("functionsCalledOnLoad") &&
              hash_or_at_sign == '#') {
     value = &per_function_compile_hints_value;
+  } else if (name_literal == base::StaticOneByteVector("debugId") &&
+             hash_or_at_sign == '#') {
+    value = &debug_id_;
   } else {
     return;
   }
@@ -710,6 +713,18 @@ template DirectHandle<String> Scanner::SourceMappingUrl(Isolate* isolate) const;
 template DirectHandle<String> Scanner::SourceMappingUrl(
     LocalIsolate* isolate) const;
 
+template <typename IsolateT>
+DirectHandle<String> Scanner::DebugId(IsolateT* isolate) const {
+  DirectHandle<String> tmp;
+  if (debug_id_.length() > 0) {
+    tmp = debug_id_.Internalize(isolate);
+  }
+  return tmp;
+}
+
+template DirectHandle<String> Scanner::DebugId(Isolate* isolate) const;
+template DirectHandle<String> Scanner::DebugId(LocalIsolate* isolate) const;
+
 bool Scanner::ScanDigitsWithNumericSeparators(bool (*predicate)(base::uc32 ch),
                                               bool is_check_first_digit) {
   // we must have at least one digit after 'x'/'b'/'o'
diff --git a/deps/v8/src/parsing/scanner.h b/deps/v8/src/parsing/scanner.h
index 103a5ec3b61ccf..ee69652633e6a1 100644
--- a/deps/v8/src/parsing/scanner.h
+++ b/deps/v8/src/parsing/scanner.h
@@ -429,6 +429,8 @@ class V8_EXPORT_PRIVATE Scanner {
   DirectHandle<String> SourceUrl(IsolateT* isolate) const;
   template <typename IsolateT>
   DirectHandle<String> SourceMappingUrl(IsolateT* isolate) const;
+  template <typename IsolateT>
+  DirectHandle<String> DebugId(IsolateT* isolate) const;
 
   bool SawSourceMappingUrlMagicCommentAtSign() const {
     return saw_source_mapping_url_magic_comment_at_sign_;
@@ -764,6 +766,7 @@ class V8_EXPORT_PRIVATE Scanner {
   // Values parsed from magic comments.
   LiteralBuffer source_url_;
   LiteralBuffer source_mapping_url_;
+  LiteralBuffer debug_id_;
   bool saw_source_mapping_url_magic_comment_at_sign_ = false;
   bool saw_magic_comment_compile_hints_all_ = false;
   bool saw_non_comment_ = false;
diff --git a/deps/v8/src/profiler/cpu-profiler.cc b/deps/v8/src/profiler/cpu-profiler.cc
index 8b940a9d8565c0..83581499dcefd1 100644
--- a/deps/v8/src/profiler/cpu-profiler.cc
+++ b/deps/v8/src/profiler/cpu-profiler.cc
@@ -165,8 +165,7 @@ void ProfilerEventsProcessor::AddCurrentStack(
     bool update_stats, const std::optional<uint64_t> trace_id) {
   TickSampleEventRecord record(last_code_event_id_);
   RegisterState regs;
-  StackFrameIterator it(isolate_, isolate_->thread_local_top(),
-                        StackFrameIterator::NoHandles{});
+  StackFrameIterator it(isolate_, isolate_->thread_local_top());
   if (!it.done()) {
     StackFrame* frame = it.frame();
     regs.sp = reinterpret_cast<void*>(frame->sp());
diff --git a/deps/v8/src/profiler/heap-profiler.cc b/deps/v8/src/profiler/heap-profiler.cc
index 705110f2dd8343..9f918fec50971c 100644
--- a/deps/v8/src/profiler/heap-profiler.cc
+++ b/deps/v8/src/profiler/heap-profiler.cc
@@ -14,6 +14,7 @@
 #include "src/heap/heap-inl.h"
 #include "src/heap/heap-layout-inl.h"
 #include "src/heap/heap.h"
+#include "src/objects/cpp-heap-object-wrapper-inl.h"
 #include "src/objects/js-array-buffer-inl.h"
 #include "src/profiler/allocation-tracker.h"
 #include "src/profiler/heap-snapshot-generator-inl.h"
@@ -59,7 +60,7 @@ std::vector<v8::Local<v8::Value>> HeapProfiler::GetDetachedJSWrapperObjects() {
     if (HeapLayout::InCodeSpace(obj)) continue;
     if (!IsJSApiWrapperObject(obj)) continue;
     // Ensure object is wrappable, otherwise GetDetachedness() can crash
-    JSApiWrapper wrapper = JSApiWrapper(Cast<JSObject>(obj));
+    CppHeapObjectWrapper wrapper = CppHeapObjectWrapper(Cast<JSObject>(obj));
     if (!wrapper.GetCppHeapWrappable(isolate(), kAnyCppHeapPointer)) continue;
 
     v8::Local<v8::Value> data(
diff --git a/deps/v8/src/profiler/heap-snapshot-generator.cc b/deps/v8/src/profiler/heap-snapshot-generator.cc
index 7185ba33ac55e5..e527ef5feb4f43 100644
--- a/deps/v8/src/profiler/heap-snapshot-generator.cc
+++ b/deps/v8/src/profiler/heap-snapshot-generator.cc
@@ -1683,27 +1683,30 @@ void V8HeapExplorer::ExtractContextReferences(HeapEntry* entry,
     // Add context allocated locals.
     for (auto it : ScopeInfo::IterateLocalNames(scope_info, no_gc)) {
       int idx = scope_info->ContextHeaderLength() + it->index();
-      SetContextReference(entry, it->name(), context->get(idx),
+      SetContextReference(entry, it->name(), context->get(idx, kRelaxedLoad),
                           Context::OffsetOfElementAt(idx));
     }
     if (scope_info->HasContextAllocatedFunctionName()) {
       Tagged<String> name = Cast<String>(scope_info->FunctionName());
       int idx = scope_info->FunctionContextSlotIndex(name);
       if (idx >= 0) {
-        SetContextReference(entry, name, context->get(idx),
+        SetContextReference(entry, name, context->get(idx, kRelaxedLoad),
                             Context::OffsetOfElementAt(idx));
       }
     }
   }
 
   SetInternalReference(
-      entry, "scope_info", context->get(Context::SCOPE_INFO_INDEX),
+      entry, "scope_info",
+      context->get(Context::SCOPE_INFO_INDEX, kRelaxedLoad),
       FixedArray::OffsetOfElementAt(Context::SCOPE_INFO_INDEX));
-  SetInternalReference(entry, "previous", context->get(Context::PREVIOUS_INDEX),
+  SetInternalReference(entry, "previous",
+                       context->get(Context::PREVIOUS_INDEX, kRelaxedLoad),
                        FixedArray::OffsetOfElementAt(Context::PREVIOUS_INDEX));
   if (context->has_extension()) {
     SetInternalReference(
-        entry, "extension", context->get(Context::EXTENSION_INDEX),
+        entry, "extension",
+        context->get(Context::EXTENSION_INDEX, kRelaxedLoad),
         FixedArray::OffsetOfElementAt(Context::EXTENSION_INDEX));
   }
 
@@ -1713,7 +1716,7 @@ void V8HeapExplorer::ExtractContextReferences(HeapEntry* entry,
     for (size_t i = 0; i < arraysize(native_context_names); i++) {
       int index = native_context_names[i].index;
       const char* name = native_context_names[i].name;
-      SetInternalReference(entry, name, context->get(index),
+      SetInternalReference(entry, name, context->get(index, kRelaxedLoad),
                            FixedArray::OffsetOfElementAt(index));
     }
 
@@ -1871,9 +1874,9 @@ void V8HeapExplorer::ExtractAccessorInfoReferences(
 void V8HeapExplorer::ExtractAccessorPairReferences(
     HeapEntry* entry, Tagged<AccessorPair> accessors) {
   SetInternalReference(entry, "getter", accessors->getter(),
-                       AccessorPair::kGetterOffset);
+                       offsetof(AccessorPair, getter_));
   SetInternalReference(entry, "setter", accessors->setter(),
-                       AccessorPair::kSetterOffset);
+                       offsetof(AccessorPair, setter_));
 }
 
 void V8HeapExplorer::ExtractJSWeakRefReferences(HeapEntry* entry,
@@ -1982,14 +1985,14 @@ void V8HeapExplorer::ExtractPrototypeInfoReferences(
 
 void V8HeapExplorer::ExtractAllocationSiteReferences(
     HeapEntry* entry, Tagged<AllocationSite> site) {
-  SetInternalReference(entry, "transition_info",
-                       site->transition_info_or_boilerplate(),
-                       AllocationSite::kTransitionInfoOrBoilerplateOffset);
+  SetInternalReference(
+      entry, "transition_info", site->transition_info_or_boilerplate(),
+      offsetof(AllocationSite, transition_info_or_boilerplate_));
   SetInternalReference(entry, "nested_site", site->nested_site(),
-                       AllocationSite::kNestedSiteOffset);
+                       offsetof(AllocationSite, nested_site_));
   TagObject(site->dependent_code(), "(dependent code)", HeapEntry::kCode);
   SetInternalReference(entry, "dependent_code", site->dependent_code(),
-                       AllocationSite::kDependentCodeOffset);
+                       offsetof(AllocationSite, dependent_code_));
 }
 
 void V8HeapExplorer::ExtractArrayBoilerplateDescriptionReferences(
@@ -2622,7 +2625,7 @@ bool V8HeapExplorer::IsEssentialObject(Tagged<Object> object) {
 bool V8HeapExplorer::IsEssentialHiddenReference(Tagged<Object> parent,
                                                 int field_offset) {
   if (IsAllocationSite(parent) &&
-      field_offset == AllocationSite::kWeakNextOffset)
+      field_offset == offsetof(AllocationSiteWithWeakNext, weak_next_))
     return false;
   if (IsContext(parent) &&
       field_offset == Context::OffsetOfElementAt(Context::NEXT_CONTEXT_LINK))
diff --git a/deps/v8/src/profiler/tick-sample.cc b/deps/v8/src/profiler/tick-sample.cc
index e9d02e9fbf8259..dedcf1197dfbb9 100644
--- a/deps/v8/src/profiler/tick-sample.cc
+++ b/deps/v8/src/profiler/tick-sample.cc
@@ -261,13 +261,9 @@ bool TickSample::GetStackSample(Isolate* v8_isolate, RegisterState* regs,
   // With stack-switching, the js_entry_sp and current sp may be in different
   // stacks. Use the active stack base instead as the upper bound to correctly
   // validate addresses in the stack frame iterator.
-  Tagged<Object> cont_obj = isolate->root(RootIndex::kActiveContinuation);
-  if (!IsUndefined(cont_obj)) {
-    auto cont = Cast<WasmContinuationObject>(cont_obj);
-    if (!IsUndefined(cont->parent())) {
-      auto* stack = reinterpret_cast<wasm::StackMemory*>(cont->stack());
-      js_entry_sp = stack->base();
-    }
+  wasm::StackMemory* stack = isolate->isolate_data()->active_stack();
+  if (stack != nullptr && stack->jmpbuf()->parent != nullptr) {
+    js_entry_sp = stack->base();
   }
 #endif
 
diff --git a/deps/v8/src/regexp/regexp-compiler.cc b/deps/v8/src/regexp/regexp-compiler.cc
index d9761c9277e588..7082484372dc60 100644
--- a/deps/v8/src/regexp/regexp-compiler.cc
+++ b/deps/v8/src/regexp/regexp-compiler.cc
@@ -6,7 +6,7 @@
 
 #include <optional>
 
-#include "src/base/safe_conversions.h"
+#include "src/base/numerics/safe_conversions.h"
 #include "src/execution/isolate.h"
 #include "src/objects/fixed-array-inl.h"
 #include "src/regexp/regexp-macro-assembler-arch.h"
diff --git a/deps/v8/src/roots/roots-inl.h b/deps/v8/src/roots/roots-inl.h
index e016cb5bba4140..35e99a06ba6b08 100644
--- a/deps/v8/src/roots/roots-inl.h
+++ b/deps/v8/src/roots/roots-inl.h
@@ -120,6 +120,10 @@ Tagged<Boolean> ReadOnlyRoots::boolean_value(bool value) const {
   return value ? Tagged<Boolean>(true_value()) : Tagged<Boolean>(false_value());
 }
 
+Tagged<String> ReadOnlyRoots::single_character_string(int code) const {
+  return Cast<String>(object_at(RootsTable::SingleCharacterStringIndex(code)));
+}
+
 Address ReadOnlyRoots::first_name_for_protector() const {
   return address_at(RootIndex::kFirstNameForProtector);
 }
@@ -147,7 +151,6 @@ Tagged<Object> ReadOnlyRoots::object_at(RootIndex root_index) const {
 Address ReadOnlyRoots::address_at(RootIndex root_index) const {
 #if V8_STATIC_ROOTS_BOOL
   return V8HeapCompressionScheme::DecompressTagged(
-      V8HeapCompressionScheme::base(),
       StaticReadOnlyRootsPointerTable[static_cast<int>(root_index)]);
 #else
   size_t index = static_cast<size_t>(root_index);
diff --git a/deps/v8/src/roots/roots.cc b/deps/v8/src/roots/roots.cc
index d57f69fa03a5a1..d64274e85a74b4 100644
--- a/deps/v8/src/roots/roots.cc
+++ b/deps/v8/src/roots/roots.cc
@@ -117,7 +117,7 @@ void ReadOnlyRoots::InitFromStaticRootsTable(Address cage_base) {
 #if V8_STATIC_ROOTS_BOOL
   RootIndex pos = RootIndex::kFirstReadOnlyRoot;
   for (auto element : StaticReadOnlyRootsPointerTable) {
-    auto ptr = V8HeapCompressionScheme::DecompressTagged(cage_base, element);
+    auto ptr = V8HeapCompressionScheme::DecompressTagged(element);
     DCHECK(!is_initialized(pos));
     read_only_roots_[static_cast<size_t>(pos)] = ptr;
     ++pos;
diff --git a/deps/v8/src/roots/roots.h b/deps/v8/src/roots/roots.h
index c34baa5099b99f..99e97a9028f241 100644
--- a/deps/v8/src/roots/roots.h
+++ b/deps/v8/src/roots/roots.h
@@ -110,8 +110,7 @@ class RootVisitor;
   V(Map, coverage_info_map, CoverageInfoMap)                                   \
   V(Map, dictionary_template_info_map, DictionaryTemplateInfoMap)              \
   V(Map, global_dictionary_map, GlobalDictionaryMap)                           \
-  V(Map, global_context_side_property_cell_map,                                \
-    GlobalContextSidePropertyCellMap)                                          \
+  V(Map, context_cell_map, ContextCellMap)                                     \
   V(Map, many_closures_cell_map, ManyClosuresCellMap)                          \
   V(Map, mega_dom_handler_map, MegaDomHandlerMap)                              \
   V(Map, module_info_map, ModuleInfoMap)                                       \
@@ -127,11 +126,13 @@ class RootVisitor;
   V(Map, preparse_data_map, PreparseDataMap)                                   \
   V(Map, property_array_map, PropertyArrayMap)                                 \
   V(Map, accessor_info_map, AccessorInfoMap)                                   \
+  V(Map, interceptor_info_map, InterceptorInfoMap)                             \
   V(Map, regexp_match_info_map, RegExpMatchInfoMap)                            \
   V(Map, regexp_data_map, RegExpDataMap)                                       \
   V(Map, atom_regexp_data_map, AtomRegExpDataMap)                              \
   V(Map, ir_regexp_data_map, IrRegExpDataMap)                                  \
   V(Map, simple_number_dictionary_map, SimpleNumberDictionaryMap)              \
+  V(Map, simple_name_dictionary_map, SimpleNameDictionaryMap)                  \
   V(Map, small_ordered_hash_map_map, SmallOrderedHashMapMap)                   \
   V(Map, small_ordered_hash_set_map, SmallOrderedHashSetMap)                   \
   V(Map, small_ordered_name_dictionary_map, SmallOrderedNameDictionaryMap)     \
@@ -140,7 +141,6 @@ class RootVisitor;
   V(Map, synthetic_module_map, SyntheticModuleMap)                             \
   IF_WASM(V, Map, wasm_import_data_map, WasmImportDataMap)                     \
   IF_WASM(V, Map, wasm_capi_function_data_map, WasmCapiFunctionDataMap)        \
-  IF_WASM(V, Map, wasm_continuation_object_map, WasmContinuationObjectMap)     \
   IF_WASM(V, Map, wasm_dispatch_table_map, WasmDispatchTableMap)               \
   IF_WASM(V, Map, wasm_exported_function_data_map,                             \
           WasmExportedFunctionDataMap)                                         \
@@ -232,8 +232,6 @@ class RootVisitor;
   V(Cell, invalid_prototype_validity_cell, InvalidPrototypeValidityCell)       \
   V(FeedbackCell, many_closures_cell, ManyClosuresCell)                        \
   STRONG_READ_ONLY_HEAP_NUMBER_ROOT_LIST(V)                                    \
-  /* Table of strings of one-byte single characters */                         \
-  V(FixedArray, single_character_string_table, SingleCharacterStringTable)     \
   /* Marker for self-references during code-generation */                      \
   V(Hole, self_reference_marker, SelfReferenceMarker)                          \
   /* Marker for basic-block usage counters array during code-generation */     \
@@ -405,7 +403,6 @@ class RootVisitor;
   V(WeakArrayList, shared_wasm_memories, SharedWasmMemories)                \
   /* EphemeronHashTable for debug scopes (local debug evaluate) */          \
   V(HeapObject, locals_block_list_cache, DebugLocalsBlockListCache)         \
-  IF_WASM(V, HeapObject, active_continuation, ActiveContinuation)           \
   IF_WASM(V, HeapObject, active_suspender, ActiveSuspender)                 \
   IF_WASM(V, WeakFixedArray, js_to_wasm_wrappers, JSToWasmWrappers)         \
   IF_WASM(V, WeakFixedArray, wasm_canonical_rtts, WasmCanonicalRtts)        \
@@ -466,20 +463,21 @@ class RootVisitor;
 #define ACCESSOR_INFO_ROOT_LIST(V) \
   ACCESSOR_INFO_LIST_GENERATOR(ACCESSOR_INFO_ROOT_LIST_ADAPTER, V)
 
-#define READ_ONLY_ROOT_LIST(V)      \
-  STRONG_READ_ONLY_ROOT_LIST(V)     \
-  INTERNALIZED_STRING_ROOT_LIST(V)  \
-  PRIVATE_SYMBOL_ROOT_LIST(V)       \
-  PUBLIC_SYMBOL_ROOT_LIST(V)        \
-  WELL_KNOWN_SYMBOL_ROOT_LIST(V)    \
-  STRUCT_MAPS_LIST(V)               \
-  TORQUE_DEFINED_MAP_ROOT_LIST(V)   \
-  ALLOCATION_SITE_MAPS_LIST(V)      \
-  NAME_FOR_PROTECTOR_ROOT_LIST(V)   \
-  DATA_HANDLER_MAPS_LIST(V)         \
-  /* Maps */                        \
-  V(Map, external_map, ExternalMap) \
-  V(Map, message_object_map, JSMessageObjectMap)
+#define READ_ONLY_ROOT_LIST(V)                   \
+  STRONG_READ_ONLY_ROOT_LIST(V)                  \
+  INTERNALIZED_STRING_ROOT_LIST(V)               \
+  PRIVATE_SYMBOL_ROOT_LIST(V)                    \
+  PUBLIC_SYMBOL_ROOT_LIST(V)                     \
+  WELL_KNOWN_SYMBOL_ROOT_LIST(V)                 \
+  STRUCT_MAPS_LIST(V)                            \
+  TORQUE_DEFINED_MAP_ROOT_LIST(V)                \
+  ALLOCATION_SITE_MAPS_LIST(V)                   \
+  NAME_FOR_PROTECTOR_ROOT_LIST(V)                \
+  DATA_HANDLER_MAPS_LIST(V)                      \
+  /* Maps */                                     \
+  V(Map, external_map, ExternalMap)              \
+  V(Map, message_object_map, JSMessageObjectMap) \
+  V(Map, cpp_heap_external_map, CppHeapExternalMap)
 
 #define MUTABLE_ROOT_LIST(V)            \
   STRONG_MUTABLE_IMMOVABLE_ROOT_LIST(V) \
@@ -518,6 +516,9 @@ enum class RootIndex : uint16_t {
   // Heap::CreateLateReadOnlyJSReceiverMaps.
   kFirstJSReceiverMapRoot = kJSSharedArrayMap,
 
+  kFirstSingleCharacterString = kascii_nul_string,
+  kLastSingleCharacterString = kFirstSingleCharacterString + 0xff,
+
   // Use for fast protector update checks
   kFirstNameForProtector = kconstructor_string,
   kNameForProtectorCount = 0 NAME_FOR_PROTECTOR_ROOT_LIST(COUNT_ROOT),
@@ -549,6 +550,11 @@ enum class RootIndex : uint16_t {
 };
 // clang-format on
 
+static_assert(RootIndex::kFirstSingleCharacterString ==
+              RootIndex::kascii_nul_string);
+static_assert(RootIndex::kLastSingleCharacterString ==
+              RootIndex::klatin1_ff_string);
+
 static_assert(RootIndex::kFirstNameForProtector <=
               RootIndex::kLastNameForProtector);
 #define FOR_PROTECTOR_CHECK(type, name, CamelName)                             \
@@ -629,11 +635,12 @@ class RootsTable {
 
   static constexpr RootIndex SingleCharacterStringIndex(int c) {
     DCHECK_GE(c, 0);
-    DCHECK_LE(c, static_cast<unsigned>(RootIndex::klatin1_ff_string) -
-                     static_cast<unsigned>(RootIndex::kascii_nul_string));
+    DCHECK_LE(
+        c, static_cast<unsigned>(RootIndex::kLastSingleCharacterString) -
+               static_cast<unsigned>(RootIndex::kFirstSingleCharacterString));
     static_assert(static_cast<int>(RootIndex::kFirstReadOnlyRoot) == 0);
     return static_cast<RootIndex>(
-        static_cast<unsigned>(RootIndex::kascii_nul_string) + c);
+        static_cast<unsigned>(RootIndex::kFirstSingleCharacterString) + c);
   }
 
  private:
@@ -736,6 +743,8 @@ class ReadOnlyRoots {
 
   V8_INLINE Tagged<Boolean> boolean_value(bool value) const;
 
+  V8_INLINE Tagged<String> single_character_string(int code) const;
+
   V8_INLINE Address address_at(RootIndex root_index) const;
   V8_INLINE Tagged<Object> object_at(RootIndex root_index) const;
 
diff --git a/deps/v8/src/roots/static-roots.h b/deps/v8/src/roots/static-roots.h
index 49de2ddf8b34a7..4754e344a6a59c 100644
--- a/deps/v8/src/roots/static-roots.h
+++ b/deps/v8/src/roots/static-roots.h
@@ -80,989 +80,991 @@ struct StaticReadOnlyRoot {
   static constexpr Tagged_t kTheHoleValue = 0x761;
   static constexpr Tagged_t kEmptyEnumCache = 0x76d;
   static constexpr Tagged_t kEmptyDescriptorArray = 0x779;
-  static constexpr Tagged_t kScopeInfoMap = 0x789;
-  static constexpr Tagged_t kModuleInfoMap = 0x7b1;
-  static constexpr Tagged_t kClosureFeedbackCellArrayMap = 0x7d9;
-  static constexpr Tagged_t kFeedbackVectorMap = 0x801;
-  static constexpr Tagged_t kForeignMap = 0x829;
-  static constexpr Tagged_t kTrustedForeignMap = 0x851;
-  static constexpr Tagged_t kMegaDomHandlerMap = 0x879;
-  static constexpr Tagged_t kFixedDoubleArrayMap = 0x8a1;
-  static constexpr Tagged_t kFeedbackMetadataArrayMap = 0x8c9;
-  static constexpr Tagged_t kByteArrayMap = 0x8f1;
-  static constexpr Tagged_t kTrustedByteArrayMap = 0x919;
-  static constexpr Tagged_t kBytecodeArrayMap = 0x941;
-  static constexpr Tagged_t kFreeSpaceMap = 0x969;
-  static constexpr Tagged_t kPropertyArrayMap = 0x991;
-  static constexpr Tagged_t kSmallOrderedHashMapMap = 0x9b9;
-  static constexpr Tagged_t kSmallOrderedHashSetMap = 0x9e1;
-  static constexpr Tagged_t kSmallOrderedNameDictionaryMap = 0xa09;
-  static constexpr Tagged_t kInstructionStreamMap = 0xa31;
-  static constexpr Tagged_t kCellMap = 0xa59;
-  static constexpr Tagged_t kInvalidPrototypeValidityCell = 0xa81;
-  static constexpr Tagged_t kGlobalPropertyCellMap = 0xa89;
-  static constexpr Tagged_t kOnePointerFillerMap = 0xab1;
-  static constexpr Tagged_t kTwoPointerFillerMap = 0xad9;
-  static constexpr Tagged_t kNoClosuresCellMap = 0xb01;
-  static constexpr Tagged_t kOneClosureCellMap = 0xb29;
-  static constexpr Tagged_t kManyClosuresCellMap = 0xb51;
-  static constexpr Tagged_t kTransitionArrayMap = 0xb79;
-  static constexpr Tagged_t kHashTableMap = 0xba1;
-  static constexpr Tagged_t kOrderedNameDictionaryMap = 0xbc9;
-  static constexpr Tagged_t kNameDictionaryMap = 0xbf1;
-  static constexpr Tagged_t kSwissNameDictionaryMap = 0xc19;
-  static constexpr Tagged_t kGlobalDictionaryMap = 0xc41;
-  static constexpr Tagged_t kNumberDictionaryMap = 0xc69;
-  static constexpr Tagged_t kRegisteredSymbolTableMap = 0xc91;
-  static constexpr Tagged_t kArrayListMap = 0xcb9;
-  static constexpr Tagged_t kAccessorInfoMap = 0xce1;
-  static constexpr Tagged_t kPreparseDataMap = 0xd09;
-  static constexpr Tagged_t kSharedFunctionInfoMap = 0xd31;
-  static constexpr Tagged_t kCodeMap = 0xd59;
-  static constexpr Tagged_t kHashSeed = 0xd81;
-  static constexpr Tagged_t kprototype_string = 0xd91;
-  static constexpr Tagged_t kname_string = 0xda9;
-  static constexpr Tagged_t kenumerable_string = 0xdb9;
-  static constexpr Tagged_t kconfigurable_string = 0xdd1;
-  static constexpr Tagged_t kvalue_string = 0xde9;
-  static constexpr Tagged_t kwritable_string = 0xdfd;
-  static constexpr Tagged_t knot_mapped_symbol = 0xe11;
-  static constexpr Tagged_t kuninitialized_symbol = 0xe21;
-  static constexpr Tagged_t kmegamorphic_symbol = 0xe31;
-  static constexpr Tagged_t kelements_transition_symbol = 0xe41;
-  static constexpr Tagged_t kmega_dom_symbol = 0xe51;
-  static constexpr Tagged_t kEmptyPropertyDictionary = 0xe61;
-  static constexpr Tagged_t kEmptyOrderedPropertyDictionary = 0xe8d;
-  static constexpr Tagged_t kEmptyByteArray = 0xea5;
-  static constexpr Tagged_t kEmptyScopeInfo = 0xead;
-  static constexpr Tagged_t kEmptyPropertyArray = 0xec5;
-  static constexpr Tagged_t kMinusZeroValue = 0xecd;
-  static constexpr Tagged_t kNanValue = 0xed9;
-  static constexpr Tagged_t kHoleNanValue = 0xee5;
-  static constexpr Tagged_t kInfinityValue = 0xef1;
-  static constexpr Tagged_t kMinusInfinityValue = 0xefd;
-  static constexpr Tagged_t kMaxSafeInteger = 0xf09;
-  static constexpr Tagged_t kMaxUInt32 = 0xf15;
-  static constexpr Tagged_t kSmiMinValue = 0xf21;
-  static constexpr Tagged_t kSmiMaxValuePlusOne = 0xf2d;
-  static constexpr Tagged_t kPromiseFulfillReactionJobTaskMap = 0xf39;
-  static constexpr Tagged_t kPromiseRejectReactionJobTaskMap = 0xf61;
-  static constexpr Tagged_t kCallableTaskMap = 0xf89;
-  static constexpr Tagged_t kCallbackTaskMap = 0xfb1;
-  static constexpr Tagged_t kPromiseResolveThenableJobTaskMap = 0xfd9;
-  static constexpr Tagged_t kAccessCheckInfoMap = 0x1001;
-  static constexpr Tagged_t kAccessorPairMap = 0x1029;
-  static constexpr Tagged_t kAliasedArgumentsEntryMap = 0x1051;
-  static constexpr Tagged_t kAllocationMementoMap = 0x1079;
-  static constexpr Tagged_t kArrayBoilerplateDescriptionMap = 0x10a1;
-  static constexpr Tagged_t kAsmWasmDataMap = 0x10c9;
-  static constexpr Tagged_t kAsyncGeneratorRequestMap = 0x10f1;
-  static constexpr Tagged_t kBreakPointMap = 0x1119;
-  static constexpr Tagged_t kBreakPointInfoMap = 0x1141;
-  static constexpr Tagged_t kBytecodeWrapperMap = 0x1169;
-  static constexpr Tagged_t kClassBoilerplateMap = 0x1191;
-  static constexpr Tagged_t kClassPositionsMap = 0x11b9;
-  static constexpr Tagged_t kCodeWrapperMap = 0x11e1;
-  static constexpr Tagged_t kDebugInfoMap = 0x1209;
-  static constexpr Tagged_t kErrorStackDataMap = 0x1231;
-  static constexpr Tagged_t kFunctionTemplateRareDataMap = 0x1259;
-  static constexpr Tagged_t kInterceptorInfoMap = 0x1281;
-  static constexpr Tagged_t kModuleRequestMap = 0x12a9;
-  static constexpr Tagged_t kPromiseCapabilityMap = 0x12d1;
-  static constexpr Tagged_t kPromiseReactionMap = 0x12f9;
-  static constexpr Tagged_t kPropertyDescriptorObjectMap = 0x1321;
-  static constexpr Tagged_t kPrototypeInfoMap = 0x1349;
-  static constexpr Tagged_t kRegExpBoilerplateDescriptionMap = 0x1371;
-  static constexpr Tagged_t kRegExpDataWrapperMap = 0x1399;
-  static constexpr Tagged_t kScriptMap = 0x13c1;
-  static constexpr Tagged_t kScriptOrModuleMap = 0x13e9;
-  static constexpr Tagged_t kSourceTextModuleInfoEntryMap = 0x1411;
-  static constexpr Tagged_t kStackFrameInfoMap = 0x1439;
-  static constexpr Tagged_t kStackTraceInfoMap = 0x1461;
-  static constexpr Tagged_t kTemplateObjectDescriptionMap = 0x1489;
-  static constexpr Tagged_t kTuple2Map = 0x14b1;
-  static constexpr Tagged_t kWasmExceptionTagMap = 0x14d9;
-  static constexpr Tagged_t kAllocationSiteWithWeakNextMap = 0x1501;
-  static constexpr Tagged_t kAllocationSiteWithoutWeakNextMap = 0x1529;
-  static constexpr Tagged_t kLoadHandler1Map = 0x1551;
-  static constexpr Tagged_t kLoadHandler2Map = 0x1579;
-  static constexpr Tagged_t kLoadHandler3Map = 0x15a1;
-  static constexpr Tagged_t kStoreHandler0Map = 0x15c9;
-  static constexpr Tagged_t kStoreHandler1Map = 0x15f1;
-  static constexpr Tagged_t kStoreHandler2Map = 0x1619;
-  static constexpr Tagged_t kStoreHandler3Map = 0x1641;
-  static constexpr Tagged_t kFunctionTemplateInfoMap = 0x1669;
-  static constexpr Tagged_t kUncompiledDataWithoutPreparseDataMap = 0x1691;
-  static constexpr Tagged_t kUncompiledDataWithPreparseDataMap = 0x16b9;
+  static constexpr Tagged_t kScopeInfoMap = 0x78d;
+  static constexpr Tagged_t kModuleInfoMap = 0x7b5;
+  static constexpr Tagged_t kClosureFeedbackCellArrayMap = 0x7dd;
+  static constexpr Tagged_t kFeedbackVectorMap = 0x805;
+  static constexpr Tagged_t kForeignMap = 0x82d;
+  static constexpr Tagged_t kTrustedForeignMap = 0x855;
+  static constexpr Tagged_t kMegaDomHandlerMap = 0x87d;
+  static constexpr Tagged_t kFixedDoubleArrayMap = 0x8a5;
+  static constexpr Tagged_t kFeedbackMetadataArrayMap = 0x8cd;
+  static constexpr Tagged_t kByteArrayMap = 0x8f5;
+  static constexpr Tagged_t kTrustedByteArrayMap = 0x91d;
+  static constexpr Tagged_t kBytecodeArrayMap = 0x945;
+  static constexpr Tagged_t kFreeSpaceMap = 0x96d;
+  static constexpr Tagged_t kPropertyArrayMap = 0x995;
+  static constexpr Tagged_t kSmallOrderedHashMapMap = 0x9bd;
+  static constexpr Tagged_t kSmallOrderedHashSetMap = 0x9e5;
+  static constexpr Tagged_t kSmallOrderedNameDictionaryMap = 0xa0d;
+  static constexpr Tagged_t kInstructionStreamMap = 0xa35;
+  static constexpr Tagged_t kCellMap = 0xa5d;
+  static constexpr Tagged_t kInvalidPrototypeValidityCell = 0xa85;
+  static constexpr Tagged_t kGlobalPropertyCellMap = 0xa8d;
+  static constexpr Tagged_t kOnePointerFillerMap = 0xab5;
+  static constexpr Tagged_t kTwoPointerFillerMap = 0xadd;
+  static constexpr Tagged_t kNoClosuresCellMap = 0xb05;
+  static constexpr Tagged_t kOneClosureCellMap = 0xb2d;
+  static constexpr Tagged_t kManyClosuresCellMap = 0xb55;
+  static constexpr Tagged_t kTransitionArrayMap = 0xb7d;
+  static constexpr Tagged_t kHashTableMap = 0xba5;
+  static constexpr Tagged_t kOrderedNameDictionaryMap = 0xbcd;
+  static constexpr Tagged_t kNameDictionaryMap = 0xbf5;
+  static constexpr Tagged_t kSwissNameDictionaryMap = 0xc1d;
+  static constexpr Tagged_t kGlobalDictionaryMap = 0xc45;
+  static constexpr Tagged_t kNumberDictionaryMap = 0xc6d;
+  static constexpr Tagged_t kRegisteredSymbolTableMap = 0xc95;
+  static constexpr Tagged_t kArrayListMap = 0xcbd;
+  static constexpr Tagged_t kAccessorInfoMap = 0xce5;
+  static constexpr Tagged_t kInterceptorInfoMap = 0xd0d;
+  static constexpr Tagged_t kPreparseDataMap = 0xd35;
+  static constexpr Tagged_t kSharedFunctionInfoMap = 0xd5d;
+  static constexpr Tagged_t kCodeMap = 0xd85;
+  static constexpr Tagged_t kHashSeed = 0xdad;
+  static constexpr Tagged_t kprototype_string = 0xdbd;
+  static constexpr Tagged_t kname_string = 0xdd5;
+  static constexpr Tagged_t kenumerable_string = 0xde5;
+  static constexpr Tagged_t kconfigurable_string = 0xdfd;
+  static constexpr Tagged_t kvalue_string = 0xe15;
+  static constexpr Tagged_t kwritable_string = 0xe29;
+  static constexpr Tagged_t knot_mapped_symbol = 0xe3d;
+  static constexpr Tagged_t kuninitialized_symbol = 0xe4d;
+  static constexpr Tagged_t kmegamorphic_symbol = 0xe5d;
+  static constexpr Tagged_t kelements_transition_symbol = 0xe6d;
+  static constexpr Tagged_t kmega_dom_symbol = 0xe7d;
+  static constexpr Tagged_t kEmptyPropertyDictionary = 0xe8d;
+  static constexpr Tagged_t kEmptyOrderedPropertyDictionary = 0xeb9;
+  static constexpr Tagged_t kEmptyByteArray = 0xed1;
+  static constexpr Tagged_t kEmptyScopeInfo = 0xed9;
+  static constexpr Tagged_t kEmptyPropertyArray = 0xef1;
+  static constexpr Tagged_t kMinusZeroValue = 0xef9;
+  static constexpr Tagged_t kNanValue = 0xf05;
+  static constexpr Tagged_t kHoleNanValue = 0xf11;
+  static constexpr Tagged_t kInfinityValue = 0xf1d;
+  static constexpr Tagged_t kMinusInfinityValue = 0xf29;
+  static constexpr Tagged_t kMaxSafeInteger = 0xf35;
+  static constexpr Tagged_t kMaxUInt32 = 0xf41;
+  static constexpr Tagged_t kSmiMinValue = 0xf4d;
+  static constexpr Tagged_t kSmiMaxValuePlusOne = 0xf59;
+  static constexpr Tagged_t kPromiseFulfillReactionJobTaskMap = 0xf65;
+  static constexpr Tagged_t kPromiseRejectReactionJobTaskMap = 0xf8d;
+  static constexpr Tagged_t kCallableTaskMap = 0xfb5;
+  static constexpr Tagged_t kCallbackTaskMap = 0xfdd;
+  static constexpr Tagged_t kPromiseResolveThenableJobTaskMap = 0x1005;
+  static constexpr Tagged_t kAccessCheckInfoMap = 0x102d;
+  static constexpr Tagged_t kAccessorPairMap = 0x1055;
+  static constexpr Tagged_t kAliasedArgumentsEntryMap = 0x107d;
+  static constexpr Tagged_t kAllocationMementoMap = 0x10a5;
+  static constexpr Tagged_t kArrayBoilerplateDescriptionMap = 0x10cd;
+  static constexpr Tagged_t kAsmWasmDataMap = 0x10f5;
+  static constexpr Tagged_t kAsyncGeneratorRequestMap = 0x111d;
+  static constexpr Tagged_t kBreakPointMap = 0x1145;
+  static constexpr Tagged_t kBreakPointInfoMap = 0x116d;
+  static constexpr Tagged_t kBytecodeWrapperMap = 0x1195;
+  static constexpr Tagged_t kClassBoilerplateMap = 0x11bd;
+  static constexpr Tagged_t kClassPositionsMap = 0x11e5;
+  static constexpr Tagged_t kCodeWrapperMap = 0x120d;
+  static constexpr Tagged_t kDebugInfoMap = 0x1235;
+  static constexpr Tagged_t kErrorStackDataMap = 0x125d;
+  static constexpr Tagged_t kFunctionTemplateRareDataMap = 0x1285;
+  static constexpr Tagged_t kModuleRequestMap = 0x12ad;
+  static constexpr Tagged_t kPromiseCapabilityMap = 0x12d5;
+  static constexpr Tagged_t kPromiseReactionMap = 0x12fd;
+  static constexpr Tagged_t kPropertyDescriptorObjectMap = 0x1325;
+  static constexpr Tagged_t kPrototypeInfoMap = 0x134d;
+  static constexpr Tagged_t kRegExpBoilerplateDescriptionMap = 0x1375;
+  static constexpr Tagged_t kRegExpDataWrapperMap = 0x139d;
+  static constexpr Tagged_t kScriptMap = 0x13c5;
+  static constexpr Tagged_t kScriptOrModuleMap = 0x13ed;
+  static constexpr Tagged_t kSourceTextModuleInfoEntryMap = 0x1415;
+  static constexpr Tagged_t kStackFrameInfoMap = 0x143d;
+  static constexpr Tagged_t kStackTraceInfoMap = 0x1465;
+  static constexpr Tagged_t kTemplateObjectDescriptionMap = 0x148d;
+  static constexpr Tagged_t kTuple2Map = 0x14b5;
+  static constexpr Tagged_t kWasmExceptionTagMap = 0x14dd;
+  static constexpr Tagged_t kAllocationSiteWithWeakNextMap = 0x1505;
+  static constexpr Tagged_t kAllocationSiteWithoutWeakNextMap = 0x152d;
+  static constexpr Tagged_t kLoadHandler1Map = 0x1555;
+  static constexpr Tagged_t kLoadHandler2Map = 0x157d;
+  static constexpr Tagged_t kLoadHandler3Map = 0x15a5;
+  static constexpr Tagged_t kStoreHandler0Map = 0x15cd;
+  static constexpr Tagged_t kStoreHandler1Map = 0x15f5;
+  static constexpr Tagged_t kStoreHandler2Map = 0x161d;
+  static constexpr Tagged_t kStoreHandler3Map = 0x1645;
+  static constexpr Tagged_t kFunctionTemplateInfoMap = 0x166d;
+  static constexpr Tagged_t kUncompiledDataWithoutPreparseDataMap = 0x1695;
+  static constexpr Tagged_t kUncompiledDataWithPreparseDataMap = 0x16bd;
   static constexpr Tagged_t kUncompiledDataWithoutPreparseDataWithJobMap =
-      0x16e1;
-  static constexpr Tagged_t kUncompiledDataWithPreparseDataAndJobMap = 0x1709;
-  static constexpr Tagged_t kOnHeapBasicBlockProfilerDataMap = 0x1731;
-  static constexpr Tagged_t kObjectTemplateInfoMap = 0x1759;
-  static constexpr Tagged_t kTurbofanBitsetTypeMap = 0x1781;
-  static constexpr Tagged_t kTurbofanUnionTypeMap = 0x17a9;
-  static constexpr Tagged_t kTurbofanRangeTypeMap = 0x17d1;
-  static constexpr Tagged_t kTurbofanHeapConstantTypeMap = 0x17f9;
-  static constexpr Tagged_t kTurbofanOtherNumberConstantTypeMap = 0x1821;
-  static constexpr Tagged_t kTurboshaftWord32TypeMap = 0x1849;
-  static constexpr Tagged_t kTurboshaftWord32RangeTypeMap = 0x1871;
-  static constexpr Tagged_t kTurboshaftWord64TypeMap = 0x1899;
-  static constexpr Tagged_t kTurboshaftWord64RangeTypeMap = 0x18c1;
-  static constexpr Tagged_t kTurboshaftFloat64TypeMap = 0x18e9;
-  static constexpr Tagged_t kTurboshaftFloat64RangeTypeMap = 0x1911;
-  static constexpr Tagged_t kInternalClassMap = 0x1939;
-  static constexpr Tagged_t kSmiPairMap = 0x1961;
-  static constexpr Tagged_t kSmiBoxMap = 0x1989;
-  static constexpr Tagged_t kExportedSubClassBaseMap = 0x19b1;
-  static constexpr Tagged_t kExportedSubClassMap = 0x19d9;
-  static constexpr Tagged_t kAbstractInternalClassSubclass1Map = 0x1a01;
-  static constexpr Tagged_t kAbstractInternalClassSubclass2Map = 0x1a29;
-  static constexpr Tagged_t kExportedSubClass2Map = 0x1a51;
-  static constexpr Tagged_t kSortStateMap = 0x1a79;
-  static constexpr Tagged_t kWasmFastApiCallDataMap = 0x1aa1;
-  static constexpr Tagged_t kWasmStringViewIterMap = 0x1ac9;
-  static constexpr Tagged_t kSloppyArgumentsElementsMap = 0x1af1;
-  static constexpr Tagged_t kStrongDescriptorArrayMap = 0x1b19;
-  static constexpr Tagged_t kTurboshaftWord32SetTypeMap = 0x1b41;
-  static constexpr Tagged_t kTurboshaftWord64SetTypeMap = 0x1b69;
-  static constexpr Tagged_t kTurboshaftFloat64SetTypeMap = 0x1b91;
-  static constexpr Tagged_t kInternalClassWithStructElementsMap = 0x1bb9;
-  static constexpr Tagged_t kOrderedHashMapMap = 0x1be1;
-  static constexpr Tagged_t kOrderedHashSetMap = 0x1c09;
-  static constexpr Tagged_t kSimpleNumberDictionaryMap = 0x1c31;
-  static constexpr Tagged_t kNameToIndexHashTableMap = 0x1c59;
-  static constexpr Tagged_t kEmbedderDataArrayMap = 0x1c81;
-  static constexpr Tagged_t kEphemeronHashTableMap = 0x1ca9;
-  static constexpr Tagged_t kScriptContextTableMap = 0x1cd1;
-  static constexpr Tagged_t kObjectBoilerplateDescriptionMap = 0x1cf9;
-  static constexpr Tagged_t kCoverageInfoMap = 0x1d21;
-  static constexpr Tagged_t kRegExpMatchInfoMap = 0x1d49;
-  static constexpr Tagged_t kRegExpDataMap = 0x1d71;
-  static constexpr Tagged_t kAtomRegExpDataMap = 0x1d99;
-  static constexpr Tagged_t kIrRegExpDataMap = 0x1dc1;
-  static constexpr Tagged_t kSourceTextModuleMap = 0x1de9;
-  static constexpr Tagged_t kSyntheticModuleMap = 0x1e11;
-  static constexpr Tagged_t kGlobalContextSidePropertyCellMap = 0x1e39;
-  static constexpr Tagged_t kWasmImportDataMap = 0x1e61;
-  static constexpr Tagged_t kWasmCapiFunctionDataMap = 0x1e89;
-  static constexpr Tagged_t kWasmExportedFunctionDataMap = 0x1eb1;
-  static constexpr Tagged_t kWasmInternalFunctionMap = 0x1ed9;
-  static constexpr Tagged_t kWasmFuncRefMap = 0x1f01;
-  static constexpr Tagged_t kWasmJSFunctionDataMap = 0x1f29;
-  static constexpr Tagged_t kWasmResumeDataMap = 0x1f51;
-  static constexpr Tagged_t kWasmSuspenderObjectMap = 0x1f79;
-  static constexpr Tagged_t kWasmTypeInfoMap = 0x1fa1;
-  static constexpr Tagged_t kWasmContinuationObjectMap = 0x1fc9;
-  static constexpr Tagged_t kWasmNullMap = 0x1ff1;
-  static constexpr Tagged_t kWasmTrustedInstanceDataMap = 0x2019;
-  static constexpr Tagged_t kWasmDispatchTableMap = 0x2041;
-  static constexpr Tagged_t kWeakCellMap = 0x2069;
-  static constexpr Tagged_t kInterpreterDataMap = 0x2091;
-  static constexpr Tagged_t kSharedFunctionInfoWrapperMap = 0x20b9;
-  static constexpr Tagged_t kDictionaryTemplateInfoMap = 0x20e1;
-  static constexpr Tagged_t kNoOpInterceptorInfo = 0x2109;
-  static constexpr Tagged_t kEmptyArrayList = 0x2131;
-  static constexpr Tagged_t kEmptyObjectBoilerplateDescription = 0x213d;
-  static constexpr Tagged_t kEmptyArrayBoilerplateDescription = 0x214d;
-  static constexpr Tagged_t kEmptyClosureFeedbackCellArray = 0x2159;
-  static constexpr Tagged_t kEmptySwissPropertyDictionary = 0x216d;
-  static constexpr Tagged_t kadoptText_string = 0x218d;
-  static constexpr Tagged_t kapproximatelySign_string = 0x21a5;
-  static constexpr Tagged_t kbaseName_string = 0x21c5;
-  static constexpr Tagged_t kaccounting_string = 0x21d9;
-  static constexpr Tagged_t kbreakType_string = 0x21f1;
-  static constexpr Tagged_t kcalendars_string = 0x2209;
-  static constexpr Tagged_t kcardinal_string = 0x2221;
-  static constexpr Tagged_t kcaseFirst_string = 0x2235;
-  static constexpr Tagged_t kceil_string = 0x224d;
-  static constexpr Tagged_t kcompare_string = 0x225d;
-  static constexpr Tagged_t kcollation_string = 0x2271;
-  static constexpr Tagged_t kcollations_string = 0x2289;
-  static constexpr Tagged_t kcompact_string = 0x22a1;
-  static constexpr Tagged_t kcompactDisplay_string = 0x22b5;
-  static constexpr Tagged_t kcurrency_string = 0x22d1;
-  static constexpr Tagged_t kcurrencyDisplay_string = 0x22e5;
-  static constexpr Tagged_t kcurrencySign_string = 0x2301;
-  static constexpr Tagged_t kdateStyle_string = 0x2319;
-  static constexpr Tagged_t kdateTimeField_string = 0x2331;
-  static constexpr Tagged_t kdayPeriod_string = 0x234d;
-  static constexpr Tagged_t kdaysDisplay_string = 0x2365;
-  static constexpr Tagged_t kdecimal_string = 0x237d;
-  static constexpr Tagged_t kdialect_string = 0x2391;
-  static constexpr Tagged_t kdigital_string = 0x23a5;
-  static constexpr Tagged_t kdirection_string = 0x23b9;
-  static constexpr Tagged_t kendRange_string = 0x23d1;
-  static constexpr Tagged_t kengineering_string = 0x23e5;
-  static constexpr Tagged_t kexceptZero_string = 0x23fd;
-  static constexpr Tagged_t kexpand_string = 0x2415;
-  static constexpr Tagged_t kexponentInteger_string = 0x2429;
-  static constexpr Tagged_t kexponentMinusSign_string = 0x2445;
-  static constexpr Tagged_t kexponentSeparator_string = 0x2465;
-  static constexpr Tagged_t kfallback_string = 0x2485;
-  static constexpr Tagged_t kfirst_string = 0x2499;
-  static constexpr Tagged_t kfirstDay_string = 0x24ad;
-  static constexpr Tagged_t kfirstDayOfWeek_string = 0x24c1;
-  static constexpr Tagged_t kfloor_string = 0x24dd;
-  static constexpr Tagged_t kformat_string = 0x24f1;
-  static constexpr Tagged_t kfraction_string = 0x2505;
-  static constexpr Tagged_t kfractionalDigits_string = 0x2519;
-  static constexpr Tagged_t kfractionalSecond_string = 0x2535;
-  static constexpr Tagged_t kfull_string = 0x2551;
-  static constexpr Tagged_t kgranularity_string = 0x2561;
-  static constexpr Tagged_t kgrapheme_string = 0x2579;
-  static constexpr Tagged_t kgroup_string = 0x258d;
-  static constexpr Tagged_t kh11_string = 0x25a1;
-  static constexpr Tagged_t kh12_string = 0x25b1;
-  static constexpr Tagged_t kh23_string = 0x25c1;
-  static constexpr Tagged_t kh24_string = 0x25d1;
-  static constexpr Tagged_t khalfCeil_string = 0x25e1;
-  static constexpr Tagged_t khalfEven_string = 0x25f5;
-  static constexpr Tagged_t khalfExpand_string = 0x2609;
-  static constexpr Tagged_t khalfFloor_string = 0x2621;
-  static constexpr Tagged_t khalfTrunc_string = 0x2639;
-  static constexpr Tagged_t khour12_string = 0x2651;
-  static constexpr Tagged_t khourCycle_string = 0x2665;
-  static constexpr Tagged_t khourCycles_string = 0x267d;
-  static constexpr Tagged_t khoursDisplay_string = 0x2695;
-  static constexpr Tagged_t kideo_string = 0x26ad;
-  static constexpr Tagged_t kignorePunctuation_string = 0x26bd;
-  static constexpr Tagged_t kInvalid_Date_string = 0x26dd;
-  static constexpr Tagged_t kinteger_string = 0x26f5;
-  static constexpr Tagged_t kisWordLike_string = 0x2709;
-  static constexpr Tagged_t kkana_string = 0x2721;
-  static constexpr Tagged_t klanguage_string = 0x2731;
-  static constexpr Tagged_t klanguageDisplay_string = 0x2745;
-  static constexpr Tagged_t klessPrecision_string = 0x2761;
-  static constexpr Tagged_t kletter_string = 0x277d;
-  static constexpr Tagged_t klist_string = 0x2791;
-  static constexpr Tagged_t kliteral_string = 0x27a1;
-  static constexpr Tagged_t klocale_string = 0x27b5;
-  static constexpr Tagged_t kloose_string = 0x27c9;
-  static constexpr Tagged_t klower_string = 0x27dd;
-  static constexpr Tagged_t kltr_string = 0x27f1;
-  static constexpr Tagged_t kmaximumFractionDigits_string = 0x2801;
-  static constexpr Tagged_t kmaximumSignificantDigits_string = 0x2825;
-  static constexpr Tagged_t kmicrosecondsDisplay_string = 0x2849;
-  static constexpr Tagged_t kmillisecondsDisplay_string = 0x2869;
-  static constexpr Tagged_t kmin2_string = 0x2889;
-  static constexpr Tagged_t kminimalDays_string = 0x2899;
-  static constexpr Tagged_t kminimumFractionDigits_string = 0x28b1;
-  static constexpr Tagged_t kminimumIntegerDigits_string = 0x28d5;
-  static constexpr Tagged_t kminimumSignificantDigits_string = 0x28f5;
-  static constexpr Tagged_t kminus_0 = 0x2919;
-  static constexpr Tagged_t kminusSign_string = 0x2929;
-  static constexpr Tagged_t kminutesDisplay_string = 0x2941;
-  static constexpr Tagged_t kmonthsDisplay_string = 0x295d;
-  static constexpr Tagged_t kmorePrecision_string = 0x2979;
-  static constexpr Tagged_t knan_string = 0x2995;
-  static constexpr Tagged_t knanosecondsDisplay_string = 0x29a5;
-  static constexpr Tagged_t knarrowSymbol_string = 0x29c5;
-  static constexpr Tagged_t knegative_string = 0x29dd;
-  static constexpr Tagged_t knever_string = 0x29f1;
-  static constexpr Tagged_t knone_string = 0x2a05;
-  static constexpr Tagged_t knotation_string = 0x2a15;
-  static constexpr Tagged_t knormal_string = 0x2a29;
-  static constexpr Tagged_t knumberingSystem_string = 0x2a3d;
-  static constexpr Tagged_t knumberingSystems_string = 0x2a59;
-  static constexpr Tagged_t knumeric_string = 0x2a75;
-  static constexpr Tagged_t kordinal_string = 0x2a89;
-  static constexpr Tagged_t kpercentSign_string = 0x2a9d;
-  static constexpr Tagged_t kplusSign_string = 0x2ab5;
-  static constexpr Tagged_t kquarter_string = 0x2ac9;
-  static constexpr Tagged_t kregion_string = 0x2add;
-  static constexpr Tagged_t krelatedYear_string = 0x2af1;
-  static constexpr Tagged_t kroundingMode_string = 0x2b09;
-  static constexpr Tagged_t kroundingPriority_string = 0x2b21;
-  static constexpr Tagged_t krtl_string = 0x2b3d;
-  static constexpr Tagged_t kscientific_string = 0x2b4d;
-  static constexpr Tagged_t ksecondsDisplay_string = 0x2b65;
-  static constexpr Tagged_t ksegment_string = 0x2b81;
-  static constexpr Tagged_t kSegmentIterator_string = 0x2b95;
-  static constexpr Tagged_t kSegments_string = 0x2bb1;
-  static constexpr Tagged_t ksensitivity_string = 0x2bc5;
-  static constexpr Tagged_t ksep_string = 0x2bdd;
-  static constexpr Tagged_t kshared_string = 0x2bed;
-  static constexpr Tagged_t ksignDisplay_string = 0x2c01;
-  static constexpr Tagged_t kstandard_string = 0x2c19;
-  static constexpr Tagged_t kstartRange_string = 0x2c2d;
-  static constexpr Tagged_t kstrict_string = 0x2c45;
-  static constexpr Tagged_t kstripIfInteger_string = 0x2c59;
-  static constexpr Tagged_t kstyle_string = 0x2c75;
-  static constexpr Tagged_t kterm_string = 0x2c89;
-  static constexpr Tagged_t ktextInfo_string = 0x2c99;
-  static constexpr Tagged_t ktimeStyle_string = 0x2cad;
-  static constexpr Tagged_t ktimeZones_string = 0x2cc5;
-  static constexpr Tagged_t ktimeZoneName_string = 0x2cdd;
-  static constexpr Tagged_t ktrailingZeroDisplay_string = 0x2cf5;
-  static constexpr Tagged_t ktrunc_string = 0x2d15;
-  static constexpr Tagged_t ktwo_digit_string = 0x2d29;
-  static constexpr Tagged_t ktype_string = 0x2d3d;
-  static constexpr Tagged_t kunknown_string = 0x2d4d;
-  static constexpr Tagged_t kupper_string = 0x2d61;
-  static constexpr Tagged_t kusage_string = 0x2d75;
-  static constexpr Tagged_t kuseGrouping_string = 0x2d89;
-  static constexpr Tagged_t kunitDisplay_string = 0x2da1;
-  static constexpr Tagged_t kweekday_string = 0x2db9;
-  static constexpr Tagged_t kweekend_string = 0x2dcd;
-  static constexpr Tagged_t kweeksDisplay_string = 0x2de1;
-  static constexpr Tagged_t kweekInfo_string = 0x2df9;
-  static constexpr Tagged_t kyearName_string = 0x2e0d;
-  static constexpr Tagged_t kyearsDisplay_string = 0x2e21;
-  static constexpr Tagged_t kascii_nul_string = 0x2e39;
-  static constexpr Tagged_t kascii_soh_string = 0x2e49;
-  static constexpr Tagged_t kascii_stx_string = 0x2e59;
-  static constexpr Tagged_t kascii_etx_string = 0x2e69;
-  static constexpr Tagged_t kascii_eot_string = 0x2e79;
-  static constexpr Tagged_t kascii_enq_string = 0x2e89;
-  static constexpr Tagged_t kascii_ack_string = 0x2e99;
-  static constexpr Tagged_t kascii_bel_string = 0x2ea9;
-  static constexpr Tagged_t kascii_bs_string = 0x2eb9;
-  static constexpr Tagged_t kascii_ht_string = 0x2ec9;
-  static constexpr Tagged_t kascii_lf_string = 0x2ed9;
-  static constexpr Tagged_t kascii_vt_string = 0x2ee9;
-  static constexpr Tagged_t kascii_ff_string = 0x2ef9;
-  static constexpr Tagged_t kascii_cr_string = 0x2f09;
-  static constexpr Tagged_t kascii_so_string = 0x2f19;
-  static constexpr Tagged_t kascii_si_string = 0x2f29;
-  static constexpr Tagged_t kascii_dle_string = 0x2f39;
-  static constexpr Tagged_t kascii_dc1_string = 0x2f49;
-  static constexpr Tagged_t kascii_dc2_string = 0x2f59;
-  static constexpr Tagged_t kascii_dc3_string = 0x2f69;
-  static constexpr Tagged_t kascii_dc4_string = 0x2f79;
-  static constexpr Tagged_t kascii_nak_string = 0x2f89;
-  static constexpr Tagged_t kascii_syn_string = 0x2f99;
-  static constexpr Tagged_t kascii_etb_string = 0x2fa9;
-  static constexpr Tagged_t kascii_can_string = 0x2fb9;
-  static constexpr Tagged_t kascii_em_string = 0x2fc9;
-  static constexpr Tagged_t kascii_sub_string = 0x2fd9;
-  static constexpr Tagged_t kascii_esc_string = 0x2fe9;
-  static constexpr Tagged_t kascii_fs_string = 0x2ff9;
-  static constexpr Tagged_t kascii_gs_string = 0x3009;
-  static constexpr Tagged_t kascii_rs_string = 0x3019;
-  static constexpr Tagged_t kascii_us_string = 0x3029;
-  static constexpr Tagged_t kspace_string = 0x3039;
-  static constexpr Tagged_t kexclamation_mark_string = 0x3049;
-  static constexpr Tagged_t kdouble_quotes_string = 0x3059;
-  static constexpr Tagged_t khash_string = 0x3069;
-  static constexpr Tagged_t kdollar_string = 0x3079;
-  static constexpr Tagged_t kpercent_sign_string = 0x3089;
-  static constexpr Tagged_t kampersand_string = 0x3099;
-  static constexpr Tagged_t ksingle_quote_string = 0x30a9;
-  static constexpr Tagged_t kopen_parenthesis_string = 0x30b9;
-  static constexpr Tagged_t kclose_parenthesis_string = 0x30c9;
-  static constexpr Tagged_t kasterisk_string = 0x30d9;
-  static constexpr Tagged_t kplus_string = 0x30e9;
-  static constexpr Tagged_t kcomma_string = 0x30f9;
-  static constexpr Tagged_t kminus_string = 0x3109;
-  static constexpr Tagged_t kdot_string = 0x3119;
-  static constexpr Tagged_t kslash_string = 0x3129;
-  static constexpr Tagged_t kzero_string = 0x3139;
-  static constexpr Tagged_t kone_string = 0x3149;
-  static constexpr Tagged_t ktwo_string = 0x3159;
-  static constexpr Tagged_t kthree_string = 0x3169;
-  static constexpr Tagged_t kfour_string = 0x3179;
-  static constexpr Tagged_t kfive_string = 0x3189;
-  static constexpr Tagged_t ksix_string = 0x3199;
-  static constexpr Tagged_t kseven_string = 0x31a9;
-  static constexpr Tagged_t keight_string = 0x31b9;
-  static constexpr Tagged_t knine_string = 0x31c9;
-  static constexpr Tagged_t kcolon_string = 0x31d9;
-  static constexpr Tagged_t ksemicolon_string = 0x31e9;
-  static constexpr Tagged_t kless_than_string = 0x31f9;
-  static constexpr Tagged_t kequals_string = 0x3209;
-  static constexpr Tagged_t kgreater_than_string = 0x3219;
-  static constexpr Tagged_t kquestion_mark_string = 0x3229;
-  static constexpr Tagged_t kat_sign_string = 0x3239;
-  static constexpr Tagged_t kA_string = 0x3249;
-  static constexpr Tagged_t kB_string = 0x3259;
-  static constexpr Tagged_t kC_string = 0x3269;
-  static constexpr Tagged_t kD_string = 0x3279;
-  static constexpr Tagged_t kE_string = 0x3289;
-  static constexpr Tagged_t kF_string = 0x3299;
-  static constexpr Tagged_t kG_string = 0x32a9;
-  static constexpr Tagged_t kH_string = 0x32b9;
-  static constexpr Tagged_t kI_string = 0x32c9;
-  static constexpr Tagged_t kJ_string = 0x32d9;
-  static constexpr Tagged_t kK_string = 0x32e9;
-  static constexpr Tagged_t kL_string = 0x32f9;
-  static constexpr Tagged_t kM_string = 0x3309;
-  static constexpr Tagged_t kN_string = 0x3319;
-  static constexpr Tagged_t kO_string = 0x3329;
-  static constexpr Tagged_t kP_string = 0x3339;
-  static constexpr Tagged_t kQ_string = 0x3349;
-  static constexpr Tagged_t kR_string = 0x3359;
-  static constexpr Tagged_t kS_string = 0x3369;
-  static constexpr Tagged_t kT_string = 0x3379;
-  static constexpr Tagged_t kU_string = 0x3389;
-  static constexpr Tagged_t kV_string = 0x3399;
-  static constexpr Tagged_t kW_string = 0x33a9;
-  static constexpr Tagged_t kX_string = 0x33b9;
-  static constexpr Tagged_t kY_string = 0x33c9;
-  static constexpr Tagged_t kZ_string = 0x33d9;
-  static constexpr Tagged_t kopen_bracket_string = 0x33e9;
-  static constexpr Tagged_t kbackslash_string = 0x33f9;
-  static constexpr Tagged_t kclose_bracket_string = 0x3409;
-  static constexpr Tagged_t kcaret_string = 0x3419;
-  static constexpr Tagged_t kunderscore_string = 0x3429;
-  static constexpr Tagged_t kbacktick_string = 0x3439;
-  static constexpr Tagged_t ka_string = 0x3449;
-  static constexpr Tagged_t kb_string = 0x3459;
-  static constexpr Tagged_t kc_string = 0x3469;
-  static constexpr Tagged_t kd_string = 0x3479;
-  static constexpr Tagged_t ke_string = 0x3489;
-  static constexpr Tagged_t kf_string = 0x3499;
-  static constexpr Tagged_t kg_string = 0x34a9;
-  static constexpr Tagged_t kh_string = 0x34b9;
-  static constexpr Tagged_t ki_string = 0x34c9;
-  static constexpr Tagged_t kj_string = 0x34d9;
-  static constexpr Tagged_t kk_string = 0x34e9;
-  static constexpr Tagged_t kl_string = 0x34f9;
-  static constexpr Tagged_t km_string = 0x3509;
-  static constexpr Tagged_t kn_string = 0x3519;
-  static constexpr Tagged_t ko_string = 0x3529;
-  static constexpr Tagged_t kp_string = 0x3539;
-  static constexpr Tagged_t kq_string = 0x3549;
-  static constexpr Tagged_t kr_string = 0x3559;
-  static constexpr Tagged_t ks_string = 0x3569;
-  static constexpr Tagged_t kt_string = 0x3579;
-  static constexpr Tagged_t ku_string = 0x3589;
-  static constexpr Tagged_t kv_string = 0x3599;
-  static constexpr Tagged_t kw_string = 0x35a9;
-  static constexpr Tagged_t kx_string = 0x35b9;
-  static constexpr Tagged_t ky_string = 0x35c9;
-  static constexpr Tagged_t kz_string = 0x35d9;
-  static constexpr Tagged_t kopen_brace_string = 0x35e9;
-  static constexpr Tagged_t kpipe_string = 0x35f9;
-  static constexpr Tagged_t kclose_brace_string = 0x3609;
-  static constexpr Tagged_t ktilde_string = 0x3619;
-  static constexpr Tagged_t kascii_del_string = 0x3629;
-  static constexpr Tagged_t klatin1_80_string = 0x3639;
-  static constexpr Tagged_t klatin1_81_string = 0x3649;
-  static constexpr Tagged_t klatin1_82_string = 0x3659;
-  static constexpr Tagged_t klatin1_83_string = 0x3669;
-  static constexpr Tagged_t klatin1_84_string = 0x3679;
-  static constexpr Tagged_t klatin1_85_string = 0x3689;
-  static constexpr Tagged_t klatin1_86_string = 0x3699;
-  static constexpr Tagged_t klatin1_87_string = 0x36a9;
-  static constexpr Tagged_t klatin1_88_string = 0x36b9;
-  static constexpr Tagged_t klatin1_89_string = 0x36c9;
-  static constexpr Tagged_t klatin1_8a_string = 0x36d9;
-  static constexpr Tagged_t klatin1_8b_string = 0x36e9;
-  static constexpr Tagged_t klatin1_8c_string = 0x36f9;
-  static constexpr Tagged_t klatin1_8d_string = 0x3709;
-  static constexpr Tagged_t klatin1_8e_string = 0x3719;
-  static constexpr Tagged_t klatin1_8f_string = 0x3729;
-  static constexpr Tagged_t klatin1_90_string = 0x3739;
-  static constexpr Tagged_t klatin1_91_string = 0x3749;
-  static constexpr Tagged_t klatin1_92_string = 0x3759;
-  static constexpr Tagged_t klatin1_93_string = 0x3769;
-  static constexpr Tagged_t klatin1_94_string = 0x3779;
-  static constexpr Tagged_t klatin1_95_string = 0x3789;
-  static constexpr Tagged_t klatin1_96_string = 0x3799;
-  static constexpr Tagged_t klatin1_97_string = 0x37a9;
-  static constexpr Tagged_t klatin1_98_string = 0x37b9;
-  static constexpr Tagged_t klatin1_99_string = 0x37c9;
-  static constexpr Tagged_t klatin1_9a_string = 0x37d9;
-  static constexpr Tagged_t klatin1_9b_string = 0x37e9;
-  static constexpr Tagged_t klatin1_9c_string = 0x37f9;
-  static constexpr Tagged_t klatin1_9d_string = 0x3809;
-  static constexpr Tagged_t klatin1_9e_string = 0x3819;
-  static constexpr Tagged_t klatin1_9f_string = 0x3829;
-  static constexpr Tagged_t klatin1_a0_string = 0x3839;
-  static constexpr Tagged_t klatin1_a1_string = 0x3849;
-  static constexpr Tagged_t klatin1_a2_string = 0x3859;
-  static constexpr Tagged_t klatin1_a3_string = 0x3869;
-  static constexpr Tagged_t klatin1_a4_string = 0x3879;
-  static constexpr Tagged_t klatin1_a5_string = 0x3889;
-  static constexpr Tagged_t klatin1_a6_string = 0x3899;
-  static constexpr Tagged_t klatin1_a7_string = 0x38a9;
-  static constexpr Tagged_t klatin1_a8_string = 0x38b9;
-  static constexpr Tagged_t klatin1_a9_string = 0x38c9;
-  static constexpr Tagged_t klatin1_aa_string = 0x38d9;
-  static constexpr Tagged_t klatin1_ab_string = 0x38e9;
-  static constexpr Tagged_t klatin1_ac_string = 0x38f9;
-  static constexpr Tagged_t klatin1_ad_string = 0x3909;
-  static constexpr Tagged_t klatin1_ae_string = 0x3919;
-  static constexpr Tagged_t klatin1_af_string = 0x3929;
-  static constexpr Tagged_t klatin1_b0_string = 0x3939;
-  static constexpr Tagged_t klatin1_b1_string = 0x3949;
-  static constexpr Tagged_t klatin1_b2_string = 0x3959;
-  static constexpr Tagged_t klatin1_b3_string = 0x3969;
-  static constexpr Tagged_t klatin1_b4_string = 0x3979;
-  static constexpr Tagged_t klatin1_b5_string = 0x3989;
-  static constexpr Tagged_t klatin1_b6_string = 0x3999;
-  static constexpr Tagged_t klatin1_b7_string = 0x39a9;
-  static constexpr Tagged_t klatin1_b8_string = 0x39b9;
-  static constexpr Tagged_t klatin1_b9_string = 0x39c9;
-  static constexpr Tagged_t klatin1_ba_string = 0x39d9;
-  static constexpr Tagged_t klatin1_bb_string = 0x39e9;
-  static constexpr Tagged_t klatin1_bc_string = 0x39f9;
-  static constexpr Tagged_t klatin1_bd_string = 0x3a09;
-  static constexpr Tagged_t klatin1_be_string = 0x3a19;
-  static constexpr Tagged_t klatin1_bf_string = 0x3a29;
-  static constexpr Tagged_t klatin1_c0_string = 0x3a39;
-  static constexpr Tagged_t klatin1_c1_string = 0x3a49;
-  static constexpr Tagged_t klatin1_c2_string = 0x3a59;
-  static constexpr Tagged_t klatin1_c3_string = 0x3a69;
-  static constexpr Tagged_t klatin1_c4_string = 0x3a79;
-  static constexpr Tagged_t klatin1_c5_string = 0x3a89;
-  static constexpr Tagged_t klatin1_c6_string = 0x3a99;
-  static constexpr Tagged_t klatin1_c7_string = 0x3aa9;
-  static constexpr Tagged_t klatin1_c8_string = 0x3ab9;
-  static constexpr Tagged_t klatin1_c9_string = 0x3ac9;
-  static constexpr Tagged_t klatin1_ca_string = 0x3ad9;
-  static constexpr Tagged_t klatin1_cb_string = 0x3ae9;
-  static constexpr Tagged_t klatin1_cc_string = 0x3af9;
-  static constexpr Tagged_t klatin1_cd_string = 0x3b09;
-  static constexpr Tagged_t klatin1_ce_string = 0x3b19;
-  static constexpr Tagged_t klatin1_cf_string = 0x3b29;
-  static constexpr Tagged_t klatin1_d0_string = 0x3b39;
-  static constexpr Tagged_t klatin1_d1_string = 0x3b49;
-  static constexpr Tagged_t klatin1_d2_string = 0x3b59;
-  static constexpr Tagged_t klatin1_d3_string = 0x3b69;
-  static constexpr Tagged_t klatin1_d4_string = 0x3b79;
-  static constexpr Tagged_t klatin1_d5_string = 0x3b89;
-  static constexpr Tagged_t klatin1_d6_string = 0x3b99;
-  static constexpr Tagged_t klatin1_d7_string = 0x3ba9;
-  static constexpr Tagged_t klatin1_d8_string = 0x3bb9;
-  static constexpr Tagged_t klatin1_d9_string = 0x3bc9;
-  static constexpr Tagged_t klatin1_da_string = 0x3bd9;
-  static constexpr Tagged_t klatin1_db_string = 0x3be9;
-  static constexpr Tagged_t klatin1_dc_string = 0x3bf9;
-  static constexpr Tagged_t klatin1_dd_string = 0x3c09;
-  static constexpr Tagged_t klatin1_de_string = 0x3c19;
-  static constexpr Tagged_t klatin1_df_string = 0x3c29;
-  static constexpr Tagged_t klatin1_e0_string = 0x3c39;
-  static constexpr Tagged_t klatin1_e1_string = 0x3c49;
-  static constexpr Tagged_t klatin1_e2_string = 0x3c59;
-  static constexpr Tagged_t klatin1_e3_string = 0x3c69;
-  static constexpr Tagged_t klatin1_e4_string = 0x3c79;
-  static constexpr Tagged_t klatin1_e5_string = 0x3c89;
-  static constexpr Tagged_t klatin1_e6_string = 0x3c99;
-  static constexpr Tagged_t klatin1_e7_string = 0x3ca9;
-  static constexpr Tagged_t klatin1_e8_string = 0x3cb9;
-  static constexpr Tagged_t klatin1_e9_string = 0x3cc9;
-  static constexpr Tagged_t klatin1_ea_string = 0x3cd9;
-  static constexpr Tagged_t klatin1_eb_string = 0x3ce9;
-  static constexpr Tagged_t klatin1_ec_string = 0x3cf9;
-  static constexpr Tagged_t klatin1_ed_string = 0x3d09;
-  static constexpr Tagged_t klatin1_ee_string = 0x3d19;
-  static constexpr Tagged_t klatin1_ef_string = 0x3d29;
-  static constexpr Tagged_t klatin1_f0_string = 0x3d39;
-  static constexpr Tagged_t klatin1_f1_string = 0x3d49;
-  static constexpr Tagged_t klatin1_f2_string = 0x3d59;
-  static constexpr Tagged_t klatin1_f3_string = 0x3d69;
-  static constexpr Tagged_t klatin1_f4_string = 0x3d79;
-  static constexpr Tagged_t klatin1_f5_string = 0x3d89;
-  static constexpr Tagged_t klatin1_f6_string = 0x3d99;
-  static constexpr Tagged_t klatin1_f7_string = 0x3da9;
-  static constexpr Tagged_t klatin1_f8_string = 0x3db9;
-  static constexpr Tagged_t klatin1_f9_string = 0x3dc9;
-  static constexpr Tagged_t klatin1_fa_string = 0x3dd9;
-  static constexpr Tagged_t klatin1_fb_string = 0x3de9;
-  static constexpr Tagged_t klatin1_fc_string = 0x3df9;
-  static constexpr Tagged_t klatin1_fd_string = 0x3e09;
-  static constexpr Tagged_t klatin1_fe_string = 0x3e19;
-  static constexpr Tagged_t klatin1_ff_string = 0x3e29;
-  static constexpr Tagged_t kadd_string = 0x3e39;
-  static constexpr Tagged_t kAggregateError_string = 0x3e49;
-  static constexpr Tagged_t kalphabet_string = 0x3e65;
-  static constexpr Tagged_t kalways_string = 0x3e79;
-  static constexpr Tagged_t kanonymous_string = 0x3e8d;
-  static constexpr Tagged_t kapply_string = 0x3ea5;
-  static constexpr Tagged_t kArguments_string = 0x3eb9;
-  static constexpr Tagged_t karguments_string = 0x3ed1;
-  static constexpr Tagged_t karguments_to_string = 0x3ee9;
-  static constexpr Tagged_t kArray_string = 0x3f09;
-  static constexpr Tagged_t karray_to_string = 0x3f1d;
-  static constexpr Tagged_t kArrayBuffer_string = 0x3f39;
-  static constexpr Tagged_t kArrayIterator_string = 0x3f51;
-  static constexpr Tagged_t kas_string = 0x3f6d;
-  static constexpr Tagged_t kassert_string = 0x3f7d;
-  static constexpr Tagged_t kasync_string = 0x3f91;
-  static constexpr Tagged_t kAtomicsCondition_string = 0x3fa5;
-  static constexpr Tagged_t kAtomicsMutex_string = 0x3fc5;
-  static constexpr Tagged_t kauto_string = 0x3fe1;
-  static constexpr Tagged_t kBigInt_string = 0x3ff1;
-  static constexpr Tagged_t kbigint_string = 0x4005;
-  static constexpr Tagged_t kBigInt64Array_string = 0x4019;
-  static constexpr Tagged_t kBigUint64Array_string = 0x4035;
-  static constexpr Tagged_t kbind_string = 0x4051;
-  static constexpr Tagged_t kblank_string = 0x4061;
-  static constexpr Tagged_t kBoolean_string = 0x4075;
-  static constexpr Tagged_t kboolean_string = 0x4089;
-  static constexpr Tagged_t kboolean_to_string = 0x409d;
-  static constexpr Tagged_t kbound__string = 0x40b9;
-  static constexpr Tagged_t kbuffer_string = 0x40cd;
-  static constexpr Tagged_t kbyte_length_string = 0x40e1;
-  static constexpr Tagged_t kbyte_offset_string = 0x40f9;
-  static constexpr Tagged_t kCompileError_string = 0x4111;
-  static constexpr Tagged_t kcalendar_string = 0x4129;
-  static constexpr Tagged_t kcallee_string = 0x413d;
-  static constexpr Tagged_t kcaller_string = 0x4151;
-  static constexpr Tagged_t kcause_string = 0x4165;
-  static constexpr Tagged_t kcharacter_string = 0x4179;
-  static constexpr Tagged_t kcode_string = 0x4191;
-  static constexpr Tagged_t kcolumn_string = 0x41a1;
-  static constexpr Tagged_t kcomputed_string = 0x41b5;
-  static constexpr Tagged_t kconjunction_string = 0x41cd;
-  static constexpr Tagged_t kconsole_string = 0x41e5;
-  static constexpr Tagged_t kconstrain_string = 0x41f9;
-  static constexpr Tagged_t kconstruct_string = 0x4211;
-  static constexpr Tagged_t kcurrent_string = 0x4229;
-  static constexpr Tagged_t kDate_string = 0x423d;
-  static constexpr Tagged_t kdate_to_string = 0x424d;
-  static constexpr Tagged_t kdateAdd_string = 0x4269;
-  static constexpr Tagged_t kdateFromFields_string = 0x427d;
-  static constexpr Tagged_t kdateUntil_string = 0x4299;
-  static constexpr Tagged_t kday_string = 0x42b1;
-  static constexpr Tagged_t kdayOfWeek_string = 0x42c1;
-  static constexpr Tagged_t kdayOfYear_string = 0x42d9;
-  static constexpr Tagged_t kdays_string = 0x42f1;
-  static constexpr Tagged_t kdaysInMonth_string = 0x4301;
-  static constexpr Tagged_t kdaysInWeek_string = 0x4319;
-  static constexpr Tagged_t kdaysInYear_string = 0x4331;
-  static constexpr Tagged_t kdefault_string = 0x4349;
-  static constexpr Tagged_t kdefineProperty_string = 0x435d;
-  static constexpr Tagged_t kdeleteProperty_string = 0x4379;
-  static constexpr Tagged_t kdetached_string = 0x4395;
-  static constexpr Tagged_t kdisjunction_string = 0x43a9;
-  static constexpr Tagged_t kdisposed_string = 0x43c1;
-  static constexpr Tagged_t kdone_string = 0x43d5;
-  static constexpr Tagged_t kdot_brand_string = 0x43e5;
-  static constexpr Tagged_t kdot_catch_string = 0x43f9;
-  static constexpr Tagged_t kdot_default_string = 0x440d;
-  static constexpr Tagged_t kdot_for_string = 0x4421;
-  static constexpr Tagged_t kdot_generator_object_string = 0x4431;
-  static constexpr Tagged_t kdot_home_object_string = 0x4451;
-  static constexpr Tagged_t kdot_new_target_string = 0x4469;
-  static constexpr Tagged_t knew_target_string = 0x4469;
-  static constexpr Tagged_t kdot_result_string = 0x4481;
-  static constexpr Tagged_t kdot_repl_result_string = 0x4495;
-  static constexpr Tagged_t kdot_static_home_object_string = 0x44ad;
-  static constexpr Tagged_t kdot_switch_tag_string = 0x44cd;
-  static constexpr Tagged_t kdotAll_string = 0x44e5;
-  static constexpr Tagged_t kError_string = 0x44f9;
-  static constexpr Tagged_t kEvalError_string = 0x450d;
-  static constexpr Tagged_t kelement_string = 0x4525;
-  static constexpr Tagged_t kepochMicroseconds_string = 0x4539;
-  static constexpr Tagged_t kepochMilliseconds_string = 0x4559;
-  static constexpr Tagged_t kepochNanoseconds_string = 0x4579;
-  static constexpr Tagged_t kepochSeconds_string = 0x4595;
-  static constexpr Tagged_t kera_string = 0x45ad;
-  static constexpr Tagged_t keraYear_string = 0x45bd;
-  static constexpr Tagged_t kerror_string = 0x45d1;
-  static constexpr Tagged_t kerrors_string = 0x45e5;
-  static constexpr Tagged_t kerror_to_string = 0x45f9;
-  static constexpr Tagged_t keval_string = 0x4615;
-  static constexpr Tagged_t kexception_string = 0x4625;
-  static constexpr Tagged_t kexec_string = 0x463d;
-  static constexpr Tagged_t kfalse_string = 0x464d;
-  static constexpr Tagged_t kfields_string = 0x4661;
-  static constexpr Tagged_t kFinalizationRegistry_string = 0x4675;
-  static constexpr Tagged_t kflags_string = 0x4695;
-  static constexpr Tagged_t kFloat16Array_string = 0x46a9;
-  static constexpr Tagged_t kFloat32Array_string = 0x46c1;
-  static constexpr Tagged_t kFloat64Array_string = 0x46d9;
-  static constexpr Tagged_t kfractionalSecondDigits_string = 0x46f1;
-  static constexpr Tagged_t kfrom_string = 0x4715;
-  static constexpr Tagged_t kFunction_string = 0x4725;
-  static constexpr Tagged_t kfunction_native_code_string = 0x4739;
-  static constexpr Tagged_t kfunction_string = 0x4765;
-  static constexpr Tagged_t kfunction_to_string = 0x4779;
-  static constexpr Tagged_t kGenerator_string = 0x4799;
-  static constexpr Tagged_t kget_space_string = 0x47b1;
-  static constexpr Tagged_t kget_string = 0x47c1;
-  static constexpr Tagged_t kgetOffsetNanosecondsFor_string = 0x47d1;
-  static constexpr Tagged_t kgetOwnPropertyDescriptor_string = 0x47f5;
-  static constexpr Tagged_t kgetPossibleInstantsFor_string = 0x4819;
-  static constexpr Tagged_t kgetPrototypeOf_string = 0x483d;
-  static constexpr Tagged_t kglobal_string = 0x4859;
-  static constexpr Tagged_t kglobalThis_string = 0x486d;
-  static constexpr Tagged_t kgroups_string = 0x4885;
-  static constexpr Tagged_t kgrowable_string = 0x4899;
-  static constexpr Tagged_t khas_string = 0x48ad;
-  static constexpr Tagged_t khasIndices_string = 0x48bd;
-  static constexpr Tagged_t khour_string = 0x48d5;
-  static constexpr Tagged_t khours_string = 0x48e5;
-  static constexpr Tagged_t khoursInDay_string = 0x48f9;
-  static constexpr Tagged_t kignoreCase_string = 0x4911;
-  static constexpr Tagged_t kid_string = 0x4929;
-  static constexpr Tagged_t killegal_access_string = 0x4939;
-  static constexpr Tagged_t killegal_argument_string = 0x4955;
-  static constexpr Tagged_t kinLeapYear_string = 0x4971;
-  static constexpr Tagged_t kindex_string = 0x4989;
-  static constexpr Tagged_t kindices_string = 0x499d;
-  static constexpr Tagged_t kInfinity_string = 0x49b1;
-  static constexpr Tagged_t kinfinity_string = 0x49c5;
-  static constexpr Tagged_t kinput_string = 0x49d9;
-  static constexpr Tagged_t kinstance_members_initializer_string = 0x49ed;
-  static constexpr Tagged_t kInt16Array_string = 0x4a19;
-  static constexpr Tagged_t kInt32Array_string = 0x4a31;
-  static constexpr Tagged_t kInt8Array_string = 0x4a49;
-  static constexpr Tagged_t kisExtensible_string = 0x4a61;
-  static constexpr Tagged_t kiso8601_string = 0x4a79;
-  static constexpr Tagged_t kisoDay_string = 0x4a8d;
-  static constexpr Tagged_t kisoHour_string = 0x4aa1;
-  static constexpr Tagged_t kisoMicrosecond_string = 0x4ab5;
-  static constexpr Tagged_t kisoMillisecond_string = 0x4ad1;
-  static constexpr Tagged_t kisoMinute_string = 0x4aed;
-  static constexpr Tagged_t kisoMonth_string = 0x4b05;
-  static constexpr Tagged_t kisoNanosecond_string = 0x4b19;
-  static constexpr Tagged_t kisoSecond_string = 0x4b35;
-  static constexpr Tagged_t kisoYear_string = 0x4b4d;
-  static constexpr Tagged_t kIterator_string = 0x4b61;
-  static constexpr Tagged_t kjsMemoryEstimate_string = 0x4b75;
-  static constexpr Tagged_t kjsMemoryRange_string = 0x4b91;
-  static constexpr Tagged_t kkeys_string = 0x4bad;
-  static constexpr Tagged_t klargestUnit_string = 0x4bbd;
-  static constexpr Tagged_t klast_chunk_handling_string = 0x4bd5;
-  static constexpr Tagged_t klastIndex_string = 0x4bf5;
-  static constexpr Tagged_t klet_string = 0x4c0d;
-  static constexpr Tagged_t kline_string = 0x4c1d;
-  static constexpr Tagged_t klinear_string = 0x4c2d;
-  static constexpr Tagged_t kLinkError_string = 0x4c41;
-  static constexpr Tagged_t klong_string = 0x4c59;
-  static constexpr Tagged_t kMap_string = 0x4c69;
-  static constexpr Tagged_t kMapIterator_string = 0x4c79;
-  static constexpr Tagged_t kmax_byte_length_string = 0x4c91;
-  static constexpr Tagged_t kmedium_string = 0x4cad;
-  static constexpr Tagged_t kmergeFields_string = 0x4cc1;
-  static constexpr Tagged_t kmessage_string = 0x4cd9;
-  static constexpr Tagged_t kmeta_string = 0x4ced;
-  static constexpr Tagged_t kminus_Infinity_string = 0x4cfd;
-  static constexpr Tagged_t kmicrosecond_string = 0x4d15;
-  static constexpr Tagged_t kmicroseconds_string = 0x4d2d;
-  static constexpr Tagged_t kmillisecond_string = 0x4d45;
-  static constexpr Tagged_t kmilliseconds_string = 0x4d5d;
-  static constexpr Tagged_t kminute_string = 0x4d75;
-  static constexpr Tagged_t kminutes_string = 0x4d89;
-  static constexpr Tagged_t kModule_string = 0x4d9d;
-  static constexpr Tagged_t kmonth_string = 0x4db1;
-  static constexpr Tagged_t kmonthDayFromFields_string = 0x4dc5;
-  static constexpr Tagged_t kmonths_string = 0x4de5;
-  static constexpr Tagged_t kmonthsInYear_string = 0x4df9;
-  static constexpr Tagged_t kmonthCode_string = 0x4e11;
-  static constexpr Tagged_t kmultiline_string = 0x4e29;
-  static constexpr Tagged_t kNaN_string = 0x4e41;
-  static constexpr Tagged_t knanosecond_string = 0x4e51;
-  static constexpr Tagged_t knanoseconds_string = 0x4e69;
-  static constexpr Tagged_t knarrow_string = 0x4e81;
-  static constexpr Tagged_t knative_string = 0x4e95;
-  static constexpr Tagged_t kNFC_string = 0x4ea9;
-  static constexpr Tagged_t kNFD_string = 0x4eb9;
-  static constexpr Tagged_t kNFKC_string = 0x4ec9;
-  static constexpr Tagged_t kNFKD_string = 0x4ed9;
-  static constexpr Tagged_t knot_equal_string = 0x4ee9;
-  static constexpr Tagged_t knull_string = 0x4f01;
-  static constexpr Tagged_t knull_to_string = 0x4f11;
-  static constexpr Tagged_t kNumber_string = 0x4f2d;
-  static constexpr Tagged_t knumber_string = 0x4f41;
-  static constexpr Tagged_t knumber_to_string = 0x4f55;
-  static constexpr Tagged_t kObject_string = 0x4f71;
-  static constexpr Tagged_t kobject_string = 0x4f85;
-  static constexpr Tagged_t kobject_to_string = 0x4f99;
-  static constexpr Tagged_t kObject_prototype_string = 0x4fb5;
-  static constexpr Tagged_t koffset_string = 0x4fd1;
-  static constexpr Tagged_t koffsetNanoseconds_string = 0x4fe5;
-  static constexpr Tagged_t kok_string = 0x5005;
-  static constexpr Tagged_t kother_string = 0x5015;
-  static constexpr Tagged_t koverflow_string = 0x5029;
-  static constexpr Tagged_t kownKeys_string = 0x503d;
-  static constexpr Tagged_t kpercent_string = 0x5051;
-  static constexpr Tagged_t kplainDate_string = 0x5065;
-  static constexpr Tagged_t kplainTime_string = 0x507d;
-  static constexpr Tagged_t kposition_string = 0x5095;
-  static constexpr Tagged_t kpreventExtensions_string = 0x50a9;
-  static constexpr Tagged_t kprivate_constructor_string = 0x50c9;
-  static constexpr Tagged_t kPromise_string = 0x50e1;
-  static constexpr Tagged_t kpromise_string = 0x50f5;
-  static constexpr Tagged_t kproto_string = 0x5109;
-  static constexpr Tagged_t kproxy_string = 0x5121;
-  static constexpr Tagged_t kProxy_string = 0x5135;
-  static constexpr Tagged_t kquery_colon_string = 0x5149;
-  static constexpr Tagged_t kRangeError_string = 0x5159;
-  static constexpr Tagged_t kraw_json_string = 0x5171;
-  static constexpr Tagged_t kraw_string = 0x5185;
-  static constexpr Tagged_t kReferenceError_string = 0x5195;
-  static constexpr Tagged_t kReflectGet_string = 0x51b1;
-  static constexpr Tagged_t kReflectHas_string = 0x51c9;
-  static constexpr Tagged_t kRegExp_string = 0x51e1;
-  static constexpr Tagged_t kregexp_to_string = 0x51f5;
-  static constexpr Tagged_t kreject_string = 0x5211;
-  static constexpr Tagged_t krelativeTo_string = 0x5225;
-  static constexpr Tagged_t kresizable_string = 0x523d;
-  static constexpr Tagged_t kResizableArrayBuffer_string = 0x5255;
-  static constexpr Tagged_t kreturn_string = 0x5275;
-  static constexpr Tagged_t krevoke_string = 0x5289;
-  static constexpr Tagged_t kroundingIncrement_string = 0x529d;
-  static constexpr Tagged_t kRuntimeError_string = 0x52bd;
-  static constexpr Tagged_t kWebAssemblyException_string = 0x52d5;
-  static constexpr Tagged_t kWebAssemblyModule_string = 0x52f9;
-  static constexpr Tagged_t kScript_string = 0x5319;
-  static constexpr Tagged_t kscript_string = 0x532d;
-  static constexpr Tagged_t ksecond_string = 0x5341;
-  static constexpr Tagged_t kseconds_string = 0x5355;
-  static constexpr Tagged_t kshort_string = 0x5369;
-  static constexpr Tagged_t kSet_string = 0x537d;
-  static constexpr Tagged_t ksentence_string = 0x538d;
-  static constexpr Tagged_t kset_space_string = 0x53a1;
-  static constexpr Tagged_t kset_string = 0x53b1;
-  static constexpr Tagged_t kSetIterator_string = 0x53c1;
-  static constexpr Tagged_t ksetPrototypeOf_string = 0x53d9;
-  static constexpr Tagged_t kShadowRealm_string = 0x53f5;
-  static constexpr Tagged_t kSharedArray_string = 0x540d;
-  static constexpr Tagged_t kSharedArrayBuffer_string = 0x5425;
-  static constexpr Tagged_t kSharedStruct_string = 0x5445;
-  static constexpr Tagged_t ksign_string = 0x545d;
-  static constexpr Tagged_t ksize_string = 0x546d;
-  static constexpr Tagged_t ksmallestUnit_string = 0x547d;
-  static constexpr Tagged_t ksource_string = 0x5495;
-  static constexpr Tagged_t ksourceText_string = 0x54a9;
-  static constexpr Tagged_t kstack_string = 0x54c1;
-  static constexpr Tagged_t kstackTraceLimit_string = 0x54d5;
-  static constexpr Tagged_t kstatic_initializer_string = 0x54f1;
-  static constexpr Tagged_t ksticky_string = 0x5511;
-  static constexpr Tagged_t kString_string = 0x5525;
-  static constexpr Tagged_t kstring_string = 0x5539;
-  static constexpr Tagged_t kstring_to_string = 0x554d;
-  static constexpr Tagged_t ksuppressed_string = 0x5569;
-  static constexpr Tagged_t kSuppressedError_string = 0x5581;
-  static constexpr Tagged_t kSuspendError_string = 0x559d;
-  static constexpr Tagged_t kSymbol_iterator_string = 0x55b5;
-  static constexpr Tagged_t kSymbol_match_all_string = 0x55d1;
-  static constexpr Tagged_t kSymbol_replace_string = 0x55ed;
-  static constexpr Tagged_t ksymbol_species_string = 0x5609;
-  static constexpr Tagged_t kSymbol_species_string = 0x5625;
-  static constexpr Tagged_t kSymbol_split_string = 0x5641;
-  static constexpr Tagged_t kSymbol_string = 0x5659;
-  static constexpr Tagged_t ksymbol_string = 0x566d;
-  static constexpr Tagged_t kSyntaxError_string = 0x5681;
-  static constexpr Tagged_t ktarget_string = 0x5699;
-  static constexpr Tagged_t kthis_function_string = 0x56ad;
-  static constexpr Tagged_t kthis_string = 0x56c9;
-  static constexpr Tagged_t kthrow_string = 0x56d9;
-  static constexpr Tagged_t ktimed_out_string = 0x56ed;
-  static constexpr Tagged_t ktimeZone_string = 0x5705;
-  static constexpr Tagged_t ktoJSON_string = 0x5719;
-  static constexpr Tagged_t ktoString_string = 0x572d;
-  static constexpr Tagged_t ktrue_string = 0x5741;
-  static constexpr Tagged_t ktotal_string = 0x5751;
-  static constexpr Tagged_t kTypedArrayLength_string = 0x5765;
-  static constexpr Tagged_t kTypeError_string = 0x5791;
-  static constexpr Tagged_t kUint16Array_string = 0x57a9;
-  static constexpr Tagged_t kUint32Array_string = 0x57c1;
-  static constexpr Tagged_t kUint8Array_string = 0x57d9;
-  static constexpr Tagged_t kUint8ClampedArray_string = 0x57f1;
-  static constexpr Tagged_t kundefined_string = 0x5811;
-  static constexpr Tagged_t kundefined_to_string = 0x5829;
-  static constexpr Tagged_t kunicode_string = 0x5849;
-  static constexpr Tagged_t kunicodeSets_string = 0x585d;
-  static constexpr Tagged_t kunit_string = 0x5875;
-  static constexpr Tagged_t kURIError_string = 0x5885;
-  static constexpr Tagged_t kUTC_string = 0x5899;
-  static constexpr Tagged_t kWeakMap_string = 0x58a9;
-  static constexpr Tagged_t kWeakRef_string = 0x58bd;
-  static constexpr Tagged_t kWeakSet_string = 0x58d1;
-  static constexpr Tagged_t kweek_string = 0x58e5;
-  static constexpr Tagged_t kweeks_string = 0x58f5;
-  static constexpr Tagged_t kweekOfYear_string = 0x5909;
-  static constexpr Tagged_t kwith_string = 0x5921;
-  static constexpr Tagged_t kword_string = 0x5931;
+      0x16e5;
+  static constexpr Tagged_t kUncompiledDataWithPreparseDataAndJobMap = 0x170d;
+  static constexpr Tagged_t kOnHeapBasicBlockProfilerDataMap = 0x1735;
+  static constexpr Tagged_t kObjectTemplateInfoMap = 0x175d;
+  static constexpr Tagged_t kTurbofanBitsetTypeMap = 0x1785;
+  static constexpr Tagged_t kTurbofanUnionTypeMap = 0x17ad;
+  static constexpr Tagged_t kTurbofanRangeTypeMap = 0x17d5;
+  static constexpr Tagged_t kTurbofanHeapConstantTypeMap = 0x17fd;
+  static constexpr Tagged_t kTurbofanOtherNumberConstantTypeMap = 0x1825;
+  static constexpr Tagged_t kTurboshaftWord32TypeMap = 0x184d;
+  static constexpr Tagged_t kTurboshaftWord32RangeTypeMap = 0x1875;
+  static constexpr Tagged_t kTurboshaftWord64TypeMap = 0x189d;
+  static constexpr Tagged_t kTurboshaftWord64RangeTypeMap = 0x18c5;
+  static constexpr Tagged_t kTurboshaftFloat64TypeMap = 0x18ed;
+  static constexpr Tagged_t kTurboshaftFloat64RangeTypeMap = 0x1915;
+  static constexpr Tagged_t kInternalClassMap = 0x193d;
+  static constexpr Tagged_t kSmiPairMap = 0x1965;
+  static constexpr Tagged_t kSmiBoxMap = 0x198d;
+  static constexpr Tagged_t kExportedSubClassBaseMap = 0x19b5;
+  static constexpr Tagged_t kExportedSubClassMap = 0x19dd;
+  static constexpr Tagged_t kAbstractInternalClassSubclass1Map = 0x1a05;
+  static constexpr Tagged_t kAbstractInternalClassSubclass2Map = 0x1a2d;
+  static constexpr Tagged_t kExportedSubClass2Map = 0x1a55;
+  static constexpr Tagged_t kSortStateMap = 0x1a7d;
+  static constexpr Tagged_t kWasmFastApiCallDataMap = 0x1aa5;
+  static constexpr Tagged_t kWasmStringViewIterMap = 0x1acd;
+  static constexpr Tagged_t kSloppyArgumentsElementsMap = 0x1af5;
+  static constexpr Tagged_t kStrongDescriptorArrayMap = 0x1b1d;
+  static constexpr Tagged_t kTurboshaftWord32SetTypeMap = 0x1b45;
+  static constexpr Tagged_t kTurboshaftWord64SetTypeMap = 0x1b6d;
+  static constexpr Tagged_t kTurboshaftFloat64SetTypeMap = 0x1b95;
+  static constexpr Tagged_t kInternalClassWithStructElementsMap = 0x1bbd;
+  static constexpr Tagged_t kOrderedHashMapMap = 0x1be5;
+  static constexpr Tagged_t kOrderedHashSetMap = 0x1c0d;
+  static constexpr Tagged_t kSimpleNumberDictionaryMap = 0x1c35;
+  static constexpr Tagged_t kSimpleNameDictionaryMap = 0x1c5d;
+  static constexpr Tagged_t kNameToIndexHashTableMap = 0x1c85;
+  static constexpr Tagged_t kEmbedderDataArrayMap = 0x1cad;
+  static constexpr Tagged_t kEphemeronHashTableMap = 0x1cd5;
+  static constexpr Tagged_t kScriptContextTableMap = 0x1cfd;
+  static constexpr Tagged_t kObjectBoilerplateDescriptionMap = 0x1d25;
+  static constexpr Tagged_t kCoverageInfoMap = 0x1d4d;
+  static constexpr Tagged_t kRegExpMatchInfoMap = 0x1d75;
+  static constexpr Tagged_t kRegExpDataMap = 0x1d9d;
+  static constexpr Tagged_t kAtomRegExpDataMap = 0x1dc5;
+  static constexpr Tagged_t kIrRegExpDataMap = 0x1ded;
+  static constexpr Tagged_t kSourceTextModuleMap = 0x1e15;
+  static constexpr Tagged_t kSyntheticModuleMap = 0x1e3d;
+  static constexpr Tagged_t kContextCellMap = 0x1e65;
+  static constexpr Tagged_t kWasmImportDataMap = 0x1e8d;
+  static constexpr Tagged_t kWasmCapiFunctionDataMap = 0x1eb5;
+  static constexpr Tagged_t kWasmExportedFunctionDataMap = 0x1edd;
+  static constexpr Tagged_t kWasmInternalFunctionMap = 0x1f05;
+  static constexpr Tagged_t kWasmFuncRefMap = 0x1f2d;
+  static constexpr Tagged_t kWasmJSFunctionDataMap = 0x1f55;
+  static constexpr Tagged_t kWasmResumeDataMap = 0x1f7d;
+  static constexpr Tagged_t kWasmSuspenderObjectMap = 0x1fa5;
+  static constexpr Tagged_t kWasmTypeInfoMap = 0x1fcd;
+  static constexpr Tagged_t kWasmNullMap = 0x1ff5;
+  static constexpr Tagged_t kWasmTrustedInstanceDataMap = 0x201d;
+  static constexpr Tagged_t kWasmDispatchTableMap = 0x2045;
+  static constexpr Tagged_t kWeakCellMap = 0x206d;
+  static constexpr Tagged_t kInterpreterDataMap = 0x2095;
+  static constexpr Tagged_t kSharedFunctionInfoWrapperMap = 0x20bd;
+  static constexpr Tagged_t kDictionaryTemplateInfoMap = 0x20e5;
+  static constexpr Tagged_t kEmptyArrayList = 0x210d;
+  static constexpr Tagged_t kEmptyObjectBoilerplateDescription = 0x2119;
+  static constexpr Tagged_t kEmptyArrayBoilerplateDescription = 0x2129;
+  static constexpr Tagged_t kEmptyClosureFeedbackCellArray = 0x2135;
+  static constexpr Tagged_t kEmptySwissPropertyDictionary = 0x2149;
+  static constexpr Tagged_t kadoptText_string = 0x2169;
+  static constexpr Tagged_t kapproximatelySign_string = 0x2181;
+  static constexpr Tagged_t kbaseName_string = 0x21a1;
+  static constexpr Tagged_t kaccounting_string = 0x21b5;
+  static constexpr Tagged_t kbreakType_string = 0x21cd;
+  static constexpr Tagged_t kcalendars_string = 0x21e5;
+  static constexpr Tagged_t kcardinal_string = 0x21fd;
+  static constexpr Tagged_t kcaseFirst_string = 0x2211;
+  static constexpr Tagged_t kceil_string = 0x2229;
+  static constexpr Tagged_t kcompare_string = 0x2239;
+  static constexpr Tagged_t kcollation_string = 0x224d;
+  static constexpr Tagged_t kcollations_string = 0x2265;
+  static constexpr Tagged_t kcompact_string = 0x227d;
+  static constexpr Tagged_t kcompactDisplay_string = 0x2291;
+  static constexpr Tagged_t kcurrency_string = 0x22ad;
+  static constexpr Tagged_t kcurrencyDisplay_string = 0x22c1;
+  static constexpr Tagged_t kcurrencySign_string = 0x22dd;
+  static constexpr Tagged_t kdateStyle_string = 0x22f5;
+  static constexpr Tagged_t kdateTimeField_string = 0x230d;
+  static constexpr Tagged_t kdayPeriod_string = 0x2329;
+  static constexpr Tagged_t kdaysDisplay_string = 0x2341;
+  static constexpr Tagged_t kdecimal_string = 0x2359;
+  static constexpr Tagged_t kdialect_string = 0x236d;
+  static constexpr Tagged_t kdigital_string = 0x2381;
+  static constexpr Tagged_t kdirection_string = 0x2395;
+  static constexpr Tagged_t kendRange_string = 0x23ad;
+  static constexpr Tagged_t kengineering_string = 0x23c1;
+  static constexpr Tagged_t kexceptZero_string = 0x23d9;
+  static constexpr Tagged_t kexpand_string = 0x23f1;
+  static constexpr Tagged_t kexponentInteger_string = 0x2405;
+  static constexpr Tagged_t kexponentMinusSign_string = 0x2421;
+  static constexpr Tagged_t kexponentSeparator_string = 0x2441;
+  static constexpr Tagged_t kfallback_string = 0x2461;
+  static constexpr Tagged_t kfirst_string = 0x2475;
+  static constexpr Tagged_t kfirstDay_string = 0x2489;
+  static constexpr Tagged_t kfirstDayOfWeek_string = 0x249d;
+  static constexpr Tagged_t kfloor_string = 0x24b9;
+  static constexpr Tagged_t kformat_string = 0x24cd;
+  static constexpr Tagged_t kfraction_string = 0x24e1;
+  static constexpr Tagged_t kfractionalDigits_string = 0x24f5;
+  static constexpr Tagged_t kfractionalSecond_string = 0x2511;
+  static constexpr Tagged_t kfull_string = 0x252d;
+  static constexpr Tagged_t kgranularity_string = 0x253d;
+  static constexpr Tagged_t kgrapheme_string = 0x2555;
+  static constexpr Tagged_t kgroup_string = 0x2569;
+  static constexpr Tagged_t kh11_string = 0x257d;
+  static constexpr Tagged_t kh12_string = 0x258d;
+  static constexpr Tagged_t kh23_string = 0x259d;
+  static constexpr Tagged_t kh24_string = 0x25ad;
+  static constexpr Tagged_t khalfCeil_string = 0x25bd;
+  static constexpr Tagged_t khalfEven_string = 0x25d1;
+  static constexpr Tagged_t khalfExpand_string = 0x25e5;
+  static constexpr Tagged_t khalfFloor_string = 0x25fd;
+  static constexpr Tagged_t khalfTrunc_string = 0x2615;
+  static constexpr Tagged_t khour12_string = 0x262d;
+  static constexpr Tagged_t khourCycle_string = 0x2641;
+  static constexpr Tagged_t khourCycles_string = 0x2659;
+  static constexpr Tagged_t khoursDisplay_string = 0x2671;
+  static constexpr Tagged_t kideo_string = 0x2689;
+  static constexpr Tagged_t kignorePunctuation_string = 0x2699;
+  static constexpr Tagged_t kInvalid_Date_string = 0x26b9;
+  static constexpr Tagged_t kinteger_string = 0x26d1;
+  static constexpr Tagged_t kisWordLike_string = 0x26e5;
+  static constexpr Tagged_t kkana_string = 0x26fd;
+  static constexpr Tagged_t klanguage_string = 0x270d;
+  static constexpr Tagged_t klanguageDisplay_string = 0x2721;
+  static constexpr Tagged_t klessPrecision_string = 0x273d;
+  static constexpr Tagged_t kletter_string = 0x2759;
+  static constexpr Tagged_t klist_string = 0x276d;
+  static constexpr Tagged_t kliteral_string = 0x277d;
+  static constexpr Tagged_t klocale_string = 0x2791;
+  static constexpr Tagged_t kloose_string = 0x27a5;
+  static constexpr Tagged_t klower_string = 0x27b9;
+  static constexpr Tagged_t kltr_string = 0x27cd;
+  static constexpr Tagged_t kmaximumFractionDigits_string = 0x27dd;
+  static constexpr Tagged_t kmaximumSignificantDigits_string = 0x2801;
+  static constexpr Tagged_t kmicrosecondsDisplay_string = 0x2825;
+  static constexpr Tagged_t kmillisecondsDisplay_string = 0x2845;
+  static constexpr Tagged_t kmin2_string = 0x2865;
+  static constexpr Tagged_t kminimalDays_string = 0x2875;
+  static constexpr Tagged_t kminimumFractionDigits_string = 0x288d;
+  static constexpr Tagged_t kminimumIntegerDigits_string = 0x28b1;
+  static constexpr Tagged_t kminimumSignificantDigits_string = 0x28d1;
+  static constexpr Tagged_t kminus_0 = 0x28f5;
+  static constexpr Tagged_t kminusSign_string = 0x2905;
+  static constexpr Tagged_t kminutesDisplay_string = 0x291d;
+  static constexpr Tagged_t kmonthsDisplay_string = 0x2939;
+  static constexpr Tagged_t kmorePrecision_string = 0x2955;
+  static constexpr Tagged_t knan_string = 0x2971;
+  static constexpr Tagged_t knanosecondsDisplay_string = 0x2981;
+  static constexpr Tagged_t knarrowSymbol_string = 0x29a1;
+  static constexpr Tagged_t knegative_string = 0x29b9;
+  static constexpr Tagged_t knever_string = 0x29cd;
+  static constexpr Tagged_t knone_string = 0x29e1;
+  static constexpr Tagged_t knotation_string = 0x29f1;
+  static constexpr Tagged_t knormal_string = 0x2a05;
+  static constexpr Tagged_t knumberingSystem_string = 0x2a19;
+  static constexpr Tagged_t knumberingSystems_string = 0x2a35;
+  static constexpr Tagged_t knumeric_string = 0x2a51;
+  static constexpr Tagged_t kordinal_string = 0x2a65;
+  static constexpr Tagged_t kpercentSign_string = 0x2a79;
+  static constexpr Tagged_t kplusSign_string = 0x2a91;
+  static constexpr Tagged_t kquarter_string = 0x2aa5;
+  static constexpr Tagged_t kregion_string = 0x2ab9;
+  static constexpr Tagged_t krelatedYear_string = 0x2acd;
+  static constexpr Tagged_t kroundingMode_string = 0x2ae5;
+  static constexpr Tagged_t kroundingPriority_string = 0x2afd;
+  static constexpr Tagged_t krtl_string = 0x2b19;
+  static constexpr Tagged_t kscientific_string = 0x2b29;
+  static constexpr Tagged_t ksecondsDisplay_string = 0x2b41;
+  static constexpr Tagged_t ksegment_string = 0x2b5d;
+  static constexpr Tagged_t kSegmentIterator_string = 0x2b71;
+  static constexpr Tagged_t kSegments_string = 0x2b8d;
+  static constexpr Tagged_t ksensitivity_string = 0x2ba1;
+  static constexpr Tagged_t ksep_string = 0x2bb9;
+  static constexpr Tagged_t kshared_string = 0x2bc9;
+  static constexpr Tagged_t ksignDisplay_string = 0x2bdd;
+  static constexpr Tagged_t kstandard_string = 0x2bf5;
+  static constexpr Tagged_t kstartRange_string = 0x2c09;
+  static constexpr Tagged_t kstrict_string = 0x2c21;
+  static constexpr Tagged_t kstripIfInteger_string = 0x2c35;
+  static constexpr Tagged_t kstyle_string = 0x2c51;
+  static constexpr Tagged_t kterm_string = 0x2c65;
+  static constexpr Tagged_t ktextInfo_string = 0x2c75;
+  static constexpr Tagged_t ktimeStyle_string = 0x2c89;
+  static constexpr Tagged_t ktimeZones_string = 0x2ca1;
+  static constexpr Tagged_t ktimeZoneName_string = 0x2cb9;
+  static constexpr Tagged_t ktrailingZeroDisplay_string = 0x2cd1;
+  static constexpr Tagged_t ktrunc_string = 0x2cf1;
+  static constexpr Tagged_t ktwo_digit_string = 0x2d05;
+  static constexpr Tagged_t ktype_string = 0x2d19;
+  static constexpr Tagged_t kunknown_string = 0x2d29;
+  static constexpr Tagged_t kupper_string = 0x2d3d;
+  static constexpr Tagged_t kusage_string = 0x2d51;
+  static constexpr Tagged_t kuseGrouping_string = 0x2d65;
+  static constexpr Tagged_t kunitDisplay_string = 0x2d7d;
+  static constexpr Tagged_t kweekday_string = 0x2d95;
+  static constexpr Tagged_t kweekend_string = 0x2da9;
+  static constexpr Tagged_t kweeksDisplay_string = 0x2dbd;
+  static constexpr Tagged_t kweekInfo_string = 0x2dd5;
+  static constexpr Tagged_t kyearName_string = 0x2de9;
+  static constexpr Tagged_t kyearsDisplay_string = 0x2dfd;
+  static constexpr Tagged_t kascii_nul_string = 0x2e15;
+  static constexpr Tagged_t kascii_soh_string = 0x2e25;
+  static constexpr Tagged_t kascii_stx_string = 0x2e35;
+  static constexpr Tagged_t kascii_etx_string = 0x2e45;
+  static constexpr Tagged_t kascii_eot_string = 0x2e55;
+  static constexpr Tagged_t kascii_enq_string = 0x2e65;
+  static constexpr Tagged_t kascii_ack_string = 0x2e75;
+  static constexpr Tagged_t kascii_bel_string = 0x2e85;
+  static constexpr Tagged_t kascii_bs_string = 0x2e95;
+  static constexpr Tagged_t kascii_ht_string = 0x2ea5;
+  static constexpr Tagged_t kascii_lf_string = 0x2eb5;
+  static constexpr Tagged_t kascii_vt_string = 0x2ec5;
+  static constexpr Tagged_t kascii_ff_string = 0x2ed5;
+  static constexpr Tagged_t kascii_cr_string = 0x2ee5;
+  static constexpr Tagged_t kascii_so_string = 0x2ef5;
+  static constexpr Tagged_t kascii_si_string = 0x2f05;
+  static constexpr Tagged_t kascii_dle_string = 0x2f15;
+  static constexpr Tagged_t kascii_dc1_string = 0x2f25;
+  static constexpr Tagged_t kascii_dc2_string = 0x2f35;
+  static constexpr Tagged_t kascii_dc3_string = 0x2f45;
+  static constexpr Tagged_t kascii_dc4_string = 0x2f55;
+  static constexpr Tagged_t kascii_nak_string = 0x2f65;
+  static constexpr Tagged_t kascii_syn_string = 0x2f75;
+  static constexpr Tagged_t kascii_etb_string = 0x2f85;
+  static constexpr Tagged_t kascii_can_string = 0x2f95;
+  static constexpr Tagged_t kascii_em_string = 0x2fa5;
+  static constexpr Tagged_t kascii_sub_string = 0x2fb5;
+  static constexpr Tagged_t kascii_esc_string = 0x2fc5;
+  static constexpr Tagged_t kascii_fs_string = 0x2fd5;
+  static constexpr Tagged_t kascii_gs_string = 0x2fe5;
+  static constexpr Tagged_t kascii_rs_string = 0x2ff5;
+  static constexpr Tagged_t kascii_us_string = 0x3005;
+  static constexpr Tagged_t kspace_string = 0x3015;
+  static constexpr Tagged_t kexclamation_mark_string = 0x3025;
+  static constexpr Tagged_t kdouble_quotes_string = 0x3035;
+  static constexpr Tagged_t khash_string = 0x3045;
+  static constexpr Tagged_t kdollar_string = 0x3055;
+  static constexpr Tagged_t kpercent_sign_string = 0x3065;
+  static constexpr Tagged_t kampersand_string = 0x3075;
+  static constexpr Tagged_t ksingle_quote_string = 0x3085;
+  static constexpr Tagged_t kopen_parenthesis_string = 0x3095;
+  static constexpr Tagged_t kclose_parenthesis_string = 0x30a5;
+  static constexpr Tagged_t kasterisk_string = 0x30b5;
+  static constexpr Tagged_t kplus_string = 0x30c5;
+  static constexpr Tagged_t kcomma_string = 0x30d5;
+  static constexpr Tagged_t kminus_string = 0x30e5;
+  static constexpr Tagged_t kdot_string = 0x30f5;
+  static constexpr Tagged_t kslash_string = 0x3105;
+  static constexpr Tagged_t kzero_string = 0x3115;
+  static constexpr Tagged_t kone_string = 0x3125;
+  static constexpr Tagged_t ktwo_string = 0x3135;
+  static constexpr Tagged_t kthree_string = 0x3145;
+  static constexpr Tagged_t kfour_string = 0x3155;
+  static constexpr Tagged_t kfive_string = 0x3165;
+  static constexpr Tagged_t ksix_string = 0x3175;
+  static constexpr Tagged_t kseven_string = 0x3185;
+  static constexpr Tagged_t keight_string = 0x3195;
+  static constexpr Tagged_t knine_string = 0x31a5;
+  static constexpr Tagged_t kcolon_string = 0x31b5;
+  static constexpr Tagged_t ksemicolon_string = 0x31c5;
+  static constexpr Tagged_t kless_than_string = 0x31d5;
+  static constexpr Tagged_t kequals_string = 0x31e5;
+  static constexpr Tagged_t kgreater_than_string = 0x31f5;
+  static constexpr Tagged_t kquestion_mark_string = 0x3205;
+  static constexpr Tagged_t kat_sign_string = 0x3215;
+  static constexpr Tagged_t kA_string = 0x3225;
+  static constexpr Tagged_t kB_string = 0x3235;
+  static constexpr Tagged_t kC_string = 0x3245;
+  static constexpr Tagged_t kD_string = 0x3255;
+  static constexpr Tagged_t kE_string = 0x3265;
+  static constexpr Tagged_t kF_string = 0x3275;
+  static constexpr Tagged_t kG_string = 0x3285;
+  static constexpr Tagged_t kH_string = 0x3295;
+  static constexpr Tagged_t kI_string = 0x32a5;
+  static constexpr Tagged_t kJ_string = 0x32b5;
+  static constexpr Tagged_t kK_string = 0x32c5;
+  static constexpr Tagged_t kL_string = 0x32d5;
+  static constexpr Tagged_t kM_string = 0x32e5;
+  static constexpr Tagged_t kN_string = 0x32f5;
+  static constexpr Tagged_t kO_string = 0x3305;
+  static constexpr Tagged_t kP_string = 0x3315;
+  static constexpr Tagged_t kQ_string = 0x3325;
+  static constexpr Tagged_t kR_string = 0x3335;
+  static constexpr Tagged_t kS_string = 0x3345;
+  static constexpr Tagged_t kT_string = 0x3355;
+  static constexpr Tagged_t kU_string = 0x3365;
+  static constexpr Tagged_t kV_string = 0x3375;
+  static constexpr Tagged_t kW_string = 0x3385;
+  static constexpr Tagged_t kX_string = 0x3395;
+  static constexpr Tagged_t kY_string = 0x33a5;
+  static constexpr Tagged_t kZ_string = 0x33b5;
+  static constexpr Tagged_t kopen_bracket_string = 0x33c5;
+  static constexpr Tagged_t kbackslash_string = 0x33d5;
+  static constexpr Tagged_t kclose_bracket_string = 0x33e5;
+  static constexpr Tagged_t kcaret_string = 0x33f5;
+  static constexpr Tagged_t kunderscore_string = 0x3405;
+  static constexpr Tagged_t kbacktick_string = 0x3415;
+  static constexpr Tagged_t ka_string = 0x3425;
+  static constexpr Tagged_t kb_string = 0x3435;
+  static constexpr Tagged_t kc_string = 0x3445;
+  static constexpr Tagged_t kd_string = 0x3455;
+  static constexpr Tagged_t ke_string = 0x3465;
+  static constexpr Tagged_t kf_string = 0x3475;
+  static constexpr Tagged_t kg_string = 0x3485;
+  static constexpr Tagged_t kh_string = 0x3495;
+  static constexpr Tagged_t ki_string = 0x34a5;
+  static constexpr Tagged_t kj_string = 0x34b5;
+  static constexpr Tagged_t kk_string = 0x34c5;
+  static constexpr Tagged_t kl_string = 0x34d5;
+  static constexpr Tagged_t km_string = 0x34e5;
+  static constexpr Tagged_t kn_string = 0x34f5;
+  static constexpr Tagged_t ko_string = 0x3505;
+  static constexpr Tagged_t kp_string = 0x3515;
+  static constexpr Tagged_t kq_string = 0x3525;
+  static constexpr Tagged_t kr_string = 0x3535;
+  static constexpr Tagged_t ks_string = 0x3545;
+  static constexpr Tagged_t kt_string = 0x3555;
+  static constexpr Tagged_t ku_string = 0x3565;
+  static constexpr Tagged_t kv_string = 0x3575;
+  static constexpr Tagged_t kw_string = 0x3585;
+  static constexpr Tagged_t kx_string = 0x3595;
+  static constexpr Tagged_t ky_string = 0x35a5;
+  static constexpr Tagged_t kz_string = 0x35b5;
+  static constexpr Tagged_t kopen_brace_string = 0x35c5;
+  static constexpr Tagged_t kpipe_string = 0x35d5;
+  static constexpr Tagged_t kclose_brace_string = 0x35e5;
+  static constexpr Tagged_t ktilde_string = 0x35f5;
+  static constexpr Tagged_t kascii_del_string = 0x3605;
+  static constexpr Tagged_t klatin1_80_string = 0x3615;
+  static constexpr Tagged_t klatin1_81_string = 0x3625;
+  static constexpr Tagged_t klatin1_82_string = 0x3635;
+  static constexpr Tagged_t klatin1_83_string = 0x3645;
+  static constexpr Tagged_t klatin1_84_string = 0x3655;
+  static constexpr Tagged_t klatin1_85_string = 0x3665;
+  static constexpr Tagged_t klatin1_86_string = 0x3675;
+  static constexpr Tagged_t klatin1_87_string = 0x3685;
+  static constexpr Tagged_t klatin1_88_string = 0x3695;
+  static constexpr Tagged_t klatin1_89_string = 0x36a5;
+  static constexpr Tagged_t klatin1_8a_string = 0x36b5;
+  static constexpr Tagged_t klatin1_8b_string = 0x36c5;
+  static constexpr Tagged_t klatin1_8c_string = 0x36d5;
+  static constexpr Tagged_t klatin1_8d_string = 0x36e5;
+  static constexpr Tagged_t klatin1_8e_string = 0x36f5;
+  static constexpr Tagged_t klatin1_8f_string = 0x3705;
+  static constexpr Tagged_t klatin1_90_string = 0x3715;
+  static constexpr Tagged_t klatin1_91_string = 0x3725;
+  static constexpr Tagged_t klatin1_92_string = 0x3735;
+  static constexpr Tagged_t klatin1_93_string = 0x3745;
+  static constexpr Tagged_t klatin1_94_string = 0x3755;
+  static constexpr Tagged_t klatin1_95_string = 0x3765;
+  static constexpr Tagged_t klatin1_96_string = 0x3775;
+  static constexpr Tagged_t klatin1_97_string = 0x3785;
+  static constexpr Tagged_t klatin1_98_string = 0x3795;
+  static constexpr Tagged_t klatin1_99_string = 0x37a5;
+  static constexpr Tagged_t klatin1_9a_string = 0x37b5;
+  static constexpr Tagged_t klatin1_9b_string = 0x37c5;
+  static constexpr Tagged_t klatin1_9c_string = 0x37d5;
+  static constexpr Tagged_t klatin1_9d_string = 0x37e5;
+  static constexpr Tagged_t klatin1_9e_string = 0x37f5;
+  static constexpr Tagged_t klatin1_9f_string = 0x3805;
+  static constexpr Tagged_t klatin1_a0_string = 0x3815;
+  static constexpr Tagged_t klatin1_a1_string = 0x3825;
+  static constexpr Tagged_t klatin1_a2_string = 0x3835;
+  static constexpr Tagged_t klatin1_a3_string = 0x3845;
+  static constexpr Tagged_t klatin1_a4_string = 0x3855;
+  static constexpr Tagged_t klatin1_a5_string = 0x3865;
+  static constexpr Tagged_t klatin1_a6_string = 0x3875;
+  static constexpr Tagged_t klatin1_a7_string = 0x3885;
+  static constexpr Tagged_t klatin1_a8_string = 0x3895;
+  static constexpr Tagged_t klatin1_a9_string = 0x38a5;
+  static constexpr Tagged_t klatin1_aa_string = 0x38b5;
+  static constexpr Tagged_t klatin1_ab_string = 0x38c5;
+  static constexpr Tagged_t klatin1_ac_string = 0x38d5;
+  static constexpr Tagged_t klatin1_ad_string = 0x38e5;
+  static constexpr Tagged_t klatin1_ae_string = 0x38f5;
+  static constexpr Tagged_t klatin1_af_string = 0x3905;
+  static constexpr Tagged_t klatin1_b0_string = 0x3915;
+  static constexpr Tagged_t klatin1_b1_string = 0x3925;
+  static constexpr Tagged_t klatin1_b2_string = 0x3935;
+  static constexpr Tagged_t klatin1_b3_string = 0x3945;
+  static constexpr Tagged_t klatin1_b4_string = 0x3955;
+  static constexpr Tagged_t klatin1_b5_string = 0x3965;
+  static constexpr Tagged_t klatin1_b6_string = 0x3975;
+  static constexpr Tagged_t klatin1_b7_string = 0x3985;
+  static constexpr Tagged_t klatin1_b8_string = 0x3995;
+  static constexpr Tagged_t klatin1_b9_string = 0x39a5;
+  static constexpr Tagged_t klatin1_ba_string = 0x39b5;
+  static constexpr Tagged_t klatin1_bb_string = 0x39c5;
+  static constexpr Tagged_t klatin1_bc_string = 0x39d5;
+  static constexpr Tagged_t klatin1_bd_string = 0x39e5;
+  static constexpr Tagged_t klatin1_be_string = 0x39f5;
+  static constexpr Tagged_t klatin1_bf_string = 0x3a05;
+  static constexpr Tagged_t klatin1_c0_string = 0x3a15;
+  static constexpr Tagged_t klatin1_c1_string = 0x3a25;
+  static constexpr Tagged_t klatin1_c2_string = 0x3a35;
+  static constexpr Tagged_t klatin1_c3_string = 0x3a45;
+  static constexpr Tagged_t klatin1_c4_string = 0x3a55;
+  static constexpr Tagged_t klatin1_c5_string = 0x3a65;
+  static constexpr Tagged_t klatin1_c6_string = 0x3a75;
+  static constexpr Tagged_t klatin1_c7_string = 0x3a85;
+  static constexpr Tagged_t klatin1_c8_string = 0x3a95;
+  static constexpr Tagged_t klatin1_c9_string = 0x3aa5;
+  static constexpr Tagged_t klatin1_ca_string = 0x3ab5;
+  static constexpr Tagged_t klatin1_cb_string = 0x3ac5;
+  static constexpr Tagged_t klatin1_cc_string = 0x3ad5;
+  static constexpr Tagged_t klatin1_cd_string = 0x3ae5;
+  static constexpr Tagged_t klatin1_ce_string = 0x3af5;
+  static constexpr Tagged_t klatin1_cf_string = 0x3b05;
+  static constexpr Tagged_t klatin1_d0_string = 0x3b15;
+  static constexpr Tagged_t klatin1_d1_string = 0x3b25;
+  static constexpr Tagged_t klatin1_d2_string = 0x3b35;
+  static constexpr Tagged_t klatin1_d3_string = 0x3b45;
+  static constexpr Tagged_t klatin1_d4_string = 0x3b55;
+  static constexpr Tagged_t klatin1_d5_string = 0x3b65;
+  static constexpr Tagged_t klatin1_d6_string = 0x3b75;
+  static constexpr Tagged_t klatin1_d7_string = 0x3b85;
+  static constexpr Tagged_t klatin1_d8_string = 0x3b95;
+  static constexpr Tagged_t klatin1_d9_string = 0x3ba5;
+  static constexpr Tagged_t klatin1_da_string = 0x3bb5;
+  static constexpr Tagged_t klatin1_db_string = 0x3bc5;
+  static constexpr Tagged_t klatin1_dc_string = 0x3bd5;
+  static constexpr Tagged_t klatin1_dd_string = 0x3be5;
+  static constexpr Tagged_t klatin1_de_string = 0x3bf5;
+  static constexpr Tagged_t klatin1_df_string = 0x3c05;
+  static constexpr Tagged_t klatin1_e0_string = 0x3c15;
+  static constexpr Tagged_t klatin1_e1_string = 0x3c25;
+  static constexpr Tagged_t klatin1_e2_string = 0x3c35;
+  static constexpr Tagged_t klatin1_e3_string = 0x3c45;
+  static constexpr Tagged_t klatin1_e4_string = 0x3c55;
+  static constexpr Tagged_t klatin1_e5_string = 0x3c65;
+  static constexpr Tagged_t klatin1_e6_string = 0x3c75;
+  static constexpr Tagged_t klatin1_e7_string = 0x3c85;
+  static constexpr Tagged_t klatin1_e8_string = 0x3c95;
+  static constexpr Tagged_t klatin1_e9_string = 0x3ca5;
+  static constexpr Tagged_t klatin1_ea_string = 0x3cb5;
+  static constexpr Tagged_t klatin1_eb_string = 0x3cc5;
+  static constexpr Tagged_t klatin1_ec_string = 0x3cd5;
+  static constexpr Tagged_t klatin1_ed_string = 0x3ce5;
+  static constexpr Tagged_t klatin1_ee_string = 0x3cf5;
+  static constexpr Tagged_t klatin1_ef_string = 0x3d05;
+  static constexpr Tagged_t klatin1_f0_string = 0x3d15;
+  static constexpr Tagged_t klatin1_f1_string = 0x3d25;
+  static constexpr Tagged_t klatin1_f2_string = 0x3d35;
+  static constexpr Tagged_t klatin1_f3_string = 0x3d45;
+  static constexpr Tagged_t klatin1_f4_string = 0x3d55;
+  static constexpr Tagged_t klatin1_f5_string = 0x3d65;
+  static constexpr Tagged_t klatin1_f6_string = 0x3d75;
+  static constexpr Tagged_t klatin1_f7_string = 0x3d85;
+  static constexpr Tagged_t klatin1_f8_string = 0x3d95;
+  static constexpr Tagged_t klatin1_f9_string = 0x3da5;
+  static constexpr Tagged_t klatin1_fa_string = 0x3db5;
+  static constexpr Tagged_t klatin1_fb_string = 0x3dc5;
+  static constexpr Tagged_t klatin1_fc_string = 0x3dd5;
+  static constexpr Tagged_t klatin1_fd_string = 0x3de5;
+  static constexpr Tagged_t klatin1_fe_string = 0x3df5;
+  static constexpr Tagged_t klatin1_ff_string = 0x3e05;
+  static constexpr Tagged_t kadd_string = 0x3e15;
+  static constexpr Tagged_t kAggregateError_string = 0x3e25;
+  static constexpr Tagged_t kalphabet_string = 0x3e41;
+  static constexpr Tagged_t kalways_string = 0x3e55;
+  static constexpr Tagged_t kanonymous_string = 0x3e69;
+  static constexpr Tagged_t kapply_string = 0x3e81;
+  static constexpr Tagged_t kArguments_string = 0x3e95;
+  static constexpr Tagged_t karguments_string = 0x3ead;
+  static constexpr Tagged_t karguments_to_string = 0x3ec5;
+  static constexpr Tagged_t kArray_string = 0x3ee5;
+  static constexpr Tagged_t karray_to_string = 0x3ef9;
+  static constexpr Tagged_t kArrayBuffer_string = 0x3f15;
+  static constexpr Tagged_t kArrayIterator_string = 0x3f2d;
+  static constexpr Tagged_t kas_string = 0x3f49;
+  static constexpr Tagged_t kassert_string = 0x3f59;
+  static constexpr Tagged_t kasync_string = 0x3f6d;
+  static constexpr Tagged_t kAtomicsCondition_string = 0x3f81;
+  static constexpr Tagged_t kAtomicsMutex_string = 0x3fa1;
+  static constexpr Tagged_t kauto_string = 0x3fbd;
+  static constexpr Tagged_t kBigInt_string = 0x3fcd;
+  static constexpr Tagged_t kbigint_string = 0x3fe1;
+  static constexpr Tagged_t kBigInt64Array_string = 0x3ff5;
+  static constexpr Tagged_t kBigUint64Array_string = 0x4011;
+  static constexpr Tagged_t kbind_string = 0x402d;
+  static constexpr Tagged_t kblank_string = 0x403d;
+  static constexpr Tagged_t kBoolean_string = 0x4051;
+  static constexpr Tagged_t kboolean_string = 0x4065;
+  static constexpr Tagged_t kboolean_to_string = 0x4079;
+  static constexpr Tagged_t kbound__string = 0x4095;
+  static constexpr Tagged_t kbuffer_string = 0x40a9;
+  static constexpr Tagged_t kbyte_length_string = 0x40bd;
+  static constexpr Tagged_t kbyte_offset_string = 0x40d5;
+  static constexpr Tagged_t kCompileError_string = 0x40ed;
+  static constexpr Tagged_t kcalendar_string = 0x4105;
+  static constexpr Tagged_t kcallee_string = 0x4119;
+  static constexpr Tagged_t kcaller_string = 0x412d;
+  static constexpr Tagged_t kcause_string = 0x4141;
+  static constexpr Tagged_t kcharacter_string = 0x4155;
+  static constexpr Tagged_t kcode_string = 0x416d;
+  static constexpr Tagged_t kcolumn_string = 0x417d;
+  static constexpr Tagged_t kcomputed_string = 0x4191;
+  static constexpr Tagged_t kconjunction_string = 0x41a9;
+  static constexpr Tagged_t kconsole_string = 0x41c1;
+  static constexpr Tagged_t kconstrain_string = 0x41d5;
+  static constexpr Tagged_t kconstruct_string = 0x41ed;
+  static constexpr Tagged_t kcurrent_string = 0x4205;
+  static constexpr Tagged_t kDate_string = 0x4219;
+  static constexpr Tagged_t kdate_to_string = 0x4229;
+  static constexpr Tagged_t kdateAdd_string = 0x4245;
+  static constexpr Tagged_t kdateFromFields_string = 0x4259;
+  static constexpr Tagged_t kdateUntil_string = 0x4275;
+  static constexpr Tagged_t kday_string = 0x428d;
+  static constexpr Tagged_t kdayOfWeek_string = 0x429d;
+  static constexpr Tagged_t kdayOfYear_string = 0x42b5;
+  static constexpr Tagged_t kdays_string = 0x42cd;
+  static constexpr Tagged_t kdaysInMonth_string = 0x42dd;
+  static constexpr Tagged_t kdaysInWeek_string = 0x42f5;
+  static constexpr Tagged_t kdaysInYear_string = 0x430d;
+  static constexpr Tagged_t kdefault_string = 0x4325;
+  static constexpr Tagged_t kdefineProperty_string = 0x4339;
+  static constexpr Tagged_t kdeleteProperty_string = 0x4355;
+  static constexpr Tagged_t kdetached_string = 0x4371;
+  static constexpr Tagged_t kdisjunction_string = 0x4385;
+  static constexpr Tagged_t kdisposed_string = 0x439d;
+  static constexpr Tagged_t kdone_string = 0x43b1;
+  static constexpr Tagged_t kdot_brand_string = 0x43c1;
+  static constexpr Tagged_t kdot_catch_string = 0x43d5;
+  static constexpr Tagged_t kdot_default_string = 0x43e9;
+  static constexpr Tagged_t kdot_for_string = 0x43fd;
+  static constexpr Tagged_t kdot_generator_object_string = 0x440d;
+  static constexpr Tagged_t kdot_home_object_string = 0x442d;
+  static constexpr Tagged_t kdot_new_target_string = 0x4445;
+  static constexpr Tagged_t knew_target_string = 0x4445;
+  static constexpr Tagged_t kdot_result_string = 0x445d;
+  static constexpr Tagged_t kdot_repl_result_string = 0x4471;
+  static constexpr Tagged_t kdot_static_home_object_string = 0x4489;
+  static constexpr Tagged_t kdot_switch_tag_string = 0x44a9;
+  static constexpr Tagged_t kdotAll_string = 0x44c1;
+  static constexpr Tagged_t kError_string = 0x44d5;
+  static constexpr Tagged_t kEvalError_string = 0x44e9;
+  static constexpr Tagged_t kelement_string = 0x4501;
+  static constexpr Tagged_t kepochMicroseconds_string = 0x4515;
+  static constexpr Tagged_t kepochMilliseconds_string = 0x4535;
+  static constexpr Tagged_t kepochNanoseconds_string = 0x4555;
+  static constexpr Tagged_t kepochSeconds_string = 0x4571;
+  static constexpr Tagged_t kera_string = 0x4589;
+  static constexpr Tagged_t keraYear_string = 0x4599;
+  static constexpr Tagged_t kerror_string = 0x45ad;
+  static constexpr Tagged_t kerrors_string = 0x45c1;
+  static constexpr Tagged_t kerror_to_string = 0x45d5;
+  static constexpr Tagged_t keval_string = 0x45f1;
+  static constexpr Tagged_t kexception_string = 0x4601;
+  static constexpr Tagged_t kexec_string = 0x4619;
+  static constexpr Tagged_t kfalse_string = 0x4629;
+  static constexpr Tagged_t kfields_string = 0x463d;
+  static constexpr Tagged_t kFinalizationRegistry_string = 0x4651;
+  static constexpr Tagged_t kflags_string = 0x4671;
+  static constexpr Tagged_t kFloat16Array_string = 0x4685;
+  static constexpr Tagged_t kFloat32Array_string = 0x469d;
+  static constexpr Tagged_t kFloat64Array_string = 0x46b5;
+  static constexpr Tagged_t kfractionalSecondDigits_string = 0x46cd;
+  static constexpr Tagged_t kfrom_string = 0x46f1;
+  static constexpr Tagged_t kFunction_string = 0x4701;
+  static constexpr Tagged_t kfunction_native_code_string = 0x4715;
+  static constexpr Tagged_t kfunction_string = 0x4741;
+  static constexpr Tagged_t kfunction_to_string = 0x4755;
+  static constexpr Tagged_t kGenerator_string = 0x4775;
+  static constexpr Tagged_t kget_space_string = 0x478d;
+  static constexpr Tagged_t kget_string = 0x479d;
+  static constexpr Tagged_t kgetOffsetNanosecondsFor_string = 0x47ad;
+  static constexpr Tagged_t kgetOwnPropertyDescriptor_string = 0x47d1;
+  static constexpr Tagged_t kgetPossibleInstantsFor_string = 0x47f5;
+  static constexpr Tagged_t kgetPrototypeOf_string = 0x4819;
+  static constexpr Tagged_t kglobal_string = 0x4835;
+  static constexpr Tagged_t kglobalThis_string = 0x4849;
+  static constexpr Tagged_t kgroups_string = 0x4861;
+  static constexpr Tagged_t kgrowable_string = 0x4875;
+  static constexpr Tagged_t khas_string = 0x4889;
+  static constexpr Tagged_t khasIndices_string = 0x4899;
+  static constexpr Tagged_t khour_string = 0x48b1;
+  static constexpr Tagged_t khours_string = 0x48c1;
+  static constexpr Tagged_t khoursInDay_string = 0x48d5;
+  static constexpr Tagged_t kignoreCase_string = 0x48ed;
+  static constexpr Tagged_t kid_string = 0x4905;
+  static constexpr Tagged_t killegal_access_string = 0x4915;
+  static constexpr Tagged_t killegal_argument_string = 0x4931;
+  static constexpr Tagged_t kinLeapYear_string = 0x494d;
+  static constexpr Tagged_t kindex_string = 0x4965;
+  static constexpr Tagged_t kindices_string = 0x4979;
+  static constexpr Tagged_t kInfinity_string = 0x498d;
+  static constexpr Tagged_t kinfinity_string = 0x49a1;
+  static constexpr Tagged_t kinput_string = 0x49b5;
+  static constexpr Tagged_t kinstance_members_initializer_string = 0x49c9;
+  static constexpr Tagged_t kInt16Array_string = 0x49f5;
+  static constexpr Tagged_t kInt32Array_string = 0x4a0d;
+  static constexpr Tagged_t kInt8Array_string = 0x4a25;
+  static constexpr Tagged_t kisExtensible_string = 0x4a3d;
+  static constexpr Tagged_t kiso8601_string = 0x4a55;
+  static constexpr Tagged_t kisoDay_string = 0x4a69;
+  static constexpr Tagged_t kisoHour_string = 0x4a7d;
+  static constexpr Tagged_t kisoMicrosecond_string = 0x4a91;
+  static constexpr Tagged_t kisoMillisecond_string = 0x4aad;
+  static constexpr Tagged_t kisoMinute_string = 0x4ac9;
+  static constexpr Tagged_t kisoMonth_string = 0x4ae1;
+  static constexpr Tagged_t kisoNanosecond_string = 0x4af5;
+  static constexpr Tagged_t kisoSecond_string = 0x4b11;
+  static constexpr Tagged_t kisoYear_string = 0x4b29;
+  static constexpr Tagged_t kIterator_string = 0x4b3d;
+  static constexpr Tagged_t kjsMemoryEstimate_string = 0x4b51;
+  static constexpr Tagged_t kjsMemoryRange_string = 0x4b6d;
+  static constexpr Tagged_t kkeys_string = 0x4b89;
+  static constexpr Tagged_t klargestUnit_string = 0x4b99;
+  static constexpr Tagged_t klast_chunk_handling_string = 0x4bb1;
+  static constexpr Tagged_t klastIndex_string = 0x4bd1;
+  static constexpr Tagged_t klet_string = 0x4be9;
+  static constexpr Tagged_t kline_string = 0x4bf9;
+  static constexpr Tagged_t klinear_string = 0x4c09;
+  static constexpr Tagged_t kLinkError_string = 0x4c1d;
+  static constexpr Tagged_t klong_string = 0x4c35;
+  static constexpr Tagged_t kMap_string = 0x4c45;
+  static constexpr Tagged_t kMapIterator_string = 0x4c55;
+  static constexpr Tagged_t kmax_byte_length_string = 0x4c6d;
+  static constexpr Tagged_t kmedium_string = 0x4c89;
+  static constexpr Tagged_t kmergeFields_string = 0x4c9d;
+  static constexpr Tagged_t kmessage_string = 0x4cb5;
+  static constexpr Tagged_t kmeta_string = 0x4cc9;
+  static constexpr Tagged_t kminus_Infinity_string = 0x4cd9;
+  static constexpr Tagged_t kmicrosecond_string = 0x4cf1;
+  static constexpr Tagged_t kmicroseconds_string = 0x4d09;
+  static constexpr Tagged_t kmillisecond_string = 0x4d21;
+  static constexpr Tagged_t kmilliseconds_string = 0x4d39;
+  static constexpr Tagged_t kminute_string = 0x4d51;
+  static constexpr Tagged_t kminutes_string = 0x4d65;
+  static constexpr Tagged_t kModule_string = 0x4d79;
+  static constexpr Tagged_t kmonth_string = 0x4d8d;
+  static constexpr Tagged_t kmonthDayFromFields_string = 0x4da1;
+  static constexpr Tagged_t kmonths_string = 0x4dc1;
+  static constexpr Tagged_t kmonthsInYear_string = 0x4dd5;
+  static constexpr Tagged_t kmonthCode_string = 0x4ded;
+  static constexpr Tagged_t kmultiline_string = 0x4e05;
+  static constexpr Tagged_t kNaN_string = 0x4e1d;
+  static constexpr Tagged_t knanosecond_string = 0x4e2d;
+  static constexpr Tagged_t knanoseconds_string = 0x4e45;
+  static constexpr Tagged_t knarrow_string = 0x4e5d;
+  static constexpr Tagged_t knative_string = 0x4e71;
+  static constexpr Tagged_t kNFC_string = 0x4e85;
+  static constexpr Tagged_t kNFD_string = 0x4e95;
+  static constexpr Tagged_t kNFKC_string = 0x4ea5;
+  static constexpr Tagged_t kNFKD_string = 0x4eb5;
+  static constexpr Tagged_t knot_equal_string = 0x4ec5;
+  static constexpr Tagged_t knull_string = 0x4edd;
+  static constexpr Tagged_t knull_to_string = 0x4eed;
+  static constexpr Tagged_t kNumber_string = 0x4f09;
+  static constexpr Tagged_t knumber_string = 0x4f1d;
+  static constexpr Tagged_t knumber_to_string = 0x4f31;
+  static constexpr Tagged_t kObject_string = 0x4f4d;
+  static constexpr Tagged_t kobject_string = 0x4f61;
+  static constexpr Tagged_t kobject_to_string = 0x4f75;
+  static constexpr Tagged_t kObject_prototype_string = 0x4f91;
+  static constexpr Tagged_t koffset_string = 0x4fad;
+  static constexpr Tagged_t koffsetNanoseconds_string = 0x4fc1;
+  static constexpr Tagged_t kok_string = 0x4fe1;
+  static constexpr Tagged_t kother_string = 0x4ff1;
+  static constexpr Tagged_t koverflow_string = 0x5005;
+  static constexpr Tagged_t kownKeys_string = 0x5019;
+  static constexpr Tagged_t kpercent_string = 0x502d;
+  static constexpr Tagged_t kplainDate_string = 0x5041;
+  static constexpr Tagged_t kplainTime_string = 0x5059;
+  static constexpr Tagged_t kposition_string = 0x5071;
+  static constexpr Tagged_t kpreventExtensions_string = 0x5085;
+  static constexpr Tagged_t kprivate_constructor_string = 0x50a5;
+  static constexpr Tagged_t kPromise_string = 0x50bd;
+  static constexpr Tagged_t kpromise_string = 0x50d1;
+  static constexpr Tagged_t kproto_string = 0x50e5;
+  static constexpr Tagged_t kproxy_string = 0x50fd;
+  static constexpr Tagged_t kProxy_string = 0x5111;
+  static constexpr Tagged_t kquery_colon_string = 0x5125;
+  static constexpr Tagged_t kRangeError_string = 0x5135;
+  static constexpr Tagged_t kraw_json_string = 0x514d;
+  static constexpr Tagged_t kraw_string = 0x5161;
+  static constexpr Tagged_t kread_string = 0x5171;
+  static constexpr Tagged_t kReferenceError_string = 0x5181;
+  static constexpr Tagged_t kReflectGet_string = 0x519d;
+  static constexpr Tagged_t kReflectHas_string = 0x51b5;
+  static constexpr Tagged_t kRegExp_string = 0x51cd;
+  static constexpr Tagged_t kregexp_to_string = 0x51e1;
+  static constexpr Tagged_t kreject_string = 0x51fd;
+  static constexpr Tagged_t krelativeTo_string = 0x5211;
+  static constexpr Tagged_t kresizable_string = 0x5229;
+  static constexpr Tagged_t kResizableArrayBuffer_string = 0x5241;
+  static constexpr Tagged_t kreturn_string = 0x5261;
+  static constexpr Tagged_t krevoke_string = 0x5275;
+  static constexpr Tagged_t kroundingIncrement_string = 0x5289;
+  static constexpr Tagged_t kRuntimeError_string = 0x52a9;
+  static constexpr Tagged_t kWebAssemblyException_string = 0x52c1;
+  static constexpr Tagged_t kWebAssemblyModule_string = 0x52e5;
+  static constexpr Tagged_t kScript_string = 0x5305;
+  static constexpr Tagged_t kscript_string = 0x5319;
+  static constexpr Tagged_t ksecond_string = 0x532d;
+  static constexpr Tagged_t kseconds_string = 0x5341;
+  static constexpr Tagged_t kshort_string = 0x5355;
+  static constexpr Tagged_t kSet_string = 0x5369;
+  static constexpr Tagged_t ksentence_string = 0x5379;
+  static constexpr Tagged_t kset_space_string = 0x538d;
+  static constexpr Tagged_t kset_string = 0x539d;
+  static constexpr Tagged_t kSetIterator_string = 0x53ad;
+  static constexpr Tagged_t ksetPrototypeOf_string = 0x53c5;
+  static constexpr Tagged_t kShadowRealm_string = 0x53e1;
+  static constexpr Tagged_t kSharedArray_string = 0x53f9;
+  static constexpr Tagged_t kSharedArrayBuffer_string = 0x5411;
+  static constexpr Tagged_t kSharedStruct_string = 0x5431;
+  static constexpr Tagged_t ksign_string = 0x5449;
+  static constexpr Tagged_t ksize_string = 0x5459;
+  static constexpr Tagged_t ksmallestUnit_string = 0x5469;
+  static constexpr Tagged_t ksource_string = 0x5481;
+  static constexpr Tagged_t ksourceText_string = 0x5495;
+  static constexpr Tagged_t kstack_string = 0x54ad;
+  static constexpr Tagged_t kstackTraceLimit_string = 0x54c1;
+  static constexpr Tagged_t kstatic_initializer_string = 0x54dd;
+  static constexpr Tagged_t ksticky_string = 0x54fd;
+  static constexpr Tagged_t kString_string = 0x5511;
+  static constexpr Tagged_t kstring_string = 0x5525;
+  static constexpr Tagged_t kstring_to_string = 0x5539;
+  static constexpr Tagged_t ksuppressed_string = 0x5555;
+  static constexpr Tagged_t kSuppressedError_string = 0x556d;
+  static constexpr Tagged_t kSuspendError_string = 0x5589;
+  static constexpr Tagged_t kSymbol_iterator_string = 0x55a1;
+  static constexpr Tagged_t kSymbol_match_all_string = 0x55bd;
+  static constexpr Tagged_t kSymbol_replace_string = 0x55d9;
+  static constexpr Tagged_t ksymbol_species_string = 0x55f5;
+  static constexpr Tagged_t kSymbol_species_string = 0x5611;
+  static constexpr Tagged_t kSymbol_split_string = 0x562d;
+  static constexpr Tagged_t kSymbol_string = 0x5645;
+  static constexpr Tagged_t ksymbol_string = 0x5659;
+  static constexpr Tagged_t kSyntaxError_string = 0x566d;
+  static constexpr Tagged_t ktarget_string = 0x5685;
+  static constexpr Tagged_t kthis_function_string = 0x5699;
+  static constexpr Tagged_t kthis_string = 0x56b5;
+  static constexpr Tagged_t kthrow_string = 0x56c5;
+  static constexpr Tagged_t ktimed_out_string = 0x56d9;
+  static constexpr Tagged_t ktimeZone_string = 0x56f1;
+  static constexpr Tagged_t ktoJSON_string = 0x5705;
+  static constexpr Tagged_t ktoString_string = 0x5719;
+  static constexpr Tagged_t ktrue_string = 0x572d;
+  static constexpr Tagged_t ktotal_string = 0x573d;
+  static constexpr Tagged_t kTypedArrayLength_string = 0x5751;
+  static constexpr Tagged_t kTypeError_string = 0x577d;
+  static constexpr Tagged_t kUint16Array_string = 0x5795;
+  static constexpr Tagged_t kUint32Array_string = 0x57ad;
+  static constexpr Tagged_t kUint8Array_string = 0x57c5;
+  static constexpr Tagged_t kUint8ClampedArray_string = 0x57dd;
+  static constexpr Tagged_t kundefined_string = 0x57fd;
+  static constexpr Tagged_t kundefined_to_string = 0x5815;
+  static constexpr Tagged_t kunicode_string = 0x5835;
+  static constexpr Tagged_t kunicodeSets_string = 0x5849;
+  static constexpr Tagged_t kunit_string = 0x5861;
+  static constexpr Tagged_t kURIError_string = 0x5871;
+  static constexpr Tagged_t kUTC_string = 0x5885;
+  static constexpr Tagged_t kWeakMap_string = 0x5895;
+  static constexpr Tagged_t kWeakRef_string = 0x58a9;
+  static constexpr Tagged_t kWeakSet_string = 0x58bd;
+  static constexpr Tagged_t kweek_string = 0x58d1;
+  static constexpr Tagged_t kweeks_string = 0x58e1;
+  static constexpr Tagged_t kweekOfYear_string = 0x58f5;
+  static constexpr Tagged_t kwith_string = 0x590d;
+  static constexpr Tagged_t kword_string = 0x591d;
+  static constexpr Tagged_t kwritten_string = 0x592d;
   static constexpr Tagged_t kyearMonthFromFields_string = 0x5941;
   static constexpr Tagged_t kyear_string = 0x5961;
   static constexpr Tagged_t kyears_string = 0x5971;
-  static constexpr Tagged_t kSingleCharacterStringTable = 0x5985;
-  static constexpr Tagged_t kPropertyCellHoleValue = 0x5d8d;
-  static constexpr Tagged_t kHashTableHoleValue = 0x5d99;
-  static constexpr Tagged_t kPromiseHoleValue = 0x5da5;
-  static constexpr Tagged_t kUninitializedValue = 0x5db1;
-  static constexpr Tagged_t kArgumentsMarker = 0x5dbd;
-  static constexpr Tagged_t kTerminationException = 0x5dc9;
-  static constexpr Tagged_t kException = 0x5dd5;
-  static constexpr Tagged_t kOptimizedOut = 0x5de1;
-  static constexpr Tagged_t kStaleRegister = 0x5ded;
-  static constexpr Tagged_t kSelfReferenceMarker = 0x5df9;
-  static constexpr Tagged_t kBasicBlockCountersMarker = 0x5e05;
-  static constexpr Tagged_t karray_buffer_wasm_memory_symbol = 0x5e11;
-  static constexpr Tagged_t kcall_site_info_symbol = 0x5e21;
-  static constexpr Tagged_t kclass_fields_symbol = 0x5e31;
-  static constexpr Tagged_t kclass_positions_symbol = 0x5e41;
-  static constexpr Tagged_t kerror_end_pos_symbol = 0x5e51;
-  static constexpr Tagged_t kerror_message_symbol = 0x5e61;
-  static constexpr Tagged_t kerror_script_symbol = 0x5e71;
-  static constexpr Tagged_t kerror_stack_symbol = 0x5e81;
-  static constexpr Tagged_t kerror_start_pos_symbol = 0x5e91;
-  static constexpr Tagged_t kfrozen_symbol = 0x5ea1;
-  static constexpr Tagged_t kinterpreter_trampoline_symbol = 0x5eb1;
-  static constexpr Tagged_t knative_context_index_symbol = 0x5ec1;
-  static constexpr Tagged_t knonextensible_symbol = 0x5ed1;
-  static constexpr Tagged_t kpromise_debug_message_symbol = 0x5ee1;
-  static constexpr Tagged_t kpromise_forwarding_handler_symbol = 0x5ef1;
-  static constexpr Tagged_t kpromise_handled_by_symbol = 0x5f01;
-  static constexpr Tagged_t kpromise_awaited_by_symbol = 0x5f11;
-  static constexpr Tagged_t kregexp_result_names_symbol = 0x5f21;
-  static constexpr Tagged_t kregexp_result_regexp_input_symbol = 0x5f31;
-  static constexpr Tagged_t kregexp_result_regexp_last_index_symbol = 0x5f41;
-  static constexpr Tagged_t ksealed_symbol = 0x5f51;
+  static constexpr Tagged_t kPropertyCellHoleValue = 0x5985;
+  static constexpr Tagged_t kHashTableHoleValue = 0x5991;
+  static constexpr Tagged_t kPromiseHoleValue = 0x599d;
+  static constexpr Tagged_t kUninitializedValue = 0x59a9;
+  static constexpr Tagged_t kArgumentsMarker = 0x59b5;
+  static constexpr Tagged_t kTerminationException = 0x59c1;
+  static constexpr Tagged_t kException = 0x59cd;
+  static constexpr Tagged_t kOptimizedOut = 0x59d9;
+  static constexpr Tagged_t kStaleRegister = 0x59e5;
+  static constexpr Tagged_t kSelfReferenceMarker = 0x59f1;
+  static constexpr Tagged_t kBasicBlockCountersMarker = 0x59fd;
+  static constexpr Tagged_t karray_buffer_wasm_memory_symbol = 0x5a09;
+  static constexpr Tagged_t kcall_site_info_symbol = 0x5a19;
+  static constexpr Tagged_t kclass_fields_symbol = 0x5a29;
+  static constexpr Tagged_t kclass_positions_symbol = 0x5a39;
+  static constexpr Tagged_t kerror_end_pos_symbol = 0x5a49;
+  static constexpr Tagged_t kerror_message_symbol = 0x5a59;
+  static constexpr Tagged_t kerror_script_symbol = 0x5a69;
+  static constexpr Tagged_t kerror_stack_symbol = 0x5a79;
+  static constexpr Tagged_t kerror_start_pos_symbol = 0x5a89;
+  static constexpr Tagged_t kfrozen_symbol = 0x5a99;
+  static constexpr Tagged_t kinterpreter_trampoline_symbol = 0x5aa9;
+  static constexpr Tagged_t knative_context_index_symbol = 0x5ab9;
+  static constexpr Tagged_t knonextensible_symbol = 0x5ac9;
+  static constexpr Tagged_t kpromise_debug_message_symbol = 0x5ad9;
+  static constexpr Tagged_t kpromise_forwarding_handler_symbol = 0x5ae9;
+  static constexpr Tagged_t kpromise_handled_by_symbol = 0x5af9;
+  static constexpr Tagged_t kpromise_awaited_by_symbol = 0x5b09;
+  static constexpr Tagged_t kregexp_result_names_symbol = 0x5b19;
+  static constexpr Tagged_t kregexp_result_regexp_input_symbol = 0x5b29;
+  static constexpr Tagged_t kregexp_result_regexp_last_index_symbol = 0x5b39;
+  static constexpr Tagged_t ksealed_symbol = 0x5b49;
   static constexpr Tagged_t kshared_struct_map_elements_template_symbol =
-      0x5f61;
-  static constexpr Tagged_t kshared_struct_map_registry_key_symbol = 0x5f71;
-  static constexpr Tagged_t kstrict_function_transition_symbol = 0x5f81;
+      0x5b59;
+  static constexpr Tagged_t kshared_struct_map_registry_key_symbol = 0x5b69;
+  static constexpr Tagged_t kstrict_function_transition_symbol = 0x5b79;
   static constexpr Tagged_t ktemplate_literal_function_literal_id_symbol =
-      0x5f91;
-  static constexpr Tagged_t ktemplate_literal_slot_id_symbol = 0x5fa1;
-  static constexpr Tagged_t kwasm_cross_instance_call_symbol = 0x5fb1;
-  static constexpr Tagged_t kwasm_exception_tag_symbol = 0x5fc1;
-  static constexpr Tagged_t kwasm_exception_values_symbol = 0x5fd1;
-  static constexpr Tagged_t kwasm_uncatchable_symbol = 0x5fe1;
-  static constexpr Tagged_t kwasm_debug_proxy_cache_symbol = 0x5ff1;
-  static constexpr Tagged_t kwasm_debug_proxy_names_symbol = 0x6001;
-  static constexpr Tagged_t kasync_iterator_symbol = 0x6011;
-  static constexpr Tagged_t kintl_fallback_symbol = 0x6041;
-  static constexpr Tagged_t kmatch_symbol = 0x6079;
-  static constexpr Tagged_t ksearch_symbol = 0x60a1;
-  static constexpr Tagged_t kunscopables_symbol = 0x60cd;
-  static constexpr Tagged_t kdispose_symbol = 0x60fd;
-  static constexpr Tagged_t kasync_dispose_symbol = 0x6129;
-  static constexpr Tagged_t khas_instance_symbol = 0x6159;
-  static constexpr Tagged_t kto_string_tag_symbol = 0x6189;
-  static constexpr Tagged_t kconstructor_string = 0x6201;
-  static constexpr Tagged_t klength_string = 0x6219;
-  static constexpr Tagged_t knext_string = 0x622d;
-  static constexpr Tagged_t kresolve_string = 0x623d;
-  static constexpr Tagged_t kthen_string = 0x6251;
-  static constexpr Tagged_t kvalueOf_string = 0x6261;
-  static constexpr Tagged_t kiterator_symbol = 0x6275;
-  static constexpr Tagged_t kmatch_all_symbol = 0x6285;
-  static constexpr Tagged_t kreplace_symbol = 0x6295;
-  static constexpr Tagged_t kspecies_symbol = 0x62a5;
-  static constexpr Tagged_t ksplit_symbol = 0x62b5;
-  static constexpr Tagged_t kto_primitive_symbol = 0x62c5;
-  static constexpr Tagged_t kis_concat_spreadable_symbol = 0x62d5;
-  static constexpr Tagged_t kEmptySlowElementDictionary = 0x62e5;
-  static constexpr Tagged_t kEmptySymbolTable = 0x6309;
-  static constexpr Tagged_t kEmptyOrderedHashMap = 0x6325;
-  static constexpr Tagged_t kEmptyOrderedHashSet = 0x6339;
-  static constexpr Tagged_t kEmptyFeedbackMetadata = 0x634d;
-  static constexpr Tagged_t kGlobalThisBindingScopeInfo = 0x6359;
-  static constexpr Tagged_t kEmptyFunctionScopeInfo = 0x6379;
-  static constexpr Tagged_t kNativeScopeInfo = 0x639d;
-  static constexpr Tagged_t kShadowRealmScopeInfo = 0x63b5;
-  static constexpr Tagged_t kManyClosuresCell = 0x63cd;
-  static constexpr Tagged_t kWasmNullPadding = 0x63dd;
+      0x5b89;
+  static constexpr Tagged_t ktemplate_literal_slot_id_symbol = 0x5b99;
+  static constexpr Tagged_t kwasm_cross_instance_call_symbol = 0x5ba9;
+  static constexpr Tagged_t kwasm_exception_tag_symbol = 0x5bb9;
+  static constexpr Tagged_t kwasm_exception_values_symbol = 0x5bc9;
+  static constexpr Tagged_t kwasm_uncatchable_symbol = 0x5bd9;
+  static constexpr Tagged_t kwasm_debug_proxy_cache_symbol = 0x5be9;
+  static constexpr Tagged_t kwasm_debug_proxy_names_symbol = 0x5bf9;
+  static constexpr Tagged_t kasync_iterator_symbol = 0x5c09;
+  static constexpr Tagged_t kintl_fallback_symbol = 0x5c39;
+  static constexpr Tagged_t kmatch_symbol = 0x5c71;
+  static constexpr Tagged_t ksearch_symbol = 0x5c99;
+  static constexpr Tagged_t kunscopables_symbol = 0x5cc5;
+  static constexpr Tagged_t kdispose_symbol = 0x5cf5;
+  static constexpr Tagged_t kasync_dispose_symbol = 0x5d21;
+  static constexpr Tagged_t khas_instance_symbol = 0x5d51;
+  static constexpr Tagged_t kto_string_tag_symbol = 0x5d81;
+  static constexpr Tagged_t kconstructor_string = 0x5df9;
+  static constexpr Tagged_t klength_string = 0x5e11;
+  static constexpr Tagged_t knext_string = 0x5e25;
+  static constexpr Tagged_t kresolve_string = 0x5e35;
+  static constexpr Tagged_t kthen_string = 0x5e49;
+  static constexpr Tagged_t kvalueOf_string = 0x5e59;
+  static constexpr Tagged_t kiterator_symbol = 0x5e6d;
+  static constexpr Tagged_t kmatch_all_symbol = 0x5e7d;
+  static constexpr Tagged_t kreplace_symbol = 0x5e8d;
+  static constexpr Tagged_t kspecies_symbol = 0x5e9d;
+  static constexpr Tagged_t ksplit_symbol = 0x5ead;
+  static constexpr Tagged_t kto_primitive_symbol = 0x5ebd;
+  static constexpr Tagged_t kis_concat_spreadable_symbol = 0x5ecd;
+  static constexpr Tagged_t kEmptySlowElementDictionary = 0x5edd;
+  static constexpr Tagged_t kEmptySymbolTable = 0x5f01;
+  static constexpr Tagged_t kEmptyOrderedHashMap = 0x5f1d;
+  static constexpr Tagged_t kEmptyOrderedHashSet = 0x5f31;
+  static constexpr Tagged_t kEmptyFeedbackMetadata = 0x5f45;
+  static constexpr Tagged_t kGlobalThisBindingScopeInfo = 0x5f51;
+  static constexpr Tagged_t kEmptyFunctionScopeInfo = 0x5f71;
+  static constexpr Tagged_t kNativeScopeInfo = 0x5f95;
+  static constexpr Tagged_t kShadowRealmScopeInfo = 0x5fad;
+  static constexpr Tagged_t kManyClosuresCell = 0x5fc5;
+  static constexpr Tagged_t kWasmNullPadding = 0x5fd5;
   static constexpr Tagged_t kWasmNull = 0xfffd;
   static constexpr Tagged_t kJSMessageObjectMap = 0x20001;
   static constexpr Tagged_t kExternalMap = 0x20029;
-  static constexpr Tagged_t kJSSharedArrayMap = 0x20051;
-  static constexpr Tagged_t kJSAtomicsMutexMap = 0x20095;
-  static constexpr Tagged_t kJSAtomicsConditionMap = 0x200bd;
+  static constexpr Tagged_t kCppHeapExternalMap = 0x20051;
+  static constexpr Tagged_t kJSSharedArrayMap = 0x20079;
+  static constexpr Tagged_t kJSAtomicsMutexMap = 0x200c1;
+  static constexpr Tagged_t kJSAtomicsConditionMap = 0x200e9;
+  static constexpr Tagged_t kNoOpInterceptorInfo = 0x20111;
 
   static constexpr Tagged_t kFirstAllocatedRoot = 0x11;
-  static constexpr Tagged_t kLastAllocatedRoot = 0x200bd;
+  static constexpr Tagged_t kLastAllocatedRoot = 0x20111;
 };
 
-static constexpr std::array<Tagged_t, 1028> StaticReadOnlyRootsPointerTable = {
+static constexpr std::array<Tagged_t, 1030> StaticReadOnlyRootsPointerTable = {
     StaticReadOnlyRoot::kFreeSpaceMap,
     StaticReadOnlyRoot::kOnePointerFillerMap,
     StaticReadOnlyRoot::kTwoPointerFillerMap,
@@ -1113,7 +1115,7 @@ static constexpr std::array<Tagged_t, 1028> StaticReadOnlyRootsPointerTable = {
     StaticReadOnlyRoot::kCoverageInfoMap,
     StaticReadOnlyRoot::kDictionaryTemplateInfoMap,
     StaticReadOnlyRoot::kGlobalDictionaryMap,
-    StaticReadOnlyRoot::kGlobalContextSidePropertyCellMap,
+    StaticReadOnlyRoot::kContextCellMap,
     StaticReadOnlyRoot::kManyClosuresCellMap,
     StaticReadOnlyRoot::kMegaDomHandlerMap,
     StaticReadOnlyRoot::kModuleInfoMap,
@@ -1129,11 +1131,13 @@ static constexpr std::array<Tagged_t, 1028> StaticReadOnlyRootsPointerTable = {
     StaticReadOnlyRoot::kPreparseDataMap,
     StaticReadOnlyRoot::kPropertyArrayMap,
     StaticReadOnlyRoot::kAccessorInfoMap,
+    StaticReadOnlyRoot::kInterceptorInfoMap,
     StaticReadOnlyRoot::kRegExpMatchInfoMap,
     StaticReadOnlyRoot::kRegExpDataMap,
     StaticReadOnlyRoot::kAtomRegExpDataMap,
     StaticReadOnlyRoot::kIrRegExpDataMap,
     StaticReadOnlyRoot::kSimpleNumberDictionaryMap,
+    StaticReadOnlyRoot::kSimpleNameDictionaryMap,
     StaticReadOnlyRoot::kSmallOrderedHashMapMap,
     StaticReadOnlyRoot::kSmallOrderedHashSetMap,
     StaticReadOnlyRoot::kSmallOrderedNameDictionaryMap,
@@ -1142,7 +1146,6 @@ static constexpr std::array<Tagged_t, 1028> StaticReadOnlyRootsPointerTable = {
     StaticReadOnlyRoot::kSyntheticModuleMap,
     StaticReadOnlyRoot::kWasmImportDataMap,
     StaticReadOnlyRoot::kWasmCapiFunctionDataMap,
-    StaticReadOnlyRoot::kWasmContinuationObjectMap,
     StaticReadOnlyRoot::kWasmDispatchTableMap,
     StaticReadOnlyRoot::kWasmExportedFunctionDataMap,
     StaticReadOnlyRoot::kWasmInternalFunctionMap,
@@ -1223,7 +1226,6 @@ static constexpr std::array<Tagged_t, 1028> StaticReadOnlyRootsPointerTable = {
     StaticReadOnlyRoot::kMaxUInt32,
     StaticReadOnlyRoot::kSmiMinValue,
     StaticReadOnlyRoot::kSmiMaxValuePlusOne,
-    StaticReadOnlyRoot::kSingleCharacterStringTable,
     StaticReadOnlyRoot::kSelfReferenceMarker,
     StaticReadOnlyRoot::kBasicBlockCountersMarker,
     StaticReadOnlyRoot::kGlobalThisBindingScopeInfo,
@@ -1858,6 +1860,7 @@ static constexpr std::array<Tagged_t, 1028> StaticReadOnlyRootsPointerTable = {
     StaticReadOnlyRoot::kRangeError_string,
     StaticReadOnlyRoot::kraw_json_string,
     StaticReadOnlyRoot::kraw_string,
+    StaticReadOnlyRoot::kread_string,
     StaticReadOnlyRoot::kReferenceError_string,
     StaticReadOnlyRoot::kReflectGet_string,
     StaticReadOnlyRoot::kReflectHas_string,
@@ -1943,6 +1946,7 @@ static constexpr std::array<Tagged_t, 1028> StaticReadOnlyRootsPointerTable = {
     StaticReadOnlyRoot::kweekOfYear_string,
     StaticReadOnlyRoot::kwith_string,
     StaticReadOnlyRoot::kword_string,
+    StaticReadOnlyRoot::kwritten_string,
     StaticReadOnlyRoot::kyearMonthFromFields_string,
     StaticReadOnlyRoot::kyear_string,
     StaticReadOnlyRoot::kyears_string,
@@ -2015,7 +2019,6 @@ static constexpr std::array<Tagged_t, 1028> StaticReadOnlyRootsPointerTable = {
     StaticReadOnlyRoot::kEnumCacheMap,
     StaticReadOnlyRoot::kErrorStackDataMap,
     StaticReadOnlyRoot::kFunctionTemplateRareDataMap,
-    StaticReadOnlyRoot::kInterceptorInfoMap,
     StaticReadOnlyRoot::kModuleRequestMap,
     StaticReadOnlyRoot::kPromiseCapabilityMap,
     StaticReadOnlyRoot::kPromiseReactionMap,
@@ -2091,6 +2094,7 @@ static constexpr std::array<Tagged_t, 1028> StaticReadOnlyRootsPointerTable = {
     StaticReadOnlyRoot::kStoreHandler3Map,
     StaticReadOnlyRoot::kExternalMap,
     StaticReadOnlyRoot::kJSMessageObjectMap,
+    StaticReadOnlyRoot::kCppHeapExternalMap,
 };
 
 }  // namespace internal
diff --git a/deps/v8/src/runtime/runtime-array.cc b/deps/v8/src/runtime/runtime-array.cc
index 2d781ce6e52af2..3c8bb8e5a1a629 100644
--- a/deps/v8/src/runtime/runtime-array.cc
+++ b/deps/v8/src/runtime/runtime-array.cc
@@ -20,7 +20,8 @@ RUNTIME_FUNCTION(Runtime_TransitionElementsKind) {
   DirectHandle<JSObject> object = args.at<JSObject>(0);
   DirectHandle<Map> to_map = args.at<Map>(1);
   ElementsKind to_kind = to_map->elements_kind();
-  ElementsAccessor::ForKind(to_kind)->TransitionElementsKind(object, to_map);
+  ElementsAccessor::ForKind(to_kind)->TransitionElementsKind(isolate, object,
+                                                             to_map);
   return *object;
 }
 
@@ -29,7 +30,7 @@ RUNTIME_FUNCTION(Runtime_TransitionElementsKindWithKind) {
   DCHECK_EQ(2, args.length());
   DirectHandle<JSObject> object = args.at<JSObject>(0);
   ElementsKind to_kind = static_cast<ElementsKind>(args.smi_value_at(1));
-  JSObject::TransitionElementsKind(object, to_kind);
+  JSObject::TransitionElementsKind(isolate, object, to_kind);
   return *object;
 }
 
@@ -112,8 +113,8 @@ RUNTIME_FUNCTION(Runtime_NewArray) {
       array, 0, 0, ArrayStorageAllocationMode::DONT_INITIALIZE_ARRAY_ELEMENTS);
 
   ElementsKind old_kind = array->GetElementsKind();
-  RETURN_FAILURE_ON_EXCEPTION(isolate,
-                              ArrayConstructInitializeElements(array, &argv));
+  RETURN_FAILURE_ON_EXCEPTION(
+      isolate, ArrayConstructInitializeElements(isolate, array, &argv));
   if (!site.is_null()) {
     if ((old_kind != array->GetElementsKind() || !can_use_type_feedback ||
          !can_inline_array_constructor)) {
@@ -144,7 +145,7 @@ RUNTIME_FUNCTION(Runtime_NormalizeElements) {
   DirectHandle<JSObject> array = args.at<JSObject>(0);
   CHECK(!array->HasTypedArrayOrRabGsabTypedArrayElements());
   CHECK(!IsJSGlobalProxy(*array));
-  JSObject::NormalizeElements(array);
+  JSObject::NormalizeElements(isolate, array);
   return *array;
 }
 
@@ -177,7 +178,7 @@ RUNTIME_FUNCTION(Runtime_GrowArrayElements) {
     bool has_grown;
     MAYBE_ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
         isolate, has_grown,
-        object->GetElementsAccessor()->GrowCapacity(object, index));
+        object->GetElementsAccessor()->GrowCapacity(isolate, object, index));
     if (!has_grown) {
       return Smi::zero();
     }
diff --git a/deps/v8/src/runtime/runtime-classes.cc b/deps/v8/src/runtime/runtime-classes.cc
index cbcc27c3191fcd..6909f0b9088138 100644
--- a/deps/v8/src/runtime/runtime-classes.cc
+++ b/deps/v8/src/runtime/runtime-classes.cc
@@ -39,7 +39,7 @@ RUNTIME_FUNCTION(Runtime_ThrowConstructorNonCallableError) {
   DirectHandle<Context> context(constructor->native_context(), isolate);
   DCHECK(IsNativeContext(*context));
   DirectHandle<JSFunction> realm_type_error_function(
-      Cast<JSFunction>(context->get(Context::TYPE_ERROR_FUNCTION_INDEX)),
+      Cast<JSFunction>(context->GetNoCell(Context::TYPE_ERROR_FUNCTION_INDEX)),
       isolate);
   if (name->length() == 0) {
     THROW_NEW_ERROR_RETURN_FAILURE(
@@ -159,7 +159,7 @@ MaybeDirectHandle<Object> GetMethodAndSetName(Isolate* isolate,
     // property name is properly converted to Name. So, we can actually be smart
     // here and avoid converting Smi keys back to Name.
     DirectHandle<Name> name = KeyToName<Dictionary>(isolate, key);
-    if (!JSFunction::SetName(method, name, name_prefix)) {
+    if (!JSFunction::SetName(isolate, method, name, name_prefix)) {
       return MaybeDirectHandle<Object>();
     }
   }
diff --git a/deps/v8/src/runtime/runtime-compiler.cc b/deps/v8/src/runtime/runtime-compiler.cc
index 3c2a6c59aa5bef..9a86ce31354215 100644
--- a/deps/v8/src/runtime/runtime-compiler.cc
+++ b/deps/v8/src/runtime/runtime-compiler.cc
@@ -100,7 +100,7 @@ RUNTIME_FUNCTION(Runtime_InstallBaselineCode) {
     }
     DisallowGarbageCollection no_gc;
     Tagged<Code> baseline_code = sfi->baseline_code(kAcquireLoad);
-    function->UpdateCodeKeepTieringRequests(baseline_code);
+    function->UpdateCodeKeepTieringRequests(isolate, baseline_code);
 #ifdef V8_ENABLE_LEAPTIERING
     return baseline_code;
   }
@@ -125,7 +125,7 @@ RUNTIME_FUNCTION(Runtime_InstallSFICode) {
     Tagged<Code> sfi_code = sfi->GetCode(isolate);
     if (V8_LIKELY(sfi_code->kind() != CodeKind::BASELINE ||
                   function->has_feedback_vector())) {
-      function->UpdateCode(sfi_code);
+      function->UpdateCode(isolate, sfi_code);
       return sfi_code;
     }
   }
@@ -137,7 +137,7 @@ RUNTIME_FUNCTION(Runtime_InstallSFICode) {
   JSFunction::CreateAndAttachFeedbackVector(isolate, function,
                                             &is_compiled_scope);
   Tagged<Code> sfi_code = function->shared()->GetCode(isolate);
-  function->UpdateCode(sfi_code);
+  function->UpdateCode(isolate, sfi_code);
   return sfi_code;
 }
 
@@ -391,7 +391,7 @@ RUNTIME_FUNCTION(Runtime_InstantiateAsmJs) {
   shared->set_is_asm_wasm_broken(true);
 #endif
   DCHECK_EQ(function->code(isolate), *BUILTIN_CODE(isolate, InstantiateAsmJs));
-  function->UpdateCode(*BUILTIN_CODE(isolate, CompileLazy));
+  function->UpdateCode(isolate, *BUILTIN_CODE(isolate, CompileLazy));
   DCHECK(!isolate->has_exception());
   return Smi::zero();
 }
@@ -666,7 +666,7 @@ Tagged<Object> CompileOptimizedOSR(Isolate* isolate,
 
 #ifndef V8_ENABLE_LEAPTIERING
     if (!function->HasAttachedOptimizedCode(isolate)) {
-      function->UpdateCode(function->shared()->GetCode(isolate));
+      function->UpdateCode(isolate, function->shared()->GetCode(isolate));
     }
 #endif  // V8_ENABLE_LEAPTIERING
 
@@ -849,9 +849,9 @@ static Tagged<Object> CompileGlobalEval(
   }
   ASSIGN_RETURN_ON_EXCEPTION_VALUE(
       isolate, compiled,
-      Compiler::GetFunctionFromEval(source.ToHandleChecked(), outer_info,
-                                    context, language_mode, restriction,
-                                    kNoSourcePosition, eval_position),
+      Compiler::GetFunctionFromEval(
+          isolate, source.ToHandleChecked(), outer_info, context, language_mode,
+          restriction, kNoSourcePosition, eval_position),
       ReadOnlyRoots(isolate).exception());
   return *compiled;
 }
diff --git a/deps/v8/src/runtime/runtime-forin.cc b/deps/v8/src/runtime/runtime-forin.cc
index 30bf9ab3063e76..3a9795bb70ee06 100644
--- a/deps/v8/src/runtime/runtime-forin.cc
+++ b/deps/v8/src/runtime/runtime-forin.cc
@@ -76,8 +76,7 @@ MaybeDirectHandle<Object> HasEnumerableProperty(
         }
       }
       case LookupIterator::WASM_OBJECT:
-        THROW_NEW_ERROR(isolate,
-                        NewTypeError(MessageTemplate::kWasmObjectsAreOpaque));
+        continue;  // Continue to the prototype, if present.
       case LookupIterator::INTERCEPTOR: {
         result = JSObject::GetPropertyAttributesWithInterceptor(&it);
         if (result.IsNothing()) return MaybeDirectHandle<Object>();
diff --git a/deps/v8/src/runtime/runtime-internal.cc b/deps/v8/src/runtime/runtime-internal.cc
index 5de56638f4429e..28aee675eab7aa 100644
--- a/deps/v8/src/runtime/runtime-internal.cc
+++ b/deps/v8/src/runtime/runtime-internal.cc
@@ -15,6 +15,7 @@
 #include "src/handles/maybe-handles.h"
 #include "src/logging/counters.h"
 #include "src/numbers/conversions.h"
+#include "src/objects/contexts.h"
 #include "src/objects/template-objects-inl.h"
 #include "src/runtime/runtime-utils.h"
 #include "src/utils/ostreams.h"
@@ -438,7 +439,6 @@ RUNTIME_FUNCTION(Runtime_BytecodeBudgetInterruptWithStackCheck_Maglev) {
 
 RUNTIME_FUNCTION(Runtime_AllocateInYoungGeneration) {
   HandleScope scope(isolate);
-  DCHECK(isolate->IsOnCentralStack());
   DCHECK_EQ(2, args.length());
   // TODO(v8:13070): Align allocations in the builtins that call this.
   int size = ALIGN_TO_ALLOCATION_ALIGNMENT(args.smi_value_at(0));
@@ -482,6 +482,30 @@ RUNTIME_FUNCTION(Runtime_AllocateInOldGeneration) {
       size, alignment, AllocationType::kOld, AllocationOrigin::kGeneratedCode);
 }
 
+RUNTIME_FUNCTION(Runtime_AllocateInSharedHeap) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(2, args.length());
+  // TODO(v8:13070): Align allocations in the builtins that call this.
+  int size = ALIGN_TO_ALLOCATION_ALIGNMENT(args.smi_value_at(0));
+  int flags = args.smi_value_at(1);
+  AllocationAlignment alignment =
+      AllocateDoubleAlignFlag::decode(flags) ? kDoubleAligned : kTaggedAligned;
+  CHECK(IsAligned(size, kTaggedSize));
+  CHECK_GT(size, 0);
+
+#if V8_ENABLE_WEBASSEMBLY
+  // When this is called from WasmGC code, clear the "thread in wasm" flag,
+  // which is important in case any GC needs to happen.
+  // TODO(chromium:1236668): Find a better fix, likely by replacing the global
+  // flag.
+  SaveAndClearThreadInWasmFlag clear_wasm_flag(isolate);
+#endif  // V8_ENABLE_WEBASSEMBLY
+
+  return *isolate->factory()->NewFillerObject(size, alignment,
+                                              AllocationType::kSharedOld,
+                                              AllocationOrigin::kGeneratedCode);
+}
+
 RUNTIME_FUNCTION(Runtime_AllocateByteArray) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
@@ -756,16 +780,18 @@ RUNTIME_FUNCTION(Runtime_SharedValueBarrierSlow) {
   return *shared_value;
 }
 
-RUNTIME_FUNCTION(Runtime_InvalidateDependentCodeForScriptContextSlot) {
+RUNTIME_FUNCTION(Runtime_NotifyContextCellStateWillChange) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
-  auto const_tracking_let_cell =
-      Cast<ContextSidePropertyCell>(args.at<HeapObject>(0));
+  auto cell = Cast<ContextCell>(args.at<HeapObject>(0));
   DependentCode::DeoptimizeDependencyGroups(
-      isolate, *const_tracking_let_cell,
-      DependentCode::kScriptContextSlotPropertyChangedGroup);
+      isolate, *cell, DependentCode::kContextCellChangedGroup);
   return ReadOnlyRoots(isolate).undefined_value();
 }
 
+RUNTIME_FUNCTION(Runtime_AddLhsIsStringConstantInternalize) {
+  UNREACHABLE();  // Lowered to a builtin call instead.
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/src/runtime/runtime-literals.cc b/deps/v8/src/runtime/runtime-literals.cc
index 829e21ef806843..af59ac470592e7 100644
--- a/deps/v8/src/runtime/runtime-literals.cc
+++ b/deps/v8/src/runtime/runtime-literals.cc
@@ -393,7 +393,7 @@ Handle<JSObject> CreateObjectLiteral(
           map, number_of_properties, allocation);
 
   // Normalize the elements of the boilerplate to save space if needed.
-  if (!use_fast_elements) JSObject::NormalizeElements(boilerplate);
+  if (!use_fast_elements) JSObject::NormalizeElements(isolate, boilerplate);
 
   // Add the constant properties to the boilerplate.
   int length = object_boilerplate_description->boilerplate_properties_count();
diff --git a/deps/v8/src/runtime/runtime-object.cc b/deps/v8/src/runtime/runtime-object.cc
index 59a1c8d9649022..59cbbe9da77d90 100644
--- a/deps/v8/src/runtime/runtime-object.cc
+++ b/deps/v8/src/runtime/runtime-object.cc
@@ -320,7 +320,7 @@ RUNTIME_FUNCTION(Runtime_AddPrivateBrand) {
   DCHECK_GE(depth, 0);
   for (; depth > 0; depth--) {
     context = direct_handle(
-        Cast<Context>(context->get(Context::PREVIOUS_INDEX)), isolate);
+        Cast<Context>(context->GetNoCell(Context::PREVIOUS_INDEX)), isolate);
   }
   DCHECK_EQ(context->scope_info()->scope_type(), ScopeType::CLASS_SCOPE);
   Maybe<bool> added_brand = Object::AddDataProperty(
@@ -697,7 +697,8 @@ RUNTIME_FUNCTION(Runtime_GetProperty) {
         if (Smi::ToInt(*key_obj) >= lookup_start_object->elements()->length()) {
           elements_kind = IsHoleyElementsKind(elements_kind) ? HOLEY_ELEMENTS
                                                              : PACKED_ELEMENTS;
-          JSObject::TransitionElementsKind(lookup_start_object, elements_kind);
+          JSObject::TransitionElementsKind(isolate, lookup_start_object,
+                                           elements_kind);
         }
       } else {
         DCHECK(IsSmiOrObjectElementsKind(elements_kind) ||
@@ -974,7 +975,7 @@ RUNTIME_FUNCTION(Runtime_SetFunctionName) {
   auto function = Cast<JSFunction>(value);
   DCHECK(!function->shared()->HasSharedName());
   DirectHandle<Map> function_map(function->map(), isolate);
-  if (!JSFunction::SetName(function, name,
+  if (!JSFunction::SetName(isolate, function, name,
                            isolate->factory()->empty_string())) {
     return ReadOnlyRoots(isolate).exception();
   }
@@ -1022,7 +1023,7 @@ RUNTIME_FUNCTION(Runtime_DefineKeyedOwnPropertyInLiteral) {
     auto function = Cast<JSFunction>(value);
     DCHECK(!function->shared()->HasSharedName());
     DirectHandle<Map> function_map(function->map(), isolate);
-    if (!JSFunction::SetName(function, Cast<Name>(name),
+    if (!JSFunction::SetName(isolate, function, Cast<Name>(name),
                              isolate->factory()->empty_string())) {
       return ReadOnlyRoots(isolate).exception();
     }
@@ -1080,7 +1081,8 @@ RUNTIME_FUNCTION(Runtime_DefineGetterPropertyUnchecked) {
 
   if (Cast<String>(getter->shared()->Name())->length() == 0) {
     DirectHandle<Map> getter_map(getter->map(), isolate);
-    if (!JSFunction::SetName(getter, name, isolate->factory()->get_string())) {
+    if (!JSFunction::SetName(isolate, getter, name,
+                             isolate->factory()->get_string())) {
       return ReadOnlyRoots(isolate).exception();
     }
     CHECK_EQ(*getter_map, getter->map());
@@ -1226,7 +1228,8 @@ RUNTIME_FUNCTION(Runtime_DefineSetterPropertyUnchecked) {
 
   if (Cast<String>(setter->shared()->Name())->length() == 0) {
     DirectHandle<Map> setter_map(setter->map(), isolate);
-    if (!JSFunction::SetName(setter, name, isolate->factory()->set_string())) {
+    if (!JSFunction::SetName(isolate, setter, name,
+                             isolate->factory()->set_string())) {
       return ReadOnlyRoots(isolate).exception();
     }
     CHECK_EQ(*setter_map, setter->map());
@@ -1369,14 +1372,14 @@ void CollectPrivateMethodsAndAccessorsFromContext(
     std::vector<PrivateMember>* results) {
   DirectHandle<ScopeInfo> scope_info(context->scope_info(), isolate);
   VariableLookupResult lookup_result;
-  int context_index = scope_info->ContextSlotIndex(desc, &lookup_result);
+  int context_index = scope_info->ContextSlotIndex(*desc, &lookup_result);
   if (context_index == -1 ||
       !IsPrivateMethodOrAccessorVariableMode(lookup_result.mode) ||
       lookup_result.is_static_flag != is_static_flag) {
     return;
   }
 
-  Handle<Object> slot_value(context->get(context_index), isolate);
+  Handle<Object> slot_value(context->GetNoCell(context_index), isolate);
   DCHECK_IMPLIES(lookup_result.mode == VariableMode::kPrivateMethod,
                  IsJSFunction(*slot_value));
   DCHECK_IMPLIES(lookup_result.mode != VariableMode::kPrivateMethod,
diff --git a/deps/v8/src/runtime/runtime-regexp.cc b/deps/v8/src/runtime/runtime-regexp.cc
index 1ae1df6fb23095..5689cdc8d1db0b 100644
--- a/deps/v8/src/runtime/runtime-regexp.cc
+++ b/deps/v8/src/runtime/runtime-regexp.cc
@@ -1880,6 +1880,28 @@ RUNTIME_FUNCTION(Runtime_RegExpSplit) {
   return *NewJSArrayWithElements(isolate, elems, num_elems);
 }
 
+namespace {
+
+template <typename Char>
+inline bool IsContainFlagImpl(Isolate* isolate, base::Vector<const Char> flags,
+                              const char* target,
+                              DisallowGarbageCollection& no_gc) {
+  StringSearch<uint8_t, Char> search(isolate, base::OneByteVector(target));
+  return search.Search(flags, 0) >= 0;
+}
+
+inline bool IsContainFlag(Isolate* isolate, String::FlatContent& flags,
+                          const char* target,
+                          DisallowGarbageCollection& no_gc) {
+  return flags.IsOneByte()
+             ? IsContainFlagImpl<uint8_t>(isolate, flags.ToOneByteVector(),
+                                          target, no_gc)
+             : IsContainFlagImpl<base::uc16>(isolate, flags.ToUC16Vector(),
+                                             target, no_gc);
+}
+
+}  // namespace
+
 // Slow path for:
 // ES#sec-regexp.prototype-@@replace
 // RegExp.prototype [ @@replace ] ( string, replaceValue )
@@ -1917,21 +1939,37 @@ RUNTIME_FUNCTION(Runtime_RegExpReplaceRT) {
   }
 
   const uint32_t length = string->length();
+  bool global = false;
+  bool fullUnicode = false;
+
+  DirectHandle<Object> flags_obj;
+  DirectHandle<String> flag_str;
 
-  DirectHandle<Object> global_obj;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, global_obj,
-      JSReceiver::GetProperty(isolate, recv, factory->global_string()));
-  const bool global = Object::BooleanValue(*global_obj, isolate);
+      isolate, flags_obj,
+      JSReceiver::GetProperty(isolate, recv, factory->flags_string()));
 
-  bool unicode = false;
-  if (global) {
-    DirectHandle<Object> unicode_obj;
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-        isolate, unicode_obj,
-        JSReceiver::GetProperty(isolate, recv, factory->unicode_string()));
-    unicode = Object::BooleanValue(*unicode_obj, isolate);
+  // 7. Let flags be ? ToString(? Get(rx, "flags")).
+  // 8. If flags contains "g", let global be true. Otherwise, let global be
+  // false.
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, flag_str,
+                                     Object::ToString(isolate, flags_obj));
+  flag_str = String::Flatten(isolate, flag_str);
+  {
+    DisallowGarbageCollection no_gc;
+    String::FlatContent flat_flag = flag_str->GetFlatContent(no_gc);
 
+    global = IsContainFlag(isolate, flat_flag, "g", no_gc);
+
+    if (global) {
+      // b. If flags contains "u" or flags contains "v", let fullUnicode be
+      // true. Otherwise, let fullUnicode be false.
+      fullUnicode = IsContainFlag(isolate, flat_flag, "u", no_gc) ||
+                    IsContainFlag(isolate, flat_flag, "v", no_gc);
+    }
+  }
+
+  if (global) {
     RETURN_FAILURE_ON_EXCEPTION(isolate,
                                 RegExpUtils::SetLastIndex(isolate, recv, 0));
   }
@@ -1968,7 +2006,7 @@ RUNTIME_FUNCTION(Runtime_RegExpReplaceRT) {
       if (match->length() == 0) {
         RETURN_FAILURE_ON_EXCEPTION(
             isolate, RegExpUtils::SetAdvancedStringIndex(isolate, recv, string,
-                                                         unicode));
+                                                         fullUnicode));
       }
     }
   }
diff --git a/deps/v8/src/runtime/runtime-scopes.cc b/deps/v8/src/runtime/runtime-scopes.cc
index 9affb1db0c5994..603d82982fceb2 100644
--- a/deps/v8/src/runtime/runtime-scopes.cc
+++ b/deps/v8/src/runtime/runtime-scopes.cc
@@ -427,7 +427,7 @@ Tagged<Object> DeclareEvalHelper(Isolate* isolate, Handle<String> name,
 
     if (index != Context::kNotFound) {
       DCHECK(holder.is_identical_to(context));
-      context->set(index, *value);
+      context->SetNoCell(index, *value);
       return ReadOnlyRoots(isolate).undefined_value();
     }
 
@@ -834,21 +834,15 @@ MaybeDirectHandle<Object> LoadLookupSlot(
     // If the "property" we were looking for is a local variable, the
     // receiver is the global object; see ECMA-262, 3rd., 10.1.6 and 10.2.3.
     Handle<Object> receiver = isolate->factory()->undefined_value();
-    DirectHandle<Object> value =
-        direct_handle(holder_context->get(index), isolate);
     // Check for uninitialized bindings.
-    if (flag == kNeedsInitialization && IsTheHole(*value, isolate)) {
+    if (flag == kNeedsInitialization &&
+        holder_context->IsElementTheHole(index)) {
       THROW_NEW_ERROR(isolate,
                       NewReferenceError(MessageTemplate::kNotDefined, name));
     }
-    DCHECK(!IsTheHole(*value, isolate));
     if (receiver_return) *receiver_return = receiver;
-    if (v8_flags.script_context_mutable_heap_number &&
-        holder_context->IsScriptContext()) {
-      return direct_handle(*Context::LoadScriptContextElement(
-                               holder_context, index, value, isolate),
-                           isolate);
-    }
+    DirectHandle<Object> value = Context::Get(holder_context, index, isolate);
+    DCHECK(!IsTheHole(*value, isolate));
     return value;
   }
 
@@ -966,19 +960,12 @@ MaybeDirectHandle<Object> StoreLookupSlot(
   if (index != Context::kNotFound) {
     auto holder_context = Cast<Context>(holder);
     if (flag == kNeedsInitialization &&
-        IsTheHole(holder_context->get(index), isolate)) {
+        holder_context->IsElementTheHole(index)) {
       THROW_NEW_ERROR(isolate,
                       NewReferenceError(MessageTemplate::kNotDefined, name));
     }
     if ((attributes & READ_ONLY) == 0) {
-      if ((v8_flags.script_context_mutable_heap_number ||
-           v8_flags.const_tracking_let) &&
-          holder_context->IsScriptContext()) {
-        Context::StoreScriptContextAndUpdateSlotProperty(holder_context, index,
-                                                         value, isolate);
-      } else {
-        Cast<Context>(holder)->set(index, *value);
-      }
+      Context::Set(holder_context, index, value, isolate);
     } else if (!is_sloppy_function_name || is_strict(language_mode)) {
       THROW_NEW_ERROR(isolate,
                       NewTypeError(MessageTemplate::kConstAssign, name));
@@ -1063,17 +1050,7 @@ RUNTIME_FUNCTION(Runtime_StoreGlobalNoHoleCheckForReplLetOrConst) {
   CHECK(found);
   DirectHandle<Context> script_context(
       script_contexts->get(lookup_result.context_index), isolate);
-  // We need to initialize the side data also for variables declared with
-  // VariableMode::kConst. This is because such variables can be accessed
-  // by functions using the LdaContextSlot bytecode, and such accesses are not
-  // regarded as "immutable" when optimizing.
-  if (v8_flags.script_context_mutable_heap_number ||
-      v8_flags.const_tracking_let) {
-    Context::StoreScriptContextAndUpdateSlotProperty(
-        script_context, lookup_result.slot_index, value, isolate);
-  } else {
-    script_context->set(lookup_result.slot_index, *value);
-  }
+  Context::Set(script_context, lookup_result.slot_index, value, isolate);
   return *value;
 }
 
diff --git a/deps/v8/src/runtime/runtime-strings.cc b/deps/v8/src/runtime/runtime-strings.cc
index 9d25d7fb4355a7..355b25043f6636 100644
--- a/deps/v8/src/runtime/runtime-strings.cc
+++ b/deps/v8/src/runtime/runtime-strings.cc
@@ -164,6 +164,69 @@ RUNTIME_FUNCTION(Runtime_StringAdd) {
                            isolate->factory()->NewConsString(str1, str2));
 }
 
+RUNTIME_FUNCTION(Runtime_StringAdd_LhsIsStringConstant_Internalize) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(4, args.length());
+  DirectHandle<String> lhs = args.at<String>(0);
+  DirectHandle<Object> rhs = args.at<Object>(1);
+  Handle<HeapObject> maybe_feedback_vector = args.at<HeapObject>(2);
+  const int slot_index = args.tagged_index_value_at(3);
+
+  DirectHandle<String> rhs_string;
+  if (IsString(*rhs)) {
+    rhs_string = Cast<String>(rhs);
+  } else {
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, rhs_string,
+                                       Object::ToString(isolate, rhs));
+  }
+
+  auto f = isolate->factory();
+  auto rhs_internalized = IsInternalizedString(*rhs_string)
+                              ? Cast<InternalizedString>(rhs_string)
+                              : f->InternalizeString(rhs_string);
+
+  if (IsUndefined(*maybe_feedback_vector)) {
+    DirectHandle<String> cons;
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+        isolate, cons, f->NewConsString(lhs, Cast<String>(rhs_internalized)));
+    return *f->InternalizeString(cons);
+  }
+
+  auto feedback_vector = Cast<FeedbackVector>(maybe_feedback_vector);
+
+  FeedbackSlot cache_slot(FeedbackVector::ToSlot(
+      slot_index + kAdd_LhsIsStringConstant_Internalize_CacheSlotOffset));
+  DCHECK_LT(cache_slot.ToInt(), feedback_vector->length());
+  Handle<Object> cache_obj(Cast<Object>(feedback_vector->Get(cache_slot)),
+                           isolate);
+  Handle<SimpleNameDictionary> cache;
+  if (*cache_obj == ReadOnlyRoots{isolate}.uninitialized_symbol()) {
+    cache = SimpleNameDictionary::New(isolate, 1);
+    feedback_vector->SynchronizedSet(cache_slot, *cache);
+  } else {
+    cache = Cast<SimpleNameDictionary>(cache_obj);
+  }
+
+  InternalIndex entry = cache->FindEntry(isolate, rhs_internalized);
+  if (entry.is_found()) {
+    auto result = cache->ValueAt(entry);
+    DCHECK(IsInternalizedString(result));
+    return result;
+  }
+
+  DirectHandle<String> cons;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, cons, f->NewConsString(lhs, Cast<String>(rhs_internalized)));
+
+  auto internalized = f->InternalizeString(cons);
+  auto new_cache =
+      SimpleNameDictionary::Set(isolate, cache, rhs_internalized, internalized);
+  if (*new_cache != *cache) {
+    feedback_vector->SynchronizedSet(cache_slot, *new_cache);
+  }
+
+  return *internalized;
+}
 
 RUNTIME_FUNCTION(Runtime_InternalizeString) {
   HandleScope handles(isolate);
@@ -308,11 +371,9 @@ RUNTIME_FUNCTION(Runtime_StringToArray) {
     // a LookupSingleCharacterStringFromCode for each of the characters.
     if (content.IsOneByte()) {
       base::Vector<const uint8_t> chars = content.ToOneByteVector();
-      Tagged<FixedArray> one_byte_table =
-          isolate->heap()->single_character_string_table();
+      ReadOnlyRoots roots(isolate);
       for (int i = 0; i < length; ++i) {
-        Tagged<Object> value = one_byte_table->get(chars[i]);
-        DCHECK(IsString(value));
+        Tagged<String> value = roots.single_character_string(chars[i]);
         DCHECK(ReadOnlyHeap::Contains(Cast<HeapObject>(value)));
         // The single-character strings are in RO space so it should
         // be safe to skip the write barriers.
@@ -387,10 +448,6 @@ RUNTIME_FUNCTION(Runtime_StringEqual) {
   SaveAndClearThreadInWasmFlag non_wasm_scope(isolate);
   HandleScope handle_scope(isolate);
   DCHECK_EQ(2, args.length());
-#ifdef V8_ENABLE_CONSERVATIVE_STACK_SCANNING
-  DirectHandle<String> x = args.at<String>(0);
-  DirectHandle<String> y = args.at<String>(1);
-#else
   // This function can be called from Wasm: optimized Wasm code calls
   // straight to the "StringEqual" builtin, which tail-calls here. So on
   // the stack, the CEntryStub's EXIT frame will sit right on top of the
@@ -403,9 +460,11 @@ RUNTIME_FUNCTION(Runtime_StringEqual) {
   // In the future, Conservative Stack Scanning will trivially solve the
   // problem. In the meantime, we can work around it by explicitly creating
   // handles here (rather than treating the on-stack arguments as handles).
+  //
+  // TODO(42203211): Don't create new handles here once direct handles and CSS
+  // are enabled by default.
   DirectHandle<String> x(*args.at<String>(0), isolate);
   DirectHandle<String> y(*args.at<String>(1), isolate);
-#endif  // V8_ENABLE_CONSERVATIVE_STACK_SCANNING
   return isolate->heap()->ToBoolean(String::Equals(isolate, x, y));
 }
 
diff --git a/deps/v8/src/runtime/runtime-test-wasm.cc b/deps/v8/src/runtime/runtime-test-wasm.cc
index 3f50751d56f491..e9f48055053275 100644
--- a/deps/v8/src/runtime/runtime-test-wasm.cc
+++ b/deps/v8/src/runtime/runtime-test-wasm.cc
@@ -611,7 +611,7 @@ RUNTIME_FUNCTION(Runtime_WasmTraceMemory) {
 
   // Find the caller wasm frame.
   wasm::WasmCodeRefScope wasm_code_ref_scope;
-  DebuggableStackFrameIterator it(isolate, StackFrameIterator::NoHandles{});
+  DebuggableStackFrameIterator it(isolate);
   DCHECK(!it.done());
   DCHECK(it.is_wasm());
 #if V8_ENABLE_DRUMBRAKE
diff --git a/deps/v8/src/runtime/runtime-test.cc b/deps/v8/src/runtime/runtime-test.cc
index 23501c0c38c92d..2669e606fc20a3 100644
--- a/deps/v8/src/runtime/runtime-test.cc
+++ b/deps/v8/src/runtime/runtime-test.cc
@@ -391,7 +391,7 @@ Tagged<Object> OptimizeFunctionOnNextCall(RuntimeArguments& args,
     if (function->shared()->HasBaselineCode()) {
       code = function->shared()->baseline_code(kAcquireLoad);
     }
-    function->UpdateCode(code);
+    function->UpdateCode(isolate, code);
   }
 
   TraceManualRecompile(*function, target_kind, concurrency_mode);
@@ -1163,7 +1163,7 @@ RUNTIME_FUNCTION(Runtime_ClearFunctionFeedback) {
   // This isn't exposed to fuzzers so doesn't need to handle invalid arguments.
   DCHECK_EQ(args.length(), 1);
   DirectHandle<JSFunction> function = args.at<JSFunction>(0);
-  function->ClearAllTypeFeedbackInfoForTesting();
+  function->ClearAllTypeFeedbackInfoForTesting(isolate);
   // Typically tests use this function to start from scratch. Thus, we should
   // also clear tiering requests.
   function->ResetTieringRequests();
@@ -2075,6 +2075,16 @@ RUNTIME_FUNCTION(Runtime_IsSharedString) {
                                     Cast<String>(obj)->IsShared());
 }
 
+RUNTIME_FUNCTION(Runtime_IsInWritableSharedSpace) {
+  HandleScope scope(isolate);
+  if (args.length() != 1) {
+    return CrashUnlessFuzzing(isolate);
+  }
+  if (!IsHeapObject(args[0])) return ReadOnlyRoots(isolate).false_value();
+  DirectHandle<HeapObject> obj = args.at<HeapObject>(0);
+  return isolate->heap()->ToBoolean(HeapLayout::InWritableSharedSpace(*obj));
+}
+
 RUNTIME_FUNCTION(Runtime_ShareObject) {
   // TODO(354005312): This function is not currently exposed to fuzzers.
   // Investigate if it should be.
diff --git a/deps/v8/src/runtime/runtime-typedarray.cc b/deps/v8/src/runtime/runtime-typedarray.cc
index dd8ddfca795520..3e556afe403fff 100644
--- a/deps/v8/src/runtime/runtime-typedarray.cc
+++ b/deps/v8/src/runtime/runtime-typedarray.cc
@@ -56,7 +56,7 @@ RUNTIME_FUNCTION(Runtime_TypedArrayCopyElements) {
   size_t length;
   CHECK(TryNumberToSize(args[2], &length));
   ElementsAccessor* accessor = target->GetElementsAccessor();
-  return accessor->CopyElements(source, target, length, 0);
+  return accessor->CopyElements(isolate, source, target, length, 0);
 }
 
 RUNTIME_FUNCTION(Runtime_TypedArrayGetBuffer) {
@@ -217,7 +217,7 @@ RUNTIME_FUNCTION(Runtime_TypedArraySet) {
   size_t offset;
   CHECK(TryNumberToSize(args[3], &offset));
   ElementsAccessor* accessor = target->GetElementsAccessor();
-  return accessor->CopyElements(source, target, length, offset);
+  return accessor->CopyElements(isolate, source, target, length, offset);
 }
 
 RUNTIME_FUNCTION(Runtime_ArrayBufferMaxByteLength) {
diff --git a/deps/v8/src/runtime/runtime-wasm.cc b/deps/v8/src/runtime/runtime-wasm.cc
index acdc8965d88df6..e217e52986e142 100644
--- a/deps/v8/src/runtime/runtime-wasm.cc
+++ b/deps/v8/src/runtime/runtime-wasm.cc
@@ -436,7 +436,9 @@ RUNTIME_FUNCTION(Runtime_WasmCompileLazy) {
   SealHandleScope scope(isolate);
 
   DCHECK(isolate->context().is_null());
-  isolate->set_context(trusted_instance_data->native_context());
+  if (trusted_instance_data->has_native_context()) {
+    isolate->set_context(trusted_instance_data->native_context());
+  }
   bool success = wasm::CompileLazy(isolate, trusted_instance_data, func_index);
   if (!success) {
     DCHECK(v8_flags.wasm_lazy_validation);
@@ -544,7 +546,7 @@ void ReplaceJSToWasmWrapper(
   CHECK(func_ref->internal(isolate)->try_get_external(&external_function));
   if (external_function->shared()->HasWasmJSFunctionData()) return;
   CHECK(external_function->shared()->HasWasmExportedFunctionData());
-  external_function->UpdateCode(wrapper_code);
+  external_function->UpdateCode(isolate, wrapper_code);
   Tagged<WasmExportedFunctionData> function_data =
       external_function->shared()->wasm_exported_function_data();
   function_data->set_wrapper_code(wrapper_code);
@@ -1190,13 +1192,14 @@ RUNTIME_FUNCTION(Runtime_WasmArrayCopy) {
 RUNTIME_FUNCTION(Runtime_WasmAllocateDescriptorStruct) {
   ClearThreadInWasmScope flag_scope(isolate);
   HandleScope scope(isolate);
-  DCHECK_EQ(3, args.length());
+  DCHECK_EQ(4, args.length());
   DirectHandle<WasmTrustedInstanceData> trusted_data{
       Cast<WasmTrustedInstanceData>(args[0]), isolate};
   DirectHandle<Map> map{Cast<Map>(args[1]), isolate};
   wasm::ModuleTypeIndex type_index{args.positive_smi_value_at(2)};
-  return *WasmStruct::AllocateDescriptorUninitialized(isolate, trusted_data,
-                                                      type_index, map);
+  DirectHandle<Object> first_field{args[3], isolate};
+  return *WasmStruct::AllocateDescriptorUninitialized(
+      isolate, trusted_data, type_index, map, first_field);
 }
 
 RUNTIME_FUNCTION(Runtime_WasmArrayNewSegment) {
@@ -1360,35 +1363,34 @@ RUNTIME_FUNCTION(Runtime_WasmAllocateSuspender) {
   DirectHandle<WasmSuspenderObject> suspender =
       isolate->factory()->NewWasmSuspenderObject();
 
-  // Update the continuation state.
-  auto parent = direct_handle(Cast<WasmContinuationObject>(isolate->root(
-                                  RootIndex::kActiveContinuation)),
-                              isolate);
+  // Update the stack state.
+  wasm::StackMemory* active_stack = isolate->isolate_data()->active_stack();
   std::unique_ptr<wasm::StackMemory> target_stack =
       isolate->stack_pool().GetOrAllocate();
-  DirectHandle<WasmContinuationObject> target = WasmContinuationObject::New(
-      isolate, target_stack.get(), wasm::JumpBuffer::Suspended, parent);
-  target_stack->set_index(isolate->wasm_stacks().size());
-  isolate->wasm_stacks().emplace_back(std::move(target_stack));
-  for (size_t i = 0; i < isolate->wasm_stacks().size(); ++i) {
-    SLOW_DCHECK(isolate->wasm_stacks()[i]->index() == i);
-  }
-  isolate->roots_table().slot(RootIndex::kActiveContinuation).store(*target);
+  target_stack->jmpbuf()->parent = active_stack;
+  target_stack->jmpbuf()->stack_limit = target_stack->jslimit();
+  target_stack->jmpbuf()->sp = target_stack->base();
+  target_stack->jmpbuf()->fp = kNullAddress;
+  target_stack->jmpbuf()->state = wasm::JumpBuffer::Suspended;
+  isolate->isolate_data()->set_active_stack(target_stack.get());
 
   // Update the suspender state.
   FullObjectSlot active_suspender_slot =
       isolate->roots_table().slot(RootIndex::kActiveSuspender);
   suspender->set_parent(
       Cast<UnionOf<Undefined, WasmSuspenderObject>>(*active_suspender_slot));
-  suspender->set_continuation(*target);
+  suspender->set_stack(isolate, target_stack.get());
   active_suspender_slot.store(*suspender);
 
+  target_stack->set_index(isolate->wasm_stacks().size());
+  isolate->wasm_stacks().emplace_back(std::move(target_stack));
+  for (size_t i = 0; i < isolate->wasm_stacks().size(); ++i) {
+    SLOW_DCHECK(isolate->wasm_stacks()[i]->index() == i);
+  }
+
   // Stack limit will be updated in WasmReturnPromiseOnSuspendAsm builtin.
-  wasm::StackMemory* stack = reinterpret_cast<wasm::StackMemory*>(
-      parent->ReadExternalPointerField<kWasmStackMemoryTag>(
-          WasmContinuationObject::kStackOffset, isolate));
-  DCHECK_EQ(stack->jmpbuf()->state, wasm::JumpBuffer::Active);
-  stack->jmpbuf()->state = wasm::JumpBuffer::Inactive;
+  DCHECK_EQ(active_stack->jmpbuf()->state, wasm::JumpBuffer::Active);
+  active_stack->jmpbuf()->state = wasm::JumpBuffer::Inactive;
 
   return *suspender;
 }
diff --git a/deps/v8/src/runtime/runtime.h b/deps/v8/src/runtime/runtime.h
index f9c8207c1c10aa..495cd6ce4989fe 100644
--- a/deps/v8/src/runtime/runtime.h
+++ b/deps/v8/src/runtime/runtime.h
@@ -268,6 +268,7 @@ namespace internal {
   F(AllocateByteArray, 1, 1)                               \
   F(AllocateInYoungGeneration, 2, 1)                       \
   F(AllocateInOldGeneration, 2, 1)                         \
+  F(AllocateInSharedHeap, 2, 1)                            \
   F(AllowDynamicFunction, 1, 1)                            \
   I(CreateAsyncFromSyncIterator, 1, 1)                     \
   F(CreateListFromArrayLike, 1, 1)                         \
@@ -285,7 +286,7 @@ namespace internal {
   F(BytecodeBudgetInterruptWithStackCheck_Sparkplug, 1, 1) \
   F(BytecodeBudgetInterrupt_Maglev, 1, 1)                  \
   F(BytecodeBudgetInterruptWithStackCheck_Maglev, 1, 1)    \
-  F(InvalidateDependentCodeForScriptContextSlot, 1, 1)     \
+  F(NotifyContextCellStateWillChange, 1, 1)                \
   F(NewError, 2, 1)                                        \
   F(NewReferenceError, 2, 1)                               \
   F(NewTypeError, -1 /* [1, 4] */, 1)                      \
@@ -300,7 +301,8 @@ namespace internal {
   F(StackGuardWithGap, 1, 1)                               \
   F(TerminateExecution, 0, 1)                              \
   F(Typeof, 1, 1)                                          \
-  F(UnwindAndFindExceptionHandler, 0, 1)
+  F(UnwindAndFindExceptionHandler, 0, 1)                   \
+  I(AddLhsIsStringConstantInternalize, 4, 1)
 
 #define FOR_EACH_INTRINSIC_LITERALS(F, I) \
   F(CreateArrayLiteral, 4, 1)             \
@@ -489,27 +491,28 @@ namespace internal {
   F(ShadowRealmImportValue, 1, 1)             \
   F(ShadowRealmThrow, 2, 1)
 
-#define FOR_EACH_INTRINSIC_STRINGS(F, I)  \
-  F(FlattenString, 1, 1)                  \
-  F(GetSubstitution, 5, 1)                \
-  F(InternalizeString, 1, 1)              \
-  F(StringAdd, 2, 1)                      \
-  F(StringBuilderConcat, 3, 1)            \
-  F(StringCharCodeAt, 2, 1)               \
-  F(StringCodePointAt, 2, 1)              \
-  F(StringCompare, 2, 1)                  \
-  F(StringEqual, 2, 1)                    \
-  F(StringEscapeQuotes, 1, 1)             \
-  F(StringGreaterThan, 2, 1)              \
-  F(StringGreaterThanOrEqual, 2, 1)       \
-  F(StringIsWellFormed, 1, 1)             \
-  F(StringLastIndexOf, 2, 1)              \
-  F(StringLessThan, 2, 1)                 \
-  F(StringLessThanOrEqual, 2, 1)          \
-  F(StringMaxLength, 0, 1)                \
-  F(StringReplaceOneCharWithString, 3, 1) \
-  F(StringSubstring, 3, 1)                \
-  F(StringToArray, 2, 1)                  \
+#define FOR_EACH_INTRINSIC_STRINGS(F, I)             \
+  F(FlattenString, 1, 1)                             \
+  F(GetSubstitution, 5, 1)                           \
+  F(InternalizeString, 1, 1)                         \
+  F(StringAdd, 2, 1)                                 \
+  F(StringAdd_LhsIsStringConstant_Internalize, 4, 1) \
+  F(StringBuilderConcat, 3, 1)                       \
+  F(StringCharCodeAt, 2, 1)                          \
+  F(StringCodePointAt, 2, 1)                         \
+  F(StringCompare, 2, 1)                             \
+  F(StringEqual, 2, 1)                               \
+  F(StringEscapeQuotes, 1, 1)                        \
+  F(StringGreaterThan, 2, 1)                         \
+  F(StringGreaterThanOrEqual, 2, 1)                  \
+  F(StringIsWellFormed, 1, 1)                        \
+  F(StringLastIndexOf, 2, 1)                         \
+  F(StringLessThan, 2, 1)                            \
+  F(StringLessThanOrEqual, 2, 1)                     \
+  F(StringMaxLength, 0, 1)                           \
+  F(StringReplaceOneCharWithString, 3, 1)            \
+  F(StringSubstring, 3, 1)                           \
+  F(StringToArray, 2, 1)                             \
   F(StringToWellFormed, 1, 1)
 
 #define FOR_EACH_INTRINSIC_SYMBOL(F, I)    \
@@ -611,6 +614,7 @@ namespace internal {
   F(IsMaglevEnabled, 0, 1)                    \
   F(IsSameHeapObject, 2, 1)                   \
   F(IsSharedString, 1, 1)                     \
+  F(IsInWritableSharedSpace, 1, 1)            \
   F(IsSparkplugEnabled, 0, 1)                 \
   F(IsTurbofanEnabled, 0, 1)                  \
   F(IsWasmTieringPredictable, 0, 1)           \
@@ -710,7 +714,7 @@ namespace internal {
   F(TierUpWasmToJSWrapper, 1, 1)              \
   F(WasmTriggerTierUp, 1, 1)                  \
   F(WasmDebugBreak, 0, 1)                     \
-  F(WasmAllocateDescriptorStruct, 3, 1)       \
+  F(WasmAllocateDescriptorStruct, 4, 1)       \
   F(WasmArrayCopy, 5, 1)                      \
   F(WasmArrayNewSegment, 5, 1)                \
   F(WasmArrayInitSegment, 6, 1)               \
diff --git a/deps/v8/src/sandbox/external-pointer-inl.h b/deps/v8/src/sandbox/external-pointer-inl.h
index ffcb1ece9605ab..5c2b452d52ecc2 100644
--- a/deps/v8/src/sandbox/external-pointer-inl.h
+++ b/deps/v8/src/sandbox/external-pointer-inl.h
@@ -75,11 +75,11 @@ V8_INLINE Address ReadExternalPointerField(Address field_address,
                                            IsolateForSandbox isolate) {
 #ifdef V8_ENABLE_SANDBOX
   // static_assert(tag != kExternalPointerNullTag); // TODO
-  //  Handles may be written to objects from other threads so the handle needs
-  //  to be loaded atomically. We assume that the load from the table cannot
-  //  be reordered before the load of the handle due to the data dependency
-  //  between the two loads and therefore use relaxed memory ordering, but
-  //  technically we should use memory_order_consume here.
+  // Handles may be written to objects from other threads so the handle needs
+  // to be loaded atomically. We assume that the load from the table cannot
+  // be reordered before the load of the handle due to the data dependency
+  // between the two loads and therefore use relaxed memory ordering, but
+  // technically we should use memory_order_consume here.
   auto location = reinterpret_cast<ExternalPointerHandle*>(field_address);
   ExternalPointerHandle handle = base::AsAtomic32::Relaxed_Load(location);
   return isolate.GetExternalPointerTableFor(tag_range).Get(handle, tag_range);
diff --git a/deps/v8/src/sandbox/external-pointer-table-inl.h b/deps/v8/src/sandbox/external-pointer-table-inl.h
index af641c05312790..af9195c106df88 100644
--- a/deps/v8/src/sandbox/external-pointer-table-inl.h
+++ b/deps/v8/src/sandbox/external-pointer-table-inl.h
@@ -366,7 +366,17 @@ void ExternalPointerTable::FreeManagedResourceIfPresent(uint32_t entry_index) {
   // does not attempt to zap its entry when it is eventually destroyed.
   if (Address addr = at(entry_index).ExtractManagedResourceOrNull()) {
     ManagedResource* resource = reinterpret_cast<ManagedResource*>(addr);
-    DCHECK_EQ(resource->ept_entry_, IndexToHandle(entry_index));
+
+    // This can currently only happen during snapshot stress mode as we cannot
+    // normally serialized managed resources. In snapshot stress mode, the new
+    // isolate will be destroyed and the old isolate (really, the old isolate's
+    // external pointer table) therefore effectively retains ownership of the
+    // resource. As such, we need to save and restore the relevant fields of
+    // the external resource. Once the external pointer table itself destroys
+    // the managed resource when freeing the corresponding table entry, this
+    // workaround can be removed again.
+    DCHECK_IMPLIES(!v8_flags.stress_snapshot,
+                   resource->ept_entry_ == IndexToHandle(entry_index));
     resource->ept_entry_ = kNullExternalPointerHandle;
   }
 }
diff --git a/deps/v8/src/sandbox/external-pointer-table.cc b/deps/v8/src/sandbox/external-pointer-table.cc
index 79daaba92bd719..1a5d658464aced 100644
--- a/deps/v8/src/sandbox/external-pointer-table.cc
+++ b/deps/v8/src/sandbox/external-pointer-table.cc
@@ -175,13 +175,7 @@ uint32_t ExternalPointerTable::EvacuateAndSweepAndCompact(Space* space,
         // field that owns the entry that is to be evacuated.
         Address handle_location =
             payload.ExtractEvacuationEntryHandleLocation();
-
-        // The evacuation entry may be invalidated by the Scavenger that has
-        // freed the object.
-        if (handle_location == kNullAddress) {
-          AddToFreelist(i);
-          continue;
-        }
+        DCHECK_NE(handle_location, kNullAddress);
 
         // The external pointer field may have been invalidated in the meantime
         // (for example if the host object has been in-place converted to a
@@ -311,40 +305,6 @@ void ExternalPointerTable::ResolveEvacuationEntryDuringSweeping(
   }
 }
 
-void ExternalPointerTable::UpdateAllEvacuationEntries(
-    Space* space, std::function<Address(Address)> function) {
-  DCHECK(space->BelongsTo(this));
-  DCHECK(!space->is_internal_read_only_space());
-
-  if (!space->IsCompacting()) return;
-
-  // Lock the space. Technically this is not necessary since no other thread can
-  // allocate entries at this point, but some of the methods we call on the
-  // space assert that the lock is held.
-  base::MutexGuard guard(&space->mutex_);
-  // Same for the invalidated fields mutex.
-  base::MutexGuard invalidated_fields_guard(&space->invalidated_fields_mutex_);
-
-  const uint32_t start_of_evacuation_area =
-      space->start_of_evacuation_area_.load(std::memory_order_relaxed);
-
-  // Iterate until the start of evacuation area.
-  for (auto& segment : space->segments_) {
-    if (segment.first_entry() == start_of_evacuation_area) return;
-    for (uint32_t i = segment.first_entry(); i < segment.last_entry() + 1;
-         ++i) {
-      ExternalPointerTableEntry& entry = at(i);
-      ExternalPointerTableEntry::Payload payload = entry.GetRawPayload();
-      if (!payload.ContainsEvacuationEntry()) {
-        continue;
-      }
-      Address new_location =
-          function(payload.ExtractEvacuationEntryHandleLocation());
-      entry.MakeEvacuationEntry(new_location);
-    }
-  }
-}
-
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/src/sandbox/external-pointer-table.h b/deps/v8/src/sandbox/external-pointer-table.h
index afa479f50992b8..29f3b87ed48182 100644
--- a/deps/v8/src/sandbox/external-pointer-table.h
+++ b/deps/v8/src/sandbox/external-pointer-table.h
@@ -434,10 +434,6 @@ class V8_EXPORT_PRIVATE ExternalPointerTable
   uint32_t SweepAndCompact(Space* space, Counters* counters);
   uint32_t Sweep(Space* space, Counters* counters);
 
-  // Updates all evacuation entries with new handle locations. The function
-  // takes the old hanlde location and returns the new one.
-  void UpdateAllEvacuationEntries(Space*, std::function<Address(Address)>);
-
   inline bool Contains(Space* space, ExternalPointerHandle handle) const;
 
   // A resource outside of the V8 heap whose lifetime is tied to something
diff --git a/deps/v8/src/sandbox/external-pointer.h b/deps/v8/src/sandbox/external-pointer.h
index 7adb6131c4cde0..5e670aa32340de 100644
--- a/deps/v8/src/sandbox/external-pointer.h
+++ b/deps/v8/src/sandbox/external-pointer.h
@@ -30,6 +30,9 @@ class ExternalPointerMember {
   alignas(alignof(Tagged_t)) char storage_[sizeof(ExternalPointer_t)];
 };
 
+// Writes the null handle or kNullAddress into the external pointer field.
+V8_INLINE void InitLazyExternalPointerField(Address field_address);
+
 // Creates and initializes an entry in the external pointer table and writes the
 // handle for that entry to the field.
 template <ExternalPointerTag tag>
diff --git a/deps/v8/src/sandbox/indirect-pointer-tag.h b/deps/v8/src/sandbox/indirect-pointer-tag.h
index 6bcbdca7347e99..4a9b6face8cd59 100644
--- a/deps/v8/src/sandbox/indirect-pointer-tag.h
+++ b/deps/v8/src/sandbox/indirect-pointer-tag.h
@@ -75,9 +75,11 @@ constexpr uint64_t kAllTagsForAndBasedTypeChecking[] = {
 // TODO(358918874): Consider having explicitly shared types (e.g.
 // `ExposedSharedTrustedObject`) and enforcing that shared tags are only ever
 // used with shared types.
-#define SHARED_TRUSTED_POINTER_TAG_LIST(V) \
-  V(kFirstSharedTrustedTag, 1)             \
-  V(kLastSharedTrustedTag, 1)
+#define SHARED_TRUSTED_POINTER_TAG_LIST(V)               \
+  V(kFirstSharedTrustedTag, 1)                           \
+  V(kSharedWasmTrustedInstanceDataIndirectPointerTag, 1) \
+  V(kSharedWasmDispatchTableIndirectPointerTag, 2)       \
+  V(kLastSharedTrustedTag, 2)
 // Leave some space in the tag range here for future shared tags.
 
 // Trusted pointers using these tags are kept in a per-Isolate trusted
@@ -152,6 +154,8 @@ enum IndirectPointerTag : uint64_t {
 #undef INDIRECT_POINTER_TAG_ENUM_DECL
 };
 
+#undef MAKE_TAG
+
 #define VALIDATE_INDIRECT_POINTER_TAG(name, tag_id)        \
   static_assert((name & kIndirectPointerTagMask) == name); \
   static_assert((name & kIndirectPointerTagMaskWithoutFreeEntryBit) == name);
@@ -200,7 +204,7 @@ V8_INLINE constexpr bool IsTrustedSpaceMigrationInProgressForObjectsWithTag(
 static_assert(!IsValidIndirectPointerTag(kIndirectPointerNullTag));
 
 V8_INLINE IndirectPointerTag
-IndirectPointerTagFromInstanceType(InstanceType instance_type) {
+IndirectPointerTagFromInstanceType(InstanceType instance_type, bool shared) {
   switch (instance_type) {
     case CODE_TYPE:
       return kCodeIndirectPointerTag;
@@ -222,9 +226,11 @@ IndirectPointerTagFromInstanceType(InstanceType instance_type) {
       return kRegExpDataIndirectPointerTag;
 #if V8_ENABLE_WEBASSEMBLY
     case WASM_DISPATCH_TABLE_TYPE:
-      return kWasmDispatchTableIndirectPointerTag;
+      return shared ? kSharedWasmDispatchTableIndirectPointerTag
+                    : kWasmDispatchTableIndirectPointerTag;
     case WASM_TRUSTED_INSTANCE_DATA_TYPE:
-      return kWasmTrustedInstanceDataIndirectPointerTag;
+      return shared ? kSharedWasmTrustedInstanceDataIndirectPointerTag
+                    : kWasmTrustedInstanceDataIndirectPointerTag;
     case WASM_INTERNAL_FUNCTION_TYPE:
       return kWasmInternalFunctionIndirectPointerTag;
     case WASM_FUNCTION_DATA_TYPE:
@@ -240,22 +246,6 @@ IndirectPointerTagFromInstanceType(InstanceType instance_type) {
   }
 }
 
-V8_INLINE InstanceType
-InstanceTypeFromIndirectPointerTag(IndirectPointerTag tag) {
-  DCHECK(IsValidIndirectPointerTag(tag));
-  switch (tag) {
-#define CASE(name, instance_type, tag_id) \
-  case MAKE_TAG(tag_id):                  \
-    return instance_type;                 \
-    break;
-#undef CASE
-    default:
-      UNREACHABLE();
-  }
-}
-
-#undef MAKE_TAG
-
 // Sanity checks.
 #define CHECK_SHARED_TRUSTED_POINTER_TAGS(Tag, ...) \
   static_assert(IsSharedTrustedPointerType(Tag));
diff --git a/deps/v8/src/sandbox/indirect-pointer.h b/deps/v8/src/sandbox/indirect-pointer.h
index d104f15a1572f0..13423b9817b8e4 100644
--- a/deps/v8/src/sandbox/indirect-pointer.h
+++ b/deps/v8/src/sandbox/indirect-pointer.h
@@ -12,6 +12,8 @@
 namespace v8 {
 namespace internal {
 
+class TrustedPointerPublishingScope;
+
 // Indirect pointers.
 //
 // An indirect pointer references a HeapObject (like a tagged pointer), but
diff --git a/deps/v8/src/sandbox/isolate-inl.h b/deps/v8/src/sandbox/isolate-inl.h
index bebc8ceb6ae51d..3434d4367fc51b 100644
--- a/deps/v8/src/sandbox/isolate-inl.h
+++ b/deps/v8/src/sandbox/isolate-inl.h
@@ -87,12 +87,12 @@ V8_INLINE IsolateForSandbox GetIsolateForSandbox(Tagged<HeapObject> object) {
     allow_isolate_sharing = true;
   }
   if (allow_isolate_sharing) {
-    // TODO(396607238): Make this a `SBXCHECK`.
-    DCHECK(IsolateForSandbox{isolate}.SharesPointerTablesWith(
+    // See the TODO above: The isolate returned here must match TLS.
+    CHECK(IsolateForSandbox{isolate}.SharesPointerTablesWith(
         Isolate::TryGetCurrent()));
   } else {
-    // TODO(396607238): Make this a `SBXCHECK`.
-    DCHECK_EQ(isolate, Isolate::TryGetCurrent());
+    // See the TODO above: The isolate returned here must match TLS.
+    CHECK_EQ(isolate, Isolate::TryGetCurrent());
   }
   return isolate;
 }
diff --git a/deps/v8/src/snapshot/context-serializer.cc b/deps/v8/src/snapshot/context-serializer.cc
index 761a9712a2c37f..8c67288ad50139 100644
--- a/deps/v8/src/snapshot/context-serializer.cc
+++ b/deps/v8/src/snapshot/context-serializer.cc
@@ -8,6 +8,7 @@
 #include "src/execution/microtask-queue.h"
 #include "src/heap/combined-heap.h"
 #include "src/numbers/math-random.h"
+#include "src/objects/cpp-heap-object-wrapper-inl.h"
 #include "src/objects/embedder-data-array-inl.h"
 #include "src/objects/js-objects.h"
 #include "src/objects/objects-inl.h"
@@ -96,8 +97,8 @@ void ContextSerializer::Serialize(Tagged<Context>* o,
   // explicitly when it's loaded.
   // TODO(v8:10416): These mutations should not observably affect the running
   // context.
-  context_->set(Context::NEXT_CONTEXT_LINK,
-                ReadOnlyRoots(isolate()).undefined_value());
+  context_->SetNoCell(Context::NEXT_CONTEXT_LINK,
+                      ReadOnlyRoots(isolate()).undefined_value());
   DCHECK(!IsUndefined(context_->global_object()));
   // Reset math random cache to get fresh random numbers.
   MathRandom::ResetContext(context_);
@@ -231,7 +232,7 @@ void ContextSerializer::SerializeObjectImpl(Handle<HeapObject> obj,
         }
         Tagged<Code> sfi_code = closure->shared()->GetCode(isolate());
         if (!sfi_code.SafeEquals(closure->code(isolate()))) {
-          closure->UpdateCode(sfi_code);
+          closure->UpdateCode(isolate(), sfi_code);
         }
       }
     }
@@ -258,7 +259,7 @@ void ContextSerializer::SerializeObjectImpl(Handle<HeapObject> obj,
   // Object has not yet been serialized.  Serialize it here.
   ObjectSerializer serializer(this, obj, &sink_);
   serializer.Serialize(slot_type);
-  if (IsJSApiWrapperObject(obj->map())) {
+  if (InstanceTypeChecker::IsJSApiWrapperObject(instance_type)) {
     SerializeApiWrapperFields(Cast<JSObject>(obj));
   }
 }
@@ -288,7 +289,7 @@ void ContextSerializer::SerializeApiWrapperFields(
     DirectHandle<JSObject> js_object) {
   DCHECK(IsJSApiWrapperObject(*js_object));
   auto* cpp_heap_pointer =
-      JSApiWrapper(*js_object)
+      CppHeapObjectWrapper(*js_object)
           .GetCppHeapWrappable(isolate(), kAnyCppHeapPointer);
   const auto& callback_data = serialize_embedder_fields_.api_wrapper_callback;
   if (callback_data.callback == nullptr && cpp_heap_pointer == nullptr) {
diff --git a/deps/v8/src/snapshot/deserializer.cc b/deps/v8/src/snapshot/deserializer.cc
index 114cb45c3a7d7a..269b481542010f 100644
--- a/deps/v8/src/snapshot/deserializer.cc
+++ b/deps/v8/src/snapshot/deserializer.cc
@@ -102,7 +102,9 @@ class SlotAccessorForHeapObject {
     Tagged<ExposedTrustedObject> object = Cast<ExposedTrustedObject>(value);
 
     InstanceType instance_type = value->map()->instance_type();
-    IndirectPointerTag tag = IndirectPointerTagFromInstanceType(instance_type);
+    bool shared = HeapLayout::InAnySharedSpace(value);
+    IndirectPointerTag tag =
+        IndirectPointerTagFromInstanceType(instance_type, shared);
     IndirectPointerSlot dest = object_->RawIndirectPointerField(offset_, tag);
     dest.store(object);
 
@@ -273,7 +275,11 @@ int Deserializer<IsolateT>::WriteExternalPointer(Tagged<HeapObject> host,
   }
 #endif  // V8_ENABLE_SANDBOX
 
-  dest.init(main_thread_isolate(), host, value, tag);
+  if (tag == kExternalPointerNullTag && value == kNullAddress) {
+    dest.init_lazily_initialized();
+  } else {
+    dest.init(main_thread_isolate(), host, value, tag);
+  }
 
 #ifdef V8_ENABLE_SANDBOX
   if (managed_resource) {
diff --git a/deps/v8/src/snapshot/object-deserializer.cc b/deps/v8/src/snapshot/object-deserializer.cc
index 4889b2d2ac17ef..d871024ef200c2 100644
--- a/deps/v8/src/snapshot/object-deserializer.cc
+++ b/deps/v8/src/snapshot/object-deserializer.cc
@@ -8,6 +8,7 @@
 #include "src/heap/heap-inl.h"
 #include "src/heap/local-factory-inl.h"
 #include "src/objects/allocation-site-inl.h"
+#include "src/objects/allocation-site.h"
 #include "src/objects/objects.h"
 #include "src/snapshot/code-serializer.h"
 
@@ -71,15 +72,19 @@ void ObjectDeserializer::LinkAllocationSites() {
   // a list at deserialization time.
   for (DirectHandle<AllocationSite> site : new_allocation_sites()) {
     if (!site->HasWeakNext()) continue;
+    DirectHandle<AllocationSiteWithWeakNext> site_with_next =
+        Cast<AllocationSiteWithWeakNext>(site);
     // TODO(mvstanton): consider treating the heap()->allocation_sites_list()
     // as a (weak) root. If this root is relocated correctly, this becomes
     // unnecessary.
     if (heap->allocation_sites_list() == Smi::zero()) {
-      site->set_weak_next(ReadOnlyRoots(heap).undefined_value());
+      site_with_next->set_weak_next(ReadOnlyRoots(heap).undefined_value());
     } else {
-      site->set_weak_next(heap->allocation_sites_list());
+      site_with_next->set_weak_next(
+          Cast<UnionOf<Undefined, AllocationSiteWithWeakNext>>(
+              heap->allocation_sites_list()));
     }
-    heap->set_allocation_sites_list(*site);
+    heap->set_allocation_sites_list(*site_with_next);
   }
 }
 
diff --git a/deps/v8/src/snapshot/read-only-deserializer.cc b/deps/v8/src/snapshot/read-only-deserializer.cc
index f1056d7aa6b64f..c6eb0694158927 100644
--- a/deps/v8/src/snapshot/read-only-deserializer.cc
+++ b/deps/v8/src/snapshot/read-only-deserializer.cc
@@ -215,6 +215,7 @@ class ObjectPostProcessor final {
   }
 #define POST_PROCESS_TYPE_LIST(V) \
   V(AccessorInfo)                 \
+  V(InterceptorInfo)              \
   V(JSExternalObject)             \
   V(FunctionTemplateInfo)         \
   V(Code)                         \
@@ -271,6 +272,32 @@ class ObjectPostProcessor final {
     external_pointer_slots_.emplace_back(slot);
 #endif  // V8_ENABLE_SANDBOX
   }
+  void DecodeLazilyInitializedExternalPointerSlot(Tagged<HeapObject> host,
+                                                  ExternalPointerSlot slot) {
+    // Constructing no_gc here is not the intended use pattern (instead we
+    // should pass it along the entire callchain); but there's little point of
+    // doing that here - all of the code in this file relies on GC being
+    // disabled, and that's guarded at entry points.
+    DisallowGarbageCollection no_gc;
+    auto encoded = ro::EncodedExternalReference::FromUint32(
+        slot.GetContentAsIndexAfterDeserialization(no_gc));
+    Address slot_value =
+        GetAnyExternalReferenceAt(encoded.index, encoded.is_api_reference);
+    DCHECK(slot.ExactTagIsKnown());
+    if (slot_value == kNullAddress) {
+      slot.init_lazily_initialized();
+    } else {
+      slot.init(isolate_, host, slot_value, slot.exact_tag());
+#ifdef V8_ENABLE_SANDBOX
+      // Register these slots during deserialization s.t. later isolates (which
+      // share the RO space we are currently deserializing) can properly
+      // initialize their external pointer table RO space. Note that slot values
+      // are only fully finalized at the end of deserialization, thus we only
+      // register the slot itself now and read the handle/value in Finalize.
+      external_pointer_slots_.emplace_back(slot);
+#endif  // V8_ENABLE_SANDBOX
+    }
+  }
   void PostProcessAccessorInfo(Tagged<AccessorInfo> o) {
     DecodeExternalPointerSlot(
         o, o->RawExternalPointerField(AccessorInfo::kSetterOffset,
@@ -280,6 +307,19 @@ class ObjectPostProcessor final {
                                      kAccessorInfoGetterTag));
     if (USE_SIMULATOR_BOOL) o->init_getter_redirection(isolate_);
   }
+  void PostProcessInterceptorInfo(Tagged<InterceptorInfo> o) {
+    const bool is_named = o->is_named();
+
+#define PROCESS_FIELD(Name, name)                            \
+  DecodeLazilyInitializedExternalPointerSlot(                \
+      o, o->RawExternalPointerField(                         \
+             InterceptorInfo::k##Name##Offset,               \
+             is_named ? kApiNamedProperty##Name##CallbackTag \
+                      : kApiIndexedProperty##Name##CallbackTag));
+
+    INTERCEPTOR_INFO_CALLBACK_LIST(PROCESS_FIELD)
+#undef PROCESS_FIELD
+  }
   void PostProcessJSExternalObject(Tagged<JSExternalObject> o) {
     DecodeExternalPointerSlot(
         o, o->RawExternalPointerField(JSExternalObject::kValueOffset,
diff --git a/deps/v8/src/snapshot/read-only-serializer.cc b/deps/v8/src/snapshot/read-only-serializer.cc
index fa60b3d07e00b6..bfedbd42917659 100644
--- a/deps/v8/src/snapshot/read-only-serializer.cc
+++ b/deps/v8/src/snapshot/read-only-serializer.cc
@@ -25,6 +25,7 @@ class ObjectPreProcessor final {
 
 #define PRE_PROCESS_TYPE_LIST(V) \
   V(AccessorInfo)                \
+  V(InterceptorInfo)             \
   V(JSExternalObject)            \
   V(FunctionTemplateInfo)        \
   V(Code)
@@ -71,6 +72,18 @@ class ObjectPreProcessor final {
     EncodeExternalPointerSlot(o->RawExternalPointerField(
         AccessorInfo::kSetterOffset, kAccessorInfoSetterTag));
   }
+  void PreProcessInterceptorInfo(Tagged<InterceptorInfo> o) {
+    const bool is_named = o->is_named();
+
+#define PROCESS_FIELD(Name, name)                       \
+  EncodeExternalPointerSlot(o->RawExternalPointerField( \
+      InterceptorInfo::k##Name##Offset,                 \
+      is_named ? kApiNamedProperty##Name##CallbackTag   \
+               : kApiIndexedProperty##Name##CallbackTag));
+
+    INTERCEPTOR_INFO_CALLBACK_LIST(PROCESS_FIELD)
+#undef PROCESS_FIELD
+  }
   void PreProcessJSExternalObject(Tagged<JSExternalObject> o) {
     EncodeExternalPointerSlot(
         o->RawExternalPointerField(JSExternalObject::kValueOffset,
diff --git a/deps/v8/src/snapshot/serializer.cc b/deps/v8/src/snapshot/serializer.cc
index 20f4df2085930a..28888f8a605bfa 100644
--- a/deps/v8/src/snapshot/serializer.cc
+++ b/deps/v8/src/snapshot/serializer.cc
@@ -12,6 +12,7 @@
 #include "src/heap/mutable-page-metadata-inl.h"
 #include "src/heap/read-only-heap.h"
 #include "src/heap/visit-object.h"
+#include "src/objects/allocation-site.h"
 #include "src/objects/code.h"
 #include "src/objects/descriptor-array.h"
 #include "src/objects/instance-type-checker.h"
@@ -770,23 +771,23 @@ class V8_NODISCARD UnlinkWeakNextScope {
  public:
   explicit UnlinkWeakNextScope(Heap* heap, Tagged<HeapObject> object) {
     Isolate* isolate = heap->isolate();
-    if (IsAllocationSite(object, isolate) &&
-        Cast<AllocationSite>(object)->HasWeakNext()) {
-      object_ = object;
-      next_ = Cast<AllocationSite>(object)->weak_next();
-      Cast<AllocationSite>(object)->set_weak_next(
-          ReadOnlyRoots(isolate).undefined_value());
+    if (TryCast<AllocationSiteWithWeakNext>(object, &object_)) {
+      next_ = object_->weak_next();
+      object_->set_weak_next(ReadOnlyRoots(isolate).undefined_value());
     }
   }
 
   ~UnlinkWeakNextScope() {
     if (next_ == Smi::zero()) return;
-    Cast<AllocationSite>(object_)->set_weak_next(next_, UPDATE_WRITE_BARRIER);
+    object_->set_weak_next(
+        Cast<UnionOf<Undefined, AllocationSiteWithWeakNext>>(next_),
+        UPDATE_WRITE_BARRIER);
   }
 
  private:
-  Tagged<HeapObject> object_;
-  Tagged<Object> next_ = Smi::zero();
+  Tagged<AllocationSiteWithWeakNext> object_;
+  Tagged<UnionOf<Smi, Undefined, AllocationSiteWithWeakNext>> next_ =
+      Smi::zero();
   DISALLOW_GARBAGE_COLLECTION(no_gc_)
 };
 
@@ -1073,7 +1074,8 @@ void Serializer::ObjectSerializer::OutputExternalReference(
     Address target, int target_size, bool sandboxify, ExternalPointerTag tag) {
   DCHECK_LE(target_size, sizeof(target));  // Must fit in Address.
   DCHECK_IMPLIES(sandboxify, V8_ENABLE_SANDBOX_BOOL);
-  DCHECK_IMPLIES(sandboxify, tag != kExternalPointerNullTag);
+  DCHECK_IMPLIES(sandboxify,
+                 tag != kExternalPointerNullTag || target == kNullAddress);
   ExternalReferenceEncoder::Value encoded_reference;
   bool encoded_successfully;
 
@@ -1135,7 +1137,7 @@ void Serializer::ObjectSerializer::VisitCppHeapPointer(
   // We serialize the slot as initialized-but-unused slot.  The actual API
   // wrapper serialization is implemented in
   // `ContextSerializer::SerializeApiWrapperFields()`.
-  DCHECK(IsJSApiWrapperObject(object_->map(cage_base)));
+  DCHECK(IsJSApiWrapperObjectMap(object_->map(cage_base)));
   static_assert(kCppHeapPointerSlotSize % kTaggedSize == 0);
   sink_->Put(
       FixedRawDataWithSize::Encode(kCppHeapPointerSlotSize >> kTaggedSizeLog2),
@@ -1152,6 +1154,7 @@ void Serializer::ObjectSerializer::VisitExternalPointer(
   if (InstanceTypeChecker::IsForeign(instance_type) ||
       InstanceTypeChecker::IsJSExternalObject(instance_type) ||
       InstanceTypeChecker::IsAccessorInfo(instance_type) ||
+      InstanceTypeChecker::IsInterceptorInfo(instance_type) ||
       InstanceTypeChecker::IsFunctionTemplateInfo(instance_type)) {
     // Output raw data payload, if any.
     OutputRawData(slot.address());
diff --git a/deps/v8/src/snapshot/snapshot.cc b/deps/v8/src/snapshot/snapshot.cc
index 4a3f6bdaf888c1..e9b05fbd76e07e 100644
--- a/deps/v8/src/snapshot/snapshot.cc
+++ b/deps/v8/src/snapshot/snapshot.cc
@@ -277,7 +277,7 @@ void Snapshot::ClearReconstructableDataForSerialization(
       if (!IsJSFunction(o, cage_base)) continue;
 
       i::Tagged<i::JSFunction> fun = i::Cast<i::JSFunction>(o);
-      fun->CompleteInobjectSlackTrackingIfActive();
+      fun->CompleteInobjectSlackTrackingIfActive(isolate);
 
       i::Tagged<i::SharedFunctionInfo> shared = fun->shared();
       if (IsScript(shared->script(cage_base), cage_base) &&
@@ -288,7 +288,7 @@ void Snapshot::ClearReconstructableDataForSerialization(
 
       // Also, clear out feedback vectors and recompilable code.
       if (fun->CanDiscardCompiled(isolate)) {
-        fun->UpdateCode(*BUILTIN_CODE(isolate, CompileLazy));
+        fun->UpdateCode(isolate, *BUILTIN_CODE(isolate, CompileLazy));
       }
       if (!IsUndefined(fun->raw_feedback_cell(cage_base)->value(cage_base))) {
         fun->raw_feedback_cell(cage_base)->set_value(
diff --git a/deps/v8/src/strings/uri.cc b/deps/v8/src/strings/uri.cc
index dce8f84f087b69..fab5395217e809 100644
--- a/deps/v8/src/strings/uri.cc
+++ b/deps/v8/src/strings/uri.cc
@@ -319,6 +319,9 @@ MaybeDirectHandle<String> Uri::Encode(Isolate* isolate,
   }
 
   if (throw_error) THROW_NEW_ERROR(isolate, NewURIError());
+  if (buffer.size() > v8::String::kMaxLength) {
+    THROW_NEW_ERROR(isolate, NewInvalidStringLengthError());
+  }
   return isolate->factory()->NewStringFromOneByte(base::VectorOf(buffer));
 }
 
diff --git a/deps/v8/src/torque/implementation-visitor.cc b/deps/v8/src/torque/implementation-visitor.cc
index 95f42ab919e123..5fc9675c7a854f 100644
--- a/deps/v8/src/torque/implementation-visitor.cc
+++ b/deps/v8/src/torque/implementation-visitor.cc
@@ -4068,7 +4068,8 @@ class ClassFieldOffsetGenerator : public FieldOffsetsGenerator {
       // TODO(leszeks): Hacked in support for some classes (e.g.
       // HeapObject) being mirrored by a *Layout class. Remove once
       // everything is ported to layout classes.
-      if (parent_name == "HeapObject" || parent_name == "TrustedObject") {
+      if (parent_name == "HeapObject" || parent_name == "TrustedObject" ||
+          parent_name == "Struct") {
         parent_name += "Layout";
       }
 
diff --git a/deps/v8/src/trap-handler/handler-inside-posix.cc b/deps/v8/src/trap-handler/handler-inside-posix.cc
index 0ce8abc1bb445e..02ce935070d79c 100644
--- a/deps/v8/src/trap-handler/handler-inside-posix.cc
+++ b/deps/v8/src/trap-handler/handler-inside-posix.cc
@@ -170,12 +170,24 @@ bool TryHandleSignal(int signum, siginfo_t* info, void* context) {
       return false;
     }
 
-    // The simulated ip will be in the second parameter register (%rsi).
+    // The simulated ip will be in the second parameter register.
+#if V8_HOST_ARCH_X64
     auto* simulated_ip_reg = CONTEXT_REG(rsi, RSI);
+#elif V8_HOST_ARCH_ARM64
+    auto* simulated_ip_reg = CONTEXT_REG(x1, 1);
+#else
+#error "Unsupported architecture."
+#endif
     if (!IsFaultAddressCovered(*simulated_ip_reg)) return false;
     TH_DCHECK(gLandingPad != 0);
 
+#if V8_HOST_ARCH_X64
     auto* return_reg = CONTEXT_REG(rax, RAX);
+#elif V8_HOST_ARCH_ARM64
+    auto* return_reg = CONTEXT_REG(x0, 0);
+#else
+#error "Unsupported architecture."
+#endif
     *return_reg = gLandingPad;
     // The fault_address that is set in non-simulator builds here is set in the
     // simulator directly.
diff --git a/deps/v8/src/trap-handler/handler-outside-simulator.cc b/deps/v8/src/trap-handler/handler-outside-simulator.cc
index 383c95f377cd6a..e3d7ba60b391de 100644
--- a/deps/v8/src/trap-handler/handler-outside-simulator.cc
+++ b/deps/v8/src/trap-handler/handler-outside-simulator.cc
@@ -16,6 +16,7 @@
 
 // Define the v8::internal::trap_handler::ProbeMemory function declared in
 // trap-handler-simulators.h.
+#if V8_HOST_ARCH_X64
 asm(".att_syntax                                                \n"
     ".globl " SYMBOL(v8_internal_simulator_ProbeMemory) "       \n"
     SYMBOL(v8_internal_simulator_ProbeMemory) ":                \n"
@@ -39,5 +40,26 @@ asm(".att_syntax                                                \n"
     SYMBOL(v8_simulator_probe_memory_continuation) ":           \n"
     // If the trap handler continues here, it wrote the landing pad in %rax.
     "  ret                                                      \n");
-
+#elif V8_HOST_ARCH_ARM64
+asm(".globl " SYMBOL(v8_internal_simulator_ProbeMemory) "       \n"
+    SYMBOL(v8_internal_simulator_ProbeMemory) ":                \n"
+    // First parameter (address) passed in x0.
+    // The second parameter (pc) is unused here. It is read by the trap handler
+    // instead.
+    "  ldrb wzr, [x0]                                           \n"
+    // Return 0 on success.
+    "  mov x0, xzr                                              \n"
+    // Place an additional "ret" here instead of falling through to the one
+    // below, because (some) toolchain(s) on Mac set ".subsections_via_symbols",
+    // which can cause the "ret" below to be placed elsewhere. An alternative
+    // prevention would be to add ".alt_entry" (see
+    // https://reviews.llvm.org/D79926), but just adding a "ret" is simpler.
+    "  ret                                                      \n"
+    ".globl " SYMBOL(v8_simulator_probe_memory_continuation) "  \n"
+    SYMBOL(v8_simulator_probe_memory_continuation) ":           \n"
+    // If the trap handler continues here, it wrote the landing pad in x0.
+    "  ret                                                      \n");
+#else
+#error "Unsupported architecture"
+#endif
 #endif
diff --git a/deps/v8/src/trap-handler/trap-handler.h b/deps/v8/src/trap-handler/trap-handler.h
index bd6f19593d3dca..c5d48091b3bf45 100644
--- a/deps/v8/src/trap-handler/trap-handler.h
+++ b/deps/v8/src/trap-handler/trap-handler.h
@@ -20,10 +20,14 @@ namespace v8::internal::trap_handler {
     ((V8_OS_LINUX && !V8_OS_ANDROID) || V8_OS_WIN || V8_OS_DARWIN || \
      V8_OS_FREEBSD)
 #define V8_TRAP_HANDLER_SUPPORTED true
-// Arm64 (non-simulator) on Linux, Windows, MacOS.
+// Arm64 native on Linux, Windows, MacOS.
 #elif V8_TARGET_ARCH_ARM64 && V8_HOST_ARCH_ARM64 && \
     ((V8_OS_LINUX && !V8_OS_ANDROID) || V8_OS_WIN || V8_OS_DARWIN)
 #define V8_TRAP_HANDLER_SUPPORTED true
+// For Linux and Mac, enable the simulator when it's been requested.
+#if USE_SIMULATOR && ((V8_OS_LINUX && !V8_OS_ANDROID) || V8_OS_DARWIN)
+#define V8_TRAP_HANDLER_VIA_SIMULATOR
+#endif
 // Arm64 simulator on x64 on Linux, Mac, or Windows.
 //
 // The simulator case uses some inline assembly code, which cannot be
diff --git a/deps/v8/src/utils/allocation.cc b/deps/v8/src/utils/allocation.cc
index 715b82bb935565..49962e13b77a08 100644
--- a/deps/v8/src/utils/allocation.cc
+++ b/deps/v8/src/utils/allocation.cc
@@ -6,6 +6,7 @@
 
 #include <stdlib.h>  // For free, malloc.
 
+#include "src/base/address-region.h"
 #include "src/base/bits.h"
 #include "src/base/bounded-page-allocator.h"
 #include "src/base/lazy-instance.h"
@@ -250,6 +251,18 @@ bool VirtualMemory::RecommitPages(Address address, size_t size,
   return result;
 }
 
+bool VirtualMemory::Resize(Address address, size_t new_size,
+                           PageAllocator::Permission access) {
+  DCHECK(IsAligned(new_size, page_allocator_->CommitPageSize()));
+  DCHECK_LE(region_.size(), new_size);
+  if (!page_allocator_->ResizeAllocationAt(reinterpret_cast<void*>(address),
+                                           region_.size(), new_size, access)) {
+    return false;
+  }
+  region_.set_size(new_size);
+  return true;
+}
+
 bool VirtualMemory::DiscardSystemPages(Address address, size_t size) {
   CHECK(InVM(address, size));
   bool result = page_allocator_->DiscardSystemPages(
diff --git a/deps/v8/src/utils/allocation.h b/deps/v8/src/utils/allocation.h
index c3c58cdfd956aa..f9d666fd151b00 100644
--- a/deps/v8/src/utils/allocation.h
+++ b/deps/v8/src/utils/allocation.h
@@ -274,6 +274,11 @@ class VirtualMemory final {
   V8_EXPORT_PRIVATE V8_WARN_UNUSED_RESULT bool RecommitPages(
       Address address, size_t size, PageAllocator::Permission access);
 
+  // Resizes the reservation starting at |address| to |new_size| and commits the
+  // additional memory range with the |access| permissions.
+  V8_EXPORT_PRIVATE V8_WARN_UNUSED_RESULT bool Resize(
+      Address address, size_t new_size, PageAllocator::Permission access);
+
   // Frees memory in the given [address, address + size) range. address and size
   // should be operating system page-aligned. The next write to this
   // memory area brings the memory transparently back. This should be treated as
diff --git a/deps/v8/src/utils/utils.h b/deps/v8/src/utils/utils.h
index 5e0c1eebe15340..2efbe8cf4df668 100644
--- a/deps/v8/src/utils/utils.h
+++ b/deps/v8/src/utils/utils.h
@@ -17,7 +17,7 @@
 #include "src/base/compiler-specific.h"
 #include "src/base/logging.h"
 #include "src/base/macros.h"
-#include "src/base/safe_conversions.h"
+#include "src/base/numerics/safe_conversions.h"
 #include "src/base/vector.h"
 #include "src/common/globals.h"
 
diff --git a/deps/v8/src/wasm/baseline/liftoff-compiler.cc b/deps/v8/src/wasm/baseline/liftoff-compiler.cc
index 578d6db49534d6..0e9dc6d4c05b91 100644
--- a/deps/v8/src/wasm/baseline/liftoff-compiler.cc
+++ b/deps/v8/src/wasm/baseline/liftoff-compiler.cc
@@ -91,6 +91,13 @@ struct assert_field_size {
       dst, LoadInstanceIntoRegister(pinned, dst),                          \
       WASM_TRUSTED_INSTANCE_DATA_FIELD_OFFSET(name));
 
+#define LOAD_TAGGED_PTR_FROM_INSTANCE(dst, name, instance)                 \
+  static_assert(                                                           \
+      WASM_TRUSTED_INSTANCE_DATA_FIELD_SIZE(name) == kTaggedSize,          \
+      "field in WasmTrustedInstanceData does not have the expected size"); \
+  __ LoadTaggedPointerFromInstance(                                        \
+      dst, instance, WASM_TRUSTED_INSTANCE_DATA_FIELD_OFFSET(name));
+
 #define LOAD_PROTECTED_PTR_INSTANCE_FIELD(dst, name, pinned)                 \
   static_assert(                                                             \
       WASM_TRUSTED_INSTANCE_DATA_FIELD_SIZE(Protected##name) == kTaggedSize, \
@@ -1793,6 +1800,42 @@ class LiftoffCompiler {
     EmitLandingPad(decoder, pc_offset);
   }
 
+  void ContNew(FullDecoder* decoder, const ContIndexImmediate& imm,
+               const Value& func_ref, Value* result) {
+    UNIMPLEMENTED();
+  }
+
+  void ContBind(FullDecoder* decoder, const ContIndexImmediate& orig_imm,
+                Value input_cont, const Value args[],
+                const ContIndexImmediate& new_imm, Value* result) {
+    UNIMPLEMENTED();
+  }
+
+  void Resume(FullDecoder* decoder, const ContIndexImmediate& imm,
+              base::Vector<HandlerCase> handlers, const Value args[],
+              const Value returns[]) {
+    UNIMPLEMENTED();
+  }
+
+  void ResumeThrow(FullDecoder* decoder,
+                   const wasm::ContIndexImmediate& cont_imm,
+                   const TagIndexImmediate& exc_imm,
+                   base::Vector<wasm::HandlerCase> handlers, const Value args[],
+                   const Value returns[]) {
+    UNIMPLEMENTED();
+  }
+
+  void Switch(FullDecoder* decoder, const TagIndexImmediate& tag_imm,
+              const ContIndexImmediate& con_imm, const Value& cont_ref,
+              const Value args[], Value returns[]) {
+    UNIMPLEMENTED();
+  }
+
+  void Suspend(FullDecoder* decoder, const TagIndexImmediate& imm,
+               const Value args[], const Value returns[]) {
+    UNIMPLEMENTED();
+  }
+
   // Before emitting the conditional branch, {will_freeze} will be initialized
   // to prevent cache state changes in conditionally executed code.
   void JumpIfFalse(FullDecoder* decoder, Label* false_dst,
@@ -3915,8 +3958,9 @@ class LiftoffCompiler {
                i64_offset);
     } else {
       LiftoffRegister full_index = __ PopToRegister(pinned);
-      ForceCheck force_check =
-          kPartialOOBWritesAreNoops ? kDontForceCheck : kDoForceCheck;
+      ForceCheck force_check = (kPartialOOBWritesAreNoops || type.size() == 1)
+                                   ? kDontForceCheck
+                                   : kDoForceCheck;
       index =
           BoundsCheckMem(decoder, imm.memory, type.size(), imm.offset,
                          full_index, pinned, force_check, kDontCheckAlignment);
@@ -3951,8 +3995,9 @@ class LiftoffCompiler {
     LiftoffRegList pinned;
     LiftoffRegister value = pinned.set(__ PopToRegister());
     LiftoffRegister full_index = __ PopToRegister(pinned);
-    ForceCheck force_check =
-        kPartialOOBWritesAreNoops ? kDontForceCheck : kDoForceCheck;
+    ForceCheck force_check = (kPartialOOBWritesAreNoops || type.size() == 1)
+                                 ? kDontForceCheck
+                                 : kDoForceCheck;
     Register index =
         BoundsCheckMem(decoder, imm.memory, type.size(), imm.offset, full_index,
                        pinned, force_check, kDontCheckAlignment);
@@ -6624,7 +6669,7 @@ class LiftoffCompiler {
   LiftoffRegister GetRtt(FullDecoder* decoder, ModuleTypeIndex index,
                          const TypeDefinition& type,
                          const Value& descriptor_value) {
-    if (!type.has_descriptor()) return RttCanon(index, {});
+    if (!type.has_descriptor()) return RttCanon(decoder, index, {});
     return GetRttFromDescriptorOnStack(decoder, descriptor_value);
   }
 
@@ -6645,19 +6690,40 @@ class LiftoffCompiler {
     return rtt;
   }
 
+  VarState GetFirstFieldIfPrototype(const StructType* struct_type,
+                                    bool initial_values_on_stack,
+                                    LiftoffRegList pinned) {
+    // If the first field might be a DescriptorOptions containing a
+    // JS prototype, we must pass it along. Otherwise, to satisfy the
+    // parameter count, we pass Smi(0).
+    if (initial_values_on_stack &&
+        struct_type->first_field_can_be_prototype()) {
+      int slot = -struct_type->field_count();
+      return __ cache_state() -> stack_state.end()[slot];
+    }
+    LiftoffRegister reg = __ GetUnusedRegister(kGpReg, pinned);
+    LoadSmi(reg, 0);
+    return VarState{kRef, reg, 0};
+  }
+
   void StructNew(FullDecoder* decoder, const StructIndexImmediate& imm,
                  const Value& descriptor, bool initial_values_on_stack) {
     const TypeDefinition& type = decoder->module_->type(imm.index);
     LiftoffRegister rtt = GetRtt(decoder, imm.index, type, descriptor);
 
     if (type.is_descriptor()) {
+      VarState first_field = GetFirstFieldIfPrototype(
+          imm.struct_type, initial_values_on_stack, LiftoffRegList{rtt});
       CallBuiltin(Builtin::kWasmAllocateDescriptorStruct,
-                  MakeSig::Returns(kRef).Params(kRef, kI32),
+                  MakeSig::Returns(kRef).Params(kRef, kI32, kRef),
                   {VarState{kRef, rtt, 0},
-                   VarState{kI32, static_cast<int32_t>(imm.index.index), 0}},
+                   VarState{kI32, static_cast<int32_t>(imm.index.index), 0},
+                   first_field},
                   decoder->position());
     } else {
-      CallBuiltin(Builtin::kWasmAllocateStructWithRtt,
+      bool is_shared = type.is_shared;
+      CallBuiltin(is_shared ? Builtin::kWasmAllocateSharedStructWithRtt
+                            : Builtin::kWasmAllocateStructWithRtt,
                   MakeSig::Returns(kRef).Params(kRef, kI32),
                   {VarState{kRef, rtt, 0},
                    VarState{kI32, WasmStruct::Size(imm.struct_type), 0}},
@@ -6685,7 +6751,9 @@ class LiftoffCompiler {
       // (1) {obj} is freshly allocated, and
       // (2) {obj} is in new-space (not pretenured).
       StoreObjectField(decoder, obj.gp(), no_reg, offset, value, false, pinned,
-                       field_type.kind(), LiftoffAssembler::kSkipWriteBarrier);
+                       field_type.kind(),
+                       type.is_shared ? LiftoffAssembler::kNoSkipWriteBarrier
+                                      : LiftoffAssembler::kSkipWriteBarrier);
       pinned.clear(value);
     }
     // If this assert fails then initialization of padding field might be
@@ -6766,8 +6834,10 @@ class LiftoffCompiler {
     int elem_size = value_kind_size(elem_kind);
     // Allocate the array.
     {
-      LiftoffRegister rtt = RttCanon(imm.index, {});
-      CallBuiltin(Builtin::kWasmAllocateArray_Uninitialized,
+      LiftoffRegister rtt = RttCanon(decoder, imm.index, {});
+      const bool is_shared = decoder->module_->type(imm.index).is_shared;
+      CallBuiltin(is_shared ? Builtin::kWasmAllocateSharedArray_Uninitialized
+                            : Builtin::kWasmAllocateArray_Uninitialized,
                   MakeSig::Returns(kRef).Params(kRef, kI32, kI32),
                   {VarState{kRef, rtt, 0},
                    __ cache_state()->stack_state.end()[-1],  // length
@@ -6950,11 +7020,13 @@ class LiftoffCompiler {
   void ArrayNewFixed(FullDecoder* decoder, const ArrayIndexImmediate& array_imm,
                      const IndexImmediate& length_imm,
                      const Value* /* elements */, Value* /* result */) {
-    LiftoffRegister rtt = RttCanon(array_imm.index, {});
+    LiftoffRegister rtt = RttCanon(decoder, array_imm.index, {});
     ValueKind elem_kind = array_imm.array_type->element_type().kind();
     int32_t elem_count = length_imm.index;
     // Allocate the array.
-    CallBuiltin(Builtin::kWasmAllocateArray_Uninitialized,
+    const bool is_shared = decoder->module_->type(array_imm.index).is_shared;
+    CallBuiltin(is_shared ? Builtin::kWasmAllocateSharedArray_Uninitialized
+                          : Builtin::kWasmAllocateArray_Uninitialized,
                 MakeSig::Returns(kRef).Params(kRef, kI32, kI32),
                 {VarState{kRef, rtt, 0}, VarState{kI32, elem_count, 0},
                  VarState{kI32, value_kind_size(elem_kind), 0}},
@@ -6988,7 +7060,8 @@ class LiftoffCompiler {
     FUZZER_HEAVY_INSTRUCTION;
     LiftoffRegList pinned;
 
-    LiftoffRegister rtt = pinned.set(RttCanon(array_imm.index, pinned));
+    LiftoffRegister rtt =
+        pinned.set(RttCanon(decoder, array_imm.index, pinned));
 
     LiftoffRegister is_element_reg =
         pinned.set(__ GetUnusedRegister(kGpReg, pinned));
@@ -7126,9 +7199,16 @@ class LiftoffCompiler {
     __ PushRegister(kRef, value);
   }
 
-  LiftoffRegister RttCanon(ModuleTypeIndex type_index, LiftoffRegList pinned) {
+  LiftoffRegister RttCanon(FullDecoder* decoder, ModuleTypeIndex type_index,
+                           LiftoffRegList pinned) {
+    bool is_shared = decoder->module_->type(type_index).is_shared;
     LiftoffRegister rtt = pinned.set(__ GetUnusedRegister(kGpReg, pinned));
-    LOAD_TAGGED_PTR_INSTANCE_FIELD(rtt.gp(), ManagedObjectMaps, pinned);
+    if (is_shared) {
+      LOAD_PROTECTED_PTR_INSTANCE_FIELD(rtt.gp(), SharedPart, pinned);
+      LOAD_TAGGED_PTR_FROM_INSTANCE(rtt.gp(), ManagedObjectMaps, rtt.gp())
+    } else {
+      LOAD_TAGGED_PTR_INSTANCE_FIELD(rtt.gp(), ManagedObjectMaps, pinned);
+    }
     __ LoadTaggedPointer(
         rtt.gp(), rtt.gp(), no_reg,
         wasm::ObjectAccess::ElementOffsetInTaggedFixedArray(type_index.index));
@@ -7223,7 +7303,7 @@ class LiftoffCompiler {
     Label return_false, done;
     LiftoffRegList pinned;
     LiftoffRegister rtt_reg =
-        pinned.set(RttCanon(target_type.ref_index(), pinned));
+        pinned.set(RttCanon(decoder, target_type.ref_index(), pinned));
     LiftoffRegister obj_reg = pinned.set(__ PopToRegister(pinned));
     Register scratch_null =
         pinned.set(__ GetUnusedRegister(kGpReg, pinned)).gp();
@@ -7283,7 +7363,7 @@ class LiftoffCompiler {
 
   void RefCast(FullDecoder* decoder, const Value& obj, Value* result) {
     if (v8_flags.experimental_wasm_assume_ref_cast_succeeds) return;
-    LiftoffRegister rtt = RttCanon(result->type.ref_index(), {});
+    LiftoffRegister rtt = RttCanon(decoder, result->type.ref_index(), {});
     return RefCastImpl(decoder, result->type, obj, rtt);
   }
 
@@ -7356,15 +7436,30 @@ class LiftoffCompiler {
   void BrOnCast(FullDecoder* decoder, HeapType target_type, const Value& obj,
                 Value* /* result_on_branch */, uint32_t depth,
                 bool null_succeeds) {
+    LiftoffRegister rtt = RttCanon(decoder, target_type.ref_index(), {});
+    return BrOnCastImpl(decoder, target_type, obj, rtt, depth, null_succeeds);
+  }
+
+  void BrOnCastDesc(FullDecoder* decoder, HeapType target_type,
+                    const Value& obj, const Value& descriptor,
+                    Value* /* result_on_branch */, uint32_t depth,
+                    bool null_succeeds) {
+    LiftoffRegister rtt = GetRttFromDescriptorOnStack(decoder, descriptor);
+    // Pretending that the target type is exact skips the supertype check.
+    return BrOnCastImpl(decoder, target_type.AsExact(), obj, rtt, depth,
+                        null_succeeds);
+  }
+  void BrOnCastImpl(FullDecoder* decoder, HeapType target_type,
+                    const Value& obj, LiftoffRegister rtt, uint32_t depth,
+                    bool null_succeeds) {
+    LiftoffRegList pinned{rtt};
     // Avoid having sequences of branches do duplicate work.
     if (depth != decoder->control_depth() - 1) {
-      __ PrepareForBranch(decoder->control_at(depth)->br_merge()->arity, {});
+      __ PrepareForBranch(decoder->control_at(depth)->br_merge()->arity,
+                          pinned);
     }
 
     Label cont_false;
-    LiftoffRegList pinned;
-    LiftoffRegister rtt_reg =
-        pinned.set(RttCanon(target_type.ref_index(), pinned));
     LiftoffRegister obj_reg = pinned.set(__ PeekToRegister(0, pinned));
     Register scratch_null =
         pinned.set(__ GetUnusedRegister(kGpReg, pinned)).gp();
@@ -7375,7 +7470,7 @@ class LiftoffCompiler {
     FREEZE_STATE(frozen);
 
     NullSucceeds null_handling = null_succeeds ? kNullSucceeds : kNullFails;
-    SubtypeCheck(decoder->module_, obj_reg.gp(), obj.type, rtt_reg.gp(),
+    SubtypeCheck(decoder->module_, obj_reg.gp(), obj.type, rtt.gp(),
                  target_type, scratch_null, scratch2, &cont_false,
                  null_handling, frozen);
 
@@ -7387,15 +7482,33 @@ class LiftoffCompiler {
   void BrOnCastFail(FullDecoder* decoder, HeapType target_type,
                     const Value& obj, Value* /* result_on_fallthrough */,
                     uint32_t depth, bool null_succeeds) {
+    LiftoffRegister rtt = RttCanon(decoder, target_type.ref_index(), {});
+    return BrOnCastFailImpl(decoder, target_type, obj, rtt, depth,
+                            null_succeeds);
+  }
+
+  void BrOnCastDescFail(FullDecoder* decoder, HeapType target_type,
+                        const Value& obj, const Value& descriptor,
+                        Value* /* result_on_fallthrough */, uint32_t depth,
+                        bool null_succeeds) {
+    LiftoffRegister rtt = GetRttFromDescriptorOnStack(decoder, descriptor);
+    // Pretending that the target type is exact skips the supertype check.
+    return BrOnCastFailImpl(decoder, target_type.AsExact(), obj, rtt, depth,
+                            null_succeeds);
+  }
+
+  void BrOnCastFailImpl(FullDecoder* decoder, HeapType target_type,
+                        const Value& obj, LiftoffRegister rtt, uint32_t depth,
+                        bool null_succeeds) {
+    LiftoffRegList pinned{rtt};
     // Avoid having sequences of branches do duplicate work.
     if (depth != decoder->control_depth() - 1) {
-      __ PrepareForBranch(decoder->control_at(depth)->br_merge()->arity, {});
+      __ PrepareForBranch(decoder->control_at(depth)->br_merge()->arity,
+                          pinned);
     }
 
     Label cont_branch, fallthrough;
-    LiftoffRegList pinned;
-    LiftoffRegister rtt_reg =
-        pinned.set(RttCanon(target_type.ref_index(), pinned));
+
     LiftoffRegister obj_reg = pinned.set(__ PeekToRegister(0, pinned));
     Register scratch_null =
         pinned.set(__ GetUnusedRegister(kGpReg, pinned)).gp();
@@ -7406,7 +7519,7 @@ class LiftoffCompiler {
     FREEZE_STATE(frozen);
 
     NullSucceeds null_handling = null_succeeds ? kNullSucceeds : kNullFails;
-    SubtypeCheck(decoder->module_, obj_reg.gp(), obj.type, rtt_reg.gp(),
+    SubtypeCheck(decoder->module_, obj_reg.gp(), obj.type, rtt.gp(),
                  target_type, scratch_null, scratch2, &cont_branch,
                  null_handling, frozen);
     __ emit_jump(&fallthrough);
@@ -8440,7 +8553,7 @@ class LiftoffCompiler {
     MaybeEmitNullCheck(decoder, lhs_reg.gp(), pinned, lhs.type);
     VarState lhs_var(kRef, lhs_reg, 0);
 
-    CallBuiltin(Builtin::kStringCompare,
+    CallBuiltin(Builtin::kWasmStringCompare,
                 MakeSig::Returns(kSmiKind).Params(kRef, kRef),
                 {lhs_var, rhs_var}, decoder->position());
     RegisterDebugSideTableEntry(decoder, DebugSideTableBuilder::kDidSpill);
diff --git a/deps/v8/src/wasm/c-api.cc b/deps/v8/src/wasm/c-api.cc
index 6594e5aa110598..0da6ee80db1298 100644
--- a/deps/v8/src/wasm/c-api.cc
+++ b/deps/v8/src/wasm/c-api.cc
@@ -1983,7 +1983,7 @@ struct implement<Global> {
   using type = RefImpl<Global, i::WasmGlobalObject>;
 };
 
-WASM_EXPORT void Global::destroy() { delete (this); }
+WASM_EXPORT void Global::destroy() { delete impl(this); }
 
 WASM_EXPORT auto Global::copy() const -> own<Global> {
   return impl(this)->copy();
diff --git a/deps/v8/src/wasm/canonical-types.cc b/deps/v8/src/wasm/canonical-types.cc
index 86c8cb33f57ed5..45e5f5df318271 100644
--- a/deps/v8/src/wasm/canonical-types.cc
+++ b/deps/v8/src/wasm/canonical-types.cc
@@ -392,7 +392,7 @@ CanonicalTypeIndex TypeCanonicalizer::FindCanonicalGroup(
 }
 
 size_t TypeCanonicalizer::EstimateCurrentMemoryConsumption() const {
-  UPDATE_WHEN_CLASS_CHANGES(TypeCanonicalizer, 8040);
+  UPDATE_WHEN_CLASS_CHANGES(TypeCanonicalizer, 8048);
   // The storage of the canonical group's types is accounted for via the
   // allocator below (which tracks the zone memory).
   base::MutexGuard mutex_guard(&mutex_);
@@ -473,6 +473,9 @@ bool TypeCanonicalizer::IsStruct(CanonicalTypeIndex index) const {
 bool TypeCanonicalizer::IsArray(CanonicalTypeIndex index) const {
   return canonical_types_[index]->kind == CanonicalType::kArray;
 }
+bool TypeCanonicalizer::IsShared(CanonicalTypeIndex index) const {
+  return canonical_types_[index]->is_shared;
+}
 
 CanonicalTypeIndex TypeCanonicalizer::FindIndex_Slow(
     const CanonicalSig* sig) const {
diff --git a/deps/v8/src/wasm/canonical-types.h b/deps/v8/src/wasm/canonical-types.h
index a63542224eac28..911cf33e5a5be0 100644
--- a/deps/v8/src/wasm/canonical-types.h
+++ b/deps/v8/src/wasm/canonical-types.h
@@ -113,6 +113,7 @@ class TypeCanonicalizer {
   V8_EXPORT_PRIVATE bool IsFunctionSignature(CanonicalTypeIndex index) const;
   V8_EXPORT_PRIVATE bool IsStruct(CanonicalTypeIndex index) const;
   V8_EXPORT_PRIVATE bool IsArray(CanonicalTypeIndex index) const;
+  V8_EXPORT_PRIVATE bool IsShared(CanonicalTypeIndex index) const;
 
   bool IsHeapSubtype(CanonicalTypeIndex sub, CanonicalTypeIndex super) const;
   bool IsCanonicalSubtype_Locked(CanonicalTypeIndex sub_index,
diff --git a/deps/v8/src/wasm/constant-expression-interface.cc b/deps/v8/src/wasm/constant-expression-interface.cc
index b06009f4a9265f..022820f176f331 100644
--- a/deps/v8/src/wasm/constant-expression-interface.cc
+++ b/deps/v8/src/wasm/constant-expression-interface.cc
@@ -124,7 +124,8 @@ void ConstantExpressionInterface::RefFunc(FullDecoder* decoder,
   bool function_is_shared = module_->type(sig_index).is_shared;
   CanonicalValueType type =
       CanonicalValueType::Ref(module_->canonical_type_id(sig_index),
-                              function_is_shared, RefTypeKind::kFunction);
+                              function_is_shared, RefTypeKind::kFunction)
+          .AsExactIfProposalEnabled();
   DirectHandle<WasmFuncRef> func_ref =
       WasmTrustedInstanceData::GetOrCreateFuncRef(
           isolate_,
@@ -192,8 +193,12 @@ void ConstantExpressionInterface::StructNew(FullDecoder* decoder,
 
   DirectHandle<WasmStruct> obj;
   if (type.is_descriptor()) {
+    DirectHandle<Object> first_field =
+        struct_type->first_field_can_be_prototype()
+            ? args[0].runtime_value.to_ref()
+            : direct_handle(Smi::zero(), isolate_);
     obj = WasmStruct::AllocateDescriptorUninitialized(isolate_, data, imm.index,
-                                                      rtt);
+                                                      rtt, first_field);
   } else {
     obj = isolate_->factory()->NewWasmStructUninitialized(struct_type, rtt);
   }
@@ -282,8 +287,9 @@ void ConstantExpressionInterface::StructNewDefault(
 
   DirectHandle<WasmStruct> obj;
   if (type.is_descriptor()) {
+    DirectHandle<Object> first_field(Smi::zero(), isolate_);
     obj = WasmStruct::AllocateDescriptorUninitialized(isolate_, data, imm.index,
-                                                      rtt);
+                                                      rtt, first_field);
   } else {
     obj = isolate_->factory()->NewWasmStructUninitialized(struct_type, rtt);
   }
@@ -329,7 +335,8 @@ void ConstantExpressionInterface::ArrayNew(FullDecoder* decoder,
       isolate_->factory()->NewWasmArray(imm.array_type->element_type(),
                                         length.runtime_value.to_u32(),
                                         initial_value.runtime_value, rtt),
-      decoder->module_->canonical_type(ValueType::Ref(imm.heap_type())));
+      decoder->module_->canonical_type(
+          ValueType::Ref(imm.heap_type()).AsExactIfProposalEnabled()));
 }
 
 void ConstantExpressionInterface::ArrayNewDefault(
@@ -359,7 +366,8 @@ void ConstantExpressionInterface::ArrayNewFixed(
   result->runtime_value = WasmValue(
       isolate_->factory()->NewWasmArrayFromElements(array_imm.array_type,
                                                     element_values, rtt),
-      decoder->module_->canonical_type(ValueType::Ref(array_imm.heap_type())));
+      decoder->module_->canonical_type(
+          ValueType::Ref(array_imm.heap_type()).AsExactIfProposalEnabled()));
 }
 
 // TODO(14034): These expressions are non-constant for now. There are plans to
@@ -388,7 +396,8 @@ void ConstantExpressionInterface::ArrayNewSegment(
     return;
   }
   CanonicalValueType element_type = rtt->wasm_type_info()->element_type();
-  CanonicalValueType result_type = rtt->wasm_type_info()->type();
+  CanonicalValueType result_type =
+      rtt->wasm_type_info()->type().AsExactIfProposalEnabled();
   if (element_type.is_numeric()) {
     const WasmDataSegment& data_segment =
         module_->data_segments[segment_imm.index];
diff --git a/deps/v8/src/wasm/function-body-decoder-impl.h b/deps/v8/src/wasm/function-body-decoder-impl.h
index cc073be743236f..4fbb26614c4063 100644
--- a/deps/v8/src/wasm/function-body-decoder-impl.h
+++ b/deps/v8/src/wasm/function-body-decoder-impl.h
@@ -212,7 +212,8 @@ namespace value_type_reader {
 template <typename ValidationTag>
 std::pair<HeapType, uint32_t> read_heap_type(Decoder* decoder,
                                              const uint8_t* pc,
-                                             WasmEnabledFeatures enabled) {
+                                             WasmEnabledFeatures enabled,
+                                             WasmDetectedFeatures* detected) {
   auto [heap_index, length] =
       decoder->read_i33v<ValidationTag>(pc, "heap type");
   Exactness exactness = Exactness::kAnySubtype;
@@ -260,6 +261,15 @@ std::pair<HeapType, uint32_t> read_heap_type(Decoder* decoder,
               HeapType::from_code(code, is_shared).name().c_str());
           return {kWasmBottom, 0};
         }
+        if (!VALIDATE(!detected->has_legacy_eh() ||
+                      v8_flags.wasm_allow_mixed_eh_for_testing)) {
+          DecodeError<ValidationTag>(
+              decoder, pc,
+              "module uses a mix of legacy and new exception handling "
+              "instructions");
+          return {kWasmBottom, 0};
+        }
+        detected->add_exnref();
         return {HeapType::from_code(code, is_shared), length};
       case kStringRefCode:
       case kStringViewWtf8Code:
@@ -329,7 +339,8 @@ std::pair<HeapType, uint32_t> read_heap_type(Decoder* decoder,
 template <typename ValidationTag>
 std::pair<ValueType, uint32_t> read_value_type(Decoder* decoder,
                                                const uint8_t* pc,
-                                               WasmEnabledFeatures enabled) {
+                                               WasmEnabledFeatures enabled,
+                                               WasmDetectedFeatures* detected) {
   uint8_t val = decoder->read_u8<ValidationTag>(pc, "value type opcode");
   if (!VALIDATE(decoder->ok())) {
     return {kWasmBottom, 0};
@@ -356,6 +367,15 @@ std::pair<ValueType, uint32_t> read_value_type(Decoder* decoder,
             HeapType::from_code(code, false).name().c_str());
         return {kWasmBottom, 0};
       }
+      if (!VALIDATE(!detected->has_legacy_eh() ||
+                    v8_flags.wasm_allow_mixed_eh_for_testing)) {
+        DecodeError<ValidationTag>(
+            decoder, pc,
+            "module uses a mix of legacy and new exception handling "
+            "instructions");
+        return {kWasmBottom, 0};
+      }
+      detected->add_exnref();
       return {code == kExnRefCode ? kWasmExnRef : kWasmNullExnRef, 1};
     case kStringRefCode:
     case kStringViewWtf8Code:
@@ -397,7 +417,7 @@ std::pair<ValueType, uint32_t> read_value_type(Decoder* decoder,
     case kRefNullCode: {
       Nullability nullability = code == kRefNullCode ? kNullable : kNonNullable;
       auto [heap_type, length] =
-          read_heap_type<ValidationTag>(decoder, pc + 1, enabled);
+          read_heap_type<ValidationTag>(decoder, pc + 1, enabled, detected);
       if (!VALIDATE(!heap_type.is_string_view() ||
                     nullability == kNonNullable)) {
         DecodeError<ValidationTag>(decoder, pc,
@@ -432,7 +452,7 @@ std::pair<ValueType, uint32_t> read_value_type(Decoder* decoder,
   }
   // Anything that doesn't match an enumeration value is an invalid type code.
   if constexpr (!ValidationTag::validate) UNREACHABLE();
-  DecodeError<ValidationTag>(decoder, pc, "invalid value type 0x%x", code);
+  DecodeError<ValidationTag>(decoder, pc, "invalid value type 0x%hhx", code);
   return {kWasmBottom, 0};
 }
 
@@ -639,6 +659,20 @@ struct SigIndexImmediate : public TypeIndexImmediate {
   }
 };
 
+struct ContIndexImmediate : public TypeIndexImmediate {
+  const ContType* cont_type = nullptr;
+  bool shared = false;
+
+  template <typename ValidationTag>
+  ContIndexImmediate(Decoder* decoder, const uint8_t* pc,
+                     ValidationTag validate = {})
+      : TypeIndexImmediate(decoder, pc, "cont index", validate) {}
+
+  HeapType heap_type() const {
+    return HeapType::Index(index, shared, RefTypeKind::kCont);
+  }
+};
+
 struct StructIndexImmediate : public TypeIndexImmediate {
   const StructType* struct_type = nullptr;
   bool shared = false;
@@ -681,7 +715,8 @@ struct SelectTypeImmediate {
   ValueType type;
 
   template <typename ValidationTag>
-  SelectTypeImmediate(WasmEnabledFeatures enabled, Decoder* decoder,
+  SelectTypeImmediate(WasmEnabledFeatures enabled,
+                      WasmDetectedFeatures* detected, Decoder* decoder,
                       const uint8_t* pc, ValidationTag = {}) {
     uint8_t num_types;
     std::tie(num_types, length) =
@@ -695,7 +730,7 @@ struct SelectTypeImmediate {
     uint32_t type_length;
     std::tie(type, type_length) =
         value_type_reader::read_value_type<ValidationTag>(decoder, pc + length,
-                                                          enabled);
+                                                          enabled, detected);
     length += type_length;
   }
 };
@@ -717,7 +752,8 @@ struct BlockTypeImmediate {
   BlockTypeImmediate& operator=(BlockTypeImmediate&&) = delete;
 
   template <typename ValidationTag>
-  BlockTypeImmediate(WasmEnabledFeatures enabled, Decoder* decoder,
+  BlockTypeImmediate(WasmEnabledFeatures enabled,
+                     WasmDetectedFeatures* detected, Decoder* decoder,
                      const uint8_t* pc, ValidationTag = {}) {
     int64_t block_type;
     std::tie(block_type, length) =
@@ -734,8 +770,8 @@ struct BlockTypeImmediate {
       if (static_cast<ValueTypeCode>(block_type & 0x7F) != kVoidCode) {
         sig = FunctionSig{1, 0, single_return_sig_storage};
         std::tie(single_return_sig_storage[0], length) =
-            value_type_reader::read_value_type<ValidationTag>(decoder, pc,
-                                                              enabled);
+            value_type_reader::read_value_type<ValidationTag>(
+                decoder, pc, enabled, detected);
       }
     } else {
       sig = FunctionSig{0, 0, nullptr};
@@ -907,6 +943,68 @@ class TryTableIterator {
   const uint32_t table_count_;  // the count of entries, not including default.
 };
 
+using EffectHandlerTableImmediate = BranchTableImmediate;
+
+struct HandlerCase {
+  SwitchKind kind;        // Regular handler or a switch site.
+  TagIndexImmediate tag;  // Tag defining this handler site.
+  union MaybeHandlerDepth {
+    uint8_t empty;
+    BranchDepthImmediate br;
+  } maybe_depth;
+};
+
+// A helper to iterate over a handler table.
+template <typename ValidationTag>
+class EffectHandlerTableIterator {
+ public:
+  uint32_t cur_index() const { return index_; }
+  bool has_next() const {
+    return VALIDATE(decoder_->ok()) && index_ < table_count_;
+  }
+
+  HandlerCase next() {
+    uint8_t kind =
+        static_cast<CatchKind>(decoder_->read_u8<ValidationTag>(pc_));
+    pc_ += 1;
+    TagIndexImmediate tag = TagIndexImmediate(decoder_, pc_, ValidationTag{});
+    pc_ += tag.length;
+
+    HandlerCase::MaybeHandlerDepth maybe_depth{0};
+
+    if (kind == kOnSuspend) {
+      maybe_depth.br = BranchDepthImmediate(decoder_, pc_, ValidationTag{});
+      pc_ += maybe_depth.br.length;
+    }
+    index_++;
+
+    return HandlerCase{static_cast<SwitchKind>(kind), tag, maybe_depth};
+  }
+
+  // length, including the length of the {EffectHandlerTableImmediate}, but not
+  // the opcode. This consumes the table entries, so it is invalid to call
+  // next() before or after this method.
+  uint32_t length() {
+    while (has_next()) next();
+    return static_cast<uint32_t>(pc_ - start_);
+  }
+  const uint8_t* pc() const { return pc_; }
+
+  EffectHandlerTableIterator(Decoder* decoder,
+                             const EffectHandlerTableImmediate& imm)
+      : decoder_(decoder),
+        start_(imm.start),
+        pc_(imm.table),
+        table_count_(imm.table_count) {}
+
+ private:
+  Decoder* const decoder_;
+  const uint8_t* const start_;
+  const uint8_t* pc_;
+  uint32_t index_ = 0;  // the current index.
+  const uint32_t table_count_;
+};
+
 struct MemoryAccessImmediate {
   uint32_t alignment;
   uint32_t mem_index;
@@ -1043,10 +1141,10 @@ struct HeapTypeImmediate {
   HeapType type = kWasmBottom;
 
   template <typename ValidationTag>
-  HeapTypeImmediate(WasmEnabledFeatures enabled, Decoder* decoder,
-                    const uint8_t* pc, ValidationTag = {}) {
-    std::tie(type, length) =
-        value_type_reader::read_heap_type<ValidationTag>(decoder, pc, enabled);
+  HeapTypeImmediate(WasmEnabledFeatures enabled, WasmDetectedFeatures* detected,
+                    Decoder* decoder, const uint8_t* pc, ValidationTag = {}) {
+    std::tie(type, length) = value_type_reader::read_heap_type<ValidationTag>(
+        decoder, pc, enabled, detected);
   }
 };
 
@@ -1308,6 +1406,20 @@ struct ControlBase : public PcForErrors<ValidationTag::validate> {
     base::Vector<Value> caught_values)                                         \
   F(Delegate, uint32_t depth, Control* block)                                  \
   F(CatchAll, Control* block)                                                  \
+  F(ContNew, const ContIndexImmediate& imm, const Value& func_ref,             \
+    Value* result)                                                             \
+  F(ContBind, const ContIndexImmediate& orig_imm, Value input_cont,            \
+    const Value args[], const ContIndexImmediate& new_imm, Value* result)      \
+  F(Resume, const ContIndexImmediate& imm, base::Vector<HandlerCase> handlers, \
+    const Value args[], const Value returns[])                                 \
+  F(ResumeThrow, const ContIndexImmediate& cont_imm,                           \
+    const TagIndexImmediate& exc_imm, base::Vector<HandlerCase> handlers,      \
+    const Value args[], const Value returns[])                                 \
+  F(Suspend, const TagIndexImmediate& imm, const Value args[],                 \
+    const Value returns[])                                                     \
+  F(Switch, const TagIndexImmediate& tag_imm,                                  \
+    const ContIndexImmediate& con_imm, const Value& cont_ref,                  \
+    const Value args[], Value returns[])                                       \
   F(AtomicOp, WasmOpcode opcode, const Value args[], const size_t argc,        \
     const MemoryAccessImmediate& imm, Value* result)                           \
   F(AtomicFence)                                                               \
@@ -1363,6 +1475,11 @@ struct ControlBase : public PcForErrors<ValidationTag::validate> {
     uint32_t depth, bool null_succeeds)                                        \
   F(BrOnCastFail, HeapType target_type, const Value& obj,                      \
     Value* result_on_fallthrough, uint32_t depth, bool null_succeeds)          \
+  F(BrOnCastDesc, HeapType target_type, const Value& obj, const Value& desc,   \
+    Value* result_on_branch, uint32_t depth, bool null_succeeds)               \
+  F(BrOnCastDescFail, HeapType target_type, const Value& obj,                  \
+    const Value& desc, Value* result_on_fallthrough, uint32_t depth,           \
+    bool null_succeeds)                                                        \
   F(BrOnCastAbstract, const Value& obj, HeapType type,                         \
     Value* result_on_branch, uint32_t depth, bool null_succeeds)               \
   F(BrOnCastFailAbstract, const Value& obj, HeapType type,                     \
@@ -1636,7 +1753,7 @@ class WasmDecoder : public Decoder {
 
       auto [type, type_length] =
           value_type_reader::read_value_type<ValidationTag>(
-              this, pc + total_length, enabled_);
+              this, pc + total_length, enabled_, detected_);
       ValidateValueType(pc + total_length, type);
       if (!VALIDATE(ok())) return 0;
       if (module_) {
@@ -2114,6 +2231,17 @@ class WasmDecoder : public Decoder {
     return true;
   }
 
+  bool ValidateCont(const uint8_t* pc, ContIndexImmediate& imm) {
+    if (!VALIDATE(module_->has_cont_type(imm.index))) {
+      DecodeError(pc, "invalid cont index: %u", imm.index.index);
+      return false;
+    }
+    imm.cont_type = module_->cont_type(imm.index);
+    imm.shared = module_->type(imm.index).is_shared;
+
+    return true;
+  }
+
   bool ValidateDataSegment(const uint8_t* pc, IndexImmediate& imm) {
     if (!VALIDATE(imm.index < module_->num_declared_data_segments)) {
       DecodeError(pc, "invalid data segment index: %u", imm.index);
@@ -2170,8 +2298,8 @@ class WasmDecoder : public Decoder {
       case kExprIf:
       case kExprLoop:
       case kExprBlock: {
-        BlockTypeImmediate imm(WasmEnabledFeatures::All(), decoder, pc + 1,
-                               validate);
+        BlockTypeImmediate imm(WasmEnabledFeatures::All(), decoder->detected_,
+                               decoder, pc + 1, validate);
         (ios.BlockType(imm), ...);
         return 1 + imm.length;
       }
@@ -2192,8 +2320,9 @@ class WasmDecoder : public Decoder {
         return 1 + iterator.length();
       }
       case kExprTryTable: {
-        BlockTypeImmediate block_type_imm(WasmEnabledFeatures::All(), decoder,
-                                          pc + 1, validate);
+        BlockTypeImmediate block_type_imm(WasmEnabledFeatures::All(),
+                                          decoder->detected_, decoder, pc + 1,
+                                          validate);
         (ios.BlockType(block_type_imm), ...);
         TryTableImmediate try_table_imm(decoder, pc + 1 + block_type_imm.length,
                                         validate);
@@ -2210,6 +2339,54 @@ class WasmDecoder : public Decoder {
       case kExprThrowRef:
         return 1;
 
+      /********** Core stack switching ********/
+      case kExprContNew: {
+        ContIndexImmediate imm(decoder, pc + 1, validate);
+        (ios.TypeIndex(imm), ...);
+        return 1 + imm.length;
+      }
+      case kExprContBind: {
+        ContIndexImmediate src(decoder, pc + 1, validate);
+        (ios.TypeIndex(src), ...);
+        ContIndexImmediate dst(decoder, pc + 1 + src.length, validate);
+        (ios.TypeIndex(dst), ...);
+        return 1 + src.length + dst.length;
+      }
+      case kExprSuspend: {
+        TagIndexImmediate imm(decoder, pc + 1, validate);
+        (ios.TagIndex(imm), ...);
+        return 1 + imm.length;
+      }
+      case kExprResume: {
+        ContIndexImmediate src(decoder, pc + 1, validate);
+        (ios.TypeIndex(src), ...);
+        EffectHandlerTableImmediate handler_table(decoder, pc + 1 + src.length,
+                                                  validate);
+        (ios.EffectHandlerTable(handler_table), ...);
+        EffectHandlerTableIterator<ValidationTag> iterator(decoder,
+                                                           handler_table);
+        return 1 + src.length + iterator.length();
+      }
+      case kExprResumeThrow: {
+        ContIndexImmediate src(decoder, pc + 1, validate);
+        (ios.TypeIndex(src), ...);
+        TagIndexImmediate event(decoder, pc + src.length + 1, validate);
+        (ios.TagIndex(event), ...);
+        EffectHandlerTableImmediate handler_table(
+            decoder, pc + 1 + src.length + event.length, validate);
+        (ios.EffectHandlerTable(handler_table), ...);
+        EffectHandlerTableIterator<ValidationTag> iterator(decoder,
+                                                           handler_table);
+        return 1 + src.length + event.length + iterator.length();
+      }
+      case kExprSwitch: {
+        ContIndexImmediate src(decoder, pc + 1, validate);
+        (ios.TypeIndex(src), ...);
+        TagIndexImmediate tag(decoder, pc + src.length + 1, validate);
+        (ios.TagIndex(tag), ...);
+        return 1 + src.length + tag.length;
+      }
+
       /********** Misc opcodes **********/
       case kExprCallFunction:
       case kExprReturnCall: {
@@ -2235,8 +2412,8 @@ class WasmDecoder : public Decoder {
       case kExprRefEq:
         return 1;
       case kExprSelectWithType: {
-        SelectTypeImmediate imm(WasmEnabledFeatures::All(), decoder, pc + 1,
-                                validate);
+        SelectTypeImmediate imm(WasmEnabledFeatures::All(), decoder->detected_,
+                                decoder, pc + 1, validate);
         (ios.SelectType(imm), ...);
         return 1 + imm.length;
       }
@@ -2283,8 +2460,8 @@ class WasmDecoder : public Decoder {
         }
         return 9;
       case kExprRefNull: {
-        HeapTypeImmediate imm(WasmEnabledFeatures::All(), decoder, pc + 1,
-                              validate);
+        HeapTypeImmediate imm(WasmEnabledFeatures::All(), decoder->detected_,
+                              decoder, pc + 1, validate);
         (ios.HeapType(imm), ...);
         return 1 + imm.length;
       }
@@ -2544,8 +2721,9 @@ class WasmDecoder : public Decoder {
           case kExprRefCastDescNull:
           case kExprRefTest:
           case kExprRefTestNull: {
-            HeapTypeImmediate imm(WasmEnabledFeatures::All(), decoder,
-                                  pc + length, validate);
+            HeapTypeImmediate imm(WasmEnabledFeatures::All(),
+                                  decoder->detected_, decoder, pc + length,
+                                  validate);
             (ios.HeapType(imm), ...);
             return length + imm.length;
           }
@@ -2557,9 +2735,10 @@ class WasmDecoder : public Decoder {
             BranchDepthImmediate branch(decoder, pc + length + flags_imm.length,
                                         validate);
             HeapTypeImmediate source_imm(
-                WasmEnabledFeatures::All(), decoder,
+                WasmEnabledFeatures::All(), decoder->detected_, decoder,
                 pc + length + flags_imm.length + branch.length, validate);
-            HeapTypeImmediate target_imm(WasmEnabledFeatures::All(), decoder,
+            HeapTypeImmediate target_imm(WasmEnabledFeatures::All(),
+                                         decoder->detected_, decoder,
                                          pc + length + flags_imm.length +
                                              branch.length + source_imm.length,
                                          validate);
@@ -3211,7 +3390,8 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
 #undef BUILD_SIMPLE_OPCODE
 
   DECODE(Block) {
-    BlockTypeImmediate imm(this->enabled_, this, this->pc_ + 1, validate);
+    BlockTypeImmediate imm(this->enabled_, this->detected_, this, this->pc_ + 1,
+                           validate);
     if (!this->Validate(this->pc_ + 1, imm)) return 0;
     Control* block = PushControl(kControlBlock, imm);
     CALL_INTERFACE_IF_OK_AND_REACHABLE(Block, block);
@@ -3234,12 +3414,9 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
   }
 
   DECODE(Throw) {
-    // This instruction is the same for legacy EH and exnref.
-    // Count it as exnref if exnref is enabled so that we have an accurate eh
-    // count for the deprecation plans.
-    this->detected_->Add(this->enabled_.has_exnref()
-                             ? WasmDetectedFeature::exnref
-                             : WasmDetectedFeature::legacy_eh);
+    // Do not update the detected feature set. This instruction is used by both
+    // the legacy and new EH proposals, so there is no way to know which
+    // one the module is using from this instruction alone.
     TagIndexImmediate imm(this, this->pc_ + 1, validate);
     if (!this->Validate(this->pc_ + 1, imm)) return 0;
     if (imm.tag->sig->return_count() != 0) {
@@ -3255,7 +3432,15 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
 
   DECODE(Try) {
     CHECK_PROTOTYPE_OPCODE(legacy_eh);
-    BlockTypeImmediate imm(this->enabled_, this, this->pc_ + 1, validate);
+    if (!VALIDATE(!this->detected_->has_exnref() ||
+                  v8_flags.wasm_allow_mixed_eh_for_testing)) {
+      this->DecodeError(
+          "module uses a mix of legacy and new exception handling "
+          "instructions");
+      return 0;
+    }
+    BlockTypeImmediate imm(this->enabled_, this->detected_, this, this->pc_ + 1,
+                           validate);
     if (!this->Validate(this->pc_ + 1, imm)) return 0;
     Control* try_block = PushControl(kControlTry, imm);
     try_block->previous_catch = current_catch_;
@@ -3266,6 +3451,8 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
 
   DECODE(Catch) {
     CHECK_PROTOTYPE_OPCODE(legacy_eh);
+    // We must have already seen a "try" opcode, so we don't need to check for
+    // mixed legacy / new EH instructions again.
     TagIndexImmediate imm(this, this->pc_ + 1, validate);
     if (!this->Validate(this->pc_ + 1, imm)) return 0;
     DCHECK(!control_.empty());
@@ -3310,6 +3497,8 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
 
   DECODE(Delegate) {
     CHECK_PROTOTYPE_OPCODE(legacy_eh);
+    // We must have already seen a "try" opcode, so we don't need to check for
+    // mixed legacy / new EH instructions again.
     BranchDepthImmediate imm(this, this->pc_ + 1, validate);
     // -1 because the current try block is not included in the count.
     if (!this->Validate(this->pc_ + 1, imm, control_depth() - 1)) return 0;
@@ -3342,6 +3531,8 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
 
   DECODE(CatchAll) {
     CHECK_PROTOTYPE_OPCODE(legacy_eh);
+    // We must have already seen a "try" opcode, so we don't need to check for
+    // mixed legacy / new EH instructions again.
     DCHECK(!control_.empty());
     Control* c = &control_.back();
     if (!VALIDATE(c->is_try())) {
@@ -3371,7 +3562,15 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
 
   DECODE(TryTable) {
     CHECK_PROTOTYPE_OPCODE(exnref);
-    BlockTypeImmediate block_imm(this->enabled_, this, this->pc_ + 1, validate);
+    if (!VALIDATE(!this->detected_->has_legacy_eh() ||
+                  v8_flags.wasm_allow_mixed_eh_for_testing)) {
+      this->DecodeError(
+          "module uses a mix of legacy and new exception handling "
+          "instructions");
+      return 0;
+    }
+    BlockTypeImmediate block_imm(this->enabled_, this->detected_, this,
+                                 this->pc_ + 1, validate);
     if (!this->Validate(this->pc_ + 1, block_imm)) return 0;
     Control* try_block = PushControl(kControlTryTable, block_imm);
     TryTableImmediate try_table_imm(this, this->pc_ + 1 + block_imm.length,
@@ -3445,6 +3644,13 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
 
   DECODE(ThrowRef) {
     CHECK_PROTOTYPE_OPCODE(exnref);
+    if (!VALIDATE(!this->detected_->has_legacy_eh() ||
+                  v8_flags.wasm_allow_mixed_eh_for_testing)) {
+      this->DecodeError(
+          "module uses a mix of legacy and new exception handling "
+          "instructions");
+      return 0;
+    }
     Value value = Pop(kWasmExnRef);
     CALL_INTERFACE_IF_OK_AND_REACHABLE(ThrowRef, &value);
     MarkMightThrow();
@@ -3544,7 +3750,8 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
   }
 
   DECODE(Loop) {
-    BlockTypeImmediate imm(this->enabled_, this, this->pc_ + 1, validate);
+    BlockTypeImmediate imm(this->enabled_, this->detected_, this, this->pc_ + 1,
+                           validate);
     if (!this->Validate(this->pc_ + 1, imm)) return 0;
     Control* block = PushControl(kControlLoop, imm);
     CALL_INTERFACE_IF_OK_AND_REACHABLE(Loop, block);
@@ -3557,7 +3764,8 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
   }
 
   DECODE(If) {
-    BlockTypeImmediate imm(this->enabled_, this, this->pc_ + 1, validate);
+    BlockTypeImmediate imm(this->enabled_, this->detected_, this, this->pc_ + 1,
+                           validate);
     if (!this->Validate(this->pc_ + 1, imm)) return 0;
     Value cond = Pop(kWasmI32);
     Control* if_block = PushControl(kControlIf, imm);
@@ -3720,7 +3928,8 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
 
   DECODE(SelectWithType) {
     this->detected_->add_reftypes();
-    SelectTypeImmediate imm(this->enabled_, this, this->pc_ + 1, validate);
+    SelectTypeImmediate imm(this->enabled_, this->detected_, this,
+                            this->pc_ + 1, validate);
     if (!this->Validate(this->pc_ + 1, imm)) return 0;
     auto [tval, fval, cond] = Pop(imm.type, imm.type, kWasmI32);
     Value* result = Push(imm.type);
@@ -3856,14 +4065,15 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
 
   DECODE(RefNull) {
     this->detected_->add_reftypes();
-    HeapTypeImmediate imm(this->enabled_, this, this->pc_ + 1, validate);
+    HeapTypeImmediate imm(this->enabled_, this->detected_, this, this->pc_ + 1,
+                          validate);
     if (!this->Validate(this->pc_ + 1, imm)) return 0;
     if (!VALIDATE(!this->enabled_.has_stringref() ||
                   !imm.type.is_string_view())) {
       this->DecodeError(this->pc_ + 1, "cannot create null string view");
       return 0;
     }
-    ValueType type = ValueType::RefNull(imm.type);
+    ValueType type = ValueType::RefNull(imm.type).AsExactIfProposalEnabled();
     Value* value = Push(type);
     CALL_INTERFACE_IF_OK_AND_REACHABLE(RefNull, type, value);
     return 1 + imm.length;
@@ -3898,7 +4108,8 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
     ModuleTypeIndex index = this->module_->functions[imm.index].sig_index;
     const TypeDefinition& type_def = this->module_->type(index);
     Value* value =
-        Push(ValueType::Ref(index, type_def.is_shared, RefTypeKind::kFunction));
+        Push(ValueType::Ref(index, type_def.is_shared, RefTypeKind::kFunction)
+                 .AsExactIfProposalEnabled());
     CALL_INTERFACE_IF_OK_AND_REACHABLE(RefFunc, imm.index, value);
     return 1 + imm.length;
   }
@@ -4156,6 +4367,281 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
     return 1;
   }
 
+  bool IsSubtypeVec(base::Vector<const ValueType> subtypes,
+                    base::Vector<const ValueType> supertypes) {
+    if (subtypes.size() != supertypes.size()) return false;
+
+    auto super_it = supertypes.begin();
+    for (ValueType subtype : subtypes) {
+      if (!IsSubtypeOf(subtype, *super_it++, this->module_)) return false;
+    }
+    return true;
+  }
+
+  DECODE(ContNew) {
+    CHECK_PROTOTYPE_OPCODE(wasmfx);
+    ContIndexImmediate imm(this, this->pc_ + 1, validate);
+    if (!this->ValidateCont(this->pc_ + 1, imm)) return 0;
+
+    // Pop a function type.
+    Value func_ref =
+        Pop(ValueType::RefNull(imm.cont_type->contfun_typeindex(), imm.shared,
+                               RefTypeKind::kFunction));
+
+    // Push a continuation type.
+    Value* value = Push(ValueType::Ref(imm.heap_type()));
+    CALL_INTERFACE_IF_OK_AND_REACHABLE(ContNew, imm, func_ref, value);
+    return 1 + imm.length;
+  }
+
+  DECODE(ContBind) {
+    CHECK_PROTOTYPE_OPCODE(wasmfx);
+
+    ContIndexImmediate orig_cont_imm(this, this->pc_ + 1, validate);
+    if (!this->ValidateCont(this->pc_ + 1, orig_cont_imm)) return 0;
+    ContIndexImmediate new_cont_imm(this, this->pc_ + orig_cont_imm.length + 1,
+                                    validate);
+    if (!this->ValidateCont(this->pc_ + 1, new_cont_imm)) return 0;
+
+    const FunctionSig* orig_cont_sig =
+        this->module_->signature(orig_cont_imm.cont_type->contfun_typeindex());
+    const FunctionSig* new_cont_sig =
+        this->module_->signature(new_cont_imm.cont_type->contfun_typeindex());
+
+    if (!VALIDATE(
+            IsSubtypeVec(orig_cont_sig->returns(), new_cont_sig->returns()))) {
+      this->DecodeError("expecting returns of %d to match returns of %d",
+                        orig_cont_imm.index.index, new_cont_imm.index.index);
+      return 0;
+    }
+
+    int delta = static_cast<int>(orig_cont_sig->parameters().size()) -
+                static_cast<int>(new_cont_sig->parameters().size());
+    if (!VALIDATE(delta >= 0)) {
+      this->DecodeError(
+          "source cont type %d has fewer parameters than target %d",
+          orig_cont_imm.index.index, new_cont_imm.index.index);
+      return 0;
+    }
+
+    const base::Vector<const ValueType> sig_parameters =
+        orig_cont_sig->parameters();
+    const base::Vector<const ValueType> new_sig_parameters =
+        new_cont_sig->parameters();
+
+    if (!VALIDATE(IsSubtypeVec(new_sig_parameters,
+                               sig_parameters + static_cast<size_t>(delta)))) {
+      this->DecodeError(
+          "parameters of new continuation %d should be subtypes of parameters "
+          "of input continuation %d",
+          new_cont_imm.index.index, orig_cont_imm.index.index);
+    }
+
+    Value orig_cont = Pop(ValueType::RefNull(orig_cont_imm.heap_type()));
+    PoppedArgVector args = PopSomeArgs(orig_cont_sig, delta);
+    Value* new_cont = Push(ValueType::Ref(new_cont_imm.heap_type()));
+    CALL_INTERFACE_IF_OK_AND_REACHABLE(ContBind, orig_cont_imm, orig_cont,
+                                       args.data(), new_cont_imm, new_cont);
+    return 1 + orig_cont_imm.length + new_cont_imm.length;
+  }
+
+  V8_INLINE int DecodeEffectHandlerTable(
+      EffectHandlerTableImmediate& handler_table_imm,
+      base::Vector<HandlerCase>& handlers) {
+    EffectHandlerTableIterator<ValidationTag> handle_iterator(
+        this, handler_table_imm);
+    int i = 0;
+    while (handle_iterator.has_next()) {
+      HandlerCase handler = handle_iterator.next();
+
+      if (!this->Validate(this->pc_, handler.tag)) {
+        return -1;
+      }
+      handlers[i] = handler;
+
+      uint32_t stack_size = stack_.size();
+      uint32_t push_count = 0;
+      if (handler.kind == kOnSuspend) {
+        const WasmTagSig* sig = handler.tag.tag->sig;
+        stack_.EnsureMoreCapacity(static_cast<int>(sig->parameter_count()),
+                                  this->zone_);
+        for (ValueType type : sig->parameters()) Push(type);
+        push_count += sig->parameter_count();
+
+        if (!VALIDATE((this->Validate(this->pc_, handler.maybe_depth.br,
+                                      control_depth())))) {
+          return -1;
+        }
+        Control* target = control_at(handler.maybe_depth.br.depth);
+        if (!VALIDATE(push_count == target->br_merge()->arity)) {
+          this->DecodeError(
+              "handler generates %d operand%s, target block returns %d",
+              push_count, push_count != 1 ? "s" : "",
+              target->br_merge()->arity);
+          return -1;
+        }
+        if (!VALIDATE((
+                TypeCheckBranch<PushBranchValues::kYes, RewriteStackTypes::kNo>(
+                    target)))) {
+          return -1;
+        }
+        stack_.shrink_to(stack_size);
+        DCHECK_LT(i, handler_table_imm.table_count);
+      } else if (handler.kind != kSwitch) {
+        this->DecodeError("invalid handler kind %d", handler.kind);
+        return -1;
+      }
+      i++;
+    }
+    return handle_iterator.length();
+  }
+
+  DECODE(Resume) {
+    CHECK_PROTOTYPE_OPCODE(wasmfx);
+    ContIndexImmediate imm(this, this->pc_ + 1, validate);
+    if (!this->ValidateCont(this->pc_ + 1, imm)) return 0;
+
+    Pop(ValueType::RefNull(imm.heap_type()));
+
+    EffectHandlerTableImmediate handler_table_imm(
+        this, this->pc_ + 1 + imm.length, validate);
+    if (!this->Validate(this->pc_ + imm.length + 1, handler_table_imm))
+      return 0;
+
+    base::Vector<HandlerCase> handlers =
+        this->zone_->template AllocateVector<HandlerCase>(
+            handler_table_imm.table_count);
+
+    int table_length = DecodeEffectHandlerTable(handler_table_imm, handlers);
+    if (table_length < 0) return 0;
+
+    // Continuations are function-like values; check the args and returns.
+    const FunctionSig* contFunSig =
+        this->module_->signature(imm.cont_type->contfun_typeindex());
+    PoppedArgVector args = PopArgs(contFunSig);
+    Value* returns = PushReturns(contFunSig);
+
+    CALL_INTERFACE_IF_OK_AND_REACHABLE(Resume, imm, handlers, args.data(),
+                                       returns);
+    return 1 + imm.length + table_length;
+  }
+
+  DECODE(ResumeThrow) {
+    CHECK_PROTOTYPE_OPCODE(wasmfx);
+    ContIndexImmediate cont_imm(this, this->pc_ + 1, validate);
+    if (!this->ValidateCont(this->pc_ + 1, cont_imm)) return 0;
+
+    Pop(ValueType::RefNull(cont_imm.heap_type()));
+
+    TagIndexImmediate exc_imm(this, this->pc_ + cont_imm.length + 1, validate);
+    if (!this->Validate(this->pc_ + cont_imm.length + 1, exc_imm)) return 0;
+    if (exc_imm.tag->sig->return_count() != 0) {
+      this->DecodeError("tag signature %u has non-void return", exc_imm.index);
+      return 0;
+    }
+    PoppedArgVector args = PopArgs(exc_imm.tag->ToFunctionSig());
+
+    EffectHandlerTableImmediate handler_table_imm(
+        this, this->pc_ + cont_imm.length + exc_imm.length + 1, validate);
+    if (!this->Validate(this->pc_ + cont_imm.length + exc_imm.length + 1,
+                        handler_table_imm))
+      return 0;
+
+    base::Vector<HandlerCase> handlers =
+        this->zone_->template AllocateVector<HandlerCase>(
+            handler_table_imm.table_count);
+
+    int table_length = DecodeEffectHandlerTable(handler_table_imm, handlers);
+    if (table_length < 0) return 0;
+
+    // The continuation might return, check the return type.
+    const FunctionSig* contFunSig =
+        this->module_->signature(cont_imm.cont_type->contfun_typeindex());
+    Value* returns = PushReturns(contFunSig);
+
+    CALL_INTERFACE_IF_OK_AND_REACHABLE(ResumeThrow, cont_imm, exc_imm, handlers,
+                                       args.data(), returns);
+    return 1 + exc_imm.length + cont_imm.length + table_length;
+  }
+
+  DECODE(Suspend) {
+    CHECK_PROTOTYPE_OPCODE(wasmfx);
+    TagIndexImmediate imm(this, this->pc_ + 1, validate);
+    if (!this->Validate(this->pc_ + 1, imm)) return 0;
+
+    const FunctionSig* sig = imm.tag->ToFunctionSig();
+
+    PoppedArgVector args = PopArgs(sig);
+
+    Value* returns = PushReturns(sig);
+
+    CALL_INTERFACE_IF_OK_AND_REACHABLE(Suspend, imm, args.data(), returns);
+
+    return 1 + imm.length;
+  }
+
+  DECODE(Switch) {
+    CHECK_PROTOTYPE_OPCODE(wasmfx);
+    ContIndexImmediate contimm(this, this->pc_ + 1, validate);
+    if (!this->ValidateCont(this->pc_ + 1, contimm)) return 0;
+
+    TagIndexImmediate tagimm(this, this->pc_ + contimm.length + 1, validate);
+    if (!this->Validate(this->pc_ + contimm.length + 1, tagimm)) return 0;
+
+    const FunctionSig* tag_sig = tagimm.tag->ToFunctionSig();
+    const FunctionSig* cont_sig =
+        this->module_->signature(contimm.cont_type->contfun_typeindex());
+
+    if (!VALIDATE(IsSubtypeVec(cont_sig->returns(), tag_sig->returns()))) {
+      this->DecodeError("return(s) from continuation %d do not match tag %d",
+                        contimm.index.index, tagimm.index);
+      return 0;
+    }
+
+    const base::Vector<const ValueType> cont_args = cont_sig->parameters();
+
+    if (!VALIDATE(cont_args.size() >= 1 &&
+                  IsSubtypeOf(cont_args.last(), kWasmContRef, this->module_))) {
+      this->DecodeError(
+          "expecting a (ref null? cont) as last parameter of type %d",
+          contimm.index.index);
+      return 0;
+    }
+
+    const ValueType return_type = cont_args.last();
+
+    if (!VALIDATE(return_type.has_index() &&
+                  this->module_->has_cont_type(return_type.ref_index()))) {
+      this->DecodeError(
+          "expecting a defined cont type as last parameter of type %d",
+          contimm.index.index);
+      return 0;
+    }
+    const ContType* return_cont =
+        this->module_->cont_type(return_type.ref_index());
+    const FunctionSig* return_sig =
+        this->module_->signature(return_cont->contfun_typeindex());
+
+    if (!VALIDATE(IsSubtypeVec(tag_sig->returns(), return_sig->returns()))) {
+      this->DecodeError(
+          "tag %d's return types should be a subtype of return continuation "
+          "%d's return types",
+          tagimm.index, cont_args.last().ref_index().index);
+      return 0;
+    }
+
+    Value cont_ref = Pop(ValueType::RefNull(contimm.heap_type()));
+    PoppedArgVector args =
+        PopSomeArgs(cont_sig, static_cast<int>(cont_args.size()) - 1);
+
+    Value* returns = PushParameters(return_sig);
+
+    CALL_INTERFACE_IF_OK_AND_REACHABLE(Switch, tagimm, contimm, cont_ref,
+                                       args.data(), returns);
+
+    return 1 + contimm.length + tagimm.length;
+  }
+
   DECODE(Numeric) {
     auto [full_opcode, opcode_length] =
         this->template read_prefixed_opcode<ValidationTag>(this->pc_,
@@ -4281,6 +4767,12 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
     DECODE_IMPL(Catch);
     DECODE_IMPL(Delegate);
     DECODE_IMPL(CatchAll);
+    DECODE_IMPL(ContNew);
+    DECODE_IMPL(ContBind);
+    DECODE_IMPL(Resume);
+    DECODE_IMPL(ResumeThrow);
+    DECODE_IMPL(Suspend);
+    DECODE_IMPL(Switch);
     DECODE_IMPL(BrOnNull);
     DECODE_IMPL(BrOnNonNull);
     DECODE_IMPL(Loop);
@@ -4447,10 +4939,10 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
     Drop(static_cast<int>(type->field_count()));
   }
 
-  // Pops arguments as required by signature, returning them by copy as a
-  // vector.
-  V8_INLINE PoppedArgVector PopArgs(const FunctionSig* sig) {
-    int count = static_cast<int>(sig->parameter_count());
+  // Pops some of the arguments as required by signature and count.
+  V8_INLINE PoppedArgVector PopSomeArgs(const FunctionSig* sig, int count) {
+    DCHECK_LE(count, static_cast<int>(sig->parameter_count()));
+
     EnsureStackArguments(count);
     DCHECK_LE(control_.back().stack_depth, stack_size());
     DCHECK_GE(stack_size() - control_.back().stack_depth, count);
@@ -4464,6 +4956,11 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
     return PoppedArgVector{base::VectorOf(args_base, count)};
   }
 
+  // Pops all the arguments as required by signature.
+  V8_INLINE PoppedArgVector PopArgs(const FunctionSig* sig) {
+    return PopSomeArgs(sig, static_cast<int>(sig->parameter_count()));
+  }
+
   Control* PushControl(ControlKind kind, const BlockTypeImmediate& imm) {
     DCHECK(!control_.empty());
     ValidateParameters(&imm.sig);
@@ -4972,7 +5469,7 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
               "%s: Immediate field %d of type %d has non-packed type %s. Use "
               "struct.get instead.",
               WasmOpcodes::OpcodeName(opcode), field.field_imm.index,
-              field.struct_imm.index, field_type.name().c_str());
+              field.struct_imm.index.index, field_type.name().c_str());
           return 0;
         }
         Value struct_obj =
@@ -5005,7 +5502,8 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
         if (!this->Validate(this->pc_ + opcode_length, imm)) return 0;
         auto [initial_value, length] =
             Pop(imm.array_type->element_type().Unpacked(), kWasmI32);
-        Value* value = Push(ValueType::Ref(imm.heap_type()));
+        Value* value =
+            Push(ValueType::Ref(imm.heap_type()).AsExactIfProposalEnabled());
         CALL_INTERFACE_IF_OK_AND_REACHABLE(ArrayNew, imm, length, initial_value,
                                            value);
         return opcode_length + imm.length;
@@ -5021,7 +5519,8 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
           return 0;
         }
         Value length = Pop(kWasmI32);
-        Value* value = Push(ValueType::Ref(imm.heap_type()));
+        Value* value =
+            Push(ValueType::Ref(imm.heap_type()).AsExactIfProposalEnabled());
         CALL_INTERFACE_IF_OK_AND_REACHABLE(ArrayNewDefault, imm, length, value);
         return opcode_length + imm.length;
       }
@@ -5036,7 +5535,7 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
           this->DecodeError(
               "array.new_data can only be used with numeric-type arrays, found "
               "array type #%d instead",
-              array_imm.index);
+              array_imm.index.index);
           return 0;
         }
         const uint8_t* data_index_pc =
@@ -5047,7 +5546,8 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
 
         auto [offset, length] = Pop(kWasmI32, kWasmI32);
 
-        Value* array = Push(ValueType::Ref(array_imm.heap_type()));
+        Value* array = Push(
+            ValueType::Ref(array_imm.heap_type()).AsExactIfProposalEnabled());
         CALL_INTERFACE_IF_OK_AND_REACHABLE(ArrayNewSegment, array_imm,
                                            data_segment, offset, length, array);
         return opcode_length + array_imm.length + data_segment.length;
@@ -5063,7 +5563,7 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
           this->DecodeError(
               "array.new_elem can only be used with reference-type arrays, "
               "found array type #%d instead",
-              array_imm.index);
+              array_imm.index.index);
           return 0;
         }
         const uint8_t* elem_index_pc =
@@ -5086,7 +5586,8 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
         }
 
         auto [offset, length] = Pop(kWasmI32, kWasmI32);
-        Value* array = Push(ValueType::Ref(array_imm.heap_type()));
+        Value* array = Push(
+            ValueType::Ref(array_imm.heap_type()).AsExactIfProposalEnabled());
         CALL_INTERFACE_IF_OK_AND_REACHABLE(ArrayNewSegment, array_imm,
                                            elem_segment, offset, length, array);
         return opcode_length + array_imm.length + elem_segment.length;
@@ -5101,7 +5602,7 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
           this->DecodeError(
               "array.init_data can only be used with mutable arrays, found "
               "array type #%d instead",
-              array_imm.index);
+              array_imm.index.index);
           return 0;
         }
         ValueType element_type = array_imm.array_type->element_type();
@@ -5109,7 +5610,7 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
           this->DecodeError(
               "array.init_data can only be used with numeric-type arrays, "
               "found array type #%d instead",
-              array_imm.index);
+              array_imm.index.index);
           return 0;
         }
         const uint8_t* data_index_pc =
@@ -5136,7 +5637,7 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
           this->DecodeError(
               "array.init_elem can only be used with mutable arrays, found "
               "array type #%d instead",
-              array_imm.index);
+              array_imm.index.index);
           return 0;
         }
         ValueType element_type = array_imm.array_type->element_type();
@@ -5144,7 +5645,7 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
           this->DecodeError(
               "array.init_elem can only be used with reference-type arrays, "
               "found array type #%d instead",
-              array_imm.index);
+              array_imm.index.index);
           return 0;
         }
         const uint8_t* elem_index_pc =
@@ -5181,7 +5682,7 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
           this->DecodeError(
               "%s: Immediate array type %d has non-packed type %s. Use "
               "array.get instead.",
-              WasmOpcodes::OpcodeName(opcode), imm.index,
+              WasmOpcodes::OpcodeName(opcode), imm.index.index,
               imm.array_type->element_type().name().c_str());
           return 0;
         }
@@ -5200,7 +5701,7 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
           this->DecodeError(
               "array.get: Immediate array type %d has packed type %s. Use "
               "array.get_s or array.get_u instead.",
-              imm.index, imm.array_type->element_type().name().c_str());
+              imm.index.index, imm.array_type->element_type().name().c_str());
           return 0;
         }
         auto [array_obj, index] =
@@ -5254,7 +5755,7 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
           this->DecodeError(
               "array.copy: source array's #%d element type is not a subtype of "
               "destination array's #%d element type",
-              src_imm.index, dst_imm.index);
+              src_imm.index.index, dst_imm.index.index);
           return 0;
         }
         auto [dst, dst_index, src, src_index, length] =
@@ -5302,7 +5803,8 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
                                              element_type.Unpacked());
         FunctionSig element_sig(0, elem_count, element_types.data());
         PoppedArgVector elements = PopArgs(&element_sig);
-        Value* result = Push(ValueType::Ref(array_imm.heap_type()));
+        Value* result = Push(
+            ValueType::Ref(array_imm.heap_type()).AsExactIfProposalEnabled());
         CALL_INTERFACE_IF_OK_AND_REACHABLE(ArrayNewFixed, array_imm, length_imm,
                                            elements.data(), result);
         return opcode_length + array_imm.length + length_imm.length;
@@ -5353,8 +5855,8 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
       case kExprRefCastDescNull: {
         NON_CONST_ONLY
         CHECK_PROTOTYPE_OPCODE(custom_descriptors);
-        HeapTypeImmediate imm(this->enabled_, this, this->pc_ + opcode_length,
-                              validate);
+        HeapTypeImmediate imm(this->enabled_, this->detected_, this,
+                              this->pc_ + opcode_length, validate);
         if (!this->Validate(this->pc_ + opcode_length, imm)) return 0;
         if (!VALIDATE(imm.type.has_index())) {
           this->DecodeError(
@@ -5399,8 +5901,8 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
       case kExprRefCast:
       case kExprRefCastNull: {
         NON_CONST_ONLY
-        HeapTypeImmediate imm(this->enabled_, this, this->pc_ + opcode_length,
-                              validate);
+        HeapTypeImmediate imm(this->enabled_, this->detected_, this,
+                              this->pc_ + opcode_length, validate);
         if (!this->Validate(this->pc_ + opcode_length, imm)) return 0;
         opcode_length += imm.length;
 
@@ -5472,8 +5974,8 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
       case kExprRefTestNull:
       case kExprRefTest: {
         NON_CONST_ONLY
-        HeapTypeImmediate imm(this->enabled_, this, this->pc_ + opcode_length,
-                              validate);
+        HeapTypeImmediate imm(this->enabled_, this->detected_, this,
+                              this->pc_ + opcode_length, validate);
         if (!this->Validate(this->pc_ + opcode_length, imm)) return 0;
         opcode_length += imm.length;
 
@@ -5544,8 +6046,8 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
               "--experimental-wasm-ref-cast-nop)");
           return 0;
         }
-        HeapTypeImmediate imm(this->enabled_, this, this->pc_ + opcode_length,
-                              validate);
+        HeapTypeImmediate imm(this->enabled_, this->detected_, this,
+                              this->pc_ + opcode_length, validate);
         if (!this->Validate(this->pc_ + opcode_length, imm)) return 0;
         opcode_length += imm.length;
         HeapType target_type = imm.type;
@@ -5571,6 +6073,12 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
         NON_CONST_ONLY
         return ParseBrOnCast(opcode, opcode_length);
       }
+      case kExprBrOnCastDesc:
+      case kExprBrOnCastDescFail: {
+        NON_CONST_ONLY
+        CHECK_PROTOTYPE_OPCODE(custom_descriptors);
+        return ParseBrOnCast(opcode, opcode_length);
+      }
       case kExprAnyConvertExtern: {
         Value extern_val = Pop(kWasmExternRef);
         ValueType intern_type = ValueType::RefMaybeNull(
@@ -5608,15 +6116,16 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
     }
     pc_offset += branch_depth.length;
 
-    HeapTypeImmediate src_imm(this->enabled_, this, this->pc_ + pc_offset,
-                              validate);
+    HeapTypeImmediate src_imm(this->enabled_, this->detected_, this,
+                              this->pc_ + pc_offset, validate);
     if (!this->Validate(this->pc_ + pc_offset, src_imm)) return 0;
     pc_offset += src_imm.length;
     ValueType src_type = ValueType::RefMaybeNull(
         src_imm.type, flags.src_is_null ? kNullable : kNonNullable);
 
     const uint8_t* target_imm_pc = this->pc_ + pc_offset;
-    HeapTypeImmediate target_imm(this->enabled_, this, target_imm_pc, validate);
+    HeapTypeImmediate target_imm(this->enabled_, this->detected_, this,
+                                 target_imm_pc, validate);
     if (!this->Validate(target_imm_pc, target_imm)) return 0;
     pc_offset += target_imm.length;
     bool null_succeeds = flags.res_is_null;
@@ -5630,6 +6139,28 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
       return 0;
     }
 
+    Value descriptor{nullptr, kWasmVoid};
+    if (opcode == kExprBrOnCastDesc || opcode == kExprBrOnCastDescFail) {
+      if (!VALIDATE(target_imm.type.has_index())) {
+        this->DecodeError(
+            target_imm_pc, "%s: target type must have an index, but was %s",
+            WasmOpcodes::OpcodeName(opcode), target_imm.type.name().c_str());
+        return 0;
+      }
+      ModuleTypeIndex target_desc_index =
+          this->module_->type(target_imm.type.ref_index()).descriptor;
+      if (!VALIDATE(target_desc_index.valid())) {
+        this->DecodeError(
+            target_imm_pc, "%s: target type %s must have a descriptor",
+            WasmOpcodes::OpcodeName(opcode), target_imm.type.name().c_str());
+        return 0;
+      }
+      ValueType desc_type =
+          ValueType::RefNull(this->module_->heap_type(target_desc_index))
+              .AsExact(target_type.exactness());
+      descriptor = Pop(desc_type);
+    }
+
     Value obj = Pop(src_type);
 
     if (!VALIDATE(
@@ -5653,7 +6184,7 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
       return 0;
     }
 
-    if (opcode == kExprBrOnCast) {
+    if (opcode == kExprBrOnCast || opcode == kExprBrOnCastDesc) {
       Value* value_on_branch = Push(target_type);
       if (!VALIDATE(
               (TypeCheckBranch<PushBranchValues::kYes, RewriteStackTypes::kYes>(
@@ -5680,7 +6211,10 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
           c->br_merge()->reached = true;
         } else if (V8_LIKELY(!TypeCheckAlwaysFails(obj, target_type.heap_type(),
                                                    null_succeeds))) {
-          if (target_imm.type.is_index()) {
+          if (opcode == kExprBrOnCastDesc) {
+            CALL_INTERFACE(BrOnCastDesc, target_imm.type, obj, descriptor,
+                           value_on_branch, branch_depth.depth, null_succeeds);
+          } else if (target_imm.type.is_index()) {
             CALL_INTERFACE(BrOnCast, target_imm.type, obj, value_on_branch,
                            branch_depth.depth, null_succeeds);
           } else {
@@ -5706,7 +6240,7 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
       return pc_offset;
 
     } else {
-      DCHECK_EQ(opcode, kExprBrOnCastFail);
+      DCHECK(opcode == kExprBrOnCastFail || opcode == kExprBrOnCastDescFail);
       // The branch type is set based on the source type immediate (independent
       // of the actual stack value). If the target type is nullable, the branch
       // type is non-nullable.
@@ -5746,7 +6280,11 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
             result_on_fallthrough = obj;
           }
         } else {
-          if (target_imm.type.is_index()) {
+          if (opcode == kExprBrOnCastDescFail) {
+            CALL_INTERFACE(BrOnCastDescFail, target_imm.type, obj, descriptor,
+                           &result_on_fallthrough, branch_depth.depth,
+                           null_succeeds);
+          } else if (target_imm.type.is_index()) {
             CALL_INTERFACE(BrOnCastFail, target_imm.type, obj,
                            &result_on_fallthrough, branch_depth.depth,
                            null_succeeds);
@@ -6390,13 +6928,21 @@ class WasmFullDecoder : public WasmDecoder<ValidationTag, decoding_mode> {
     for (Value& value : values) Push(value);
   }
 
-  Value* PushReturns(const FunctionSig* sig) {
-    size_t return_count = sig->return_count();
-    stack_.EnsureMoreCapacity(static_cast<int>(return_count), this->zone_);
-    for (size_t i = 0; i < return_count; ++i) {
-      Push(sig->GetReturn(i));
+  Value* PushValueTypes(const base::Vector<const ValueType> types) {
+    size_t count = types.size();
+    stack_.EnsureMoreCapacity(static_cast<int>(count), this->zone_);
+    for (size_t i = 0; i < count; ++i) {
+      Push(types[i]);
     }
-    return stack_.end() - return_count;
+    return stack_.end() - count;
+  }
+
+  Value* PushParameters(const FunctionSig* sig) {
+    return PushValueTypes(sig->parameters());
+  }
+
+  Value* PushReturns(const FunctionSig* sig) {
+    return PushValueTypes(sig->returns());
   }
 
   // We do not inline these functions because doing so causes a large binary
diff --git a/deps/v8/src/wasm/interpreter/arm64/interpreter-builtins-arm64.cc b/deps/v8/src/wasm/interpreter/arm64/interpreter-builtins-arm64.cc
index 5d983c3afef67f..7c40080cd784e6 100644
--- a/deps/v8/src/wasm/interpreter/arm64/interpreter-builtins-arm64.cc
+++ b/deps/v8/src/wasm/interpreter/arm64/interpreter-builtins-arm64.cc
@@ -110,11 +110,14 @@ void RestoreAfterBuiltinCall(MacroAssembler* masm, Register wasm_instance,
 void PrepareForWasmToJsConversionBuiltinCall(
     MacroAssembler* masm, Register return_count, Register result_index,
     Register current_return_slot, Register valuetypes_array_ptr,
-    Register wasm_instance, Register fixed_array, Register jsarray) {
+    Register wasm_instance, Register fixed_array, Register jsarray,
+    bool load_native_context = true) {
   UseScratchRegisterScope temps(masm);
   Register GCScanCount = temps.AcquireX();
   // Pushes and puts the values in order onto the stack before builtin calls
   // for the GenericJSToWasmInterpreterWrapper.
+  // The last three slots contain tagged objects that need to be visited during
+  // GC.
   __ Mov(GCScanCount, 3);
   __ Str(
       GCScanCount,
@@ -122,17 +125,19 @@ void PrepareForWasmToJsConversionBuiltinCall(
           fp, BuiltinWasmInterpreterWrapperConstants::kGCScanSlotCountOffset));
   __ Push(return_count, result_index, current_return_slot, valuetypes_array_ptr,
           xzr, wasm_instance, fixed_array, jsarray);
-  // Put the context into x27.
-  Register wasm_trusted_instance = wasm_instance;
-  __ LoadTrustedPointerField(
-      wasm_trusted_instance,
-      FieldMemOperand(wasm_instance, WasmInstanceObject::kTrustedDataOffset),
-      kWasmTrustedInstanceDataIndirectPointerTag);
-  __ LoadTaggedField(
-      kContextRegister,  // cp(x27)
-      MemOperand(wasm_trusted_instance,
-                 wasm::ObjectAccess::ToTagged(
-                     WasmTrustedInstanceData::kNativeContextOffset)));
+  if (load_native_context) {
+    // Put the context into x27.
+    Register wasm_trusted_instance = wasm_instance;
+    __ LoadTrustedPointerField(
+        wasm_trusted_instance,
+        FieldMemOperand(wasm_instance, WasmInstanceObject::kTrustedDataOffset),
+        kWasmTrustedInstanceDataIndirectPointerTag);
+    __ LoadTaggedField(
+        kContextRegister,  // cp(x27)
+        MemOperand(wasm_trusted_instance,
+                   wasm::ObjectAccess::ToTagged(
+                       WasmTrustedInstanceData::kNativeContextOffset)));
+  }
 }
 
 void RestoreAfterWasmToJsConversionBuiltinCall(
@@ -144,6 +149,10 @@ void RestoreAfterWasmToJsConversionBuiltinCall(
   // builtin calls for the GenericJSToWasmInterpreterWrapper.
   __ Pop(jsarray, fixed_array, wasm_instance, xzr, valuetypes_array_ptr,
          current_return_slot, result_index, return_count);
+  __ Str(
+      xzr,
+      MemOperand(
+          fp, BuiltinWasmInterpreterWrapperConstants::kGCScanSlotCountOffset));
 }
 
 }  // namespace
@@ -435,7 +444,7 @@ void Builtins::Generate_GenericJSToWasmInterpreterWrapper(
   // -------------------------------------------
   // Load the Wasm exported function data and the Wasm instance.
   // -------------------------------------------
-  DEFINE_PINNED(function_data, kJSFunctionRegister);    // x1
+  DEFINE_PINNED(function_data, kJSFunctionRegister);       // x1
   DEFINE_PINNED(wasm_instance, kWasmImplicitArgRegister);  // x7
   LoadFunctionDataAndWasmInstance(masm, function_data, wasm_instance);
 
@@ -549,8 +558,7 @@ void Builtins::Generate_GenericJSToWasmInterpreterWrapper(
   __ Str(current_index, MemOperand(fp, kCurrentIndexOffset));
 
   DEFINE_REG_W(valuetype);
-  __ Ldr(valuetype,
-         MemOperand(valuetypes_array_ptr, wasm::ValueType::bit_field_offset()));
+  __ Ldr(valuetype, MemOperand(valuetypes_array_ptr, 0));
 
   // -------------------------------------------
   // Param conversion.
@@ -560,14 +568,14 @@ void Builtins::Generate_GenericJSToWasmInterpreterWrapper(
   Label param_conversion_done;
   Label check_ref_param;
   Label convert_param;
-  __ cmp(valuetype, Immediate(wasm::kWasmI32.raw_bit_field()));
+  __ Cmp(valuetype, Immediate(wasm::kWasmI32.raw_bit_field()));
   __ B(&check_ref_param, ne);
   __ JumpIfNotSmi(param, &convert_param);
 
   // Change the param from Smi to int32.
   __ SmiUntag(param);
   // Place the param into the proper slot in Integer section.
-  __ Str(param, MemOperand(current_param_slot, 0));
+  __ Str(param.W(), MemOperand(current_param_slot, 0));
   __ Add(current_param_slot, current_param_slot, Immediate(sizeof(int32_t)));
   __ jmp(&param_conversion_done);
 
@@ -575,11 +583,8 @@ void Builtins::Generate_GenericJSToWasmInterpreterWrapper(
   __ bind(&check_ref_param);
 
   // wasm::ValueKind::kRefNull is not representable as a cmp immediate operand.
-  __ And(valuetype, valuetype, Immediate(wasm::kWasmValueKindBitsMask));
-  __ cmp(valuetype, Immediate(wasm::ValueKind::kRefNull));
-  __ B(&handle_ref_param, eq);
-  __ cmp(valuetype, Immediate(wasm::ValueKind::kRef));
-  __ B(&convert_param, ne);
+  __ Tst(valuetype, Immediate(1));
+  __ B(&convert_param, eq);
 
   // Place the reference param into the proper slot.
   __ bind(&handle_ref_param);
@@ -623,16 +628,16 @@ void Builtins::Generate_GenericJSToWasmInterpreterWrapper(
   Label param_kWasmI32_not_smi, param_kWasmI64, param_kWasmF32, param_kWasmF64,
       throw_type_error;
 
-  __ cmp(valuetype, Immediate(wasm::kWasmI32.raw_bit_field()));
+  __ Cmp(valuetype, Immediate(wasm::kWasmI32.raw_bit_field()));
   __ B(&param_kWasmI32_not_smi, eq);
-  __ cmp(valuetype, Immediate(wasm::kWasmI64.raw_bit_field()));
+  __ Cmp(valuetype, Immediate(wasm::kWasmI64.raw_bit_field()));
   __ B(&param_kWasmI64, eq);
-  __ cmp(valuetype, Immediate(wasm::kWasmF32.raw_bit_field()));
+  __ Cmp(valuetype, Immediate(wasm::kWasmF32.raw_bit_field()));
   __ B(&param_kWasmF32, eq);
-  __ cmp(valuetype, Immediate(wasm::kWasmF64.raw_bit_field()));
+  __ Cmp(valuetype, Immediate(wasm::kWasmF64.raw_bit_field()));
   __ B(&param_kWasmF64, eq);
 
-  __ cmp(valuetype, Immediate(wasm::kWasmS128.raw_bit_field()));
+  __ Cmp(valuetype, Immediate(wasm::kWasmS128.raw_bit_field()));
   // Simd arguments cannot be passed from JavaScript.
   __ B(&throw_type_error, eq);
 
@@ -646,7 +651,7 @@ void Builtins::Generate_GenericJSToWasmInterpreterWrapper(
   RestoreAfterJsToWasmConversionBuiltinCall(masm, function_data, wasm_instance,
                                             valuetypes_array_ptr,
                                             current_param_slot);
-  __ Str(param, MemOperand(current_param_slot, 0));
+  __ Str(param.W(), MemOperand(current_param_slot, 0));
   __ Add(current_param_slot, current_param_slot, Immediate(sizeof(int32_t)));
   __ jmp(&param_conversion_done);
 
@@ -665,7 +670,7 @@ void Builtins::Generate_GenericJSToWasmInterpreterWrapper(
   RestoreAfterJsToWasmConversionBuiltinCall(masm, function_data, wasm_instance,
                                             valuetypes_array_ptr,
                                             current_param_slot);
-  __ Str(kFPReturnRegister0, MemOperand(current_param_slot, 0));
+  __ Str(s0, MemOperand(current_param_slot, 0));
   __ Add(current_param_slot, current_param_slot, Immediate(sizeof(float)));
   __ jmp(&param_conversion_done);
 
@@ -782,10 +787,14 @@ void Builtins::Generate_GenericJSToWasmInterpreterWrapper(
 
   __ bind(&start_return_conversion);
   Register current_return_slot = array_start;
+  __ Ldr(current_return_slot, MemOperand(fp, kArgRetsAddressOffset));
 
   DEFINE_PINNED(result_index, x13);
   __ Mov(result_index, xzr);
 
+  ASSIGN_REG(valuetypes_array_ptr);
+  __ Ldr(valuetypes_array_ptr, MemOperand(fp, kValueTypesArrayStartOffset));
+
   // -------------------------------------------
   // Return conversions.
   // -------------------------------------------
@@ -796,32 +805,25 @@ void Builtins::Generate_GenericJSToWasmInterpreterWrapper(
   // the Wasm call, that is, kGCScanSlotCount = 0, so we don't have to reset it.
   // We don't need the JS context for these builtin calls.
 
-  ASSIGN_REG(valuetypes_array_ptr);
-  __ Ldr(valuetypes_array_ptr, MemOperand(fp, kValueTypesArrayStartOffset));
-
   // The first valuetype of the array is the return's valuetype.
   ASSIGN_REG_W(valuetype);
-  __ Ldr(valuetype,
-         MemOperand(valuetypes_array_ptr, wasm::ValueType::bit_field_offset()));
+  __ Ldr(valuetype, MemOperand(valuetypes_array_ptr, 0));
 
   Label return_kWasmI32, return_kWasmI64, return_kWasmF32, return_kWasmF64,
       return_kWasmRef;
 
-  __ cmp(valuetype, Immediate(wasm::kWasmI32.raw_bit_field()));
+  __ Cmp(valuetype, Immediate(wasm::kWasmI32.raw_bit_field()));
   __ B(&return_kWasmI32, eq);
-  __ cmp(valuetype, Immediate(wasm::kWasmI64.raw_bit_field()));
+  __ Cmp(valuetype, Immediate(wasm::kWasmI64.raw_bit_field()));
   __ B(&return_kWasmI64, eq);
-  __ cmp(valuetype, Immediate(wasm::kWasmF32.raw_bit_field()));
+  __ Cmp(valuetype, Immediate(wasm::kWasmF32.raw_bit_field()));
   __ B(&return_kWasmF32, eq);
-  __ cmp(valuetype, Immediate(wasm::kWasmF64.raw_bit_field()));
+  __ Cmp(valuetype, Immediate(wasm::kWasmF64.raw_bit_field()));
   __ B(&return_kWasmF64, eq);
 
   {
-    __ And(valuetype, valuetype, Immediate(wasm::kWasmValueKindBitsMask));
-    __ cmp(valuetype, Immediate(wasm::ValueKind::kRefNull));
-    __ B(&return_kWasmRef, eq);
-    __ cmp(valuetype, Immediate(wasm::ValueKind::kRef));
-    __ B(&return_kWasmRef, eq);
+    __ Tst(valuetype, Immediate(1));
+    __ B(&return_kWasmRef, ne);
 
     // Invalid type. Wasm cannot return Simd results to JavaScript.
     __ DebugBreak();
@@ -876,7 +878,7 @@ void Builtins::Generate_GenericJSToWasmInterpreterWrapper(
   __ jmp(&return_value_done);
 
   __ bind(&return_kWasmF32);
-  __ Ldr(v0, MemOperand(current_return_slot, 0));
+  __ Ldr(s0, MemOperand(current_return_slot, 0));
   __ Add(current_return_slot, current_return_slot, Immediate(sizeof(float)));
   PrepareForWasmToJsConversionBuiltinCall(
       masm, return_count, result_index, current_return_slot,
@@ -908,24 +910,42 @@ void Builtins::Generate_GenericJSToWasmInterpreterWrapper(
   __ Ldr(return_value, MemOperand(current_return_slot, 0));
   __ Add(current_return_slot, current_return_slot,
          Immediate(kSystemPointerSize));
-  // It might be cleaner to call Builtins_WasmFuncRefToJS here to extract
-  // func.external from the ref object if the type is kWasmFuncRef.
 
   Label next_return_value;
 
   __ bind(&return_value_done);
   __ Add(valuetypes_array_ptr, valuetypes_array_ptr, Immediate(kValueTypeSize));
-  __ Str(valuetypes_array_ptr, MemOperand(fp, kValueTypesArrayStartOffset));
   __ cmp(fixed_array, xzr);
   __ B(&next_return_value, eq);
 
-  // Store result in JSArray
+  // Store result into JSArray.
   DEFINE_REG(array_items);
   __ Add(array_items, fixed_array,
          OFFSET_OF_DATA_START(FixedArray) - kHeapObjectTag);
   __ StoreTaggedField(return_value, MemOperand(array_items, result_index, LSL,
                                                kTaggedSizeLog2));
 
+  Label skip_write_barrier;
+  // See the arm64 version of LiftoffAssembler::StoreTaggedPointer.
+  __ CheckPageFlag(array_items,
+                   MemoryChunk::kPointersFromHereAreInterestingMask, kZero,
+                   &skip_write_barrier);
+  __ JumpIfSmi(return_value, &skip_write_barrier);
+  __ CheckPageFlag(return_value, MemoryChunk::kPointersToHereAreInterestingMask,
+                   eq, &skip_write_barrier);
+  PrepareForWasmToJsConversionBuiltinCall(
+      masm, return_count, result_index, current_return_slot,
+      valuetypes_array_ptr, wasm_instance, fixed_array, jsarray, false);
+  Register offset = return_count;
+  __ Mov(offset, Immediate(OFFSET_OF_DATA_START(FixedArray) - kHeapObjectTag));
+  __ Add(offset, offset, Operand(result_index, LSL, kTaggedSizeLog2));
+  __ CallRecordWriteStubSaveRegisters(fixed_array, Operand(offset),
+                                      SaveFPRegsMode::kSave);
+  RestoreAfterWasmToJsConversionBuiltinCall(
+      masm, jsarray, fixed_array, wasm_instance, valuetypes_array_ptr,
+      current_return_slot, result_index, return_count);
+  __ bind(&skip_write_barrier);
+
   __ bind(&next_return_value);
   __ Add(result_index, result_index, 1);
   __ cmp(result_index, return_count);
@@ -1106,7 +1126,7 @@ void Builtins::Generate_GenericWasmToJSInterpreterWrapper(
   // ...       JS arg n-1                    | objects
   // ...       (padding if num args is odd)  |
   // fp-0x60   context                       |
-  // fp-0x58   callable                      v
+  // fp-0x58   callable / call result        v
   // -------------------------------------------
   // fp-0x50   current_param_offset/current_result_offset
   // fp-0x48   valuetypes_array_ptr
@@ -1175,6 +1195,7 @@ void Builtins::Generate_GenericWasmToJSInterpreterWrapper(
   __ LoadTaggedField(
       context, FieldMemOperand(target_js_function, JSFunction::kContextOffset));
   __ Mov(cp, context);
+  __ Str(cp, MemOperand(fp, kContextOffset));
 
   // Load global receiver if sloppy else use undefined.
   Label receiver_undefined;
@@ -1274,28 +1295,24 @@ void Builtins::Generate_GenericWasmToJSInterpreterWrapper(
     Label loop_copy_param_ref, load_ref_param, set_and_move;
 
     __ bind(&loop_copy_param_ref);
-    __ Ldr(valuetype, MemOperand(valuetypes_array_ptr,
-                                 wasm::ValueType::bit_field_offset()));
-    __ And(valuetype, valuetype, Immediate(wasm::kWasmValueKindBitsMask));
-    __ cmp(valuetype, Immediate(wasm::ValueKind::kRefNull));
-    __ B(&load_ref_param, eq);
-    __ cmp(valuetype, Immediate(wasm::ValueKind::kRef));
-    __ B(&load_ref_param, eq);
+    __ Ldr(valuetype, MemOperand(valuetypes_array_ptr, 0));
+    __ Tst(valuetype, Immediate(1));
+    __ B(&load_ref_param, ne);
 
     // Initialize non-ref type slots to zero since they can be visited by GC
     // when converting wasm numbers into heap numbers.
     __ Mov(param, Smi::zero());
 
     Label inc_param_32bit;
-    __ cmp(valuetype, Immediate(wasm::kWasmI32.raw_bit_field()));
+    __ Cmp(valuetype, Immediate(wasm::kWasmI32.raw_bit_field()));
     __ B(&inc_param_32bit, eq);
-    __ cmp(valuetype, Immediate(wasm::kWasmF32.raw_bit_field()));
+    __ Cmp(valuetype, Immediate(wasm::kWasmF32.raw_bit_field()));
     __ B(&inc_param_32bit, eq);
 
     Label inc_param_64bit;
-    __ cmp(valuetype, Immediate(wasm::kWasmI64.raw_bit_field()));
+    __ Cmp(valuetype, Immediate(wasm::kWasmI64.raw_bit_field()));
     __ B(&inc_param_64bit, eq);
-    __ cmp(valuetype, Immediate(wasm::kWasmF64.raw_bit_field()));
+    __ Cmp(valuetype, Immediate(wasm::kWasmF64.raw_bit_field()));
     __ B(&inc_param_64bit, eq);
 
     // Invalid type. Wasm cannot pass Simd arguments to JavaScript.
@@ -1344,8 +1361,7 @@ void Builtins::Generate_GenericWasmToJSInterpreterWrapper(
   Label loop_through_params;
   __ bind(&loop_through_params);
 
-  __ Ldr(valuetype,
-         MemOperand(valuetypes_array_ptr, wasm::ValueType::bit_field_offset()));
+  __ Ldr(valuetype, MemOperand(valuetypes_array_ptr, 0));
 
   // -------------------------------------------
   // Param conversion.
@@ -1353,7 +1369,7 @@ void Builtins::Generate_GenericWasmToJSInterpreterWrapper(
   // If param is a Smi we can easily convert it. Otherwise we'll call a builtin
   // for conversion.
   Label param_conversion_done, check_ref_param, skip_ref_param, convert_param;
-  __ cmp(valuetype, Immediate(wasm::kWasmI32.raw_bit_field()));
+  __ Cmp(valuetype, Immediate(wasm::kWasmI32.raw_bit_field()));
   __ B(&check_ref_param, ne);
 
   // I32 param: change to Smi.
@@ -1381,11 +1397,8 @@ void Builtins::Generate_GenericWasmToJSInterpreterWrapper(
 
   // Skip Ref params. We already copied reference params in the first loop.
   __ bind(&check_ref_param);
-  __ And(valuetype, valuetype, Immediate(wasm::kWasmValueKindBitsMask));
-  __ cmp(valuetype, Immediate(wasm::ValueKind::kRefNull));
-  __ B(&skip_ref_param, eq);
-  __ cmp(valuetype, Immediate(wasm::ValueKind::kRef));
-  __ B(&convert_param, ne);
+  __ Tst(valuetype, Immediate(1));
+  __ B(&convert_param, eq);
 
   __ bind(&skip_ref_param);
   __ Add(param_index, param_index, 1);
@@ -1414,13 +1427,13 @@ void Builtins::Generate_GenericWasmToJSInterpreterWrapper(
   Label param_kWasmF64;
   Label finish_param_conversion;
 
-  __ cmp(valuetype, Immediate(wasm::kWasmI32.raw_bit_field()));
+  __ Cmp(valuetype, Immediate(wasm::kWasmI32.raw_bit_field()));
   __ B(&param_kWasmI32_not_smi, eq);
-  __ cmp(valuetype, Immediate(wasm::kWasmI64.raw_bit_field()));
+  __ Cmp(valuetype, Immediate(wasm::kWasmI64.raw_bit_field()));
   __ B(&param_kWasmI64, eq);
-  __ cmp(valuetype, Immediate(wasm::kWasmF32.raw_bit_field()));
+  __ Cmp(valuetype, Immediate(wasm::kWasmF32.raw_bit_field()));
   __ B(&param_kWasmF32, eq);
-  __ cmp(valuetype, Immediate(wasm::kWasmF64.raw_bit_field()));
+  __ Cmp(valuetype, Immediate(wasm::kWasmF64.raw_bit_field()));
   __ B(&param_kWasmF64, eq);
 
   // Invalid type. Wasm cannot pass Simd arguments to JavaScript.
@@ -1556,12 +1569,19 @@ void Builtins::Generate_GenericWasmToJSInterpreterWrapper(
   __ Ldr(x1, MemOperand(fp, kReturnCountOffset));
   __ Add(x1, x1, x1);
 
-  // One tagged object at the top of the stack (the context).
-  __ Add(scratch, sp, Immediate(kSystemPointerSize));
+  // Two tagged objects at the top of the stack (the context and the result,
+  // which we store at the place of the function object we called).
+  static_assert(
+      kCurrentParamOffset == kContextOffset + 0x10,
+      "Expected two (tagged) slots between 'context' and 'current_param'.");
+  __ Str(x0, MemOperand(fp, kCallableOffset));
+  // Here sp points to the Context spilled slot: [fp - kContextOffset].
+  __ Add(scratch, sp, Immediate(kSystemPointerSize * 2));
   __ Str(scratch,
          MemOperand(fp,
                     WasmToJSInterpreterFrameConstants::kGCScanSlotLimitOffset));
 
+  // We can have a GC here!
   __ Call(BUILTIN_CODE(masm->isolate(), IterableToFixedArrayForWasm),
           RelocInfo::CODE_TARGET);
   __ Mov(fixed_array, kReturnRegister0);
@@ -1599,8 +1619,7 @@ void Builtins::Generate_GenericWasmToJSInterpreterWrapper(
   // The builtin expects the parameter to be in register param = x0.
 
   // The first valuetype of the array is the return's valuetype.
-  __ Ldr(valuetype,
-         MemOperand(valuetypes_array_ptr, wasm::ValueType::bit_field_offset()));
+  __ Ldr(valuetype, MemOperand(valuetypes_array_ptr, 0));
 
   Label return_kWasmI32;
   Label return_kWasmI32_not_smi;
@@ -1611,20 +1630,17 @@ void Builtins::Generate_GenericWasmToJSInterpreterWrapper(
 
   // Prepare for builtin call.
 
-  __ cmp(valuetype, Immediate(wasm::kWasmI32.raw_bit_field()));
+  __ Cmp(valuetype, Immediate(wasm::kWasmI32.raw_bit_field()));
   __ B(&return_kWasmI32, eq);
-  __ cmp(valuetype, Immediate(wasm::kWasmI64.raw_bit_field()));
+  __ Cmp(valuetype, Immediate(wasm::kWasmI64.raw_bit_field()));
   __ B(&return_kWasmI64, eq);
-  __ cmp(valuetype, Immediate(wasm::kWasmF32.raw_bit_field()));
+  __ Cmp(valuetype, Immediate(wasm::kWasmF32.raw_bit_field()));
   __ B(&return_kWasmF32, eq);
-  __ cmp(valuetype, Immediate(wasm::kWasmF64.raw_bit_field()));
+  __ Cmp(valuetype, Immediate(wasm::kWasmF64.raw_bit_field()));
   __ B(&return_kWasmF64, eq);
 
-  __ And(valuetype, valuetype, Immediate(wasm::kWasmValueKindBitsMask));
-  __ cmp(valuetype, Immediate(wasm::ValueKind::kRefNull));
-  __ B(&return_kWasmRef, eq);
-  __ cmp(valuetype, Immediate(wasm::ValueKind::kRef));
-  __ B(&return_kWasmRef, eq);
+  __ Tst(valuetype, Immediate(1));
+  __ B(&return_kWasmRef, ne);
 
   // Invalid type. JavaScript cannot return Simd results to WebAssembly.
   __ DebugBreak();
@@ -1691,7 +1707,7 @@ void Builtins::Generate_GenericWasmToJSInterpreterWrapper(
   __ bind(&return_done);
 
   // Restore after builtin call
-  __ Ldr(cp, MemOperand(sp, 0));
+  __ Ldr(cp, MemOperand(fp, kContextOffset));
   __ Ldr(fixed_array, MemOperand(sp, kSystemPointerSize));
   __ Ldr(valuetypes_array_ptr, MemOperand(fp, kValueTypesArrayStartOffset));
   __ Add(valuetypes_array_ptr, valuetypes_array_ptr, Immediate(kValueTypeSize));
@@ -1732,25 +1748,21 @@ void Builtins::Generate_GenericWasmToJSInterpreterWrapper(
 
   // Copy if the current return value is a ref type.
   __ bind(&copy_return_if_ref);
-  __ Ldr(valuetype,
-         MemOperand(valuetypes_array_ptr, wasm::ValueType::bit_field_offset()));
+  __ Ldr(valuetype, MemOperand(valuetypes_array_ptr, 0));
 
-  __ And(valuetype, valuetype, Immediate(wasm::kWasmValueKindBitsMask));
-  __ cmp(valuetype, Immediate(wasm::ValueKind::kRefNull));
-  __ B(&copy_return_ref, eq);
-  __ cmp(valuetype, Immediate(wasm::ValueKind::kRef));
-  __ B(&copy_return_ref, eq);
+  __ Tst(valuetype, Immediate(1));
+  __ B(&copy_return_ref, ne);
 
   Label inc_result_32bit;
-  __ cmp(valuetype, Immediate(wasm::kWasmI32.raw_bit_field()));
+  __ Cmp(valuetype, Immediate(wasm::kWasmI32.raw_bit_field()));
   __ B(&inc_result_32bit, eq);
-  __ cmp(valuetype, Immediate(wasm::kWasmF32.raw_bit_field()));
+  __ Cmp(valuetype, Immediate(wasm::kWasmF32.raw_bit_field()));
   __ B(&inc_result_32bit, eq);
 
   Label inc_result_64bit;
-  __ cmp(valuetype, Immediate(wasm::kWasmI64.raw_bit_field()));
+  __ Cmp(valuetype, Immediate(wasm::kWasmI64.raw_bit_field()));
   __ B(&inc_result_64bit, eq);
-  __ cmp(valuetype, Immediate(wasm::kWasmF64.raw_bit_field()));
+  __ Cmp(valuetype, Immediate(wasm::kWasmF64.raw_bit_field()));
   __ B(&inc_result_64bit, eq);
 
   // Invalid type. JavaScript cannot return Simd values to WebAssembly.
@@ -1797,7 +1809,7 @@ void Builtins::Generate_GenericWasmToJSInterpreterWrapper(
   // Deconstruct the stack frame.
   __ LeaveFrame(StackFrame::WASM_TO_JS);
 
-  __ Mov(x0, xzr);
+  __ Mov(x0, Immediate(WasmToJSInterpreterFrameConstants::kSuccess));
   __ Ret(lr);
 }
 
diff --git a/deps/v8/src/wasm/interpreter/wasm-interpreter-inl.h b/deps/v8/src/wasm/interpreter/wasm-interpreter-inl.h
index f5e6d817a218c9..04f9720b94ae4d 100644
--- a/deps/v8/src/wasm/interpreter/wasm-interpreter-inl.h
+++ b/deps/v8/src/wasm/interpreter/wasm-interpreter-inl.h
@@ -10,8 +10,6 @@
 #endif  // !V8_ENABLE_WEBASSEMBLY
 
 #include "src/wasm/interpreter/wasm-interpreter.h"
-// Include the non-inl header before the rest of the headers.
-
 #include "src/handles/handles-inl.h"
 #include "src/wasm/interpreter/wasm-interpreter-runtime.h"
 #include "src/wasm/wasm-module.h"
@@ -444,7 +442,7 @@ inline void WasmBytecodeGenerator::PushConstSlot(uint32_t slot_index) {
 
 inline bool WasmBytecodeGenerator::HasVoidSignature(
     const WasmBytecodeGenerator::BlockData& block_data) const {
-  if (block_data.signature_.value_type() == kWasmBottom) {
+  if (block_data.signature_.is_bottom()) {
     const FunctionSig* sig =
         module_->signature(block_data.signature_.sig_index);
     return 0 == (sig->parameter_count() + sig->return_count());
@@ -456,7 +454,7 @@ inline bool WasmBytecodeGenerator::HasVoidSignature(
 
 inline uint32_t WasmBytecodeGenerator::ParamsCount(
     const WasmBytecodeGenerator::BlockData& block_data) const {
-  if (block_data.signature_.value_type() == kWasmBottom) {
+  if (block_data.signature_.is_bottom()) {
     const FunctionSig* sig =
         module_->signature(block_data.signature_.sig_index);
     return static_cast<uint32_t>(sig->parameter_count());
@@ -466,14 +464,14 @@ inline uint32_t WasmBytecodeGenerator::ParamsCount(
 
 inline ValueType WasmBytecodeGenerator::GetParamType(
     const WasmBytecodeGenerator::BlockData& block_data, size_t index) const {
-  DCHECK_EQ(block_data.signature_.value_type(), kWasmBottom);
+  DCHECK(block_data.signature_.is_bottom());
   const FunctionSig* sig = module_->signature(block_data.signature_.sig_index);
   return sig->GetParam(index);
 }
 
 inline uint32_t WasmBytecodeGenerator::ReturnsCount(
     const WasmBytecodeGenerator::BlockData& block_data) const {
-  if (block_data.signature_.value_type() == kWasmBottom) {
+  if (block_data.signature_.is_bottom()) {
     const FunctionSig* sig =
         module_->signature(block_data.signature_.sig_index);
     return static_cast<uint32_t>(sig->return_count());
@@ -486,7 +484,7 @@ inline uint32_t WasmBytecodeGenerator::ReturnsCount(
 inline ValueType WasmBytecodeGenerator::GetReturnType(
     const WasmBytecodeGenerator::BlockData& block_data, size_t index) const {
   DCHECK_NE(block_data.signature_.value_type(), kWasmVoid);
-  if (block_data.signature_.value_type() == kWasmBottom) {
+  if (block_data.signature_.is_bottom()) {
     const FunctionSig* sig =
         module_->signature(block_data.signature_.sig_index);
     return sig->GetReturn(index);
diff --git a/deps/v8/src/wasm/interpreter/wasm-interpreter-runtime.cc b/deps/v8/src/wasm/interpreter/wasm-interpreter-runtime.cc
index a28724a83bc7ed..5a978f9c49e86a 100644
--- a/deps/v8/src/wasm/interpreter/wasm-interpreter-runtime.cc
+++ b/deps/v8/src/wasm/interpreter/wasm-interpreter-runtime.cc
@@ -137,9 +137,8 @@ RUNTIME_FUNCTION(Runtime_WasmRunInterpreter) {
         CASE_ARG_TYPE(kWasmF32.kind(), float)
         CASE_ARG_TYPE(kWasmF64.kind(), double)
 #undef CASE_ARG_TYPE
-        case wasm::kWasmRefString.kind():
-        case wasm::kWasmAnyRef.kind(): {
-          const bool anyref = (kind == wasm::kWasmAnyRef.kind());
+        case wasm::kRef:
+        case wasm::kRefNull: {
           DCHECK_EQ(wasm::ValueTypes::ElementSizeInBytes(sig->GetParam(i)),
                     kSystemPointerSize);
           // MarkCompactCollector::RootMarkingVisitor requires ref slots to be
@@ -163,10 +162,7 @@ RUNTIME_FUNCTION(Runtime_WasmRunInterpreter) {
             ref = isolate->factory()->wasm_null();
           }
 
-          wasm_args[i] = wasm::WasmValue(
-              ref,
-              anyref ? wasm::kWasmAnyRef
-                     : wasm::CanonicalValueType::Ref(wasm::HeapType::kString));
+          wasm_args[i] = wasm::WasmValue(ref, wasm::kWasmAnyRef);
           arg_buf_ptr += kSystemPointerSize;
           break;
         }
@@ -208,8 +204,8 @@ RUNTIME_FUNCTION(Runtime_WasmRunInterpreter) {
         CASE_RET_TYPE(kWasmF32.kind(), float)
         CASE_RET_TYPE(kWasmF64.kind(), double)
 #undef CASE_RET_TYPE
-        case wasm::kWasmRefString.kind():
-        case wasm::kWasmAnyRef.kind(): {
+        case wasm::kRef:
+        case wasm::kRefNull: {
           DCHECK_EQ(wasm::ValueTypes::ElementSizeInBytes(sig->GetReturn(i)),
                     kSystemPointerSize);
           DirectHandle<Object> ref = wasm_rets[i].to_ref();
@@ -312,7 +308,7 @@ IndirectFunctionTableEntry::IndirectFunctionTableEntry(
 
 WasmInterpreterRuntime::WasmInterpreterRuntime(
     const WasmModule* module, Isolate* isolate,
-    DirectHandle<WasmInstanceObject> instance_object,
+    IndirectHandle<WasmInstanceObject> instance_object,
     WasmInterpreter::CodeMap* codemap)
     : isolate_(isolate),
       module_(module),
@@ -991,24 +987,12 @@ void WasmInterpreterRuntime::BeginExecution(
           p += sizeof(double);
           break;
         case kRef:
-        case kRefNull: {
-          DirectHandle<Object> ref = value.to_ref();
-          if (IsJSFunction(*ref, isolate_)) {
-            Tagged<SharedFunctionInfo> sfi = Cast<JSFunction>(ref)->shared();
-            if (sfi->HasWasmExportedFunctionData()) {
-              Tagged<WasmExportedFunctionData> wasm_exported_function_data =
-                  sfi->wasm_exported_function_data();
-              ref = direct_handle(
-                  wasm_exported_function_data->func_ref()->internal(isolate_),
-                  isolate_);
-            }
-          }
-          ref_args.push_back(ref);
+        case kRefNull:
+          ref_args.push_back(value.to_ref());
           base::WriteUnalignedValue<uint64_t>(reinterpret_cast<Address>(p),
                                               kSlotsZapValue);
           p += sizeof(WasmRef);
           break;
-        }
         case kS128:
         default:
           UNREACHABLE();
@@ -1078,15 +1062,21 @@ void WasmInterpreterRuntime::ContinueExecution(WasmInterpreterThread* thread,
 
   const uint8_t* code = nullptr;
   const FunctionSig* sig = nullptr;
+  const CanonicalSig* canonicalized_sig = nullptr;
   uint32_t return_count = 0;
   WasmBytecode* target_function = GetFunctionBytecode(start_function_index_);
   if (target_function) {
     sig = target_function->GetFunctionSignature();
+    canonicalized_sig = target_function->GetCanonicalFunctionSignature();
     return_count = target_function->return_count();
     ExecuteFunction(code, start_function_index_, target_function->args_count(),
                     0, 0, 0);
   } else {
     sig = module_->functions[start_function_index_].sig;
+    CanonicalTypeIndex canonical_sig_index = module_->canonical_sig_id(
+        module_->functions[start_function_index_].sig_index);
+    canonicalized_sig =
+        GetTypeCanonicalizer()->LookupFunctionSignature(canonical_sig_index);
     return_count = static_cast<uint32_t>(sig->return_count());
     ExecuteImportedFunction(code, start_function_index_,
                             static_cast<uint32_t>(sig->parameter_count()), 0, 0,
@@ -1108,7 +1098,9 @@ void WasmInterpreterRuntime::ContinueExecution(WasmInterpreterThread* thread,
         // {GetReturnValue}.
         function_result_.resize(return_count);
         for (size_t index = 0; index < return_count; index++) {
-          switch (sig->GetReturn(index).kind()) {
+          CanonicalValueType ret_value_type =
+              canonicalized_sig->GetReturn(index);
+          switch (ret_value_type.kind()) {
             case kI32:
               function_result_[index] =
                   WasmValue(base::ReadUnalignedValue<int32_t>(
@@ -1138,10 +1130,7 @@ void WasmInterpreterRuntime::ContinueExecution(WasmInterpreterThread* thread,
               DirectHandle<Object> ref =
                   ExtractWasmRef(ref_result_slot_index++);
               ref = WasmToJSObject(ref);
-              function_result_[index] = WasmValue(
-                  ref, sig->GetReturn(index).kind() == kRef
-                           ? CanonicalValueType::Ref(HeapType::kString)
-                           : kWasmAnyRef);
+              function_result_[index] = WasmValue(ref, ret_value_type);
               dst += sizeof(WasmRef) / kSlotSize;
               break;
             }
@@ -1755,9 +1744,11 @@ void WasmInterpreterRuntime::UpdateIndirectCallTable(
 bool WasmInterpreterRuntime::CheckIndirectCallSignature(
     uint32_t table_index, uint32_t entry_index, uint32_t sig_index) const {
   const WasmTable& table = module_->tables[table_index];
-  bool needs_type_check = !EquivalentTypes(
-      table.type.AsNonNull(), ValueType::Ref(ModuleTypeIndex({sig_index})),
-      module_, module_);
+  bool needs_type_check =
+      !EquivalentTypes(table.type.AsNonNull(),
+                       ValueType::Ref(ModuleTypeIndex({sig_index}), false,
+                                      RefTypeKind::kFunction),
+                       module_, module_);
   bool needs_null_check = table.type.is_nullable();
 
   // Copied from Liftoff.
@@ -2206,8 +2197,11 @@ void WasmInterpreterRuntime::CallWasmToJSBuiltin(
 #else
   stack_handler.padding = 0;
 #endif
+  // {saved_c_entry_fp} can be null if we run the interpreter directly from the
+  // fuzzer, not from JS. In this case, we need to break the handler chain.
   isolate->thread_local_top()->handler_ =
-      reinterpret_cast<Address>(&stack_handler);
+      saved_c_entry_fp ? reinterpret_cast<Address>(&stack_handler)
+                       : kNullAddress;
   if (trap_handler::IsThreadInWasm()) {
     trap_handler::ClearThreadInWasm();
   }
@@ -2217,7 +2211,7 @@ void WasmInterpreterRuntime::CallWasmToJSBuiltin(
     Address result = generic_wasm_to_js_interpreter_wrapper_fn_.Call(
         (*js_function).ptr(), packed_args, isolate->isolate_root(), sig,
         saved_c_entry_fp, (*callable).ptr());
-    if (result != kNullAddress) {
+    if (result != WasmToJSInterpreterFrameConstants::kSuccess) {
       isolate->set_exception(Tagged<Object>(result));
       if (trap_handler::IsThreadInWasm()) {
         trap_handler::ClearThreadInWasm();
@@ -2542,21 +2536,11 @@ WasmRef WasmInterpreterRuntime::WasmJSToWasmObject(
 
 WasmRef WasmInterpreterRuntime::JSToWasmObject(WasmRef extern_ref,
                                                ValueType type) const {
-  wasm::CanonicalTypeIndex canonical_index;
-  if (type.has_index()) {
-    canonical_index =
-        module_->isorecursive_canonical_type_ids[type.ref_index().index];
-    type = wasm::ValueType::RefMaybeNull(ModuleTypeIndex({canonical_index}),
-                                         type.nullability());
-  }
+  DirectHandle<Object> result;
   const char* error_message;
-  {
-    DirectHandle<Object> result;
-    if (wasm::JSToWasmObject(isolate_, extern_ref, (CanonicalValueType)type,
-                             &error_message)
-            .ToHandle(&result)) {
-      return result;
-    }
+  if (wasm::JSToWasmObject(isolate_, module_, extern_ref, type, &error_message)
+          .ToHandle(&result)) {
+    return result;
   }
 
   {
@@ -2566,9 +2550,9 @@ WasmRef WasmInterpreterRuntime::JSToWasmObject(WasmRef extern_ref,
     if (v8_flags.wasm_jitless && trap_handler::IsThreadInWasm()) {
       trap_handler::ClearThreadInWasm();
     }
-    Tagged<Object> result = isolate_->Throw(*isolate_->factory()->NewTypeError(
+    Tagged<Object> error = isolate_->Throw(*isolate_->factory()->NewTypeError(
         MessageTemplate::kWasmTrapJSTypeError));
-    return direct_handle(result, isolate_);
+    return direct_handle(error, isolate_);
   }
 }
 
@@ -2633,8 +2617,7 @@ bool WasmInterpreterRuntime::SubtypeCheck(const WasmRef obj,
   }
 
   // Add Smi check if the source type may store a Smi (i31ref or JS Smi).
-  ValueType i31ref = ValueType::Ref(HeapType::kI31);
-  if (IsSubtypeOf(i31ref, obj_type, module_) && IsSmi(*obj)) {
+  if (IsSubtypeOf(kWasmRefI31, obj_type, module_) && IsSmi(*obj)) {
     return false;
   }
 
diff --git a/deps/v8/src/wasm/interpreter/wasm-interpreter-runtime.h b/deps/v8/src/wasm/interpreter/wasm-interpreter-runtime.h
index 5a6493992a9a2f..bee665f0da874a 100644
--- a/deps/v8/src/wasm/interpreter/wasm-interpreter-runtime.h
+++ b/deps/v8/src/wasm/interpreter/wasm-interpreter-runtime.h
@@ -29,7 +29,7 @@ struct WasmTag;
 class WasmInterpreterRuntime {
  public:
   WasmInterpreterRuntime(const WasmModule* module, Isolate* isolate,
-                         DirectHandle<WasmInstanceObject> instance_object,
+                         IndirectHandle<WasmInstanceObject> instance_object,
                          WasmInterpreter::CodeMap* codemap);
 
   inline WasmBytecode* GetFunctionBytecode(uint32_t func_index);
@@ -289,7 +289,7 @@ class WasmInterpreterRuntime {
 
   Isolate* isolate_;
   const WasmModule* module_;
-  DirectHandle<WasmInstanceObject> instance_object_;
+  IndirectHandle<WasmInstanceObject> instance_object_;
   WasmInterpreter::CodeMap* codemap_;
 
   uint32_t start_function_index_;
diff --git a/deps/v8/src/wasm/interpreter/wasm-interpreter.cc b/deps/v8/src/wasm/interpreter/wasm-interpreter.cc
index fce4d42696fdf6..de960c47a3d125 100644
--- a/deps/v8/src/wasm/interpreter/wasm-interpreter.cc
+++ b/deps/v8/src/wasm/interpreter/wasm-interpreter.cc
@@ -16,6 +16,7 @@
 #include "src/heap/heap-write-barrier.h"
 #include "src/objects/object-macros.h"
 #include "src/snapshot/embedded/embedded-data-inl.h"
+#include "src/wasm/canonical-types.h"
 #include "src/wasm/decoder.h"
 #include "src/wasm/function-body-decoder-impl.h"
 #include "src/wasm/interpreter/wasm-interpreter-inl.h"
@@ -352,7 +353,7 @@ void NopFinalizer(const v8::WeakCallbackInfo<void>& data) {
   GlobalHandles::Destroy(global_handle_location);
 }
 
-DirectHandle<WasmInstanceObject> MakeWeak(
+IndirectHandle<WasmInstanceObject> MakeWeak(
     Isolate* isolate, DirectHandle<WasmInstanceObject> instance_object) {
   Handle<WasmInstanceObject> weak_instance =
       isolate->global_handles()->Create<WasmInstanceObject>(*instance_object);
@@ -5361,38 +5362,38 @@ class Handlers : public HandlersBase {
       s2s_DoSimdLoadExtend<int16x8, int16_t, int8_t, uint32_t,
                            memory_offset32_t>;
   static auto constexpr s2s_SimdS128Load8x8S_Idx64 =
-      s2s_DoSimdLoadExtend<int16x8, int16_t, int8_t, uint32_t,
-                           memory_offset32_t>;
+      s2s_DoSimdLoadExtend<int16x8, int16_t, int8_t, uint64_t,
+                           memory_offset64_t>;
   static auto constexpr s2s_SimdS128Load8x8U =
       s2s_DoSimdLoadExtend<int16x8, uint16_t, uint8_t, uint32_t,
                            memory_offset32_t>;
   static auto constexpr s2s_SimdS128Load8x8U_Idx64 =
-      s2s_DoSimdLoadExtend<int16x8, uint16_t, uint8_t, uint32_t,
-                           memory_offset32_t>;
+      s2s_DoSimdLoadExtend<int16x8, uint16_t, uint8_t, uint64_t,
+                           memory_offset64_t>;
   static auto constexpr s2s_SimdS128Load16x4S =
       s2s_DoSimdLoadExtend<int32x4, int32_t, int16_t, uint32_t,
                            memory_offset32_t>;
   static auto constexpr s2s_SimdS128Load16x4S_Idx64 =
-      s2s_DoSimdLoadExtend<int32x4, int32_t, int16_t, uint32_t,
-                           memory_offset32_t>;
+      s2s_DoSimdLoadExtend<int32x4, int32_t, int16_t, uint64_t,
+                           memory_offset64_t>;
   static auto constexpr s2s_SimdS128Load16x4U =
       s2s_DoSimdLoadExtend<int32x4, uint32_t, uint16_t, uint32_t,
                            memory_offset32_t>;
   static auto constexpr s2s_SimdS128Load16x4U_Idx64 =
-      s2s_DoSimdLoadExtend<int32x4, uint32_t, uint16_t, uint32_t,
-                           memory_offset32_t>;
+      s2s_DoSimdLoadExtend<int32x4, uint32_t, uint16_t, uint64_t,
+                           memory_offset64_t>;
   static auto constexpr s2s_SimdS128Load32x2S =
       s2s_DoSimdLoadExtend<int64x2, int64_t, int32_t, uint32_t,
                            memory_offset32_t>;
   static auto constexpr s2s_SimdS128Load32x2S_Idx64 =
-      s2s_DoSimdLoadExtend<int64x2, int64_t, int32_t, uint32_t,
-                           memory_offset32_t>;
+      s2s_DoSimdLoadExtend<int64x2, int64_t, int32_t, uint64_t,
+                           memory_offset64_t>;
   static auto constexpr s2s_SimdS128Load32x2U =
       s2s_DoSimdLoadExtend<int64x2, uint64_t, uint32_t, uint32_t,
                            memory_offset32_t>;
   static auto constexpr s2s_SimdS128Load32x2U_Idx64 =
-      s2s_DoSimdLoadExtend<int64x2, uint64_t, uint32_t, uint32_t,
-                           memory_offset32_t>;
+      s2s_DoSimdLoadExtend<int64x2, uint64_t, uint32_t, uint64_t,
+                           memory_offset64_t>;
 
   template <typename s_type, typename load_type, typename MemIdx,
             typename MemOffsetT>
@@ -5794,8 +5795,9 @@ class Handlers : public HandlersBase {
       const uint8_t* code, uint32_t* sp, WasmInterpreterRuntime* wasm_runtime,
       int64_t r0, double fp0) {
     bool null_succeeds = Read<int32_t>(code);
-    HeapType target_type(
-        ModuleTypeIndex({static_cast<uint32_t>(Read<int32_t>(code))}));
+
+    HeapType target_type =
+        HeapType::FromBits(static_cast<uint32_t>(Read<int32_t>(code)));
 
     WasmRef ref = pop<WasmRef>(sp, code, wasm_runtime);
     const uint32_t ref_bitfield = Read<int32_t>(code);
@@ -5832,8 +5834,9 @@ class Handlers : public HandlersBase {
       const uint8_t* code, uint32_t* sp, WasmInterpreterRuntime* wasm_runtime,
       int64_t r0, double fp0) {
     bool null_succeeds = Read<int32_t>(code);
-    HeapType target_type(
-        ModuleTypeIndex({static_cast<uint32_t>(Read<int32_t>(code))}));
+
+    HeapType target_type =
+        HeapType::FromBits(static_cast<uint32_t>(Read<int32_t>(code)));
 
     WasmRef ref = pop<WasmRef>(sp, code, wasm_runtime);
     const uint32_t ref_bitfield = Read<int32_t>(code);
@@ -6095,7 +6098,7 @@ class Handlers : public HandlersBase {
     Tagged_t ref_tagged = base::ReadUnalignedValue<uint32_t>(field_addr);
     Isolate* isolate = wasm_runtime->GetIsolate();
     Tagged<Object> ref_uncompressed(
-        V8HeapCompressionScheme::DecompressTagged(isolate, ref_tagged));
+        V8HeapCompressionScheme::DecompressTagged(ref_tagged));
     WasmRef ref_handle = handle(ref_uncompressed, isolate);
     push<WasmRef>(sp, code, wasm_runtime, ref_handle);
 
@@ -6754,8 +6757,8 @@ class Handlers : public HandlersBase {
   INSTRUCTION_HANDLER_FUNC RefCast(const uint8_t* code, uint32_t* sp,
                                    WasmInterpreterRuntime* wasm_runtime,
                                    int64_t r0, double fp0) {
-    HeapType target_type(
-        ModuleTypeIndex({static_cast<uint32_t>(Read<int32_t>(code))}));
+    HeapType target_type =
+        HeapType::FromBits(static_cast<uint32_t>(Read<int32_t>(code)));
 
     WasmRef ref = pop<WasmRef>(sp, code, wasm_runtime);
 
@@ -6777,8 +6780,8 @@ class Handlers : public HandlersBase {
   INSTRUCTION_HANDLER_FUNC RefTest(const uint8_t* code, uint32_t* sp,
                                    WasmInterpreterRuntime* wasm_runtime,
                                    int64_t r0, double fp0) {
-    HeapType target_type(
-        ModuleTypeIndex({static_cast<uint32_t>(Read<int32_t>(code))}));
+    HeapType target_type =
+        HeapType::FromBits(static_cast<uint32_t>(Read<int32_t>(code)));
 
     WasmRef ref = pop<WasmRef>(sp, code, wasm_runtime);
 
@@ -7321,6 +7324,7 @@ void WasmEHDataGenerator::RecordPotentialExceptionThrowingInstruction(
 WasmBytecode::WasmBytecode(int func_index, const uint8_t* code_data,
                            size_t code_length, uint32_t stack_frame_size,
                            const FunctionSig* signature,
+                           const CanonicalSig* canonical_signature,
                            const InterpreterCode* interpreter_code,
                            size_t blocks_count, const uint8_t* const_slots_data,
                            size_t const_slots_length, uint32_t ref_slots_count,
@@ -7329,6 +7333,7 @@ WasmBytecode::WasmBytecode(int func_index, const uint8_t* code_data,
     : code_(code_data, code_data + code_length),
       code_bytes_(code_.data()),
       signature_(signature),
+      canonical_signature_(canonical_signature),
       interpreter_code_(interpreter_code),
       const_slots_values_(const_slots_data,
                           const_slots_data + const_slots_length),
@@ -7823,16 +7828,20 @@ void WasmBytecodeGenerator::StoreBlockParamsAndResultsIntoSlots(
       target_block_index == 0 ? 0 : ParamsCount(target_block_data);
   uint32_t rets_count = ReturnsCount(target_block_data);
 
-  // There could be valid code where there are not enough elements in the
-  // stack if some code in unreachable (for example if a 'i32.const 0' is
-  // followed by a 'br_if' the if branch is never reachable).
-  uint32_t count = std::min(static_cast<uint32_t>(stack_.size()), rets_count);
-  for (uint32_t i = 0; i < count; i++) {
-    uint32_t from_slot_index = stack_[stack_top_index() - (count - 1) + i];
-    uint32_t to_slot_index = target_block_data.first_block_index_ + i;
-    if (from_slot_index != to_slot_index) {
-      EmitCopySlot(GetReturnType(target_block_data, i), from_slot_index,
-                   to_slot_index);
+  // If we are branching to a loop block we go back to the beginning of the
+  // block, therefore we don't need to store the block results.
+  if (!is_target_loop_block || !is_branch) {
+    // There could be valid code where there are not enough elements in the
+    // stack if some code in unreachable (for example if a 'i32.const 0' is
+    // followed by a 'br_if' the if branch is never reachable).
+    uint32_t count = std::min(static_cast<uint32_t>(stack_.size()), rets_count);
+    for (uint32_t i = 0; i < count; i++) {
+      uint32_t from_slot_index = stack_[stack_top_index() - (count - 1) + i];
+      uint32_t to_slot_index = target_block_data.first_block_index_ + i;
+      if (from_slot_index != to_slot_index) {
+        EmitCopySlot(GetReturnType(target_block_data, i), from_slot_index,
+                     to_slot_index);
+      }
     }
   }
 
@@ -7979,6 +7988,7 @@ WasmInstruction WasmBytecodeGenerator::DecodeInstruction(pc_t pc,
   }
 
   WasmInstruction::Optional optional;
+  WasmDetectedFeatures detected;
   switch (orig) {
     case kExprUnreachable:
       break;
@@ -7988,7 +7998,7 @@ WasmInstruction WasmBytecodeGenerator::DecodeInstruction(pc_t pc,
     case kExprLoop:
     case kExprIf:
     case kExprTry: {
-      BlockTypeImmediate imm(WasmEnabledFeatures::All(), &decoder,
+      BlockTypeImmediate imm(WasmEnabledFeatures::All(), &detected, &decoder,
                              wasm_code_->at(pc + 1), Decoder::kNoValidation);
       if (imm.sig_index.valid()) {
         // The block has at least one argument or at least two results, its
@@ -8081,7 +8091,7 @@ WasmInstruction WasmBytecodeGenerator::DecodeInstruction(pc_t pc,
     case kExprSelect:
       break;
     case kExprSelectWithType: {
-      SelectTypeImmediate imm(WasmEnabledFeatures::All(), &decoder,
+      SelectTypeImmediate imm(WasmEnabledFeatures::All(), &detected, &decoder,
                               wasm_code_->at(pc + 1), Decoder::kNoValidation);
       len = 1 + imm.length;
       break;
@@ -8264,9 +8274,10 @@ WasmInstruction WasmBytecodeGenerator::DecodeInstruction(pc_t pc,
 #undef EXECUTE_UNOP
 
     case kExprRefNull: {
-      HeapTypeImmediate imm(WasmEnabledFeatures::All(), &decoder,
+      HeapTypeImmediate imm(WasmEnabledFeatures::All(), &detected, &decoder,
                             wasm_code_->at(pc + 1), Decoder::kNoValidation);
-      optional.ref_type = imm.type.representation();
+      value_type_reader::Populate(&imm.type, module_);
+      optional.ref_type_bit_field = imm.type.raw_bit_field();
       len = 1 + imm.length;
       break;
     }
@@ -8327,6 +8338,7 @@ void WasmBytecodeGenerator::DecodeGCOp(WasmOpcode opcode,
                                        WasmInstruction::Optional* optional,
                                        Decoder* decoder, InterpreterCode* code,
                                        pc_t pc, int* const len) {
+  WasmDetectedFeatures detected;
   switch (opcode) {
     case kExprStructNew:
     case kExprStructNewDefault: {
@@ -8411,11 +8423,12 @@ void WasmBytecodeGenerator::DecodeGCOp(WasmOpcode opcode,
     case kExprRefCastNull:
     case kExprRefTest:
     case kExprRefTestNull: {
-      HeapTypeImmediate imm(WasmEnabledFeatures::All(), decoder,
+      HeapTypeImmediate imm(WasmEnabledFeatures::All(), &detected, decoder,
                             code->at(pc + *len), Decoder::kNoValidation);
+      value_type_reader::Populate(&imm.type, module_);
       optional->gc_heap_type_immediate.length = imm.length;
-      optional->gc_heap_type_immediate.type_representation =
-          imm.type.representation();
+      optional->gc_heap_type_immediate.heap_type_bit_field =
+          imm.type.raw_bit_field();
       *len += imm.length;
       break;
     }
@@ -8428,15 +8441,21 @@ void WasmBytecodeGenerator::DecodeGCOp(WasmOpcode opcode,
       BranchDepthImmediate branch(decoder, code->at(pc + *len),
                                   Decoder::kNoValidation);
       *len += branch.length;
-      HeapTypeImmediate source_imm(WasmEnabledFeatures::All(), decoder,
-                                   code->at(pc + *len), Decoder::kNoValidation);
+      HeapTypeImmediate source_imm(WasmEnabledFeatures::All(), &detected,
+                                   decoder, code->at(pc + *len),
+                                   Decoder::kNoValidation);
+      value_type_reader::Populate(&source_imm.type, module_);
       *len += source_imm.length;
-      HeapTypeImmediate target_imm(WasmEnabledFeatures::All(), decoder,
-                                   code->at(pc + *len), Decoder::kNoValidation);
+      HeapTypeImmediate target_imm(WasmEnabledFeatures::All(), &detected,
+                                   decoder, code->at(pc + *len),
+                                   Decoder::kNoValidation);
+      value_type_reader::Populate(&target_imm.type, module_);
       *len += target_imm.length;
+      DCHECK(target_imm.type.raw_bit_field() <
+             (1 << kBranchOnCastDataTargetTypeBitSize));
       optional->br_on_cast_data = BranchOnCastData{
           branch.depth, flags_imm.flags.src_is_null,
-          flags_imm.flags.res_is_null, target_imm.type.representation()};
+          flags_imm.flags.res_is_null, target_imm.type.raw_bit_field()};
       break;
     }
 
@@ -9744,7 +9763,7 @@ RegMode WasmBytecodeGenerator::DoEncodeInstruction(const WasmInstruction& instr,
           GetTargetBranch(br_on_cast_data.label_depth);
       bool null_succeeds = br_on_cast_data.res_is_null;
       const ValueType target_type = ValueType::RefMaybeNull(
-          ModuleTypeIndex({br_on_cast_data.target_type}),
+          HeapType::FromBits(br_on_cast_data.target_type_bit_fields),
           null_succeeds ? kNullable : kNonNullable);
 
       const ValueType obj_type = slots_[stack_.back()].value_type;
@@ -9771,10 +9790,10 @@ RegMode WasmBytecodeGenerator::DoEncodeInstruction(const WasmInstruction& instr,
         EMIT_INSTR_HANDLER(s2s_BranchOnCast);
         EmitI32Const(null_succeeds);
         HeapType br_on_cast_data_target_type(
-            ModuleTypeIndex({br_on_cast_data.target_type}));
+            HeapType::FromBits(br_on_cast_data.target_type_bit_fields));
         EmitI32Const(br_on_cast_data_target_type.is_index()
-                         ? br_on_cast_data_target_type.representation()
-                         : target_type.heap_type().representation());
+                         ? br_on_cast_data_target_type.raw_bit_field()
+                         : target_type.heap_type().raw_bit_field());
         ValueType value_type = RefPop();
         EmitRefValueType(value_type.raw_bit_field());
         RefPush(value_type);
@@ -9797,8 +9816,8 @@ RegMode WasmBytecodeGenerator::DoEncodeInstruction(const WasmInstruction& instr,
       int32_t target_branch_index =
           GetTargetBranch(br_on_cast_data.label_depth);
       bool null_succeeds = br_on_cast_data.res_is_null;
-      HeapType br_on_cast_data_target_type(
-          ModuleTypeIndex({br_on_cast_data.target_type}));
+      HeapType br_on_cast_data_target_type =
+          HeapType::FromBits(br_on_cast_data.target_type_bit_fields);
       const ValueType target_type =
           ValueType::RefMaybeNull(br_on_cast_data_target_type,
                                   null_succeeds ? kNullable : kNonNullable);
@@ -9831,8 +9850,8 @@ RegMode WasmBytecodeGenerator::DoEncodeInstruction(const WasmInstruction& instr,
         EMIT_INSTR_HANDLER(s2s_BranchOnCastFail);
         EmitI32Const(null_succeeds);
         EmitI32Const(br_on_cast_data_target_type.is_index()
-                         ? br_on_cast_data_target_type.representation()
-                         : target_type.heap_type().representation());
+                         ? br_on_cast_data_target_type.raw_bit_field()
+                         : target_type.heap_type().raw_bit_field());
         ValueType value_type = RefPop();
         EmitRefValueType(value_type.raw_bit_field());
         RefPush(value_type);
@@ -11163,8 +11182,8 @@ RegMode WasmBytecodeGenerator::DoEncodeInstruction(const WasmInstruction& instr,
 
     case kExprRefNull: {
       EMIT_INSTR_HANDLER(s2s_RefNull);
-      ValueType value_type =
-          ValueType::RefNull(HeapType(instr.optional.ref_type));
+      ValueType value_type = ValueType::RefNull(
+          HeapType::FromBits(instr.optional.ref_type_bit_field));
       EmitRefValueType(value_type.raw_bit_field());
       RefPush(value_type);
       break;
@@ -11179,8 +11198,9 @@ RegMode WasmBytecodeGenerator::DoEncodeInstruction(const WasmInstruction& instr,
     case kExprRefFunc: {
       EMIT_INSTR_HANDLER(s2s_RefFunc);
       EmitI32Const(instr.optional.index);
-      ValueType value_type =
-          ValueType::Ref(module_->functions[instr.optional.index].sig_index);
+      ModuleTypeIndex sig_index =
+          module_->functions[instr.optional.index].sig_index;
+      ValueType value_type = ValueType::Ref(module_->heap_type(sig_index));
       RefPush(value_type);
       break;
     }
@@ -11211,14 +11231,16 @@ RegMode WasmBytecodeGenerator::DoEncodeInstruction(const WasmInstruction& instr,
         Pop(kind);
       }
 
-      RefPush(ValueType::Ref(ModuleTypeIndex({instr.optional.index})));
+      ModuleTypeIndex type_index{instr.optional.index};
+      RefPush(ValueType::Ref(module_->heap_type(type_index)));
       break;
     }
 
     case kExprStructNewDefault: {
       EMIT_INSTR_HANDLER(s2s_StructNewDefault);
       EmitI32Const(instr.optional.index);
-      RefPush(ValueType::Ref(ModuleTypeIndex({instr.optional.index})));
+      ModuleTypeIndex type_index{instr.optional.index};
+      RefPush(ValueType::Ref(module_->heap_type(type_index)));
       break;
     }
 
@@ -11413,7 +11435,8 @@ RegMode WasmBytecodeGenerator::DoEncodeInstruction(const WasmInstruction& instr,
           UNREACHABLE();
       }
       // Push the new array.
-      RefPush(ValueType::Ref(ModuleTypeIndex({array_index})));
+      RefPush(
+          ValueType::Ref(module_->heap_type(ModuleTypeIndex({array_index}))));
       break;
     }
 
@@ -11456,7 +11479,8 @@ RegMode WasmBytecodeGenerator::DoEncodeInstruction(const WasmInstruction& instr,
         }
       }
       // Push the new array.
-      RefPush(ValueType::Ref(ModuleTypeIndex({array_index})));
+      RefPush(
+          ValueType::Ref(module_->heap_type(ModuleTypeIndex({array_index}))));
       break;
     }
 
@@ -11465,7 +11489,9 @@ RegMode WasmBytecodeGenerator::DoEncodeInstruction(const WasmInstruction& instr,
       EmitI32Const(instr.optional.index);
       I32Pop();
       // Push the new array.
-      RefPush(ValueType::Ref(ModuleTypeIndex({instr.optional.index})));
+      ModuleTypeIndex array_index{instr.optional.index};
+      RefPush(
+          ValueType::Ref(module_->heap_type(ModuleTypeIndex({array_index}))));
       break;
     }
 
@@ -11479,7 +11505,8 @@ RegMode WasmBytecodeGenerator::DoEncodeInstruction(const WasmInstruction& instr,
       I32Pop();
       I32Pop();
       // Push the new array.
-      RefPush(ValueType::Ref(ModuleTypeIndex({array_index})));
+      RefPush(
+          ValueType::Ref(module_->heap_type(ModuleTypeIndex({array_index}))));
       break;
     }
 
@@ -11493,7 +11520,8 @@ RegMode WasmBytecodeGenerator::DoEncodeInstruction(const WasmInstruction& instr,
       I32Pop();
       I32Pop();
       // Push the new array.
-      RefPush(ValueType::Ref(ModuleTypeIndex({array_index})));
+      RefPush(
+          ValueType::Ref(module_->heap_type(ModuleTypeIndex({array_index}))));
       break;
     }
 
@@ -11747,7 +11775,7 @@ RegMode WasmBytecodeGenerator::DoEncodeInstruction(const WasmInstruction& instr,
     case kExprRefI31: {
       EMIT_INSTR_HANDLER(s2s_RefI31);
       I32Pop();
-      RefPush(ValueType::Ref(HeapType::kI31));
+      RefPush(ValueType::Ref(kWasmRefI31));
       break;
     }
 
@@ -11768,7 +11796,8 @@ RegMode WasmBytecodeGenerator::DoEncodeInstruction(const WasmInstruction& instr,
     case kExprRefCast:
     case kExprRefCastNull: {
       bool null_succeeds = (instr.opcode == kExprRefCastNull);
-      HeapType target_type = instr.optional.gc_heap_type_immediate.type();
+      HeapType target_type = HeapType::FromBits(
+          instr.optional.gc_heap_type_immediate.heap_type_bit_field);
       ValueType resulting_value_type = ValueType::RefMaybeNull(
           target_type, null_succeeds ? kNullable : kNonNullable);
 
@@ -11805,7 +11834,7 @@ RegMode WasmBytecodeGenerator::DoEncodeInstruction(const WasmInstruction& instr,
         } else {
           EMIT_INSTR_HANDLER_WITH_PC(s2s_RefCastNull, instr.pc);
         }
-        EmitI32Const(instr.optional.gc_heap_type_immediate.type_representation);
+        EmitI32Const(instr.optional.gc_heap_type_immediate.heap_type_bit_field);
         ValueType value_type = RefPop();
         EmitRefValueType(value_type.raw_bit_field());
         RefPush(resulting_value_type);
@@ -11816,7 +11845,8 @@ RegMode WasmBytecodeGenerator::DoEncodeInstruction(const WasmInstruction& instr,
     case kExprRefTest:
     case kExprRefTestNull: {
       bool null_succeeds = (instr.opcode == kExprRefTestNull);
-      HeapType target_type = instr.optional.gc_heap_type_immediate.type();
+      HeapType target_type = HeapType::FromBits(
+          instr.optional.gc_heap_type_immediate.heap_type_bit_field);
 
       ValueType obj_type = slots_[stack_.back()].value_type;
       DCHECK(obj_type.is_object_reference());
@@ -11845,7 +11875,7 @@ RegMode WasmBytecodeGenerator::DoEncodeInstruction(const WasmInstruction& instr,
         } else {
           EMIT_INSTR_HANDLER(s2s_RefTestNull);
         }
-        EmitI32Const(instr.optional.gc_heap_type_immediate.type_representation);
+        EmitI32Const(instr.optional.gc_heap_type_immediate.heap_type_bit_field);
         ValueType value_type = RefPop();
         EmitRefValueType(value_type.raw_bit_field());
         I32Push();  // bool
@@ -11857,7 +11887,7 @@ RegMode WasmBytecodeGenerator::DoEncodeInstruction(const WasmInstruction& instr,
       EMIT_INSTR_HANDLER_WITH_PC(s2s_AnyConvertExtern, instr.pc);
       ValueType extern_val = RefPop();
       ValueType intern_type = ValueType::RefMaybeNull(
-          HeapType::kAny, Nullability(extern_val.is_nullable()));
+          kWasmAnyRef, Nullability(extern_val.is_nullable()));
       RefPush(intern_type);
       break;
     }
@@ -11866,7 +11896,7 @@ RegMode WasmBytecodeGenerator::DoEncodeInstruction(const WasmInstruction& instr,
       EMIT_INSTR_HANDLER(s2s_ExternConvertAny);
       ValueType value_type = RefPop();
       ValueType extern_type = ValueType::RefMaybeNull(
-          HeapType::kExtern, Nullability(value_type.is_nullable()));
+          kWasmExternRef, Nullability(value_type.is_nullable()));
       RefPush(extern_type);
       break;
     }
@@ -12966,8 +12996,9 @@ std::unique_ptr<WasmBytecode> WasmBytecodeGenerator::GenerateBytecode() {
     _PushSlot(wasm_code_->locals.local_types[index]);
   }
 
-  current_block_index_ =
-      BeginBlock(kExprBlock, {wasm_code_->function->sig_index, kBottom});
+  current_block_index_ = BeginBlock(
+      kExprBlock,
+      {wasm_code_->function->sig_index, kWasmBottom.raw_bit_field()});
 
   WasmInstruction curr_instr;
   WasmInstruction next_instr;
@@ -13011,11 +13042,15 @@ std::unique_ptr<WasmBytecode> WasmBytecodeGenerator::GenerateBytecode() {
 
   total_bytecode_size_ += code_.size();
 
+  CanonicalTypeIndex canonical_sig_index =
+      module_->canonical_sig_id(module_->functions[function_index_].sig_index);
+  const CanonicalSig* canonicalized_sig =
+      GetTypeCanonicalizer()->LookupFunctionSignature(canonical_sig_index);
   return std::make_unique<WasmBytecode>(
       function_index_, code_.data(), code_.size(), slot_offset_,
-      module_->functions[function_index_].sig, wasm_code_, blocks_.size(),
-      const_slots_values_.data(), const_slots_values_.size(), ref_slots_count_,
-      std::move(eh_data_), std::move(code_pc_map_));
+      module_->functions[function_index_].sig, canonicalized_sig, wasm_code_,
+      blocks_.size(), const_slots_values_.data(), const_slots_values_.size(),
+      ref_slots_count_, std::move(eh_data_), std::move(code_pc_map_));
 }
 
 int32_t WasmBytecodeGenerator::BeginBlock(
diff --git a/deps/v8/src/wasm/interpreter/wasm-interpreter.h b/deps/v8/src/wasm/interpreter/wasm-interpreter.h
index 06b5dce3836892..7e5ecc1f237d0e 100644
--- a/deps/v8/src/wasm/interpreter/wasm-interpreter.h
+++ b/deps/v8/src/wasm/interpreter/wasm-interpreter.h
@@ -654,7 +654,7 @@ class V8_EXPORT_PRIVATE WasmInterpreter {
   // {InterpreterCode} vector in the {CodeMap}. It is also passed to
   // {WasmDecoder} used to parse the 'locals' in a Wasm function.
   Zone zone_;
-  DirectHandle<WasmInstanceObject> instance_object_;
+  IndirectHandle<WasmInstanceObject> instance_object_;
 
   // Create a copy of the module bytes for the interpreter, since the passed
   // pointer might be invalidated after constructing the interpreter.
@@ -1058,11 +1058,13 @@ enum ExternalCallResult {
   EXTERNAL_EXCEPTION
 };
 
+constexpr uint32_t kBranchOnCastDataTargetTypeBitSize = 30;
 struct BranchOnCastData {
   uint32_t label_depth;
-  uint32_t src_is_null : 1;   //  BrOnCastFlags
-  uint32_t res_is_null : 1;   //  BrOnCastFlags
-  uint32_t target_type : 30;  //  HeapType
+  uint32_t src_is_null : 1;  //  BrOnCastFlags
+  uint32_t res_is_null : 1;  //  BrOnCastFlags
+  uint32_t target_type_bit_fields
+      : kBranchOnCastDataTargetTypeBitSize;  //  HeapType bit_fields
 };
 
 struct WasmInstruction {
@@ -1086,6 +1088,7 @@ struct WasmInstruction {
       ModuleTypeIndex sig_index;
       uint32_t value_type_bitfield;  // return type or kVoid if no return type
                                      // or kBottom if sig_index is valid.
+      constexpr bool is_bottom() const { return value_type().is_bottom(); }
       constexpr ValueType value_type() const {
         return ValueType::FromRawBitField(value_type_bitfield);
       }
@@ -1114,12 +1117,10 @@ struct WasmInstruction {
     } gc_memory_immediate;
     struct GC_HeapTypeImmediate {
       uint32_t length;
-      HeapType::Representation type_representation;
-      // This is incorrect; it's just the smallest possible fix to make
-      // the header-includes bot green which needs this file to compile.
-      // It'd probably be a good idea to store a HeapType instead of a
-      // HeapType::Representation above.
-      constexpr HeapType type() const { return kWasmAnyRef; }
+      uint32_t heap_type_bit_field;
+      constexpr HeapType type() const {
+        return HeapType::FromBits(heap_type_bit_field);
+      }
     } gc_heap_type_immediate;
     struct GC_ArrayNewFixed {
       uint32_t array_index;
@@ -1135,7 +1136,7 @@ struct WasmInstruction {
     } gc_array_copy;
     BranchOnCastData br_on_cast_data;
     size_t simd_immediate_index;
-    HeapType::Representation ref_type;
+    uint32_t ref_type_bit_field;
   };
 
   WasmInstruction()
@@ -1343,6 +1344,7 @@ class WasmBytecode {
  public:
   WasmBytecode(int func_index, const uint8_t* code_data, size_t code_length,
                uint32_t stack_frame_size, const FunctionSig* signature,
+               const CanonicalSig* canonical_signature,
                const InterpreterCode* interpreter_code, size_t blocks_count,
                const uint8_t* const_slots_data, size_t const_slots_length,
                uint32_t ref_slots_count, const WasmEHData&& eh_data,
@@ -1360,6 +1362,9 @@ class WasmBytecode {
   inline uint32_t GetBlocksCount() const { return blocks_count_; }
 
   inline const FunctionSig* GetFunctionSignature() const { return signature_; }
+  inline const CanonicalSig* GetCanonicalFunctionSignature() const {
+    return canonical_signature_;
+  }
   inline ValueType return_type(size_t index) const;
   inline ValueType arg_type(size_t index) const;
   inline ValueType local_type(size_t index) const;
@@ -1416,6 +1421,7 @@ class WasmBytecode {
   std::vector<uint8_t> code_;
   const uint8_t* code_bytes_;
   const FunctionSig* signature_;
+  const CanonicalSig* canonical_signature_;
   const InterpreterCode* interpreter_code_;
   std::vector<uint8_t> const_slots_values_;
 
diff --git a/deps/v8/src/wasm/interpreter/x64/interpreter-builtins-x64.cc b/deps/v8/src/wasm/interpreter/x64/interpreter-builtins-x64.cc
index e415b4a0add009..55649dfa484830 100644
--- a/deps/v8/src/wasm/interpreter/x64/interpreter-builtins-x64.cc
+++ b/deps/v8/src/wasm/interpreter/x64/interpreter-builtins-x64.cc
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "src/codegen/code-factory.h"
+#include "src/codegen/interface-descriptors-inl.h"
 #include "src/codegen/macro-assembler.h"
 #include "src/codegen/signature.h"
 #include "src/execution/frame-constants.h"
@@ -421,8 +422,7 @@ void Builtins::Generate_GenericJSToWasmInterpreterWrapper(
                             kArgsOffset));
 
   Register valuetype = r12;
-  __ movl(valuetype,
-          Operand(valuetypes_array_ptr, wasm::ValueType::bit_field_offset()));
+  __ movl(valuetype, Operand(valuetypes_array_ptr, 0));
 
   // -------------------------------------------
   // Param conversion.
@@ -440,18 +440,15 @@ void Builtins::Generate_GenericJSToWasmInterpreterWrapper(
   __ SmiUntag(param);
   // Zero extend.
   __ movl(param, param);
-  // Place the param into the proper slot in Integer section.
-  __ movq(MemOperand(current_param_slot, 0), param);
+  // Place the param into the proper slot.
+  __ movl(MemOperand(current_param_slot, 0), param);
   __ addq(current_param_slot, Immediate(sizeof(int32_t)));
   __ jmp(&param_conversion_done);
 
   Label handle_ref_param;
   __ bind(&check_ref_param);
-  __ andl(valuetype, Immediate(wasm::kWasmValueKindBitsMask));
-  __ cmpq(valuetype, Immediate(wasm::ValueKind::kRefNull));
-  __ j(equal, &handle_ref_param);
-  __ cmpq(valuetype, Immediate(wasm::ValueKind::kRef));
-  __ j(not_equal, &convert_param);
+  __ testl(valuetype, Immediate(1));
+  __ j(equal, &convert_param);
 
   // Place the reference param into the proper slot.
   __ bind(&handle_ref_param);
@@ -569,7 +566,7 @@ void Builtins::Generate_GenericJSToWasmInterpreterWrapper(
   PrepareForBuiltinCall(masm, array_start, return_count, wasm_instance);
   __ movq(rax, return_count);
   __ SmiTag(rax);
-  // Create JSArray to hold results.
+  // Create JSArray to hold results. Possible GC here.
   __ Call(BUILTIN_CODE(masm->isolate(), WasmAllocateJSArray),
           RelocInfo::CODE_TARGET);
   __ movq(jsarray, rax);
@@ -697,7 +694,7 @@ void Builtins::Generate_GenericJSToWasmInterpreterWrapper(
   RestoreAfterJsToWasmConversionBuiltinCall(
       masm, function_data, wasm_instance, valuetypes_array_ptr,
       current_param_slot, param_count, array_start);
-  __ Movsd(MemOperand(current_param_slot, 0), xmm0);
+  __ Movss(MemOperand(current_param_slot, 0), xmm0);
   __ addq(current_param_slot, Immediate(sizeof(float)));
   __ jmp(&param_conversion_done);
 
@@ -727,8 +724,7 @@ void Builtins::Generate_GenericJSToWasmInterpreterWrapper(
 
   __ movq(valuetypes_array_ptr, MemOperand(rbp, kValueTypesArrayStartOffset));
   // The first valuetype of the array is the return's valuetype.
-  __ movl(valuetype,
-          Operand(valuetypes_array_ptr, wasm::ValueType::bit_field_offset()));
+  __ movl(valuetype, Operand(valuetypes_array_ptr, 0));
 
   Label return_kWasmI32;
   Label return_kWasmI64;
@@ -748,11 +744,8 @@ void Builtins::Generate_GenericJSToWasmInterpreterWrapper(
   __ cmpq(valuetype, Immediate(wasm::kWasmF64.raw_bit_field()));
   __ j(equal, &return_kWasmF64);
 
-  __ andl(valuetype, Immediate(wasm::kWasmValueKindBitsMask));
-  __ cmpq(valuetype, Immediate(wasm::ValueKind::kRefNull));
-  __ j(equal, &return_kWasmRef);
-  __ cmpq(valuetype, Immediate(wasm::ValueKind::kRef));
-  __ j(equal, &return_kWasmRef);
+  __ testl(valuetype, Immediate(1));
+  __ j(not_equal, &return_kWasmRef);
 
   // Invalid type. Wasm cannot return Simd results to JavaScript.
   __ int3();
@@ -849,11 +842,24 @@ void Builtins::Generate_GenericJSToWasmInterpreterWrapper(
   __ cmpq(fixed_array, Immediate(0));
   __ j(equal, &next_return_value);
 
-  // Store result in JSArray
+  // Store result into JSArray.
   __ StoreTaggedField(FieldOperand(fixed_array, result_index,
                                    static_cast<ScaleFactor>(kTaggedSizeLog2),
                                    OFFSET_OF_DATA_START(FixedArray)),
                       return_value);
+  PrepareForWasmToJsConversionBuiltinCall(
+      masm, return_count, result_index, current_return_slot,
+      valuetypes_array_ptr, wasm_instance, fixed_array, jsarray);
+  Register slot_address = WriteBarrierDescriptor::SlotAddressRegister();
+  __ leaq(slot_address, FieldOperand(fixed_array, result_index,
+                                     static_cast<ScaleFactor>(kTaggedSizeLog2),
+                                     OFFSET_OF_DATA_START(FixedArray)));
+  __ RecordWrite(fixed_array, slot_address, return_value,
+                 SaveFPRegsMode::kIgnore);
+  RestoreAfterWasmToJsConversionBuiltinCall(
+      masm, jsarray, fixed_array, wasm_instance, valuetypes_array_ptr,
+      current_return_slot, result_index, return_count);
+
   __ jmp(&next_return_value);
 }
 
@@ -1193,13 +1199,9 @@ void Builtins::Generate_GenericWasmToJSInterpreterWrapper(
     Label loop_copy_param_ref, load_ref_param, set_and_move;
 
     __ bind(&loop_copy_param_ref);
-    __ movl(valuetype,
-            Operand(valuetypes_array_ptr, wasm::ValueType::bit_field_offset()));
-    __ andl(valuetype, Immediate(wasm::kWasmValueKindBitsMask));
-    __ cmpq(valuetype, Immediate(wasm::ValueKind::kRefNull));
-    __ j(equal, &load_ref_param);
-    __ cmpq(valuetype, Immediate(wasm::ValueKind::kRef));
-    __ j(equal, &load_ref_param);
+    __ movl(valuetype, Operand(valuetypes_array_ptr, 0));
+    __ testl(valuetype, Immediate(1));
+    __ j(not_equal, &load_ref_param);
 
     // Initialize non-ref type slots to zero since they can be visited by GC
     // when converting wasm numbers into heap numbers.
@@ -1257,8 +1259,7 @@ void Builtins::Generate_GenericWasmToJSInterpreterWrapper(
   Label loop_through_params;
   __ bind(&loop_through_params);
 
-  __ movl(valuetype,
-          Operand(valuetypes_array_ptr, wasm::ValueType::bit_field_offset()));
+  __ movl(valuetype, Operand(valuetypes_array_ptr, 0));
 
   // -------------------------------------------
   // Param conversion.
@@ -1295,11 +1296,8 @@ void Builtins::Generate_GenericWasmToJSInterpreterWrapper(
 
   // Skip Ref params. We already copied reference params in the first loop.
   __ bind(&check_ref_param);
-  __ andl(valuetype, Immediate(wasm::kWasmValueKindBitsMask));
-  __ cmpq(valuetype, Immediate(wasm::ValueKind::kRefNull));
-  __ j(equal, &skip_ref_param);
-  __ cmpq(valuetype, Immediate(wasm::ValueKind::kRef));
-  __ j(not_equal, &convert_param);
+  __ testl(valuetype, Immediate(1));
+  __ j(equal, &convert_param);
 
   __ bind(&skip_ref_param);
   __ addq(current_param_slot_offset, Immediate(kSystemPointerSize));
@@ -1402,14 +1400,18 @@ void Builtins::Generate_GenericWasmToJSInterpreterWrapper(
   // rsi: context.
   __ movq(rbx, MemOperand(rbp, kReturnCountOffset));
   __ addq(rbx, rbx);
+  __ pushq(return_reg);  // result
   __ pushq(context);
+
+  // We can have a GC here!
   __ Call(BUILTIN_CODE(masm->isolate(), IterableToFixedArrayForWasm),
           RelocInfo::CODE_TARGET);
   __ movq(MemOperand(rbp,
                      WasmToJSInterpreterFrameConstants::kGCScanSlotLimitOffset),
           rsp);
-  __ popq(context);
   __ movq(fixed_array, rax);
+  __ popq(context);
+  __ popq(return_reg);
   __ movq(return_count, MemOperand(rbp, kReturnCountOffset));
   __ movq(packed_args, MemOperand(rbp, kPackedArrayOffset));
   __ movq(signature, MemOperand(rbp, kSignatureOffset));
@@ -1467,14 +1469,10 @@ void Builtins::Generate_GenericWasmToJSInterpreterWrapper(
 
   // Copy if the current return value is a ref type.
   __ bind(&copy_return_if_ref);
-  __ movl(valuetype,
-          Operand(valuetypes_array_ptr, wasm::ValueType::bit_field_offset()));
+  __ movl(valuetype, Operand(valuetypes_array_ptr, 0));
 
-  __ andl(valuetype, Immediate(wasm::kWasmValueKindBitsMask));
-  __ cmpq(valuetype, Immediate(wasm::ValueKind::kRefNull));
-  __ j(equal, &copy_return_ref);
-  __ cmpq(valuetype, Immediate(wasm::ValueKind::kRef));
-  __ j(equal, &copy_return_ref);
+  __ testl(valuetype, Immediate(1));
+  __ j(not_equal, &copy_return_ref);
 
   Label inc_result_32bit;
   __ cmpq(valuetype, Immediate(wasm::kWasmI32.raw_bit_field()));
@@ -1530,7 +1528,7 @@ void Builtins::Generate_GenericWasmToJSInterpreterWrapper(
   // Deconstruct the stack frame.
   __ LeaveFrame(StackFrame::WASM_TO_JS);
 
-  __ xorq(rax, rax);
+  __ movq(rax, Immediate(WasmToJSInterpreterFrameConstants::kSuccess));
   __ ret(0);
 
   // --------------------------------------------------------------------------
@@ -1641,8 +1639,7 @@ void Builtins::Generate_GenericWasmToJSInterpreterWrapper(
   // The builtin expects the parameter to be in register param = rax.
 
   // The first valuetype of the array is the return's valuetype.
-  __ movl(valuetype,
-          Operand(valuetypes_array_ptr, wasm::ValueType::bit_field_offset()));
+  __ movl(valuetype, Operand(valuetypes_array_ptr, 0));
 
   Label return_kWasmI32;
   Label return_kWasmI32_not_smi;
@@ -1665,11 +1662,8 @@ void Builtins::Generate_GenericWasmToJSInterpreterWrapper(
   __ cmpq(valuetype, Immediate(wasm::kWasmF64.raw_bit_field()));
   __ j(equal, &return_kWasmF64);
 
-  __ andl(valuetype, Immediate(wasm::kWasmValueKindBitsMask));
-  __ cmpq(valuetype, Immediate(wasm::ValueKind::kRefNull));
-  __ j(equal, &return_kWasmRef);
-  __ cmpq(valuetype, Immediate(wasm::ValueKind::kRef));
-  __ j(equal, &return_kWasmRef);
+  __ testl(valuetype, Immediate(1));
+  __ j(not_equal, &return_kWasmRef);
 
   // Invalid type. JavaScript cannot return Simd results to WebAssembly.
   __ int3();
diff --git a/deps/v8/src/wasm/jump-table-assembler.cc b/deps/v8/src/wasm/jump-table-assembler.cc
index 7a69ea0902ed1d..cb6e7983f6f63e 100644
--- a/deps/v8/src/wasm/jump-table-assembler.cc
+++ b/deps/v8/src/wasm/jump-table-assembler.cc
@@ -801,27 +801,26 @@ void JumpTableAssembler::EmitLazyCompileJumpSlot(uint32_t func_index,
        uint32_t((target_offset & 0x100000) << 11)),  // bit  20 ),  // jal
   };
 
-  emit<uint32_t>(inst[0]);
-  emit<uint32_t>(inst[1]);
-  emit<uint32_t>(inst[2]);
+  emit<uint32_t>(inst[0], kRelaxedStore);
+  emit<uint32_t>(inst[1], kRelaxedStore);
+  emit<uint32_t>(inst[2], kRelaxedStore);
 }
 bool JumpTableAssembler::EmitJumpSlot(Address target) {
-  uint32_t high_20 = (int64_t(4 * kInstrSize + 0x800) >> 12);
-  uint32_t low_12 = (int64_t(4 * kInstrSize) << 52 >> 52);
+  uint32_t high_20 = (int64_t(3 * kInstrSize + 0x800) >> 12);
+  uint32_t low_12 = (int64_t(3 * kInstrSize) << 52 >> 52);
 
   const uint32_t inst[kJumpTableSlotSize / 4] = {
       (RO_AUIPC | (t6.code() << kRdShift) |
        (high_20 << kImm20Shift)),  // auipc t6, high_20
       (RO_LW | (t6.code() << kRdShift) | (t6.code() << kRs1Shift) |
-       (low_12 << kImm12Shift)),  // jalr t6, t6, low_12
-      (RO_JALR | (t6.code() << kRs1Shift) | zero_reg.code() << kRdShift),
-      (kNopByte),  // nop
-      0x0000,      // target
+       (low_12 << kImm12Shift)),  // lw t6, t6, low_12
+      (RO_JALR | (t6.code() << kRs1Shift) |
+       zero_reg.code() << kRdShift),  // jalr t6
+      0x0000,                         // target
   };
-  emit<uint32_t>(inst[0]);
-  emit<uint32_t>(inst[1]);
-  emit<uint32_t>(inst[2]);
-  emit<uint32_t>(inst[3]);
+  emit<uint32_t>(inst[0], kRelaxedStore);
+  emit<uint32_t>(inst[1], kRelaxedStore);
+  emit<uint32_t>(inst[2], kRelaxedStore);
   emit<uint32_t>(target, kRelaxedStore);
   return true;
 }
diff --git a/deps/v8/src/wasm/jump-table-assembler.h b/deps/v8/src/wasm/jump-table-assembler.h
index a76fe76396328c..09126f03ca614e 100644
--- a/deps/v8/src/wasm/jump-table-assembler.h
+++ b/deps/v8/src/wasm/jump-table-assembler.h
@@ -236,7 +236,7 @@ class V8_EXPORT_PRIVATE JumpTableAssembler {
   static constexpr int kFarJumpTableSlotSize = 6 * kInstrSize;
   static constexpr int kLazyCompileTableSlotSize = 3 * kInstrSize;
 #elif V8_TARGET_ARCH_RISCV32
-  static constexpr int kJumpTableSlotSize = 5 * kInstrSize;
+  static constexpr int kJumpTableSlotSize = 4 * kInstrSize;
   static constexpr int kJumpTableLineSize = kJumpTableSlotSize;
   static constexpr int kFarJumpTableSlotSize = kJumpTableSlotSize;
   static constexpr int kLazyCompileTableSlotSize = 3 * kInstrSize;
diff --git a/deps/v8/src/wasm/module-compiler.cc b/deps/v8/src/wasm/module-compiler.cc
index 80aadddea958b1..7b618ede228ac8 100644
--- a/deps/v8/src/wasm/module-compiler.cc
+++ b/deps/v8/src/wasm/module-compiler.cc
@@ -621,7 +621,8 @@ class CompilationStateImpl {
   // Adds compilation units for another function to the
   // {CompilationUnitBuilder}. This function is the streaming compilation
   // equivalent to {InitializeCompilationUnits}.
-  void AddCompilationUnit(CompilationUnitBuilder* builder, int func_index);
+  void InitializeCompilationUnitForSingleFunction(
+      CompilationUnitBuilder* builder, int func_index);
 
   // Add the callback to be called on compilation events. Needs to be
   // set before {CommitCompilationUnits} is run to ensure that it receives all
@@ -727,10 +728,6 @@ class CompilationStateImpl {
   std::vector<WasmCode*> PublishCode(base::Vector<UnpublishedWasmCode> codes);
 
  private:
-  void AddCompilationUnitInternal(CompilationUnitBuilder* builder,
-                                  int function_index,
-                                  uint8_t function_progress);
-
   // Trigger callbacks according to the internal counters below
   // (outstanding_...).
   // Hold the {callbacks_mutex_} when calling this method.
@@ -799,10 +796,17 @@ class CompilationStateImpl {
   base::EnumSet<CompilationEvent> finished_events_;
 
   int outstanding_baseline_units_ = 0;
+
   // The amount of generated top tier code since the last
   // {kFinishedCompilationChunk} event.
   size_t bytes_since_last_chunk_ = 0;
-  std::vector<uint8_t> compilation_progress_;
+
+  // One byte per declared function, see bitfields defined below.
+  // This vector is initialized once to the right size, updates are *usually*
+  // protected by the {callbacks_mutes_}, with exceptions during
+  // initialization (see comment in
+  // {CompilationStateImpl::InitializeCompilationUnitForSingleFunction}).
+  base::OwnedVector<uint8_t> compilation_progress_;
 
   // The timestamp of the last top-tier compilation.
   // This field is updated on every publishing of top-tier code, and is reset
@@ -840,7 +844,7 @@ CompilationStateImpl* BackgroundCompileScope::compilation_state() const {
 }
 
 size_t CompilationStateImpl::EstimateCurrentMemoryConsumption() const {
-  UPDATE_WHEN_CLASS_CHANGES(CompilationStateImpl, 464);
+  UPDATE_WHEN_CLASS_CHANGES(CompilationStateImpl, 456);
   size_t result = sizeof(CompilationStateImpl);
 
   {
@@ -3363,8 +3367,8 @@ bool AsyncStreamingProcessor::ProcessFunctionBody(
   }
 
   auto* compilation_state = Impl(job_->native_module_->compilation_state());
-  compilation_state->AddCompilationUnit(compilation_unit_builder_.get(),
-                                        func_index);
+  compilation_state->InitializeCompilationUnitForSingleFunction(
+      compilation_unit_builder_.get(), func_index);
   return true;
 }
 
@@ -3639,6 +3643,13 @@ void CompilationStateImpl::ApplyCompilationHintToInitialProgress(
       break;
   }
 
+  if (new_top_tier == ExecutionTier::kLiftoff &&
+      new_baseline_tier == ExecutionTier::kTurbofan) {
+    // The top tier shouldn't be lower than the baseline tier (or it should be
+    // ::None).
+    new_top_tier = ExecutionTier::kTurbofan;
+  }
+
   progress = RequiredBaselineTierField::update(progress, new_baseline_tier);
   progress = RequiredTopTierField::update(progress, new_top_tier);
 
@@ -3760,8 +3771,9 @@ void CompilationStateImpl::InitializeCompilationProgress(
         RequiredBaselineTierField::encode(default_tiers.baseline_tier) |
         RequiredTopTierField::encode(default_tiers.top_tier) |
         ReachedTierField::encode(ExecutionTier::kNone);
-    compilation_progress_.assign(module->num_declared_functions,
-                                 default_progress);
+    DCHECK_NULL(compilation_progress_);
+    compilation_progress_ = base::OwnedVector<uint8_t>::New(
+        module->num_declared_functions, default_progress);
     if (default_tiers.baseline_tier != ExecutionTier::kNone) {
       outstanding_baseline_units_ += module->num_declared_functions;
     }
@@ -3801,9 +3813,24 @@ void CompilationStateImpl::InitializeCompilationProgress(
   TriggerOutstandingCallbacks();
 }
 
-void CompilationStateImpl::AddCompilationUnitInternal(
-    CompilationUnitBuilder* builder, int function_index,
-    uint8_t function_progress) {
+void CompilationStateImpl::InitializeCompilationUnitForSingleFunction(
+    CompilationUnitBuilder* builder, int function_index) {
+  if (v8_flags.wasm_jitless) return;
+
+  // Only during streaming compilation, we reach here without holding
+  // `callbacks_mutex_`.
+  // This avoids the observed overhead of taking the lock once per function.
+  // This is correct (data-race free), because the only mutation of
+  // `compilation_progress_` before reading it here without holding the lock is
+  // when initializing the compilation during parsing of the code section
+  // header (see `InitializeCompilationProgress` and
+  // `AsyncStreamingProcessor::ProcessCodeSectionHeader`), which must happen
+  // before processing functions.
+  // Also, this read here happens exactly once per function, only for the
+  // initial compilation, and all accesses to `compilation_progress_` thereafter
+  // are synchronized via `callbacks_mutex_`.
+  uint8_t function_progress = compilation_progress_[declared_function_index(
+      native_module_->module(), function_index)];
   ExecutionTier required_baseline_tier =
       CompilationStateImpl::RequiredBaselineTierField::decode(
           function_progress);
@@ -3823,40 +3850,21 @@ void CompilationStateImpl::AddCompilationUnitInternal(
 
 void CompilationStateImpl::InitializeCompilationUnits(
     std::unique_ptr<CompilationUnitBuilder> builder) {
-  if (!v8_flags.wasm_jitless) {
-    int offset = native_module_->module()->num_imported_functions;
-    {
-      base::MutexGuard guard(&callbacks_mutex_);
+  if (v8_flags.wasm_jitless) return;
 
-      for (size_t i = 0, e = compilation_progress_.size(); i < e; ++i) {
-        uint8_t function_progress = compilation_progress_[i];
-        int func_index = offset + static_cast<int>(i);
-        AddCompilationUnitInternal(builder.get(), func_index,
-                                   function_progress);
-      }
+  {
+    base::MutexGuard guard(&callbacks_mutex_);
+    const WasmModule* module = native_module_->module();
+    DCHECK_EQ(module->num_declared_functions, compilation_progress_.size());
+    int start = module->num_imported_functions;
+    int end = start + module->num_declared_functions;
+    for (int func_index = start; func_index < end; ++func_index) {
+      InitializeCompilationUnitForSingleFunction(builder.get(), func_index);
     }
   }
   builder->Commit();
 }
 
-void CompilationStateImpl::AddCompilationUnit(CompilationUnitBuilder* builder,
-                                              int func_index) {
-  int offset = native_module_->module()->num_imported_functions;
-  int progress_index = func_index - offset;
-  uint8_t function_progress = 0;
-  if (!v8_flags.wasm_jitless) {
-    // TODO(ahaas): This lock may cause overhead. If so, we could get rid of the
-    // lock as follows:
-    // 1) Make compilation_progress_ an array of atomic<uint8_t>, and access it
-    // lock-free.
-    // 2) Have a copy of compilation_progress_ that we use for initialization.
-    // 3) Just re-calculate the content of compilation_progress_.
-    base::MutexGuard guard(&callbacks_mutex_);
-    function_progress = compilation_progress_[progress_index];
-  }
-  AddCompilationUnitInternal(builder, func_index, function_progress);
-}
-
 void CompilationStateImpl::InitializeCompilationProgressAfterDeserialization(
     base::Vector<const int> lazy_functions,
     base::Vector<const int> eager_functions) {
@@ -3872,7 +3880,7 @@ void CompilationStateImpl::InitializeCompilationProgressAfterDeserialization(
   auto* module = native_module_->module();
   {
     base::MutexGuard guard(&callbacks_mutex_);
-    DCHECK(compilation_progress_.empty());
+    DCHECK_NULL(compilation_progress_);
 
     // Initialize the compilation progress as if everything was
     // TurboFan-compiled.
@@ -3880,8 +3888,8 @@ void CompilationStateImpl::InitializeCompilationProgressAfterDeserialization(
         RequiredBaselineTierField::encode(ExecutionTier::kLiftoff) |
         RequiredTopTierField::encode(ExecutionTier::kTurbofan) |
         ReachedTierField::encode(ExecutionTier::kTurbofan);
-    compilation_progress_.assign(module->num_declared_functions,
-                                 kProgressAfterTurbofanDeserialization);
+    compilation_progress_ = base::OwnedVector<uint8_t>::New(
+        module->num_declared_functions, kProgressAfterTurbofanDeserialization);
 
     // Update compilation state for lazy functions.
     constexpr uint8_t kProgressForLazyFunctions =
@@ -4024,9 +4032,9 @@ void CompilationStateImpl::OnFinishedUnits(
       // This view on the compilation progress may differ from the actually
       // compiled code. Any lazily compiled function does not contribute to the
       // compilation progress but may publish code to the code manager.
-      int slot_index =
-          declared_function_index(native_module_->module(), code->index());
-      uint8_t function_progress = compilation_progress_[slot_index];
+      uint8_t& function_progress =
+          compilation_progress_[declared_function_index(
+              native_module_->module(), code->index())];
       ExecutionTier required_baseline_tier =
           RequiredBaselineTierField::decode(function_progress);
       ExecutionTier reached_tier = ReachedTierField::decode(function_progress);
@@ -4043,8 +4051,8 @@ void CompilationStateImpl::OnFinishedUnits(
 
       // Update function's compilation progress.
       if (code->tier() > reached_tier) {
-        compilation_progress_[slot_index] = ReachedTierField::update(
-            compilation_progress_[slot_index], code->tier());
+        function_progress =
+            ReachedTierField::update(function_progress, code->tier());
       }
       // Allow another top tier compilation if deopts are enabled and the
       // currently installed code object is a liftoff object.
@@ -4070,8 +4078,8 @@ void CompilationStateImpl::OnFinishedUnits(
         // inconsistent state and has actually led to crashes before (see
         // https://crbug.com/379086474).
         DCHECK_LE(required_baseline_tier, ExecutionTier::kLiftoff);
-        compilation_progress_[slot_index] = ReachedTierField::update(
-            compilation_progress_[slot_index], ExecutionTier::kLiftoff);
+        function_progress = ReachedTierField::update(function_progress,
+                                                     ExecutionTier::kLiftoff);
         compilation_unit_queues_.AllowAnotherTopTierJob(code->index());
       }
       DCHECK_LE(0, outstanding_baseline_units_);
diff --git a/deps/v8/src/wasm/module-decoder-impl.h b/deps/v8/src/wasm/module-decoder-impl.h
index fe33741b78b932..03e2a20c3e808c 100644
--- a/deps/v8/src/wasm/module-decoder-impl.h
+++ b/deps/v8/src/wasm/module-decoder-impl.h
@@ -570,6 +570,7 @@ class ModuleDecoderImpl : public Decoder {
           CHECK(!ok());
           return {};
         }
+
         return {sig, kNoSuperType, is_final, shared};
       }
       case kWasmStructTypeCode: {
@@ -687,6 +688,12 @@ class ModuleDecoderImpl : public Decoder {
       module_->has_shared_part = true;
       consume_bytes(1, " shared", tracer_);
       TypeDefinition type = consume_describing_type(current_type_index);
+      if (type.kind == TypeDefinition::kFunction ||
+          type.kind == TypeDefinition::kCont) {
+        // TODO(42204563): Support shared functions/continuations.
+        error(pc() - 1, "shared functions/continuations are not supported yet");
+        return {};
+      }
       type.is_shared = true;
       return type;
     } else {
@@ -2195,9 +2202,10 @@ class ModuleDecoderImpl : public Decoder {
                 "--experimental-wasm-shared yet.");
         }
       } else if (!v8_flags.experimental_wasm_shared) {  // table
-        error(pc() - 1,
-              "invalid table limits flags, enable with "
-              "--experimental-wasm-shared");
+        error(pc() - 1, "invalid table limits flags");
+      } else {
+        // TODO(42204563): Support shared tables.
+        error(pc() - 1, "shared tables are not supported yet");
       }
     }
 
@@ -2247,10 +2255,12 @@ class ModuleDecoderImpl : public Decoder {
       tracer_->Description(mutability ? " mutable" : " immutable");
     }
     if (shared && !v8_flags.experimental_wasm_shared) {
-      errorf(
-          pc() - 1,
-          "invalid global flags 0x%x (enable via --experimental-wasm-shared)",
-          flags);
+      errorf(pc() - 1, "invalid global flags 0x%x", flags);
+      return {false, false};
+    }
+    if (shared) {
+      // TODO(42204563): Support shared globals.
+      error(pc() - 1, "shared globals are not supported yet");
       return {false, false};
     }
     return {mutability, shared};
@@ -2383,7 +2393,7 @@ class ModuleDecoderImpl : public Decoder {
       case kExprRefNull: {
         auto [type, length] =
             value_type_reader::read_heap_type<FullValidationTag>(
-                this, pc() + 1, enabled_features_);
+                this, pc() + 1, enabled_features_, detected_features_);
         value_type_reader::ValidateHeapType<FullValidationTag>(this, pc_,
                                                                module, type);
         if (V8_UNLIKELY(failed())) return {};
@@ -2480,7 +2490,8 @@ class ModuleDecoderImpl : public Decoder {
         value_type_reader::read_value_type<FullValidationTag>(
             this, pc_,
             module_->origin == kWasmOrigin ? enabled_features_
-                                           : WasmEnabledFeatures::None());
+                                           : WasmEnabledFeatures::None(),
+            detected_features_);
     value_type_reader::ValidateValueType<FullValidationTag>(
         this, pc_, module_.get(), result);
     if (ok() && module) value_type_reader::Populate(&result, module);
@@ -2497,7 +2508,8 @@ class ModuleDecoderImpl : public Decoder {
         value_type_reader::read_heap_type<FullValidationTag>(
             this, pc_,
             module_->origin == kWasmOrigin ? enabled_features_
-                                           : WasmEnabledFeatures::None());
+                                           : WasmEnabledFeatures::None(),
+            detected_features_);
 
     value_type_reader::ValidateHeapType<FullValidationTag>(
         this, pc_, module_.get(), heap_type);
@@ -2623,11 +2635,15 @@ class ModuleDecoderImpl : public Decoder {
 
     bool is_shared = flag & kSharedFlag;
     if (is_shared && !v8_flags.experimental_wasm_shared) {
-      errorf(pos,
-             "illegal flag value %u, enable with --experimental-wasm-shared",
-             flag);
+      errorf(pos, "illegal flag value %u", flag);
+      return {};
+    }
+    if (is_shared) {
+      // TODO(42204563): Support shared element segments.
+      error(pos, "shared element segments are not supported yet.");
       return {};
     }
+
     if (is_shared) module_->has_shared_part = true;
 
     const WasmElemSegment::Status status =
@@ -2768,9 +2784,12 @@ class ModuleDecoderImpl : public Decoder {
     bool is_shared = flag & 0b1000;
 
     if (V8_UNLIKELY(is_shared && !v8_flags.experimental_wasm_shared)) {
-      errorf(pos,
-             "illegal flag value %u. Enable with --experimental-wasm-shared",
-             flag);
+      errorf(pos, "illegal flag value %u.", flag);
+      return {};
+    }
+    if (V8_UNLIKELY(is_shared)) {
+      // TODO(42204563): Support shared data segments.
+      error(pos, "shared data segments are not supported yet.");
       return {};
     }
 
diff --git a/deps/v8/src/wasm/module-instantiate.cc b/deps/v8/src/wasm/module-instantiate.cc
index 9cf3a6f63c81ef..867baf75e7f97b 100644
--- a/deps/v8/src/wasm/module-instantiate.cc
+++ b/deps/v8/src/wasm/module-instantiate.cc
@@ -92,14 +92,18 @@ void CreateMapForType(Isolate* isolate, const WasmModule* module,
   }
   DirectHandle<Map> map;
   switch (module->type(type_index).kind) {
-    case TypeDefinition::kStruct:
-      map = CreateStructMap(isolate, canonical_type_index, rtt_parent);
+    case TypeDefinition::kStruct: {
+      DirectHandle<NativeContext> context_independent;
+      map = CreateStructMap(isolate, canonical_type_index, rtt_parent,
+                            context_independent);
       break;
+    }
     case TypeDefinition::kArray:
       map = CreateArrayMap(isolate, canonical_type_index, rtt_parent);
       break;
     case TypeDefinition::kFunction:
-      map = CreateFuncRefMap(isolate, canonical_type_index, rtt_parent);
+      map = CreateFuncRefMap(isolate, canonical_type_index, rtt_parent,
+                             module->type(type_index).is_shared);
       break;
     case TypeDefinition::kCont:
       UNIMPLEMENTED();
@@ -1101,8 +1105,12 @@ MaybeDirectHandle<WasmTrustedInstanceData> InstanceBuilder::Build_Phase1(
   bool shared = module_object_->module()->has_shared_part;
   DirectHandle<WasmTrustedInstanceData> shared_trusted_data;
   if (shared) {
+    // For now, allocate the shared part in non-shared space. We do not need it
+    // in shared space yet since no shared objects point to it.
+    // TODO(42204563): This will change once we introduce shared globals,
+    // tables, or functions.
     shared_trusted_data =
-        WasmTrustedInstanceData::New(isolate_, module_object_, true);
+        WasmTrustedInstanceData::New(isolate_, module_object_, false);
     trusted_data->set_shared_part(*shared_trusted_data);
   }
 
@@ -1181,12 +1189,13 @@ MaybeDirectHandle<WasmTrustedInstanceData> InstanceBuilder::Build_Phase1(
     trusted_data->set_globals_start(
         reinterpret_cast<uint8_t*>(untagged_globals_->backing_store()));
 
-    // TODO(14616): Do this only if we have a shared untagged global.
-    if (shared) {
+    // TODO(42204563): Do this only if we have a shared untagged global.
+    // TODO(42204563): Reinstate once we support shared globals.
+    /* if (shared) {
       MaybeDirectHandle<JSArrayBuffer> shared_result =
           isolate_->factory()->NewJSArrayBufferAndBackingStore(
               untagged_globals_buffer_size, InitializedFlag::kZeroInitialized,
-              AllocationType::kOld);
+              AllocationType::kSharedOld);
 
       if (!shared_result.ToHandle(&shared_untagged_globals_)) {
         thrower_->RangeError("Out of memory: wasm globals");
@@ -1197,7 +1206,7 @@ MaybeDirectHandle<WasmTrustedInstanceData> InstanceBuilder::Build_Phase1(
           *shared_untagged_globals_);
       shared_trusted_data->set_globals_start(reinterpret_cast<uint8_t*>(
           shared_untagged_globals_->backing_store()));
-    }
+    }*/
   }
 
   uint32_t tagged_globals_buffer_size = module_->tagged_globals_buffer_size;
@@ -1207,7 +1216,8 @@ MaybeDirectHandle<WasmTrustedInstanceData> InstanceBuilder::Build_Phase1(
     trusted_data->set_tagged_globals_buffer(*tagged_globals_);
     if (shared) {
       shared_tagged_globals_ = isolate_->factory()->NewFixedArray(
-          static_cast<int>(tagged_globals_buffer_size));
+          static_cast<int>(tagged_globals_buffer_size),
+          AllocationType::kSharedOld);
       shared_trusted_data->set_tagged_globals_buffer(*shared_tagged_globals_);
     }
   }
@@ -1225,7 +1235,8 @@ MaybeDirectHandle<WasmTrustedInstanceData> InstanceBuilder::Build_Phase1(
     if (shared) {
       DirectHandle<FixedArray> shared_buffers_array =
           isolate_->factory()->NewFixedArray(
-              module_->num_imported_mutable_globals, AllocationType::kOld);
+              module_->num_imported_mutable_globals,
+              AllocationType::kSharedOld);
       shared_trusted_data->set_imported_mutable_globals_buffers(
           *shared_buffers_array);
     }
@@ -1242,7 +1253,8 @@ MaybeDirectHandle<WasmTrustedInstanceData> InstanceBuilder::Build_Phase1(
     tags_wrappers_.resize(tags_count);
     if (shared) {
       DirectHandle<FixedArray> shared_tag_table =
-          isolate_->factory()->NewFixedArray(tags_count, AllocationType::kOld);
+          isolate_->factory()->NewFixedArray(tags_count,
+                                             AllocationType::kSharedOld);
       shared_trusted_data->set_tags_table(*shared_tag_table);
       shared_tags_wrappers_.resize(tags_count);
     }
@@ -1268,7 +1280,8 @@ MaybeDirectHandle<WasmTrustedInstanceData> InstanceBuilder::Build_Phase1(
     DirectHandle<FixedArray> shared_tables;
     DirectHandle<ProtectedFixedArray> shared_dispatch_tables;
     if (shared) {
-      shared_tables = isolate_->factory()->NewFixedArray(table_count);
+      shared_tables = isolate_->factory()->NewFixedArray(
+          table_count, AllocationType::kSharedOld);
       shared_dispatch_tables =
           isolate_->factory()->NewProtectedFixedArray(table_count);
       shared_trusted_data->set_tables(*shared_tables);
@@ -1323,12 +1336,13 @@ MaybeDirectHandle<WasmTrustedInstanceData> InstanceBuilder::Build_Phase1(
       static_cast<int>(module_->types.size()));
   DirectHandle<FixedArray> shared_maps =
       shared ? isolate_->factory()->NewFixedArray(
-                   static_cast<int>(module_->types.size()))
+                   static_cast<int>(module_->types.size()),
+                   AllocationType::kSharedOld)
              : DirectHandle<FixedArray>();
   for (uint32_t index = 0; index < module_->types.size(); index++) {
-    bool type_is_shared = module_->types[index].is_shared;
+    bool map_is_shared = module_->types[index].is_shared;
     CreateMapForType(isolate_, module_, ModuleTypeIndex{index},
-                     type_is_shared ? shared_maps : non_shared_maps);
+                     map_is_shared ? shared_maps : non_shared_maps);
   }
   trusted_data->set_managed_object_maps(*non_shared_maps);
   if (shared) shared_trusted_data->set_managed_object_maps(*shared_maps);
@@ -1363,8 +1377,8 @@ MaybeDirectHandle<WasmTrustedInstanceData> InstanceBuilder::Build_Phase1(
     trusted_data->set_feedback_vectors(*vectors);
     if (shared) {
       DirectHandle<FixedArray> shared_vectors =
-          isolate_->factory()->NewFixedArrayWithZeroes(num_functions,
-                                                       AllocationType::kOld);
+          isolate_->factory()->NewFixedArrayWithZeroes(
+              num_functions, AllocationType::kSharedOld);
       shared_trusted_data->set_feedback_vectors(*shared_vectors);
     }
   }
@@ -1400,7 +1414,8 @@ MaybeDirectHandle<WasmTrustedInstanceData> InstanceBuilder::Build_Phase1(
         static_cast<int>(module_->elem_segments.size()));
     DirectHandle<FixedArray> shared_elements =
         shared ? isolate_->factory()->NewFixedArray(
-                     static_cast<int>(module_->elem_segments.size()))
+                     static_cast<int>(module_->elem_segments.size()),
+                     AllocationType::kSharedOld)
                : DirectHandle<FixedArray>();
     for (uint32_t i = 0; i < module_->elem_segments.size(); i++) {
       // Initialize declarative segments as empty. The rest remain
@@ -1889,14 +1904,20 @@ bool InstanceBuilder::ProcessImportedFunction(
   ImportedFunctionEntry imported_entry(trusted_instance_data, func_index);
   switch (kind) {
     case ImportCallKind::kRuntimeTypeError:
-      imported_entry.SetGenericWasmToJs(
-          isolate_, js_receiver, resolved.suspend(), expected_sig, sig_index);
+      if (v8_flags.wasm_generic_wrapper) {
+        imported_entry.SetGenericWasmToJs(
+            isolate_, js_receiver, resolved.suspend(), expected_sig, sig_index);
+        return true;
+      }
+      // Otherwise fall through to the generic handling below.
       break;
+
     case ImportCallKind::kLinkError:
       thrower_->LinkError(
           "%s: imported function does not match the expected type",
           ImportName(import_index).c_str());
       return false;
+
     case ImportCallKind::kWasmToWasm: {
       // The imported function is a Wasm function from another instance.
       auto function_data =
@@ -1914,8 +1935,9 @@ bool InstanceBuilder::ProcessImportedFunction(
                                    function_data->function_index()
 #endif  // V8_ENABLE_DRUMBRAKE
       );
-      break;
+      return true;
     }
+
     case ImportCallKind::kWasmToCapi: {
       int expected_arity = static_cast<int>(expected_sig->parameter_count());
       WasmImportWrapperCache* cache = GetWasmImportWrapperCache();
@@ -1946,8 +1968,9 @@ bool InstanceBuilder::ProcessImportedFunction(
       // callable to the wrapper, which we need to get the function data.
       imported_entry.SetCompiledWasmToJs(isolate_, js_receiver, wasm_code,
                                          kNoSuspend, expected_sig, sig_index);
-      break;
+      return true;
     }
+
     case ImportCallKind::kWasmToJSFastApi: {
       DCHECK(IsJSFunction(*js_receiver) || IsJSBoundFunction(*js_receiver));
       WasmCodeRefScope code_ref_scope;
@@ -1976,55 +1999,55 @@ bool InstanceBuilder::ProcessImportedFunction(
       wasm_code->MaybePrint();
       imported_entry.SetCompiledWasmToJs(isolate_, js_receiver, wasm_code,
                                          kNoSuspend, expected_sig, sig_index);
-      break;
+      return true;
     }
-    default: {
-      // The imported function is a callable.
-      if (UseGenericWasmToJSWrapper(kind, expected_sig, resolved.suspend())) {
-        DCHECK(kind == ImportCallKind::kJSFunctionArityMatch ||
-               kind == ImportCallKind::kJSFunctionArityMismatch);
-        imported_entry.SetGenericWasmToJs(
-            isolate_, js_receiver, resolved.suspend(), expected_sig, sig_index);
-        break;
-      }
-      if (v8_flags.wasm_jitless) {
-        WasmCode* no_code = nullptr;
-        imported_entry.SetCompiledWasmToJs(isolate_, js_receiver, no_code,
-                                           resolved.suspend(), expected_sig,
-                                           sig_index);
-        break;
-      }
-      int expected_arity = static_cast<int>(expected_sig->parameter_count());
-      if (kind == ImportCallKind::kJSFunctionArityMismatch) {
-        auto function = Cast<JSFunction>(js_receiver);
-        Tagged<SharedFunctionInfo> shared = function->shared();
-        expected_arity =
-            shared->internal_formal_parameter_count_without_receiver();
-      }
 
-      WasmImportWrapperCache* cache = GetWasmImportWrapperCache();
-      WasmCodeRefScope code_ref_scope;
-      WasmCode* wasm_code =
-          cache->MaybeGet(kind, sig_index, expected_arity, resolved.suspend());
-      if (!wasm_code) {
-        // This should be a very rare fallback case. We expect that the
-        // generic wrapper will be used (see above).
-        bool source_positions =
-            is_asmjs_module(trusted_instance_data->module());
-        wasm_code = cache->CompileWasmImportCallWrapper(
-            isolate_, kind, expected_sig, sig_index, source_positions,
-            expected_arity, resolved.suspend());
-      }
-
-      DCHECK_NOT_NULL(wasm_code);
-      CHECK_EQ(wasm_code->kind(), WasmCode::kWasmToJsWrapper);
-      // Wasm to JS wrappers are treated specially in the import table.
-      imported_entry.SetCompiledWasmToJs(isolate_, js_receiver, wasm_code,
-                                         resolved.suspend(), expected_sig,
-                                         sig_index);
+    default:
       break;
-    }
   }
+
+  if (UseGenericWasmToJSWrapper(kind, expected_sig, resolved.suspend())) {
+    DCHECK(kind == ImportCallKind::kJSFunctionArityMatch ||
+           kind == ImportCallKind::kJSFunctionArityMismatch);
+    imported_entry.SetGenericWasmToJs(isolate_, js_receiver, resolved.suspend(),
+                                      expected_sig, sig_index);
+    return true;
+  }
+
+  if (v8_flags.wasm_jitless) {
+    WasmCode* no_code = nullptr;
+    imported_entry.SetCompiledWasmToJs(isolate_, js_receiver, no_code,
+                                       resolved.suspend(), expected_sig,
+                                       sig_index);
+    return true;
+  }
+
+  int expected_arity = static_cast<int>(expected_sig->parameter_count());
+  if (kind == ImportCallKind::kJSFunctionArityMismatch) {
+    auto function = Cast<JSFunction>(js_receiver);
+    Tagged<SharedFunctionInfo> shared = function->shared();
+    expected_arity = shared->internal_formal_parameter_count_without_receiver();
+  }
+
+  WasmImportWrapperCache* cache = GetWasmImportWrapperCache();
+  WasmCodeRefScope code_ref_scope;
+  WasmCode* wasm_code =
+      cache->MaybeGet(kind, sig_index, expected_arity, resolved.suspend());
+  if (!wasm_code) {
+    // This should be a very rare fallback case. We expect that the
+    // generic wrapper will be used (see above).
+    bool source_positions = is_asmjs_module(trusted_instance_data->module());
+    wasm_code = cache->CompileWasmImportCallWrapper(
+        isolate_, kind, expected_sig, sig_index, source_positions,
+        expected_arity, resolved.suspend());
+  }
+
+  DCHECK_NOT_NULL(wasm_code);
+  CHECK_EQ(wasm_code->kind(), WasmCode::kWasmToJsWrapper);
+  // Wasm to JS wrappers are treated specially in the import table.
+  imported_entry.SetCompiledWasmToJs(isolate_, js_receiver, wasm_code,
+                                     resolved.suspend(), expected_sig,
+                                     sig_index);
   return true;
 }
 
@@ -2719,7 +2742,7 @@ void InstanceBuilder::ProcessExports(
     uint32_t index;
     if (V8_UNLIKELY(name->AsArrayIndex(&index))) {
       // Add a data element.
-      JSObject::AddDataElement(exports_object, index, value,
+      JSObject::AddDataElement(isolate_, exports_object, index, value,
                                details.attributes());
     } else {
       // Add a property to the dictionary.
@@ -2857,9 +2880,11 @@ ValueOrError ConsumeElementSegmentEntry(
       break;
     }
     case kExprRefNull: {
+      WasmDetectedFeatures detected;
       auto [heap_type, length] =
           value_type_reader::read_heap_type<Decoder::FullValidationTag>(
-              &decoder, decoder.pc() + 1, WasmEnabledFeatures::All());
+              &decoder, decoder.pc() + 1, WasmEnabledFeatures::All(),
+              &detected);
       value_type_reader::Populate(&heap_type, module);
       if (V8_LIKELY(decoder.lookahead(1 + length, kExprEnd))) {
         decoder.consume_bytes(length + 2);
diff --git a/deps/v8/src/wasm/stacks.cc b/deps/v8/src/wasm/stacks.cc
index 7bb0c380e8a283..e876051aeb0778 100644
--- a/deps/v8/src/wasm/stacks.cc
+++ b/deps/v8/src/wasm/stacks.cc
@@ -130,9 +130,22 @@ Address StackMemory::Shrink() {
   return old_fp;
 }
 
+void StackMemory::ShrinkTo(Address stack_address) {
+  DCHECK_NOT_NULL(active_segment_);
+  while (active_segment_) {
+    if (stack_address <= active_segment_->base() &&
+        stack_address >= reinterpret_cast<Address>(active_segment_->limit_)) {
+      return;
+    }
+    Shrink();
+  }
+  UNREACHABLE();
+}
+
 void StackMemory::Reset() {
   active_segment_ = first_segment_;
   size_ = active_segment_->size_;
+  clear_stack_switch_info();
 }
 
 std::unique_ptr<StackMemory> StackPool::GetOrAllocate() {
diff --git a/deps/v8/src/wasm/stacks.h b/deps/v8/src/wasm/stacks.h
index 90bbf15900653c..b392d2c914fa7d 100644
--- a/deps/v8/src/wasm/stacks.h
+++ b/deps/v8/src/wasm/stacks.h
@@ -20,11 +20,14 @@ class Isolate;
 
 namespace v8::internal::wasm {
 
+class StackMemory;
+
 struct JumpBuffer {
   Address sp;
   Address fp;
   Address pc;
   void* stack_limit;
+  StackMemory* parent = nullptr;
   // We track the state below to prevent stack corruptions under the sandbox
   // security model.
   // Assuming that the external pointer to the jump buffer has been corrupted
@@ -44,22 +47,8 @@ struct JumpBuffer {
     Retired     // A finished stack. The jump buffer is invalid in that state.
   };
   StackState state;
-#if V8_ENABLE_SANDBOX
-  // Store a pointer to the parent jump buffer here, so that we can validate
-  // that it matches the continuation's parent when we return/suspend.
-  JumpBuffer* caller;
-#endif
 };
 
-constexpr int kJmpBufSpOffset = offsetof(JumpBuffer, sp);
-constexpr int kJmpBufFpOffset = offsetof(JumpBuffer, fp);
-constexpr int kJmpBufPcOffset = offsetof(JumpBuffer, pc);
-constexpr int kJmpBufStackLimitOffset = offsetof(JumpBuffer, stack_limit);
-constexpr int kJmpBufStateOffset = offsetof(JumpBuffer, state);
-#if V8_ENABLE_SANDBOX
-constexpr int kJmpBufCaller = offsetof(JumpBuffer, caller);
-#endif
-
 class StackMemory {
  public:
   static std::unique_ptr<StackMemory> New() {
@@ -127,6 +116,7 @@ class StackMemory {
   Address old_fp() { return active_segment_->old_fp; }
   bool Grow(Address current_fp);
   Address Shrink();
+  void ShrinkTo(Address stack_address);
   void Reset();
 
   class StackSegment {
@@ -209,6 +199,19 @@ class StackMemory {
   StackSegment* active_segment_ = nullptr;
 };
 
+constexpr int kStackSpOffset =
+    wasm::StackMemory::jmpbuf_offset() + offsetof(JumpBuffer, sp);
+constexpr int kStackFpOffset =
+    wasm::StackMemory::jmpbuf_offset() + offsetof(JumpBuffer, fp);
+constexpr int kStackPcOffset =
+    wasm::StackMemory::jmpbuf_offset() + offsetof(JumpBuffer, pc);
+constexpr int kStackLimitOffset =
+    wasm::StackMemory::jmpbuf_offset() + offsetof(JumpBuffer, stack_limit);
+constexpr int kStackParentOffset =
+    wasm::StackMemory::jmpbuf_offset() + offsetof(JumpBuffer, parent);
+constexpr int kStackStateOffset =
+    wasm::StackMemory::jmpbuf_offset() + offsetof(JumpBuffer, state);
+
 // A pool of "finished" stacks, i.e. stacks whose last frame have returned and
 // whose memory can be reused for new suspendable computations.
 class StackPool {
diff --git a/deps/v8/src/wasm/struct-types.h b/deps/v8/src/wasm/struct-types.h
index fed0ca09ccd69e..73f7e72e8fab1d 100644
--- a/deps/v8/src/wasm/struct-types.h
+++ b/deps/v8/src/wasm/struct-types.h
@@ -122,6 +122,14 @@ class StructTypeBase : public ZoneObject {
 #endif
   }
 
+  // Determines whether the static type meets the prerequisites for testing
+  // whether the first field's runtime value is a DescriptorOptions object.
+  bool first_field_can_be_prototype() const {
+    return v8_flags.wasm_explicit_prototypes && is_descriptor_ &&
+           field_count_ > 0 && !mutabilities_[0] &&
+           reps_[0].is_reference_to(GenericKind::kExtern);
+  }
+
   // For incrementally building StructTypes.
   template <class Subclass, class ValueTypeSubclass>
   class BuilderImpl {
diff --git a/deps/v8/src/wasm/turboshaft-graph-interface.cc b/deps/v8/src/wasm/turboshaft-graph-interface.cc
index 0227104c8a7d89..1d2b82915a4a7e 100644
--- a/deps/v8/src/wasm/turboshaft-graph-interface.cc
+++ b/deps/v8/src/wasm/turboshaft-graph-interface.cc
@@ -151,8 +151,8 @@ OpIndex WasmGraphBuilderBase::CallRuntime(
   const Runtime::Function* fun = Runtime::FunctionForId(f);
   OpIndex isolate_root = __ LoadRootRegister();
   DCHECK_EQ(1, fun->result_size);
-  int builtin_slot_offset = IsolateData::BuiltinSlotOffset(
-      Builtin::kCEntry_Return1_ArgvOnStack_NoBuiltinExit);
+  int builtin_slot_offset =
+      IsolateData::BuiltinSlotOffset(Builtin::kWasmCEntry);
   OpIndex centry_stub =
       __ Load(isolate_root, LoadOp::Kind::RawAligned(),
               MemoryRepresentation::UintPtr(), builtin_slot_offset);
@@ -290,16 +290,6 @@ RegisterRepresentation WasmGraphBuilderBase::RepresentationFor(
   }
 }
 
-// Load the trusted data from a WasmInstanceObject.
-V<WasmTrustedInstanceData>
-WasmGraphBuilderBase::LoadTrustedDataFromInstanceObject(
-    V<HeapObject> instance_object) {
-  return V<WasmTrustedInstanceData>::Cast(__ LoadTrustedPointerField(
-      instance_object, LoadOp::Kind::TaggedBase().Immutable(),
-      kWasmTrustedInstanceDataIndirectPointerTag,
-      WasmInstanceObject::kTrustedDataOffset));
-}
-
 void WasmGraphBuilderBase::BuildModifyThreadInWasmFlagHelper(
     Zone* zone, OpIndex thread_in_wasm_flag_address, bool new_value) {
   if (v8_flags.debug_code) {
@@ -356,6 +346,99 @@ OpIndex WasmGraphBuilderBase::CallC(const MachineSignature* sig,
                  ts_call_descriptor);
 }
 
+void WasmGraphBuilderBase::BuildSetNewStackLimit(V<WordPtr> old_limit,
+                                                 V<WordPtr> new_limit) {
+  // Set the new interrupt limit and real limit. Use a compare-and-swap for
+  // the interrupt limit to avoid overwriting a pending interrupt.
+  __ AtomicCompareExchange(
+      __ IsolateField(IsolateFieldId::kJsLimitAddress), __ UintPtrConstant(0),
+      old_limit, new_limit, RegisterRepresentation::WordPtr(),
+      MemoryRepresentation::UintPtr(), compiler::MemoryAccessKind::kNormal);
+  __ Store(__ LoadRootRegister(), new_limit, StoreOp::Kind::RawAligned(),
+           MemoryRepresentation::UintPtr(), compiler::kNoWriteBarrier,
+           IsolateData::real_jslimit_offset());
+}
+
+V<WordPtr> WasmGraphBuilderBase::BuildSwitchToTheCentralStack(
+    V<WordPtr> old_limit) {
+  // Set the is_on_central_stack flag.
+  OpIndex isolate_root = __ LoadRootRegister();
+  __ Store(isolate_root, __ Word32Constant(1), LoadOp::Kind::RawAligned(),
+           MemoryRepresentation::Uint8(), compiler::kNoWriteBarrier,
+           IsolateData::is_on_central_stack_flag_offset());
+
+  // Save the old fp and the target sp in the StackMemory's stack switch info.
+  // We are not on the main stack, so the active stack must be set.
+  V<WordPtr> active_stack = __ Load(isolate_root, LoadOp::Kind::RawAligned(),
+                                    MemoryRepresentation::UintPtr(),
+                                    IsolateData::active_stack_offset());
+  __ Store(active_stack, __ FramePointer(), StoreOp::Kind::RawAligned(),
+           MemoryRepresentation::UintPtr(), compiler::kNoWriteBarrier,
+           StackMemory::stack_switch_source_fp_offset());
+  V<WordPtr> central_stack_sp = __ Load(
+      isolate_root, LoadOp::Kind::RawAligned(), MemoryRepresentation::UintPtr(),
+      Isolate::central_stack_sp_offset());
+  __ Store(active_stack, central_stack_sp, StoreOp::Kind::RawAligned(),
+           MemoryRepresentation::UintPtr(), compiler::kNoWriteBarrier,
+           StackMemory::stack_switch_target_sp_offset());
+
+  // Switch the stack limit and the stack pointer.
+  V<WordPtr> central_stack_limit = __ Load(
+      isolate_root, LoadOp::Kind::RawAligned(), MemoryRepresentation::UintPtr(),
+      Isolate::central_stack_limit_offset());
+  BuildSetNewStackLimit(old_limit, central_stack_limit);
+  OpIndex old_sp = __ LoadStackPointer();
+  __ SetStackPointer(central_stack_sp);
+  return old_sp;
+}
+
+// Returns the old (secondary stack's) sp and stack limit.
+std::pair<V<WordPtr>, V<WordPtr>>
+WasmGraphBuilderBase::BuildSwitchToTheCentralStackIfNeeded() {
+  V<WordPtr> isolate_root = __ LoadRootRegister();
+  V<Word32> is_on_central_stack_flag = __ Load(
+      isolate_root, LoadOp::Kind::RawAligned(), MemoryRepresentation::Uint8(),
+      IsolateData::is_on_central_stack_flag_offset());
+  ScopedVar<WordPtr> old_sp_var(this, __ IntPtrConstant(0));
+  ScopedVar<WordPtr> old_limit_var(this, __ IntPtrConstant(0));
+  IF_NOT (LIKELY(is_on_central_stack_flag)) {
+    V<WordPtr> old_limit = __ Load(isolate_root, LoadOp::Kind::RawAligned(),
+                                   MemoryRepresentation::UintPtr(),
+                                   IsolateData::real_jslimit_offset());
+    V<WordPtr> old_sp = BuildSwitchToTheCentralStack(old_limit);
+    old_sp_var = old_sp;
+    old_limit_var = old_limit;
+  }
+  return {old_sp_var, old_limit_var};
+}
+
+void WasmGraphBuilderBase::BuildSwitchBackFromCentralStack(
+    V<WordPtr> old_sp, V<WordPtr> old_limit) {
+  IF_NOT (LIKELY(__ WordPtrEqual(old_sp, __ IntPtrConstant(0)))) {
+    // Reset is_on_central_stack flag.
+    V<WordPtr> isolate_root = __ LoadRootRegister();
+    __ Store(isolate_root, __ Word32Constant(0), StoreOp::Kind::RawAligned(),
+             MemoryRepresentation::Uint8(), compiler::kNoWriteBarrier,
+             IsolateData::is_on_central_stack_flag_offset());
+
+    // Clear stack switch info.
+    // We are not on the main stack, so the active stack must be set.
+    V<WordPtr> active_stack = __ Load(isolate_root, LoadOp::Kind::RawAligned(),
+                                      MemoryRepresentation::UintPtr(),
+                                      IsolateData::active_stack_offset());
+    __ Store(active_stack, __ UintPtrConstant(0), StoreOp::Kind::RawAligned(),
+             MemoryRepresentation::UintPtr(), compiler::kNoWriteBarrier,
+             StackMemory::stack_switch_source_fp_offset());
+
+    // Restore the old stack limit and stack pointer.
+    V<WordPtr> real_jslimit = __ Load(isolate_root, LoadOp::Kind::RawAligned(),
+                                      MemoryRepresentation::UintPtr(),
+                                      IsolateData::real_jslimit_offset());
+    BuildSetNewStackLimit(real_jslimit, old_limit);
+    __ SetStackPointer(old_sp);
+  }
+}
+
 class TurboshaftGraphBuildingInterface : public WasmGraphBuilderBase {
  private:
   class BlockPhis;
@@ -1571,12 +1654,14 @@ class TurboshaftGraphBuildingInterface : public WasmGraphBuilderBase {
     MemoryRepresentation repr =
         MemoryRepresentation::FromMachineRepresentation(type.mem_rep());
 
+    compiler::EnforceBoundsCheck enforce_bounds_check =
+        (wasm::kPartialOOBWritesAreNoops || type.size() == 1)
+            ? compiler::EnforceBoundsCheck::kCanOmitBoundsCheck
+            : compiler::EnforceBoundsCheck::kNeedsBoundsCheck;
+
     auto [final_index, strategy] =
         BoundsCheckMem(imm.memory, repr, index.op, imm.offset,
-                       wasm::kPartialOOBWritesAreNoops
-                           ? compiler::EnforceBoundsCheck::kCanOmitBoundsCheck
-                           : compiler::EnforceBoundsCheck::kNeedsBoundsCheck,
-                       compiler::AlignmentCheck::kNo);
+                       enforce_bounds_check, compiler::AlignmentCheck::kNo);
 
     V<WordPtr> mem_start = MemStart(imm.memory->index);
 
@@ -1619,12 +1704,14 @@ class TurboshaftGraphBuildingInterface : public WasmGraphBuilderBase {
     MemoryRepresentation repr =
         MemoryRepresentation::FromMachineRepresentation(type.mem_rep());
 
+    compiler::EnforceBoundsCheck enforce_bounds_check =
+        (wasm::kPartialOOBWritesAreNoops || type.size() == 1)
+            ? compiler::EnforceBoundsCheck::kCanOmitBoundsCheck
+            : compiler::EnforceBoundsCheck::kNeedsBoundsCheck;
+
     auto [final_index, strategy] =
         BoundsCheckMem(imm.memory, repr, index.op, imm.offset,
-                       kPartialOOBWritesAreNoops
-                           ? compiler::EnforceBoundsCheck::kCanOmitBoundsCheck
-                           : compiler::EnforceBoundsCheck::kNeedsBoundsCheck,
-                       compiler::AlignmentCheck::kNo);
+                       enforce_bounds_check, compiler::AlignmentCheck::kNo);
     Simd128LaneMemoryOp::Kind kind = GetMemoryAccessKind(repr, strategy);
 
     Simd128LaneMemoryOp::LaneKind lane_kind;
@@ -1737,7 +1824,7 @@ class TurboshaftGraphBuildingInterface : public WasmGraphBuilderBase {
     BuildModifyThreadInWasmFlag(decoder->zone(), false);
 
     V<Smi> result_value =
-        CallBuiltinThroughJumptable<BuiltinCallDescriptor::StringIndexOf>(
+        CallBuiltinThroughJumptable<BuiltinCallDescriptor::WasmStringIndexOf>(
             decoder, {string, search, start_smi});
     BuildModifyThreadInWasmFlag(decoder->zone(), true);
 
@@ -1748,7 +1835,7 @@ class TurboshaftGraphBuildingInterface : public WasmGraphBuilderBase {
   V<String> CallStringToLowercase(FullDecoder* decoder, V<String> string) {
     BuildModifyThreadInWasmFlag(decoder->zone(), false);
     OpIndex result = CallBuiltinThroughJumptable<
-        BuiltinCallDescriptor::StringToLowerCaseIntl>(
+        BuiltinCallDescriptor::WasmStringToLowerCaseIntl>(
         decoder, __ NoContextConstant(), {string});
     BuildModifyThreadInWasmFlag(decoder->zone(), true);
     return result;
@@ -2163,8 +2250,10 @@ class TurboshaftGraphBuildingInterface : public WasmGraphBuilderBase {
              StoreOp::Kind::RawAligned(), MemoryRepresentation::UintPtr(),
              compiler::kNoWriteBarrier, Isolate::context_offset());
     BuildModifyThreadInWasmFlag(__ graph_zone(), false);
+    auto [old_sp, old_limit] = BuildSwitchToTheCentralStackIfNeeded();
     OpIndex ret_val = __ Call(target_address, OpIndex::Invalid(),
                               base::VectorOf(inputs), ts_call_descriptor);
+    BuildSwitchBackFromCentralStack(old_sp, old_limit);
 
 #if DEBUG
     // Reset the context again after the call, to make sure nobody is using the
@@ -2269,9 +2358,9 @@ class TurboshaftGraphBuildingInterface : public WasmGraphBuilderBase {
       case WKI::kStringCompare: {
         V<String> a_string = ExternRefToString(args[0]);
         V<String> b_string = ExternRefToString(args[1]);
-        result = __ UntagSmi(
-            CallBuiltinThroughJumptable<BuiltinCallDescriptor::StringCompare>(
-                decoder, {a_string, b_string}));
+        result = __ UntagSmi(CallBuiltinThroughJumptable<
+                             BuiltinCallDescriptor::WasmStringCompare>(
+            decoder, {a_string, b_string}));
         decoder->detected_->add_imported_strings();
         break;
       }
@@ -2280,7 +2369,7 @@ class TurboshaftGraphBuildingInterface : public WasmGraphBuilderBase {
         V<String> tail_string = ExternRefToString(args[1]);
         V<HeapObject> native_context = instance_cache_.native_context();
         V<String> result_value = CallBuiltinThroughJumptable<
-            BuiltinCallDescriptor::StringAdd_CheckNone>(
+            BuiltinCallDescriptor::WasmStringAdd_CheckNone>(
             decoder, V<Context>::Cast(native_context),
             {head_string, tail_string});
         result = __ AnnotateWasmType(result_value, kWasmRefExternString);
@@ -3912,6 +4001,42 @@ class TurboshaftGraphBuildingInterface : public WasmGraphBuilderBase {
     ThrowRef(decoder, value->op);
   }
 
+  void ContNew(FullDecoder* decoder, const ContIndexImmediate& imm,
+               const Value& func_ref, Value* result) {
+    UNIMPLEMENTED();
+  }
+
+  void ContBind(FullDecoder* decoder, const ContIndexImmediate& orig_imm,
+                Value input_cont, const Value args[],
+                const ContIndexImmediate& new_imm, Value* result) {
+    UNIMPLEMENTED();
+  }
+
+  void Resume(FullDecoder* decoder, const ContIndexImmediate& imm,
+              base::Vector<HandlerCase> handlers, const Value args[],
+              const Value returns[]) {
+    UNIMPLEMENTED();
+  }
+
+  void ResumeThrow(FullDecoder* decoder,
+                   const wasm::ContIndexImmediate& cont_imm,
+                   const TagIndexImmediate& exc_imm,
+                   base::Vector<wasm::HandlerCase> handlers, const Value args[],
+                   const Value returns[]) {
+    UNIMPLEMENTED();
+  }
+
+  void Switch(FullDecoder* decoder, const TagIndexImmediate& tag_imm,
+              const ContIndexImmediate& con_imm, const Value& cont_ref,
+              const Value args[], Value returns[]) {
+    UNIMPLEMENTED();
+  }
+
+  void Suspend(FullDecoder* decoder, const TagIndexImmediate& imm,
+               const Value args[], const Value returns[]) {
+    UNIMPLEMENTED();
+  }
+
   void AtomicNotify(FullDecoder* decoder, const MemoryAccessImmediate& imm,
                     OpIndex index, OpIndex num_waiters_to_wake, Value* result) {
     V<WordPtr> converted_index;
@@ -4458,7 +4583,8 @@ class TurboshaftGraphBuildingInterface : public WasmGraphBuilderBase {
     for (uint32_t i = 0; i < field_count; ++i) {
       args_vector[i] = args[i].op;
     }
-    result->op = StructNewImpl(decoder, imm, descriptor, args_vector.data());
+    result->op =
+        StructNewImpl(decoder, imm, descriptor, args_vector.data(), true);
   }
 
   void StructNewDefault(FullDecoder* decoder, const StructIndexImmediate& imm,
@@ -4469,7 +4595,7 @@ class TurboshaftGraphBuildingInterface : public WasmGraphBuilderBase {
       ValueType field_type = imm.struct_type->field(i);
       args[i] = DefaultValue(field_type);
     }
-    result->op = StructNewImpl(decoder, imm, descriptor, args.data());
+    result->op = StructNewImpl(decoder, imm, descriptor, args.data(), false);
   }
 
   void StructGet(FullDecoder* decoder, const Value& struct_object,
@@ -4650,7 +4776,7 @@ class TurboshaftGraphBuildingInterface : public WasmGraphBuilderBase {
     // Initialize the array header.
     bool shared = decoder->module_->type(array_imm.index).is_shared;
     V<Map> rtt = __ RttCanon(managed_object_maps(shared), array_imm.index);
-    V<WasmArray> array = __ WasmAllocateArray(rtt, element_count, type);
+    V<WasmArray> array = __ WasmAllocateArray(rtt, element_count, type, shared);
     // Initialize all elements.
     for (int i = 0; i < element_count; i++) {
       __ ArraySet(array, __ Word32Constant(i), elements[i].op, element_type);
@@ -4858,6 +4984,19 @@ class TurboshaftGraphBuildingInterface : public WasmGraphBuilderBase {
                         null_succeeds);
   }
 
+  void BrOnCastDesc(FullDecoder* decoder, HeapType target_type,
+                    const Value& object, const Value& descriptor,
+                    Value* value_on_branch, uint32_t br_depth,
+                    bool null_succeeds) {
+    ValueType target = ValueType::RefMaybeNull(
+        target_type, null_succeeds ? kNullable : kNonNullable);
+    V<Map> rtt = GetRttFromDescriptor(descriptor);
+    compiler::WasmTypeCheckConfig config{object.type, target,
+                                         compiler::kExactMatchOnly};
+    return BrOnCastImpl(decoder, rtt, config, object, value_on_branch, br_depth,
+                        null_succeeds);
+  }
+
   void BrOnCastAbstract(FullDecoder* decoder, const Value& object,
                         HeapType type, Value* value_on_branch,
                         uint32_t br_depth, bool null_succeeds) {
@@ -4882,6 +5021,19 @@ class TurboshaftGraphBuildingInterface : public WasmGraphBuilderBase {
                             br_depth, null_succeeds);
   }
 
+  void BrOnCastDescFail(FullDecoder* decoder, HeapType target_type,
+                        const Value& object, const Value& descriptor,
+                        Value* value_on_fallthrough, uint32_t br_depth,
+                        bool null_succeeds) {
+    ValueType target = ValueType::RefMaybeNull(
+        target_type, null_succeeds ? kNullable : kNonNullable);
+    V<Map> rtt = GetRttFromDescriptor(descriptor);
+    compiler::WasmTypeCheckConfig config{object.type, target,
+                                         compiler::kExactMatchOnly};
+    return BrOnCastFailImpl(decoder, rtt, config, object, value_on_fallthrough,
+                            br_depth, null_succeeds);
+  }
+
   void BrOnCastFailAbstract(FullDecoder* decoder, const Value& object,
                             HeapType type, Value* value_on_fallthrough,
                             uint32_t br_depth, bool null_succeeds) {
@@ -5103,11 +5255,10 @@ class TurboshaftGraphBuildingInterface : public WasmGraphBuilderBase {
   void StringConcat(FullDecoder* decoder, const Value& head, const Value& tail,
                     Value* result) {
     V<NativeContext> native_context = instance_cache_.native_context();
-    V<String> result_value =
-        CallBuiltinThroughJumptable<BuiltinCallDescriptor::StringAdd_CheckNone>(
-            decoder, native_context,
-            {V<String>::Cast(NullCheck(head)),
-             V<String>::Cast(NullCheck(tail))});
+    V<String> result_value = CallBuiltinThroughJumptable<
+        BuiltinCallDescriptor::WasmStringAdd_CheckNone>(
+        decoder, native_context,
+        {V<String>::Cast(NullCheck(head)), V<String>::Cast(NullCheck(tail))});
     result->op = __ AnnotateWasmType(result_value, result->type);
   }
 
@@ -5136,7 +5287,7 @@ class TurboshaftGraphBuildingInterface : public WasmGraphBuilderBase {
 
     V<WordPtr> length = __ ChangeInt32ToIntPtr(a_length);
     V<Boolean> result =
-        CallBuiltinByPointer<BuiltinCallDescriptor::StringEqual>(
+        CallBuiltinByPointer<BuiltinCallDescriptor::WasmJSStringEqual>(
             decoder, {a, b, length});
 
     GOTO(done, __ IsRootConstant(result, RootIndex::kTrueValue));
@@ -5407,7 +5558,7 @@ class TurboshaftGraphBuildingInterface : public WasmGraphBuilderBase {
     V<String> lhs_val = V<String>::Cast(NullCheck(lhs));
     V<String> rhs_val = V<String>::Cast(NullCheck(rhs));
     result->op = __ UntagSmi(
-        CallBuiltinThroughJumptable<BuiltinCallDescriptor::StringCompare>(
+        CallBuiltinThroughJumptable<BuiltinCallDescriptor::WasmStringCompare>(
             decoder, {lhs_val, rhs_val}));
   }
 
@@ -8050,7 +8201,7 @@ class TurboshaftGraphBuildingInterface : public WasmGraphBuilderBase {
     // Initialize the array header.
     bool shared = decoder->module_->type(index).is_shared;
     V<Map> rtt = __ RttCanon(managed_object_maps(shared), index);
-    V<WasmArray> array = __ WasmAllocateArray(rtt, length, array_type);
+    V<WasmArray> array = __ WasmAllocateArray(rtt, length, array_type, shared);
     // Initialize the elements.
     ArrayFillImpl(array, __ Word32Constant(0), initial_value, length,
                   array_type, false);
@@ -8083,7 +8234,8 @@ class TurboshaftGraphBuildingInterface : public WasmGraphBuilderBase {
 
   V<WasmStruct> StructNewImpl(FullDecoder* decoder,
                               const StructIndexImmediate& imm,
-                              const Value& descriptor, OpIndex args[]) {
+                              const Value& descriptor, OpIndex args[],
+                              bool has_nondefault_args) {
     const TypeDefinition& type = decoder->module_->type(imm.index);
     DCHECK_EQ(type.has_descriptor(), descriptor.op.valid());
     V<Map> rtt;
@@ -8095,11 +8247,18 @@ class TurboshaftGraphBuildingInterface : public WasmGraphBuilderBase {
 
     V<WasmStruct> struct_value;
     if (type.is_descriptor()) {
+      bool pass_potential_prototype =
+          has_nondefault_args &&
+          imm.struct_type->first_field_can_be_prototype();
+      V<Object> first_field =
+          pass_potential_prototype ? args[0] : __ SmiZeroConstant();
+
       struct_value = CallBuiltinThroughJumptable<
           BuiltinCallDescriptor::WasmAllocateDescriptorStruct>(
-          decoder, {rtt, __ Word32Constant(imm.index.index)});
+          decoder, {rtt, __ Word32Constant(imm.index.index), first_field});
     } else {
-      struct_value = __ WasmAllocateStruct(rtt, imm.struct_type);
+      const bool shared = type.is_shared;
+      struct_value = __ WasmAllocateStruct(rtt, imm.struct_type, shared);
     }
 
     for (uint32_t i = 0; i < imm.struct_type->field_count(); ++i) {
diff --git a/deps/v8/src/wasm/turboshaft-graph-interface.h b/deps/v8/src/wasm/turboshaft-graph-interface.h
index 3c4ce482c3d549..9a33a1d686ff7f 100644
--- a/deps/v8/src/wasm/turboshaft-graph-interface.h
+++ b/deps/v8/src/wasm/turboshaft-graph-interface.h
@@ -112,8 +112,6 @@ class V8_EXPORT_PRIVATE WasmGraphBuilderBase {
   BuildFunctionTargetAndImplicitArg(V<WasmInternalFunction> internal_function);
 
   RegisterRepresentation RepresentationFor(ValueTypeBase type);
-  V<WasmTrustedInstanceData> LoadTrustedDataFromInstanceObject(
-      V<HeapObject> instance_object);
 
   OpIndex CallC(const MachineSignature* sig, ExternalReference ref,
                 std::initializer_list<OpIndex> args);
@@ -124,6 +122,11 @@ class V8_EXPORT_PRIVATE WasmGraphBuilderBase {
     return CallC(sig, ref, {arg});
   }
 
+  void BuildSetNewStackLimit(V<WordPtr> old_limit, V<WordPtr> new_limit);
+  V<WordPtr> BuildSwitchToTheCentralStack(V<WordPtr> old_limit);
+  std::pair<V<WordPtr>, V<WordPtr>> BuildSwitchToTheCentralStackIfNeeded();
+  void BuildSwitchBackFromCentralStack(V<WordPtr> old_sp, V<WordPtr> old_limit);
+
   Assembler& Asm() { return asm_; }
 
   Zone* zone_;
diff --git a/deps/v8/src/wasm/value-type.h b/deps/v8/src/wasm/value-type.h
index 62d47481503715..8ef28100d5263f 100644
--- a/deps/v8/src/wasm/value-type.h
+++ b/deps/v8/src/wasm/value-type.h
@@ -341,6 +341,7 @@ class ValueTypeBase {
   static const uint32_t kIsRefBit = value_type_impl::IsRefField::kMask;
   static const uint32_t kIsNullableBit =
       value_type_impl::IsNullableField::kMask;
+  static const uint32_t kIsSharedBit = value_type_impl::IsSharedField::kMask;
   static const uint32_t kHasIndexBit =
       value_type_impl::HasIndexOrSentinelField::kMask;
   static const uint32_t kRefKindBits = value_type_impl::RefTypeKindField::kMask;
diff --git a/deps/v8/src/wasm/wasm-builtin-list.h b/deps/v8/src/wasm/wasm-builtin-list.h
index eff7f8ddd09438..65796bc43017e8 100644
--- a/deps/v8/src/wasm/wasm-builtin-list.h
+++ b/deps/v8/src/wasm/wasm-builtin-list.h
@@ -73,7 +73,7 @@ namespace v8::internal::wasm {
   V(ThrowDataViewOutOfBounds)                                                  \
   V(ThrowIndexOfCalledOnNull)                                                  \
   V(ThrowToLowerCaseCalledOnNull)                                              \
-  IF_INTL(V, StringToLowerCaseIntl)                                            \
+  IF_INTL(V, WasmStringToLowerCaseIntl)                                        \
   IF_TSAN(V, TSANRelaxedStore8IgnoreFP)                                        \
   IF_TSAN(V, TSANRelaxedStore8SaveFP)                                          \
   IF_TSAN(V, TSANRelaxedStore16IgnoreFP)                                       \
@@ -95,10 +95,13 @@ namespace v8::internal::wasm {
   IF_TSAN(V, TSANRelaxedLoad64IgnoreFP)                                        \
   IF_TSAN(V, TSANRelaxedLoad64SaveFP)                                          \
   V(WasmAllocateArray_Uninitialized)                                           \
+  V(WasmAllocateSharedArray_Uninitialized)                                     \
   V(WasmArrayCopy)                                                             \
   V(WasmArrayNewSegment)                                                       \
   V(WasmArrayInitSegment)                                                      \
   V(WasmAllocateStructWithRtt)                                                 \
+  V(WasmAllocateDescriptorStruct)                                              \
+  V(WasmAllocateSharedStructWithRtt)                                           \
   V(WasmOnStackReplace)                                                        \
   V(WasmReject)                                                                \
   V(WasmStringNewWtf8)                                                         \
@@ -130,13 +133,13 @@ namespace v8::internal::wasm {
   V(WasmStringViewIterAdvance)                                                 \
   V(WasmStringViewIterRewind)                                                  \
   V(WasmStringViewIterSlice)                                                   \
-  V(StringCompare)                                                             \
-  V(StringIndexOf)                                                             \
+  V(WasmStringCompare)                                                         \
+  V(WasmStringIndexOf)                                                         \
   V(WasmStringFromCodePoint)                                                   \
   V(WasmStringHash)                                                            \
   V(WasmAnyConvertExtern)                                                      \
   V(WasmStringFromDataSegment)                                                 \
-  V(StringAdd_CheckNone)                                                       \
+  V(WasmStringAdd_CheckNone)                                                   \
   V(DebugPrintFloat64)                                                         \
   V(DebugPrintWordPtr)                                                         \
   V(WasmFastApiCallTypeCheckAndUpdateIC)                                       \
@@ -148,11 +151,10 @@ namespace v8::internal::wasm {
 // Other wasm builtins that are not called via the far jump table, but need the
 // {is_wasm} assembler option for proper stack-switching support.
 #define WASM_BUILTINS_WITHOUT_JUMP_TABLE_SLOT(V) \
-  V(IterableToFixedArrayForWasm)                 \
   V(WasmAllocateInYoungGeneration)               \
   V(WasmAllocateInOldGeneration)                 \
-  V(WasmAllocateZeroedFixedArray)                \
-  V(WasmSuspend)                                 \
+  V(WasmAllocateInSharedHeap)                    \
+  V(WasmJSStringEqual)                           \
   V(WasmToJsWrapperInvalidSig)                   \
   V(WasmTrap)                                    \
   V(WasmTrapHandlerThrowTrap)
diff --git a/deps/v8/src/wasm/wasm-code-manager.cc b/deps/v8/src/wasm/wasm-code-manager.cc
index 489a30d7aed57b..fa06d7ca16ade5 100644
--- a/deps/v8/src/wasm/wasm-code-manager.cc
+++ b/deps/v8/src/wasm/wasm-code-manager.cc
@@ -75,7 +75,7 @@ using trap_handler::ProtectedInstructionData;
 // Increase the limit if needed, but first check if the size increase is
 // justified.
 #ifndef V8_GC_MOLE
-static_assert(sizeof(WasmCode) <= 104);
+static_assert(sizeof(WasmCode) <= 112);
 #endif
 
 base::AddressRegion DisjointAllocationPool::Merge(
@@ -194,8 +194,17 @@ Address WasmCode::code_comments() const {
 }
 
 int WasmCode::code_comments_size() const {
-  DCHECK_GE(unpadded_binary_size_, code_comments_offset_);
-  return static_cast<int>(unpadded_binary_size_ - code_comments_offset_);
+  DCHECK_GE(jump_table_info_offset_, code_comments_offset_);
+  return static_cast<int>(jump_table_info_offset_ - code_comments_offset_);
+}
+
+Address WasmCode::jump_table_info() const {
+  return instruction_start() + jump_table_info_offset_;
+}
+
+int WasmCode::jump_table_info_size() const {
+  DCHECK_GE(unpadded_binary_size_, jump_table_info_offset_);
+  return static_cast<int>(unpadded_binary_size_ - jump_table_info_offset_);
 }
 
 std::unique_ptr<const uint8_t[]> WasmCode::ConcatenateBytes(
@@ -613,7 +622,7 @@ std::tuple<int, bool, SourcePosition> WasmCode::GetInliningPosition(
 }
 
 size_t WasmCode::EstimateCurrentMemoryConsumption() const {
-  UPDATE_WHEN_CLASS_CHANGES(WasmCode, 104);
+  UPDATE_WHEN_CLASS_CHANGES(WasmCode, 112);
   size_t result = sizeof(WasmCode);
   // For meta_data_.
   result += protected_instructions_size_ + reloc_info_size_ +
@@ -1059,6 +1068,8 @@ WasmCode* NativeModule::AddCodeForTesting(DirectHandle<Code> code,
   const int handler_table_offset = base_offset + code->handler_table_offset();
   const int constant_pool_offset = base_offset + code->constant_pool_offset();
   const int code_comments_offset = base_offset + code->code_comments_offset();
+  const int jump_table_info_offset =
+      base_offset + code->jump_table_info_offset();
 
   base::RecursiveMutexGuard guard{&allocation_mutex_};
   base::Vector<uint8_t> dst_code_bytes =
@@ -1120,6 +1131,7 @@ WasmCode* NativeModule::AddCodeForTesting(DirectHandle<Code> code,
                    handler_table_offset,     // handler_table_offset
                    constant_pool_offset,     // constant_pool_offset
                    code_comments_offset,     // code_comments_offset
+                   jump_table_info_offset,   // jump_table_info_offset
                    instructions.length(),    // unpadded_binary_size
                    {},                       // protected_instructions
                    reloc_info.as_vector(),   // reloc_info
@@ -1288,6 +1300,7 @@ std::unique_ptr<WasmCode> NativeModule::AddCodeWithCodeSpace(
   const int handler_table_offset = desc.handler_table_offset;
   const int constant_pool_offset = desc.constant_pool_offset;
   const int code_comments_offset = desc.code_comments_offset;
+  const int jump_table_info_offset = desc.jump_table_info_offset;
   const int instr_size = desc.instr_size;
 
   {
@@ -1353,6 +1366,7 @@ std::unique_ptr<WasmCode> NativeModule::AddCodeWithCodeSpace(
                                               handler_table_offset,
                                               constant_pool_offset,
                                               code_comments_offset,
+                                              jump_table_info_offset,
                                               instr_size,
                                               protected_instructions_data,
                                               reloc_info,
@@ -1572,7 +1586,8 @@ std::unique_ptr<WasmCode> NativeModule::AddDeserializedCode(
     int index, base::Vector<uint8_t> instructions, int stack_slots,
     int ool_spills, uint32_t tagged_parameter_slots, int safepoint_table_offset,
     int handler_table_offset, int constant_pool_offset,
-    int code_comments_offset, int unpadded_binary_size,
+    int code_comments_offset, int jump_table_info_offset,
+    int unpadded_binary_size,
     base::Vector<const uint8_t> protected_instructions_data,
     base::Vector<const uint8_t> reloc_info,
     base::Vector<const uint8_t> source_position_table,
@@ -1594,6 +1609,7 @@ std::unique_ptr<WasmCode> NativeModule::AddDeserializedCode(
                                                 handler_table_offset,
                                                 constant_pool_offset,
                                                 code_comments_offset,
+                                                jump_table_info_offset,
                                                 unpadded_binary_size,
                                                 protected_instructions_data,
                                                 reloc_info,
@@ -1708,6 +1724,7 @@ WasmCode* NativeModule::CreateEmptyJumpTableInRegionLocked(
                    jump_table_size,       // handler_table_offset
                    jump_table_size,       // constant_pool_offset
                    jump_table_size,       // code_comments_offset
+                   jump_table_size,       // jump_table_info_offset
                    jump_table_size,       // unpadded_binary_size
                    {},                    // protected_instructions
                    {},                    // reloc_info
@@ -2726,22 +2743,26 @@ std::pair<size_t, size_t> NativeModule::RemoveCompiledCode(
     RemoveFilter filter) {
   const uint32_t num_imports = module_->num_imported_functions;
   const uint32_t num_functions = module_->num_declared_functions;
-  base::RecursiveMutexGuard guard(&allocation_mutex_);
   size_t removed_codesize = 0;
   size_t removed_metadatasize = 0;
-  for (uint32_t i = 0; i < num_functions; i++) {
-    WasmCode* code = code_table_[i];
-    if (code && ShouldRemoveCode(code, filter)) {
-      removed_codesize += code->instructions_size();
-      removed_metadatasize += code->EstimateCurrentMemoryConsumption();
-      code_table_[i] = nullptr;
-      // Add the code to the {WasmCodeRefScope}, so the ref count cannot drop to
-      // zero here. It might in the {WasmCodeRefScope} destructor, though.
-      WasmCodeRefScope::AddRef(code);
-      code->DecRefOnLiveCode();
-      uint32_t func_index = i + num_imports;
-      UseLazyStubLocked(func_index);
+  {
+    base::RecursiveMutexGuard guard(&allocation_mutex_);
+    for (uint32_t i = 0; i < num_functions; i++) {
+      WasmCode* code = code_table_[i];
+      if (code && ShouldRemoveCode(code, filter)) {
+        removed_codesize += code->instructions_size();
+        removed_metadatasize += code->EstimateCurrentMemoryConsumption();
+        code_table_[i] = nullptr;
+        // Add the code to the {WasmCodeRefScope}, so the ref count cannot drop
+        // to zero here. It might in the {WasmCodeRefScope} destructor, though.
+        WasmCodeRefScope::AddRef(code);
+        code->DecRefOnLiveCode();
+        uint32_t func_index = i + num_imports;
+        UseLazyStubLocked(func_index);
+      }
     }
+    // To avoid lock order inversion, release the {allocation_mutex_} before
+    // acquiring the {type_feedback.mutex} inside {AllowAnother...} below.
   }
   // When resuming optimized execution after a debugging session ends, or when
   // discarding optimized code that made outdated assumptions, allow another
@@ -2776,6 +2797,10 @@ void NativeModule::FreeCode(base::Vector<WasmCode* const> codes) {
   // Free the {WasmCode} objects. This will also unregister trap handler data.
   for (WasmCode* code : codes) {
     DCHECK_EQ(1, owned_code_.count(code->instruction_start()));
+    // TODO(407003348): Drop this check if it doesn't trigger in the wild.
+    CHECK_EQ(WasmCode::refcount(
+                 code->ref_count_bitfield_.load(std::memory_order_acquire)),
+             0);
     owned_code_.erase(code->instruction_start());
   }
   // Remove debug side tables for all removed code objects, after releasing our
@@ -2995,6 +3020,16 @@ void WasmCodeRefScope::AddRef(WasmCode* code) {
   code->IncRef();
 }
 
+// static
+WasmCode* WasmCodeRefScope::AddRefIfNotDying(WasmCode* code) {
+  DCHECK_NOT_NULL(code);
+  WasmCodeRefScope* current_scope = current_code_refs_scope;
+  DCHECK_NOT_NULL(current_scope);
+  if (!code->IncRefIfNotDying()) return nullptr;
+  current_scope->code_ptrs_.push_back(code);
+  return code;
+}
+
 void WasmCodeLookupCache::Flush() {
   for (int i = 0; i < kWasmCodeLookupCacheSize; i++)
     cache_[i].pc.store(kNullAddress, std::memory_order_release);
diff --git a/deps/v8/src/wasm/wasm-code-manager.h b/deps/v8/src/wasm/wasm-code-manager.h
index 49258f516d2251..9ec2f061c506de 100644
--- a/deps/v8/src/wasm/wasm-code-manager.h
+++ b/deps/v8/src/wasm/wasm-code-manager.h
@@ -203,10 +203,14 @@ class V8_EXPORT_PRIVATE WasmCode final {
   int handler_table_size() const;
   Address code_comments() const;
   int code_comments_size() const;
+  Address jump_table_info() const;
+  int jump_table_info_size() const;
+  bool has_jump_table_info() const { return jump_table_info_size() > 0; }
   int constant_pool_offset() const { return constant_pool_offset_; }
   int safepoint_table_offset() const { return safepoint_table_offset_; }
   int handler_table_offset() const { return handler_table_offset_; }
   int code_comments_offset() const { return code_comments_offset_; }
+  int jump_table_info_offset() const { return jump_table_info_offset_; }
   int unpadded_binary_size() const { return unpadded_binary_size_; }
   int stack_slots() const { return stack_slots_; }
   int ool_spills() const { return ool_spills_; }
@@ -261,40 +265,51 @@ class V8_EXPORT_PRIVATE WasmCode final {
   ~WasmCode();
 
   void IncRef() {
-    [[maybe_unused]] int old_val =
-        ref_count_.fetch_add(1, std::memory_order_acq_rel);
-    DCHECK_LE(1, old_val);
-    DCHECK_GT(kMaxInt, old_val);
+    [[maybe_unused]] uint32_t old_field =
+        ref_count_bitfield_.fetch_add(1, std::memory_order_acq_rel);
+    DCHECK_LE(1, refcount(old_field));
+    DCHECK_GT(kMaxInt, refcount(old_field));
+  }
+
+  // Returns true if the refcount was incremented, false if {this->is_dying()}.
+  bool IncRefIfNotDying() {
+    uint32_t old_field = ref_count_bitfield_.load(std::memory_order_acquire);
+    while (true) {
+      if (is_dying(old_field)) return false;
+      if (ref_count_bitfield_.compare_exchange_weak(
+              old_field, old_field + 1, std::memory_order_acq_rel)) {
+        return true;
+      }
+    }
   }
 
   // Decrement the ref count. Returns whether this code becomes dead and needs
   // to be freed.
   V8_WARN_UNUSED_RESULT bool DecRef() {
-    int old_count = ref_count_.load(std::memory_order_acquire);
+    uint32_t old_field = ref_count_bitfield_.load(std::memory_order_acquire);
     while (true) {
-      DCHECK_LE(1, old_count);
-      if (V8_UNLIKELY(old_count == 1)) {
-        if (is_dying()) {
+      DCHECK_LE(1, refcount(old_field));
+      if (V8_UNLIKELY(refcount(old_field) == 1)) {
+        if (is_dying(old_field)) {
           // The code was already on the path to deletion, only temporary
           // C++ references to it are left. Decrement the refcount, and
           // return true if it drops to zero.
           return DecRefOnDeadCode();
         }
         // Otherwise, the code enters the path to destruction now.
-        mark_as_dying();
-        old_count = ref_count_.load(std::memory_order_acquire);
-        if (V8_LIKELY(old_count == 1)) {
+        if (ref_count_bitfield_.compare_exchange_weak(
+                old_field, old_field | kIsDyingMask,
+                std::memory_order_acq_rel)) {
           // No other thread got in the way. Commit to the decision.
           DecRefOnPotentiallyDeadCode();
           return false;
         }
-        // Another thread managed to increment the refcount again, just
-        // before we set the "dying" bit. So undo that, and resume the
-        // loop to evaluate again what needs to be done.
-        undo_mark_as_dying();
+        // Another thread interfered. Re-evaluate what to do.
+        continue;
       }
-      if (ref_count_.compare_exchange_weak(old_count, old_count - 1,
-                                           std::memory_order_acq_rel)) {
+      DCHECK_LT(1, refcount(old_field));
+      if (ref_count_bitfield_.compare_exchange_weak(
+              old_field, old_field - 1, std::memory_order_acq_rel)) {
         return false;
       }
     }
@@ -303,16 +318,18 @@ class V8_EXPORT_PRIVATE WasmCode final {
   // Decrement the ref count on code that is known to be in use (i.e. the ref
   // count cannot drop to zero here).
   void DecRefOnLiveCode() {
-    [[maybe_unused]] int old_count =
-        ref_count_.fetch_sub(1, std::memory_order_acq_rel);
-    DCHECK_LE(2, old_count);
+    [[maybe_unused]] uint32_t old_bitfield_value =
+        ref_count_bitfield_.fetch_sub(1, std::memory_order_acq_rel);
+    DCHECK_LE(2, refcount(old_bitfield_value));
   }
 
   // Decrement the ref count on code that is known to be dead, even though there
   // might still be C++ references. Returns whether this drops the last
   // reference and the code needs to be freed.
   V8_WARN_UNUSED_RESULT bool DecRefOnDeadCode() {
-    return ref_count_.fetch_sub(1, std::memory_order_acq_rel) == 1;
+    uint32_t old_bitfield_value =
+        ref_count_bitfield_.fetch_sub(1, std::memory_order_acq_rel);
+    return refcount(old_bitfield_value) == 1;
   }
 
   // Decrement the ref count on a set of {WasmCode} objects, potentially
@@ -321,9 +338,9 @@ class V8_EXPORT_PRIVATE WasmCode final {
 
   // Called by the WasmEngine when it shuts down for code it thinks is
   // probably dead (i.e. is in the "potentially_dead_code_" set). Wrapped
-  // in a method only because {ref_count_} is private.
+  // in a method only because {ref_count_bitfield_} is private.
   void DcheckRefCountIsOne() {
-    DCHECK_EQ(1, ref_count_.load(std::memory_order_acquire));
+    DCHECK_EQ(1, refcount(ref_count_bitfield_.load(std::memory_order_acquire)));
   }
 
   // Returns the last source position before {offset}.
@@ -340,7 +357,15 @@ class V8_EXPORT_PRIVATE WasmCode final {
     return ForDebuggingField::decode(flags_);
   }
 
-  bool is_dying() const { return dying_.load(std::memory_order_acquire); }
+  bool is_dying() const {
+    return is_dying(ref_count_bitfield_.load(std::memory_order_acquire));
+  }
+  static bool is_dying(uint32_t bit_field_value) {
+    return (bit_field_value & kIsDyingMask) != 0;
+  }
+  static uint32_t refcount(uint32_t bit_field_value) {
+    return bit_field_value & ~kIsDyingMask;
+  }
 
   // Returns {true} for Liftoff code that sets up a feedback vector slot in its
   // stack frame.
@@ -365,7 +390,8 @@ class V8_EXPORT_PRIVATE WasmCode final {
            base::Vector<uint8_t> instructions, int stack_slots, int ool_spills,
            uint32_t tagged_parameter_slots, int safepoint_table_offset,
            int handler_table_offset, int constant_pool_offset,
-           int code_comments_offset, int unpadded_binary_size,
+           int code_comments_offset, int jump_table_info_offset,
+           int unpadded_binary_size,
            base::Vector<const uint8_t> protected_instructions_data,
            base::Vector<const uint8_t> reloc_info,
            base::Vector<const uint8_t> source_position_table,
@@ -393,6 +419,7 @@ class V8_EXPORT_PRIVATE WasmCode final {
         safepoint_table_offset_(safepoint_table_offset),
         handler_table_offset_(handler_table_offset),
         code_comments_offset_(code_comments_offset),
+        jump_table_info_offset_(jump_table_info_offset),
         unpadded_binary_size_(unpadded_binary_size),
         flags_(KindField::encode(kind) | ExecutionTierField::encode(tier) |
                ForDebuggingField::encode(for_debugging) |
@@ -401,6 +428,7 @@ class V8_EXPORT_PRIVATE WasmCode final {
     DCHECK_LE(handler_table_offset, unpadded_binary_size);
     DCHECK_LE(code_comments_offset, unpadded_binary_size);
     DCHECK_LE(constant_pool_offset, unpadded_binary_size);
+    DCHECK_LE(jump_table_info_offset, unpadded_binary_size);
   }
 
   std::unique_ptr<const uint8_t[]> ConcatenateBytes(
@@ -427,11 +455,6 @@ class V8_EXPORT_PRIVATE WasmCode final {
   // for consideration in the next Code GC cycle.
   V8_NOINLINE void DecRefOnPotentiallyDeadCode();
 
-  void mark_as_dying() { dying_.store(true, std::memory_order_release); }
-  // This is rarely necessary to mitigate a race condition. See the comment
-  // at its (only) call site.
-  void undo_mark_as_dying() { dying_.store(false, std::memory_order_release); }
-
   NativeModule* const native_module_ = nullptr;
   uint8_t* const instructions_;
   const uint64_t signature_hash_;
@@ -461,6 +484,7 @@ class V8_EXPORT_PRIVATE WasmCode final {
   const int safepoint_table_offset_;
   const int handler_table_offset_;
   const int code_comments_offset_;
+  const int jump_table_info_offset_;
   const int unpadded_binary_size_;
   int trap_handler_index_ = -1;
 
@@ -476,10 +500,6 @@ class V8_EXPORT_PRIVATE WasmCode final {
   using ForDebuggingField = ExecutionTierField::Next<ForDebugging, 2>;
   using FrameHasFeedbackSlotField = ForDebuggingField::Next<bool, 1>;
 
-  // Will be set to {true} the first time this code object is considered
-  // "potentially dead" (to be confirmed by the next Wasm Code GC cycle).
-  std::atomic<bool> dying_{false};
-
   // WasmCode is ref counted. Counters are held by:
   //   1) The jump table / code table.
   //   2) {WasmCodeRefScope}s.
@@ -490,7 +510,11 @@ class V8_EXPORT_PRIVATE WasmCode final {
   // it's being used. Once the ref count drops to zero (i.e. after being removed
   // from (3) and all (2)), the code object is deleted and the memory for the
   // machine code is freed.
-  std::atomic<int> ref_count_{1};
+  // The topmost bit is used to indicate that the code is in (3). It is stored
+  // in this same field to avoid race conditions between atomic updates to
+  // that state and the refcount.
+  static constexpr uint32_t kIsDyingMask = 0x8000'0000u;
+  std::atomic<uint32_t> ref_count_bitfield_{1};
 };
 
 WasmCode::Kind GetCodeKind(const WasmCompilationResult& result);
@@ -637,7 +661,7 @@ class V8_EXPORT_PRIVATE NativeModule final {
       int ool_spills, uint32_t tagged_parameter_slots,
       int safepoint_table_offset, int handler_table_offset,
       int constant_pool_offset, int code_comments_offset,
-      int unpadded_binary_size,
+      int jump_table_info_offset, int unpadded_binary_size,
       base::Vector<const uint8_t> protected_instructions_data,
       base::Vector<const uint8_t> reloc_info,
       base::Vector<const uint8_t> source_position_table,
@@ -1237,6 +1261,10 @@ class V8_EXPORT_PRIVATE V8_NODISCARD WasmCodeRefScope {
   // Register a {WasmCode} reference in the current {WasmCodeRefScope}. Fails if
   // there is no current scope.
   static void AddRef(WasmCode*);
+  // Same, but conditional:
+  // - if the {code} is marked as dying, do nothing, return nullptr.
+  // - otherwise add a ref and return {code}.
+  static WasmCode* AddRefIfNotDying(WasmCode* code);
 
  private:
   WasmCodeRefScope* const previous_scope_;
diff --git a/deps/v8/src/wasm/wasm-constants.h b/deps/v8/src/wasm/wasm-constants.h
index b8b8497c4fa2fc..be305009fcce1c 100644
--- a/deps/v8/src/wasm/wasm-constants.h
+++ b/deps/v8/src/wasm/wasm-constants.h
@@ -169,6 +169,12 @@ enum CatchKind : uint8_t {
   kLastCatchKind = kCatchAllRef,
 };
 
+enum SwitchKind : uint8_t {
+  kOnSuspend = 0x0,
+  kSwitch = 0x1,
+  kLastSwitchKind = kSwitch,
+};
+
 constexpr size_t kWasmPageSize = 0x10000;
 constexpr uint32_t kWasmPageSizeLog2 = 16;
 static_assert(kWasmPageSize == size_t{1} << kWasmPageSizeLog2, "consistency");
diff --git a/deps/v8/src/wasm/wasm-disassembler.cc b/deps/v8/src/wasm/wasm-disassembler.cc
index bfceb58485d493..127aab2d89b634 100644
--- a/deps/v8/src/wasm/wasm-disassembler.cc
+++ b/deps/v8/src/wasm/wasm-disassembler.cc
@@ -460,6 +460,27 @@ class ImmediatesPrinter {
     }
   }
 
+  void EffectHandlerTable(EffectHandlerTableImmediate& imm) {
+    const uint8_t* pc = imm.table;
+    for (uint32_t i = 0; i < imm.table_count; i++) {
+      uint8_t kind = owner_->read_u8<ValidationTag>(pc);
+      pc += 1;
+      auto [tag, length] = owner_->read_u32v<ValidationTag>(pc);
+      out_ << "(on ";
+      names()->PrintTagName(out_, tag);
+      out_ << " ";
+      pc += length;
+      if (kind == kOnSuspend) {
+        auto [target, tlen] = owner_->read_u32v<ValidationTag>(pc);
+        PrintDepthAsLabel(target);
+        pc += tlen;
+        out_ << ")";
+      } else {
+        out_ << " switch)";
+      }
+    }
+  }
+
   void CallIndirect(CallIndirectImmediate& imm) {
     PrintSignature(imm.sig_imm.index);
     if (imm.table_imm.index != 0) TableIndex(imm.table_imm);
diff --git a/deps/v8/src/wasm/wasm-engine.cc b/deps/v8/src/wasm/wasm-engine.cc
index 7724979eb01b11..9e93b58f38ff2e 100644
--- a/deps/v8/src/wasm/wasm-engine.cc
+++ b/deps/v8/src/wasm/wasm-engine.cc
@@ -1890,17 +1890,11 @@ void WasmEngine::FreeDeadCodeLocked(const DeadCodeMap& dead_code,
     const std::vector<WasmCode*>& code_vec = dead_code_entry.second;
     TRACE_CODE_GC("Freeing %zu code object%s of module %p.\n", code_vec.size(),
                   code_vec.size() == 1 ? "" : "s", native_module);
-#if DEBUG
-    for (WasmCode* code : code_vec) DCHECK(code->is_dying());
-#endif  // DEBUG
     native_module->FreeCode(base::VectorOf(code_vec));
   }
   if (dead_wrappers.size()) {
     TRACE_CODE_GC("Freeing %zu wrapper%s.\n", dead_wrappers.size(),
                   dead_wrappers.size() == 1 ? "" : "s");
-#if DEBUG
-    for (WasmCode* code : dead_wrappers) DCHECK(code->is_dying());
-#endif  // DEBUG
     GetWasmImportWrapperCache()->Free(dead_wrappers);
   }
 }
@@ -2029,7 +2023,7 @@ void WasmEngine::DecodeAllNameSections(CanonicalTypeNamesProvider* target) {
 }
 
 size_t WasmEngine::EstimateCurrentMemoryConsumption() const {
-  UPDATE_WHEN_CLASS_CHANGES(WasmEngine, 8408);
+  UPDATE_WHEN_CLASS_CHANGES(WasmEngine, 8424);
   UPDATE_WHEN_CLASS_CHANGES(IsolateInfo, 168);
   UPDATE_WHEN_CLASS_CHANGES(NativeModuleInfo, 56);
   UPDATE_WHEN_CLASS_CHANGES(CurrentGCInfo, 96);
diff --git a/deps/v8/src/wasm/wasm-external-refs.cc b/deps/v8/src/wasm/wasm-external-refs.cc
index 95f9952ef33064..6dc9ee08fd5538 100644
--- a/deps/v8/src/wasm/wasm-external-refs.cc
+++ b/deps/v8/src/wasm/wasm-external-refs.cc
@@ -10,7 +10,7 @@
 
 #include "src/base/bits.h"
 #include "src/base/ieee754.h"
-#include "src/base/safe_conversions.h"
+#include "src/base/numerics/safe_conversions.h"
 #include "src/common/assert-scope.h"
 #include "src/execution/pointer-authentication.h"
 #include "src/numbers/conversions.h"
@@ -983,25 +983,13 @@ double flat_string_to_f64(Address string_address) {
                             std::numeric_limits<double>::quiet_NaN());
 }
 
-void switch_stacks(Isolate* isolate, Address old_continuation) {
-  DisallowGarbageCollection no_gc;
-  Tagged<Object> active_continuation =
-      isolate->root(RootIndex::kActiveContinuation);
-  isolate->SwitchStacks(
-      Cast<WasmContinuationObject>(Tagged<Object>{old_continuation}),
-      Cast<WasmContinuationObject>(active_continuation));
+void switch_stacks(Isolate* isolate, wasm::StackMemory* from) {
+  isolate->SwitchStacks(from, isolate->isolate_data()->active_stack());
 }
 
-void return_switch(Isolate* isolate, Address raw_old_continuation) {
-  DisallowGarbageCollection no_gc;
-
-  Tagged<WasmContinuationObject> old_continuation =
-      Cast<WasmContinuationObject>(Tagged<Object>{raw_old_continuation});
-  Tagged<Object> active_continuation =
-      isolate->root(RootIndex::kActiveContinuation);
-  isolate->SwitchStacks(old_continuation,
-                        Cast<WasmContinuationObject>(active_continuation));
-  isolate->RetireWasmStack(old_continuation);
+void return_switch(Isolate* isolate, wasm::StackMemory* from) {
+  isolate->SwitchStacks(from, isolate->isolate_data()->active_stack());
+  isolate->RetireWasmStack(from);
 }
 
 intptr_t switch_to_the_central_stack(Isolate* isolate, uintptr_t current_sp) {
@@ -1038,11 +1026,9 @@ void switch_from_the_central_stack(Isolate* isolate) {
 }
 
 intptr_t switch_to_the_central_stack_for_js(Isolate* isolate, Address fp) {
-  auto active_continuation = Cast<WasmContinuationObject>(
-      isolate->root(RootIndex::kActiveContinuation));
   ThreadLocalTop* thread_local_top = isolate->thread_local_top();
   StackGuard* stack_guard = isolate->stack_guard();
-  auto* stack = reinterpret_cast<StackMemory*>(active_continuation->stack());
+  wasm::StackMemory* stack = isolate->isolate_data()->active_stack();
   Address central_stack_sp = thread_local_top->central_stack_sp_;
   stack->set_stack_switch_info(fp, central_stack_sp);
   stack_guard->SetStackLimitForStackSwitching(
@@ -1053,9 +1039,7 @@ intptr_t switch_to_the_central_stack_for_js(Isolate* isolate, Address fp) {
 
 void switch_from_the_central_stack_for_js(Isolate* isolate) {
   // The stack only contains wasm frames after this JS call.
-  auto active_continuation = Cast<WasmContinuationObject>(
-      isolate->root(RootIndex::kActiveContinuation));
-  auto* stack = reinterpret_cast<StackMemory*>(active_continuation->stack());
+  wasm::StackMemory* stack = isolate->isolate_data()->active_stack();
   stack->clear_stack_switch_info();
   ThreadLocalTop* thread_local_top = isolate->thread_local_top();
   thread_local_top->is_on_central_stack_flag_ = false;
@@ -1070,21 +1054,17 @@ Address grow_stack(Isolate* isolate, void* current_sp, size_t frame_size,
   // Check if this is a real stack overflow.
   StackLimitCheck check(isolate);
   if (check.WasmHasOverflowed(gap)) {
-    Tagged<WasmContinuationObject> current_continuation =
-        Cast<WasmContinuationObject>(
-            isolate->root(RootIndex::kActiveContinuation));
     // If there is no parent, then the current stack is the main isolate stack.
-    if (IsUndefined(current_continuation->parent())) {
+    wasm::StackMemory* active_stack = isolate->isolate_data()->active_stack();
+    if (active_stack->jmpbuf()->parent == nullptr) {
       return 0;
     }
-    auto stack =
-        reinterpret_cast<wasm::StackMemory*>(current_continuation->stack());
-    DCHECK(stack->IsActive());
-    if (!stack->Grow(current_fp)) {
+    DCHECK(active_stack->IsActive());
+    if (!active_stack->Grow(current_fp)) {
       return 0;
     }
 
-    Address new_sp = stack->base() - frame_size;
+    Address new_sp = active_stack->base() - frame_size;
     // Here we assume stack values don't refer other moved stack slots.
     // A stack grow event happens right in the beginning of the function
     // call so moved slots contain only incoming params and frame header.
@@ -1104,7 +1084,7 @@ Address grow_stack(Isolate* isolate, void* current_sp, size_t frame_size,
 #endif
 
     isolate->stack_guard()->SetStackLimitForStackSwitching(
-        reinterpret_cast<uintptr_t>(stack->jslimit()));
+        reinterpret_cast<uintptr_t>(active_stack->jslimit()));
     return new_sp;
   }
 
@@ -1112,35 +1092,27 @@ Address grow_stack(Isolate* isolate, void* current_sp, size_t frame_size,
 }
 
 Address shrink_stack(Isolate* isolate) {
-  Tagged<WasmContinuationObject> current_continuation =
-      Cast<WasmContinuationObject>(
-          isolate->root(RootIndex::kActiveContinuation));
   // If there is no parent, then the current stack is the main isolate stack.
-  if (IsUndefined(current_continuation->parent())) {
+  wasm::StackMemory* active_stack = isolate->isolate_data()->active_stack();
+  if (active_stack->jmpbuf()->parent == nullptr) {
     return 0;
   }
-  auto stack =
-      reinterpret_cast<wasm::StackMemory*>(current_continuation->stack());
-  DCHECK(stack->IsActive());
-  Address old_fp = stack->Shrink();
+  DCHECK(active_stack->IsActive());
+  Address old_fp = active_stack->Shrink();
 
   isolate->stack_guard()->SetStackLimitForStackSwitching(
-      reinterpret_cast<uintptr_t>(stack->jslimit()));
+      reinterpret_cast<uintptr_t>(active_stack->jslimit()));
   return old_fp;
 }
 
 Address load_old_fp(Isolate* isolate) {
-  Tagged<WasmContinuationObject> current_continuation =
-      Cast<WasmContinuationObject>(
-          isolate->root(RootIndex::kActiveContinuation));
   // If there is no parent, then the current stack is the main isolate stack.
-  if (IsUndefined(current_continuation->parent())) {
+  wasm::StackMemory* active_stack = isolate->isolate_data()->active_stack();
+  if (active_stack->jmpbuf()->parent == nullptr) {
     return 0;
   }
-  auto stack =
-      reinterpret_cast<wasm::StackMemory*>(current_continuation->stack());
-  DCHECK_EQ(stack->jmpbuf()->state, wasm::JumpBuffer::Active);
-  return stack->old_fp();
+  DCHECK_EQ(active_stack->jmpbuf()->state, wasm::JumpBuffer::Active);
+  return active_stack->old_fp();
 }
 
 }  // namespace v8::internal::wasm
diff --git a/deps/v8/src/wasm/wasm-external-refs.h b/deps/v8/src/wasm/wasm-external-refs.h
index af8d921ec365a8..4f1a32019c2454 100644
--- a/deps/v8/src/wasm/wasm-external-refs.h
+++ b/deps/v8/src/wasm/wasm-external-refs.h
@@ -20,6 +20,8 @@ class Isolate;
 
 namespace wasm {
 
+class StackMemory;
+
 using Address = uintptr_t;
 
 V8_EXPORT_PRIVATE void f32_trunc_wrapper(Address data);
@@ -188,10 +190,10 @@ double flat_string_to_f64(Address string_address);
 
 // Update the stack limit after a stack switch,
 // and preserve pending interrupts.
-void switch_stacks(Isolate* isolate, Address old_continuation);
+void switch_stacks(Isolate* isolate, wasm::StackMemory* from);
 // Return {continuation}'s stack memory to the stack pool after it has returned
 // and switched back to its parent, and update the stack limit.
-void return_switch(Isolate* isolate, Address continuation);
+void return_switch(Isolate* isolate, wasm::StackMemory* from);
 
 intptr_t switch_to_the_central_stack(Isolate* isolate, uintptr_t sp);
 void switch_from_the_central_stack(Isolate* isolate);
diff --git a/deps/v8/src/wasm/wasm-feature-flags.h b/deps/v8/src/wasm/wasm-feature-flags.h
index 1f7c5f4e290a01..29e07e66612af5 100644
--- a/deps/v8/src/wasm/wasm-feature-flags.h
+++ b/deps/v8/src/wasm/wasm-feature-flags.h
@@ -89,12 +89,6 @@
 // Consider adding a chromium-side use counter if you want to track usage in the
 // wild (also see {V8::UseCounterFeature}).
 #define FOREACH_WASM_STAGING_FEATURE_FLAG(V) /*          (force 80 columns) */ \
-  /* Branch Hinting proposal. */                                               \
-  /* https://github.com/WebAssembly/branch-hinting */                          \
-  /* V8 side owner: jkummerow */                                               \
-  /* Staged in v13.6. */                                                       \
-  V(branch_hinting, "branch hinting", false)                                   \
-                                                                               \
   /* Reference-Typed Strings Proposal. */                                      \
   /* https://github.com/WebAssembly/stringref */                               \
   /* V8 side owner: jkummerow */                                               \
@@ -103,17 +97,7 @@
   /* Imported Strings TextEncoder/TextDecoder post-MVP extension. */           \
   /* No upstream repo yet. */                                                  \
   /* V8 side owner: jkummerow */                                               \
-  V(imported_strings_utf8, "imported strings (utf8 features)", false)          \
-                                                                               \
-  /* Exnref */                                                                 \
-  /* This flag enables the new exception handling proposal */                  \
-  /* V8 side owner: thibaudm */                                                \
-  V(exnref, "exnref", false)                                                   \
-                                                                               \
-  /* JavaScript Promise Integration proposal. */                               \
-  /* https://github.com/WebAssembly/js-promise-integration */                  \
-  /* V8 side owner: thibaudm, fgm */                                           \
-  V(jspi, "javascript promise integration", false)
+  V(imported_strings_utf8, "imported strings (utf8 features)", false)
 
 // #############################################################################
 // Shipped features (enabled by default). Remove the feature flag once they hit
@@ -126,11 +110,32 @@
   /* Shipped in v9.5 */                                                        \
   V(legacy_eh, "legacy exception handling opcodes", true)                      \
                                                                                \
+  /* Branch Hinting proposal. */                                               \
+  /* https://github.com/WebAssembly/branch-hinting */                          \
+  /* V8 side owner: jkummerow */                                               \
+  /* Staged in v13.6. */                                                       \
+  /* Shipped in v13.7. */                                                      \
+  V(branch_hinting, "branch hinting", true)                                    \
+                                                                               \
   /* Imported Strings Proposal. */                                             \
   /* https://github.com/WebAssembly/js-string-builtins */                      \
   /* V8 side owner: jkummerow */                                               \
   /* Shipped in v13.0 */                                                       \
-  V(imported_strings, "imported strings", true)
+  V(imported_strings, "imported strings", true)                                \
+                                                                               \
+  /* Exnref */                                                                 \
+  /* This flag enables the new exception handling proposal */                  \
+  /* V8 side owner: thibaudm */                                                \
+  /* Shipped in v13.7 */                                                       \
+  V(exnref, "exnref", true)                                                    \
+                                                                               \
+  /* JavaScript Promise Integration proposal. */                               \
+  /* https://github.com/WebAssembly/js-promise-integration */                  \
+  /* I2S: */                                                                   \
+  /* https://groups.google.com/a/chromium.org/g/blink-dev/c/w_jCD4gf7Bc */     \
+  /* V8 side owner: thibaudm, fgm */                                           \
+  /* Shipped in v13.7 */                                                       \
+  V(jspi, "javascript promise integration", true)
 
 // Combination of all available wasm feature flags.
 #define FOREACH_WASM_FEATURE_FLAG(V)        \
diff --git a/deps/v8/src/wasm/wasm-import-wrapper-cache.cc b/deps/v8/src/wasm/wasm-import-wrapper-cache.cc
index 447195d1a61683..4df72444ce7be8 100644
--- a/deps/v8/src/wasm/wasm-import-wrapper-cache.cc
+++ b/deps/v8/src/wasm/wasm-import-wrapper-cache.cc
@@ -75,6 +75,7 @@ WasmCode* WasmImportWrapperCache::ModificationScope::AddWrapper(
   const int handler_table_offset = desc.handler_table_offset;
   const int constant_pool_offset = desc.constant_pool_offset;
   const int code_comments_offset = desc.code_comments_offset;
+  const int jump_table_info_offset = desc.jump_table_info_offset;
   const int instr_size = desc.instr_size;
   {
     WritableJitAllocation jit_allocation =
@@ -110,6 +111,7 @@ WasmCode* WasmImportWrapperCache::ModificationScope::AddWrapper(
                                 handler_table_offset,
                                 constant_pool_offset,
                                 code_comments_offset,
+                                jump_table_info_offset,
                                 instr_size,
                                 result.protected_instructions_data.as_vector(),
                                 reloc_info,
@@ -146,9 +148,7 @@ WasmCode* WasmImportWrapperCache::FindWrapper(WasmCodePointer call_target) {
       GetProcessWideWasmCodePointerTable()->GetEntrypointWithoutSignatureCheck(
           call_target));
   if (iter == codes_.end()) return nullptr;
-  WasmCodeRefScope::AddRef(iter->second);
-  if (iter->second->is_dying()) return nullptr;
-  return iter->second;
+  return WasmCodeRefScope::AddRefIfNotDying(iter->second);
 }
 
 WasmCode* WasmImportWrapperCache::CompileWasmImportCallWrapper(
@@ -165,8 +165,8 @@ WasmCode* WasmImportWrapperCache::CompileWasmImportCallWrapper(
     // again whether another thread has just created the wrapper.
     wasm_code = cache_scope[key];
     if (wasm_code) {
-      WasmCodeRefScope::AddRef(wasm_code);
-      if (!wasm_code->is_dying()) return wasm_code;
+      wasm_code = WasmCodeRefScope::AddRefIfNotDying(wasm_code);
+      if (wasm_code) return wasm_code;
     }
 
     wasm_code = cache_scope.AddWrapper(key, std::move(result),
@@ -218,6 +218,9 @@ void WasmImportWrapperCache::Free(std::vector<WasmCode*>& wrappers) {
   }
   code_allocator_->FreeCode(base::VectorOf(wrappers));
   for (WasmCode* wrapper : wrappers) {
+    // TODO(407003348): Drop this check if it doesn't trigger in the wild.
+    CHECK_EQ(wrapper->ref_count_bitfield_.load(std::memory_order_acquire),
+             WasmCode::kIsDyingMask);
     delete wrapper;
   }
   // Make sure nobody tries to access stale pointers.
@@ -232,9 +235,7 @@ WasmCode* WasmImportWrapperCache::MaybeGet(ImportCallKind kind,
 
   auto it = entry_map_.find({kind, type_index, expected_arity, suspend});
   if (it == entry_map_.end()) return nullptr;
-  WasmCodeRefScope::AddRef(it->second);
-  if (it->second->is_dying()) return nullptr;
-  return it->second;
+  return WasmCodeRefScope::AddRefIfNotDying(it->second);
 }
 
 WasmCode* WasmImportWrapperCache::Lookup(Address pc) const {
diff --git a/deps/v8/src/wasm/wasm-js.cc b/deps/v8/src/wasm/wasm-js.cc
index ef83a43ddc66b8..874ed5e637ba6b 100644
--- a/deps/v8/src/wasm/wasm-js.cc
+++ b/deps/v8/src/wasm/wasm-js.cc
@@ -2256,20 +2256,23 @@ i::DirectHandle<i::JSFunction> NewPromisingWasmExportedFunction(
 
   int num_imported_functions = module->num_imported_functions;
   i::DirectHandle<i::TrustedObject> implicit_arg;
+  constexpr bool kShared = false;
   if (func_index >= num_imported_functions) {
     implicit_arg = trusted_instance_data;
   } else {
-    implicit_arg = i_isolate->factory()->NewWasmImportData(direct_handle(
-        i::Cast<i::WasmImportData>(
-            trusted_instance_data->dispatch_table_for_imports()->implicit_arg(
-                func_index)),
-        i_isolate));
+    implicit_arg = i_isolate->factory()->NewWasmImportData(
+        direct_handle(i::Cast<i::WasmImportData>(
+                          trusted_instance_data->dispatch_table_for_imports()
+                              ->implicit_arg(func_index)),
+                      i_isolate),
+        kShared);
   }
 
   i::DirectHandle<i::WasmInternalFunction> internal =
-      i_isolate->factory()->NewWasmInternalFunction(implicit_arg, func_index);
+      i_isolate->factory()->NewWasmInternalFunction(implicit_arg, func_index,
+                                                    kShared);
   i::DirectHandle<i::WasmFuncRef> func_ref =
-      i_isolate->factory()->NewWasmFuncRef(internal, rtt);
+      i_isolate->factory()->NewWasmFuncRef(internal, rtt, kShared);
   internal->set_call_target(trusted_instance_data->GetCallTarget(func_index));
   if (func_index < num_imported_functions) {
     i::Cast<i::WasmImportData>(implicit_arg)->set_call_origin(*internal);
@@ -2454,6 +2457,38 @@ void WebAssemblySuspendingImpl(
   info.GetReturnValue().Set(Utils::ToLocal(i::Cast<i::JSObject>(result)));
 }
 
+// WebAssembly.DescriptorOptions({options}) -> DescriptorOptions
+void WebAssemblyDescriptorOptionsImpl(
+    const FunctionCallbackInfo<v8::Value>& info) {
+  WasmJSApiScope js_api_scope{info, "WebAssembly.DescriptorOptions()"};
+  auto [isolate, i_isolate, thrower] = js_api_scope.isolates_and_thrower();
+
+  if (!info.IsConstructCall()) {
+    thrower.TypeError(
+        "WebAssembly.DescriptorOptions must be invoked with 'new'");
+    return;
+  }
+  if (!info[0]->IsObject()) {
+    thrower.TypeError("Argument 0 must be an object");
+    return;
+  }
+
+  i::DirectHandle<i::JSReceiver> options =
+      Utils::OpenDirectHandle(*Local<v8::Object>::Cast(info[0]));
+  i::DirectHandle<i::Object> prototype;
+  if (!i::JSReceiver::GetProperty(i_isolate, options, "prototype")
+           .ToHandle(&prototype)) {
+    return js_api_scope.AssertException();
+  }
+  if (!i::IsJSReceiver(*prototype)) {
+    thrower.TypeError("Prototype must be an object");
+    return;
+  }
+  i::DirectHandle<i::WasmDescriptorOptions> result =
+      i::WasmDescriptorOptions::New(i_isolate, prototype);
+  info.GetReturnValue().Set(Utils::ToLocal(i::Cast<i::JSObject>(result)));
+}
+
 // WebAssembly.Function.prototype.type() -> FunctionType
 void WebAssemblyFunctionType(const v8::FunctionCallbackInfo<v8::Value>& info) {
   WasmJSApiScope js_api_scope{info, "WebAssembly.Function.type()"};
@@ -3350,7 +3385,7 @@ DirectHandle<JSObject> SetupConstructor(Isolate* isolate,
                                         const char* name = nullptr,
                                         int in_object_properties = 0) {
   SetDummyInstanceTemplate(isolate, constructor);
-  JSFunction::EnsureHasInitialMap(constructor);
+  JSFunction::EnsureHasInitialMap(isolate, constructor);
   DirectHandle<JSObject> proto(
       Cast<JSObject>(constructor->instance_prototype()), isolate);
   DirectHandle<Map> map = isolate->factory()->NewContextfulMap(
@@ -3379,10 +3414,12 @@ void WasmJs::PrepareForSnapshot(Isolate* isolate) {
   DirectHandle<JSGlobalObject> global = isolate->global_object();
   DirectHandle<NativeContext> native_context(global->native_context(), isolate);
 
-  CHECK(IsUndefined(native_context->get(Context::WASM_WEBASSEMBLY_OBJECT_INDEX),
-                    isolate));
-  CHECK(IsUndefined(native_context->get(Context::WASM_MODULE_CONSTRUCTOR_INDEX),
-                    isolate));
+  CHECK(IsUndefined(
+      native_context->GetNoCell(Context::WASM_WEBASSEMBLY_OBJECT_INDEX),
+      isolate));
+  CHECK(IsUndefined(
+      native_context->GetNoCell(Context::WASM_MODULE_CONSTRUCTOR_INDEX),
+      isolate));
 
   Factory* const f = isolate->factory();
   static constexpr PropertyAttributes ro_attributes =
@@ -3399,7 +3436,8 @@ void WasmJs::PrepareForSnapshot(Isolate* isolate) {
 
     DirectHandle<JSFunction> ctor =
         Factory::JSFunctionBuilder{isolate, sfi, native_context}.Build();
-    JSFunction::SetPrototype(ctor, isolate->initial_object_prototype());
+    JSFunction::SetPrototype(isolate, ctor,
+                             isolate->initial_object_prototype());
     webassembly = f->NewJSObject(ctor, AllocationType::kOld);
     native_context->set_wasm_webassembly_object(*webassembly);
 
@@ -3673,6 +3711,10 @@ void WasmJs::Install(Isolate* isolate) {
     InstallMemoryControl(isolate, native_context, webassembly);
   }
 
+  if (enabled_features.has_custom_descriptors()) {
+    InstallCustomDescriptors(isolate, native_context, webassembly);
+  }
+
   // Initialize and install JSPI feature.
   if (enabled_features.has_jspi()) {
     CHECK(native_context->is_wasm_jspi_installed() == Smi::zero());
@@ -3712,8 +3754,7 @@ void WasmJs::InstallConditionalFeatures(Isolate* isolate,
   if (isolate->IsWasmJSPIRequested(context)) {
     if (context->is_wasm_jspi_installed() == Smi::zero()) {
       isolate->WasmInitJSPIFeature();
-      if (InstallJSPromiseIntegration(isolate, context, webassembly) &&
-          InstallTypeReflection(isolate, context, webassembly)) {
+      if (InstallJSPromiseIntegration(isolate, context, webassembly)) {
         context->set_is_wasm_jspi_installed(Smi::FromInt(1));
       }
     }
@@ -3756,6 +3797,27 @@ bool WasmJs::InstallJSPromiseIntegration(Isolate* isolate,
   return true;
 }
 
+bool WasmJs::InstallCustomDescriptors(Isolate* isolate,
+                                      DirectHandle<NativeContext> context,
+                                      DirectHandle<JSObject> webassembly) {
+  DirectHandle<String> descriptor_options_string =
+      v8_str(isolate, "DescriptorOptions");
+  if (JSObject::HasRealNamedProperty(isolate, webassembly,
+                                     descriptor_options_string)
+          .FromMaybe(true)) {
+    return false;
+  }
+  DirectHandle<JSFunction> descriptor_options_constructor =
+      InstallConstructorFunc(isolate, webassembly, "DescriptorOptions",
+                             WebAssemblyDescriptorOptionsImpl);
+  context->set_wasm_descriptor_options_constructor(
+      *descriptor_options_constructor);
+  SetupConstructor(
+      isolate, descriptor_options_constructor, WASM_DESCRIPTOR_OPTIONS_TYPE,
+      WasmDescriptorOptions::kHeaderSize, "WebAssembly.DescriptorOptions");
+  return true;
+}
+
 void WasmJs::InstallMemoryControl(Isolate* isolate,
                                   DirectHandle<NativeContext> context,
                                   DirectHandle<JSObject> webassembly) {
@@ -3837,7 +3899,7 @@ bool WasmJs::InstallTypeReflection(Isolate* isolate,
   DirectHandle<JSFunction> function_constructor = InstallConstructorFunc(
       isolate, webassembly, "Function", WebAssemblyFunction);
   SetDummyInstanceTemplate(isolate, function_constructor);
-  JSFunction::EnsureHasInitialMap(function_constructor);
+  JSFunction::EnsureHasInitialMap(isolate, function_constructor);
   DirectHandle<JSObject> function_proto(
       Cast<JSObject>(function_constructor->instance_prototype()), isolate);
   DirectHandle<Map> function_map =
diff --git a/deps/v8/src/wasm/wasm-js.h b/deps/v8/src/wasm/wasm-js.h
index 73134148b0870a..5df0802877cc89 100644
--- a/deps/v8/src/wasm/wasm-js.h
+++ b/deps/v8/src/wasm/wasm-js.h
@@ -103,6 +103,10 @@ class WasmJs {
   V8_EXPORT_PRIVATE static void InstallResizableBufferIntegration(
       Isolate* isolate, DirectHandle<NativeContext> context,
       DirectHandle<JSObject> webassembly);
+
+  V8_EXPORT_PRIVATE static bool InstallCustomDescriptors(
+      Isolate* isolate, DirectHandle<NativeContext> context,
+      DirectHandle<JSObject> webassembly);
 };
 
 }  // namespace v8::internal
diff --git a/deps/v8/src/wasm/wasm-module.cc b/deps/v8/src/wasm/wasm-module.cc
index 623fb3681583ad..bd5ebf1eb75b85 100644
--- a/deps/v8/src/wasm/wasm-module.cc
+++ b/deps/v8/src/wasm/wasm-module.cc
@@ -416,7 +416,7 @@ DirectHandle<JSArray> GetImports(Isolate* isolate,
   DirectHandle<JSArray> array_object =
       factory->NewJSArray(PACKED_ELEMENTS, 0, 0);
   DirectHandle<FixedArray> storage = factory->NewFixedArray(num_imports);
-  JSArray::SetContent(array_object, storage);
+  JSArray::SetContent(isolate, array_object, storage);
 
   DirectHandle<JSFunction> object_function = DirectHandle<JSFunction>(
       isolate->native_context()->object_function(), isolate);
@@ -517,7 +517,7 @@ DirectHandle<JSArray> GetImports(Isolate* isolate,
   for (int index = cursor; index < num_imports; ++index) {
     storage->set_the_hole(isolate, cursor++);
   }
-  JSObject::ValidateElements(*array_object);
+  JSObject::ValidateElements(isolate, *array_object);
   return array_object;
 }
 
@@ -542,7 +542,7 @@ DirectHandle<JSArray> GetExports(Isolate* isolate,
   DirectHandle<JSArray> array_object =
       factory->NewJSArray(PACKED_ELEMENTS, 0, 0);
   DirectHandle<FixedArray> storage = factory->NewFixedArray(num_exports);
-  JSArray::SetContent(array_object, storage);
+  JSArray::SetContent(isolate, array_object, storage);
   DCHECK_EQ(array_object->length(), Smi::FromInt(num_exports));
 
   DirectHandle<JSFunction> object_function = DirectHandle<JSFunction>(
@@ -615,7 +615,7 @@ DirectHandle<JSArray> GetExports(Isolate* isolate,
     storage->set(index, *entry);
   }
 
-  JSObject::ValidateElements(*array_object);
+  JSObject::ValidateElements(isolate, *array_object);
   return array_object;
 }
 
@@ -661,14 +661,14 @@ DirectHandle<JSArray> GetCustomSections(
       factory->NewJSArray(PACKED_ELEMENTS, 0, 0);
   DirectHandle<FixedArray> storage =
       factory->NewFixedArray(num_custom_sections);
-  JSArray::SetContent(array_object, storage);
+  JSArray::SetContent(isolate, array_object, storage);
   DCHECK_EQ(array_object->length(), Smi::FromInt(num_custom_sections));
 
   for (int i = 0; i < num_custom_sections; i++) {
     storage->set(i, *matching_sections[i]);
   }
 
-  JSObject::ValidateElements(*array_object);
+  JSObject::ValidateElements(isolate, *array_object);
   return array_object;
 }
 
@@ -693,7 +693,7 @@ int GetSourcePosition(const WasmModule* module, uint32_t func_index,
 size_t WasmModule::EstimateStoredSize() const {
   UPDATE_WHEN_CLASS_CHANGES(WasmModule,
 #if V8_ENABLE_DRUMBRAKE
-                            776
+                            800
 #else   // V8_ENABLE_DRUMBRAKE
                             768
 #endif  // V8_ENABLE_DRUMBRAKE
@@ -772,7 +772,7 @@ size_t TypeFeedbackStorage::EstimateCurrentMemoryConsumption() const {
 size_t WasmModule::EstimateCurrentMemoryConsumption() const {
   UPDATE_WHEN_CLASS_CHANGES(WasmModule,
 #if V8_ENABLE_DRUMBRAKE
-                            776
+                            800
 #else   // V8_ENABLE_DRUMBRAKE
                             768
 #endif  // V8_ENABLE_DRUMBRAKE
diff --git a/deps/v8/src/wasm/wasm-module.h b/deps/v8/src/wasm/wasm-module.h
index 148e656a82c14a..16c23732a62409 100644
--- a/deps/v8/src/wasm/wasm-module.h
+++ b/deps/v8/src/wasm/wasm-module.h
@@ -104,7 +104,7 @@ struct WasmGlobal {
 };
 
 // Note: An exception tag signature only uses the params portion of a function
-// signature.
+// signature. However, tags used for suspend/resume use both params and results.
 using WasmTagSig = FunctionSig;
 
 // Static representation of a wasm tag type.
@@ -872,11 +872,18 @@ struct V8_EXPORT_PRIVATE WasmModule {
     return types[index.index].function_sig;
   }
 
-  bool has_conttype(ModuleTypeIndex index) const {
+  bool has_cont_type(ModuleTypeIndex index) const {
     return index.index < types.size() &&
            types[index.index].kind == TypeDefinition::kCont;
   }
 
+  const ContType* cont_type(ModuleTypeIndex index) const {
+    DCHECK(has_cont_type(index));
+    size_t num_types = types.size();
+    V8_ASSUME(index.index < num_types);
+    return types[index.index].cont_type;
+  }
+
   CanonicalTypeIndex canonical_sig_id(ModuleTypeIndex index) const {
     DCHECK(has_signature(index));
     size_t num_types = isorecursive_canonical_type_ids.size();
diff --git a/deps/v8/src/wasm/wasm-objects-inl.h b/deps/v8/src/wasm/wasm-objects-inl.h
index 8267b1504e1052..7a1301cfea5116 100644
--- a/deps/v8/src/wasm/wasm-objects-inl.h
+++ b/deps/v8/src/wasm/wasm-objects-inl.h
@@ -45,7 +45,6 @@ namespace v8::internal {
 TQ_OBJECT_CONSTRUCTORS_IMPL(AsmWasmData)
 TQ_OBJECT_CONSTRUCTORS_IMPL(WasmArray)
 TQ_OBJECT_CONSTRUCTORS_IMPL(WasmCapiFunctionData)
-TQ_OBJECT_CONSTRUCTORS_IMPL(WasmContinuationObject)
 TQ_OBJECT_CONSTRUCTORS_IMPL(WasmExceptionTag)
 TQ_OBJECT_CONSTRUCTORS_IMPL(WasmExportedFunctionData)
 TQ_OBJECT_CONSTRUCTORS_IMPL(WasmFunctionData)
@@ -231,8 +230,8 @@ PRIMITIVE_ACCESSORS(WasmTrustedInstanceData, break_on_entry, uint8_t,
 
 OPTIONAL_ACCESSORS(WasmTrustedInstanceData, instance_object,
                    Tagged<WasmInstanceObject>, kInstanceObjectOffset)
-ACCESSORS(WasmTrustedInstanceData, native_context, Tagged<Context>,
-          kNativeContextOffset)
+OPTIONAL_ACCESSORS(WasmTrustedInstanceData, native_context, Tagged<Context>,
+                   kNativeContextOffset)
 ACCESSORS(WasmTrustedInstanceData, memory_objects, Tagged<FixedArray>,
           kMemoryObjectsOffset)
 OPTIONAL_ACCESSORS(WasmTrustedInstanceData, untagged_globals_buffer,
@@ -822,13 +821,13 @@ int WasmArray::DecodeElementSizeFromMap(Tagged<Map> map) {
   return map->WasmByte1();
 }
 
+EXTERNAL_POINTER_ACCESSORS(WasmSuspenderObject, stack, wasm::StackMemory*,
+                           kStackOffset, kWasmStackMemoryTag)
+
 TRUSTED_POINTER_ACCESSORS(WasmTagObject, trusted_data, WasmTrustedInstanceData,
                           kTrustedDataOffset,
                           kWasmTrustedInstanceDataIndirectPointerTag)
 
-EXTERNAL_POINTER_ACCESSORS(WasmContinuationObject, stack, Address, kStackOffset,
-                           kWasmStackMemoryTag)
-
 #include "src/objects/object-macros-undef.h"
 
 }  // namespace v8::internal
diff --git a/deps/v8/src/wasm/wasm-objects.cc b/deps/v8/src/wasm/wasm-objects.cc
index 91ebf45a50bdec..9ced01f7c45637 100644
--- a/deps/v8/src/wasm/wasm-objects.cc
+++ b/deps/v8/src/wasm/wasm-objects.cc
@@ -206,10 +206,11 @@ DirectHandle<WasmTableObject> WasmTableObject::New(
     entries->set(i, *initial_value);
   }
   bool is_function_table = canonical_type.IsFunctionType();
+  const bool shared = false;
   DirectHandle<WasmDispatchTable> dispatch_table =
-      is_function_table
-          ? isolate->factory()->NewWasmDispatchTable(initial, canonical_type)
-          : DirectHandle<WasmDispatchTable>{};
+      is_function_table ? isolate->factory()->NewWasmDispatchTable(
+                              initial, canonical_type, shared)
+                        : DirectHandle<WasmDispatchTable>{};
 
   DirectHandle<UnionOf<Undefined, Number, BigInt>> max =
       isolate->factory()->undefined_value();
@@ -576,8 +577,9 @@ void WasmTableObject::UpdateDispatchTable(
 
   if (v8_flags.wasm_generic_wrapper && IsWasmImportData(*implicit_arg)) {
     auto import_data = Cast<WasmImportData>(implicit_arg);
+    constexpr bool kShared = false;
     DirectHandle<WasmImportData> new_import_data =
-        isolate->factory()->NewWasmImportData(import_data);
+        isolate->factory()->NewWasmImportData(import_data, kShared);
     new_import_data->set_call_origin(*dispatch_table);
     new_import_data->set_table_slot(entry_index);
     implicit_arg = new_import_data;
@@ -589,7 +591,7 @@ void WasmTableObject::UpdateDispatchTable(
                                   ->LookupFunctionSignature(sig_id)
                                   ->signature_hash();
     dispatch_table->SetForWrapper(
-        entry_index, *implicit_arg,
+        entry_index, Cast<WasmImportData>(*implicit_arg),
         wasm::GetProcessWideWasmCodePointerTable()->GetEntrypoint(
             call_target, signature_hash),
         sig_id, signature_hash,
@@ -599,12 +601,13 @@ void WasmTableObject::UpdateDispatchTable(
         wasm::GetWasmImportWrapperCache()->FindWrapper(call_target),
         WasmDispatchTable::kExistingEntry);
   } else {
-    dispatch_table->SetForNonWrapper(entry_index, *implicit_arg, call_target,
-                                     sig_id,
+    dispatch_table->SetForNonWrapper(
+        entry_index, Cast<WasmTrustedInstanceData>(*implicit_arg), call_target,
+        sig_id,
 #if V8_ENABLE_DRUMBRAKE
-                                     target_func_index,
+        target_func_index,
 #endif
-                                     WasmDispatchTable::kExistingEntry);
+        WasmDispatchTable::kExistingEntry);
   }
 
 #if V8_ENABLE_DRUMBRAKE
@@ -681,8 +684,10 @@ void WasmTableObject::UpdateDispatchTable(
                  Builtins::EntryOf(Builtin::kWasmToJsWrapperAsm, isolate) ||
              call_target == Builtins::EntryOf(
                                 Builtin::kWasmToJsWrapperInvalidSig, isolate));
+      constexpr bool kShared = false;
       import_data = isolate->factory()->NewWasmImportData(
-          callable, suspend, MaybeDirectHandle<WasmTrustedInstanceData>{}, sig);
+          callable, suspend, MaybeDirectHandle<WasmTrustedInstanceData>{}, sig,
+          kShared);
       import_data->SetIndexInTableAsCallOrigin(*dispatch_table, entry_index);
     }
   }
@@ -735,7 +740,8 @@ void WasmTableObject::UpdateDispatchTable(
     isolate->counters()->wasm_reloc_size()->Increment(
         wasm_code->reloc_info().length());
   }
-  Tagged<HeapObject> implicit_arg = func_data->internal()->implicit_arg();
+  Tagged<WasmImportData> implicit_arg =
+      Cast<WasmImportData>(func_data->internal()->implicit_arg());
   Address call_target = wasm_code->instruction_start();
   Tagged<WasmDispatchTable> dispatch_table =
       table->trusted_dispatch_table(isolate);
@@ -1495,7 +1501,13 @@ MaybeDirectHandle<WasmGlobalObject> WasmGlobalObject::New(
           isolate->factory()->NewJSArrayBufferAndBackingStore(
               offset + type_size, InitializedFlag::kZeroInitialized);
 
-      if (!result.ToHandle(&untagged_buffer)) return {};
+      if (!result.ToHandle(&untagged_buffer)) {
+        isolate->Throw(*isolate->factory()->NewRangeError(
+            MessageTemplate::kOutOfMemory,
+            isolate->factory()->NewStringFromAsciiChecked(
+                "WebAssembly.Global")));
+        return {};
+      }
     }
 
     // Check that the offset is in bounds.
@@ -1550,9 +1562,10 @@ void ImportedFunctionEntry::SetGenericWasmToJs(
   TRACE_IFT("Import callable 0x%" PRIxPTR "[%d] = {callable=0x%" PRIxPTR
             ", target=0x%" PRIxPTR "}\n",
             instance_data_->ptr(), index_, callable->ptr(), wrapper_entry);
+  constexpr bool kShared = false;
   DirectHandle<WasmImportData> import_data =
       isolate->factory()->NewWasmImportData(callable, suspend, instance_data_,
-                                            sig);
+                                            sig, kShared);
   import_data->SetIndexInTableAsCallOrigin(
       instance_data_->dispatch_table_for_imports(), index_);
   DisallowGarbageCollection no_gc;
@@ -1580,9 +1593,10 @@ void ImportedFunctionEntry::SetCompiledWasmToJs(
   DCHECK(v8_flags.wasm_jitless ||
          wasm_to_js_wrapper->kind() == wasm::WasmCode::kWasmToJsWrapper ||
          wasm_to_js_wrapper->kind() == wasm::WasmCode::kWasmToCapiWrapper);
+  constexpr bool kShared = false;
   DirectHandle<WasmImportData> import_data =
       isolate->factory()->NewWasmImportData(callable, suspend, instance_data_,
-                                            sig);
+                                            sig, kShared);
   DisallowGarbageCollection no_gc;
   Tagged<WasmDispatchTable> dispatch_table =
       instance_data_->dispatch_table_for_imports();
@@ -1732,16 +1746,19 @@ DirectHandle<WasmTrustedInstanceData> WasmTrustedInstanceData::New(
   // initialized yet, which can lead to heap verification errors.
   const WasmModule* module = native_module->module();
 
+  AllocationType allocation =
+      shared ? AllocationType::kSharedOld : AllocationType::kYoung;
+
   int num_imported_functions = module->num_imported_functions;
   DirectHandle<WasmDispatchTable> dispatch_table_for_imports =
       isolate->factory()->NewWasmDispatchTable(num_imported_functions,
-                                               wasm::kWasmFuncRef);
+                                               wasm::kWasmFuncRef, shared);
   DirectHandle<FixedArray> well_known_imports =
-      isolate->factory()->NewFixedArray(num_imported_functions);
+      isolate->factory()->NewFixedArray(num_imported_functions, allocation);
 
   DirectHandle<FixedArray> func_refs =
       isolate->factory()->NewFixedArrayWithZeroes(
-          static_cast<int>(module->functions.size()));
+          static_cast<int>(module->functions.size()), allocation);
 
   int num_imported_mutable_globals = module->num_imported_mutable_globals;
   // The imported_mutable_globals is essentially a FixedAddressArray (storing
@@ -1749,13 +1766,13 @@ DirectHandle<WasmTrustedInstanceData> WasmTrustedInstanceData::New(
   // globals) are accessed as 32-bit integers which is more convenient with a
   // raw ByteArray.
   DirectHandle<FixedAddressArray> imported_mutable_globals =
-      FixedAddressArray::New(isolate, num_imported_mutable_globals);
+      FixedAddressArray::New(isolate, num_imported_mutable_globals, allocation);
 
   int num_data_segments = module->num_declared_data_segments;
   DirectHandle<FixedAddressArray> data_segment_starts =
-      FixedAddressArray::New(isolate, num_data_segments);
+      FixedAddressArray::New(isolate, num_data_segments, allocation);
   DirectHandle<FixedUInt32Array> data_segment_sizes =
-      FixedUInt32Array::New(isolate, num_data_segments);
+      FixedUInt32Array::New(isolate, num_data_segments, allocation);
 
 #if V8_ENABLE_DRUMBRAKE
   DirectHandle<FixedInt32Array> imported_function_indices =
@@ -1765,14 +1782,16 @@ DirectHandle<WasmTrustedInstanceData> WasmTrustedInstanceData::New(
   static_assert(wasm::kV8MaxWasmMemories < kMaxInt / 2);
   int num_memories = static_cast<int>(module->memories.size());
   DirectHandle<FixedArray> memory_objects =
-      isolate->factory()->NewFixedArray(num_memories);
+      isolate->factory()->NewFixedArray(num_memories, allocation);
   DirectHandle<TrustedFixedAddressArray> memory_bases_and_sizes =
-      TrustedFixedAddressArray::New(isolate, 2 * num_memories);
+      TrustedFixedAddressArray::New(
+          isolate, 2 * num_memories,
+          shared ? AllocationType::kSharedTrusted : AllocationType::kTrusted);
 
   // TODO(clemensb): Should we have singleton empty dispatch table in the
   // trusted space?
   DirectHandle<WasmDispatchTable> empty_dispatch_table =
-      isolate->factory()->NewWasmDispatchTable(0, wasm::kWasmFuncRef);
+      isolate->factory()->NewWasmDispatchTable(0, wasm::kWasmFuncRef, shared);
   DirectHandle<ProtectedFixedArray> empty_protected_fixed_array =
       isolate->factory()->empty_protected_fixed_array();
 
@@ -1783,13 +1802,13 @@ DirectHandle<WasmTrustedInstanceData> WasmTrustedInstanceData::New(
       module_object->managed_native_module()->estimated_size();
   DirectHandle<TrustedManaged<wasm::NativeModule>>
       trusted_managed_native_module = TrustedManaged<wasm::NativeModule>::From(
-          isolate, estimated_size, native_module);
+          isolate, estimated_size, native_module, shared);
 
   // Now allocate the WasmTrustedInstanceData.
   // During this step, no more allocations should happen because the instance is
   // incomplete yet, so we should not trigger heap verification at this point.
   DirectHandle<WasmTrustedInstanceData> trusted_data =
-      isolate->factory()->NewWasmTrustedInstanceData();
+      isolate->factory()->NewWasmTrustedInstanceData(shared);
   {
     DisallowHeapAllocation no_gc;
 
@@ -1820,7 +1839,7 @@ DirectHandle<WasmTrustedInstanceData> WasmTrustedInstanceData::New(
 #if V8_ENABLE_DRUMBRAKE
     trusted_data->set_imported_function_indices(*imported_function_indices);
 #endif  // V8_ENABLE_DRUMBRAKE
-    trusted_data->set_native_context(*isolate->native_context());
+    if (!shared) trusted_data->set_native_context(*isolate->native_context());
     trusted_data->set_jump_table_start(native_module->jump_table_start());
     trusted_data->set_hook_on_function_call_address(
         isolate->debug()->hook_on_function_call_address());
@@ -2025,6 +2044,7 @@ DirectHandle<WasmFuncRef> WasmTrustedInstanceData::GetOrCreateFuncRef(
     Isolate* isolate,
     DirectHandle<WasmTrustedInstanceData> trusted_instance_data,
     int function_index) {
+  bool shared = HeapLayout::InAnySharedSpace(*trusted_instance_data);
   Tagged<WasmFuncRef> existing_func_ref;
   if (trusted_instance_data->try_get_func_ref(function_index,
                                               &existing_func_ref)) {
@@ -2050,9 +2070,10 @@ DirectHandle<WasmFuncRef> WasmTrustedInstanceData::GetOrCreateFuncRef(
       isolate};
 
   DirectHandle<WasmInternalFunction> internal_function =
-      isolate->factory()->NewWasmInternalFunction(implicit_arg, function_index);
+      isolate->factory()->NewWasmInternalFunction(implicit_arg, function_index,
+                                                  shared);
   DirectHandle<WasmFuncRef> func_ref =
-      isolate->factory()->NewWasmFuncRef(internal_function, rtt);
+      isolate->factory()->NewWasmFuncRef(internal_function, rtt, shared);
   trusted_instance_data->func_refs()->set(function_index, *func_ref);
 
   // Reuse the call target of the instance. In case of import wrappers, the
@@ -2224,13 +2245,14 @@ const wasm::CanonicalStructType* WasmStruct::GcSafeType(Tagged<Map> map) {
 //
 // The eventual on-heap object structure will be something like the following,
 // where (A) is the object returned by this function, and (B) is allocated
-// along with it. There will likely be many instance of (C), and they will be
+// along with it. There will likely be many instances of (C), and they will be
 // allocated (much) later, by one or more {struct.new} instructions that
 // take (A) as input and retrieve (B) from it.
+// (D) is the {map} passed to this function.
 //
 //   Wasm struct (C):                    Wasm Descriptor Struct (A):
 //   +-----------+                       +-----------+
-//   | Map       |------\                | Map       |
+//   | Map       |------\                | Map (D)   |
 //   +-----------+      |                +-----------+
 //   | hash      |      |                | hash      |
 //   +-----------+      |       /--------| RTT       |
@@ -2245,7 +2267,8 @@ const wasm::CanonicalStructType* WasmStruct::GcSafeType(Tagged<Map> map) {
 // static
 DirectHandle<WasmStruct> WasmStruct::AllocateDescriptorUninitialized(
     Isolate* isolate, DirectHandle<WasmTrustedInstanceData> trusted_data,
-    wasm::ModuleTypeIndex index, DirectHandle<Map> map) {
+    wasm::ModuleTypeIndex index, DirectHandle<Map> map,
+    DirectHandle<Object> first_field) {
   const wasm::WasmModule* module = trusted_data->module();
   const wasm::TypeDefinition& type = module->type(index);
   DCHECK(type.is_descriptor());
@@ -2256,7 +2279,20 @@ DirectHandle<WasmStruct> WasmStruct::AllocateDescriptorUninitialized(
   DirectHandle<Map> rtt_parent{
       Cast<Map>(trusted_data->managed_object_maps()->get(type.describes.index)),
       isolate};
-  DirectHandle<Map> rtt = CreateStructMap(isolate, described_index, rtt_parent);
+  DirectHandle<NativeContext> context(
+      Cast<NativeContext>(trusted_data->native_context()), isolate);
+  DirectHandle<Map> rtt =
+      CreateStructMap(isolate, described_index, rtt_parent, context);
+
+  if (v8_flags.wasm_explicit_prototypes && !IsSmi(*first_field) &&
+      IsWasmDescriptorOptions(Cast<HeapObject>(*first_field))) {
+    DirectHandle<JSPrototype> prototype = direct_handle(
+        Cast<JSReceiver>(
+            Cast<WasmDescriptorOptions>(*first_field)->prototype()),
+        isolate);
+    Map::SetPrototype(isolate, rtt, prototype);
+  }
+
   DirectHandle<WasmStruct> descriptor =
       isolate->factory()->NewWasmStructUninitialized(type.struct_type, map,
                                                      AllocationType::kOld);
@@ -2370,6 +2406,17 @@ DirectHandle<WasmTagObject> WasmTagObject::New(
   return tag_wrapper;
 }
 
+DirectHandle<WasmDescriptorOptions> WasmDescriptorOptions::New(
+    Isolate* isolate, DirectHandle<Object> prototype) {
+  DirectHandle<JSFunction> ctor(
+      isolate->native_context()->wasm_descriptor_options_constructor(),
+      isolate);
+  DirectHandle<WasmDescriptorOptions> desc =
+      Cast<WasmDescriptorOptions>(isolate->factory()->NewJSObject(ctor));
+  desc->set_prototype(*prototype);
+  return desc;
+}
+
 bool WasmTagObject::MatchesSignature(wasm::CanonicalTypeIndex expected_index) {
   return wasm::CanonicalTypeIndex{static_cast<uint32_t>(
              this->canonical_type_index())} == expected_index;
@@ -2453,13 +2500,13 @@ void WasmDispatchTableData::Remove(int index, WasmCodePointer call_target) {
   wrappers_.erase(entry);
 }
 
-void WasmDispatchTable::SetForNonWrapper(int index, Tagged<Object> implicit_arg,
-                                         WasmCodePointer call_target,
-                                         wasm::CanonicalTypeIndex sig_id,
+void WasmDispatchTable::SetForNonWrapper(
+    int index, Tagged<Union<Smi, WasmTrustedInstanceData>> implicit_arg,
+    WasmCodePointer call_target, wasm::CanonicalTypeIndex sig_id,
 #if V8_ENABLE_DRUMBRAKE
-                                         uint32_t function_index,
+    uint32_t function_index,
 #endif  // V8_ENABLE_DRUMBRAKE
-                                         NewOrExistingEntry new_or_existing) {
+    NewOrExistingEntry new_or_existing) {
   if (implicit_arg == Smi::zero()) {
     DCHECK_EQ(wasm::kInvalidWasmCodePointer, call_target);
     Clear(index, new_or_existing);
@@ -2467,8 +2514,7 @@ void WasmDispatchTable::SetForNonWrapper(int index, Tagged<Object> implicit_arg,
   }
 
   SBXCHECK_BOUNDS(index, length());
-  DCHECK(IsWasmImportData(implicit_arg) ||
-         IsWasmTrustedInstanceData(implicit_arg));
+  DCHECK(IsWasmTrustedInstanceData(implicit_arg));
   DCHECK(sig_id.valid());
   const int offset = OffsetOf(index);
   if (!v8_flags.wasm_jitless) {
@@ -2494,20 +2540,16 @@ void WasmDispatchTable::SetForNonWrapper(int index, Tagged<Object> implicit_arg,
   WriteField<uint32_t>(offset + kSigBias, sig_id.index);
 }
 
-void WasmDispatchTable::SetForWrapper(int index, Tagged<Object> implicit_arg,
-                                      Address call_target,
-                                      wasm::CanonicalTypeIndex sig_id,
-                                      uint64_t signature_hash,
+void WasmDispatchTable::SetForWrapper(
+    int index, Tagged<WasmImportData> implicit_arg, Address call_target,
+    wasm::CanonicalTypeIndex sig_id, uint64_t signature_hash,
 #if V8_ENABLE_DRUMBRAKE
-                                      uint32_t function_index,
+    uint32_t function_index,
 #endif  // V8_ENABLE_DRUMBRAKE
-                                      wasm::WasmCode* compiled_wrapper,
-                                      NewOrExistingEntry new_or_existing) {
+    wasm::WasmCode* compiled_wrapper, NewOrExistingEntry new_or_existing) {
   DCHECK_NE(implicit_arg, Smi::zero());
   SBXCHECK(!compiled_wrapper || !compiled_wrapper->is_dying());
   SBXCHECK_BOUNDS(index, length());
-  DCHECK(IsWasmImportData(implicit_arg) ||
-         IsWasmTrustedInstanceData(implicit_arg));
   DCHECK(sig_id.valid());
   const int offset = OffsetOf(index);
   WriteProtectedPointerField(offset + kImplicitArgBias,
@@ -2648,8 +2690,9 @@ Tagged<ProtectedWeakFixedArray> WasmDispatchTable::MaybeGrowUsesList(
 
 // static
 DirectHandle<WasmDispatchTable> WasmDispatchTable::New(
-    Isolate* isolate, int length, wasm::CanonicalValueType table_type) {
-  return isolate->factory()->NewWasmDispatchTable(length, table_type);
+    Isolate* isolate, int length, wasm::CanonicalValueType table_type,
+    bool shared) {
+  return isolate->factory()->NewWasmDispatchTable(length, table_type, shared);
 }
 
 // static
@@ -2689,7 +2732,8 @@ DirectHandle<WasmDispatchTable> WasmDispatchTable::Grow(
   uint32_t new_capacity = old_capacity + grow;
   DCHECK_LE(new_capacity, limit);
   DirectHandle<WasmDispatchTable> new_table =
-      WasmDispatchTable::New(isolate, new_capacity, old_table->table_type());
+      WasmDispatchTable::New(isolate, new_capacity, old_table->table_type(),
+                             HeapLayout::InAnySharedSpace(*old_table));
 
   DisallowGarbageCollection no_gc;
   // Writing non-atomically is fine here because this is a freshly allocated
@@ -2849,21 +2893,6 @@ void DecodeI64ExceptionValue(DirectHandle<FixedArray> encoded_values,
   *value = (static_cast<uint64_t>(msb) << 32) | static_cast<uint64_t>(lsb);
 }
 
-// static
-DirectHandle<WasmContinuationObject> WasmContinuationObject::New(
-    Isolate* isolate, wasm::StackMemory* stack,
-    wasm::JumpBuffer::StackState state, DirectHandle<HeapObject> parent,
-    AllocationType allocation_type) {
-  stack->jmpbuf()->stack_limit = stack->jslimit();
-  stack->jmpbuf()->sp = stack->base();
-  stack->jmpbuf()->fp = kNullAddress;
-  stack->jmpbuf()->state = state;
-  DirectHandle<WasmContinuationObject> result =
-      isolate->factory()->NewWasmContinuationObject(stack, parent,
-                                                    allocation_type);
-  return result;
-}
-
 bool UseGenericWasmToJSWrapper(wasm::ImportCallKind kind,
                                const wasm::CanonicalSig* sig,
                                wasm::Suspend suspend) {
@@ -2884,14 +2913,6 @@ bool UseGenericWasmToJSWrapper(wasm::ImportCallKind kind,
 #endif
 }
 
-// static
-DirectHandle<WasmContinuationObject> WasmContinuationObject::New(
-    Isolate* isolate, wasm::StackMemory* stack,
-    wasm::JumpBuffer::StackState state, AllocationType allocation_type) {
-  auto parent = ReadOnlyRoots(isolate).undefined_value();
-  return New(isolate, stack, state, direct_handle(parent, isolate),
-             allocation_type);
-}
 #ifdef DEBUG
 
 namespace {
@@ -3129,11 +3150,13 @@ bool WasmJSFunction::IsWasmJSFunction(Tagged<Object> object) {
   return js_function->shared()->HasWasmJSFunctionData();
 }
 
-DirectHandle<Map> CreateStructMap(Isolate* isolate,
-                                  wasm::CanonicalTypeIndex struct_index,
-                                  DirectHandle<Map> opt_rtt_parent) {
+DirectHandle<Map> CreateStructMap(
+    Isolate* isolate, wasm::CanonicalTypeIndex struct_index,
+    DirectHandle<Map> opt_rtt_parent,
+    DirectHandle<NativeContext> opt_native_context) {
   const wasm::CanonicalStructType* type =
       wasm::GetTypeCanonicalizer()->LookupStruct(struct_index);
+  const bool shared = wasm::GetTypeCanonicalizer()->IsShared(struct_index);
   const int inobject_properties = 0;
   // We have to use the variable size sentinel because the instance size
   // stored directly in a Map is capped at 255 pointer sizes.
@@ -3142,18 +3165,26 @@ DirectHandle<Map> CreateStructMap(Isolate* isolate,
   // TODO(jkummerow): If NO_ELEMENTS were supported, we could use that here.
   const ElementsKind elements_kind = TERMINAL_FAST_ELEMENTS_KIND;
   const wasm::CanonicalValueType no_array_element = wasm::kWasmBottom;
-  constexpr bool shared = false;  // TODO(42204563): Implement.
   // If we had a CanonicalHeapType, we could use that here.
   wasm::CanonicalValueType heaptype = wasm::CanonicalValueType::Ref(
       struct_index, shared, wasm::RefTypeKind::kStruct);
   DirectHandle<WasmTypeInfo> type_info = isolate->factory()->NewWasmTypeInfo(
-      heaptype, no_array_element, opt_rtt_parent);
-  DirectHandle<Map> map = isolate->factory()->NewContextlessMap(
-      instance_type, map_instance_size, elements_kind, inobject_properties);
+      heaptype, no_array_element, opt_rtt_parent, shared);
+  DirectHandle<Map> map;
+  // TODO(manoskouk): Combine `shared` with contextful maps.
+  if (shared) {
+    map = isolate->factory()->NewMapWithMetaMap(
+        isolate->factory()->meta_map(), instance_type, map_instance_size,
+        elements_kind, inobject_properties, AllocationType::kSharedMap);
+  } else if (opt_native_context.is_null()) {
+    map = isolate->factory()->NewContextlessMap(
+        instance_type, map_instance_size, elements_kind, inobject_properties);
+  } else {
+    map = isolate->factory()->NewContextfulMap(
+        opt_native_context, instance_type, map_instance_size, elements_kind,
+        inobject_properties);
+  }
   map->set_wasm_type_info(*type_info);
-  map->SetInstanceDescriptors(isolate,
-                              *isolate->factory()->empty_descriptor_array(), 0,
-                              SKIP_WRITE_BARRIER);
   map->set_is_extensible(false);
   const int real_instance_size = WasmStruct::Size(type);
   WasmStruct::EncodeInstanceSizeInMap(real_instance_size, *map);
@@ -3166,17 +3197,24 @@ DirectHandle<Map> CreateArrayMap(Isolate* isolate,
   const wasm::CanonicalArrayType* type =
       wasm::GetTypeCanonicalizer()->LookupArray(array_index);
   wasm::CanonicalValueType element_type = type->element_type();
+  const bool shared = wasm::GetTypeCanonicalizer()->IsShared(array_index);
   const int inobject_properties = 0;
-  const int instance_size = kVariableSizeSentinel;
+  const int map_instance_size = kVariableSizeSentinel;
   const InstanceType instance_type = WASM_ARRAY_TYPE;
   const ElementsKind elements_kind = TERMINAL_FAST_ELEMENTS_KIND;
-  constexpr bool shared = false;  // TODO(42204563): Implement.
   wasm::CanonicalValueType heaptype = wasm::CanonicalValueType::Ref(
       array_index, shared, wasm::RefTypeKind::kArray);
   DirectHandle<WasmTypeInfo> type_info = isolate->factory()->NewWasmTypeInfo(
-      heaptype, element_type, opt_rtt_parent);
-  DirectHandle<Map> map = isolate->factory()->NewContextlessMap(
-      instance_type, instance_size, elements_kind, inobject_properties);
+      heaptype, element_type, opt_rtt_parent, shared);
+
+  DirectHandle<Map> map =
+      shared ? isolate->factory()->NewMapWithMetaMap(
+                   isolate->factory()->meta_map(), instance_type,
+                   map_instance_size, elements_kind, inobject_properties,
+                   AllocationType::kSharedMap)
+             : isolate->factory()->NewContextlessMap(
+                   instance_type, map_instance_size, elements_kind,
+                   inobject_properties);
   map->set_wasm_type_info(*type_info);
   map->SetInstanceDescriptors(isolate,
                               *isolate->factory()->empty_descriptor_array(), 0,
@@ -3188,22 +3226,23 @@ DirectHandle<Map> CreateArrayMap(Isolate* isolate,
 
 DirectHandle<Map> CreateFuncRefMap(Isolate* isolate,
                                    wasm::CanonicalTypeIndex type,
-                                   DirectHandle<Map> opt_rtt_parent) {
+                                   DirectHandle<Map> opt_rtt_parent,
+                                   bool shared) {
   const int inobject_properties = 0;
   const InstanceType instance_type = WASM_FUNC_REF_TYPE;
   const ElementsKind elements_kind = TERMINAL_FAST_ELEMENTS_KIND;
   const wasm::CanonicalValueType no_array_element = wasm::kWasmBottom;
-  constexpr bool shared = false;  // TODO(42204563): Implement.
   wasm::CanonicalValueType heaptype =
       wasm::CanonicalValueType::Ref(type, shared, wasm::RefTypeKind::kFunction);
   DirectHandle<WasmTypeInfo> type_info = isolate->factory()->NewWasmTypeInfo(
-      heaptype, no_array_element, opt_rtt_parent);
+      heaptype, no_array_element, opt_rtt_parent, shared);
   constexpr int kInstanceSize = WasmFuncRef::kSize;
   DCHECK_EQ(
       kInstanceSize,
       Cast<Map>(isolate->root(RootIndex::kWasmFuncRefMap))->instance_size());
   DirectHandle<Map> map = isolate->factory()->NewContextlessMap(
-      instance_type, kInstanceSize, elements_kind, inobject_properties);
+      instance_type, kInstanceSize, elements_kind, inobject_properties,
+      shared ? AllocationType::kSharedMap : AllocationType::kMap);
   map->set_wasm_type_info(*type_info);
   return map;
 }
@@ -3236,7 +3275,7 @@ DirectHandle<WasmJSFunction> WasmJSFunction::New(
     rtt = direct_handle(
         Cast<Map>(maybe_canonical_map.GetHeapObjectAssumeWeak()), isolate);
   } else {
-    rtt = CreateFuncRefMap(isolate, sig_id, DirectHandle<Map>());
+    rtt = CreateFuncRefMap(isolate, sig_id, DirectHandle<Map>(), false);
     canonical_rtts->set(sig_id.index, MakeWeak(*rtt));
   }
 
@@ -3316,7 +3355,7 @@ DirectHandle<WasmJSFunction> WasmJSFunction::New(
 
   DirectHandle<String> name = factory->Function_string();
   if (IsJSFunction(*callable)) {
-    name = JSFunction::GetDebugName(Cast<JSFunction>(callable));
+    name = JSFunction::GetDebugName(isolate, Cast<JSFunction>(callable));
     name = String::Flatten(isolate, name);
   }
   DirectHandle<SharedFunctionInfo> shared =
@@ -3459,6 +3498,43 @@ DirectHandle<Object> CanonicalizeSmi(DirectHandle<Object> smi,
 }  // namespace
 
 namespace wasm {
+namespace {
+inline bool CheckExpectedSharedness(Isolate* isolate,
+                                    DirectHandle<Object> value,
+                                    CanonicalValueType expected,
+                                    const char** error_message) {
+  if (v8_flags.experimental_wasm_shared && (*value).IsHeapObject()) {
+    Tagged<HeapObject> heap_obj = (*value).cast<HeapObject>();
+    if (expected.is_shared() != HeapLayout::InWritableSharedSpace(heap_obj)) {
+      *error_message =
+          expected.is_shared()
+              ? "unshared object is not allowed for shared heap types"
+              : "shared object is not allowed for unshared heap types";
+      return false;
+    }
+  }
+  return true;
+}
+
+inline bool ConvertToSharedIfExpected(Isolate* isolate,
+                                      DirectHandle<Object>* value,
+                                      CanonicalValueType expected,
+                                      const char** error_message) {
+  if (v8_flags.experimental_wasm_shared && expected.is_shared() &&
+      (**value).IsHeapObject()) {
+    Tagged<HeapObject> heap_obj = (**value).cast<HeapObject>();
+    if (!HeapLayout::InWritableSharedSpace(heap_obj)) {
+      if (!Object::Share(isolate, *value, ShouldThrow::kDontThrow)
+               .ToHandle(value)) {
+        *error_message = "unshared object is not allowed for shared heap types";
+        return false;
+      }
+    }
+  }
+  return true;
+}
+}  // namespace
+
 MaybeDirectHandle<Object> JSToWasmObject(Isolate* isolate,
                                          DirectHandle<Object> value,
                                          CanonicalValueType expected,
@@ -3507,15 +3583,25 @@ MaybeDirectHandle<Object> JSToWasmObject(Isolate* isolate,
           isolate);
     }
     case HeapType::kExtern: {
+      if (!ConvertToSharedIfExpected(isolate, &value, expected,
+                                     error_message)) {
+        return {};
+      }
       if (!IsNull(*value, isolate)) return value;
       *error_message = "null is not allowed for (ref extern)";
       return {};
     }
     case HeapType::kAny: {
+      // TODO(mliedtke): We need to construct heap numbers with correct
+      // sharedness.
       if (IsSmi(*value)) return CanonicalizeSmi(value, isolate);
       if (IsHeapNumber(*value)) {
         return CanonicalizeHeapNumber(value, isolate);
       }
+      if (!ConvertToSharedIfExpected(isolate, &value, expected,
+                                     error_message)) {
+        return {};
+      }
       if (!IsNull(*value, isolate)) return value;
       *error_message = "null is not allowed for (ref any)";
       return {};
@@ -3527,6 +3613,9 @@ MaybeDirectHandle<Object> JSToWasmObject(Isolate* isolate,
       *error_message = "invalid type (ref cont)";
       return {};
     case HeapType::kStruct: {
+      if (!CheckExpectedSharedness(isolate, value, expected, error_message)) {
+        return {};
+      }
       if (IsWasmStruct(*value)) {
         return value;
       }
@@ -3535,6 +3624,9 @@ MaybeDirectHandle<Object> JSToWasmObject(Isolate* isolate,
       return {};
     }
     case HeapType::kArray: {
+      if (!CheckExpectedSharedness(isolate, value, expected, error_message)) {
+        return {};
+      }
       if (IsWasmArray(*value)) {
         return value;
       }
@@ -3550,6 +3642,9 @@ MaybeDirectHandle<Object> JSToWasmObject(Isolate* isolate,
         DirectHandle<Object> truncated = CanonicalizeHeapNumber(value, isolate);
         if (IsSmi(*truncated)) return truncated;
       } else if (IsWasmStruct(*value) || IsWasmArray(*value)) {
+        if (!CheckExpectedSharedness(isolate, value, expected, error_message)) {
+          return {};
+        }
         return value;
       }
       *error_message =
diff --git a/deps/v8/src/wasm/wasm-objects.h b/deps/v8/src/wasm/wasm-objects.h
index d384ef731e6a65..5c7d515287ea8d 100644
--- a/deps/v8/src/wasm/wasm-objects.h
+++ b/deps/v8/src/wasm/wasm-objects.h
@@ -473,7 +473,7 @@ class WasmGlobalObject
 class V8_EXPORT_PRIVATE WasmTrustedInstanceData : public ExposedTrustedObject {
  public:
   DECL_OPTIONAL_ACCESSORS(instance_object, Tagged<WasmInstanceObject>)
-  DECL_ACCESSORS(native_context, Tagged<Context>)
+  DECL_OPTIONAL_ACCESSORS(native_context, Tagged<Context>)
   DECL_ACCESSORS(memory_objects, Tagged<FixedArray>)
 #if V8_ENABLE_DRUMBRAKE
   DECL_OPTIONAL_ACCESSORS(interpreter_object, Tagged<Tuple2>)
@@ -818,6 +818,9 @@ class WasmDispatchTable : public ExposedTrustedObject {
   static const uint32_t kInvalidFunctionIndex = UINT_MAX;
 #endif  // V8_ENABLE_DRUMBRAKE
 
+  // Indicate whether we are modifying an existing entry (for which we might
+  // have to update the ref count), or if we are initializing a slot for the
+  // first time (in which case we should not read the uninitialized memory).
   enum NewOrExistingEntry : bool { kNewEntry, kExistingEntry };
 
   class BodyDescriptor;
@@ -860,7 +863,7 @@ class WasmDispatchTable : public ExposedTrustedObject {
   static_assert(IsAligned(kTargetBias, kTaggedSize));
   static_assert(IsAligned(kImplicitArgBias, kTaggedSize));
 
-  // TODO(clemensb): If we ever enable allocation alignment we will needs to add
+  // TODO(clemensb): If we ever enable allocation alignment we will need to add
   // more padding to make the "target" fields system-pointer-size aligned.
   static_assert(!USE_ALLOCATION_ALIGNMENT_BOOL);
 
@@ -907,30 +910,26 @@ class WasmDispatchTable : public ExposedTrustedObject {
 
   // Set an entry for indirect calls that don't go to a WasmToJS wrapper.
   // Wrappers are special since we own the CPT entries for the wrappers.
-  // {implicit_arg} has to be a WasmImportData, a WasmTrustedInstanceData, or
-  // Smi::zero().
-  void V8_EXPORT_PRIVATE SetForNonWrapper(int index,
-                                          Tagged<Object> implicit_arg,
-                                          WasmCodePointer call_target,
-                                          wasm::CanonicalTypeIndex sig_id,
+  // {implicit_arg} has to be a WasmTrustedInstanceData, or Smi::zero() for
+  // clearing the slot.
+  void V8_EXPORT_PRIVATE SetForNonWrapper(
+      int index, Tagged<Union<Smi, WasmTrustedInstanceData>> implicit_arg,
+      WasmCodePointer call_target, wasm::CanonicalTypeIndex sig_id,
 #if V8_ENABLE_DRUMBRAKE
-                                          uint32_t function_index,
+      uint32_t function_index,
 #endif  // V8_ENABLE_DRUMBRAKE
-                                          NewOrExistingEntry new_or_existing);
+      NewOrExistingEntry new_or_existing);
 
   // Set an entry for indirect calls to a WasmToJS wrapper.
-  // {implicit_arg} has to be a WasmImportData, a WasmTrustedInstanceData.
   // {compiled_wrapper} needs to be set to the corresponding WasmCode, or
   // nullptr in case of the generic wrapper.
-  void V8_EXPORT_PRIVATE SetForWrapper(int index, Tagged<Object> implicit_arg,
-                                       Address call_target,
-                                       wasm::CanonicalTypeIndex sig_id,
-                                       uint64_t signature_hash,
+  void V8_EXPORT_PRIVATE SetForWrapper(
+      int index, Tagged<WasmImportData> implicit_arg, Address call_target,
+      wasm::CanonicalTypeIndex sig_id, uint64_t signature_hash,
 #if V8_ENABLE_DRUMBRAKE
-                                       uint32_t function_index,
+      uint32_t function_index,
 #endif  // V8_ENABLE_DRUMBRAKE
-                                       wasm::WasmCode* compiled_wrapper,
-                                       NewOrExistingEntry new_or_existing);
+      wasm::WasmCode* compiled_wrapper, NewOrExistingEntry new_or_existing);
 
 #if V8_ENABLE_DRUMBRAKE
   inline uint32_t function_index(int index) const;
@@ -953,7 +952,8 @@ class WasmDispatchTable : public ExposedTrustedObject {
       Isolate* isolate, DirectHandle<WasmDispatchTable> dispatch_table);
 
   static V8_EXPORT_PRIVATE V8_WARN_UNUSED_RESULT DirectHandle<WasmDispatchTable>
-  New(Isolate* isolate, int length, wasm::CanonicalValueType table_type);
+  New(Isolate* isolate, int length, wasm::CanonicalValueType table_type,
+      bool shared);
   static V8_WARN_UNUSED_RESULT DirectHandle<WasmDispatchTable> Grow(
       Isolate*, DirectHandle<WasmDispatchTable>, uint32_t new_length);
 
@@ -1435,7 +1435,8 @@ class WasmStruct : public TorqueGeneratedWasmStruct<WasmStruct, WasmObject> {
   // Only for structs whose type describes another type.
   static DirectHandle<WasmStruct> AllocateDescriptorUninitialized(
       Isolate* isolate, DirectHandle<WasmTrustedInstanceData> trusted_data,
-      wasm::ModuleTypeIndex index, DirectHandle<Map> map);
+      wasm::ModuleTypeIndex index, DirectHandle<Map> map,
+      DirectHandle<Object> first_field);
   inline Tagged<Map> get_described_rtt() const;
   inline void set_described_rtt(Tagged<Map> rtt);
 
@@ -1512,30 +1513,14 @@ class WasmArray : public TorqueGeneratedWasmArray<WasmArray, WasmObject> {
   TQ_OBJECT_CONSTRUCTORS(WasmArray)
 };
 
-// A wasm delimited continuation.
-class WasmContinuationObject
-    : public TorqueGeneratedWasmContinuationObject<WasmContinuationObject,
-                                                   HeapObject> {
+class WasmDescriptorOptions
+    : public TorqueGeneratedWasmDescriptorOptions<WasmDescriptorOptions,
+                                                  JSObject> {
  public:
-  static DirectHandle<WasmContinuationObject> New(
-      Isolate* isolate, wasm::StackMemory* stack,
-      wasm::JumpBuffer::StackState state,
-      AllocationType allocation_type = AllocationType::kYoung);
-  static DirectHandle<WasmContinuationObject> New(
-      Isolate* isolate, wasm::StackMemory* stack,
-      wasm::JumpBuffer::StackState state, DirectHandle<HeapObject> parent,
-      AllocationType allocation_type = AllocationType::kYoung);
-
-  DECL_EXTERNAL_POINTER_ACCESSORS(stack, Address)
-
-  DECL_PRINTER(WasmContinuationObject)
-
-  using BodyDescriptor = StackedBodyDescriptor<
-      FixedBodyDescriptorFor<WasmContinuationObject>,
-      WithExternalPointer<kStackOffset, kWasmStackMemoryTag>>;
-
- private:
-  TQ_OBJECT_CONSTRUCTORS(WasmContinuationObject)
+  static DirectHandle<WasmDescriptorOptions> New(
+      Isolate* isolate, DirectHandle<Object> prototype);
+  DECL_PRINTER(WasmDescriptorOptions)
+  TQ_OBJECT_CONSTRUCTORS(WasmDescriptorOptions)
 };
 
 // The suspender object provides an API to suspend and resume wasm code using
@@ -1544,8 +1529,11 @@ class WasmSuspenderObject
     : public TorqueGeneratedWasmSuspenderObject<WasmSuspenderObject,
                                                 HeapObject> {
  public:
-  using BodyDescriptor = FixedBodyDescriptorFor<WasmSuspenderObject>;
+  using BodyDescriptor = StackedBodyDescriptor<
+      FixedBodyDescriptorFor<WasmSuspenderObject>,
+      WithExternalPointer<kStackOffset, kWasmStackMemoryTag>>;
   enum State : int { kInactive = 0, kActive, kSuspended };
+  DECL_EXTERNAL_POINTER_ACCESSORS(stack, wasm::StackMemory*)
   DECL_PRINTER(WasmSuspenderObject)
   TQ_OBJECT_CONSTRUCTORS(WasmSuspenderObject)
 };
@@ -1588,9 +1576,13 @@ class WasmNull : public TorqueGeneratedWasmNull<WasmNull, HeapObject> {
 
 #undef DECL_OPTIONAL_ACCESSORS
 
-DirectHandle<Map> CreateStructMap(Isolate* isolate,
-                                  wasm::CanonicalTypeIndex type,
-                                  DirectHandle<Map> opt_rtt_parent);
+// If {opt_native_context} is not null, creates a contextful map bound to
+// that context; otherwise creates a context-independent map (which must then
+// not point to any context-specific objects!).
+DirectHandle<Map> CreateStructMap(
+    Isolate* isolate, wasm::CanonicalTypeIndex type,
+    DirectHandle<Map> opt_rtt_parent,
+    DirectHandle<NativeContext> opt_native_context);
 
 DirectHandle<Map> CreateArrayMap(Isolate* isolate,
                                  wasm::CanonicalTypeIndex array_index,
@@ -1598,7 +1590,8 @@ DirectHandle<Map> CreateArrayMap(Isolate* isolate,
 
 DirectHandle<Map> CreateFuncRefMap(Isolate* isolate,
                                    wasm::CanonicalTypeIndex type,
-                                   DirectHandle<Map> opt_rtt_parent);
+                                   DirectHandle<Map> opt_rtt_parent,
+                                   bool shared);
 
 namespace wasm {
 // Takes a {value} in the JS representation and typechecks it according to
diff --git a/deps/v8/src/wasm/wasm-objects.tq b/deps/v8/src/wasm/wasm-objects.tq
index 59d01295c2b0ad..1752e1bfe5d790 100644
--- a/deps/v8/src/wasm/wasm-objects.tq
+++ b/deps/v8/src/wasm/wasm-objects.tq
@@ -165,13 +165,8 @@ extern class WasmResumeData extends HeapObject {
   on_resume: Smi;  // See wasm::OnResume enum.
 }
 
-extern class WasmContinuationObject extends HeapObject {
-  parent: WasmContinuationObject|Undefined;
-  stack: ExternalPointer;
-}
-
 extern class WasmSuspenderObject extends HeapObject {
-  continuation: WasmContinuationObject|Undefined;
+  stack: ExternalPointer;
   parent: WasmSuspenderObject|Undefined;
   promise: JSPromise;
   resume: JSObject|Undefined;
@@ -301,6 +296,10 @@ extern class WasmArray extends WasmObject {
   @ifnot(TAGGED_SIZE_8_BYTES) optional_padding: void;
 }
 
+extern class WasmDescriptorOptions extends JSObject {
+  prototype: Object;
+}
+
 class WasmStringViewIter extends HeapObject {
   string: String;
   offset: uint32;  // Index into string.
diff --git a/deps/v8/src/wasm/wasm-opcodes.h b/deps/v8/src/wasm/wasm-opcodes.h
index bb9c91e9c49642..c529ee1eb61214 100644
--- a/deps/v8/src/wasm/wasm-opcodes.h
+++ b/deps/v8/src/wasm/wasm-opcodes.h
@@ -255,6 +255,14 @@ V8_EXPORT_PRIVATE bool IsJSCompatibleSignature(const CanonicalSig* sig);
   V(I64SExtendI16, 0xc3, l_l, "i64.extend16_s")          \
   V(I64SExtendI32, 0xc4, l_l, "i64.extend32_s")
 
+#define FOREACH_WASMFX_OPCODE(V)          \
+  V(ContNew, 0xe0, _, "cont.new")         \
+  V(ContBind, 0xe1, _, "cont.bind")       \
+  V(Suspend, 0xe2, _, "suspend")          \
+  V(Resume, 0xe3, _, "resume")            \
+  V(ResumeThrow, 0xe4, _, "resume_throw") \
+  V(Switch, 0xe5, _, "switch")
+
 #define FOREACH_SIMPLE_OPCODE(V)          \
   FOREACH_SIMPLE_EXTENDED_CONST_OPCODE(V) \
   FOREACH_SIMPLE_NON_CONST_OPCODE(V)
@@ -826,7 +834,8 @@ V8_EXPORT_PRIVATE bool IsJSCompatibleSignature(const CanonicalSig* sig);
   FOREACH_ATOMIC_OPCODE(V)           \
   FOREACH_ATOMIC_0_OPERAND_OPCODE(V) \
   FOREACH_NUMERIC_OPCODE(V)          \
-  FOREACH_GC_OPCODE(V)
+  FOREACH_GC_OPCODE(V)               \
+  FOREACH_WASMFX_OPCODE(V)
 
 // All signatures.
 #define FOREACH_SIGNATURE(V)                        \
diff --git a/deps/v8/src/wasm/wasm-serialization.cc b/deps/v8/src/wasm/wasm-serialization.cc
index c3034bd846c12e..d3d2aa8bba7586 100644
--- a/deps/v8/src/wasm/wasm-serialization.cc
+++ b/deps/v8/src/wasm/wasm-serialization.cc
@@ -220,6 +220,7 @@ constexpr size_t kCodeHeaderSize = sizeof(uint8_t) +  // code kind
                                    sizeof(int) +  // offset of safepoint table
                                    sizeof(int) +  // offset of handler table
                                    sizeof(int) +  // offset of code comments
+                                   sizeof(int) +  // offset of jump table info
                                    sizeof(int) +  // unpadded binary size
                                    sizeof(int) +  // stack slots
                                    sizeof(int) +  // ool slots
@@ -448,6 +449,7 @@ void NativeModuleSerializer::WriteCode(
   writer->Write(code->safepoint_table_offset());
   writer->Write(code->handler_table_offset());
   writer->Write(code->code_comments_offset());
+  writer->Write(code->jump_table_info_offset());
   writer->Write(code->unpadded_binary_size());
   writer->Write(code->stack_slots());
   writer->Write(code->ool_spills());
@@ -908,6 +910,7 @@ DeserializationUnit NativeModuleDeserializer::ReadCode(int fn_index,
   int safepoint_table_offset = reader->Read<int>();
   int handler_table_offset = reader->Read<int>();
   int code_comment_offset = reader->Read<int>();
+  int jump_table_info_offset = reader->Read<int>();
   int unpadded_binary_size = reader->Read<int>();
   int stack_slot_count = reader->Read<int>();
   int ool_spill_count = reader->Read<int>();
@@ -954,9 +957,9 @@ DeserializationUnit NativeModuleDeserializer::ReadCode(int fn_index,
   unit.code = native_module_->AddDeserializedCode(
       fn_index, instructions, stack_slot_count, ool_spill_count,
       tagged_parameter_slots, safepoint_table_offset, handler_table_offset,
-      constant_pool_offset, code_comment_offset, unpadded_binary_size,
-      protected_instructions, reloc_info, source_pos, inlining_pos, deopt_data,
-      kind, tier);
+      constant_pool_offset, code_comment_offset, jump_table_info_offset,
+      unpadded_binary_size, protected_instructions, reloc_info, source_pos,
+      inlining_pos, deopt_data, kind, tier);
   unit.jump_tables = current_jump_tables_;
   return unit;
 }
diff --git a/deps/v8/src/wasm/wrappers.cc b/deps/v8/src/wasm/wrappers.cc
index 1df44f104b78d2..dcd6e43859337c 100644
--- a/deps/v8/src/wasm/wrappers.cc
+++ b/deps/v8/src/wasm/wrappers.cc
@@ -934,14 +934,14 @@ class WasmWrapperTSGraphBuilder : public WasmGraphBuilderBase {
                : __ Call(target, {input, context}, ts_call_descriptor);
   }
 
-  OpIndex FromJS(OpIndex input, OpIndex context, CanonicalValueType type,
+  OpIndex FromJS(V<Object> input, OpIndex context, CanonicalValueType type,
                  OptionalOpIndex frame_state = {}) {
     switch (type.kind()) {
       case kRef:
       case kRefNull: {
         switch (type.heap_representation_non_shared()) {
           // TODO(14034): Add more fast paths?
-          case HeapType::kExtern:
+          case HeapType::kExtern: {
             if (type.kind() == kRef) {
               IF (UNLIKELY(__ TaggedEqual(input, LOAD_ROOT(NullValue)))) {
                 CallRuntime(__ phase_zone(), Runtime::kWasmThrowJSTypeError, {},
@@ -949,7 +949,31 @@ class WasmWrapperTSGraphBuilder : public WasmGraphBuilderBase {
                 __ Unreachable();
               }
             }
+            if (v8_flags.experimental_wasm_shared &&
+                type.heap_representation() == HeapType::kExternShared) {
+              Label<Object> done(&asm_);
+              IF_NOT (__ IsSmi(input)) {
+                V<WordPtr> flags = __ LoadPageFlags(V<HeapObject>::Cast(input));
+                V<WordPtr> shared_or_read_only = __ WordPtrBitwiseAnd(
+                    flags, static_cast<uintptr_t>(
+                               MemoryChunk::IN_WRITABLE_SHARED_SPACE |
+                               MemoryChunk::READ_ONLY_HEAP));
+                IF (UNLIKELY(__ WordPtrEqual(shared_or_read_only, 0))) {
+                  // If it isn't shared, yet, use the runtime function.
+                  std::initializer_list<const OpIndex> inputs = {
+                      input, __ IntPtrConstant(IntToSmi(
+                                 static_cast<int>(type.raw_bit_field())))};
+                  GOTO(done, CallRuntime(__ phase_zone(),
+                                         Runtime::kWasmJSToWasmObject, inputs,
+                                         context));
+                }
+              }
+              GOTO(done, input);
+              BIND(done, result);
+              return result;
+            }
             return input;
+          }
           case HeapType::kString:
             return BuildCheckString(input, context, type);
           case HeapType::kExn:
@@ -1130,102 +1154,6 @@ class WasmWrapperTSGraphBuilder : public WasmGraphBuilderBase {
                    JSFunction::kContextOffset);
   }
 
-  void BuildSetNewStackLimit(V<WordPtr> old_limit, V<WordPtr> new_limit) {
-    // Set the new interrupt limit and real limit. Use a compare-and-swap for
-    // the interrupt limit to avoid overwriting a pending interrupt.
-    __ AtomicCompareExchange(
-        __ IsolateField(IsolateFieldId::kJsLimitAddress), __ UintPtrConstant(0),
-        old_limit, new_limit, RegisterRepresentation::WordPtr(),
-        MemoryRepresentation::UintPtr(), compiler::MemoryAccessKind::kNormal);
-    __ Store(__ LoadRootRegister(), new_limit, StoreOp::Kind::RawAligned(),
-             MemoryRepresentation::UintPtr(), compiler::kNoWriteBarrier,
-             IsolateData::real_jslimit_offset());
-  }
-
-  V<WordPtr> BuildSwitchToTheCentralStack(V<WordPtr> old_limit) {
-    // Set the is_on_central_stack flag.
-    OpIndex isolate_root = __ LoadRootRegister();
-    __ Store(isolate_root, __ Word32Constant(1), LoadOp::Kind::RawAligned(),
-             MemoryRepresentation::Uint8(), compiler::kNoWriteBarrier,
-             IsolateData::is_on_central_stack_flag_offset());
-
-    // Save the old fp and the target sp in the StackMemory's stack switch info.
-    // We are not on the main stack, so the ActiveContinuation root must exist
-    // and be of type WasmContinuationObject.
-    V<WasmContinuationObject> active_continuation =
-        V<WasmContinuationObject>::Cast(LOAD_ROOT(ActiveContinuation));
-    V<WordPtr> stack_data = __ LoadExternalPointerFromObject(
-        active_continuation, WasmContinuationObject::kStackOffset,
-        kWasmStackMemoryTag);
-    __ Store(stack_data, __ FramePointer(), StoreOp::Kind::RawAligned(),
-             MemoryRepresentation::UintPtr(), compiler::kNoWriteBarrier,
-             StackMemory::stack_switch_source_fp_offset());
-    V<WordPtr> central_stack_sp = __ Load(
-        isolate_root, LoadOp::Kind::RawAligned(),
-        MemoryRepresentation::UintPtr(), Isolate::central_stack_sp_offset());
-    __ Store(stack_data, central_stack_sp, StoreOp::Kind::RawAligned(),
-             MemoryRepresentation::UintPtr(), compiler::kNoWriteBarrier,
-             StackMemory::stack_switch_target_sp_offset());
-
-    // Switch the stack limit and the stack pointer.
-    V<WordPtr> central_stack_limit = __ Load(
-        isolate_root, LoadOp::Kind::RawAligned(),
-        MemoryRepresentation::UintPtr(), Isolate::central_stack_limit_offset());
-    BuildSetNewStackLimit(old_limit, central_stack_limit);
-    OpIndex old_sp = __ LoadStackPointer();
-    __ SetStackPointer(central_stack_sp);
-    return old_sp;
-  }
-
-  // Returns the old (secondary stack's) sp and stack limit.
-  std::pair<V<WordPtr>, V<WordPtr>> BuildSwitchToTheCentralStackIfNeeded() {
-    V<WordPtr> isolate_root = __ LoadRootRegister();
-    V<Word32> is_on_central_stack_flag = __ Load(
-        isolate_root, LoadOp::Kind::RawAligned(), MemoryRepresentation::Uint8(),
-        IsolateData::is_on_central_stack_flag_offset());
-    ScopedVar<WordPtr> old_sp_var(this, __ IntPtrConstant(0));
-    ScopedVar<WordPtr> old_limit_var(this, __ IntPtrConstant(0));
-    IF_NOT (LIKELY(is_on_central_stack_flag)) {
-      V<WordPtr> old_limit = __ Load(isolate_root, LoadOp::Kind::RawAligned(),
-                                     MemoryRepresentation::UintPtr(),
-                                     IsolateData::real_jslimit_offset());
-      V<WordPtr> old_sp = BuildSwitchToTheCentralStack(old_limit);
-      old_sp_var = old_sp;
-      old_limit_var = old_limit;
-    }
-    return {old_sp_var, old_limit_var};
-  }
-
-  void BuildSwitchBackFromCentralStack(V<WordPtr> old_sp,
-                                       V<WordPtr> old_limit) {
-    IF_NOT (LIKELY(__ WordPtrEqual(old_sp, __ IntPtrConstant(0)))) {
-      // Reset is_on_central_stack flag.
-      V<WordPtr> isolate_root = __ LoadRootRegister();
-      __ Store(isolate_root, __ Word32Constant(0), StoreOp::Kind::RawAligned(),
-               MemoryRepresentation::Uint8(), compiler::kNoWriteBarrier,
-               IsolateData::is_on_central_stack_flag_offset());
-
-      // Clear stack switch info.
-      // We are not on the main stack, so the ActiveContinuation root must exist
-      // and be of type WasmContinuationObject.
-      auto active_continuation =
-          V<WasmContinuationObject>::Cast(LOAD_ROOT(ActiveContinuation));
-      V<WordPtr> stack_data = __ LoadExternalPointerFromObject(
-          active_continuation, WasmContinuationObject::kStackOffset,
-          kWasmStackMemoryTag);
-      __ Store(stack_data, __ UintPtrConstant(0), StoreOp::Kind::RawAligned(),
-               MemoryRepresentation::UintPtr(), compiler::kNoWriteBarrier,
-               StackMemory::stack_switch_source_fp_offset());
-
-      // Restore the old stack limit and stack pointer.
-      V<WordPtr> real_jslimit = __ Load(
-          isolate_root, LoadOp::Kind::RawAligned(),
-          MemoryRepresentation::UintPtr(), IsolateData::real_jslimit_offset());
-      BuildSetNewStackLimit(real_jslimit, old_limit);
-      __ SetStackPointer(old_sp);
-    }
-  }
-
   V<Object> BuildSuspend(V<Object> value, V<Object> import_data,
                          V<WordPtr>* old_sp, V<WordPtr> old_limit) {
     // If value is a promise, suspend to the js-to-wasm prompt, and resume later
diff --git a/deps/v8/src/zone/accounting-allocator.cc b/deps/v8/src/zone/accounting-allocator.cc
index e0fe5a58e5df8f..08da1756261ed6 100644
--- a/deps/v8/src/zone/accounting-allocator.cc
+++ b/deps/v8/src/zone/accounting-allocator.cc
@@ -9,6 +9,9 @@
 #include "src/base/bounded-page-allocator.h"
 #include "src/base/logging.h"
 #include "src/base/macros.h"
+#include "src/execution/isolate.h"
+#include "src/flags/flags.h"
+#include "src/heap/page-pool.h"
 #include "src/utils/allocation.h"
 #include "src/zone/zone-compression.h"
 #include "src/zone/zone-segment.h"
@@ -23,84 +26,184 @@ const size_t ZoneCompression::kReservationAlignment;
 
 namespace {
 
-static constexpr size_t kZonePageSize = 256 * KB;
+// TODO(409953791): Deprecated and should be removed.
+class CompressedZones final {
+ public:
+  static VirtualMemory ReserveAddressSpace(
+      v8::PageAllocator* platform_allocator) {
+    DCHECK(IsAligned(ZoneCompression::kReservationSize,
+                     platform_allocator->AllocatePageSize()));
+
+    void* hint = reinterpret_cast<void*>(RoundDown(
+        reinterpret_cast<uintptr_t>(platform_allocator->GetRandomMmapAddr()),
+        ZoneCompression::kReservationAlignment));
+
+    VirtualMemory memory(platform_allocator, ZoneCompression::kReservationSize,
+                         hint, ZoneCompression::kReservationAlignment);
+    if (memory.IsReserved()) {
+      CHECK(
+          IsAligned(memory.address(), ZoneCompression::kReservationAlignment));
+      return memory;
+    }
+
+    base::FatalOOM(base::OOMType::kProcess,
+                   "Failed to reserve memory for compressed zones");
+    UNREACHABLE();
+  }
+
+  static std::unique_ptr<v8::base::BoundedPageAllocator> CreateBoundedAllocator(
+      v8::PageAllocator* platform_allocator, Address reservation_start) {
+    CHECK(reservation_start);
+    CHECK(IsAligned(reservation_start, ZoneCompression::kReservationAlignment));
+
+    auto allocator = std::make_unique<v8::base::BoundedPageAllocator>(
+        platform_allocator, reservation_start,
+        ZoneCompression::kReservationSize, kZonePageSize,
+        base::PageInitializationMode::kAllocatedPagesCanBeUninitialized,
+        base::PageFreeingMode::kMakeInaccessible);
+
+    // Exclude first page from allocation to ensure that accesses through
+    // decompressed null pointer will seg-fault.
+    allocator->AllocatePagesAt(reservation_start, kZonePageSize,
+                               v8::PageAllocator::kNoAccess);
+    return allocator;
+  }
 
-VirtualMemory ReserveAddressSpace(v8::PageAllocator* platform_allocator) {
-  DCHECK(IsAligned(ZoneCompression::kReservationSize,
-                   platform_allocator->AllocatePageSize()));
+  static std::pair<std::unique_ptr<VirtualMemory>,
+                   std::unique_ptr<base::BoundedPageAllocator>>
+  Initialize() {
+    v8::PageAllocator* platform_page_allocator = GetPlatformPageAllocator();
+    VirtualMemory memory =
+        CompressedZones::ReserveAddressSpace(platform_page_allocator);
+
+    auto virtual_memory = std::make_unique<VirtualMemory>(std::move(memory));
+    auto bounded_page_allocator = CompressedZones::CreateBoundedAllocator(
+        platform_page_allocator, virtual_memory->address());
+    return std::make_pair(std::move(virtual_memory),
+                          std::move(bounded_page_allocator));
+  }
+
+  static base::AllocationResult<void*> AllocateSegment(
+      v8::base::BoundedPageAllocator* bounded_page_allocator, size_t bytes) {
+    bytes = RoundUp(bytes, CompressedZones::kZonePageSize);
+    void* memory = AllocatePages(bounded_page_allocator, nullptr, bytes,
+                                 CompressedZones::kZonePageSize,
+                                 PageAllocator::kReadWrite);
+    return {memory, bytes};
+  }
+
+  static void ReturnSegment(
+      v8::base::BoundedPageAllocator* bounded_page_allocator, void* memory,
+      size_t bytes) {
+    FreePages(bounded_page_allocator, memory, bytes);
+  }
 
-  void* hint = reinterpret_cast<void*>(RoundDown(
-      reinterpret_cast<uintptr_t>(platform_allocator->GetRandomMmapAddr()),
-      ZoneCompression::kReservationAlignment));
+ private:
+  static constexpr size_t kZonePageSize = 256 * KB;
+};
+
+class ManagedZones final {
+ public:
+  static std::optional<VirtualMemory> GetOrCreateMemoryForSegment(
+      Isolate* isolate, size_t bytes) {
+    DCHECK_EQ(0, bytes % kMinZonePageSize);
+    // Only consult the pool if we have an isolate and the size is exactly the
+    // zone page size. Larger sizes may be required and just bypass the pool.
+    if (isolate && bytes == kMinZonePageSize) {
+      auto maybe_reservation =
+          IsolateGroup::current()->page_pool()->RemoveZoneReservation(isolate);
+      if (maybe_reservation) {
+        return maybe_reservation;
+      }
+    }
 
-  VirtualMemory memory(platform_allocator, ZoneCompression::kReservationSize,
-                       hint, ZoneCompression::kReservationAlignment);
-  if (memory.IsReserved()) {
-    CHECK(IsAligned(memory.address(), ZoneCompression::kReservationAlignment));
+    v8::PageAllocator* platform_page_allocator = GetPlatformPageAllocator();
+    VirtualMemory memory(platform_page_allocator, bytes, nullptr,
+                         kMinZonePageAlignment, v8::PageAllocator::kReadWrite);
+    if (V8_UNLIKELY(!memory.IsReserved())) {
+      return std::nullopt;
+    }
+    CHECK(IsAligned(memory.address(), kMinZonePageAlignment));
     return memory;
   }
 
-  base::FatalOOM(base::OOMType::kProcess,
-                 "Failed to reserve memory for compressed zones");
-  UNREACHABLE();
-}
+  static base::AllocationResult<void*> AllocateSegment(Isolate* isolate,
+                                                       size_t bytes) {
+    static constexpr size_t kMaxSize = size_t{2} * GB;
+    if (bytes >= kMaxSize) {
+      return {nullptr, bytes};
+    }
+    void* memory = nullptr;
+    bytes = RoundUp(bytes, ManagedZones::kMinZonePageSize);
+    std::optional<VirtualMemory> maybe_reservation =
+        ManagedZones::GetOrCreateMemoryForSegment(isolate, bytes);
+    if (V8_LIKELY(maybe_reservation)) {
+      VirtualMemory reservation = std::move(maybe_reservation.value());
+      DCHECK(reservation.IsReserved());
+      DCHECK_EQ(reservation.size(), bytes);
+      memory = reinterpret_cast<void*>(reservation.address());
+      // Don't let the reservation be freed by destructor. From now on the
+      // reservation will be managed via a pair {memory, bytes}.
+      reservation.Reset();
+    }
+    return {memory, bytes};
+  }
 
-std::unique_ptr<v8::base::BoundedPageAllocator> CreateBoundedAllocator(
-    v8::PageAllocator* platform_allocator, Address reservation_start) {
-  CHECK(reservation_start);
-  CHECK(IsAligned(reservation_start, ZoneCompression::kReservationAlignment));
-
-  auto allocator = std::make_unique<v8::base::BoundedPageAllocator>(
-      platform_allocator, reservation_start, ZoneCompression::kReservationSize,
-      kZonePageSize,
-      base::PageInitializationMode::kAllocatedPagesCanBeUninitialized,
-      base::PageFreeingMode::kMakeInaccessible);
-
-  // Exclude first page from allocation to ensure that accesses through
-  // decompressed null pointer will seg-fault.
-  allocator->AllocatePagesAt(reservation_start, kZonePageSize,
-                             v8::PageAllocator::kNoAccess);
-  return allocator;
-}
+  static void ReturnSegment(Isolate* isolate, void* memory, size_t bytes) {
+    VirtualMemory reservation(GetPlatformPageAllocator(),
+                              reinterpret_cast<Address>(memory), bytes);
+    if (reservation.size() == ManagedZones::kMinZonePageSize) {
+      IsolateGroup::current()->page_pool()->AddZoneReservation(
+          isolate, std::move(reservation));
+    }
+    // Reservation will be automatically freed here otherwise.
+  }
+
+ private:
+  static constexpr size_t kMinZonePageSize = 64 * KB;
+  static constexpr size_t kMinZonePageAlignment = 16 * KB;
+};
 
 }  // namespace
 
-AccountingAllocator::AccountingAllocator() {
+AccountingAllocator::AccountingAllocator() : AccountingAllocator(nullptr) {}
+
+AccountingAllocator::AccountingAllocator(Isolate* isolate) : isolate_(isolate) {
+  CHECK_IMPLIES(COMPRESS_ZONES_BOOL, !v8_flags.managed_zone_memory);
   if (COMPRESS_ZONES_BOOL) {
-    v8::PageAllocator* platform_page_allocator = GetPlatformPageAllocator();
-    VirtualMemory memory = ReserveAddressSpace(platform_page_allocator);
-    reserved_area_ = std::make_unique<VirtualMemory>(std::move(memory));
-    bounded_page_allocator_ = CreateBoundedAllocator(platform_page_allocator,
-                                                     reserved_area_->address());
+    std::tie(reserved_area_, bounded_page_allocator_) =
+        CompressedZones::Initialize();
   }
 }
 
 AccountingAllocator::~AccountingAllocator() = default;
 
-Segment* AccountingAllocator::AllocateSegment(size_t bytes,
+Segment* AccountingAllocator::AllocateSegment(size_t requested_bytes,
                                               bool supports_compression) {
-  void* memory;
+  base::AllocationResult<void*> memory;
   if (COMPRESS_ZONES_BOOL && supports_compression) {
-    bytes = RoundUp(bytes, kZonePageSize);
-    memory = AllocatePages(bounded_page_allocator_.get(), nullptr, bytes,
-                           kZonePageSize, PageAllocator::kReadWrite);
+    memory = CompressedZones::AllocateSegment(bounded_page_allocator_.get(),
+                                              requested_bytes);
 
+  } else if (v8_flags.managed_zone_memory && isolate_) {
+    memory = ManagedZones::AllocateSegment(isolate_, requested_bytes);
   } else {
-    auto result = AllocAtLeastWithRetry(bytes);
-    memory = result.ptr;
-    bytes = result.count;
+    memory = AllocAtLeastWithRetry(requested_bytes);
+  }
+  if (V8_UNLIKELY(memory.ptr == nullptr)) {
+    return nullptr;
   }
-  if (memory == nullptr) return nullptr;
 
   size_t current =
-      current_memory_usage_.fetch_add(bytes, std::memory_order_relaxed) + bytes;
+      current_memory_usage_.fetch_add(memory.count, std::memory_order_relaxed) +
+      memory.count;
   size_t max = max_memory_usage_.load(std::memory_order_relaxed);
   while (current > max && !max_memory_usage_.compare_exchange_weak(
                               max, current, std::memory_order_relaxed)) {
     // {max} was updated by {compare_exchange_weak}; retry.
   }
-  DCHECK_LE(sizeof(Segment), bytes);
-  return new (memory) Segment(bytes);
+  DCHECK_LE(sizeof(Segment), memory.count);
+  return new (memory.ptr) Segment(memory.count);
 }
 
 void AccountingAllocator::ReturnSegment(Segment* segment,
@@ -110,7 +213,10 @@ void AccountingAllocator::ReturnSegment(Segment* segment,
   current_memory_usage_.fetch_sub(segment_size, std::memory_order_relaxed);
   segment->ZapHeader();
   if (COMPRESS_ZONES_BOOL && supports_compression) {
-    FreePages(bounded_page_allocator_.get(), segment, segment_size);
+    CompressedZones::ReturnSegment(bounded_page_allocator_.get(), segment,
+                                   segment_size);
+  } else if (isolate_ && v8_flags.managed_zone_memory) {
+    ManagedZones::ReturnSegment(isolate_, segment, segment_size);
   } else {
     free(segment);
   }
diff --git a/deps/v8/src/zone/accounting-allocator.h b/deps/v8/src/zone/accounting-allocator.h
index 4e1f9442ff45e2..44039a35db379d 100644
--- a/deps/v8/src/zone/accounting-allocator.h
+++ b/deps/v8/src/zone/accounting-allocator.h
@@ -20,6 +20,7 @@ class BoundedPageAllocator;
 
 namespace internal {
 
+class Isolate;
 class Segment;
 class VirtualMemory;
 class Zone;
@@ -27,6 +28,7 @@ class Zone;
 class V8_EXPORT_PRIVATE AccountingAllocator {
  public:
   AccountingAllocator();
+  explicit AccountingAllocator(Isolate* isolate);
   AccountingAllocator(const AccountingAllocator&) = delete;
   AccountingAllocator& operator=(const AccountingAllocator&) = delete;
   virtual ~AccountingAllocator();
@@ -66,7 +68,10 @@ class V8_EXPORT_PRIVATE AccountingAllocator {
   virtual void TraceZoneDestructionImpl(const Zone* zone) {}
   virtual void TraceAllocateSegmentImpl(Segment* segment) {}
 
+  Isolate* isolate() const { return isolate_; }
+
  private:
+  Isolate* const isolate_ = nullptr;
   std::atomic<size_t> current_memory_usage_{0};
   std::atomic<size_t> max_memory_usage_{0};
 
diff --git a/deps/v8/src/zone/zone.cc b/deps/v8/src/zone/zone.cc
index bb7ecf7756632b..da36b616a0112b 100644
--- a/deps/v8/src/zone/zone.cc
+++ b/deps/v8/src/zone/zone.cc
@@ -153,6 +153,9 @@ void Zone::Expand(size_t size) {
   // strategy, where we increase the segment size every time we expand
   // except that we employ a maximum segment size when we delete. This
   // is to avoid excessive malloc() and free() overhead.
+  //
+  // TODO(409953791): This can be simplified when using the page pool for
+  // managing zone memory as it works with equal-sized segments.
   Segment* head = segment_head_;
   const size_t old_size = head ? head->total_size() : 0;
   static const size_t kSegmentOverhead = sizeof(Segment) + kAlignmentInBytes;
diff --git a/deps/v8/test/BUILD.gn b/deps/v8/test/BUILD.gn
index 6604cb9631a469..c8d000c44edfc0 100644
--- a/deps/v8/test/BUILD.gn
+++ b/deps/v8/test/BUILD.gn
@@ -9,6 +9,7 @@ group("gn_all") {
 
   data_deps = [
     "benchmarks:v8_benchmarks",
+    "filecheck:v8_filecheck",
     "fuzzer:v8_fuzzer",
     "intl:v8_intl",
     "message:v8_message",
@@ -92,6 +93,7 @@ group("v8_bot_default") {
   data_deps = [
     "cctest:cctest",
     "debugger:v8_debugger",
+    "filecheck:v8_filecheck",
     "fuzzer:v8_fuzzer",
     "inspector:inspector-test",
     "intl:v8_intl",
@@ -117,6 +119,7 @@ group("v8_default") {
   data_deps = [
     "cctest:cctest",
     "debugger:v8_debugger",
+    "filecheck:v8_filecheck",
     "fuzzer:v8_fuzzer",
     "inspector:inspector-test",
     "intl:v8_intl",
@@ -153,6 +156,7 @@ group("v8_d8_default") {
 
   data_deps = [
     "debugger:v8_debugger",
+    "filecheck:v8_filecheck",
     "intl:v8_intl",
     "message:v8_message",
     "mjsunit:v8_mjsunit",
diff --git a/deps/v8/test/cctest/cctest.status b/deps/v8/test/cctest/cctest.status
index cfa2014fdacccb..070f503e6da355 100644
--- a/deps/v8/test/cctest/cctest.status
+++ b/deps/v8/test/cctest/cctest.status
@@ -297,8 +297,14 @@
   'test-api/Threading8': [SKIP],
   'test-concurrent-allocation/ConcurrentAllocationInLargeSpace': [SKIP],
   'test-heap/TestInternalWeakLists': [SKIP],
+  'test-serialize/ContextSerializerContext': [SKIP],
+  'test-serialize/ContextSerializerCustomContext': [SKIP],
+  'test-serialize/SharedStrings': [SKIP],
   'test-serialize/StartupSerializerOnce': [SKIP],
   'test-serialize/StartupSerializerTwice': [SKIP],
+
+  # https://issues.chromium.org/issues/407932138
+  'test-cpu-profiler/NoProfilingProtectorCPUProfiler': [SKIP],
 }],  # 'full_debug'
 
 ##############################################################################
@@ -849,10 +855,10 @@
   'test-run-unwinding-info/RunUnwindingInfo': [SKIP],
 }],
 
-['conservative_stack_scanning', {
+['direct_handle', {
   # Needs --predictable.
   'test-serialize/StaticRootsPredictableSnapshot': [SKIP],
-}],  # conservative_stack_scanning
+}],  # direct_handle
 
 ['clang_coverage and mode == debug', {
   # Too slow tests.
diff --git a/deps/v8/test/cctest/compiler/function-tester.cc b/deps/v8/test/cctest/compiler/function-tester.cc
index 8404c265aa28a9..6189c332bf2f44 100644
--- a/deps/v8/test/cctest/compiler/function-tester.cc
+++ b/deps/v8/test/cctest/compiler/function-tester.cc
@@ -37,7 +37,7 @@ FunctionTester::FunctionTester(DirectHandle<Code> code, int param_count)
   CHECK(!code.is_null());
   CHECK(IsCode(*code));
   Compile(function);
-  function->UpdateCode(*code);
+  function->UpdateCode(isolate, *code);
 }
 
 FunctionTester::FunctionTester(DirectHandle<Code> code)
diff --git a/deps/v8/test/cctest/compiler/test-js-context-specialization.cc b/deps/v8/test/cctest/compiler/test-js-context-specialization.cc
index 67699a17907d3f..cbd9ef01b49113 100644
--- a/deps/v8/test/cctest/compiler/test-js-context-specialization.cc
+++ b/deps/v8/test/cctest/compiler/test-js-context-specialization.cc
@@ -153,7 +153,7 @@ Handle<Context> NewCanonicalContextForTesting(ContextSpecializationTester& t,
 
 static const int slot_index = 5;
 
-TEST(ReduceJSLoadContext0) {
+TEST(ReduceJSLoadContextNoCell0) {
   ContextSpecializationTester t(Nothing<OuterContext>());
 
   Node* start = t.graph()->NewNode(t.common()->Start(0));
@@ -166,7 +166,7 @@ TEST(ReduceJSLoadContext0) {
   DirectHandle<Object> expected =
       t.CanonicalHandle(*t.factory()->InternalizeUtf8String("gboy!"));
   const int slot = 5;
-  native->set(slot, *expected);
+  native->SetNoCell(slot, *expected);
 
   Node* const_context =
       t.jsgraph()->ConstantNoHole(MakeRef(t.broker(), native), t.broker());
@@ -176,25 +176,26 @@ TEST(ReduceJSLoadContext0) {
 
   {
     // Mutable slot, constant context, depth = 0 => do nothing.
-    Node* load = t.graph()->NewNode(t.javascript()->LoadContext(0, 0, false),
-                                    const_context, start);
+    Node* load = t.graph()->NewNode(
+        t.javascript()->LoadContextNoCell(0, 0, false), const_context, start);
     Reduction r = t.spec()->Reduce(load);
     CHECK(!r.Changed());
   }
 
   {
     // Mutable slot, non-constant context, depth = 0 => do nothing.
-    Node* load = t.graph()->NewNode(t.javascript()->LoadContext(0, 0, false),
-                                    param_context, start);
+    Node* load = t.graph()->NewNode(
+        t.javascript()->LoadContextNoCell(0, 0, false), param_context, start);
     Reduction r = t.spec()->Reduce(load);
     CHECK(!r.Changed());
   }
 
   {
     // Mutable slot, constant context, depth > 0 => fold-in parent context.
-    Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(2, Context::GLOBAL_EVAL_FUN_INDEX, false),
-        deep_const_context, start);
+    Node* load =
+        t.graph()->NewNode(t.javascript()->LoadContextNoCell(
+                               2, Context::GLOBAL_EVAL_FUN_INDEX, false),
+                           deep_const_context, start);
     Reduction r = t.spec()->Reduce(load);
     CHECK(r.Changed());
     Node* new_context_input = NodeProperties::GetContextInput(r.replacement());
@@ -209,8 +210,8 @@ TEST(ReduceJSLoadContext0) {
 
   {
     // Immutable slot, constant context, depth = 0 => specialize.
-    Node* load = t.graph()->NewNode(t.javascript()->LoadContext(0, slot, true),
-                                    const_context, start);
+    Node* load = t.graph()->NewNode(
+        t.javascript()->LoadContextNoCell(0, slot, true), const_context, start);
     Reduction r = t.spec()->Reduce(load);
     CHECK(r.Changed());
     CHECK(r.replacement() != load);
@@ -221,10 +222,10 @@ TEST(ReduceJSLoadContext0) {
   }
 
   // Clean up so that verifiers don't complain.
-  native->set(slot, Smi::zero());
+  native->SetNoCell(slot, Smi::zero());
 }
 
-TEST(ReduceJSLoadContext1) {
+TEST(ReduceJSLoadContextNoCell1) {
   // The graph's context chain ends in the incoming context parameter:
   //
   //   context2 <-- context1 <-- context0 (= Parameter(0))
@@ -245,54 +246,62 @@ TEST(ReduceJSLoadContext1) {
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(0, slot_index, false), context2, start);
+        t.javascript()->LoadContextNoCell(0, slot_index, false), context2,
+        start);
     CHECK(!t.spec()->Reduce(load).Changed());
   }
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(0, slot_index, true), context2, start);
+        t.javascript()->LoadContextNoCell(0, slot_index, true), context2,
+        start);
     CHECK(!t.spec()->Reduce(load).Changed());
   }
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(1, slot_index, false), context2, start);
+        t.javascript()->LoadContextNoCell(1, slot_index, false), context2,
+        start);
     t.CheckContextInputAndDepthChanges(load, context1, 0);
   }
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(1, slot_index, true), context2, start);
+        t.javascript()->LoadContextNoCell(1, slot_index, true), context2,
+        start);
     t.CheckContextInputAndDepthChanges(load, context1, 0);
   }
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(2, slot_index, false), context2, start);
+        t.javascript()->LoadContextNoCell(2, slot_index, false), context2,
+        start);
     t.CheckContextInputAndDepthChanges(load, context0, 0);
   }
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(2, slot_index, true), context2, start);
+        t.javascript()->LoadContextNoCell(2, slot_index, true), context2,
+        start);
     t.CheckContextInputAndDepthChanges(load, context0, 0);
   }
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(3, slot_index, false), context2, start);
+        t.javascript()->LoadContextNoCell(3, slot_index, false), context2,
+        start);
     t.CheckContextInputAndDepthChanges(load, context0, 1);
   }
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(3, slot_index, true), context2, start);
+        t.javascript()->LoadContextNoCell(3, slot_index, true), context2,
+        start);
     t.CheckContextInputAndDepthChanges(load, context0, 1);
   }
 }
 
-TEST(ReduceJSLoadContext2) {
+TEST(ReduceJSLoadContextNoCell2) {
   // The graph's context chain ends in a constant context (context_object1),
   // which has another outer context (context_object0).
   //
@@ -329,61 +338,67 @@ TEST(ReduceJSLoadContext2) {
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(0, slot_index, false), context2, start);
+        t.javascript()->LoadContextNoCell(0, slot_index, false), context2,
+        start);
     CHECK(!t.spec()->Reduce(load).Changed());
   }
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(0, slot_index, true), context2, start);
+        t.javascript()->LoadContextNoCell(0, slot_index, true), context2,
+        start);
     CHECK(!t.spec()->Reduce(load).Changed());
   }
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(1, slot_index, false), context2, start);
+        t.javascript()->LoadContextNoCell(1, slot_index, false), context2,
+        start);
     t.CheckContextInputAndDepthChanges(load, context1, 0);
   }
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(1, slot_index, true), context2, start);
+        t.javascript()->LoadContextNoCell(1, slot_index, true), context2,
+        start);
     t.CheckContextInputAndDepthChanges(load, context1, 0);
   }
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(2, slot_index, false), context2, start);
+        t.javascript()->LoadContextNoCell(2, slot_index, false), context2,
+        start);
     t.CheckContextInputAndDepthChanges(load, context0, 0);
   }
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(2, Context::EXTENSION_INDEX, true),
+        t.javascript()->LoadContextNoCell(2, Context::EXTENSION_INDEX, true),
         context2, start);
     t.CheckChangesToValue(load, slot_value1);
   }
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(3, slot_index, false), context2, start);
+        t.javascript()->LoadContextNoCell(3, slot_index, false), context2,
+        start);
     t.CheckContextInputAndDepthChanges(load, context_object0, 0);
   }
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(3, Context::EXTENSION_INDEX, true),
+        t.javascript()->LoadContextNoCell(3, Context::EXTENSION_INDEX, true),
         context2, start);
     t.CheckChangesToValue(load, slot_value0);
   }
 }
 
-TEST(ReduceJSLoadContext3) {
-  // Like in ReduceJSLoadContext1, the graph's context chain ends in the
+TEST(ReduceJSLoadContextNoCell3) {
+  // Like in ReduceJSLoadContextNoCell1, the graph's context chain ends in the
   // incoming context parameter.  However, this time we provide a concrete
   // context for this parameter as the "specialization context".  We choose
-  // context_object2 from ReduceJSLoadContext2 for this, so almost all test
-  // expectations are the same as in ReduceJSLoadContext2.
+  // context_object2 from ReduceJSLoadContextNoCell2 for this, so almost all
+  // test expectations are the same as in ReduceJSLoadContextNoCell2.
 
   HandleAndZoneScope handle_zone_scope;
   auto isolate = handle_zone_scope.main_isolate();
@@ -418,56 +433,62 @@ TEST(ReduceJSLoadContext3) {
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(0, slot_index, false), context2, start);
+        t.javascript()->LoadContextNoCell(0, slot_index, false), context2,
+        start);
     CHECK(!t.spec()->Reduce(load).Changed());
   }
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(0, slot_index, true), context2, start);
+        t.javascript()->LoadContextNoCell(0, slot_index, true), context2,
+        start);
     CHECK(!t.spec()->Reduce(load).Changed());
   }
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(1, slot_index, false), context2, start);
+        t.javascript()->LoadContextNoCell(1, slot_index, false), context2,
+        start);
     t.CheckContextInputAndDepthChanges(load, context1, 0);
   }
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(1, slot_index, true), context2, start);
+        t.javascript()->LoadContextNoCell(1, slot_index, true), context2,
+        start);
     t.CheckContextInputAndDepthChanges(load, context1, 0);
   }
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(2, slot_index, false), context2, start);
+        t.javascript()->LoadContextNoCell(2, slot_index, false), context2,
+        start);
     t.CheckContextInputAndDepthChanges(load, context_object1, 0);
   }
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(2, Context::EXTENSION_INDEX, true),
+        t.javascript()->LoadContextNoCell(2, Context::EXTENSION_INDEX, true),
         context2, start);
     t.CheckChangesToValue(load, slot_value1);
   }
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(3, slot_index, false), context2, start);
+        t.javascript()->LoadContextNoCell(3, slot_index, false), context2,
+        start);
     t.CheckContextInputAndDepthChanges(load, context_object0, 0);
   }
 
   {
     Node* load = t.graph()->NewNode(
-        t.javascript()->LoadContext(3, Context::EXTENSION_INDEX, true),
+        t.javascript()->LoadContextNoCell(3, Context::EXTENSION_INDEX, true),
         context2, start);
     t.CheckChangesToValue(load, slot_value0);
   }
 }
 
-TEST(ReduceJSStoreContext0) {
+TEST(ReduceJSStoreContextNoCell0) {
   ContextSpecializationTester t(Nothing<OuterContext>());
 
   Node* start = t.graph()->NewNode(t.common()->Start(0));
@@ -480,7 +501,7 @@ TEST(ReduceJSStoreContext0) {
   DirectHandle<Object> expected =
       t.CanonicalHandle(*t.factory()->InternalizeUtf8String("gboy!"));
   const int slot = 5;
-  native->set(slot, *expected);
+  native->SetNoCell(slot, *expected);
 
   Node* const_context =
       t.jsgraph()->ConstantNoHole(MakeRef(t.broker(), native), t.broker());
@@ -490,7 +511,7 @@ TEST(ReduceJSStoreContext0) {
 
   {
     // Mutable slot, constant context, depth = 0 => do nothing.
-    Node* load = t.graph()->NewNode(t.javascript()->StoreContext(0, 0),
+    Node* load = t.graph()->NewNode(t.javascript()->StoreContextNoCell(0, 0),
                                     const_context, const_context, start, start);
     Reduction r = t.spec()->Reduce(load);
     CHECK(!r.Changed());
@@ -498,7 +519,7 @@ TEST(ReduceJSStoreContext0) {
 
   {
     // Mutable slot, non-constant context, depth = 0 => do nothing.
-    Node* load = t.graph()->NewNode(t.javascript()->StoreContext(0, 0),
+    Node* load = t.graph()->NewNode(t.javascript()->StoreContextNoCell(0, 0),
                                     param_context, param_context, start, start);
     Reduction r = t.spec()->Reduce(load);
     CHECK(!r.Changed());
@@ -506,7 +527,7 @@ TEST(ReduceJSStoreContext0) {
 
   {
     // Immutable slot, constant context, depth = 0 => do nothing.
-    Node* load = t.graph()->NewNode(t.javascript()->StoreContext(0, slot),
+    Node* load = t.graph()->NewNode(t.javascript()->StoreContextNoCell(0, slot),
                                     const_context, const_context, start, start);
     Reduction r = t.spec()->Reduce(load);
     CHECK(!r.Changed());
@@ -515,7 +536,7 @@ TEST(ReduceJSStoreContext0) {
   {
     // Mutable slot, constant context, depth > 0 => fold-in parent context.
     Node* load = t.graph()->NewNode(
-        t.javascript()->StoreContext(2, Context::GLOBAL_EVAL_FUN_INDEX),
+        t.javascript()->StoreContextNoCell(2, Context::GLOBAL_EVAL_FUN_INDEX),
         deep_const_context, deep_const_context, start, start);
     Reduction r = t.spec()->Reduce(load);
     CHECK(r.Changed());
@@ -530,10 +551,10 @@ TEST(ReduceJSStoreContext0) {
   }
 
   // Clean up so that verifiers don't complain.
-  native->set(slot, Smi::zero());
+  native->SetNoCell(slot, Smi::zero());
 }
 
-TEST(ReduceJSStoreContext1) {
+TEST(ReduceJSStoreContextNoCell1) {
   ContextSpecializationTester t(Nothing<OuterContext>());
 
   Node* start = t.graph()->NewNode(t.common()->Start(0));
@@ -550,34 +571,34 @@ TEST(ReduceJSStoreContext1) {
 
   {
     Node* store =
-        t.graph()->NewNode(t.javascript()->StoreContext(0, slot_index),
+        t.graph()->NewNode(t.javascript()->StoreContextNoCell(0, slot_index),
                            context2, context2, start, start);
     CHECK(!t.spec()->Reduce(store).Changed());
   }
 
   {
     Node* store =
-        t.graph()->NewNode(t.javascript()->StoreContext(1, slot_index),
+        t.graph()->NewNode(t.javascript()->StoreContextNoCell(1, slot_index),
                            context2, context2, start, start);
     t.CheckContextInputAndDepthChanges(store, context1, 0);
   }
 
   {
     Node* store =
-        t.graph()->NewNode(t.javascript()->StoreContext(2, slot_index),
+        t.graph()->NewNode(t.javascript()->StoreContextNoCell(2, slot_index),
                            context2, context2, start, start);
     t.CheckContextInputAndDepthChanges(store, context0, 0);
   }
 
   {
     Node* store =
-        t.graph()->NewNode(t.javascript()->StoreContext(3, slot_index),
+        t.graph()->NewNode(t.javascript()->StoreContextNoCell(3, slot_index),
                            context2, context2, start, start);
     t.CheckContextInputAndDepthChanges(store, context0, 1);
   }
 }
 
-TEST(ReduceJSStoreContext2) {
+TEST(ReduceJSStoreContextNoCell2) {
   ContextSpecializationTester t(Nothing<OuterContext>());
 
   Node* start = t.graph()->NewNode(t.common()->Start(0));
@@ -607,34 +628,34 @@ TEST(ReduceJSStoreContext2) {
 
   {
     Node* store = t.graph()->NewNode(
-        t.javascript()->StoreContext(0, Context::EXTENSION_INDEX), context2,
-        context2, start, start);
+        t.javascript()->StoreContextNoCell(0, Context::EXTENSION_INDEX),
+        context2, context2, start, start);
     CHECK(!t.spec()->Reduce(store).Changed());
   }
 
   {
     Node* store = t.graph()->NewNode(
-        t.javascript()->StoreContext(1, Context::EXTENSION_INDEX), context2,
-        context2, start, start);
+        t.javascript()->StoreContextNoCell(1, Context::EXTENSION_INDEX),
+        context2, context2, start, start);
     t.CheckContextInputAndDepthChanges(store, context1, 0);
   }
 
   {
     Node* store = t.graph()->NewNode(
-        t.javascript()->StoreContext(2, Context::EXTENSION_INDEX), context2,
-        context2, start, start);
+        t.javascript()->StoreContextNoCell(2, Context::EXTENSION_INDEX),
+        context2, context2, start, start);
     t.CheckContextInputAndDepthChanges(store, context0, 0);
   }
 
   {
     Node* store = t.graph()->NewNode(
-        t.javascript()->StoreContext(3, Context::EXTENSION_INDEX), context2,
-        context2, start, start);
+        t.javascript()->StoreContextNoCell(3, Context::EXTENSION_INDEX),
+        context2, context2, start, start);
     t.CheckContextInputAndDepthChanges(store, context_object0, 0);
   }
 }
 
-TEST(ReduceJSStoreContext3) {
+TEST(ReduceJSStoreContextNoCell3) {
   HandleAndZoneScope handle_zone_scope;
   auto isolate = handle_zone_scope.main_isolate();
   auto factory = isolate->factory();
@@ -670,29 +691,29 @@ TEST(ReduceJSStoreContext3) {
 
   {
     Node* store = t.graph()->NewNode(
-        t.javascript()->StoreContext(0, Context::EXTENSION_INDEX), context2,
-        context2, start, start);
+        t.javascript()->StoreContextNoCell(0, Context::EXTENSION_INDEX),
+        context2, context2, start, start);
     CHECK(!t.spec()->Reduce(store).Changed());
   }
 
   {
     Node* store = t.graph()->NewNode(
-        t.javascript()->StoreContext(1, Context::EXTENSION_INDEX), context2,
-        context2, start, start);
+        t.javascript()->StoreContextNoCell(1, Context::EXTENSION_INDEX),
+        context2, context2, start, start);
     t.CheckContextInputAndDepthChanges(store, context1, 0);
   }
 
   {
     Node* store = t.graph()->NewNode(
-        t.javascript()->StoreContext(2, Context::EXTENSION_INDEX), context2,
-        context2, start, start);
+        t.javascript()->StoreContextNoCell(2, Context::EXTENSION_INDEX),
+        context2, context2, start, start);
     t.CheckContextInputAndDepthChanges(store, context_object1, 0);
   }
 
   {
     Node* store = t.graph()->NewNode(
-        t.javascript()->StoreContext(3, Context::EXTENSION_INDEX), context2,
-        context2, start, start);
+        t.javascript()->StoreContextNoCell(3, Context::EXTENSION_INDEX),
+        context2, context2, start, start);
     t.CheckContextInputAndDepthChanges(store, context_object0, 0);
   }
 }
diff --git a/deps/v8/test/cctest/compiler/test-jump-threading.cc b/deps/v8/test/cctest/compiler/test-jump-threading.cc
index 08fe6e1bcb5127..bc0dc1c500a294 100644
--- a/deps/v8/test/cctest/compiler/test-jump-threading.cc
+++ b/deps/v8/test/cctest/compiler/test-jump-threading.cc
@@ -76,7 +76,7 @@ class TestCode : public HandleAndZoneScope {
     CHECK_NULL(current_);
     Start();
     CHECK_NOT_NULL(current_);
-    current_->set_switch_target(true);
+    current_->set_table_switch_target(true);
     return rpo_number_;
   }
   void RedundantMoves() {
@@ -797,7 +797,7 @@ void CheckBranch(TestCode* code, int pos, int t1, int t2) {
 
 void CheckBlockSwitchTarget(TestCode* code, RpoNumber rpo,
                             bool expect_switch_target) {
-  CHECK_EQ(code->sequence_.InstructionBlockAt(rpo)->IsSwitchTarget(),
+  CHECK_EQ(code->sequence_.InstructionBlockAt(rpo)->IsTableSwitchTarget(),
            expect_switch_target);
 }
 
diff --git a/deps/v8/test/cctest/compiler/test-run-machops.cc b/deps/v8/test/cctest/compiler/test-run-machops.cc
index 184c116e764b9c..a321f4ed93af8d 100644
--- a/deps/v8/test/cctest/compiler/test-run-machops.cc
+++ b/deps/v8/test/cctest/compiler/test-run-machops.cc
@@ -8,8 +8,8 @@
 
 #include "src/base/bits.h"
 #include "src/base/ieee754.h"
+#include "src/base/numerics/safe_conversions.h"
 #include "src/base/overflowing-math.h"
-#include "src/base/safe_conversions.h"
 #include "src/base/utils/random-number-generator.h"
 #include "src/builtins/builtins.h"
 #include "src/common/ptr-compr-inl.h"
diff --git a/deps/v8/test/cctest/compiler/turboshaft-codegen-tester.h b/deps/v8/test/cctest/compiler/turboshaft-codegen-tester.h
index a8abd2c3757575..412e54eb42516b 100644
--- a/deps/v8/test/cctest/compiler/turboshaft-codegen-tester.h
+++ b/deps/v8/test/cctest/compiler/turboshaft-codegen-tester.h
@@ -505,20 +505,23 @@ class IntBinopWrapper {
   TurboshaftBinop op;
 };
 
-#define COMPARE_LIST(V)    \
-  V(TaggedEqual)           \
-  V(Word32Equal)           \
-  V(Int32LessThan)         \
-  V(Int32LessThanOrEqual)  \
-  V(Uint32LessThan)        \
-  V(Uint32LessThanOrEqual) \
-  V(Word64Equal)           \
-  V(Int64LessThan)         \
-  V(Int64LessThanOrEqual)  \
-  V(Uint64LessThan)        \
-  V(Uint64LessThanOrEqual) \
-  V(Float64Equal)          \
-  V(Float64LessThan)       \
+#define COMPARE_LIST(V)     \
+  V(TaggedEqual)            \
+  V(Word32Equal)            \
+  V(Int32LessThan)          \
+  V(Int32LessThanOrEqual)   \
+  V(Uint32LessThan)         \
+  V(Uint32LessThanOrEqual)  \
+  V(Word64Equal)            \
+  V(Int64LessThan)          \
+  V(Int64LessThanOrEqual)   \
+  V(Uint64LessThan)         \
+  V(Uint64LessThanOrEqual)  \
+  V(Float32Equal)           \
+  V(Float32LessThan)        \
+  V(Float32LessThanOrEqual) \
+  V(Float64Equal)           \
+  V(Float64LessThan)        \
   V(Float64LessThanOrEqual)
 
 enum class TurboshaftComparison {
@@ -582,6 +585,19 @@ class CompareWrapper {
     }
   }
 
+  bool Float32Compare(float a, float b) const {
+    switch (op) {
+      case TurboshaftComparison::kFloat32Equal:
+        return a == b;
+      case TurboshaftComparison::kFloat32LessThan:
+        return a < b;
+      case TurboshaftComparison::kFloat32LessThanOrEqual:
+        return a <= b;
+      default:
+        UNREACHABLE();
+    }
+  }
+
   bool Float64Compare(double a, double b) const {
     switch (op) {
       case TurboshaftComparison::kFloat64Equal:
diff --git a/deps/v8/test/cctest/compiler/turboshaft-test-compare-combine.cc b/deps/v8/test/cctest/compiler/turboshaft-test-compare-combine.cc
index ed271fee40cf3e..439522d0dd03f0 100644
--- a/deps/v8/test/cctest/compiler/turboshaft-test-compare-combine.cc
+++ b/deps/v8/test/cctest/compiler/turboshaft-test-compare-combine.cc
@@ -46,6 +46,17 @@ constexpr size_t kNumInt64Cmps = 6;
 #endif  // V8_COMPRESS_POINTERS
 #endif  // V8_TARGET_ARCH_64_BIT
 
+#ifdef V8_ENABLE_FP_PARAMS_IN_C_LINKAGE
+constexpr std::array kFloat32CmpOpcodes = {
+    TurboshaftComparison::kFloat32Equal, TurboshaftComparison::kFloat32LessThan,
+    TurboshaftComparison::kFloat32LessThanOrEqual};
+#if V8_TARGET_ARCH_64_BIT
+constexpr std::array kFloat64CmpOpcodes = {
+    TurboshaftComparison::kFloat64Equal, TurboshaftComparison::kFloat64LessThan,
+    TurboshaftComparison::kFloat64LessThanOrEqual};
+#endif  // V8_TARGET_ARCH_64_BIT
+#endif  // V8_ENABLE_FP_PARAMS_IN_C_LINKAGE
+
 enum GraphShape { kBalanced, kUnbalanced };
 enum InvertPattern {
   kNoInvert,
@@ -84,7 +95,46 @@ static constexpr uint64_t uint64_test_array[] = {
     0x007FFFFFDDDDDDDD, 0x8000000000000000, 0x7FF8000000000000,
     0x7FF7654321FEDCBA};
 static constexpr auto uint64_test_vector = base::VectorOf(uint64_test_array);
-#endif
+#endif  // V8_TARGET_ARCH_64_BIT
+#ifdef V8_ENABLE_FP_PARAMS_IN_C_LINKAGE
+static constexpr float float32_test_array[] = {
+    -9223372036854775808.0,
+    -1.45381e+10,
+    -2147483904.0,
+    -2147483648.0,
+    -2147483520.0,
+    -1.3956e+09,
+    -1.0,
+    -0.0,
+    0.0,
+    1.0,
+    2147483648.0,
+    2147483904.0,
+    4294967296.0,
+    std::numeric_limits<float>::infinity(),
+    std::numeric_limits<float>::quiet_NaN(),
+    -std::numeric_limits<float>::quiet_NaN()};
+static constexpr auto float32_test_vector = base::VectorOf(float32_test_array);
+#ifdef V8_TARGET_ARCH_64_BIT
+static constexpr double float64_test_array[] = {
+    -9223372036854775808.0,
+    -1.0,
+    -0.5,
+    -0.0,
+    0.0,
+    3e-88,
+    0.5,
+    1.0,
+    9223372036854775808.0,
+    9223373136366403584.0,
+    18446744073709551616.0,
+    V8_INFINITY,
+    -V8_INFINITY,
+    std::numeric_limits<double>::quiet_NaN(),
+    -std::numeric_limits<double>::quiet_NaN()};
+static constexpr auto float64_test_vector = base::VectorOf(float64_test_array);
+#endif  // V8_TARGET_ARCH_64_BIT
+#endif  // V8_ENABLE_FP_PARAMS_IN_C_LINKAGE
 
 // Given kGraphShapes and kInvertPatterns, defined above, the graphs produced by
 // the test framework, with four compares, are illustrated below. In the cases
@@ -350,6 +400,18 @@ class CombineCompares {
         return m().Uint64LessThan(lhs, rhs);
       case TurboshaftComparison::kUint64LessThanOrEqual:
         return m().Uint64LessThanOrEqual(lhs, rhs);
+      case TurboshaftComparison::kFloat32Equal:
+        return m().Float32Equal(lhs, rhs);
+      case TurboshaftComparison::kFloat32LessThan:
+        return m().Float32LessThan(lhs, rhs);
+      case TurboshaftComparison::kFloat32LessThanOrEqual:
+        return m().Float32LessThanOrEqual(lhs, rhs);
+      case TurboshaftComparison::kFloat64Equal:
+        return m().Float64Equal(lhs, rhs);
+      case TurboshaftComparison::kFloat64LessThan:
+        return m().Float64LessThan(lhs, rhs);
+      case TurboshaftComparison::kFloat64LessThanOrEqual:
+        return m().Float64LessThanOrEqual(lhs, rhs);
     }
   }
 
@@ -595,6 +657,32 @@ class CombineCompareWord64 : public CombineCompares<NumLogic, uint64_t> {
   }
 };
 
+template <uint32_t NumLogic>
+class CombineCompareFloat32 : public CombineCompares<NumLogic, float> {
+ public:
+  using CombineCompares<NumLogic, float>::CombineCompares;
+  uint32_t EvalCompare(CompareWrapper& cmpw, float lhs,
+                       float rhs) const override {
+    return cmpw.Float32Compare(lhs, rhs);
+  }
+  OpIndex Zero() const override { return this->m().Float32Constant(0.0); }
+  OpIndex One() const override { return this->m().Float32Constant(1.0); }
+  OpIndex ThirtyTwo() const override { return this->m().Float32Constant(32.0); }
+};
+
+template <uint32_t NumLogic>
+class CombineCompareFloat64 : public CombineCompares<NumLogic, double> {
+ public:
+  using CombineCompares<NumLogic, double>::CombineCompares;
+  uint32_t EvalCompare(CompareWrapper& cmpw, double lhs,
+                       double rhs) const override {
+    return cmpw.Float64Compare(lhs, rhs);
+  }
+  OpIndex Zero() const override { return this->m().Float64Constant(0.0); }
+  OpIndex One() const override { return this->m().Float64Constant(1.0); }
+  OpIndex ThirtyTwo() const override { return this->m().Float64Constant(32.0); }
+};
+
 template <typename Combiner, typename InputType, size_t NumCmps>
 void CombineCompareLogic1(
     const std::array<TurboshaftComparison, NumCmps>& cmp_opcodes,
@@ -638,12 +726,24 @@ TEST(CombineCompareWord32Logic1) {
   CombineCompareLogic1<CombineCompareWord32<1>, uint32_t, kNumInt32Cmps>(
       kInt32CmpOpcodes, MachineType::Uint32, uint32_test_vector);
 }
+#ifdef V8_ENABLE_FP_PARAMS_IN_C_LINKAGE
+TEST(CombineCompareFloat32Logic1) {
+  CombineCompareLogic1<CombineCompareFloat32<1>, float, 3>(
+      kFloat32CmpOpcodes, MachineType::Float32, float32_test_vector);
+}
+#endif  // V8_ENABLE_FP_PARAMS_IN_C_LINKAGE
 #if V8_TARGET_ARCH_64_BIT
 TEST(CombineCompareWord64Logic1) {
   CombineCompareLogic1<CombineCompareWord64<1>, uint64_t, kNumInt64Cmps>(
       kInt64CmpOpcodes, MachineType::Uint64, uint64_test_vector);
 }
-#endif
+#ifdef V8_ENABLE_FP_PARAMS_IN_C_LINKAGE
+TEST(CombineCompareFloat64Logic1) {
+  CombineCompareLogic1<CombineCompareFloat64<1>, double, 3>(
+      kFloat64CmpOpcodes, MachineType::Float64, float64_test_vector);
+}
+#endif  // V8_ENABLE_FP_PARAMS_IN_C_LINKAGE
+#endif  // V8_TARGET_ARCH_64_BIT
 
 template <typename Combiner, typename InputType, size_t NumCmps>
 void CombineCompareLogic2(
@@ -652,9 +752,9 @@ void CombineCompareLogic2(
     const base::Vector<const InputType>& input_vector) {
   constexpr GraphShape shape = kUnbalanced;
   constexpr BranchPattern branch_pattern = kNone;
-  auto cmp0 = cmp_opcodes[3];
-  auto cmp1 = cmp_opcodes[2];
-  auto cmp2 = cmp_opcodes[1];
+  auto cmp0 = cmp_opcodes[2];
+  auto cmp1 = cmp_opcodes[1];
+  auto cmp2 = cmp_opcodes[0];
   std::array compare_ops = {cmp0, cmp1, cmp2};
   for (auto logic0 : kLogicOpcodes) {
     for (auto logic1 : kLogicOpcodes) {
@@ -688,12 +788,24 @@ TEST(CombineCompareWord32Logic2) {
   CombineCompareLogic2<CombineCompareWord32<2>, uint32_t, kNumInt32Cmps>(
       kInt32CmpOpcodes, MachineType::Uint32, uint32_test_vector);
 }
+#ifdef V8_ENABLE_FP_PARAMS_IN_C_LINKAGE
+TEST(CombineCompareFloat32Logic2) {
+  CombineCompareLogic2<CombineCompareFloat32<2>, float, 3>(
+      kFloat32CmpOpcodes, MachineType::Float32, float32_test_vector);
+}
+#endif  // V8_ENABLE_FP_PARAMS_IN_C_LINKAGE
 #if V8_TARGET_ARCH_64_BIT
 TEST(CombineCompareWord64Logic2) {
   CombineCompareLogic2<CombineCompareWord64<2>, uint64_t, kNumInt64Cmps>(
       kInt64CmpOpcodes, MachineType::Uint64, uint64_test_vector);
 }
-#endif
+#ifdef V8_ENABLE_FP_PARAMS_IN_C_LINKAGE
+TEST(CombineCompareFloat64Logic2) {
+  CombineCompareLogic2<CombineCompareFloat64<2>, double, 3>(
+      kFloat64CmpOpcodes, MachineType::Float64, float64_test_vector);
+}
+#endif  // V8_ENABLE_FP_PARAMS_IN_C_LINKAGE
+#endif  // V8_TARGET_ARCH_64_BIT
 
 template <typename Combiner, typename InputType, size_t NumCmps>
 void CombineCompareLogic3Zero(
@@ -1042,6 +1154,53 @@ TEST(CombineCompareTwoLogicInputs) {
   }
 }
 
+#if (V8_TARGET_ARCH_64_BIT && V8_ENABLE_FP_PARAMS_IN_C_LINKAGE)
+TEST(CombineCompareFloatAndIntMaxDepth) {
+  auto run = [](uint32_t a, uint32_t b, float c, double d) {
+    bool fcmp0 = 0.0f <= c;
+    bool icmp0 = static_cast<int32_t>(b) >= static_cast<int32_t>(a);
+    bool and0 = fcmp0 || icmp0;
+    bool fcmp1 = c < -1.0f;
+    bool or0 = and0 || fcmp1;
+    bool icmp1 = b > a;
+    bool and1 = or0 && icmp1;
+    bool fcmp2 = 1.0 == d;
+    return and1 || fcmp2;
+  };
+
+  RawMachineAssemblerTester<uint32_t> m(
+      MachineType::Uint32(), MachineType::Uint32(), MachineType::Float32(),
+      MachineType::Float64());
+  {
+    V<Word32> a = m.Parameter(0);
+    V<Word32> b = m.Parameter(1);
+    V<Float32> c = m.Parameter(2);
+    V<Float64> d = m.Parameter(3);
+    V<Word32> fcmp0 = m.Float32LessThanOrEqual(m.Float32Constant(0.0), c);
+    V<Word32> icmp0 = m.Int32GreaterThanOrEqual(b, a);
+    V<Word32> and0 = m.Word32BitwiseOr(fcmp0, icmp0);
+    V<Word32> fcmp1 = m.Float32LessThan(c, m.Float32Constant(-1.0));
+    V<Word32> or0 = m.Word32BitwiseOr(and0, fcmp1);
+    V<Word32> icmp1 = m.Uint32GreaterThan(b, a);
+    V<Word32> and1 = m.Word32BitwiseAnd(or0, icmp1);
+    V<Word32> fcmp2 = m.Float64Equal(m.Float64Constant(1.0), d);
+    m.Return(m.Word32BitwiseOr(and1, fcmp2));
+  }
+
+  for (uint32_t a : uint32_test_vector) {
+    for (uint32_t b : uint32_test_vector) {
+      for (float c : float32_test_vector) {
+        for (double d : float64_test_vector) {
+          uint32_t result = m.Call(a, b, c, d);
+          uint32_t expected = run(a, b, c, d);
+          CHECK_EQ(result, expected);
+        }
+      }
+    }
+  }
+}
+#endif  // (V8_TARGET_ARCH_64_BIT && V8_ENABLE_FP_PARAMS_IN_C_LINKAGE)
+
 }  // end namespace
 
 }  // namespace v8::internal::compiler::turboshaft
diff --git a/deps/v8/test/cctest/heap/heap-utils.cc b/deps/v8/test/cctest/heap/heap-utils.cc
index 35a81a639d2c75..da9742be8c3231 100644
--- a/deps/v8/test/cctest/heap/heap-utils.cc
+++ b/deps/v8/test/cctest/heap/heap-utils.cc
@@ -283,7 +283,7 @@ void SimulateIncrementalMarking(i::Heap* heap, bool force_completion) {
     // because of the AdvanceForTesting call in this function which is currently
     // only possible for MajorMC.
     heap->CollectGarbage(NEW_SPACE,
-                         GarbageCollectionReason::kFinalizeConcurrentMinorMS);
+                         GarbageCollectionReason::kFinalizeMinorMSForMajorGC);
   }
 
   if (marking->IsStopped()) {
@@ -382,19 +382,9 @@ bool InCorrectGeneration(Tagged<HeapObject> object) {
                                     : i::HeapLayout::InYoungGeneration(object);
 }
 
-void GrowNewSpace(Heap* heap) {
-  IsolateSafepointScope scope(heap);
-  heap->ExpandNewSpaceSizeForTesting();
-  CHECK(heap->new_space()->EnsureCurrentCapacity());
-}
-
 void GrowNewSpaceToMaximumCapacity(Heap* heap) {
   IsolateSafepointScope scope(heap);
-  NewSpace* new_space = heap->new_space();
-  while (new_space->TotalCapacity() < new_space->MaximumCapacity()) {
-    heap->ExpandNewSpaceSizeForTesting();
-  }
-  CHECK(new_space->EnsureCurrentCapacity());
+  heap->new_space()->GrowToMaximumCapacityForTesting();
 }
 
 }  // namespace heap
diff --git a/deps/v8/test/cctest/heap/test-array-buffer-tracker.cc b/deps/v8/test/cctest/heap/test-array-buffer-tracker.cc
index 78bb7cff498f43..5b06b9f2852e37 100644
--- a/deps/v8/test/cctest/heap/test-array-buffer-tracker.cc
+++ b/deps/v8/test/cctest/heap/test-array-buffer-tracker.cc
@@ -229,86 +229,6 @@ TEST(ArrayBuffer_UnregisterDuringSweep) {
   }
 }
 
-TEST(ArrayBuffer_NonLivePromotion) {
-  if (!v8_flags.incremental_marking || v8_flags.separate_gc_phases) return;
-  v8_flags.concurrent_array_buffer_sweeping = false;
-  ManualGCScope manual_gc_scope;
-  // The test verifies that the marking state is preserved when promoting
-  // a buffer to old space.
-  CcTest::InitializeVM();
-  LocalContext env;
-  v8::Isolate* isolate = env->GetIsolate();
-  Heap* heap = reinterpret_cast<Isolate*>(isolate)->heap();
-  i::DisableConservativeStackScanningScopeForTesting no_stack_scanning(
-      CcTest::heap());
-
-  {
-    v8::HandleScope handle_scope(isolate);
-    DirectHandle<FixedArray> root =
-        heap->isolate()->factory()->NewFixedArray(1, AllocationType::kOld);
-    {
-      v8::HandleScope new_handle_scope(isolate);
-      Local<v8::ArrayBuffer> ab = v8::ArrayBuffer::New(isolate, 100);
-      DirectHandle<JSArrayBuffer> buf = v8::Utils::OpenDirectHandle(*ab);
-      root->set(0, *buf);  // Buffer that should not be promoted as live.
-    }
-    heap::SimulateIncrementalMarking(heap, false);
-    CHECK(IsTracked(heap, Cast<JSArrayBuffer>(root->get(0))));
-    heap::InvokeAtomicMinorGC(heap);
-    CHECK(IsTracked(heap, Cast<JSArrayBuffer>(root->get(0))));
-    heap::InvokeAtomicMinorGC(heap);
-    CHECK(IsTracked(heap, Cast<JSArrayBuffer>(root->get(0))));
-    ArrayBufferExtension* extension =
-        Cast<JSArrayBuffer>(root->get(0))->extension();
-    root->set(0, ReadOnlyRoots(heap).undefined_value());
-    heap::SimulateIncrementalMarking(heap, true);
-    heap::InvokeAtomicMajorGC(heap);
-    CHECK(!IsTracked(heap, extension));
-  }
-}
-
-TEST(ArrayBuffer_LivePromotion) {
-  if (!v8_flags.incremental_marking || v8_flags.separate_gc_phases) return;
-  v8_flags.concurrent_array_buffer_sweeping = false;
-  ManualGCScope manual_gc_scope;
-  // The test verifies that the marking state is preserved when promoting
-  // a buffer to old space.
-  CcTest::InitializeVM();
-  LocalContext env;
-  v8::Isolate* isolate = env->GetIsolate();
-  Heap* heap = reinterpret_cast<Isolate*>(isolate)->heap();
-
-  Tagged<JSArrayBuffer> raw_ab;
-  {
-    v8::HandleScope handle_scope(isolate);
-    DirectHandle<FixedArray> root =
-        heap->isolate()->factory()->NewFixedArray(1, AllocationType::kOld);
-    {
-      v8::HandleScope new_handle_scope(isolate);
-      Local<v8::ArrayBuffer> ab = v8::ArrayBuffer::New(isolate, 100);
-      DirectHandle<JSArrayBuffer> buf = v8::Utils::OpenDirectHandle(*ab);
-      root->set(0, *buf);  // Buffer that should be promoted as live.
-    }
-    // Store array in Global such that it is part of the root set when
-    // starting incremental marking.
-    v8::Global<Value> global_root(CcTest::isolate(),
-                                  Utils::ToLocal(Cast<Object>(root)));
-    heap::SimulateIncrementalMarking(heap, true);
-    CHECK(IsTracked(heap, Cast<JSArrayBuffer>(root->get(0))));
-    heap::InvokeMinorGC(heap);
-    CHECK(IsTracked(heap, Cast<JSArrayBuffer>(root->get(0))));
-    heap::InvokeMinorGC(heap);
-    CHECK(IsTracked(heap, Cast<JSArrayBuffer>(root->get(0))));
-    raw_ab = Cast<JSArrayBuffer>(root->get(0));
-    root->set(0, ReadOnlyRoots(heap).undefined_value());
-    // Prohibit page from being released.
-    MemoryChunk::FromHeapObject(raw_ab)->MarkNeverEvacuate();
-    heap::InvokeMajorGC(heap);
-    CHECK(!heap->array_buffer_sweeper()->sweeping_in_progress());
-    CHECK(IsTracked(heap, raw_ab));
-  }
-}
-
 TEST(ArrayBuffer_SemiSpaceCopyThenPagePromotion) {
   if (!i::v8_flags.incremental_marking) return;
   if (v8_flags.minor_ms) return;
diff --git a/deps/v8/test/cctest/heap/test-concurrent-allocation.cc b/deps/v8/test/cctest/heap/test-concurrent-allocation.cc
index f47c888a12afad..c61a1b041ff308 100644
--- a/deps/v8/test/cctest/heap/test-concurrent-allocation.cc
+++ b/deps/v8/test/cctest/heap/test-concurrent-allocation.cc
@@ -143,14 +143,10 @@ UNINITIALIZED_TEST(ConcurrentAllocationInOldSpaceFromMainThread) {
 }
 
 UNINITIALIZED_TEST(ConcurrentAllocationWhileMainThreadIsParked) {
-#ifndef V8_ENABLE_CONSERVATIVE_STACK_SCANNING
-  v8_flags.max_old_space_size = 4;
-#else
   // With CSS, it is expected that the GCs triggered by concurrent allocation
   // will reclaim less memory. If this test fails, this limit should probably
   // be further increased.
-  v8_flags.max_old_space_size = 10;
-#endif
+  v8_flags.max_old_space_size = v8_flags.conservative_stack_scanning ? 10 : 4;
   v8_flags.stress_concurrent_allocation = false;
 
   v8::Isolate::CreateParams create_params;
@@ -179,14 +175,10 @@ UNINITIALIZED_TEST(ConcurrentAllocationWhileMainThreadIsParked) {
 }
 
 UNINITIALIZED_TEST(ConcurrentAllocationWhileMainThreadParksAndUnparks) {
-#ifndef V8_ENABLE_CONSERVATIVE_STACK_SCANNING
-  v8_flags.max_old_space_size = 4;
-#else
   // With CSS, it is expected that the GCs triggered by concurrent allocation
   // will reclaim less memory. If this test fails, this limit should probably
   // be further increased.
-  v8_flags.max_old_space_size = 10;
-#endif
+  v8_flags.max_old_space_size = v8_flags.conservative_stack_scanning ? 10 : 4;
   v8_flags.stress_concurrent_allocation = false;
   v8_flags.incremental_marking = false;
   i::FlagList::EnforceFlagImplications();
@@ -224,14 +216,10 @@ UNINITIALIZED_TEST(ConcurrentAllocationWhileMainThreadParksAndUnparks) {
 }
 
 UNINITIALIZED_TEST(ConcurrentAllocationWhileMainThreadRunsWithSafepoints) {
-#ifndef V8_ENABLE_CONSERVATIVE_STACK_SCANNING
-  v8_flags.max_old_space_size = 4;
-#else
   // With CSS, it is expected that the GCs triggered by concurrent allocation
   // will reclaim less memory. If this test fails, this limit should probably
   // be further increased.
-  v8_flags.max_old_space_size = 10;
-#endif
+  v8_flags.max_old_space_size = v8_flags.conservative_stack_scanning ? 10 : 4;
   v8_flags.stress_concurrent_allocation = false;
   v8_flags.incremental_marking = false;
   i::FlagList::EnforceFlagImplications();
diff --git a/deps/v8/test/cctest/heap/test-heap.cc b/deps/v8/test/cctest/heap/test-heap.cc
index 7c4a479f5ed2be..86f42949ed0632 100644
--- a/deps/v8/test/cctest/heap/test-heap.cc
+++ b/deps/v8/test/cctest/heap/test-heap.cc
@@ -65,6 +65,7 @@
 #include "src/heap/safepoint.h"
 #include "src/ic/ic.h"
 #include "src/numbers/hash-seed-inl.h"
+#include "src/objects/allocation-site.h"
 #include "src/objects/call-site-info-inl.h"
 #include "src/objects/elements.h"
 #include "src/objects/field-type.h"
@@ -117,11 +118,11 @@ static void VerifyStoredPrototypeMap(Isolate* isolate,
                                      int stored_ctor_context_index) {
   DirectHandle<Context> context = isolate->native_context();
 
-  DirectHandle<Map> this_map(Cast<Map>(context->get(stored_map_context_index)),
-                             isolate);
+  DirectHandle<Map> this_map(
+      Cast<Map>(context->GetNoCell(stored_map_context_index)), isolate);
 
   DirectHandle<JSFunction> fun(
-      Cast<JSFunction>(context->get(stored_ctor_context_index)), isolate);
+      Cast<JSFunction>(context->GetNoCell(stored_ctor_context_index)), isolate);
   DirectHandle<JSObject> proto(Cast<JSObject>(fun->initial_map()->prototype()),
                                isolate);
   DirectHandle<Map> that_map(proto->map(), isolate);
@@ -643,6 +644,10 @@ TEST(BytecodeArray) {
   Factory* factory = isolate->factory();
   HandleScope scope(isolate);
 
+  // Ensures that the BytecodeArray isn't allocated on a NEVER_EVACUATE page.
+  heap::AbandonCurrentlyFreeMemory(
+      CcTest::i_isolate()->heap()->trusted_space());
+
   heap::SimulateFullSpace(heap->old_space());
   IndirectHandle<TrustedFixedArray> constant_pool =
       factory->NewTrustedFixedArray(5);
@@ -882,10 +887,10 @@ TEST(JSArray) {
   DirectHandle<JSObject> object = factory->NewJSObject(function);
   DirectHandle<JSArray> array = Cast<JSArray>(object);
   // We just initialized the VM, no heap allocation failure yet.
-  JSArray::Initialize(array, 0);
+  JSArray::Initialize(isolate, array, 0);
 
   // Set array length to 0.
-  JSArray::SetLength(array, 0);
+  JSArray::SetLength(isolate, array, 0);
   CHECK_EQ(Smi::zero(), array->length());
   // Must be in fast mode.
   CHECK(array->HasSmiOrObjectElements());
@@ -897,7 +902,7 @@ TEST(JSArray) {
   CHECK_EQ(*element, *name);
 
   // Set array length with larger than smi value.
-  JSArray::SetLength(array, static_cast<uint32_t>(Smi::kMaxValue) + 1);
+  JSArray::SetLength(isolate, array, static_cast<uint32_t>(Smi::kMaxValue) + 1);
 
   uint32_t int_length = 0;
   CHECK(Object::ToArrayIndex(array->length(), &int_length));
@@ -1908,7 +1913,7 @@ TEST(TestInternalWeakLists) {
   // and hence are incompatible with this test case.
   if (v8_flags.gc_global || v8_flags.stress_compaction ||
       v8_flags.stress_incremental_marking || v8_flags.single_generation ||
-      v8_flags.separate_gc_phases || v8_flags.stress_concurrent_allocation)
+      v8_flags.stress_concurrent_allocation)
     return;
   v8_flags.retain_maps_for_n_gc = 0;
 
@@ -2657,7 +2662,6 @@ TEST(InstanceOfStubWriteBarrier) {
   CcTest::InitializeVM();
   Isolate* isolate = CcTest::i_isolate();
   if (!isolate->use_optimizer()) return;
-  if (v8_flags.force_marking_deque_overflows) return;
   v8::HandleScope outer_scope(CcTest::isolate());
   v8::Local<v8::Context> ctx = CcTest::isolate()->GetCurrentContext();
 
@@ -2734,12 +2738,6 @@ HEAP_TEST(GCFlags) {
                                 GarbageCollectionReason::kTesting);
   CHECK(heap->current_gc_flags_ & GCFlag::kReduceMemoryFootprint);
 
-  if (!v8_flags.separate_gc_phases) {
-    heap::InvokeMinorGC(heap);
-    // NewSpace scavenges should not overwrite the flags.
-    CHECK(heap->current_gc_flags_ & GCFlag::kReduceMemoryFootprint);
-  }
-
   heap::InvokeMajorGC(heap, GCFlag::kNoFlags);
   CHECK_EQ(heap->current_gc_flags_, GCFlag::kNoFlags);
 }
@@ -4093,7 +4091,7 @@ TEST(Regress169928) {
 
   heap::FillCurrentPageButNBytes(
       SemiSpaceNewSpace::From(CcTest::heap()->new_space()),
-      JSArray::kHeaderSize + AllocationMemento::kSize + kTaggedSize);
+      JSArray::kHeaderSize + sizeof(AllocationMemento) + kTaggedSize);
 
   DirectHandle<JSArray> array =
       factory->NewJSArrayWithElements(array_data, PACKED_SMI_ELEMENTS);
@@ -4106,12 +4104,12 @@ TEST(Regress169928) {
   Tagged<HeapObject> obj;
   AllocationResult allocation =
       CcTest::heap()->allocator()->new_space_allocator()->AllocateRaw(
-          AllocationMemento::kSize + kTaggedSize, kTaggedAligned,
+          sizeof(AllocationMemento) + kTaggedSize, kTaggedAligned,
           AllocationOrigin::kRuntime);
   CHECK(allocation.To(&obj));
   Address addr_obj = obj.address();
   CcTest::heap()->CreateFillerObjectAt(addr_obj,
-                                       AllocationMemento::kSize + kTaggedSize);
+                                       sizeof(AllocationMemento) + kTaggedSize);
 
   // Give the array a name, making sure not to allocate strings.
   v8::Local<v8::Object> array_obj = v8::Utils::ToLocal(array);
@@ -4331,7 +4329,8 @@ static int AllocationSitesCount(Heap* heap) {
   int count = 0;
   for (Tagged<Object> site = heap->allocation_sites_list();
        IsAllocationSite(site);) {
-    Tagged<AllocationSite> cur = Cast<AllocationSite>(site);
+    Tagged<AllocationSiteWithWeakNext> cur =
+        Cast<AllocationSiteWithWeakNext>(site);
     CHECK(cur->HasWeakNext());
     site = cur->weak_next();
     count++;
@@ -4343,7 +4342,8 @@ static int SlimAllocationSiteCount(Heap* heap) {
   int count = 0;
   for (Tagged<Object> weak_list = heap->allocation_sites_list();
        IsAllocationSite(weak_list);) {
-    Tagged<AllocationSite> weak_cur = Cast<AllocationSite>(weak_list);
+    Tagged<AllocationSiteWithWeakNext> weak_cur =
+        Cast<AllocationSiteWithWeakNext>(weak_list);
     for (Tagged<Object> site = weak_cur->nested_site();
          IsAllocationSite(site);) {
       Tagged<AllocationSite> cur = Cast<AllocationSite>(site);
@@ -5711,7 +5711,7 @@ static void RemoveCodeAndGC(const v8::FunctionCallbackInfo<v8::Value>& info) {
   // Bytecode is code too.
   SharedFunctionInfo::DiscardCompiled(isolate,
                                       direct_handle(fun->shared(), isolate));
-  fun->UpdateCode(*BUILTIN_CODE(isolate, CompileLazy));
+  fun->UpdateCode(isolate, *BUILTIN_CODE(isolate, CompileLazy));
   heap::InvokeMemoryReducingMajorGCs(CcTest::heap());
 }
 
@@ -6037,7 +6037,7 @@ TEST(Regress598319) {
         DirectHandle<JSArray> js_array =
             isolate->factory()->NewJSArrayWithElements(
                 DirectHandle<FixedArray>(arr.get(), isolate));
-        js_array->GetElementsAccessor()->Shift(js_array).Check();
+        js_array->GetElementsAccessor()->Shift(isolate, js_array).Check();
       }
       break;
     }
@@ -6161,7 +6161,7 @@ class StaticOneByteResource : public v8::String::ExternalOneByteStringResource {
 };
 
 TEST(Regress631969) {
-  if (!v8_flags.incremental_marking || v8_flags.separate_gc_phases) return;
+  if (!v8_flags.incremental_marking) return;
   ManualGCScope manual_gc_scope;
   heap::ManualEvacuationCandidatesSelectionScope
       manual_evacuation_candidate_selection_scope(manual_gc_scope);
@@ -6736,7 +6736,7 @@ HEAP_TEST(Regress670675) {
 
   heap->EnsureSweepingCompleted(
       Heap::SweepingForcedFinalizationMode::kUnifiedHeap);
-  heap->tracer()->StopFullCycleIfNeeded();
+  heap->tracer()->StopFullCycleIfFinished();
   i::IncrementalMarking* marking = CcTest::heap()->incremental_marking();
   if (marking->IsStopped()) {
     IsolateSafepointScope safepoint_scope(heap);
@@ -7302,7 +7302,7 @@ TEST(CodeObjectRegistry) {
 
 TEST(Regress9701) {
   ManualGCScope manual_gc_scope;
-  if (!v8_flags.incremental_marking || v8_flags.separate_gc_phases) return;
+  if (!v8_flags.incremental_marking) return;
   CcTest::InitializeVM();
   Heap* heap = CcTest::heap();
   // Start with an empty new space.
diff --git a/deps/v8/test/cctest/heap/test-spaces.cc b/deps/v8/test/cctest/heap/test-spaces.cc
index 09d99c2c715064..e83e8f5dc89d9f 100644
--- a/deps/v8/test/cctest/heap/test-spaces.cc
+++ b/deps/v8/test/cctest/heap/test-spaces.cc
@@ -351,9 +351,7 @@ TEST(PagedNewSpace) {
   MainAllocator allocator(heap->main_thread_local_heap(), new_space.get(),
                           MainAllocator::IsNewGeneration::kYes,
                           &allocation_info);
-  CHECK(new_space->MaximumCapacity());
-  CHECK(new_space->EnsureCurrentCapacity());
-  CHECK_LT(0, new_space->TotalCapacity());
+  GrowNewSpaceToMaximumCapacity(heap);
 
   size_t successful_allocations = 0;
   while (true) {
@@ -571,7 +569,7 @@ HEAP_TEST(Regress791582) {
   Heap* heap = isolate->heap();
   HandleScope scope(isolate);
   MainAllocator* new_space_allocator = heap->allocator()->new_space_allocator();
-  GrowNewSpace(heap);
+  GrowNewSpaceToMaximumCapacity(heap);
 
   int until_page_end =
       static_cast<int>(heap->NewSpaceLimit() - heap->NewSpaceTop());
@@ -606,118 +604,6 @@ HEAP_TEST(Regress791582) {
   new_space_allocator->RemoveAllocationObserver(&observer);
 }
 
-TEST(ShrinkPageToHighWaterMarkFreeSpaceEnd) {
-  v8_flags.stress_incremental_marking = false;
-  v8_flags.stress_concurrent_allocation = false;  // For SealCurrentObjects.
-  CcTest::InitializeVM();
-  Isolate* isolate = CcTest::i_isolate();
-  HandleScope scope(isolate);
-
-  heap::SealCurrentObjects(CcTest::heap());
-
-  // Prepare page that only contains a single object and a trailing FreeSpace
-  // filler.
-  DirectHandle<FixedArray> array =
-      isolate->factory()->NewFixedArray(128, AllocationType::kOld);
-  PageMetadata* page = PageMetadata::FromHeapObject(*array);
-
-  // Reset space so high water mark is consistent.
-  PagedSpace* old_space = CcTest::heap()->old_space();
-  CcTest::heap()->FreeMainThreadLinearAllocationAreas();
-  old_space->ResetFreeList();
-
-  Tagged<HeapObject> filler =
-      HeapObject::FromAddress(array->address() + array->Size());
-  CHECK(IsFreeSpace(filler));
-  size_t shrunk = old_space->ShrinkPageToHighWaterMark(page);
-  size_t should_have_shrunk = RoundDown(
-      static_cast<size_t>(MemoryChunkLayout::AllocatableMemoryInDataPage() -
-                          array->Size()),
-      CommitPageSize());
-  CHECK_EQ(should_have_shrunk, shrunk);
-}
-
-TEST(ShrinkPageToHighWaterMarkNoFiller) {
-  v8_flags.stress_concurrent_allocation = false;  // For SealCurrentObjects.
-  CcTest::InitializeVM();
-  Isolate* isolate = CcTest::i_isolate();
-  HandleScope scope(isolate);
-  heap::SealCurrentObjects(CcTest::heap());
-
-  const int kFillerSize = 0;
-  DirectHandleVector<FixedArray> arrays(isolate);
-  heap::FillOldSpacePageWithFixedArrays(CcTest::heap(), kFillerSize, &arrays);
-  DirectHandle<FixedArray> array = arrays.back();
-  PageMetadata* page = PageMetadata::FromHeapObject(*array);
-  CHECK_EQ(page->area_end(), array->address() + array->Size() + kFillerSize);
-
-  // Reset space so high water mark and fillers are consistent.
-  PagedSpace* old_space = CcTest::heap()->old_space();
-  CcTest::heap()->FreeMainThreadLinearAllocationAreas();
-  old_space->ResetFreeList();
-
-  size_t shrunk = old_space->ShrinkPageToHighWaterMark(page);
-  CHECK_EQ(0u, shrunk);
-}
-
-TEST(ShrinkPageToHighWaterMarkOneWordFiller) {
-  v8_flags.stress_concurrent_allocation = false;  // For SealCurrentObjects.
-  CcTest::InitializeVM();
-  Isolate* isolate = CcTest::i_isolate();
-  HandleScope scope(isolate);
-
-  heap::SealCurrentObjects(CcTest::heap());
-
-  const int kFillerSize = kTaggedSize;
-  DirectHandleVector<FixedArray> arrays(isolate);
-  heap::FillOldSpacePageWithFixedArrays(CcTest::heap(), kFillerSize, &arrays);
-  DirectHandle<FixedArray> array = arrays.back();
-  PageMetadata* page = PageMetadata::FromHeapObject(*array);
-  CHECK_EQ(page->area_end(), array->address() + array->Size() + kFillerSize);
-
-  // Reset space so high water mark and fillers are consistent.
-  PagedSpace* old_space = CcTest::heap()->old_space();
-  CcTest::heap()->FreeMainThreadLinearAllocationAreas();
-  old_space->ResetFreeList();
-
-  Tagged<HeapObject> filler =
-      HeapObject::FromAddress(array->address() + array->Size());
-  CHECK_EQ(filler->map(),
-           ReadOnlyRoots(CcTest::heap()).one_pointer_filler_map());
-
-  size_t shrunk = old_space->ShrinkPageToHighWaterMark(page);
-  CHECK_EQ(0u, shrunk);
-}
-
-TEST(ShrinkPageToHighWaterMarkTwoWordFiller) {
-  v8_flags.stress_concurrent_allocation = false;  // For SealCurrentObjects.
-  CcTest::InitializeVM();
-  Isolate* isolate = CcTest::i_isolate();
-  HandleScope scope(isolate);
-
-  heap::SealCurrentObjects(CcTest::heap());
-
-  const int kFillerSize = 2 * kTaggedSize;
-  DirectHandleVector<FixedArray> arrays(isolate);
-  heap::FillOldSpacePageWithFixedArrays(CcTest::heap(), kFillerSize, &arrays);
-  DirectHandle<FixedArray> array = arrays.back();
-  PageMetadata* page = PageMetadata::FromHeapObject(*array);
-  CHECK_EQ(page->area_end(), array->address() + array->Size() + kFillerSize);
-
-  // Reset space so high water mark and fillers are consistent.
-  PagedSpace* old_space = CcTest::heap()->old_space();
-  CcTest::heap()->FreeMainThreadLinearAllocationAreas();
-  old_space->ResetFreeList();
-
-  Tagged<HeapObject> filler =
-      HeapObject::FromAddress(array->address() + array->Size());
-  CHECK_EQ(filler->map(),
-           ReadOnlyRoots(CcTest::heap()).two_pointer_filler_map());
-
-  size_t shrunk = old_space->ShrinkPageToHighWaterMark(page);
-  CHECK_EQ(0u, shrunk);
-}
-
 namespace {
 // PageAllocator that always fails.
 class FailingPageAllocator : public v8::PageAllocator {
diff --git a/deps/v8/test/cctest/heap/test-weak-references.cc b/deps/v8/test/cctest/heap/test-weak-references.cc
index 484107d6a8d863..e5a23cd269db78 100644
--- a/deps/v8/test/cctest/heap/test-weak-references.cc
+++ b/deps/v8/test/cctest/heap/test-weak-references.cc
@@ -183,46 +183,6 @@ TEST(WeakReferencesOldToCleared) {
   CHECK(lh->data1().IsCleared());
 }
 
-TEST(ObjectMovesBeforeClearingWeakField) {
-  if (!v8_flags.incremental_marking || v8_flags.single_generation ||
-      v8_flags.separate_gc_phases) {
-    return;
-  }
-  ManualGCScope manual_gc_scope;
-  CcTest::InitializeVM();
-  Isolate* isolate = CcTest::i_isolate();
-  Factory* factory = isolate->factory();
-  Heap* heap = isolate->heap();
-  i::DisableConservativeStackScanningScopeForTesting no_stack_scanning(heap);
-
-  HandleScope outer_scope(isolate);
-  IndirectHandle<LoadHandler> lh = CreateLoadHandlerForTest(factory);
-  CHECK(InCorrectGeneration(*lh));
-  Address lh_object_location = lh->address();
-  {
-    HandleScope inner_scope(isolate);
-    // Create a new FixedArray which the LoadHandler will point to.
-    IndirectHandle<FixedArray> fixed_array = factory->NewFixedArray(1);
-    CHECK(HeapLayout::InYoungGeneration(*fixed_array));
-    lh->set_data1(MakeWeak(*fixed_array));
-    // inner_scope will go out of scope, so when marking the next time,
-    // *fixed_array will stay white.
-  }
-
-  // Do marking steps; this will store *lh into the list for later processing
-  // (since it points to a white object).
-  SimulateIncrementalMarking(heap, true);
-
-  // Scavenger will move *lh.
-  heap::InvokeMinorGC(heap);
-  CHECK_NE(lh_object_location, lh.address());
-  CHECK(lh->data1().IsWeak());
-
-  // Now we try to clear *lh.
-  heap::InvokeMajorGC(heap);
-  CHECK(lh->data1().IsCleared());
-}
-
 TEST(ObjectWithWeakFieldDies) {
   if (!v8_flags.incremental_marking) {
     return;
diff --git a/deps/v8/test/cctest/test-api-array-buffer.cc b/deps/v8/test/cctest/test-api-array-buffer.cc
index e2730bdf41e683..4628573e632095 100644
--- a/deps/v8/test/cctest/test-api-array-buffer.cc
+++ b/deps/v8/test/cctest/test-api-array-buffer.cc
@@ -1265,3 +1265,12 @@ TEST(ArrayBufferView_GetContentsDetached) {
       "data_view";
   TestArrayBufferViewGetContent(source, nullptr);
 }
+
+TEST(ArrayBufferView_GetContentsOutOfBounds) {
+  const char* source =
+      "let ab = new ArrayBuffer(100, {maxByteLength: 200}); "
+      "let ta = new Uint8Array(ab, 2); "
+      "ab.resize(1); "
+      "ta";
+  TestArrayBufferViewGetContent(source, nullptr);
+}
diff --git a/deps/v8/test/cctest/test-api-interceptors.cc b/deps/v8/test/cctest/test-api-interceptors.cc
index 1f8bdbaacae07e..e8299bc287bc5a 100644
--- a/deps/v8/test/cctest/test-api-interceptors.cc
+++ b/deps/v8/test/cctest/test-api-interceptors.cc
@@ -6028,17 +6028,6 @@ v8::Intercepted ShouldNamedInterceptor(
   return v8::Intercepted::kYes;
 }
 
-v8::Intercepted ShouldIndexedInterceptor(
-    uint32_t, const v8::PropertyCallbackInfo<Value>& info) {
-  CheckReturnValue(info, FUNCTION_ADDR(ShouldIndexedInterceptor));
-  auto data = GetWrappedObject<ShouldInterceptData>(info.Data());
-  if (!data->should_intercept) return v8::Intercepted::kNo;
-  // Side effects are allowed only when the property is present or throws.
-  ApiTestFuzzer::Fuzz();
-  info.GetReturnValue().Set(v8_num(data->value));
-  return v8::Intercepted::kYes;
-}
-
 }  // namespace
 
 THREADED_TEST(NonMaskingInterceptorOwnProperty) {
diff --git a/deps/v8/test/cctest/test-api-typed-array.cc b/deps/v8/test/cctest/test-api-typed-array.cc
index 9fab3aeb5a7184..c851bdb2ab8803 100644
--- a/deps/v8/test/cctest/test-api-typed-array.cc
+++ b/deps/v8/test/cctest/test-api-typed-array.cc
@@ -585,6 +585,108 @@ TEST(InternalFieldsOnDataView) {
   }
 }
 
+TEST(DetachedArrayBufferViewsPretendOffsetAndLengthAreZero) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  v8::HandleScope scope(isolate);
+  v8::Local<v8::Context> context = env.local();
+  Context::Scope context_scope(context);
+
+  v8::Local<v8::ArrayBuffer> buffer = v8::Local<v8::ArrayBuffer>::Cast(
+      CompileRun("let ab = new ArrayBuffer(100, {maxByteLength: 200}); ab"));
+
+  v8::Local<v8::Uint16Array> fixed_length_ta =
+      v8::Uint16Array::New(buffer, 2, 1);
+  // Length-tracking TypedArrays cannot (yet) be constructed via the API.
+  v8::Local<v8::Uint16Array> length_tracking_ta =
+      v8::Local<v8::Uint16Array>::Cast(CompileRun("new Uint16Array(ab, 2)"));
+
+  // RAB/GSAB-backed DataViews cannot (yet) be constructed via the API.
+  v8::Local<v8::DataView> fixed_length_dv =
+      v8::Local<v8::DataView>::Cast(CompileRun("new DataView(ab, 1, 1)"));
+  v8::Local<v8::DataView> length_tracking_dv =
+      v8::Local<v8::DataView>::Cast(CompileRun("new DataView(ab, 1)"));
+
+  CHECK_EQ(2, fixed_length_ta->ByteOffset());
+  CHECK_EQ(2, length_tracking_ta->ByteOffset());
+  CHECK_EQ(1, fixed_length_dv->ByteOffset());
+  CHECK_EQ(1, length_tracking_dv->ByteOffset());
+
+  CHECK_EQ(2, fixed_length_ta->ByteLength());
+  CHECK_EQ(98, length_tracking_ta->ByteLength());
+  CHECK_EQ(1, fixed_length_dv->ByteLength());
+  CHECK_EQ(99, length_tracking_dv->ByteLength());
+
+  CHECK_EQ(1, fixed_length_ta->Length());
+  CHECK_EQ(49, length_tracking_ta->Length());
+
+  buffer->Detach({}).Check();
+
+  CHECK_EQ(0, fixed_length_ta->ByteOffset());
+  CHECK_EQ(0, length_tracking_ta->ByteOffset());
+  CHECK_EQ(0, fixed_length_dv->ByteOffset());
+  CHECK_EQ(0, length_tracking_dv->ByteOffset());
+
+  CHECK_EQ(0, fixed_length_ta->ByteLength());
+  CHECK_EQ(0, length_tracking_ta->ByteLength());
+  CHECK_EQ(0, fixed_length_dv->ByteLength());
+  CHECK_EQ(0, length_tracking_dv->ByteLength());
+
+  CHECK_EQ(0, fixed_length_ta->Length());
+  CHECK_EQ(0, length_tracking_ta->Length());
+}
+
+TEST(OutOfBoundsArrayBufferViewsPretendOffsetAndLengthAreZero) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  v8::HandleScope scope(isolate);
+  v8::Local<v8::Context> context = env.local();
+  Context::Scope context_scope(context);
+
+  v8::Local<v8::ArrayBuffer> buffer = v8::Local<v8::ArrayBuffer>::Cast(
+      CompileRun("let ab = new ArrayBuffer(100, {maxByteLength: 200}); ab"));
+
+  v8::Local<v8::Uint16Array> fixed_length_ta =
+      v8::Uint16Array::New(buffer, 2, 1);
+  // Length-tracking TypedArrays cannot (yet) be constructed via the API.
+  v8::Local<v8::Uint16Array> length_tracking_ta =
+      v8::Local<v8::Uint16Array>::Cast(CompileRun("new Uint16Array(ab, 2)"));
+
+  // RAB/GSAB-backed DataViews cannot (yet) be constructed via the API.
+  v8::Local<v8::DataView> fixed_length_dv =
+      v8::Local<v8::DataView>::Cast(CompileRun("new DataView(ab, 1, 1)"));
+  v8::Local<v8::DataView> length_tracking_dv =
+      v8::Local<v8::DataView>::Cast(CompileRun("new DataView(ab, 1)"));
+
+  CHECK_EQ(2, fixed_length_ta->ByteOffset());
+  CHECK_EQ(2, length_tracking_ta->ByteOffset());
+  CHECK_EQ(1, fixed_length_dv->ByteOffset());
+  CHECK_EQ(1, length_tracking_dv->ByteOffset());
+
+  CHECK_EQ(2, fixed_length_ta->ByteLength());
+  CHECK_EQ(98, length_tracking_ta->ByteLength());
+  CHECK_EQ(1, fixed_length_dv->ByteLength());
+  CHECK_EQ(99, length_tracking_dv->ByteLength());
+
+  CHECK_EQ(1, fixed_length_ta->Length());
+  CHECK_EQ(49, length_tracking_ta->Length());
+
+  CompileRun("ab.resize(0)");
+
+  CHECK_EQ(0, fixed_length_ta->ByteOffset());
+  CHECK_EQ(0, length_tracking_ta->ByteOffset());
+  CHECK_EQ(0, fixed_length_dv->ByteOffset());
+  CHECK_EQ(0, length_tracking_dv->ByteOffset());
+
+  CHECK_EQ(0, fixed_length_ta->ByteLength());
+  CHECK_EQ(0, length_tracking_ta->ByteLength());
+  CHECK_EQ(0, fixed_length_dv->ByteLength());
+  CHECK_EQ(0, length_tracking_dv->ByteLength());
+
+  CHECK_EQ(0, fixed_length_ta->Length());
+  CHECK_EQ(0, length_tracking_ta->Length());
+}
+
 namespace {
 void TestOnHeapHasBuffer(const char* array_name, size_t elem_size) {
   LocalContext env;
diff --git a/deps/v8/test/cctest/test-api.cc b/deps/v8/test/cctest/test-api.cc
index 0f023d15cfc181..c0c1506fce748b 100644
--- a/deps/v8/test/cctest/test-api.cc
+++ b/deps/v8/test/cctest/test-api.cc
@@ -41,6 +41,9 @@
 #include <unistd.h>
 #endif
 
+#include "include/cppgc/allocation.h"
+#include "include/cppgc/persistent.h"
+#include "include/v8-cpp-heap-external.h"
 #include "include/v8-date.h"
 #include "include/v8-extension.h"
 #include "include/v8-fast-api-calls.h"
@@ -64,7 +67,9 @@
 #include "src/execution/protectors-inl.h"
 #include "src/handles/global-handles.h"
 #include "src/heap/heap-inl.h"
+#include "src/heap/heap.h"
 #include "src/heap/incremental-marking.h"
+#include "src/init/v8.h"
 #include "src/logging/metrics.h"
 #include "src/objects/feedback-vector-inl.h"
 #include "src/objects/feedback-vector.h"
@@ -96,6 +101,7 @@ using ::v8::Array;
 using ::v8::Boolean;
 using ::v8::BooleanObject;
 using ::v8::Context;
+using ::v8::CppHeapExternal;
 using ::v8::Extension;
 using ::v8::External;
 using ::v8::FixedArray;
@@ -4006,6 +4012,8 @@ THREADED_TEST(WellKnownSymbols) {
   CheckWellKnownSymbol(v8::Symbol::GetSplit, "Symbol.split");
   CheckWellKnownSymbol(v8::Symbol::GetToPrimitive, "Symbol.toPrimitive");
   CheckWellKnownSymbol(v8::Symbol::GetToStringTag, "Symbol.toStringTag");
+  CheckWellKnownSymbol(v8::Symbol::GetDispose, "Symbol.dispose");
+  CheckWellKnownSymbol(v8::Symbol::GetAsyncDispose, "Symbol.asyncDispose");
 }
 
 
@@ -12081,37 +12089,6 @@ void FastApiCallback_TrivialSignature(
       info[0]->Int32Value(isolate->GetCurrentContext()).FromJust() + 1);
 }
 
-// Allow usages of v8::Object::GetPrototype() for now.
-// TODO(https://crbug.com/333672197): remove.
-START_ALLOW_USE_DEPRECATED()
-
-void FastApiCallback_SimpleSignature(
-    const v8::FunctionCallbackInfo<v8::Value>& info) {
-  CHECK(i::ValidateCallbackInfo(info));
-  ApiTestFuzzer::Fuzz();
-  CheckReturnValue(info, FUNCTION_ADDR(FastApiCallback_SimpleSignature));
-  v8::Isolate* isolate = CcTest::isolate();
-  CHECK_EQ(isolate, info.GetIsolate());
-  CHECK(info.This()
-            ->GetPrototype()
-            ->Equals(isolate->GetCurrentContext(), info.This())
-            .FromJust());
-  CHECK(info.Data()
-            ->Equals(isolate->GetCurrentContext(), v8_str("method_data"))
-            .FromJust());
-  // Note, we're using HasRealNamedProperty instead of Has to avoid
-  // invoking the interceptor again.
-  CHECK(info.This()
-            ->HasRealNamedProperty(isolate->GetCurrentContext(), v8_str("foo"))
-            .FromJust());
-  info.GetReturnValue().Set(
-      info[0]->Int32Value(isolate->GetCurrentContext()).FromJust() + 1);
-}
-
-// Allow usages of v8::Object::GetPrototype() for now.
-// TODO(https://crbug.com/333672197): remove.
-END_ALLOW_USE_DEPRECATED()
-
 // Helper to maximize the odds of object moving.
 void GenerateSomeGarbage() {
   CompileRun(
@@ -13570,8 +13547,10 @@ UNINITIALIZED_TEST(TwoIsolateGroups) {
   v8::Isolate::CreateParams create_params_2;
   create_params_2.array_buffer_allocator =
       v8::ArrayBuffer::Allocator::NewDefaultAllocator(groups[1]);
+#ifdef V8_ENABLE_SANDBOX
   CHECK_NE(create_params_1.array_buffer_allocator->GetPageAllocator(),
            create_params_2.array_buffer_allocator->GetPageAllocator());
+#endif
 
   TestAllocateAndNewForTwoIsolateGroups(create_params_1, create_params_2,
                                         groups[0], groups[1]);
@@ -31264,6 +31243,19 @@ TEST(GettingHashSeed) {
   CHECK_GT(isolate->GetHashSeed(), 0);
 }
 
+TEST(CanonicalizingUnicodeLocaleId) {
+  LocalContext env;
+  v8::Isolate* isolate = env->GetIsolate();
+  // Test the function exists, and that if Intl is unsupported, Nothing is
+  // returned. The functionality itself is mostly not useful to test here as
+  // it's locale-dependent.
+#ifdef V8_INTL_SUPPORT
+  CHECK(isolate->ValidateAndCanonicalizeUnicodeLocaleId("en").IsJust());
+#else
+  CHECK(isolate->ValidateAndCanonicalizeUnicodeLocaleId("en").IsNothing());
+#endif
+}
+
 TEST(LocalCasts) {
   LocalContext context;
   v8::Isolate* isolate = context->GetIsolate();
@@ -31345,6 +31337,88 @@ TEST(LocalCasts) {
   }
 }
 
+class TestGarbagedCollectedData
+    : public cppgc::GarbageCollected<TestGarbagedCollectedData> {
+ public:
+  void Trace(cppgc::Visitor*) const {}
+};
+
+class GCedWithCppHeapExternalJSRef
+    : public cppgc::GarbageCollected<GCedWithCppHeapExternalJSRef> {
+ public:
+  GCedWithCppHeapExternalJSRef(v8::Isolate* isolate,
+                               TestGarbagedCollectedData* data)
+      : isolate_(isolate) {
+    v8::HandleScope scope(isolate_);
+    v8::Local<v8::CppHeapExternal> external =
+        v8::CppHeapExternal::New<TestGarbagedCollectedData>(
+            isolate, data, v8::CppHeapPointerTag::kDefaultTag);
+    v8_cpp_heap_external_.Reset(isolate_, external);
+  }
+
+  TestGarbagedCollectedData* GetData() const {
+    v8::HandleScope scope(isolate_);
+    v8::Local<v8::Data> data = v8_cpp_heap_external_.Get(isolate_);
+    CHECK(data->IsCppHeapExternal());
+    auto external = v8::Local<v8::CppHeapExternal>::Cast(data);
+    return external->Value<TestGarbagedCollectedData>(
+        isolate_,
+        v8::CppHeapPointerTagRange(v8::CppHeapPointerTag::kDefaultTag,
+                                   v8::CppHeapPointerTag::kDefaultTag));
+  }
+
+  void Trace(cppgc::Visitor* v) const { v->Trace(v8_cpp_heap_external_); }
+
+ private:
+  // Store as `v8::Data` to test casting.
+  v8::TracedReference<v8::Data> v8_cpp_heap_external_;
+  v8::Isolate* isolate_;
+};
+
+TEST(CppHeapExternal) {
+  v8::Isolate::CreateParams create_params = CreateTestParams();
+  create_params.cpp_heap =
+      v8::CppHeap::Create(::v8::internal::V8::GetCurrentPlatform(),
+                          v8::CppHeapCreateParams({}))
+          .release();
+  v8::Isolate* isolate = v8::Isolate::New(create_params);
+  isolate->Enter();
+  v8::CppHeap* cpp_heap = isolate->GetCppHeap();
+  i::Heap* heap = reinterpret_cast<i::Isolate*>(isolate)->heap();
+
+  cppgc::WeakPersistent<TestGarbagedCollectedData> cpp_object(
+      cppgc::MakeGarbageCollected<TestGarbagedCollectedData>(
+          cpp_heap->GetAllocationHandle()));
+  cppgc::Persistent<GCedWithCppHeapExternalJSRef> holder(
+      cppgc::MakeGarbageCollected<GCedWithCppHeapExternalJSRef>(
+          cpp_heap->GetAllocationHandle(), isolate, cpp_object.Get()));
+
+  CHECK_EQ(cpp_object.Get(), holder->GetData());
+
+  // The `cpp_object` should still exist and match the external after GC.
+  {
+    i::EmbedderStackStateScope stack_scope(
+        heap, i::EmbedderStackStateOrigin::kExplicitInvocation,
+        v8::StackState::kNoHeapPointers);
+    i::heap::InvokeMajorGC(heap);
+    CHECK(cpp_object.Get());
+    CHECK_EQ(cpp_object.Get(), holder->GetData());
+  }
+  // Clearing the root holding the external should allow the `cpp_object` to be
+  // GCed.
+  holder.Clear();
+  {
+    i::EmbedderStackStateScope stack_scope(
+        heap, i::EmbedderStackStateOrigin::kExplicitInvocation,
+        v8::StackState::kNoHeapPointers);
+    i::heap::InvokeMajorGC(heap);
+    CHECK(!cpp_object.Get());
+  }
+
+  isolate->Exit();
+  isolate->Dispose();
+}
+
 TEST(IsolateFree) {
   v8::Isolate* isolate1 = v8::Isolate::Allocate();
   v8::Isolate::Initialize(isolate1, CreateTestParams());
diff --git a/deps/v8/test/cctest/test-assembler-arm64.cc b/deps/v8/test/cctest/test-assembler-arm64.cc
index e86dd4e4f9c0a2..f99c69a2607ac8 100644
--- a/deps/v8/test/cctest/test-assembler-arm64.cc
+++ b/deps/v8/test/cctest/test-assembler-arm64.cc
@@ -1841,6 +1841,95 @@ TEST(branch_cond) {
   CHECK_EQUAL_64(0x1, x0);
 }
 
+TEST(branch_cond_consistent) {
+  INIT_V8();
+  SETUP();
+  SETUP_FEATURE(HBC);
+
+  Label wrong;
+
+  START();
+  __ Mov(x0, 0x1);
+  __ Mov(x1, 0x1);
+  __ Mov(x2, 0x8000000000000000L);
+
+  // For each 'cmp' instruction below, condition codes other than the ones
+  // following it would branch.
+
+  __ Cmp(x1, 0);
+  __ bc(&wrong, eq);
+  __ bc(&wrong, lo);
+  __ bc(&wrong, mi);
+  __ bc(&wrong, vs);
+  __ bc(&wrong, ls);
+  __ bc(&wrong, lt);
+  __ bc(&wrong, le);
+  Label ok_1;
+  __ bc(&ok_1, ne);
+  __ Mov(x0, 0x0);
+  __ Bind(&ok_1);
+
+  __ Cmp(x1, 1);
+  __ bc(&wrong, ne);
+  __ bc(&wrong, lo);
+  __ bc(&wrong, mi);
+  __ bc(&wrong, vs);
+  __ bc(&wrong, hi);
+  __ bc(&wrong, lt);
+  __ bc(&wrong, gt);
+  Label ok_2;
+  __ bc(&ok_2, pl);
+  __ Mov(x0, 0x0);
+  __ Bind(&ok_2);
+
+  __ Cmp(x1, 2);
+  __ bc(&wrong, eq);
+  __ bc(&wrong, hs);
+  __ bc(&wrong, pl);
+  __ bc(&wrong, vs);
+  __ bc(&wrong, hi);
+  __ bc(&wrong, ge);
+  __ bc(&wrong, gt);
+  Label ok_3;
+  __ bc(&ok_3, vc);
+  __ Mov(x0, 0x0);
+  __ Bind(&ok_3);
+
+  __ Cmp(x2, 1);
+  __ bc(&wrong, eq);
+  __ bc(&wrong, lo);
+  __ bc(&wrong, mi);
+  __ bc(&wrong, vc);
+  __ bc(&wrong, ls);
+  __ bc(&wrong, ge);
+  __ bc(&wrong, gt);
+  Label ok_4;
+  __ bc(&ok_4, le);
+  __ Mov(x0, 0x0);
+  __ Bind(&ok_4);
+
+  Label ok_5;
+  __ bc(&ok_5, al);
+  __ Mov(x0, 0x0);
+  __ Bind(&ok_5);
+
+  Label ok_6;
+  __ bc(&ok_6, nv);
+  __ Mov(x0, 0x0);
+  __ Bind(&ok_6);
+
+  END();
+
+  __ Bind(&wrong);
+  __ Mov(x0, 0x0);
+  END();
+
+  if (CAN_RUN()) {
+    RUN();
+    CHECK_EQUAL_64(0x1, x0);
+  }
+}
+
 TEST(branch_to_reg) {
   INIT_V8();
   SETUP();
@@ -3132,6 +3221,13 @@ TEST(neon_ld1_d_postindex) {
          MemOperand(x21, 32, PostIndex));
   __ Ld1(v20.V1D(), v21.V1D(), v22.V1D(), v23.V1D(),
          MemOperand(x22, 32, PostIndex));
+
+  // Check PostIndex operation on sp.
+  __ Mov(x23, sp);
+  __ Ld1(v24.V8B(), v25.V8B(), MemOperand(sp, 16, PostIndex));
+  __ Mov(x24, sp);  // actual sp with post index.
+  __ Mov(sp, x23);
+  __ Add(x23, x23, 16);  // expected sp with post index.
   END();
 
   RUN();
@@ -3160,6 +3256,7 @@ TEST(neon_ld1_d_postindex) {
   CHECK_EQUAL_64(src_base + 3 + 32, x20);
   CHECK_EQUAL_64(src_base + 4 + 32, x21);
   CHECK_EQUAL_64(src_base + 5 + 32, x22);
+  CHECK_EQUAL_64(x23, x24);
 }
 
 TEST(neon_ld1_q) {
@@ -3227,6 +3324,13 @@ TEST(neon_ld1_q_postindex) {
          MemOperand(x20, 64, PostIndex));
   __ Ld1(v30.V2D(), v31.V2D(), v0.V2D(), v1.V2D(),
          MemOperand(x21, 64, PostIndex));
+
+  // Check PostIndex operation on sp.
+  __ Mov(x23, sp);
+  __ Ld1(v24.V16B(), MemOperand(sp, 16, PostIndex));
+  __ Mov(x24, sp);  // actual sp with post index.
+  __ Mov(sp, x23);
+  __ Add(x23, x23, 16);  // expected sp with post index.
   END();
 
   RUN();
@@ -3250,6 +3354,7 @@ TEST(neon_ld1_q_postindex) {
   CHECK_EQUAL_64(src_base + 2 + 48, x19);
   CHECK_EQUAL_64(src_base + 3 + 64, x20);
   CHECK_EQUAL_64(src_base + 4 + 64, x21);
+  CHECK_EQUAL_64(x23, x24);
 }
 
 TEST(neon_ld1_lane) {
@@ -3369,6 +3474,13 @@ TEST(neon_ld2_d_postindex) {
   __ Ld2(v5.V4H(), v6.V4H(), MemOperand(x19, 16, PostIndex));
   __ Ld2(v16.V2S(), v17.V2S(), MemOperand(x20, 16, PostIndex));
   __ Ld2(v31.V2S(), v0.V2S(), MemOperand(x21, 16, PostIndex));
+
+  // Check PostIndex operation on sp.
+  __ Mov(x23, sp);
+  __ Ld2(v18.V8B(), v19.V8B(), MemOperand(sp, 16, PostIndex));
+  __ Mov(x24, sp);  // actual sp with post index.
+  __ Mov(sp, x23);
+  __ Add(x23, x23, 16);  // expected sp with post index.
   END();
 
   RUN();
@@ -3388,6 +3500,7 @@ TEST(neon_ld2_d_postindex) {
   CHECK_EQUAL_64(src_base + 2 + 16, x19);
   CHECK_EQUAL_64(src_base + 3 + 16, x20);
   CHECK_EQUAL_64(src_base + 4 + 16, x21);
+  CHECK_EQUAL_64(x23, x24);
 }
 
 TEST(neon_ld2_q) {
@@ -3449,6 +3562,13 @@ TEST(neon_ld2_q_postindex) {
   __ Ld2(v6.V8H(), v7.V8H(), MemOperand(x19, 32, PostIndex));
   __ Ld2(v16.V4S(), v17.V4S(), MemOperand(x20, 32, PostIndex));
   __ Ld2(v31.V2D(), v0.V2D(), MemOperand(x21, 32, PostIndex));
+
+  // Check PostIndex operation on sp.
+  __ Mov(x23, sp);
+  __ Ld2(v18.V16B(), v19.V16B(), MemOperand(sp, 32, PostIndex));
+  __ Mov(x24, sp);  // actual sp with post index.
+  __ Mov(sp, x23);
+  __ Add(x23, x23, 32);  // expected sp with post index.
   END();
 
   RUN();
@@ -3469,6 +3589,7 @@ TEST(neon_ld2_q_postindex) {
   CHECK_EQUAL_64(src_base + 2 + 32, x19);
   CHECK_EQUAL_64(src_base + 3 + 32, x20);
   CHECK_EQUAL_64(src_base + 4 + 32, x21);
+  CHECK_EQUAL_64(x23, x24);
 }
 
 TEST(neon_ld2_lane) {
@@ -3611,6 +3732,12 @@ TEST(neon_ld2_lane_postindex) {
   __ Ldr(q15, MemOperand(x7));
   __ Ld2(v14.D(), v15.D(), 1, MemOperand(x24, x25, PostIndex));
 
+  // Check PostIndex operation on sp.
+  __ Mov(x25, sp);
+  __ Ld2(v18.D(), v19.D(), 1, MemOperand(sp, 16, PostIndex));
+  __ Mov(x26, sp);  // actual sp with post index.
+  __ Mov(sp, x25);
+  __ Add(x25, x25, 16);  // expected sp with post index.
   END();
 
   RUN();
@@ -3640,6 +3767,7 @@ TEST(neon_ld2_lane_postindex) {
   CHECK_EQUAL_64(src_base + 2, x22);
   CHECK_EQUAL_64(src_base + 3, x23);
   CHECK_EQUAL_64(src_base + 4, x24);
+  CHECK_EQUAL_64(x25, x26);
 }
 
 TEST(neon_ld2_alllanes) {
@@ -3707,6 +3835,13 @@ TEST(neon_ld2_alllanes_postindex) {
   __ Ld2r(v8_.V2S(), v9.V2S(), MemOperand(x17, x19, PostIndex));
   __ Ld2r(v10.V4S(), v11.V4S(), MemOperand(x17, 8, PostIndex));
   __ Ld2r(v12.V2D(), v13.V2D(), MemOperand(x17, 16, PostIndex));
+
+  // Check PostIndex operation on sp.
+  __ Mov(x23, sp);
+  __ Ld2r(v18.V2D(), v19.V2D(), MemOperand(sp, 16, PostIndex));
+  __ Mov(x24, sp);  // actual sp with post index.
+  __ Mov(sp, x23);
+  __ Add(x23, x23, 16);  // expected sp with post index.
   END();
 
   RUN();
@@ -3726,6 +3861,7 @@ TEST(neon_ld2_alllanes_postindex) {
   CHECK_EQUAL_128(0x1918171615141312, 0x1918171615141312, q12);
   CHECK_EQUAL_128(0x21201F1E1D1C1B1A, 0x21201F1E1D1C1B1A, q13);
   CHECK_EQUAL_64(src_base + 34, x17);
+  CHECK_EQUAL_64(x23, x24);
 }
 
 TEST(neon_ld3_d) {
@@ -3787,6 +3923,14 @@ TEST(neon_ld3_d_postindex) {
   __ Ld3(v8_.V4H(), v9.V4H(), v10.V4H(), MemOperand(x19, 24, PostIndex));
   __ Ld3(v11.V2S(), v12.V2S(), v13.V2S(), MemOperand(x20, 24, PostIndex));
   __ Ld3(v31.V2S(), v0.V2S(), v1.V2S(), MemOperand(x21, 24, PostIndex));
+
+  // Check PostIndex operation on sp.
+  __ Mov(x25, 32);
+  __ Mov(x23, sp);
+  __ Ld3(v18.V8B(), v19.V8B(), v20.V8B(), MemOperand(sp, x25, PostIndex));
+  __ Mov(x24, sp);  // actual sp with post index.
+  __ Mov(sp, x23);
+  __ Add(x23, x23, x25);  // expected sp with post index.
   END();
 
   RUN();
@@ -3812,6 +3956,7 @@ TEST(neon_ld3_d_postindex) {
   CHECK_EQUAL_64(src_base + 2 + 24, x19);
   CHECK_EQUAL_64(src_base + 3 + 24, x20);
   CHECK_EQUAL_64(src_base + 4 + 24, x21);
+  CHECK_EQUAL_64(x23, x24);
 }
 
 TEST(neon_ld3_q) {
@@ -3879,6 +4024,13 @@ TEST(neon_ld3_q_postindex) {
   __ Ld3(v8_.V8H(), v9.V8H(), v10.V8H(), MemOperand(x19, 48, PostIndex));
   __ Ld3(v11.V4S(), v12.V4S(), v13.V4S(), MemOperand(x20, 48, PostIndex));
   __ Ld3(v31.V2D(), v0.V2D(), v1.V2D(), MemOperand(x21, 48, PostIndex));
+
+  // Check PostIndex operation on sp.
+  __ Mov(x23, sp);
+  __ Ld3(v18.V16B(), v19.V16B(), v20.V16B(), MemOperand(sp, 48, PostIndex));
+  __ Mov(x24, sp);  // actual sp with post index.
+  __ Mov(sp, x23);
+  __ Add(x23, x23, 48);  // expected sp with post index.
   END();
 
   RUN();
@@ -3904,6 +4056,7 @@ TEST(neon_ld3_q_postindex) {
   CHECK_EQUAL_64(src_base + 2 + 48, x19);
   CHECK_EQUAL_64(src_base + 3 + 48, x20);
   CHECK_EQUAL_64(src_base + 4 + 48, x21);
+  CHECK_EQUAL_64(x23, x24);
 }
 
 TEST(neon_ld3_lane) {
@@ -4056,6 +4209,13 @@ TEST(neon_ld3_lane_postindex) {
   __ Ldr(q23, MemOperand(x7));
   __ Ld3(v21.D(), v22.D(), v23.D(), 1, MemOperand(x24, x25, PostIndex));
 
+  // Check PostIndex operation on sp.
+  __ Mov(x27, 32);
+  __ Mov(x25, sp);
+  __ Ld3(v24.D(), v25.D(), v26.D(), 1, MemOperand(sp, x27, PostIndex));
+  __ Mov(x26, sp);  // actual sp with post index.
+  __ Mov(sp, x25);
+  __ Add(x25, x25, x27);  // expected sp with post index.
   END();
 
   RUN();
@@ -4093,6 +4253,7 @@ TEST(neon_ld3_lane_postindex) {
   CHECK_EQUAL_64(src_base + 2, x22);
   CHECK_EQUAL_64(src_base + 3, x23);
   CHECK_EQUAL_64(src_base + 4, x24);
+  CHECK_EQUAL_64(x25, x26);
 }
 
 TEST(neon_ld3_alllanes) {
@@ -4167,6 +4328,14 @@ TEST(neon_ld3_alllanes_postindex) {
   __ Ld3r(v12.V2S(), v13.V2S(), v14.V2S(), MemOperand(x17, x19, PostIndex));
   __ Ld3r(v15.V4S(), v16.V4S(), v17.V4S(), MemOperand(x17, 12, PostIndex));
   __ Ld3r(v18.V2D(), v19.V2D(), v20.V2D(), MemOperand(x17, 24, PostIndex));
+
+  // Check PostIndex operation on sp.
+  __ Mov(x25, 32);
+  __ Mov(x23, sp);
+  __ Ld3r(v21.V2D(), v22.V2D(), v23.V2D(), MemOperand(sp, x25, PostIndex));
+  __ Mov(x24, sp);  // actual sp with post index.
+  __ Mov(sp, x23);
+  __ Add(x23, x23, x25);  // expected sp with post index.
   END();
 
   RUN();
@@ -4192,6 +4361,7 @@ TEST(neon_ld3_alllanes_postindex) {
   CHECK_EQUAL_128(0x201F1E1D1C1B1A19, 0x201F1E1D1C1B1A19, q18);
   CHECK_EQUAL_128(0x2827262524232221, 0x2827262524232221, q19);
   CHECK_EQUAL_128(0x302F2E2D2C2B2A29, 0x302F2E2D2C2B2A29, q20);
+  CHECK_EQUAL_64(x23, x24);
 }
 
 TEST(neon_ld4_d) {
@@ -4262,6 +4432,14 @@ TEST(neon_ld4_d_postindex) {
          MemOperand(x20, 32, PostIndex));
   __ Ld4(v30.V2S(), v31.V2S(), v0.V2S(), v1.V2S(),
          MemOperand(x21, 32, PostIndex));
+
+  // Check PostIndex operation on sp.
+  __ Mov(x23, sp);
+  __ Ld4(v18.V8B(), v19.V8B(), v20.V8B(), v21.V8B(),
+         MemOperand(sp, 32, PostIndex));
+  __ Mov(x24, sp);  // actual sp with post index.
+  __ Mov(sp, x23);
+  __ Add(x23, x23, 32);  // expected sp with post index.
   END();
 
   RUN();
@@ -4292,6 +4470,7 @@ TEST(neon_ld4_d_postindex) {
   CHECK_EQUAL_64(src_base + 2 + 32, x19);
   CHECK_EQUAL_64(src_base + 3 + 32, x20);
   CHECK_EQUAL_64(src_base + 4 + 32, x21);
+  CHECK_EQUAL_64(x23, x24);
 }
 
 TEST(neon_ld4_q) {
@@ -15668,111 +15847,138 @@ TEST(near_call_no_relocation) {
   CHECK_EQUAL_64(1, x0);
 }
 
-static void AbsHelperX(int64_t value) {
-  int64_t expected;
-
-  SETUP();
-  START();
-
-  Label fail;
-  Label done;
-
-  __ Mov(x0, 0);
-  __ Mov(x1, value);
-
-  if (value != kXMinInt) {
-    expected = std::abs(value);
-
-    Label next;
-    // The result is representable.
-    __ Abs(x10, x1);
-    __ Abs(x11, x1, &fail);
-    __ Abs(x12, x1, &fail, &next);
-    __ Bind(&next);
-    __ Abs(x13, x1, nullptr, &done);
-  } else {
-    // std::abs is undefined for kXMinInt but our implementation in the
-    // MacroAssembler will return kXMinInt in such a case.
-    expected = kXMinInt;
-
-    Label next;
-    // The result is not representable.
-    __ Abs(x10, x1);
-    __ Abs(x11, x1, nullptr, &fail);
-    __ Abs(x12, x1, &next, &fail);
-    __ Bind(&next);
-    __ Abs(x13, x1, &done);
+#define ABS_HELPER_X(can_run, value)                                    \
+  int64_t expected;                                                     \
+                                                                        \
+  START();                                                              \
+                                                                        \
+  Label fail;                                                           \
+  Label done;                                                           \
+                                                                        \
+  __ Mov(x0, 0);                                                        \
+  __ Mov(x1, (value));                                                  \
+                                                                        \
+  if ((value) != kXMinInt) {                                            \
+    expected = std::abs(value);                                         \
+                                                                        \
+    Label next;                                                         \
+    /* The result is representable. */                                  \
+    __ AbsWithOverflow(x10, x1);                                        \
+    __ AbsWithOverflow(x11, x1, &fail);                                 \
+    __ AbsWithOverflow(x12, x1, &fail, &next);                          \
+    __ Bind(&next);                                                     \
+    __ AbsWithOverflow(x13, x1, nullptr, &done);                        \
+  } else {                                                              \
+    /* std::abs is undefined for kXMinInt but our implementation in the \
+       MacroAssembler will return kXMinInt in such a case. */           \
+    expected = kXMinInt;                                                \
+                                                                        \
+    Label next;                                                         \
+    /* The result is not representable. */                              \
+    __ AbsWithOverflow(x10, x1);                                        \
+    __ AbsWithOverflow(x11, x1, nullptr, &fail);                        \
+    __ AbsWithOverflow(x12, x1, &next, &fail);                          \
+    __ Bind(&next);                                                     \
+    __ AbsWithOverflow(x13, x1, &done);                                 \
+  }                                                                     \
+                                                                        \
+  __ Bind(&fail);                                                       \
+  __ Mov(x0, -1);                                                       \
+                                                                        \
+  __ Bind(&done);                                                       \
+                                                                        \
+  END();                                                                \
+                                                                        \
+  if (can_run) {                                                        \
+    RUN();                                                              \
+                                                                        \
+    CHECK_EQUAL_64(0, x0);                                              \
+    CHECK_EQUAL_64((value), x1);                                        \
+    CHECK_EQUAL_64(expected, x10);                                      \
+    CHECK_EQUAL_64(expected, x11);                                      \
+    CHECK_EQUAL_64(expected, x12);                                      \
+    CHECK_EQUAL_64(expected, x13);                                      \
   }
 
-  __ Bind(&fail);
-  __ Mov(x0, -1);
-
-  __ Bind(&done);
-
-  END();
-  RUN();
+static void AbsHelperX(int64_t value) {
+  {
+    SETUP();
+    ABS_HELPER_X(true, value);
+  }
 
-  CHECK_EQUAL_64(0, x0);
-  CHECK_EQUAL_64(value, x1);
-  CHECK_EQUAL_64(expected, x10);
-  CHECK_EQUAL_64(expected, x11);
-  CHECK_EQUAL_64(expected, x12);
-  CHECK_EQUAL_64(expected, x13);
+  {
+    SETUP();
+    SETUP_FEATURE(CSSC);
+    ABS_HELPER_X(CAN_RUN(), value);
+  }
 }
 
+#define ABS_HELPER_W(can_run, value)                                           \
+  int32_t expected;                                                            \
+                                                                               \
+  START();                                                                     \
+                                                                               \
+  Label fail;                                                                  \
+  Label done;                                                                  \
+                                                                               \
+  __ Mov(w0, 0);                                                               \
+  /* TODO(jbramley): The cast is needed to avoid a sign-extension bug in VIXL. \
+     Once it is fixed, we should remove the cast. */                           \
+  __ Mov(w1, static_cast<uint32_t>(value));                                    \
+                                                                               \
+  if ((value) != kWMinInt) {                                                   \
+    expected = abs(value);                                                     \
+                                                                               \
+    Label next;                                                                \
+    /* The result is representable. */                                         \
+    __ AbsWithOverflow(w10, w1);                                               \
+    __ AbsWithOverflow(w11, w1, &fail);                                        \
+    __ AbsWithOverflow(w12, w1, &fail, &next);                                 \
+    __ Bind(&next);                                                            \
+    __ AbsWithOverflow(w13, w1, nullptr, &done);                               \
+  } else {                                                                     \
+    /* abs is undefined for kWMinInt but our implementation in the             \
+       MacroAssembler will return kWMinInt in such a case. */                  \
+    expected = kWMinInt;                                                       \
+                                                                               \
+    Label next;                                                                \
+    /* The result is not representable. */                                     \
+    __ AbsWithOverflow(w10, w1);                                               \
+    __ AbsWithOverflow(w11, w1, nullptr, &fail);                               \
+    __ AbsWithOverflow(w12, w1, &next, &fail);                                 \
+    __ Bind(&next);                                                            \
+    __ AbsWithOverflow(w13, w1, &done);                                        \
+  }                                                                            \
+                                                                               \
+  __ Bind(&fail);                                                              \
+  __ Mov(w0, -1);                                                              \
+                                                                               \
+  __ Bind(&done);                                                              \
+                                                                               \
+  END();                                                                       \
+                                                                               \
+  if (can_run) {                                                               \
+    RUN();                                                                     \
+                                                                               \
+    CHECK_EQUAL_32(0, w0);                                                     \
+    CHECK_EQUAL_32((value), w1);                                               \
+    CHECK_EQUAL_32(expected, w10);                                             \
+    CHECK_EQUAL_32(expected, w11);                                             \
+    CHECK_EQUAL_32(expected, w12);                                             \
+    CHECK_EQUAL_32(expected, w13);                                             \
+  }
 
 static void AbsHelperW(int32_t value) {
-  int32_t expected;
-
-  SETUP();
-  START();
-
-  Label fail;
-  Label done;
-
-  __ Mov(w0, 0);
-  // TODO(jbramley): The cast is needed to avoid a sign-extension bug in VIXL.
-  // Once it is fixed, we should remove the cast.
-  __ Mov(w1, static_cast<uint32_t>(value));
-
-  if (value != kWMinInt) {
-    expected = abs(value);
-
-    Label next;
-    // The result is representable.
-    __ Abs(w10, w1);
-    __ Abs(w11, w1, &fail);
-    __ Abs(w12, w1, &fail, &next);
-    __ Bind(&next);
-    __ Abs(w13, w1, nullptr, &done);
-  } else {
-    // abs is undefined for kWMinInt but our implementation in the
-    // MacroAssembler will return kWMinInt in such a case.
-    expected = kWMinInt;
-
-    Label next;
-    // The result is not representable.
-    __ Abs(w10, w1);
-    __ Abs(w11, w1, nullptr, &fail);
-    __ Abs(w12, w1, &next, &fail);
-    __ Bind(&next);
-    __ Abs(w13, w1, &done);
+  {
+    SETUP();
+    ABS_HELPER_W(true, value);
   }
 
-  __ Bind(&fail);
-  __ Mov(w0, -1);
-
-  __ Bind(&done);
-
-  END();
-  RUN();
-
-  CHECK_EQUAL_32(0, w0);
-  CHECK_EQUAL_32(value, w1);
-  CHECK_EQUAL_32(expected, w10);
-  CHECK_EQUAL_32(expected, w11);
-  CHECK_EQUAL_32(expected, w12);
-  CHECK_EQUAL_32(expected, w13);
+  {
+    SETUP();
+    SETUP_FEATURE(CSSC);
+    ABS_HELPER_W(CAN_RUN(), value);
+  }
 }
 
 TEST(abs) {
@@ -16073,6 +16279,32 @@ TEST(neon_3extension_dot_product) {
   }
 }
 
+TEST(neon_sha3) {
+  INIT_V8();
+  SETUP();
+  SETUP_FEATURE(SHA3);
+  START();
+
+  __ Movi(v0.V2D(), 0xccaaffee00000000, 0xccaaffee00000000);
+  __ Movi(v1.V2D(), 0x6666666666666666, 0x6666666666666666);
+  __ Movi(v2.V2D(), 0x00000000ccaaffee, 0x00000000ccaaffee);
+
+  __ Movi(v10.V16B(), 0);
+  __ Movi(v11.V16B(), 0);
+
+  __ Bcax(v10.V16B(), v0.V16B(), v1.V16B(), v2.V16B());
+  __ Eor3(v11.V16B(), v0.V16B(), v1.V16B(), v2.V16B());
+
+  END();
+
+  if (CAN_RUN()) {
+    RUN();
+
+    CHECK_EQUAL_128(0xaacc998822440000, 0xaacc998822440000, v10);
+    CHECK_EQUAL_128(0xaacc9988aacc9988, 0xaacc9988aacc9988, v11);
+  }
+}
+
 #define FP16_OP_LIST(V) \
   V(fadd)               \
   V(fsub)               \
@@ -16161,6 +16393,180 @@ FP16_OP_LIST(TEST_FP16_OP)
 #undef TEST_FP16_OP
 #undef FP16_OP_LIST
 
+TEST(cssc_abs) {
+  INIT_V8();
+  SETUP();
+  SETUP_FEATURE(CSSC);
+  START();
+
+  __ Mov(x0, -1);
+  __ Mov(x1, 1);
+  __ Mov(x2, 0);
+  __ Mov(x3, 0x7fff'ffff);
+  __ Mov(x4, 0x8000'0000);
+  __ Mov(x5, 0x8000'0001);
+  __ Mov(x6, 0x7fff'ffff'ffff'ffff);
+  __ Mov(x7, 0x8000'0000'0000'0000);
+  __ Mov(x8, 0x8000'0000'0000'0001);
+
+  __ Abs(w10, w0);
+  __ Abs(x11, x0);
+  __ Abs(w12, w1);
+  __ Abs(x13, x1);
+  __ Abs(w14, w2);
+  __ Abs(x15, x2);
+
+  __ Abs(w19, w3);
+  __ Abs(x20, x3);
+  __ Abs(w21, w4);
+  __ Abs(x22, x4);
+  __ Abs(w23, w5);
+  __ Abs(x24, x5);
+  __ Abs(w25, w6);
+  __ Abs(x26, x6);
+  __ Abs(w27, w7);
+  __ Abs(x28, x7);
+  __ Abs(w29, w8);
+  __ Abs(x30, x8);
+
+  END();
+
+  if (CAN_RUN()) {
+    RUN();
+
+    CHECK_EQUAL_64(1, x10);
+    CHECK_EQUAL_64(1, x11);
+    CHECK_EQUAL_64(1, x12);
+    CHECK_EQUAL_64(1, x13);
+    CHECK_EQUAL_64(0, x14);
+    CHECK_EQUAL_64(0, x15);
+    CHECK_EQUAL_64(0x7fff'ffff, x19);
+    CHECK_EQUAL_64(0x7fff'ffff, x20);
+    CHECK_EQUAL_64(0x8000'0000, x21);
+    CHECK_EQUAL_64(0x8000'0000, x22);
+    CHECK_EQUAL_64(0x7fff'ffff, x23);
+    CHECK_EQUAL_64(0x8000'0001, x24);
+    CHECK_EQUAL_64(1, x25);
+    CHECK_EQUAL_64(0x7fff'ffff'ffff'ffff, x26);
+    CHECK_EQUAL_64(0, x27);
+    CHECK_EQUAL_64(0x8000'0000'0000'0000, x28);
+    CHECK_EQUAL_64(1, x29);
+    CHECK_EQUAL_64(0x7fff'ffff'ffff'ffff, x30);
+  }
+}
+
+TEST(cssc_cnt) {
+  INIT_V8();
+  SETUP();
+  SETUP_FEATURE(CSSC);
+  START();
+
+  __ Mov(x0, -1);
+  __ Mov(x1, 1);
+  __ Mov(x2, 0);
+  __ Mov(x3, 0x7fff'ffff);
+  __ Mov(x4, 0x8000'0000);
+  __ Mov(x5, 0x8000'0001);
+  __ Mov(x6, 0x7fff'ffff'ffff'ffff);
+  __ Mov(x7, 0x4242'4242'aaaa'aaaa);
+
+  __ Cnt(w10, w0);
+  __ Cnt(x11, x0);
+  __ Cnt(w12, w1);
+  __ Cnt(x13, x1);
+  __ Cnt(w14, w2);
+  __ Cnt(x15, x2);
+  __ Cnt(w19, w3);
+  __ Cnt(x20, x3);
+  __ Cnt(w21, w4);
+  __ Cnt(x22, x4);
+  __ Cnt(w23, w5);
+  __ Cnt(x24, x5);
+  __ Cnt(w25, w6);
+  __ Cnt(x26, x6);
+  __ Cnt(w27, w7);
+  __ Cnt(x28, x7);
+
+  END();
+
+  if (CAN_RUN()) {
+    RUN();
+
+    CHECK_EQUAL_64(32, x10);
+    CHECK_EQUAL_64(64, x11);
+    CHECK_EQUAL_64(1, x12);
+    CHECK_EQUAL_64(1, x13);
+    CHECK_EQUAL_64(0, x14);
+    CHECK_EQUAL_64(0, x15);
+    CHECK_EQUAL_64(31, x19);
+    CHECK_EQUAL_64(31, x20);
+    CHECK_EQUAL_64(1, x21);
+    CHECK_EQUAL_64(1, x22);
+    CHECK_EQUAL_64(2, x23);
+    CHECK_EQUAL_64(2, x24);
+    CHECK_EQUAL_64(32, x25);
+    CHECK_EQUAL_64(63, x26);
+    CHECK_EQUAL_64(16, x27);
+    CHECK_EQUAL_64(24, x28);
+  }
+}
+
+TEST(cssc_ctz) {
+  INIT_V8();
+  SETUP();
+  SETUP_FEATURE(CSSC);
+  START();
+
+  __ Mov(x0, -1);
+  __ Mov(x1, 1);
+  __ Mov(x2, 2);
+  __ Mov(x3, 0x7fff'ff00);
+  __ Mov(x4, 0x8000'4000);
+  __ Mov(x5, 0x4000'0001);
+  __ Mov(x6, 0x0000'0001'0000'0000);
+  __ Mov(x7, 0x4200'0000'0000'0000);
+
+  __ Ctz(w10, w0);
+  __ Ctz(x11, x0);
+  __ Ctz(w12, w1);
+  __ Ctz(x13, x1);
+  __ Ctz(w14, w2);
+  __ Ctz(x15, x2);
+  __ Ctz(w19, w3);
+  __ Ctz(x20, x3);
+  __ Ctz(w21, w4);
+  __ Ctz(x22, x4);
+  __ Ctz(w23, w5);
+  __ Ctz(x24, x5);
+  __ Ctz(w25, w6);
+  __ Ctz(x26, x6);
+  __ Ctz(w27, w7);
+  __ Ctz(x28, x7);
+
+  END();
+
+  if (CAN_RUN()) {
+    RUN();
+
+    CHECK_EQUAL_64(0, x10);
+    CHECK_EQUAL_64(0, x11);
+    CHECK_EQUAL_64(0, x12);
+    CHECK_EQUAL_64(0, x13);
+    CHECK_EQUAL_64(1, x14);
+    CHECK_EQUAL_64(1, x15);
+    CHECK_EQUAL_64(8, x19);
+    CHECK_EQUAL_64(8, x20);
+    CHECK_EQUAL_64(14, x21);
+    CHECK_EQUAL_64(14, x22);
+    CHECK_EQUAL_64(0, x23);
+    CHECK_EQUAL_64(0, x24);
+    CHECK_EQUAL_64(32, x25);
+    CHECK_EQUAL_64(32, x26);
+    CHECK_EQUAL_64(32, x27);
+    CHECK_EQUAL_64(57, x28);
+  }
+}
+
 }  // namespace internal
 }  // namespace v8
 
diff --git a/deps/v8/test/cctest/test-code-stub-assembler.cc b/deps/v8/test/cctest/test-code-stub-assembler.cc
index 195e72a72cbdeb..99fc6a64847b72 100644
--- a/deps/v8/test/cctest/test-code-stub-assembler.cc
+++ b/deps/v8/test/cctest/test-code-stub-assembler.cc
@@ -552,7 +552,7 @@ TEST(ToString) {
   js_array_storage->set(0, Smi::FromInt(1));
   js_array_storage->set(1, Smi::FromInt(2));
   DirectHandle<JSArray> js_array = isolate->factory()->NewJSArray(2);
-  JSArray::SetContent(js_array, js_array_storage);
+  JSArray::SetContent(isolate, js_array, js_array_storage);
   tostring_test->set(0, *js_array);
   str = isolate->factory()->InternalizeUtf8String("1,2");
   tostring_test->set(1, *str);
@@ -1321,7 +1321,7 @@ TEST(TryHasOwnProperty) {
     // Global object.
     DirectHandle<JSFunction> function =
         factory->NewFunctionForTesting(factory->empty_string());
-    JSFunction::EnsureHasInitialMap(function);
+    JSFunction::EnsureHasInitialMap(isolate, function);
     function->initial_map()->set_instance_type(JS_GLOBAL_OBJECT_TYPE);
     function->initial_map()->set_instance_size(JSGlobalObject::kHeaderSize);
     function->initial_map()->SetInObjectUnusedPropertyFields(0);
@@ -1603,10 +1603,10 @@ TEST(TryGetOwnProperty) {
 
 namespace {
 
-void AddElement(DirectHandle<JSObject> object, uint32_t index,
+void AddElement(Isolate* isolate, DirectHandle<JSObject> object, uint32_t index,
                 DirectHandle<Object> value,
                 PropertyAttributes attributes = NONE) {
-  JSObject::AddDataElement(object, index, value, attributes);
+  JSObject::AddDataElement(isolate, object, index, value, attributes);
 }
 
 }  // namespace
@@ -1693,8 +1693,8 @@ TEST(TryLookupElement) {
 
   {
     Handle<JSArray> object = factory->NewJSArray(0, PACKED_SMI_ELEMENTS);
-    AddElement(object, 0, smi0);
-    AddElement(object, 1, smi0);
+    AddElement(isolate, object, 0, smi0);
+    AddElement(isolate, object, 1, smi0);
     CHECK_EQ(PACKED_SMI_ELEMENTS, object->map()->elements_kind());
 
     CHECK_FOUND(object, 0);
@@ -1706,8 +1706,8 @@ TEST(TryLookupElement) {
 
   {
     Handle<JSArray> object = factory->NewJSArray(0, HOLEY_SMI_ELEMENTS);
-    AddElement(object, 0, smi0);
-    AddElement(object, 13, smi0);
+    AddElement(isolate, object, 0, smi0);
+    AddElement(isolate, object, 13, smi0);
     CHECK_EQ(HOLEY_SMI_ELEMENTS, object->map()->elements_kind());
 
     CHECK_FOUND(object, 0);
@@ -1719,8 +1719,8 @@ TEST(TryLookupElement) {
 
   {
     Handle<JSArray> object = factory->NewJSArray(0, PACKED_ELEMENTS);
-    AddElement(object, 0, smi0);
-    AddElement(object, 1, smi0);
+    AddElement(isolate, object, 0, smi0);
+    AddElement(isolate, object, 1, smi0);
     CHECK_EQ(PACKED_ELEMENTS, object->map()->elements_kind());
 
     CHECK_FOUND(object, 0);
@@ -1732,8 +1732,8 @@ TEST(TryLookupElement) {
 
   {
     Handle<JSArray> object = factory->NewJSArray(0, HOLEY_ELEMENTS);
-    AddElement(object, 0, smi0);
-    AddElement(object, 13, smi0);
+    AddElement(isolate, object, 0, smi0);
+    AddElement(isolate, object, 13, smi0);
     CHECK_EQ(HOLEY_ELEMENTS, object->map()->elements_kind());
 
     CHECK_FOUND(object, 0);
@@ -1774,7 +1774,7 @@ TEST(TryLookupElement) {
     Handle<JSObject> object = factory->NewJSObject(constructor);
     DirectHandle<String> str = factory->InternalizeUtf8String("ab");
     Cast<JSPrimitiveWrapper>(object)->set_value(*str);
-    AddElement(object, 13, smi0);
+    AddElement(isolate, object, 13, smi0);
     CHECK_EQ(FAST_STRING_WRAPPER_ELEMENTS, object->map()->elements_kind());
 
     CHECK_FOUND(object, 0);
@@ -1789,8 +1789,8 @@ TEST(TryLookupElement) {
     Handle<JSObject> object = factory->NewJSObject(constructor);
     DirectHandle<String> str = factory->InternalizeUtf8String("ab");
     Cast<JSPrimitiveWrapper>(object)->set_value(*str);
-    AddElement(object, 13, smi0);
-    JSObject::NormalizeElements(object);
+    AddElement(isolate, object, 13, smi0);
+    JSObject::NormalizeElements(isolate, object);
     CHECK_EQ(SLOW_STRING_WRAPPER_ELEMENTS, object->map()->elements_kind());
 
     CHECK_FOUND(object, 0);
@@ -2906,9 +2906,9 @@ TEST(CreatePromiseResolvingFunctionsContext) {
   DirectHandle<Context> context_js = Cast<Context>(result);
   CHECK_EQ(isolate->root(RootIndex::kEmptyScopeInfo), context_js->scope_info());
   CHECK_EQ(*isolate->native_context(), context_js->native_context());
-  CHECK(IsJSPromise(context_js->get(PromiseBuiltins::kPromiseSlot)));
+  CHECK(IsJSPromise(context_js->GetNoCell(PromiseBuiltins::kPromiseSlot)));
   CHECK_EQ(ReadOnlyRoots(isolate).false_value(),
-           context_js->get(PromiseBuiltins::kDebugEventSlot));
+           context_js->GetNoCell(PromiseBuiltins::kDebugEventSlot));
 }
 
 TEST(CreatePromiseResolvingFunctions) {
@@ -3063,7 +3063,8 @@ TEST(CreatePromiseGetCapabilitiesExecutorContext) {
   CHECK_EQ(PromiseBuiltins::kCapabilitiesContextLength, context_js->length());
   CHECK_EQ(isolate->root(RootIndex::kEmptyScopeInfo), context_js->scope_info());
   CHECK_EQ(*isolate->native_context(), context_js->native_context());
-  CHECK(IsPromiseCapability(context_js->get(PromiseBuiltins::kCapabilitySlot)));
+  CHECK(IsPromiseCapability(
+      context_js->GetNoCell(PromiseBuiltins::kCapabilitySlot)));
 }
 
 TEST(NewPromiseCapability) {
@@ -3076,8 +3077,8 @@ TEST(NewPromiseCapability) {
 
     auto context = m.GetJSContextParameter();
     const TNode<NativeContext> native_context = m.LoadNativeContext(context);
-    const TNode<Object> promise_constructor =
-        m.LoadContextElement(native_context, Context::PROMISE_FUNCTION_INDEX);
+    const TNode<Object> promise_constructor = m.LoadContextElementNoCell(
+        native_context, Context::PROMISE_FUNCTION_INDEX);
 
     const TNode<True> debug_event = m.TrueConstant();
     const TNode<Object> capability =
@@ -3114,7 +3115,7 @@ TEST(NewPromiseCapability) {
       CHECK_EQ(*isolate->native_context(), callback_context->native_context());
       CHECK_EQ(PromiseBuiltins::kPromiseContextLength,
                callback_context->length());
-      CHECK_EQ(callback_context->get(PromiseBuiltins::kPromiseSlot),
+      CHECK_EQ(callback_context->GetNoCell(PromiseBuiltins::kPromiseSlot),
                result->promise());
     }
   }
diff --git a/deps/v8/test/cctest/test-cpu-profiler.cc b/deps/v8/test/cctest/test-cpu-profiler.cc
index c2392f86896ec4..857a6b247aeddd 100644
--- a/deps/v8/test/cctest/test-cpu-profiler.cc
+++ b/deps/v8/test/cctest/test-cpu-profiler.cc
@@ -43,8 +43,11 @@
 #include "src/codegen/source-position-table.h"
 #include "src/deoptimizer/deoptimize-reason.h"
 #include "src/execution/embedder-state.h"
+#include "src/execution/isolate-inl.h"
 #include "src/execution/protectors-inl.h"
 #include "src/flags/flags.h"
+#include "src/heap/memory-chunk.h"
+#include "src/heap/page-metadata.h"
 #include "src/heap/spaces.h"
 #include "src/init/v8.h"
 #include "src/libsampler/sampler.h"
@@ -4169,9 +4172,12 @@ TEST(EmbedderStatePropagateNativeContextMove) {
   ManualGCScope manual_gc_scope;
   heap::ManualEvacuationCandidatesSelectionScope
       manual_evacuation_candidate_selection_scope(manual_gc_scope);
-  LocalContext execution_env;
   i::HandleScope scope(CcTest::i_isolate());
 
+  // Ensures that the context isn't allocated on a NEVER_EVACUATE page.
+  heap::AbandonCurrentlyFreeMemory(CcTest::i_isolate()->heap()->old_space());
+
+  LocalContext execution_env;
   v8::Isolate* isolate = execution_env.local()->GetIsolate();
 
   // Install CollectSample callback for more deterministic sampling.
@@ -4185,6 +4191,9 @@ TEST(EmbedderStatePropagateNativeContextMove) {
 
     i::Address initial_address =
         CcTest::i_isolate()->current_embedder_state()->native_context_address();
+    CHECK(!PageMetadata::FromAddress(initial_address)
+               ->Chunk()
+               ->IsFlagSet(MemoryChunk::NEVER_EVACUATE));
 
     // Install a function that triggers the native context to be moved.
     v8::Local<v8::FunctionTemplate> move_func_template =
diff --git a/deps/v8/test/cctest/test-debug-helper.cc b/deps/v8/test/cctest/test-debug-helper.cc
index 885ac096606201..1e3f7ba622bdef 100644
--- a/deps/v8/test/cctest/test-debug-helper.cc
+++ b/deps/v8/test/cctest/test-debug-helper.cc
@@ -385,7 +385,8 @@ TEST(GetObjectProperties) {
   props = d::GetObjectProperties(
       ReadProp<i::Tagged_t>(*props, "instance_descriptors"), &ReadMemory,
       heap_addresses);
-  CHECK_EQ(props->num_properties, 6);
+  int padding = TAGGED_SIZE_8_BYTES ? 1 : 0;
+  CHECK_EQ(props->num_properties, 7 + padding);
   // It should have at least two descriptors (possibly plus slack).
   CheckProp(*props->properties[1], "uint16_t", "number_of_all_descriptors");
   uint16_t number_of_all_descriptors =
@@ -393,7 +394,7 @@ TEST(GetObjectProperties) {
   CHECK_GE(number_of_all_descriptors, 2);
   // The "descriptors" property should describe the struct layout for each
   // element in the array.
-  const d::ObjectProperty& descriptors = *props->properties[5];
+  const d::ObjectProperty& descriptors = *props->properties[6 + padding];
   // No C++ type is reported directly because there may not be an actual C++
   // struct with this layout, hence the empty string in this check.
   CheckProp(descriptors, /*type=*/"", "descriptors",
diff --git a/deps/v8/test/cctest/test-inobject-slack-tracking.cc b/deps/v8/test/cctest/test-inobject-slack-tracking.cc
index 0c419b47e5051b..a64c75ccf94362 100644
--- a/deps/v8/test/cctest/test-inobject-slack-tracking.cc
+++ b/deps/v8/test/cctest/test-inobject-slack-tracking.cc
@@ -44,10 +44,10 @@ DirectHandle<T> GetLexical(const char* name) {
 
   VariableLookupResult lookup_result;
   if (script_contexts->Lookup(str_name, &lookup_result)) {
-    Tagged<Context> script_context =
-        script_contexts->get(lookup_result.context_index);
-    DirectHandle<Object> result(script_context->get(lookup_result.slot_index),
-                                isolate);
+    DirectHandle<Context> script_context =
+        handle(script_contexts->get(lookup_result.context_index), isolate);
+    DirectHandle<Object> result =
+        Context::Get(script_context, lookup_result.slot_index, isolate);
     return Cast<T>(result);
   }
   return DirectHandle<T>();
diff --git a/deps/v8/test/cctest/test-js-weak-refs.cc b/deps/v8/test/cctest/test-js-weak-refs.cc
index 29eff6178b6c2e..c9d67d6e6f661e 100644
--- a/deps/v8/test/cctest/test-js-weak-refs.cc
+++ b/deps/v8/test/cctest/test-js-weak-refs.cc
@@ -933,61 +933,6 @@ TEST(JSWeakRefScavengedInWorklist) {
   heap::InvokeMajorGC(heap);
 }
 
-TEST(JSWeakRefTenuredInWorklist) {
-  if (!v8_flags.incremental_marking || v8_flags.single_generation ||
-      v8_flags.separate_gc_phases) {
-    return;
-  }
-
-  ManualGCScope manual_gc_scope;
-  CcTest::InitializeVM();
-  Isolate* isolate = CcTest::i_isolate();
-  Heap* heap = isolate->heap();
-  i::DisableConservativeStackScanningScopeForTesting no_stack_scanning(heap);
-
-  HandleScope outer_scope(isolate);
-  IndirectHandle<JSWeakRef> weak_ref;
-
-  // Make a WeakRef that points to a target. The target becomes unreachable.
-  {
-    HandleScope inner_scope(isolate);
-    IndirectHandle<JSObject> js_object =
-        isolate->factory()->NewJSObject(isolate->object_function());
-    IndirectHandle<JSWeakRef> inner_weak_ref =
-        ConstructJSWeakRef(js_object, isolate);
-    CHECK(HeapLayout::InYoungGeneration(*js_object));
-    CHECK(HeapLayout::InYoungGeneration(*inner_weak_ref));
-
-    weak_ref = inner_scope.CloseAndEscape(inner_weak_ref);
-  }
-  // Store weak_ref such that it is part of the root set when starting
-  // incremental marking.
-  v8::Global<Value> global_weak_ref(CcTest::isolate(),
-                                    Utils::ToLocal(Cast<Object>(weak_ref)));
-  Address old_weak_ref_location = weak_ref->address();
-
-  // Do marking. This puts the WeakRef above into the js_weak_refs worklist
-  // since its target isn't marked.
-  CHECK(heap->mark_compact_collector()->weak_objects()->js_weak_refs.IsEmpty());
-  heap::SimulateIncrementalMarking(heap, true);
-  heap->mark_compact_collector()->local_weak_objects()->Publish();
-  CHECK(
-      !heap->mark_compact_collector()->weak_objects()->js_weak_refs.IsEmpty());
-
-  // Now collect weak_ref's target. We still have a Handle to weak_ref, so it is
-  // moved and remains on the worklist.
-  heap::InvokeMinorGC(heap);
-  Address new_weak_ref_location = weak_ref->address();
-  CHECK_NE(old_weak_ref_location, new_weak_ref_location);
-  CHECK(
-      !heap->mark_compact_collector()->weak_objects()->js_weak_refs.IsEmpty());
-
-  // The mark-compactor should see the moved WeakRef in the worklist.
-  heap::InvokeMajorGC(heap);
-  CHECK(heap->mark_compact_collector()->weak_objects()->js_weak_refs.IsEmpty());
-  CHECK(IsUndefined(weak_ref->target(), isolate));
-}
-
 TEST(UnregisterTokenHeapVerifier) {
   if (!v8_flags.incremental_marking) return;
   ManualGCScope manual_gc_scope;
diff --git a/deps/v8/test/cctest/test-mementos.cc b/deps/v8/test/cctest/test-mementos.cc
index 4ee14a6105a190..23ac5a22d2e24f 100644
--- a/deps/v8/test/cctest/test-mementos.cc
+++ b/deps/v8/test/cctest/test-mementos.cc
@@ -25,6 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+#include "src/common/globals.h"
 #include "src/execution/isolate.h"
 #include "src/heap/factory.h"
 #include "src/heap/heap-inl.h"
@@ -57,8 +58,14 @@ static void SetUpNewSpaceWithPoisonedMementoAtTop() {
 
   // Using this accessor as we're writing an invalid tagged pointer.
   Tagged_t poison = kHeapObjectTag;
-  memento->WriteField<Tagged_t>(AllocationMemento::kAllocationSiteOffset,
-                                poison);
+  Address full_poison;
+#if V8_COMPRESS_POINTERS
+  full_poison = V8HeapCompressionScheme::DecompressTagged(poison);
+#else
+  full_poison = poison;
+#endif
+  memento->set_allocation_site(
+      UncheckedCast<AllocationSite>(Tagged<Object>(full_poison)));
 }
 
 
diff --git a/deps/v8/test/cctest/test-profile-generator.cc b/deps/v8/test/cctest/test-profile-generator.cc
index 75590cb806b2a9..6d198f26c07c3c 100644
--- a/deps/v8/test/cctest/test-profile-generator.cc
+++ b/deps/v8/test/cctest/test-profile-generator.cc
@@ -625,6 +625,8 @@ class MockPlatform final : public TestPlatform {
     }
 
     bool IdleTasksEnabled() override { return false; }
+    // The runner supports non-nestable tasks (as that's required by cctests)
+    // but they are never executed.
     bool NonNestableTasksEnabled() const override { return true; }
     bool NonNestableDelayedTasksEnabled() const override { return true; }
 
diff --git a/deps/v8/test/cctest/test-serialize.cc b/deps/v8/test/cctest/test-serialize.cc
index c711f5f7a20ea5..3b25077f8fbb04 100644
--- a/deps/v8/test/cctest/test-serialize.cc
+++ b/deps/v8/test/cctest/test-serialize.cc
@@ -416,9 +416,15 @@ static void SerializeContext(base::Vector<const uint8_t>* startup_blob_out,
 
     env.Reset();
 
-    IsolateSafepointScope safepoint(heap);
+    SafepointScope safepoint(isolate, SafepointKind::kIsolate);
+    DisallowGarbageCollection no_gc;
 
     if (!isolate->initialized_from_snapshot()) {
+      // Promote objects from mutable heap spaces to read-only space prior to
+      // serialization. Objects can be promoted if a) they are themselves
+      // immutable-after-deserialization and b) all objects in the transitive
+      // object graph also satisfy condition a).
+      ReadOnlyPromotion::Promote(isolate, safepoint, no_gc);
       // When creating the snapshot from scratch, we are responsible for sealing
       // the RO heap here. Note we cannot delegate the responsibility e.g. to
       // Isolate::Init since it should still be possible to allocate into RO
@@ -427,7 +433,6 @@ static void SerializeContext(base::Vector<const uint8_t>* startup_blob_out,
       isolate->read_only_heap()->OnCreateHeapObjectsComplete(isolate);
     }
 
-    DisallowGarbageCollection no_gc;
     SnapshotByteSink read_only_sink;
     ReadOnlySerializer read_only_serializer(isolate,
                                             Snapshot::kDefaultSerializerFlags);
@@ -700,9 +705,9 @@ UNINITIALIZED_TEST(ContextSerializerCustomContext) {
       DirectHandle<NativeContext> context = Cast<NativeContext>(root);
 
       // Add context to the weak native context list
-      Cast<Context>(context)->set(Context::NEXT_CONTEXT_LINK,
-                                  isolate->heap()->native_contexts_list(),
-                                  UPDATE_WRITE_BARRIER);
+      Cast<Context>(context)->SetNoCell(Context::NEXT_CONTEXT_LINK,
+                                        isolate->heap()->native_contexts_list(),
+                                        UPDATE_WRITE_BARRIER);
       isolate->heap()->set_native_contexts_list(*context);
 
       CHECK(context->global_proxy() == *global_proxy);
@@ -3566,11 +3571,14 @@ void AccessorForSerialization(v8::Local<v8::Name> property,
   info.GetReturnValue().Set(v8_num(2017));
 }
 
+void MessageCallbackForSerialization(Local<Message> message,
+                                     Local<Value> data) {}
+
 SerializerOneByteResource serializable_one_byte_resource("one_byte", 8);
 SerializerTwoByteResource serializable_two_byte_resource(
     AsciiToTwoByteString(u"two_byte 🤓"), 11);
 
-intptr_t original_external_references[] = {
+const intptr_t original_external_references[] = {
     reinterpret_cast<intptr_t>(SerializedCallback),
     reinterpret_cast<intptr_t>(&serialized_static_field),
     reinterpret_cast<intptr_t>(&NamedPropertyGetterForSerialization),
@@ -3578,9 +3586,10 @@ intptr_t original_external_references[] = {
     reinterpret_cast<intptr_t>(&serialized_static_field),  // duplicate entry
     reinterpret_cast<intptr_t>(&serializable_one_byte_resource),
     reinterpret_cast<intptr_t>(&serializable_two_byte_resource),
+    reinterpret_cast<intptr_t>(&MessageCallbackForSerialization),
     0};
 
-intptr_t replaced_external_references[] = {
+const intptr_t replaced_external_references[] = {
     reinterpret_cast<intptr_t>(SerializedCallbackReplacement),
     reinterpret_cast<intptr_t>(&serialized_static_field),
     reinterpret_cast<intptr_t>(&NamedPropertyGetterForSerialization),
@@ -3588,9 +3597,10 @@ intptr_t replaced_external_references[] = {
     reinterpret_cast<intptr_t>(&serialized_static_field),
     reinterpret_cast<intptr_t>(&serializable_one_byte_resource),
     reinterpret_cast<intptr_t>(&serializable_two_byte_resource),
+    reinterpret_cast<intptr_t>(&MessageCallbackForSerialization),
     0};
 
-intptr_t short_external_references[] = {
+const intptr_t short_external_references[] = {
     reinterpret_cast<intptr_t>(SerializedCallbackReplacement),
     reinterpret_cast<intptr_t>(&serialized_static_field), 0};
 
@@ -3600,6 +3610,7 @@ UNINITIALIZED_TEST(SnapshotCreatorExternalReferences) {
   DisableAlwaysOpt();
   DisableEmbeddedBlobRefcounting();
   v8::StartupData blob;
+  uint32_t my_context_embedder_field_index = 0;
   {
     SnapshotCreatorParams testing_params(original_external_references);
     v8::SnapshotCreator creator(testing_params.create_params);
@@ -3607,7 +3618,13 @@ UNINITIALIZED_TEST(SnapshotCreatorExternalReferences) {
     {
       v8::HandleScope handle_scope(isolate);
       v8::Local<v8::Context> context = v8::Context::New(isolate);
+      my_context_embedder_field_index =
+          context->GetNumberOfEmbedderDataFields();
       v8::Context::Scope context_scope(context);
+      v8::Local<v8::External> writable_external =
+          v8::External::New(isolate, &serialized_static_field);
+      context->SetEmbedderData(my_context_embedder_field_index,
+                               writable_external);
       v8::Local<v8::External> external =
           v8::External::New(isolate, &serialized_static_field);
       v8::Local<v8::FunctionTemplate> callback =
@@ -3670,6 +3687,13 @@ UNINITIALIZED_TEST(SnapshotCreatorExternalReferences) {
       auto func = Cast<i::JSFunction>(Utils::OpenHandle(*v8_func));
       Tagged<FunctionTemplateInfo> func_temp = func->shared()->api_func_data();
       CHECK(HeapLayout::InReadOnlySpace(func_temp));
+
+      // Ensure that writable v8::External was NOT promoted to RO space.
+      v8::Local<v8::External> v8_external =
+          context->GetEmbedderData(my_context_embedder_field_index)
+              .As<v8::External>();
+      auto external = Cast<i::HeapObject>(Utils::OpenHandle(*v8_external));
+      CHECK(!HeapLayout::InReadOnlySpace(*external));
     }
     isolate->Dispose();
   }
@@ -4041,7 +4065,8 @@ UNINITIALIZED_TEST(SnapshotCreatorUnknownExternalReferences) {
   FreeCurrentEmbeddedBlob();
 }
 
-UNINITIALIZED_TEST(SnapshotCreatorTemplates) {
+namespace {
+void TestSnapshotCreatorTemplates(bool promote_templates_to_read_only) {
   DisableAlwaysOpt();
   DisableEmbeddedBlobRefcounting();
   v8::StartupData blob;
@@ -4056,14 +4081,25 @@ UNINITIALIZED_TEST(SnapshotCreatorTemplates) {
     v8::Isolate* isolate = creator.GetIsolate();
     {
       v8::HandleScope handle_scope(isolate);
+      CHECK(isolate->AddMessageListener(MessageCallbackForSerialization));
+
       v8::ExtensionConfiguration* no_extension = nullptr;
+      v8::Local<v8::FunctionTemplate> global_template_constructor =
+          v8::FunctionTemplate::New(isolate);
       v8::Local<v8::ObjectTemplate> global_template =
-          v8::ObjectTemplate::New(isolate);
+          v8::ObjectTemplate::New(isolate, global_template_constructor);
       v8::Local<v8::External> external =
           v8::External::New(isolate, &serialized_static_field);
       v8::Local<v8::FunctionTemplate> callback =
           v8::FunctionTemplate::New(isolate, SerializedCallback, external);
       global_template->Set(isolate, "f", callback);
+
+      if (promote_templates_to_read_only) {
+        callback->SealAndPrepareForPromotionToReadOnly();
+        global_template->SealAndPrepareForPromotionToReadOnly();
+        global_template_constructor->SealAndPrepareForPromotionToReadOnly();
+      }
+
       v8::Local<v8::Context> context =
           v8::Context::New(isolate, no_extension, global_template);
       creator.SetDefaultContext(context);
@@ -4126,6 +4162,10 @@ UNINITIALIZED_TEST(SnapshotCreatorTemplates) {
       {
         // Create a new context without a new object template.
         v8::HandleScope handle_scope(isolate);
+        // Ensure that the message listeners ArrayList didn't end up in the RO
+        // space.
+        isolate->RemoveMessageListeners(MessageCallbackForSerialization);
+
         v8::Local<v8::Context> context =
             v8::Context::FromSnapshot(
                 isolate, 0,
@@ -4141,6 +4181,12 @@ UNINITIALIZED_TEST(SnapshotCreatorTemplates) {
             isolate->GetDataFromSnapshotOnce<v8::ObjectTemplate>(1)
                 .ToLocalChecked();
         CHECK(!obj_template.IsEmpty());
+        if (promote_templates_to_read_only) {
+          auto obj_template_info = Utils::OpenHandle(*obj_template);
+          CHECK(obj_template_info->should_promote_to_read_only());
+          CHECK(HeapLayout::InReadOnlySpace(*obj_template_info));
+        }
+
         v8::Local<v8::Object> object =
             obj_template->NewInstance(context).ToLocalChecked();
         CHECK(context->Global()->Set(context, v8_str("o"), object).FromJust());
@@ -4154,6 +4200,11 @@ UNINITIALIZED_TEST(SnapshotCreatorTemplates) {
             isolate->GetDataFromSnapshotOnce<v8::FunctionTemplate>(0)
                 .ToLocalChecked();
         CHECK(!fun_template.IsEmpty());
+        if (promote_templates_to_read_only) {
+          auto fun_template_info = Utils::OpenHandle(*fun_template);
+          CHECK(fun_template_info->should_promote_to_read_only());
+          CHECK(HeapLayout::InReadOnlySpace(*fun_template_info));
+        }
         v8::Local<v8::Function> fun =
             fun_template->GetFunction(context).ToLocalChecked();
         CHECK(context->Global()->Set(context, v8_str("g"), fun).FromJust());
@@ -4219,6 +4270,17 @@ UNINITIALIZED_TEST(SnapshotCreatorTemplates) {
   delete[] blob.data;
   FreeCurrentEmbeddedBlob();
 }
+}  // namespace
+
+UNINITIALIZED_TEST(SnapshotCreatorTemplates) {
+  const bool promote_templates_to_read_only = false;
+  TestSnapshotCreatorTemplates(promote_templates_to_read_only);
+}
+
+UNINITIALIZED_TEST(SnapshotCreatorTemplatesReadOnlyPromotion) {
+  const bool promote_templates_to_read_only = true;
+  TestSnapshotCreatorTemplates(promote_templates_to_read_only);
+}
 
 namespace context_data_test {
 
@@ -5141,6 +5203,77 @@ UNINITIALIZED_TEST(SnapshotCreatorIncludeGlobalProxy) {
   FreeCurrentEmbeddedBlob();
 }
 
+UNINITIALIZED_TEST(SnapshotCreatorSerializeInterceptorInOldSpace) {
+  DisableAlwaysOpt();
+  DisableEmbeddedBlobRefcounting();
+  v8::StartupData blob;
+
+  {
+    SnapshotCreatorParams testing_params(original_external_references);
+    v8::SnapshotCreator creator(testing_params.create_params);
+    v8::Isolate* isolate = creator.GetIsolate();
+
+    {
+      v8::HandleScope handle_scope(isolate);
+
+      v8::Local<v8::ObjectTemplate> global_template =
+          v8::ObjectTemplate::New(isolate);
+
+      NamedPropertyHandlerConfiguration config(
+          NamedPropertyGetterForSerialization, {}, {}, {}, {}, {}, {},
+          v8_str("test"),  // Stop it from being promoted to RO space.
+          PropertyHandlerFlags::kHasNoSideEffect);
+
+      global_template->SetHandler(config);
+
+      v8::Local<v8::Context> context =
+          v8::Context::New(isolate, nullptr, global_template);
+      v8::Context::Scope context_scope(context);
+      ExpectInt32("x", 2016);
+      creator.SetDefaultContext(context);
+    }
+
+    blob =
+        creator.CreateBlob(v8::SnapshotCreator::FunctionCodeHandling::kClear);
+  }
+
+  {
+    v8::Isolate::CreateParams params;
+    params.snapshot_blob = &blob;
+    params.array_buffer_allocator = CcTest::array_buffer_allocator();
+    params.external_references = original_external_references;
+    // Test-appropriate equivalent of v8::Isolate::New.
+    v8::Isolate* isolate = TestSerializer::NewIsolate(params);
+    {
+      v8::Isolate::Scope isolate_scope(isolate);
+      v8::HandleScope handle_scope(isolate);
+
+      v8::Local<v8::Context> context = v8::Context::New(isolate);
+      v8::Context::Scope context_scope(context);
+
+      // Check that the InterceptorInfo is not promoted to RO space after
+      // deserialization.
+      i::Isolate* i_isolate = reinterpret_cast<i::Isolate*>(isolate);
+      CHECK(i_isolate->global_object()->map()->has_named_interceptor());
+      CHECK(i_isolate->heap()->InOldSpace(
+          i_isolate->global_object()->GetNamedInterceptor()));
+
+      ExpectInt32("x", 2016);  // Check deserialized getter.
+      // Check the unset interceptors.
+      CompileRun(
+          "Object.defineProperty(globalThis, 'test', {"
+          "  value: 0, enumerable: true"
+          "})");
+      ExpectFalse("delete globalThis.test");
+      ExpectTrue("Object.keys(globalThis).includes('test')");
+    }
+
+    isolate->Dispose();
+  }
+  delete[] blob.data;
+  FreeCurrentEmbeddedBlob();
+}
+
 UNINITIALIZED_TEST(ReinitializeHashSeedJSCollectionRehashable) {
   DisableAlwaysOpt();
   i::v8_flags.rehash_snapshot = true;
@@ -5197,6 +5330,64 @@ UNINITIALIZED_TEST(ReinitializeHashSeedJSCollectionRehashable) {
   FreeCurrentEmbeddedBlob();
 }
 
+UNINITIALIZED_TEST(ReinitializeHashSeedNameToIndexRehashable) {
+  DisableAlwaysOpt();
+  i::v8_flags.rehash_snapshot = true;
+  i::v8_flags.hash_seed = 42;
+  i::v8_flags.allow_natives_syntax = true;
+  DisableEmbeddedBlobRefcounting();
+  v8::StartupData blob;
+  {
+    SnapshotCreatorParams testing_params;
+    v8::SnapshotCreator creator(testing_params.create_params);
+    v8::Isolate* isolate = creator.GetIsolate();
+    {
+      v8::HandleScope handle_scope(isolate);
+      v8::Local<v8::Context> context = v8::Context::New(isolate);
+      v8::Context::Scope context_scope(context);
+      // Be sure to use the name-to-index hash table.
+      static_assert(kScopeInfoMaxInlinedLocalNamesSize < 80);
+      CompileRun(
+          "class a { "
+          "  #x0; #x1; #x2; #x3; #x4; #x5; #x6; #x7; #x8; #x9;"
+          "  #x10; #x11; #x12; #x13; #x14; #x15; #x16; #x17; #x18; #x19;"
+          "  #x20; #x21; #x22; #x23; #x24; #x25; #x26; #x27; #x28; #x29;"
+          "  #x30; #x31; #x32; #x33; #x34; #x35; #x36; #x37; #x38; #x39;"
+          "  #x40; #x41; #x42; #x43; #x44; #x45; #x46; #x47; #x48; #x49;"
+          "  #x50; #x51; #x52; #x53; #x54; #x55; #x56; #x57; #x58; #x59;"
+          "  #x60; #x61; #x62; #x63; #x64; #x65; #x66; #x67; #x68; #x69;"
+          "  #x70; #x71; #x72; #x73; #x74; #x75; #x76; #x77; #x78; #x79;"
+          "  static #foo() { return new Error(); }"
+          "  f() { return this.#foo(); } }"
+          "let o = new a()");
+      creator.SetDefaultContext(context);
+    }
+    blob =
+        creator.CreateBlob(v8::SnapshotCreator::FunctionCodeHandling::kClear);
+    CHECK(blob.CanBeRehashed());
+  }
+
+  i::v8_flags.hash_seed = 1337;
+  v8::Isolate::CreateParams create_params;
+  create_params.array_buffer_allocator = CcTest::array_buffer_allocator();
+  create_params.snapshot_blob = &blob;
+  v8::Isolate* isolate = v8::Isolate::New(create_params);
+  {
+    v8::Isolate::Scope isolate_scope(isolate);
+    // Check that rehashing has been performed.
+    CHECK_EQ(static_cast<uint64_t>(1337),
+             HashSeed(reinterpret_cast<i::Isolate*>(isolate)));
+    v8::HandleScope handle_scope(isolate);
+    v8::Local<v8::Context> context = v8::Context::New(isolate);
+    CHECK(!context.IsEmpty());
+    v8::Context::Scope context_scope(context);
+    CompileRun("try {o.f()} catch(o) { o; }");
+  }
+  isolate->Dispose();
+  delete[] blob.data;
+  FreeCurrentEmbeddedBlob();
+}
+
 UNINITIALIZED_TEST(ReinitializeHashSeedRehashable) {
   DisableAlwaysOpt();
   i::v8_flags.rehash_snapshot = true;
@@ -6598,12 +6789,10 @@ UNINITIALIZED_TEST(BreakPointAccessorContextSnapshot) {
 // static roots, to be able to generate the static-roots.h file.
 #if defined(V8_COMPRESS_POINTERS_IN_SHARED_CAGE) && defined(V8_SHARED_RO_HEAP)
 UNINITIALIZED_TEST(StaticRootsPredictableSnapshot) {
-#ifdef V8_ENABLE_CONSERVATIVE_STACK_SCANNING
   // TODO(jgruber): Snapshot determinism requires predictable heap layout
   // (v8_flags.predictable), but this flag is currently known not to work with
   // CSS due to false positives.
-  UNREACHABLE();
-#else
+  CHECK(!v8_flags.conservative_stack_scanning);
   if (v8_flags.random_seed == 0) return;
   const int random_seed = v8_flags.random_seed;
 
@@ -6642,7 +6831,6 @@ UNINITIALIZED_TEST(StaticRootsPredictableSnapshot) {
   blobs1.Dispose();
   blobs2.Dispose();
   FreeCurrentEmbeddedBlob();
-#endif  // V8_ENABLE_CONSERVATIVE_STACK_SCANNING
 }
 #endif  // defined(V8_COMPRESS_POINTERS_IN_SHARED_CAGE) &&
         // defined(V8_SHARED_RO_HEAP)
diff --git a/deps/v8/test/cctest/wasm/test-c-wasm-entry.cc b/deps/v8/test/cctest/wasm/test-c-wasm-entry.cc
index e06dd74fa851ae..63f98115f1f5da 100644
--- a/deps/v8/test/cctest/wasm/test-c-wasm-entry.cc
+++ b/deps/v8/test/cctest/wasm/test-c-wasm-entry.cc
@@ -4,8 +4,8 @@
 
 #include <cstdint>
 
+#include "src/base/numerics/safe_conversions.h"
 #include "src/base/overflowing-math.h"
-#include "src/base/safe_conversions.h"
 #include "src/codegen/assembler-inl.h"
 #include "src/objects/objects-inl.h"
 #include "src/wasm/wasm-arguments.h"
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-64.cc b/deps/v8/test/cctest/wasm/test-run-wasm-64.cc
index fbdb995ddd84bb..c6bcaaa6542134 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-64.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-64.cc
@@ -7,8 +7,8 @@
 #include <string.h>
 
 #include "src/base/bits.h"
+#include "src/base/numerics/safe_conversions.h"
 #include "src/base/overflowing-math.h"
-#include "src/base/safe_conversions.h"
 #include "src/codegen/assembler-inl.h"
 #include "src/objects/objects-inl.h"
 #include "test/cctest/cctest.h"
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-relaxed-simd.cc b/deps/v8/test/cctest/wasm/test-run-wasm-relaxed-simd.cc
index e7e5b48120bf0a..eb88a4fe32b8fa 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-relaxed-simd.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-relaxed-simd.cc
@@ -4,8 +4,8 @@
 
 #include <type_traits>
 
+#include "src/base/numerics/safe_conversions.h"
 #include "src/base/overflowing-math.h"
-#include "src/base/safe_conversions.h"
 #include "src/codegen/cpu-features.h"
 #include "src/common/globals.h"
 #include "src/wasm/compilation-environment.h"
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-simd.cc b/deps/v8/test/cctest/wasm/test-run-wasm-simd.cc
index ca097f35869161..e42432378891fd 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-simd.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-simd.cc
@@ -18,8 +18,8 @@
 #include "src/base/logging.h"
 #include "src/base/macros.h"
 #include "src/base/memory.h"
+#include "src/base/numerics/safe_conversions.h"
 #include "src/base/overflowing-math.h"
-#include "src/base/safe_conversions.h"
 #include "src/base/utils/random-number-generator.h"
 #include "src/base/vector.h"
 #include "src/codegen/cpu-features.h"
diff --git a/deps/v8/test/cctest/wasm/wasm-run-utils.cc b/deps/v8/test/cctest/wasm/wasm-run-utils.cc
index a7b070ba36edf7..b73a0b648df8d0 100644
--- a/deps/v8/test/cctest/wasm/wasm-run-utils.cc
+++ b/deps/v8/test/cctest/wasm/wasm-run-utils.cc
@@ -236,7 +236,6 @@ void TestingModuleBuilder::InitializeWrapperCache() {
   DirectHandle<FixedArray> maps = isolate_->factory()->NewFixedArray(
       static_cast<int>(test_module_->types.size()));
   for (uint32_t index = 0; index < test_module_->types.size(); index++) {
-    // TODO(14616): Support shared types.
     CreateMapForType(isolate_, test_module_.get(), ModuleTypeIndex{index},
                      maps);
   }
@@ -311,7 +310,7 @@ void TestingModuleBuilder::AddIndirectFunctionTable(
         uint64_t signature_hash = SignatureHasher::Hash(function.sig);
         trusted_instance_data_->dispatch_table(table_index)
             ->SetForWrapper(
-                i, *entry.implicit_arg(),
+                i, Cast<WasmImportData>(*entry.implicit_arg()),
                 wasm::GetProcessWideWasmCodePointerTable()->GetEntrypoint(
                     entry.call_target(), signature_hash),
                 sig_id, signature_hash,
@@ -323,12 +322,13 @@ void TestingModuleBuilder::AddIndirectFunctionTable(
                 WasmDispatchTable::kNewEntry);
       } else {
         trusted_instance_data_->dispatch_table(table_index)
-            ->SetForNonWrapper(i, *entry.implicit_arg(), entry.call_target(),
-                               sig_id,
+            ->SetForNonWrapper(
+                i, Cast<WasmTrustedInstanceData>(*entry.implicit_arg()),
+                entry.call_target(), sig_id,
 #if V8_ENABLE_DRUMBRAKE
-                               function.func_index,
+                function.func_index,
 #endif  // !V8_ENABLE_DRUMBRAKE
-                               WasmDispatchTable::kNewEntry);
+                WasmDispatchTable::kNewEntry);
       }
 
       WasmTableObject::SetFunctionTablePlaceholder(
diff --git a/deps/v8/test/common/wasm/test-signatures.h b/deps/v8/test/common/wasm/test-signatures.h
index c36c53672c3397..a601f7f642e820 100644
--- a/deps/v8/test/common/wasm/test-signatures.h
+++ b/deps/v8/test/common/wasm/test-signatures.h
@@ -48,6 +48,8 @@ class TestSignatures {
   SIG(i_aa, MakeSig1Return, kWasmI32, kWasmExternRef, kWasmExternRef)
   SIG(i_c, MakeSig1Return, kWasmI32, kWasmFuncRef)
   SIG(i_s, MakeSig1Return, kWasmI32, kWasmS128)
+  SIG(i_id, MakeSig1Return, kWasmI32, kWasmI32, kWasmF64)
+  SIG(i_di, MakeSig1Return, kWasmI32, kWasmF64, kWasmI32)
 
   // Returning one i64 value.
   SIG(l_v, MakeSig1Return, kWasmI64)
@@ -59,10 +61,14 @@ class TestSignatures {
   // Returning one f32 value.
   SIG(f_f, MakeSig1Return, kWasmF32, kWasmF32)
   SIG(f_ff, MakeSig1Return, kWasmF32, kWasmF32, kWasmF32)
+  SIG(f_v, MakeSig1Return, kWasmF32)
 
   // Returning one f64 value.
   SIG(d_d, MakeSig1Return, kWasmF64, kWasmF64)
   SIG(d_dd, MakeSig1Return, kWasmF64, kWasmF64, kWasmF64)
+  SIG(d_i, MakeSig1Return, kWasmF64, kWasmI32)
+  SIG(d_ii, MakeSig1Return, kWasmF64, kWasmI32, kWasmI32)
+  SIG(d_v, MakeSig1Return, kWasmF64)
 
   // Returning other values.
   SIG(a_v, MakeSig1Return, kWasmExternRef)
diff --git a/deps/v8/test/common/wasm/wasm-macro-gen.h b/deps/v8/test/common/wasm/wasm-macro-gen.h
index 71da022a3fcc68..45afcad233a54c 100644
--- a/deps/v8/test/common/wasm/wasm-macro-gen.h
+++ b/deps/v8/test/common/wasm/wasm-macro-gen.h
@@ -689,6 +689,26 @@ inline uint16_t ExtractPrefixedOpcodeBytes(WasmOpcode opcode) {
 #define WASM_NOT(x) x, kExprI32Eqz
 #define WASM_SEQ(...) __VA_ARGS__
 
+//------------------------------------------------------------------------------
+// Stack switching opcodes.
+//------------------------------------------------------------------------------
+
+#define WASM_CONT_NEW(index) kExprContNew, static_cast<uint8_t>(index)
+#define WASM_CONT_BIND(src, tgt) \
+  kExprContBind, static_cast<uint8_t>(src), static_cast<uint8_t>(tgt)
+
+#define WASM_RESUME(index, count, ...) \
+  kExprResume, static_cast<uint8_t>(index), U32V_1(count), ##__VA_ARGS__
+#define WASM_RESUME_THROW(cont, exc, count, ...)                           \
+  kExprResumeThrow, static_cast<uint8_t>(cont), static_cast<uint8_t>(exc), \
+      U32V_1(count), ##__VA_ARGS__
+#define WASM_SUSPEND(index) kExprSuspend, static_cast<uint8_t>(index)
+#define WASM_SWITCH(cont, tag) \
+  kExprSwitch, static_cast<uint8_t>(cont), ToByte(tag)
+
+#define WASM_ON_TAG(tag, label) kOnSuspend, ToByte(tag), label
+#define WASM_SWITCH_TAG(tag) kSwitch, ToByte(tag)
+
 //------------------------------------------------------------------------------
 // Constructs that are composed of multiple bytecodes.
 //------------------------------------------------------------------------------
diff --git a/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-runtime-check.js b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-runtime-check.js
index 0d753b646fe027..b28af38ac54c93 100644
--- a/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-runtime-check.js
+++ b/deps/v8/test/debugger/debug/side-effect/debug-evaluate-no-side-effect-runtime-check.js
@@ -6,7 +6,7 @@
 
 Debug = debug.Debug;
 
-// StaCurrentContextSlot
+// StaCurrentContextSlotNoCell
 success(10, `(function(){
   const x = 10;
   function f1() {return x;}
diff --git a/deps/v8/test/filecheck/BUILD.gn b/deps/v8/test/filecheck/BUILD.gn
new file mode 100644
index 00000000000000..0b627853ce5657
--- /dev/null
+++ b/deps/v8/test/filecheck/BUILD.gn
@@ -0,0 +1,14 @@
+# Copyright 2025 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+group("v8_filecheck") {
+  testonly = true
+
+  data_deps = [
+    "../../:d8",
+    "../../tools/:v8_testrunner",
+  ]
+
+  data = [ "./" ]
+}
diff --git a/deps/v8/test/filecheck/deopt-too-much-feedback.js b/deps/v8/test/filecheck/deopt-too-much-feedback.js
new file mode 100644
index 00000000000000..2e90a45ecbb00b
--- /dev/null
+++ b/deps/v8/test/filecheck/deopt-too-much-feedback.js
@@ -0,0 +1,139 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --wasm-deopt --liftoff --wasm-inlining
+// Flags: --no-jit-fuzzing --trace-deopt --trace-wasm-compilation-times
+// Flags: --deopt-every-n-times=0 --trace-wasm-inlining
+
+d8.file.execute("test/mjsunit/mjsunit.js");
+d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
+
+let createModule = (function() {
+  return function createModule() {
+    var builder = new WasmModuleBuilder();
+    let funcRefT = builder.addType(kSig_i_ii);
+
+    builder.addFunction("add", funcRefT)
+      .addBody([kExprLocalGet, 0, kExprLocalGet, 1, kExprI32Add])
+      .exportFunc();
+    builder.addFunction("mul", funcRefT)
+      .addBody([kExprLocalGet, 0, kExprLocalGet, 1, kExprI32Mul])
+      .exportFunc();
+    builder.addFunction("sub", funcRefT)
+      .addBody([kExprLocalGet, 0, kExprLocalGet, 1, kExprI32Sub])
+      .exportFunc();
+    builder.addFunction("first", funcRefT)
+      .addBody([kExprLocalGet, 0])
+      .exportFunc();
+    builder.addFunction("second", funcRefT)
+      .addBody([kExprLocalGet, 1])
+      .exportFunc();
+    builder.addFunction("equals", funcRefT)
+      .addBody([kExprLocalGet, 0, kExprLocalGet, 1, kExprI32Eq,])
+      .exportFunc();
+
+    let mainSig =
+      makeSig([kWasmI32, kWasmI32, wasmRefType(funcRefT)], [kWasmI32]);
+    builder.addFunction("main", mainSig)
+      .addLocals(kWasmI32, 1)
+      .addBody([
+        kExprLocalGet, 0,
+        kExprLocalGet, 1,
+        kExprLocalGet, 2,
+        kExprCallRef, funcRefT,
+        kExprLocalTee, 3,
+        // If the result is 0, repeat the call, so that we have a second deopt
+        // point.
+        kExprI32Eqz,
+        kExprIf, kWasmVoid,
+          kExprI32Const, 0,
+          kExprI32Const, 0,
+          kExprLocalGet, 2,
+          kExprCallRef, funcRefT,
+          kExprDrop,
+        kExprEnd,
+        kExprLocalGet, 3,
+    ]).exportFunc();
+    return builder.toModule();
+  }
+})();
+
+// Test a scenario where each instance only has polymorphic call feedback but
+// the instances combined sum up to more feedback slots than the maximum
+// polymorphism (4).
+(function TestCollectiveFeedbackMoreThanMaxPolymorphism() {
+  let module = createModule();
+
+  let wasm1 = new WebAssembly.Instance(module).exports;
+  // Collect polymorphic feedback for wasm1.
+  assertEquals(42, wasm1.main(30, 12, wasm1.add));
+  assertEquals(360, wasm1.main(30, 12, wasm1.mul));
+  assertEquals(18, wasm1.main(30, 12, wasm1.sub));
+  %WasmTierUpFunction(wasm1.main);
+  // Trigger deopt and collect polymorphic feedback for wasm2.
+  let wasm2 = new WebAssembly.Instance(module).exports;
+  // CHECK: function 6: call #0 inlineable (polymorphic 3)
+  // CHECK: function 6: Speculatively inlining call_ref #0, case #0, to function 0
+  // CHECK: function 6: Speculatively inlining call_ref #0, case #1, to function 1
+  // CHECK: function 6: Speculatively inlining call_ref #0, case #2, to function 2
+  // CHECK: Compiled function [[NATIVE_MODULE:(0x)?[0-9a-fA-F]+]]#6 using TurboFan
+  assertTrue(%IsTurboFanFunction(wasm2.main));
+  assertEquals(30, wasm2.main(30, 12, wasm2.first));
+  // Deopt due to inlined target mismatch.
+  // CHECK-NEXT: bailout (kind: deopt-eager, reason: wrong call target, type: Wasm): begin. deoptimizing main, function index 6, bytecode offset 144
+  assertFalse(%IsTurboFanFunction(wasm2.main));
+  // Returning zero here means that the second call_ref in the main function now
+  // has feedback for "second".
+  assertEquals(0, wasm2.main(30, 0, wasm2.second));
+
+  // We have 5 different call targets, so the call is megamorphic. (The
+  // per-instance feedback for both instances is polymorphic.)
+  // CHECK: function 6: call #0: megamorphic
+  // CHECK: function 6: call #1 inlineable (monomorphic)
+  // CHECK: function 6: Speculatively inlining call_ref #1, case #0, to function 4
+  // CHECK: Compiled function [[NATIVE_MODULE]]#6 using TurboFan
+  %WasmTierUpFunction(wasm2.main);
+  for (let wasm of [wasm1, wasm2]) {
+    assertEquals(42, wasm.main(30, 12, wasm.add));
+    assertEquals(360, wasm.main(30, 12, wasm.mul));
+    assertEquals(18, wasm.main(30, 12, wasm.sub));
+    assertEquals(30, wasm.main(30, 12, wasm.first));
+    assertEquals(12, wasm.main(30, 12, wasm.second));
+    // New targets don't trigger a de-opt either (as long as they don't return
+    // zero which would cause them executing the second call_ref).
+    assertEquals(1, wasm.main(30, 30, wasm.equals));
+    assertTrue(%IsTurboFanFunction(wasm.main));
+  }
+
+  let wasm3 = new WebAssembly.Instance(module).exports;
+  assertEquals(42, wasm3.main(30, 12, wasm3.add));
+  assertTrue(%IsTurboFanFunction(wasm3.main));
+
+  // CHECK: Trigger deopt on second call_ref for wasm3
+  print("Trigger deopt on second call_ref for wasm3");
+  // Trigger deoptimization on second call_ref which so far has only seen the
+  // "second" function.
+  assertEquals(0, wasm3.main(12, 12, wasm3.sub));
+  // CHECK: bailout (kind: deopt-eager, reason: wrong call target, type: Wasm): begin. deoptimizing main, function index 6, bytecode offset 157
+  assertFalse(%IsTurboFanFunction(wasm3.main));
+  // Now that we are back in liftoff, collect feedback for equals on the first
+  // call_ref as well.
+  assertEquals(0, wasm3.main(30, 12, wasm3.equals));
+  // CHECK: function 6: call #0: megamorphic
+  // CHECK: Compiled function [[NATIVE_MODULE]]#6 using TurboFan
+  // CHECK-NOT: bailout (kind: deopt-eager, reason: wrong call target, type: Wasm)
+  %WasmTierUpFunction(wasm3.main);
+
+  // The first call is still megamorphic, so we can call all functions without
+  // triggering a deopt (as long as the result isn't zero).
+  for (let wasm of [wasm1, wasm2, wasm3]) {
+    assertEquals(42, wasm.main(30, 12, wasm.add));
+    assertEquals(360, wasm.main(30, 12, wasm.mul));
+    assertEquals(18, wasm.main(30, 12, wasm.sub));
+    assertEquals(30, wasm.main(30, 12, wasm.first));
+    assertEquals(12, wasm.main(30, 12, wasm.second));
+    assertEquals(1, wasm.main(30, 30, wasm.equals));
+    assertTrue(%IsTurboFanFunction(wasm.main));
+  }
+})();
diff --git a/deps/v8/test/filecheck/filecheck.status b/deps/v8/test/filecheck/filecheck.status
new file mode 100644
index 00000000000000..eaef7dff17eaf4
--- /dev/null
+++ b/deps/v8/test/filecheck/filecheck.status
@@ -0,0 +1,11 @@
+# Copyright 2025 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+[
+['variant == code_serializer', {
+  # Code serializer output is incompatible with some filecheck tests because the
+  # same test is executed twice (similar to message tests).
+  'deopt-too-much-feedback': [SKIP],
+}],  # variant == code_serializer
+]
diff --git a/deps/v8/test/filecheck/testcfg.py b/deps/v8/test/filecheck/testcfg.py
new file mode 100644
index 00000000000000..774090b6118d65
--- /dev/null
+++ b/deps/v8/test/filecheck/testcfg.py
@@ -0,0 +1,38 @@
+# Copyright 2025 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+from testrunner.local import testsuite
+from testrunner.objects import testcase
+from testrunner.outproc.filecheck import FileCheckOutProc
+
+
+class TestSuite(testsuite.TestSuite):
+
+  def _test_loader_class(self):
+    return testsuite.JSTestLoader
+
+  def _test_class(self):
+    return FileCheckTestCase
+
+
+class FileCheckTestCase(testcase.D8TestCase):
+  """Test case using llvm's FileCheck."""
+
+  def __init__(self, *args, **kwargs):
+    super().__init__(*args, **kwargs)
+    self._source_flags = self._parse_source_flags()
+
+  def _get_source_flags(self):
+    return self._source_flags
+
+  def _get_files_params(self):
+    return [self._get_source_path()]
+
+  def _get_source_path(self):
+    return self.suite.root / self.path_js
+
+  @property
+  def output_proc(self):
+    return FileCheckOutProc(self.expected_outcomes,
+                            self.suite.root / self.path_and_suffix('.js'))
diff --git a/deps/v8/test/message/wasm-deopt-max-input-count.js b/deps/v8/test/filecheck/wasm-deopt-max-input-count.js
similarity index 92%
rename from deps/v8/test/message/wasm-deopt-max-input-count.js
rename to deps/v8/test/filecheck/wasm-deopt-max-input-count.js
index 578d03eab80a1a..275e89005b20a4 100644
--- a/deps/v8/test/message/wasm-deopt-max-input-count.js
+++ b/deps/v8/test/filecheck/wasm-deopt-max-input-count.js
@@ -33,6 +33,7 @@ d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
 
   let wasm = builder.instantiate().exports;
   assertEquals(2 + 3, wasm.main(2, 3, wasm.add));
+  // CHECK: Disabling deoptimizations for speculative inlining as the deoptimization FrameState takes too many inputs
   %WasmTierUpFunction(wasm.main);
   assertEquals(2 + 3, wasm.main(2, 3, wasm.add));
   assertTrue(%IsTurboFanFunction(wasm.main));
diff --git a/deps/v8/test/message/wasm-deopt-max-limit.js b/deps/v8/test/filecheck/wasm-deopt-max-limit.js
similarity index 89%
rename from deps/v8/test/message/wasm-deopt-max-limit.js
rename to deps/v8/test/filecheck/wasm-deopt-max-limit.js
index be56ddea06a400..725cff69b1f2c9 100644
--- a/deps/v8/test/message/wasm-deopt-max-limit.js
+++ b/deps/v8/test/filecheck/wasm-deopt-max-limit.js
@@ -39,10 +39,12 @@ d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
   assertEquals(2 + 3, wasm.main(2, 3, wasm.add));
   assertTrue(%IsTurboFanFunction(wasm.main));
   // New target on 2nd call_ref.
+  // CHECK: bailout (kind: deopt-eager, reason: wrong call target, type: Wasm)
   assertEquals(2 * 3, wasm.main(2, 3, wasm.mul));
   assertFalse(%IsTurboFanFunction(wasm.main));
   // Trigger tier-up again. This disable using deoptimizations as the limit is
   // reached.
+  // CHECK: Disabling deoptimizations for speculative inlining as the deoptimization limit (1) for this function is reached or exceeded (1)
   %WasmTierUpFunction(wasm.main);
   assertEquals(2 + 3, wasm.main(2, 3, wasm.add));
   assertEquals(2 * 3, wasm.main(2, 3, wasm.mul));
diff --git a/deps/v8/test/fuzzer/wasm/async.cc b/deps/v8/test/fuzzer/wasm/async.cc
index ed3536cfb866e8..033682bbbd55a4 100644
--- a/deps/v8/test/fuzzer/wasm/async.cc
+++ b/deps/v8/test/fuzzer/wasm/async.cc
@@ -94,7 +94,9 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
     isolate->PerformMicrotaskCheckpoint();
   }
 
-  return resolver->fuzzing_return_value();
+  // Differently to fuzzers generating "always valid" wasm modules, also mark
+  // invalid modules as interesting to have coverage-guidance for invalid cases.
+  return 0;
 }
 
 }  // namespace v8::internal::wasm::fuzzing
diff --git a/deps/v8/test/fuzzer/wasm/code.cc b/deps/v8/test/fuzzer/wasm/code.cc
index 75ffa6c292dc7d..fa7bae70383249 100644
--- a/deps/v8/test/fuzzer/wasm/code.cc
+++ b/deps/v8/test/fuzzer/wasm/code.cc
@@ -30,7 +30,10 @@ class WasmCodeFuzzer : public WasmExecutionFuzzer {
 };
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
-  return WasmCodeFuzzer().FuzzWasmModule({data, size});
+  // Differently to fuzzers generating "always valid" wasm modules, also mark
+  // invalid modules as interesting to have coverage-guidance for invalid cases.
+  USE(WasmCodeFuzzer().FuzzWasmModule({data, size}));
+  return 0;
 }
 
 }  // namespace v8::internal::wasm::fuzzing
diff --git a/deps/v8/test/fuzzer/wasm/deopt.cc b/deps/v8/test/fuzzer/wasm/deopt.cc
index ad23e85b8d1d74..9f1b14e4ed23ba 100644
--- a/deps/v8/test/fuzzer/wasm/deopt.cc
+++ b/deps/v8/test/fuzzer/wasm/deopt.cc
@@ -217,6 +217,10 @@ void ConfigureFlags(v8::Isolate* isolate) {
       v8_flags.wasm_inlining_budget = v8_flags.wasm_inlining_budget * 5;
       v8_flags.wasm_inlining_max_size = v8_flags.wasm_inlining_max_size * 5;
       v8_flags.wasm_inlining_factor = v8_flags.wasm_inlining_factor * 5;
+      // Allow mixed old and new EH instructions in the same module for fuzzing,
+      // to help us test the interaction between the two EH proposals without
+      // requiring multiple modules.
+      v8_flags.wasm_allow_mixed_eh_for_testing = true;
       // Enable other staged or experimental features and enforce flag
       // implications.
       EnableExperimentalWasmFeatures(isolate);
diff --git a/deps/v8/test/fuzzer/wasm/fuzzer-common.cc b/deps/v8/test/fuzzer/wasm/fuzzer-common.cc
index 78d274826a9e6b..a8f0703adbb13f 100644
--- a/deps/v8/test/fuzzer/wasm/fuzzer-common.cc
+++ b/deps/v8/test/fuzzer/wasm/fuzzer-common.cc
@@ -463,6 +463,11 @@ int WasmExecutionFuzzer::FuzzWasmModule(base::Vector<const uint8_t> data,
   // the flag by itself.
   EnableExperimentalWasmFeatures(isolate);
 
+  // Allow mixed old and new EH instructions in the same module for fuzzing, to
+  // help us test the interaction between the two EH proposals without requiring
+  // multiple modules.
+  v8_flags.wasm_allow_mixed_eh_for_testing = true;
+
   AccountingAllocator allocator;
   Zone zone(&allocator, ZONE_NAME);
 
diff --git a/deps/v8/test/fuzzer/wasm/module.cc b/deps/v8/test/fuzzer/wasm/module.cc
index f9d411137c483d..f6bdffdbc40239 100644
--- a/deps/v8/test/fuzzer/wasm/module.cc
+++ b/deps/v8/test/fuzzer/wasm/module.cc
@@ -74,18 +74,18 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
     GenerateTestCase(i_isolate, wire_bytes, compiles);
   }
 
-  // Return `-1` for invalid modules. We generate enough of them via mutation,
-  // no need to add them to the corpus.
-  int fuzzer_return_value =
-      compiles ? ExecuteAgainstReference(i_isolate, module_object,
-                                         kDefaultMaxFuzzerExecutedInstructions)
-               : -1;
+  if (compiles) {
+    USE(ExecuteAgainstReference(i_isolate, module_object,
+                                kDefaultMaxFuzzerExecutedInstructions));
+  }
 
   // Pump the message loop and run micro tasks, e.g. GC finalization tasks.
   support->PumpMessageLoop(v8::platform::MessageLoopBehavior::kDoNotWait);
   isolate->PerformMicrotaskCheckpoint();
 
-  return fuzzer_return_value;
+  // Differently to fuzzers generating "always valid" wasm modules, also mark
+  // invalid modules as interesting to have coverage-guidance for invalid cases.
+  return 0;
 }
 
 }  // namespace v8::internal::wasm::fuzzing
diff --git a/deps/v8/test/inspector/debugger/script-parsed-js-build-id-expected.txt b/deps/v8/test/inspector/debugger/script-parsed-js-build-id-expected.txt
new file mode 100644
index 00000000000000..21e739a806e9a9
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/script-parsed-js-build-id-expected.txt
@@ -0,0 +1,17 @@
+Tests buildId for JavaScript scripts/modules
+Debugger.scriptParsed with:
+url: script1.js
+buildId: 85314830-023f-4cf1-a267-535f4e37bb17
+
+Debugger.scriptParsed with:
+url: module1.js
+buildId: cdc0c7f3-423a-4250-9f15-baac67a52cce
+
+Debugger.scriptParsed with:
+url: wrong-magic-comment.js
+buildId: 
+
+Debugger.scriptFailedToParse with:
+url: failed-to-parse.js
+buildId: 715dd671-19f9-42dd-af76-93664d8a1bef
+
diff --git a/deps/v8/test/inspector/debugger/script-parsed-js-build-id.js b/deps/v8/test/inspector/debugger/script-parsed-js-build-id.js
new file mode 100644
index 00000000000000..1aca50f95304e0
--- /dev/null
+++ b/deps/v8/test/inspector/debugger/script-parsed-js-build-id.js
@@ -0,0 +1,45 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const { session, contextGroup, Protocol } = InspectorTest.start('Tests buildId for JavaScript scripts/modules');
+
+contextGroup.addScript(`
+const foo = 42;
+//# debugId=85314830-023f-4cf1-a267-535f4e37bb17
+`, 0, 0, 'script1.js');
+
+contextGroup.addModule(`
+const foo = 42;
+//# debugId=cdc0c7f3-423a-4250-9f15-baac67a52cce
+`, 'module1.js');
+
+contextGroup.addScript(`
+const foo = 42;
+//@ debugId=d348ff8b-da3a-4c99-8dff-807b45723ed8
+`, 0, 0, 'wrong-magic-comment.js');
+
+(async () => {
+  Protocol.Debugger.onScriptParsed(({params: { buildId, url }}) => {
+    InspectorTest.log('Debugger.scriptParsed with:')
+    InspectorTest.log('url: ' + url);
+    InspectorTest.log('buildId: ' + buildId);
+    InspectorTest.log();
+  });
+
+  Protocol.Debugger.onScriptFailedToParse(({params: { buildId, url }}) => {
+    InspectorTest.log('Debugger.scriptFailedToParse with:')
+    InspectorTest.log('url: ' + url);
+    InspectorTest.log('buildId: ' + buildId);
+    InspectorTest.log();
+  });
+
+  await Protocol.Debugger.enable();
+
+  contextGroup.addScript(`
+    for (
+    //# debugId=715dd671-19f9-42dd-af76-93664d8a1bef
+  `, 0, 0, 'failed-to-parse.js');
+
+  InspectorTest.completeTest();
+})();
diff --git a/deps/v8/test/inspector/debugger/set-breakpoint-after-gc-expected.txt b/deps/v8/test/inspector/debugger/set-breakpoint-after-gc-expected.txt
index 512ae69fcb889f..901da03ff2d7a5 100644
--- a/deps/v8/test/inspector/debugger/set-breakpoint-after-gc-expected.txt
+++ b/deps/v8/test/inspector/debugger/set-breakpoint-after-gc-expected.txt
@@ -2,4 +2,4 @@ Checks if we keep alive breakpoint information for top-level functions.
 Result of setting breakpoint in topLevel.js
 []
 Result of setting breakpoint in moduleFunc.js
-[{"scriptId":"5","lineNumber":0,"columnNumber":22}]
+[{"scriptId":"7","lineNumber":0,"columnNumber":22}]
diff --git a/deps/v8/test/inspector/debugger/set-breakpoint-after-gc.js b/deps/v8/test/inspector/debugger/set-breakpoint-after-gc.js
index f11b81a32b0891..f7e14b6f98f164 100644
--- a/deps/v8/test/inspector/debugger/set-breakpoint-after-gc.js
+++ b/deps/v8/test/inspector/debugger/set-breakpoint-after-gc.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --expose-gc
 
 let {session, contextGroup, Protocol} = InspectorTest.start(
     'Checks if we keep alive breakpoint information for top-level functions.');
@@ -44,6 +44,10 @@ async function testSetBreakpoint(executionContextId, func, url) {
   });
   const scriptId = obj.result.scriptId;
   await Protocol.Runtime.runScript({scriptId});
+  // TODO(41480448): This relies on precise  garbage collection and may fail if
+  // conservative stack scanning is used. We call callGarbageCollector twice
+  // to ensure the weak reference hold by the script is collected.
+  await Protocol.Runtime.evaluate({expression: `${callGarbageCollector}`});
   await Protocol.Runtime.evaluate({expression: `${callGarbageCollector}`});
   const {result: {locations}} =
       await Protocol.Debugger.setBreakpointByUrl({lineNumber: 0, url});
diff --git a/deps/v8/test/inspector/inspector.status b/deps/v8/test/inspector/inspector.status
index ff0c609281c5e0..b5cd5dcf3cea4b 100644
--- a/deps/v8/test/inspector/inspector.status
+++ b/deps/v8/test/inspector/inspector.status
@@ -257,7 +257,7 @@
 }],  # 'clang_coverage and mode == debug'
 
 ##############################################################################
-['((arch != x64 and arch != arm64 and arch != ia32 and arch != arm and arch != ppc64 and arch != s390x) or (simulator_run and conservative_stack_scanning))', {
+['((arch != x64 and arch != arm64 and arch != ia32 and arch != arm and arch != ppc64 and arch != s390x) or (simulator_run and direct_handle))', {
   # Stack switching is only supported on x64/arm64/ia32/arm.
   'debugger/wasm-jspi-async-stack': [SKIP],
 }],  # (arch != x64 and arch != arm64 and arch != ia32 and arch != arm and arch != ppc64 and arch != s390x)
diff --git a/deps/v8/test/inspector/isolate-data.cc b/deps/v8/test/inspector/isolate-data.cc
index 9141b9651faeea..94b7d628d8cc38 100644
--- a/deps/v8/test/inspector/isolate-data.cc
+++ b/deps/v8/test/inspector/isolate-data.cc
@@ -203,7 +203,7 @@ std::optional<int> InspectorIsolateData::ConnectSession(
   // inspector will already send notifications.
   auto* c = channel.get();
   ChannelHolder::AddChannel(session_id, std::move(channel));
-  sessions_[session_id] = inspector_->connect(
+  sessions_[session_id] = inspector_->connectShared(
       context_group_id, c, state,
       is_fully_trusted ? v8_inspector::V8Inspector::kFullyTrusted
                        : v8_inspector::V8Inspector::kUntrusted,
diff --git a/deps/v8/test/inspector/isolate-data.h b/deps/v8/test/inspector/isolate-data.h
index c8d667ad432e17..305f27a293f860 100644
--- a/deps/v8/test/inspector/isolate-data.h
+++ b/deps/v8/test/inspector/isolate-data.h
@@ -168,7 +168,7 @@ class InspectorIsolateData : public v8_inspector::V8InspectorClient {
   std::map<int, std::vector<v8::Global<v8::Context>>> contexts_;
   std::map<std::vector<uint16_t>, v8::Global<v8::Module>> modules_;
   int last_session_id_ = 0;
-  std::map<int, std::unique_ptr<v8_inspector::V8InspectorSession>> sessions_;
+  std::map<int, std::shared_ptr<v8_inspector::V8InspectorSession>> sessions_;
   std::map<v8_inspector::V8InspectorSession*, int> context_group_by_session_;
   std::set<int> session_ids_for_cleanup_;
   v8::Global<v8::Value> memory_info_;
diff --git a/deps/v8/test/intl/regress-407793302.js b/deps/v8/test/intl/regress-407793302.js
new file mode 100644
index 00000000000000..a350384cef9dde
--- /dev/null
+++ b/deps/v8/test/intl/regress-407793302.js
@@ -0,0 +1,8 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Locale language should not return undefined but "und"
+assertEquals((new Intl.Locale("und")).language, "und");
+assertEquals((new Intl.Locale("und-Latn")).language, "und");
+assertEquals((new Intl.Locale("und-RS")).language, "und");
diff --git a/deps/v8/test/js-perf-test/Array/run.js b/deps/v8/test/js-perf-test/Array/run.js
index 82ea13ce064739..d15aa4c77b252b 100644
--- a/deps/v8/test/js-perf-test/Array/run.js
+++ b/deps/v8/test/js-perf-test/Array/run.js
@@ -18,12 +18,22 @@ const max_index_value = `value ${max_index}`;
 // newClosure is a handy function to get a fresh
 // closure unpolluted by IC feedback for a 2nd-order array builtin
 // test.
+
+let cache_break = 0;
+
 function newClosure(name, generic = false) {
   if (generic) {
     return new Function(
-      `result = Array.prototype.${name}.call(array, func, this_arg);`);
+      `
+      // ${cache_break++}
+      result = Array.prototype.${name}.call(array, func, this_arg);
+      `);
   }
-  return new Function(`result = array.${name}(func, this_arg);`);
+  return new Function(
+      `
+      // ${cache_break++}
+      result = array.${name}(func, this_arg);
+      `);
 }
 
 function MakeHoley(array) {
diff --git a/deps/v8/test/message/wasm-deopt-max-input-count.out b/deps/v8/test/message/wasm-deopt-max-input-count.out
deleted file mode 100644
index de72c3be00fd3d..00000000000000
--- a/deps/v8/test/message/wasm-deopt-max-input-count.out
+++ /dev/null
@@ -1,6 +0,0 @@
-[function 2: call #0 inlineable (monomorphic)]
-[function 2: expanding topmost caller... budget=min({NUMBER}, {NUMBER}), size 13->13 queueing 1 callee(s)]
-[function 2: in function 2, considering call #0, case #0, to function 0 (count=1, size=7, score={NUMBER})... budget=min({NUMBER}, {NUMBER}), size 13->20 decided to inline! no feedback yet or no callees]
-[function 2: Disabling deoptimizations for speculative inlining as the deoptimization FrameState takes too many inputs (508 vs. 500)]
-[function 2: Speculatively inlining call_ref #0, case #0, to function 0]
-[function 2: emitted {NUMBER} nodes]
diff --git a/deps/v8/test/message/wasm-deopt-max-limit.out b/deps/v8/test/message/wasm-deopt-max-limit.out
deleted file mode 100644
index b8695399bb1c63..00000000000000
--- a/deps/v8/test/message/wasm-deopt-max-limit.out
+++ /dev/null
@@ -1,14 +0,0 @@
-[function 3: call #0 inlineable (monomorphic)]
-[function 3: expanding topmost caller... budget=min({NUMBER}, {NUMBER}), size 10->10 queueing 1 callee(s)]
-[function 3: in function 3, considering call #0, case #0, to function 0 (count=1, size=7, score={NUMBER})... budget=min({NUMBER}, {NUMBER}), size 10->17 decided to inline! no feedback yet or no callees]
-[function 3: Speculatively inlining call_ref #0, case #0, to function 0]
-[function 3: emitted {NUMBER} nodes]
-[bailout (kind: deopt-eager, reason: wrong call target, type: Wasm): begin. deoptimizing main, function index 3, bytecode offset 95, deopt exit 0, FP to SP delta {NUMBER}, pc {ADDRESS}]
-[function 3: call #0 inlineable (polymorphic 2)]
-[function 3: expanding topmost caller... budget=min(50, 7000), size 10->10 queueing 1 callee(s)]
-[function 3: in function 3, considering call #0, case #0, to function 0 (count=1, size=7, score={NUMBER})... budget=min({NUMBER}, {NUMBER}), size 10->17 decided to inline! no feedback yet or no callees]
-[function 3: in function 3, considering call #0, case #1, to function 1 (count=1, size=7, score={NUMBER})... budget=min({NUMBER}, {NUMBER}), size 10->17 decided to inline! no feedback yet or no callees]
-[function 3: Disabling deoptimizations for speculative inlining as the deoptimization limit (1) for this function is reached or exceeded (1)]
-[function 3: Speculatively inlining call_ref #0, case #0, to function 0]
-[function 3: Speculatively inlining call_ref #0, case #1, to function 1]
-[function 3: emitted {NUMBER} nodes]
diff --git a/deps/v8/test/mjsunit/compiler/deopt-pretenure.js b/deps/v8/test/mjsunit/compiler/deopt-pretenure.js
index ed432f56712a46..c86afdcdfec5b7 100644
--- a/deps/v8/test/mjsunit/compiler/deopt-pretenure.js
+++ b/deps/v8/test/mjsunit/compiler/deopt-pretenure.js
@@ -6,13 +6,15 @@
 // Flags: --allocation-site-pretenuring --stress-gc-during-compilation
 // Flags: --stress-scavenge=0 --gc-interval=-1
 // Flags: --max-optimized-bytecode-size=132000
+// Flags: --no-reopt-after-lazy-deopts
 
 function CheckOptimizationStatus(func, expectedOptimizationStatus) {
   let opt_status = %GetOptimizationStatus(func);
   assertTrue(
       (opt_status & expectedOptimizationStatus) !== 0,
       'Expected flag 0x' + expectedOptimizationStatus.toString(16) +
-          ' to be set in optimization status');
+          ' to be set in optimization status, but status was ' +
+          opt_status.toString(16));
 }
 
 // Trigger pretenuring decision change at entry, deopting at bytecode offset -1.
diff --git a/deps/v8/test/mjsunit/compiler/fast-api-calls-wasm.js b/deps/v8/test/mjsunit/compiler/fast-api-calls-wasm.js
index e15daad37045a9..11e57c4a796d86 100644
--- a/deps/v8/test/mjsunit/compiler/fast-api-calls-wasm.js
+++ b/deps/v8/test/mjsunit/compiler/fast-api-calls-wasm.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 // Flags: --turbo-fast-api-calls --expose-fast-api
-// Flags: --fast-api-allow-float-in-sim
+// Flags: --fast-api-allow-float-in-sim --experimental-wasm-jspi
 
 d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
 
@@ -213,3 +213,10 @@ fast_c_api.reset_counts();
 assertThrows(test_throw_no_fallback, Error, 'Exception from fast callback');
 assertEquals(1, fast_c_api.fast_call_count());
 assertEquals(0, fast_c_api.slow_call_count());
+
+// Test that the fast API call runs on the central stack when called from a JSPI
+// stack. This is verified by a CHECK in Isolate::Throw.
+assertThrowsAsync(
+    WebAssembly.promising(test_throw_no_fallback)(),
+    Error,
+    'Exception from fast callback');
diff --git a/deps/v8/test/mjsunit/compiler/load_mutable_heap_slot_context_specialized.js b/deps/v8/test/mjsunit/compiler/load_mutable_heap_slot_context_specialized.js
index 8f2dd3ca798f9e..ba156766b0df2d 100644
--- a/deps/v8/test/mjsunit/compiler/load_mutable_heap_slot_context_specialized.js
+++ b/deps/v8/test/mjsunit/compiler/load_mutable_heap_slot_context_specialized.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 //
 // Flags: --allow-natives-syntax --turbofan --no-always-turbofan
-// Flags: --script-context-mutable-heap-number
+// Flags: --script-context-cells
 
 let x = 42;
 (function() {
diff --git a/deps/v8/test/mjsunit/compiler/regress-406999116.js b/deps/v8/test/mjsunit/compiler/regress-406999116.js
new file mode 100644
index 00000000000000..87a0f40e55e8ce
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-406999116.js
@@ -0,0 +1,14 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbofan --no-always-turbofan
+
+var val = new DataView(new ArrayBuffer());
+function foo() {
+  return ArrayBuffer.isView(val);
+}
+%PrepareFunctionForOptimization(foo);
+foo();
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo());
diff --git a/deps/v8/test/mjsunit/const-tracking-let-already-not-constant-global-no-deopt-maglev.js b/deps/v8/test/mjsunit/const-tracking-let-already-not-constant-global-no-deopt-maglev.js
index af0c8b689eab6d..3c8ab3cfc1636a 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-already-not-constant-global-no-deopt-maglev.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-already-not-constant-global-no-deopt-maglev.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-already-not-constant-no-deopt-maglev.js b/deps/v8/test/mjsunit/const-tracking-let-already-not-constant-no-deopt-maglev.js
index efcb860a487a11..42fa894064a03c 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-already-not-constant-no-deopt-maglev.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-already-not-constant-no-deopt-maglev.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-basic.js b/deps/v8/test/mjsunit/const-tracking-let-basic.js
index c4d8302f2fd928..209cafb2dde2b2 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-basic.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-basic.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-globalic-slow-path.js b/deps/v8/test/mjsunit/const-tracking-let-globalic-slow-path.js
index 21d79cf42bf39d..c8b4236c5bded3 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-globalic-slow-path.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-globalic-slow-path.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug --stress-ic
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-initial-value-maglev.js b/deps/v8/test/mjsunit/const-tracking-let-initial-value-maglev.js
index 615b7debd8d8a7..1f94b5a581930d 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-initial-value-maglev.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-initial-value-maglev.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-initialization-baseline.js b/deps/v8/test/mjsunit/const-tracking-let-initialization-baseline.js
index 93a5fc0f19b5f5..389b199685c095 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-initialization-baseline.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-initialization-baseline.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-eval.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-eval.js
index 12b9633e4374a7..28df4308788231 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-eval.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-eval.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-baseline1.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-baseline1.js
index b7bd129af09744..4fe3ebd1bed531 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-baseline1.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-baseline1.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-baseline2.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-baseline2.js
index 43f63d231eb1db..fbe30fcb06f42a 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-baseline2.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-baseline2.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-baseline3.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-baseline3.js
index 9d6c15d611eb86..ee2de54910c674 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-baseline3.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-baseline3.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-interpreter1.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-interpreter1.js
index 396f6ae711e4cb..b43f9b7620900b 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-interpreter1.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-interpreter1.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-interpreter2.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-interpreter2.js
index f282bab6e19122..c7073ad4dc91a5 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-interpreter2.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-interpreter2.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-interpreter3.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-interpreter3.js
index 35fddea3e280af..109caf25d24ae6 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-interpreter3.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-interpreter3.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-maglev1.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-maglev1.js
index efea9edce01713..7b25a270f64fea 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-maglev1.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-maglev1.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-maglev2.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-maglev2.js
index b92cf84bcc2aa4..82d49a013634e9 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-maglev2.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-maglev2.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-maglev3.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-maglev3.js
index 6d2fdcd57923d8..4aa7161e57b154 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-maglev3.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-maglev3.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-turbofan1.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-turbofan1.js
index 41e029d70593f5..feae4033cc5615 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-turbofan1.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-turbofan1.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-turbofan2.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-turbofan2.js
index 1968a328c321ce..bd09d02b9ad195 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-turbofan2.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-turbofan2.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-turbofan3.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-turbofan3.js
index 5d038b1fa38077..18041c9a904445 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-turbofan3.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-function-turbofan3.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-baseline1.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-baseline1.js
index f7b8042644059c..598622b0959134 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-baseline1.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-baseline1.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-baseline2.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-baseline2.js
index 4afc43dcd512be..fc1180c62173c3 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-baseline2.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-baseline2.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-interpreter1.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-interpreter1.js
index f5784398facb90..8b4579980cdaec 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-interpreter1.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-interpreter1.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-interpreter2.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-interpreter2.js
index 8c410e42c29ac8..1e2739b99e370c 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-interpreter2.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-interpreter2.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-maglev1.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-maglev1.js
index 917559e5d9a4de..2ee2297844c1ee 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-maglev1.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-maglev1.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-maglev2.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-maglev2.js
index 4994afcde9fdb2..18e9cfe21290ca 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-maglev2.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-maglev2.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-turbofan1.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-turbofan1.js
index e14dc425a6236e..fcd145743cd30b 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-turbofan1.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-turbofan1.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-turbofan2.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-turbofan2.js
index fcb45c742320e1..10dc724e40911a 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-turbofan2.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-inner-function-turbofan2.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-maglev-representations.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-maglev-representations.js
index c1f5773d2d064d..eef7b8196044a9 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-maglev-representations.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-maglev-representations.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-repl-baseline.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-repl-baseline.js
index 758a3c825499b9..cc521e76c9ca10 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-repl-baseline.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-repl-baseline.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-repl-interpreter.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-repl-interpreter.js
index a16cb0177a4b51..ca73c371fb799a 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-repl-interpreter.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-repl-interpreter.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-repl-maglev.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-repl-maglev.js
index 30c435d510fbd2..46cd2259749d3b 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-repl-maglev.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-repl-maglev.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-repl-turbofan.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-repl-turbofan.js
index 9bc8d9577a375f..874d8fdccc9a95 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-repl-turbofan.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-repl-turbofan.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-storeglobal-baseline.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-storeglobal-baseline.js
index 89a2c6520a8ec6..a7706f5a92764d 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-storeglobal-baseline.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-storeglobal-baseline.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-storeglobal-interpreter.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-storeglobal-interpreter.js
index 8fcd1bb6b7e39d..e47ea03cb2ef1d 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-storeglobal-interpreter.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-storeglobal-interpreter.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-storeglobal-maglev.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-storeglobal-maglev.js
index 959fa0e1e8098d..71506177682aba 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-storeglobal-maglev.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-storeglobal-maglev.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-storeglobal-turbofan.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-storeglobal-turbofan.js
index 22b5a1696ba408..7efc7b035fc625 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-storeglobal-turbofan.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-storeglobal-turbofan.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-baseline.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-baseline.js
index 621ee2c19b04eb..ff93a7e646592c 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-baseline.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-baseline.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-interpreter.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-interpreter.js
index db2b0f59eaa021..96f2922a9d728b 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-interpreter.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-interpreter.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-maglev.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-maglev.js
index 0c8c951aaa7a7e..eca03c42986c35 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-maglev.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-maglev.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-strict-baseline.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-strict-baseline.js
index c5a2c10c33181e..72ccf62c767d83 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-strict-baseline.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-strict-baseline.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-strict-interpreter.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-strict-interpreter.js
index 138d7d664850f0..d7e6d597f23653 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-strict-interpreter.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-strict-interpreter.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-strict-maglev.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-strict-maglev.js
index 36257c6b37792c..0f987e004cdf5b 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-strict-maglev.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-strict-maglev.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-strict-turbofan.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-strict-turbofan.js
index 0c574fdf303a64..6a0ec053602cef 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-strict-turbofan.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-strict-turbofan.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-turbofan.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-turbofan.js
index 0c400a1fae3120..ce7932205a4082 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-turbofan.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-storelookupslot-turbofan.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-toplevel-baseline.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-toplevel-baseline.js
index 487e801c959f9b..24a481e4dd4565 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-toplevel-baseline.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-toplevel-baseline.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-toplevel-interpreter.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-toplevel-interpreter.js
index 88460ca1246a15..9ba00dc957eaf9 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-toplevel-interpreter.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-toplevel-interpreter.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-toplevel-maglev.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-toplevel-maglev.js
index f245a2baeaa947..4b48f990d3de28 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-toplevel-maglev.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-toplevel-maglev.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-invalidate-toplevel-turbofan.js b/deps/v8/test/mjsunit/const-tracking-let-invalidate-toplevel-turbofan.js
index 0a20d9ee9c0ca6..666009da99a843 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-invalidate-toplevel-turbofan.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-invalidate-toplevel-turbofan.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-multiple.js b/deps/v8/test/mjsunit/const-tracking-let-multiple.js
index 71fa3c1d7ffce5..522656e0b3d2d1 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-multiple.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-multiple.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-no-deopt-write-if-already-not-const.js b/deps/v8/test/mjsunit/const-tracking-let-no-deopt-write-if-already-not-const.js
index b249d29636ed6d..cfb3fc79c77ca1 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-no-deopt-write-if-already-not-const.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-no-deopt-write-if-already-not-const.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-not-const.js b/deps/v8/test/mjsunit/const-tracking-let-not-const.js
index e0f71a3c5592e4..971833f5aff720 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-not-const.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-not-const.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-other-script.js b/deps/v8/test/mjsunit/const-tracking-let-other-script.js
index e1a48097ed8024..9c26e36eef69fd 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-other-script.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-other-script.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-read-is-inner-function.js b/deps/v8/test/mjsunit/const-tracking-let-read-is-inner-function.js
index f2a9836e6f2f23..e43aa0f775f60c 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-read-is-inner-function.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-read-is-inner-function.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-read-uninitialized.js b/deps/v8/test/mjsunit/const-tracking-let-read-uninitialized.js
index 5bbf67d9baccf6..f9379dd40230eb 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-read-uninitialized.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-read-uninitialized.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-repl-initialize.js b/deps/v8/test/mjsunit/const-tracking-let-repl-initialize.js
index 2dcfa770bceb00..f42fb85f528d99 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-repl-initialize.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-repl-initialize.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-repl-side-data-sync.js b/deps/v8/test/mjsunit/const-tracking-let-repl-side-data-sync.js
index 93a5421d25490b..1986df1f9dff27 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-repl-side-data-sync.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-repl-side-data-sync.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-repl.js b/deps/v8/test/mjsunit/const-tracking-let-repl.js
index 5b52f247c41fdf..288536546b2fed 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-repl.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-repl.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-uninitialized.js b/deps/v8/test/mjsunit/const-tracking-let-uninitialized.js
index 5f99ca5f73232b..bf08fa13345d64 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-uninitialized.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-uninitialized.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 
diff --git a/deps/v8/test/mjsunit/const-tracking-let-wont-prevent-osr-to-turbofan.js b/deps/v8/test/mjsunit/const-tracking-let-wont-prevent-osr-to-turbofan.js
index 64894cf420cd5c..273776f494e3e5 100644
--- a/deps/v8/test/mjsunit/const-tracking-let-wont-prevent-osr-to-turbofan.js
+++ b/deps/v8/test/mjsunit/const-tracking-let-wont-prevent-osr-to-turbofan.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --const-tracking-let --allow-natives-syntax
+// Flags: --script-context-cells --allow-natives-syntax
 // Flags: --turbofan --no-always-turbofan --maglev --no-stress-maglev
 // Flags: --sparkplug --no-always-sparkplug
 // Flags: --no-baseline-batch-compilation --use-osr
diff --git a/deps/v8/test/mjsunit/d8/d8-terminate-before-cache.js b/deps/v8/test/mjsunit/d8/d8-terminate-before-cache.js
new file mode 100644
index 00000000000000..d699263f435621
--- /dev/null
+++ b/deps/v8/test/mjsunit/d8/d8-terminate-before-cache.js
@@ -0,0 +1,14 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --cache=after-execute --strict-termination-checks
+
+d8.terminate();
+
+function f(a, b) {
+  return a + b
+}
+
+// Force an OSR to handle interrupts.
+for (let i = 0; i < 1_000; i++) f(i, i)
diff --git a/deps/v8/test/mjsunit/d8/d8-terminate-now-before-cache.js b/deps/v8/test/mjsunit/d8/d8-terminate-now-before-cache.js
new file mode 100644
index 00000000000000..74ab7c425249cc
--- /dev/null
+++ b/deps/v8/test/mjsunit/d8/d8-terminate-now-before-cache.js
@@ -0,0 +1,7 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --cache=after-execute --strict-termination-checks
+
+d8.terminateNow();
diff --git a/deps/v8/test/mjsunit/equals-feedback.js b/deps/v8/test/mjsunit/equals-feedback.js
index ccf107a6fcebf1..a61a637ba00b1a 100644
--- a/deps/v8/test/mjsunit/equals-feedback.js
+++ b/deps/v8/test/mjsunit/equals-feedback.js
@@ -98,10 +98,10 @@ testLoose(21, false, false, 'NumberOrBoolean');
 testStrict(20, true, false, 'Any');
 testStrict(21, false, false, 'Any');
 
-// These should actually be NumberOrOddball, but detecting it is not
-// implemented (unclear if implementing it will improve performance).
-test(22, null, false, 'Any');
-test(23, undefined, false, 'Any');
+testLoose(22, null, false, 'NumberOrOddball');
+testStrict(22, null, false, 'Any');
+testLoose(23, undefined, false, 'NumberOrOddball');
+testStrict(23, undefined, false, 'Any');
 
 // SMI, internalized string
 testLoose(24, '24', true, 'Any');
@@ -145,10 +145,10 @@ testLoose(3.21, false, false, 'NumberOrBoolean');
 testStrict(3.20, true, false, 'Any');
 testStrict(3.21, false, false, 'Any');
 
-// These should actually be NumberOrOddball, but detecting it is not
-// implemented (unclear if implementing it will improve performance).
-test(3.22, null, false, 'Any');
-test(3.23, undefined, false, 'Any');
+testLoose(3.22, null, false, 'NumberOrOddball');
+testStrict(3.22, null, false, 'Any');
+testLoose(3.23, undefined, false, 'NumberOrOddball');
+testStrict(3.23, undefined, false, 'Any');
 
 // HeapNumber, internalized string
 testLoose(3.24, '3.24', true, 'Any');
@@ -261,11 +261,11 @@ testOneWay(false, undefined, '===', false, 'Any');
 testOneWay(undefined, false, '===', false, 'ReceiverOrNullOrUndefined');
 
 // TODO(397375000): These should be NumberOrOddball.
-testOneWay(true, null, '==', false, 'Any');
+testOneWay(true, null, '==', false, 'NumberOrOddball');
 testOneWay(null, true, '===', false, 'ReceiverOrNullOrUndefined');
-testLoose(true, undefined, false, 'Any');
-testLoose(false, null, false, 'Any');
-testLoose(false, undefined, false, 'Any');
+testLoose(true, undefined, false, 'NumberOrOddball');
+testLoose(false, null, false, 'NumberOrOddball');
+testLoose(false, undefined, false, 'NumberOrOddball');
 
 test(undefined, undefined, true, 'ReceiverOrNullOrUndefined');
 testLoose(undefined, null, true, 'ReceiverOrNullOrUndefined');
diff --git a/deps/v8/test/mjsunit/eval-origin.js b/deps/v8/test/mjsunit/eval-origin.js
index 5ca648a53fe2c1..e4d275bf1e5c92 100644
--- a/deps/v8/test/mjsunit/eval-origin.js
+++ b/deps/v8/test/mjsunit/eval-origin.js
@@ -8,26 +8,28 @@ Error.prepareStackTrace = function(exception, frames) {
   return frames[0].getEvalOrigin();
 }
 
-var source = "new Error()";
+var sc = 0;
+// TODO(4921)
+Object.defineProperty(globalThis, "source", {get() { return `new Error(${sc++})` }});
 var eval_origin;
 var geval = eval;
 var log = [];
 
 (function() {
-  log.push([geval(source).stack, "17:13"]);
-  log.push([geval(source).stack, "18:13"]);
-  // log.push([geval(source).stack, "19:13"]);  TODO(4921).
+  log.push([geval(source).stack, "19:13"]);
+  log.push([geval(source).stack, "20:13"]);
+  log.push([geval(source).stack, "21:13"]);
 })();
 
 (function() {
-  log.push([eval(source).stack, "23:13"]);
-  log.push([eval(source).stack, "24:13"]);
-  // log.push([eval(source).stack, "25:13"]);  TODO(4921).
+  log.push([eval(source).stack, "25:13"]);
+  log.push([eval(source).stack, "26:13"]);
+  log.push([eval(source).stack, "27:13"]);
 })();
 
-log.push([eval(source).stack, "28:11"]);
-log.push([eval(source).stack, "29:11"]);
-// log.push([eval(source).stack, "30:11"]);  TODO(4921).
+log.push([eval(source).stack, "30:11"]);
+log.push([eval(source).stack, "31:11"]);
+log.push([eval(source).stack, "32:11"]);
 
 Error.prepareStackTrace = undefined;
 
diff --git a/deps/v8/test/mjsunit/harmony/base64-from-hex-long-inputs.js b/deps/v8/test/mjsunit/harmony/base64-from-hex-long-inputs.js
index 6a15e7933d9887..6e5df915a4230c 100644
--- a/deps/v8/test/mjsunit/harmony/base64-from-hex-long-inputs.js
+++ b/deps/v8/test/mjsunit/harmony/base64-from-hex-long-inputs.js
@@ -56,11 +56,16 @@
       arr_two_byte_64.join(','));
 
   for (let i = 0; i < 0xFF; i++) {
-    if ((i >= 0x30 && i <= 0x39 /* 0-9 */) ||
+    const isValid = (i >= 0x30 && i <= 0x39 /* 0-9 */) ||
         (i >= 0x41 && i <= 0x46 /* A-F */) ||
-        (i >= 0x61 && i <= 0x66 /* a-f */))
-      continue;
+        (i >= 0x61 && i <= 0x66 /* a-f */);
     const str = String.fromCharCode.apply(String, Array(32).fill(i));
-    assertThrows(() => Uint8Array.fromHex(str), SyntaxError);
+    if (isValid) {
+      const byte = parseInt(str.substr(0, 2), 16);
+      const arr = Uint8Array.fromHex(str);
+      assertSame(Array(16).fill(byte).join(','), arr.join(','));
+    } else {
+      assertThrows(() => Uint8Array.fromHex(str), SyntaxError);
+    }
   }
 })();
diff --git a/deps/v8/test/mjsunit/harmony/regress/regress-409478039.js b/deps/v8/test/mjsunit/harmony/regress/regress-409478039.js
new file mode 100644
index 00000000000000..aab8a9343d4551
--- /dev/null
+++ b/deps/v8/test/mjsunit/harmony/regress/regress-409478039.js
@@ -0,0 +1,24 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --js-staging
+
+var log = [];
+class Test {
+  [Symbol.dispose]() {
+    log.push(42);
+  }
+
+  f() {
+    log.push(43);
+  }
+}
+
+{
+  using listener = new Test();
+  g = () => listener;
+}
+g().f();
+
+assertEquals(log, [42, 43]);
diff --git a/deps/v8/test/mjsunit/maglev/constant-typed-array-load-deopt-detach.js b/deps/v8/test/mjsunit/maglev/constant-typed-array-load-deopt-detach.js
new file mode 100644
index 00000000000000..12d5305ea3e215
--- /dev/null
+++ b/deps/v8/test/mjsunit/maglev/constant-typed-array-load-deopt-detach.js
@@ -0,0 +1,36 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev --no-always-turbofan
+
+const ab = new ArrayBuffer(100);
+var constTypedArray = new Uint16Array(ab);
+
+function fillTypedArray() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    constTypedArray[i] = i;
+  }
+}
+%NeverOptimizeFunction(fillTypedArray);
+
+fillTypedArray();
+
+function foo(i) {
+  return constTypedArray[i];
+}
+%PrepareFunctionForOptimization(foo);
+
+assertEquals(3, foo(3));
+assertEquals(10, foo(10));
+
+%OptimizeMaglevOnNextCall(foo);
+
+assertEquals(3, foo(3));
+assertEquals(10, foo(10));
+
+assertTrue(isMaglevved(foo));
+
+// Detaching the buffer deopts.
+%ArrayBufferDetach(ab);
+assertFalse(isMaglevved(foo));
diff --git a/deps/v8/test/mjsunit/maglev/constant-typed-array-load-deopt-oob.js b/deps/v8/test/mjsunit/maglev/constant-typed-array-load-deopt-oob.js
new file mode 100644
index 00000000000000..a7baa8aa4cf6a5
--- /dev/null
+++ b/deps/v8/test/mjsunit/maglev/constant-typed-array-load-deopt-oob.js
@@ -0,0 +1,36 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev --no-always-turbofan
+
+const ab = new ArrayBuffer(100);
+var constTypedArray = new Uint16Array(ab);
+
+function fillTypedArray() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    constTypedArray[i] = i;
+  }
+}
+%NeverOptimizeFunction(fillTypedArray);
+
+fillTypedArray();
+
+function foo(i) {
+  return constTypedArray[i];
+}
+%PrepareFunctionForOptimization(foo);
+
+assertEquals(3, foo(3));
+assertEquals(10, foo(10));
+
+%OptimizeMaglevOnNextCall(foo);
+
+assertEquals(3, foo(3));
+assertEquals(10, foo(10));
+
+assertTrue(isMaglevved(foo));
+
+// Going out of bounds deopts.
+assertEquals(undefined, foo(1000));
+assertFalse(isMaglevved(foo));
diff --git a/deps/v8/test/mjsunit/maglev/constant-typed-array-load-double.js b/deps/v8/test/mjsunit/maglev/constant-typed-array-load-double.js
new file mode 100644
index 00000000000000..0de6d8983b5d1c
--- /dev/null
+++ b/deps/v8/test/mjsunit/maglev/constant-typed-array-load-double.js
@@ -0,0 +1,37 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev --no-always-turbofan
+
+const ab = new ArrayBuffer(100);
+var constTypedArray = new Float32Array(ab);
+
+function fillTypedArray() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    constTypedArray[i] = i + 0.5;
+  }
+}
+%NeverOptimizeFunction(fillTypedArray);
+
+fillTypedArray();
+
+function foo(i) {
+  return constTypedArray[i];
+}
+%PrepareFunctionForOptimization(foo);
+
+assertEquals(3.5, foo(3));
+assertEquals(10.5, foo(10));
+
+%OptimizeMaglevOnNextCall(foo);
+
+function test() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    assertEquals(i + 0.5, foo(i));
+  }
+}
+%NeverOptimizeFunction(test);
+test();
+
+assertTrue(isMaglevved(foo));
diff --git a/deps/v8/test/mjsunit/maglev/constant-typed-array-load-no-rab-gsab.js b/deps/v8/test/mjsunit/maglev/constant-typed-array-load-no-rab-gsab.js
new file mode 100644
index 00000000000000..68e875ed5296a6
--- /dev/null
+++ b/deps/v8/test/mjsunit/maglev/constant-typed-array-load-no-rab-gsab.js
@@ -0,0 +1,45 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev --no-always-turbofan
+// Flags: --no-optimize-maglev-optimizes-to-turbofan
+
+const ab = new ArrayBuffer(100, {maxByteLength: 300});
+var constTypedArray = new Uint16Array(ab);
+
+function fillTypedArray() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    constTypedArray[i] = i;
+  }
+}
+%NeverOptimizeFunction(fillTypedArray);
+
+fillTypedArray();
+
+function foo(i) {
+  return constTypedArray[i];
+}
+%PrepareFunctionForOptimization(foo);
+
+assertEquals(3, foo(3));
+assertEquals(10, foo(10));
+
+%OptimizeMaglevOnNextCall(foo);
+
+assertEquals(3, foo(3));
+assertEquals(10, foo(10));
+
+assertTrue(isMaglevved(foo));
+
+// We don't optimize loading from the constant typed array, so we then also
+// don't deopt if we read out of bounds, the array buffer is detached, etc.
+assertEquals(undefined, foo(1000));
+assertTrue(isMaglevved(foo));
+
+ab.resize(50);
+assertEquals(undefined, foo(30));
+assertTrue(isMaglevved(foo));
+
+%ArrayBufferDetach(ab);
+assertTrue(isMaglevved(foo));
diff --git a/deps/v8/test/mjsunit/maglev/constant-typed-array-load-signed.js b/deps/v8/test/mjsunit/maglev/constant-typed-array-load-signed.js
new file mode 100644
index 00000000000000..8ff65341fd8368
--- /dev/null
+++ b/deps/v8/test/mjsunit/maglev/constant-typed-array-load-signed.js
@@ -0,0 +1,37 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev --no-always-turbofan
+
+const ab = new ArrayBuffer(100);
+var constTypedArray = new Int16Array(ab);
+
+function fillTypedArray() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    constTypedArray[i] = -1-i;
+  }
+}
+%NeverOptimizeFunction(fillTypedArray);
+
+fillTypedArray();
+
+function foo(i) {
+  return constTypedArray[i];
+}
+%PrepareFunctionForOptimization(foo);
+
+assertEquals(-4, foo(3));
+assertEquals(-11, foo(10));
+
+%OptimizeMaglevOnNextCall(foo);
+
+function test() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    assertEquals(-1-i, foo(i));
+  }
+}
+%NeverOptimizeFunction(test);
+test();
+
+assertTrue(isMaglevved(foo));
diff --git a/deps/v8/test/mjsunit/maglev/constant-typed-array-load-unsigned.js b/deps/v8/test/mjsunit/maglev/constant-typed-array-load-unsigned.js
new file mode 100644
index 00000000000000..6804c988a7f10f
--- /dev/null
+++ b/deps/v8/test/mjsunit/maglev/constant-typed-array-load-unsigned.js
@@ -0,0 +1,37 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev --no-always-turbofan
+
+const ab = new ArrayBuffer(100);
+var constTypedArray = new Uint16Array(ab);
+
+function fillTypedArray() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    constTypedArray[i] = i;
+  }
+}
+%NeverOptimizeFunction(fillTypedArray);
+
+fillTypedArray();
+
+function foo(i) {
+  return constTypedArray[i];
+}
+%PrepareFunctionForOptimization(foo);
+
+assertEquals(3, foo(3));
+assertEquals(10, foo(10));
+
+%OptimizeMaglevOnNextCall(foo);
+
+function test() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    assertEquals(i, foo(i));
+  }
+}
+%NeverOptimizeFunction(test);
+test();
+
+assertTrue(isMaglevved(foo));
diff --git a/deps/v8/test/mjsunit/maglev/constant-typed-array-store-deopt-detach.js b/deps/v8/test/mjsunit/maglev/constant-typed-array-store-deopt-detach.js
new file mode 100644
index 00000000000000..74ddaf57cc46ef
--- /dev/null
+++ b/deps/v8/test/mjsunit/maglev/constant-typed-array-store-deopt-detach.js
@@ -0,0 +1,36 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev --no-always-turbofan
+
+const ab = new ArrayBuffer(100);
+var constTypedArray = new Uint16Array(ab);
+
+function readTypedArray() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    assertEquals(i, constTypedArray[i]);
+  }
+}
+%NeverOptimizeFunction(readTypedArray);
+
+function foo(i, v) {
+  constTypedArray[i] = v;
+}
+
+%PrepareFunctionForOptimization(foo);
+foo(3, 4);
+foo(10, 20);
+
+assertEquals(4, constTypedArray[3]);
+assertEquals(20, constTypedArray[10]);
+%OptimizeMaglevOnNextCall(foo);
+
+foo(13, 14);
+
+assertTrue(isMaglevved(foo));
+assertEquals(14, constTypedArray[13]);
+
+// Detaching the buffer deopts.
+%ArrayBufferDetach(ab);
+assertFalse(isMaglevved(foo));
diff --git a/deps/v8/test/mjsunit/maglev/constant-typed-array-store-deopt-oob.js b/deps/v8/test/mjsunit/maglev/constant-typed-array-store-deopt-oob.js
new file mode 100644
index 00000000000000..ee0f0d53c4ad7c
--- /dev/null
+++ b/deps/v8/test/mjsunit/maglev/constant-typed-array-store-deopt-oob.js
@@ -0,0 +1,36 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev --no-always-turbofan
+
+const ab = new ArrayBuffer(100);
+var constTypedArray = new Uint16Array(ab);
+
+function readTypedArray() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    assertEquals(i, constTypedArray[i]);
+  }
+}
+%NeverOptimizeFunction(readTypedArray);
+
+function foo(i, v) {
+  constTypedArray[i] = v;
+}
+
+%PrepareFunctionForOptimization(foo);
+foo(3, 4);
+foo(10, 20);
+
+assertEquals(4, constTypedArray[3]);
+assertEquals(20, constTypedArray[10]);
+%OptimizeMaglevOnNextCall(foo);
+
+foo(13, 14);
+
+assertTrue(isMaglevved(foo));
+assertEquals(14, constTypedArray[13]);
+
+// Going out of bounds deopts.
+foo(1000, 0);
+assertFalse(isMaglevved(foo));
diff --git a/deps/v8/test/mjsunit/maglev/constant-typed-array-store-double.js b/deps/v8/test/mjsunit/maglev/constant-typed-array-store-double.js
new file mode 100644
index 00000000000000..2cb52caede049a
--- /dev/null
+++ b/deps/v8/test/mjsunit/maglev/constant-typed-array-store-double.js
@@ -0,0 +1,39 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev --no-always-turbofan
+
+const ab = new ArrayBuffer(100);
+var constTypedArray = new Float32Array(ab);
+
+function readTypedArray() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    assertEquals(i + 0.5, constTypedArray[i]);
+  }
+}
+%NeverOptimizeFunction(readTypedArray);
+
+function foo(i, v) {
+  constTypedArray[i] = v;
+}
+
+%PrepareFunctionForOptimization(foo);
+foo(3, 4.5);
+foo(10, 20.5);
+
+assertEquals(4.5, constTypedArray[3]);
+assertEquals(20.5, constTypedArray[10]);
+
+%OptimizeMaglevOnNextCall(foo);
+
+function test() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    foo(i, i + 0.5);
+  }
+  readTypedArray();
+}
+%NeverOptimizeFunction(test);
+test();
+
+assertTrue(isMaglevved(foo));
diff --git a/deps/v8/test/mjsunit/maglev/constant-typed-array-store-int.js b/deps/v8/test/mjsunit/maglev/constant-typed-array-store-int.js
new file mode 100644
index 00000000000000..b539c048af8205
--- /dev/null
+++ b/deps/v8/test/mjsunit/maglev/constant-typed-array-store-int.js
@@ -0,0 +1,39 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev --no-always-turbofan
+
+const ab = new ArrayBuffer(100);
+var constTypedArray = new Uint16Array(ab);
+
+function readTypedArray() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    assertEquals(i, constTypedArray[i]);
+  }
+}
+%NeverOptimizeFunction(readTypedArray);
+
+function foo(i, v) {
+  constTypedArray[i] = v;
+}
+
+%PrepareFunctionForOptimization(foo);
+foo(3, 4);
+foo(10, 20);
+
+assertEquals(4, constTypedArray[3]);
+assertEquals(20, constTypedArray[10]);
+
+%OptimizeMaglevOnNextCall(foo);
+
+function test() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    foo(i, i);
+  }
+  readTypedArray();
+}
+%NeverOptimizeFunction(test);
+test();
+
+assertTrue(isMaglevved(foo));
diff --git a/deps/v8/test/mjsunit/maglev/constant-typed-array-store-no-rab-gsab.js b/deps/v8/test/mjsunit/maglev/constant-typed-array-store-no-rab-gsab.js
new file mode 100644
index 00000000000000..7c9cd896df037d
--- /dev/null
+++ b/deps/v8/test/mjsunit/maglev/constant-typed-array-store-no-rab-gsab.js
@@ -0,0 +1,45 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev --no-always-turbofan
+// Flags: --no-optimize-maglev-optimizes-to-turbofan
+
+const ab = new ArrayBuffer(100, {maxByteLength: 300});
+var constTypedArray = new Uint16Array(ab);
+
+function readTypedArray() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    assertEquals(i, constTypedArray[i]);
+  }
+}
+%NeverOptimizeFunction(readTypedArray);
+
+function foo(i, v) {
+  constTypedArray[i] = v;
+}
+
+%PrepareFunctionForOptimization(foo);
+foo(3, 4);
+foo(10, 20);
+
+assertEquals(4, constTypedArray[3]);
+assertEquals(20, constTypedArray[10]);
+%OptimizeMaglevOnNextCall(foo);
+
+foo(13, 14);
+
+assertTrue(isMaglevved(foo));
+assertEquals(14, constTypedArray[13]);
+
+// We don't optimize storing into the constant typed array, so we then also
+// don't deopt if we store out of bounds, the array buffer is detached, etc.
+foo(1000, 0);
+assertTrue(isMaglevved(foo));
+
+ab.resize(50);
+foo(30, 0);
+assertTrue(isMaglevved(foo));
+
+%ArrayBufferDetach(ab);
+assertTrue(isMaglevved(foo));
diff --git a/deps/v8/test/mjsunit/maglev/load_mutable_heap_slot_context_specialized.js b/deps/v8/test/mjsunit/maglev/load_mutable_heap_slot_context_specialized.js
index 8aa756f885576c..98090c29d945cf 100644
--- a/deps/v8/test/mjsunit/maglev/load_mutable_heap_slot_context_specialized.js
+++ b/deps/v8/test/mjsunit/maglev/load_mutable_heap_slot_context_specialized.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 //
 // Flags: --allow-natives-syntax --maglev --no-always-turbofan
-// Flags: --script-context-mutable-heap-number
+// Flags: --script-context-cells
 // Flags: --maglev-function-context-specialization
 
 let x = 42;
diff --git a/deps/v8/test/mjsunit/maglev/load_mutable_heap_slot_no_context_specialized.js b/deps/v8/test/mjsunit/maglev/load_mutable_heap_slot_no_context_specialized.js
index b888c5ecd8bd7a..a710c78c85681f 100644
--- a/deps/v8/test/mjsunit/maglev/load_mutable_heap_slot_no_context_specialized.js
+++ b/deps/v8/test/mjsunit/maglev/load_mutable_heap_slot_no_context_specialized.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 //
 // Flags: --allow-natives-syntax --maglev --no-always-turbofan
-// Flags: --script-context-mutable-heap-number
+// Flags: --script-context-cells
 // Flags: --no-maglev-function-context-specialization
 
 let x = 42;
diff --git a/deps/v8/test/mjsunit/maglev/regress-377850462.js b/deps/v8/test/mjsunit/maglev/regress-377850462.js
index 6ae567bd89a923..48cf93012d3d9b 100644
--- a/deps/v8/test/mjsunit/maglev/regress-377850462.js
+++ b/deps/v8/test/mjsunit/maglev/regress-377850462.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 //
 // Flags: --allow-natives-syntax --maglev --no-always-turbofan
-// Flags: --script-context-mutable-heap-number
+// Flags: --script-context-cells
 // Flags: --maglev-function-context-specialization
 
 let x = 42;
diff --git a/deps/v8/test/mjsunit/maglev/regress-406830022.js b/deps/v8/test/mjsunit/maglev/regress-406830022.js
new file mode 100644
index 00000000000000..31c5d902b2cf9d
--- /dev/null
+++ b/deps/v8/test/mjsunit/maglev/regress-406830022.js
@@ -0,0 +1,20 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev --maglev-future
+
+function __f_0(__v_0, __v_1) {
+    if (__v_1 != __v_0) 'xxxxxxxxxxxxxxxxx' + __v_1;
+}
+%PrepareFunctionForOptimization(__f_0);
+
+__f_0("", ".");
+
+(function () {
+  try {
+    for (__v_2 = 2000; __v_2; --__v_2) {
+    }
+    __f_0(3, "122".length);
+  } catch (e) {}
+})();
diff --git a/deps/v8/test/mjsunit/maglev/regress-407298296.js b/deps/v8/test/mjsunit/maglev/regress-407298296.js
new file mode 100644
index 00000000000000..b618b248062fd1
--- /dev/null
+++ b/deps/v8/test/mjsunit/maglev/regress-407298296.js
@@ -0,0 +1,20 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev
+
+function f0() {
+  return f0;
+}
+
+function test() {
+  for (let v1 = 0; v1 < 5; v1++) {
+    for (const v2 in f0) {
+      v1[v2]();
+    }
+    const v4 = %OptimizeOsr();
+  }
+}
+%PrepareFunctionForOptimization(test);
+test();
diff --git a/deps/v8/test/mjsunit/maglev/regress-408571498.js b/deps/v8/test/mjsunit/maglev/regress-408571498.js
new file mode 100644
index 00000000000000..dee9e157a3fff6
--- /dev/null
+++ b/deps/v8/test/mjsunit/maglev/regress-408571498.js
@@ -0,0 +1,16 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev --no-always-turbofan
+// Flags: --maglev-cons-string-elision
+
+const v0 = [4.5];
+function f7() {
+  v0[268435] = undefined;
+  `foooo000000000000000000000000000 ${undefined}`;
+}
+%PrepareFunctionForOptimization(f7);
+f7();
+%OptimizeMaglevOnNextCall(f7);
+f7();
diff --git a/deps/v8/test/mjsunit/maglev/regress-409354670.js b/deps/v8/test/mjsunit/maglev/regress-409354670.js
new file mode 100644
index 00000000000000..f1aadaf62d3bff
--- /dev/null
+++ b/deps/v8/test/mjsunit/maglev/regress-409354670.js
@@ -0,0 +1,23 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev
+
+function foo(a, b, cond) {
+  if (cond) {
+    a === b;
+  }
+}
+%PrepareFunctionForOptimization(foo);
+foo("a", "b", 1); // String feedback for the ===.
+
+function test(cond) {
+  let big = 10000000000;
+  const big2 = big | 0; // Truncates to int32
+  return foo(big2, big2, cond);
+}
+%PrepareFunctionForOptimization(test);
+test(0);
+%OptimizeMaglevOnNextCall(test);
+test(1);
diff --git a/deps/v8/test/mjsunit/maglev/regress-409905368.js b/deps/v8/test/mjsunit/maglev/regress-409905368.js
new file mode 100644
index 00000000000000..70e72b571c15ca
--- /dev/null
+++ b/deps/v8/test/mjsunit/maglev/regress-409905368.js
@@ -0,0 +1,10 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev
+
+for (let v0 = 0; v0 < 2500; v0++) {
+  const v2 = new Uint16Array(Uint16Array);
+  v2[2] = v2;
+}
diff --git a/deps/v8/test/mjsunit/maglev/regress-410052362.js b/deps/v8/test/mjsunit/maglev/regress-410052362.js
new file mode 100644
index 00000000000000..82669799ee030b
--- /dev/null
+++ b/deps/v8/test/mjsunit/maglev/regress-410052362.js
@@ -0,0 +1,17 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev --ignore-unhandled-promises
+
+const ta = new Uint32Array();
+async function foo(a, b) {
+  Object.defineProperty(a, 98, { value: 0 });
+  ({'buffer':b, 'length':b,} = ta);
+}
+%PrepareFunctionForOptimization(foo);
+foo();
+foo(Int8Array);
+%OptimizeMaglevOnNextCall(foo);
+foo(Int8Array);
+%DeoptimizeFunction(foo);
diff --git a/deps/v8/test/mjsunit/maglev/regress-410121217.js b/deps/v8/test/mjsunit/maglev/regress-410121217.js
new file mode 100644
index 00000000000000..16acc37b59830f
--- /dev/null
+++ b/deps/v8/test/mjsunit/maglev/regress-410121217.js
@@ -0,0 +1,22 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --maglev
+
+function test() {
+  const array = [];
+  function foo(o) {
+    o.prop1 = o;
+    o.prop2 = 1.797;
+  }
+  %PrepareFunctionForOptimization(foo);
+  foo.prop3 = foo;
+  foo(foo);
+  foo(array);
+}
+%PrepareFunctionForOptimization(test);
+test();
+test();
+%OptimizeMaglevOnNextCall(test);
+test();
diff --git a/deps/v8/test/mjsunit/maglev/regress-412125812.js b/deps/v8/test/mjsunit/maglev/regress-412125812.js
new file mode 100644
index 00000000000000..4fa7c7f3c32aab
--- /dev/null
+++ b/deps/v8/test/mjsunit/maglev/regress-412125812.js
@@ -0,0 +1,21 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc --maglev
+
+function foo() {
+  let o = {};
+  o[Uint8ClampedArray] ||= 1000;
+  Math.cbrt(o);
+  const o2 = %PretenureAllocationSite({
+    y: o
+  });
+}
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+gc();
+foo();
+%OptimizeMaglevOnNextCall(foo);
+foo();
diff --git a/deps/v8/test/mjsunit/maglev/regress-413419840.js b/deps/v8/test/mjsunit/maglev/regress-413419840.js
new file mode 100644
index 00000000000000..a6b1dfd3a3d91e
--- /dev/null
+++ b/deps/v8/test/mjsunit/maglev/regress-413419840.js
@@ -0,0 +1,18 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --maglev --no-lazy-feedback-allocation --allow-natives-syntax
+
+%PrepareFunctionForOptimization(%GetFunctionForCurrentFrame());
+
+for (let v1 = 0; v1 < 5; v1++) {
+  function f2() {
+    return f2;
+  }
+  const v3 = f2.constructor;
+  const v4 = new v3();
+  v4.b = v3;
+  f2.constructor = 2327;
+  const v5 = %OptimizeOsr();
+}
diff --git a/deps/v8/test/mjsunit/maglev/store_mutable_heap_slot_context_specialized.js b/deps/v8/test/mjsunit/maglev/store_mutable_heap_slot_context_specialized.js
index b523bcefeaa3fd..0bf71b0432151f 100644
--- a/deps/v8/test/mjsunit/maglev/store_mutable_heap_slot_context_specialized.js
+++ b/deps/v8/test/mjsunit/maglev/store_mutable_heap_slot_context_specialized.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 //
 // Flags: --allow-natives-syntax --maglev --no-always-turbofan
-// Flags: --script-context-mutable-heap-number
+// Flags: --script-context-cells
 // Flags: --maglev-function-context-specialization
 
 let x = 42;
diff --git a/deps/v8/test/mjsunit/maglev/store_mutable_heap_slot_no_context_specialized.js b/deps/v8/test/mjsunit/maglev/store_mutable_heap_slot_no_context_specialized.js
index 91d1366cffa31b..5918e142e2e895 100644
--- a/deps/v8/test/mjsunit/maglev/store_mutable_heap_slot_no_context_specialized.js
+++ b/deps/v8/test/mjsunit/maglev/store_mutable_heap_slot_no_context_specialized.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 //
 // Flags: --allow-natives-syntax --maglev --no-always-turbofan
-// Flags: --script-context-mutable-heap-number
+// Flags: --script-context-cells
 // Flags: --no-maglev-function-context-specialization
 
 let x = 42;
diff --git a/deps/v8/test/mjsunit/maglev/typed-array-length-store-script-context.js b/deps/v8/test/mjsunit/maglev/typed-array-length-store-script-context.js
index 7f61bcf4c2b120..e6f9e219260122 100644
--- a/deps/v8/test/mjsunit/maglev/typed-array-length-store-script-context.js
+++ b/deps/v8/test/mjsunit/maglev/typed-array-length-store-script-context.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 //
 // Flags: --allow-natives-syntax --maglev --no-always-turbofan
-// Flags: --typed-array-length-loading --script-context-mutable-heap-number
+// Flags: --typed-array-length-loading --script-context-cells
 
 let scriptContextSlot = 0;
 
@@ -20,6 +20,8 @@ foo(100);
 assertEquals(100, scriptContextSlot);
 assertTrue(isMaglevved(foo));
 
+foo(100);
+
 // If we create a large JSTypedArray (length doesn't fit in Smi), we'll deopt
 // because the large length doesn't match the existing type for
 // scriptContextSlot.
diff --git a/deps/v8/test/mjsunit/mjsunit.status b/deps/v8/test/mjsunit/mjsunit.status
index 301aab595004c8..629e2c02c1ca54 100644
--- a/deps/v8/test/mjsunit/mjsunit.status
+++ b/deps/v8/test/mjsunit/mjsunit.status
@@ -580,6 +580,8 @@
   'regress/wasm/regress-362539773': [SKIP],
   'regress/wasm/regress-382547695': [SKIP],
   'regress/wasm/regress-384974501': [SKIP],
+  'regress/wasm/regress-390675703': [SKIP],
+  'regress/wasm/regress-393632542': [SKIP],
   'wasm/call-ref': [SKIP],
   'wasm/exceptions-type-reflection': [SKIP],
   'wasm/externref-table': [SKIP],
@@ -604,6 +606,7 @@
   'wasm/gc-casts-exnref': [SKIP],
   'wasm/gc-casts-invalid': [SKIP],
   'wasm/js-wrapper-typechecks': [SKIP],
+  'wasm/mixed-eh-invalid': [SKIP],
   'wasm/wasm-inlining-catch-unreachable': [SKIP],
 
   #--experimental-wasm-ref-cast-nop
@@ -636,6 +639,8 @@
   'regress/wasm/regress-324690505': [SKIP],
   'regress/wasm/regress-330580823': [SKIP],
   'regress/wasm/regress-336007398': [SKIP],
+  'regress/wasm/regress-390467420': [SKIP],
+  'regress/wasm/regress-399497254': [SKIP],
   'regress/wasm/regress-crbug-1463232': [SKIP],
   'regress/wasm/regress-crbug-1466312': [SKIP],
   'regress/wasm/regress-v8-14710': [SKIP],
@@ -661,6 +666,7 @@
   'regress/wasm/regress-9017': [SKIP],
   'regress/wasm/regress-350779988': [SKIP],
   'regress/wasm/regress-366350772': [SKIP],
+  'regress/wasm/regress-397043084': [SKIP],
   'wasm/denormals': [SKIP],
   'wasm/deopt/*': [SKIP],
   'wasm/enter-debug-state': [SKIP],
@@ -711,16 +717,45 @@
   'wasm/shared-everything/basic': [SKIP],
 
   # --experimental-wasm-jspi
+  'regress/regress-333926321': [SKIP],
+  'regress/wasm/regress-331383939': [SKIP],
+  'regress/wasm/regress-336358915': [SKIP],
   'regress/wasm/regress-336852356': [SKIP],
   'regress/wasm/regress-342522151': [SKIP],
+  'regress/wasm/regress-348473836-*': [SKIP],
   'regress/wasm/regress-349640002': [SKIP],
   'regress/wasm/regress-361717714': [SKIP],
   'regress/wasm/regress-361123483': [SKIP],
   'regress/wasm/regress-364667545': [SKIP],
+  'regress/wasm/regress-365376497': [SKIP],
+  'regress/wasm/regress-381917890': [SKIP],
+  'regress/wasm/regress-392928805': [SKIP],
+  'regress/wasm/regress-406043349': [SKIP],
+  'regress/wasm/regress-407298298': [SKIP],
 
   # --experimental-wasm-fp16
   'wasm/simd-fp16': [SKIP],
 
+  # --experimental-wasm-simd-opt
+  'wasm/redundant-shuffle-lanes': [SKIP],
+
+  # --experimental-wasm-rab-integration
+  'wasm/grow-huge-memory-resizable-buffer*': [SKIP],
+  'wasm/grow-memory-detaching-resizable-buffer': [SKIP],
+  'wasm/grow-memory-in-branch-resizable-buffer': [SKIP],
+  'wasm/grow-memory-in-call-resizable-buffer': [SKIP],
+  'wasm/grow-memory-in-loop-resizable-buffer': [SKIP],
+  'wasm/grow-memory-resizable-buffer': [SKIP],
+  'wasm/grow-shared-memory-resizable-buffer': [SKIP],
+  'wasm/memory-resizable-buffer*': [SKIP],
+  'wasm/memory-toresizable-tofixedlength': [SKIP],
+  'wasm/shared-memory-resizable-buffer-array*': [SKIP],
+  'wasm/shared-memory-resizable-buffer-errors': [SKIP],
+
+  # --experimental-wasm-custom-descriptors
+  'wasm/custom-descriptors*': [SKIP],
+  'wasm/exact-types': [SKIP],
+
   # --wasm-deopt
   'regress/wasm/regress-363826217': [SKIP],
   'regress/wasm/regress-364360260': [SKIP],
@@ -739,6 +774,7 @@
 
   # Other tests that require compilation.
   'compiler/fast-api-calls-wasm': [SKIP],
+  'regress/wasm/regress-403308742': [SKIP],
   'wasm/async-compile': [SKIP],
   'wasm/log-code-after-post-message': [SKIP],
   'wasm/multiple-code-spaces': [SKIP],
@@ -789,6 +825,7 @@
 
   # Tests using %WasmGenerateRandomModule() (require compilation)
   'regress/wasm/regress-369652650': [SKIP],
+  'regress/wasm/regress-388934347-a': [SKIP],
 
   # --wasm_tier_up
   'wasm/graceful_shutdown_during_tierup': [SKIP],
@@ -930,10 +967,16 @@
 ['full_debug', {
   # Tests too slow in non-optimized debug mode.
   'es6/super-ic': [SKIP],
+  'es6/typedarray-of': [SKIP],
   'regress/regress-1122': [SKIP],
   'regress/regress-2790': [SKIP],
   'regress/regress-740784': [SKIP],
   'regress/regress-992389': [SKIP],
+  'regress/regress-crbug-1276923': [SKIP],
+  'wasm/memory-resizable-buffer-array-flat-flatmap-from': [SKIP],
+  'wasm/memory-resizable-buffer-array-from-grows-detaches': [SKIP],
+  'wasm/shared-memory-resizable-buffer-array-flat-flatmap-from': [SKIP],
+  'wasm/shared-memory-resizable-buffer-array-from-grows': [SKIP],
   'wasm/shared-memory-worker-gc': [SKIP],
 }],  # 'full_debug'
 
@@ -1607,7 +1650,9 @@
   'compiler/array-slice-clone': [SKIP],
 
   # Times out with asan.
+  'regress/regress-524': [PASS, ['asan', SKIP]],
   'wasm/max-wasm-functions': [PASS, ['asan', SKIP]],
+  'wasm/user-properties-module': [PASS, ['asan', SKIP]],
 }],  # 'gc_fuzzer'
 
 ##############################################################################
@@ -1951,10 +1996,6 @@
   'wasm/wasm-dynamic-tiering': [SKIP],
   'regress/wasm/regress-1179065': [SKIP],
   'regress/wasm/regress-334687959': [SKIP],
-
-  # Only implemented in turboshaft for now.
-  # TODO(14616): Enable again when implemented in liftoff.
-  'wasm/shared-everything/basic': [SKIP],
 }],  # variant == nooptimization
 
 ##############################################################################
@@ -2121,10 +2162,6 @@
   # https://crbug.com/v8/13181
   'maglev/get-template-object': [SKIP],
 
-  # Flaky and failing under this variant. https://crbug.com/380912397
-  'regress/regress-372298921': [SKIP],
-  'regress/regress-333926321': [SKIP],
-
   # Failing under this variant. https://crbug.com/401016020
   'regress/regress-340921322': [SKIP],
 }],  # variant == stress_snapshot and arch == x64
@@ -2360,14 +2397,20 @@
   # TODO(v8:14581): Re-enable this test once TransitionElementsKindOrCheckMap is
   # supported by the Maglev->Turboshaft graph builder.
   'turboshaft/maglev-frontend/*': [SKIP],
+
+  # TODO(42204563): These tests rely on the shared heap which is incompatible
+  # with single generation.
+  'wasm/custom-descriptors-validity': [SKIP],
+  'wasm/shared-everything/*': [SKIP],
+  'wasm/subtyping-invalid': [SKIP],
 }], # single_generation
 
 ################################################################################
-['conservative_stack_scanning', {
+['direct_handle', {
   # These tests are known to timeout with CSS, especially with variants that
   # stress the GC.
   'regress/regress-crbug-820312': [SKIP],
-}], # conservative_stack_scanning
+}], # direct_handle
 
 ##############################################################################
 ['arch == mips64el', {
@@ -2421,10 +2464,11 @@
 }],
 
 ##############################################################################
-# TODO(mliedtke): Support deopts on all platforms.
-['arch != x64 and arch != arm64 and arch != ia32 and arch != arm and arch != loong64 and arch != mips64el', {
-  # --wasm-deopt implementation experimental and not ported to most
-  # architectures, yet.
+# TODO(ports): Support Wasm deopts on all platforms.
+# If you need to add your architecture here, you will need to disable the
+# wasm_deopt flag by default on your platform as well!
+['arch in [riscv32, riscv64, mips64, ppc64, s390x]', {
+  # --wasm-deopt implementation not ported to all  architectures, yet.
   'wasm/deopt/*': [SKIP],
   'regress/wasm/regress-350779988': [SKIP],
   'regress/wasm/regress-353582136': [SKIP],
diff --git a/deps/v8/test/mjsunit/mutable-int32-slot.js b/deps/v8/test/mjsunit/mutable-int32-slot.js
index e977f63d3f3d62..6a80ca04e6a83c 100644
--- a/deps/v8/test/mjsunit/mutable-int32-slot.js
+++ b/deps/v8/test/mjsunit/mutable-int32-slot.js
@@ -4,7 +4,7 @@
 
 // Flags: --allow-natives-syntax --maglev
 // Flags: --maglev-function-context-specialization
-// Flags: --script-context-mutable-heap-int32
+// Flags: --script-context-cells
 
 // Reading slot and deopting via unoptimized code.
 let x = 0;
diff --git a/deps/v8/test/mjsunit/regress-378102635.js b/deps/v8/test/mjsunit/regress-378102635.js
index e52a4aef55654e..070f411fbf5760 100644
--- a/deps/v8/test/mjsunit/regress-378102635.js
+++ b/deps/v8/test/mjsunit/regress-378102635.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
-// Flags: --allow-natives-syntax --script-context-mutable-heap-number
+// Flags: --allow-natives-syntax --script-context-cells
 
 let y = 42;
 y = 4;
diff --git a/deps/v8/test/mjsunit/regress-401073454.js b/deps/v8/test/mjsunit/regress-401073454.js
new file mode 100644
index 00000000000000..15cce92f842c5f
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress-401073454.js
@@ -0,0 +1,37 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  function bar(a) {
+    let x = undefined;
+    try {
+      x = a & 1;
+    } catch (e) {}
+    return 2147483647 * x + 1 << 16;
+  }
+
+  %PrepareFunctionForOptimization(bar);
+  bar(-1);
+  bar([]); // [] & 1 = 0
+
+  %OptimizeFunctionOnNextCall(bar);
+  var obj = {};
+  obj.__proto__ = null;
+  assertEquals(0, bar(obj)); // obj & 1 will throw
+})();
+
+(function() {
+  function foo(i) {
+    var a = [0.5, 1, , 3];
+    return (a[i] + 1) | 0;
+  }
+
+  %PrepareFunctionForOptimization(foo);
+  foo(1);
+  foo(1);
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(2));
+})();
diff --git a/deps/v8/test/mjsunit/regress-409512701.js b/deps/v8/test/mjsunit/regress-409512701.js
new file mode 100644
index 00000000000000..95e2176e424f7c
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress-409512701.js
@@ -0,0 +1,20 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --cache
+
+class C {
+  constructor(s) { return eval(s) }
+  static #hello() {}
+  #a0;#a1;#a2;#a3;#a4;#a5;#a6;#a7;#a8;#a9;
+  #a10;#a11;#a12;#a13;#a14;#a15;#a16;#a17;#a18;#a19;
+  #a20;#a21;#a22;#a23;#a24;#a25;#a26;#a27;#a28;#a29;
+  #a30;#a31;#a32;#a33;#a34;#a35;#a36;#a37;#a38;#a39;
+  #a40;#a41;#a42;#a43;#a44;#a45;#a46;#a47;#a48;#a49;
+  #a50;#a51;#a52;#a53;#a54;#a55;#a56;#a57;#a58;#a59;
+  #a60;#a61;#a62;#a63;#a64;#a65;#a66;#a67;#a68;#a69;
+  #a70;#a71;#a72;#a73;#a74;#a75;#a76;#a77;#a78;#a79;
+}
+
+new C("print('hello')");
diff --git a/deps/v8/test/mjsunit/regress-410109077.js b/deps/v8/test/mjsunit/regress-410109077.js
new file mode 100644
index 00000000000000..8fca0ace33e3d5
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress-410109077.js
@@ -0,0 +1,28 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+%PrepareFunctionForOptimization(bar);
+bar();
+%OptimizeFunctionOnNextCall(bar);
+bar();
+
+let slot = 1;
+function foo() {
+  return slot;
+}
+
+%PrepareFunctionForOptimization(foo);
+%OptimizeFunctionOnNextCall(foo);
+foo();
+
+function bar() {
+  try {
+    slot = undefined;
+  } catch (e) {}
+}
+
+bar();
+assertEquals(undefined, foo());
diff --git a/deps/v8/test/mjsunit/regress-413800519.js b/deps/v8/test/mjsunit/regress-413800519.js
new file mode 100644
index 00000000000000..d21c5b1de96ab4
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress-413800519.js
@@ -0,0 +1,14 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var x = false;
+function foo() {
+    return x < x;
+}
+%PrepareFunctionForOptimization(foo);
+foo();
+%OptimizeFunctionOnNextCall(foo);
+assertFalse(foo());
diff --git a/deps/v8/test/mjsunit/regress-6429506.js b/deps/v8/test/mjsunit/regress-6429506.js
new file mode 100644
index 00000000000000..e685f3e9817034
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress-6429506.js
@@ -0,0 +1,17 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  for (let i = 0; i < 2; i++) {
+     (a[2] + 20) | 0;
+  }
+}
+
+const a = new Float32Array(1000);
+%PrepareFunctionForOptimization(foo);
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/deps/v8/test/mjsunit/regress/regress-327247469.js b/deps/v8/test/mjsunit/regress/regress-327247469.js
index 8405c569f5ef29..4eb31c07769c1c 100644
--- a/deps/v8/test/mjsunit/regress/regress-327247469.js
+++ b/deps/v8/test/mjsunit/regress/regress-327247469.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 //
 // Flags: --allow-natives-syntax --turbofan --no-always-turbofan
-// Flags: --const-tracking-let --no-lazy-feedback-allocation
+// Flags: --script-context-cells --no-lazy-feedback-allocation
 
 let v15 = 0;
 const v22 = [];
diff --git a/deps/v8/test/mjsunit/regress/regress-378229888.js b/deps/v8/test/mjsunit/regress/regress-378229888.js
new file mode 100644
index 00000000000000..2e52d4c5ff80e6
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-378229888.js
@@ -0,0 +1,25 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f1(a2) {
+    const v4 = Infinity ? "23446" : Infinity;
+    let v5 = 0;
+    v5++;
+    const v9 = Math.min(v4, !v5);
+    let v10 = 0;
+    v10--;
+    let v12 = v9 % v10;
+    if (a2) {
+        v12 = 1.3;
+    }
+    const v16 = v12 ? 1 : 0;
+    v16 / v16;
+    return f1;
+}
+%PrepareFunctionForOptimization(f1);
+f1();
+%OptimizeFunctionOnNextCall(f1);
+f1();
diff --git a/deps/v8/test/mjsunit/regress/regress-408240561.js b/deps/v8/test/mjsunit/regress/regress-408240561.js
new file mode 100644
index 00000000000000..e138b797e0ffa0
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-408240561.js
@@ -0,0 +1,10 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const obj = {
+    [Symbol.replace]() {},
+    a: '\u{D83D}\u{DE0A}'
+};
+const arr = [obj, obj];
+assertEquals('[{"a":"😊"},{"a":"😊"}]', JSON.stringify(arr));
diff --git a/deps/v8/test/mjsunit/regress/regress-410809965.js b/deps/v8/test/mjsunit/regress/regress-410809965.js
new file mode 100644
index 00000000000000..74d63b66db91c1
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-410809965.js
@@ -0,0 +1,22 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+function __f_1(__v_9) {
+    %PrepareFunctionForOptimization(__v_9);
+    __v_9();
+    %OptimizeFunctionOnNextCall(__v_9);
+ __v_9();
+}
+function __f_6() {
+  try {
+    return Math.max(Math.__v_16 |  1010);
+  } catch (e) {}
+}
+function __f_7() {
+  return __f_6() * -127;
+}
+__f_1(__f_7, -254);
diff --git a/deps/v8/test/mjsunit/regress/regress-410809966.js b/deps/v8/test/mjsunit/regress/regress-410809966.js
new file mode 100644
index 00000000000000..e3feffb64ae0e6
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-410809966.js
@@ -0,0 +1,16 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+var __v_6 = "gaga";
+function __f_3() {
+  let __v_8 = Math.min(Infinity ? __v_6 : 0) / 0;
+  return __v_8 ? 1 : 0;
+}
+%PrepareFunctionForOptimization(__f_3);
+__f_3();
+%OptimizeFunctionOnNextCall(__f_3);
+__f_3();
diff --git a/deps/v8/test/mjsunit/regress/regress-410811025.js b/deps/v8/test/mjsunit/regress/regress-410811025.js
new file mode 100644
index 00000000000000..ec0761eeaf39f9
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-410811025.js
@@ -0,0 +1,21 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+(function () {
+  async function __f_13() {
+      for (let __v_24 = 0; __v_24 < 4; __v_24++) {
+        __v_24.__lookupGetter__();
+        for (let __v_26 = 0; __v_26 == 6; __v_26++) {
+          await 7;
+        }
+      }
+  }
+  %PrepareFunctionForOptimization(__f_13);
+  __f_13();
+  %OptimizeFunctionOnNextCall(__f_13);
+  __f_13();
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-410842388.js b/deps/v8/test/mjsunit/regress/regress-410842388.js
new file mode 100644
index 00000000000000..0365cd610540a6
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-410842388.js
@@ -0,0 +1,21 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+
+function __wrapTC(f) {
+    return f();
+}
+function __f_0() {
+  try {
+    const __v_4 = Array();
+      __v_4.reduceRight(__f_0);
+  } catch (e) {}
+}
+const __v_0 = __wrapTC(() => __f_0());
+%PrepareFunctionForOptimization(__f_0);
+const __v_1 = __wrapTC(() => new __f_0);
+%OptimizeFunctionOnNextCall(__f_0);
+__f_0();
diff --git a/deps/v8/test/mjsunit/regress/regress-410842391.js b/deps/v8/test/mjsunit/regress/regress-410842391.js
new file mode 100644
index 00000000000000..84fd3bbee97674
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-410842391.js
@@ -0,0 +1,17 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let obj1 = {
+  foo: [],
+  bar: 1
+};
+let obj2 = {
+  foo: [{}],
+  bar: 2
+};
+assertEquals('{"foo":[],"bar":1}', JSON.stringify(obj1));
+assertEquals('{"foo":[{}],"bar":2}', JSON.stringify(obj2));
+Object.defineProperty(obj2, undefined, { get: function () {}});
+assertEquals('{"foo":[],"bar":1}', JSON.stringify(obj1));
+assertEquals('{"foo":[{}],"bar":2}', JSON.stringify(obj2));
diff --git a/deps/v8/test/mjsunit/regress/regress-410979284.js b/deps/v8/test/mjsunit/regress/regress-410979284.js
new file mode 100644
index 00000000000000..0b20785ee1543d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-410979284.js
@@ -0,0 +1,9 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let smiley = '\u{D83D}\u{DE0A}';
+let obj1 = {[smiley]: undefined};
+let obj2 = {[smiley]: {}};
+assertEquals('{}', JSON.stringify(obj1));
+assertEquals(`{"${smiley}":{}}`, JSON.stringify(obj2));
diff --git a/deps/v8/test/mjsunit/regress/regress-799813.js b/deps/v8/test/mjsunit/regress/regress-799813.js
index e965ede5bbbf73..5b5b2d4878aedc 100644
--- a/deps/v8/test/mjsunit/regress/regress-799813.js
+++ b/deps/v8/test/mjsunit/regress/regress-799813.js
@@ -9,8 +9,9 @@ function testAdvanceLastIndex(initial_last_index_value,
   let final_last_index_value;
 
   var customRegexp = {
-    get global() { return true; },
-    get unicode() { return true; },
+    get flags() {
+      return 'gu'
+    },
     get lastIndex() {
       return initial_last_index_value;
     },
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-369652650.js b/deps/v8/test/mjsunit/regress/wasm/regress-369652650.js
index aff447ea08df0d..25d5f67e4b8195 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-369652650.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-369652650.js
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 // Flags: --fuzzing --allow-natives-syntax --wasm-staging
+// Flags: --wasm-allow-mixed-eh-for-testing
 
 const generated_module = %WasmGenerateRandomModule();
 if (typeof WebAssembly == "object") {
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-372261626.js b/deps/v8/test/mjsunit/regress/wasm/regress-372261626.js
index 0b5e1222794f1d..353093b355f29d 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-372261626.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-372261626.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --wasm-staging
+// Flags: --wasm-staging --wasm-allow-mixed-eh-for-testing
 
 d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
 
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-382816108.js b/deps/v8/test/mjsunit/regress/wasm/regress-382816108.js
index cec6a144c65f01..41c406aed3d7ae 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-382816108.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-382816108.js
@@ -3,5 +3,6 @@
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax --wasm-max-module-size=1 --fuzzing
+// Flags: --wasm-allow-mixed-eh-for-testing
 
 %WasmGenerateRandomModule();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-384565015.js b/deps/v8/test/mjsunit/regress/wasm/regress-384565015.js
new file mode 100644
index 00000000000000..36a0afc043069d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-384565015.js
@@ -0,0 +1,21 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
+
+let builder = new WasmModuleBuilder();
+let params = [];
+let size = 139;
+for (let i = 0; i < size; i++) {
+  params.push(kWasmI64);
+}
+let fn = builder.addFunction("callee", makeSig(params, [])).addBody([]);
+let body = [];
+for (let i = 0; i < size; i++) {
+  body.push(kExprI64Const, i);
+  body.push(kExprI64Const, i);
+}
+body.push(kExprReturnCall, fn.index);
+builder.addFunction("main", kSig_v_v).exportFunc().addBody(body);
+builder.instantiate().exports.main();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-388934347-a.js b/deps/v8/test/mjsunit/regress/wasm/regress-388934347-a.js
index 3b8829f7c00a49..52a607691c143c 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-388934347-a.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-388934347-a.js
@@ -7,6 +7,7 @@
 // compiles with TurboFan, which eventually triggers caching. This was missing
 // support for --single-threaded.
 // Flags: --no-enable-ssse3 --no-wasm-lazy-compilation --single-threaded
+// Flags: --wasm-allow-mixed-eh-for-testing
 
 for (let i = 0; i < 100; i++) {
   %WasmGenerateRandomModule();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-407298298.js b/deps/v8/test/mjsunit/regress/wasm/regress-407298298.js
new file mode 100644
index 00000000000000..9ba8ac0a0c1f52
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-407298298.js
@@ -0,0 +1,31 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-liftoff --experimental-wasm-jspi
+
+d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
+
+let kSig_d_r = makeSig([kWasmExternRef], [kWasmF64]);
+
+let kImports = {
+  DataView: {
+    byteLengthImport: Function.prototype.call.bind(
+        Object.getOwnPropertyDescriptor(DataView.prototype, 'byteLength').get)
+  },
+};
+
+let builder = new WasmModuleBuilder();
+let kDataViewByteLength =
+    builder.addImport('DataView', 'byteLengthImport', kSig_d_r);
+builder.addFunction('byteLength', kSig_d_r).exportFunc().addBody([
+  kExprLocalGet, 0,
+  kExprCallFunction, kDataViewByteLength,
+]);
+let instance = builder.instantiate(kImports);
+const kLength = 8;
+let buffer = new SharedArrayBuffer(kLength, {maxByteLength: 2 * kLength});
+let dataview = new DataView(buffer);
+assertPromiseResult(
+    WebAssembly.promising(instance.exports.byteLength)(dataview),
+    v => assertEquals(v, kLength));
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-407797300.js b/deps/v8/test/mjsunit/regress/wasm/regress-407797300.js
new file mode 100644
index 00000000000000..fe183d48751518
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-407797300.js
@@ -0,0 +1,28 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-jspi --allow-natives-syntax
+
+d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
+
+let kSig_i_rr = makeSig([kWasmExternRef, kWasmExternRef], [kWasmI32]);
+
+let builder = new WasmModuleBuilder();
+let string_equals = builder.addImport('wasm:js-string', 'equals', kSig_i_rr);
+
+builder.addFunction("eq", kSig_i_rr)
+  .exportFunc()
+  .addBody([
+    kExprLocalGet, 0,
+    kExprLocalGet, 1,
+    kExprCallFunction, string_equals,
+  ]);
+
+let instance = builder.instantiate({}, { builtins: ["js-string"] });
+
+assertPromiseResult(
+    WebAssembly.promising(instance.exports.eq)(
+    %ConstructConsString('abcdefghijklm', 'abcdefghijkl'),
+    %ConstructConsString('abcdefghijklm', 'abcdefghijkl')),
+    v => assertEquals(v, 1));
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-408254017.js b/deps/v8/test/mjsunit/regress/wasm/regress-408254017.js
new file mode 100644
index 00000000000000..313189d5c27d4c
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-408254017.js
@@ -0,0 +1,26 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-jspi
+// Flags: --stress-wasm-stack-switching
+
+d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
+
+let builder = new WasmModuleBuilder();
+builder.addMemory(0);
+import_index = builder.addImport('m', 'suspending', kSig_v_v);
+builder.addFunction("test", kSig_v_v).addBody([
+    kExprCallFunction, import_index
+]).exportFunc();
+builder.addFunction("grow", kSig_i_v).addBody([
+    ...wasmI32Const(40000), kExprMemoryGrow, kMemoryZero
+]).exportFunc();
+let suspending = new WebAssembly.Suspending(() => Promise.resolve());
+
+let instance = builder.instantiate({m: { suspending } });
+try {
+  instance.exports.test();
+} catch (e) {
+}
+instance.exports.grow();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-410295354.js b/deps/v8/test/mjsunit/regress/wasm/regress-410295354.js
new file mode 100644
index 00000000000000..30334126c55e11
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-410295354.js
@@ -0,0 +1,16 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-wasm-generic-wrapper
+
+d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
+
+let sig = makeSig([], [kWasmExnRef]);
+let builder = new WasmModuleBuilder();
+builder.addImport('q', 'f', sig);
+builder.addTable(kWasmAnyFunc, 1, 2);
+builder.addActiveElementSegment(0, [kExprI32Const, 0], [0]);
+builder.addExportOfKind('table', kExternalTable);
+let instance = builder.instantiate({q: {f: () => {}}});
+instance.exports.table.grow(1);
diff --git a/deps/v8/test/mjsunit/sandbox/regress/regress-412741811.js b/deps/v8/test/mjsunit/sandbox/regress/regress-412741811.js
new file mode 100644
index 00000000000000..8e2ef0ac8dff51
--- /dev/null
+++ b/deps/v8/test/mjsunit/sandbox/regress/regress-412741811.js
@@ -0,0 +1,64 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --sandbox-testing --expose-gc
+
+const kJSArrayType = Sandbox.getInstanceTypeIdFor("JS_ARRAY_TYPE");
+const kJSArrayLengthOffset = Sandbox.getFieldOffset(kJSArrayType, "length");
+
+// Helper function that spawns a worker thread that corrupts memory in the
+// background, constantly flipping the given address between valueA and valueB.
+function corruptInBackground(address, valueA, valueB) {
+  function workerTemplate(address, valueA, valueB) {
+    let memory = new DataView(new Sandbox.MemoryView(0, 0x100000000));
+    while (true) {
+      memory.setUint32(address, valueA, true);
+      memory.setUint32(address, valueB, true);
+    }
+  }
+  const workerCode = new Function(
+      `(${workerTemplate})(${address}, ${valueA}, ${valueB})`);
+  return new Worker(workerCode, {type: 'function'});
+}
+
+let memory = new DataView(new Sandbox.MemoryView(0, 0x100000000));
+
+// Create two JSArrays: the targetArray is the one we'll corrupt while the
+// templateArray is used to restore the targetArray to its original state
+// after every attempt.
+let templateArray = [0.0, 1.1, 2.2];
+let targetArray = [3.3, 4.4, 5.5];
+
+// Move objects to a stable location.
+gc();
+gc();
+
+let templateArrayAddress = Sandbox.getAddressOf(templateArray);
+let targetArrayAddress = Sandbox.getAddressOf(targetArray);
+let arraySize = Sandbox.getSizeOf(targetArray);
+assertEquals(arraySize, Sandbox.getSizeOf(templateArray));
+
+// Corrupt the length of the JSArray in a worker thread.
+let address = targetArrayAddress + kJSArrayLengthOffset;
+let valueA = memory.getUint32(address, true);
+let valueB = 0x10000 << 1;  // Should be a Smi
+let worker = corruptInBackground(address, valueA, valueB);
+
+// Wait for worker to start working.
+while (memory.getUint32(address, true) == valueA) { }
+
+// Try to push an object. We will then first try a fast path, then bail to a
+// slower path to transition the array. Even with the corrupted objects, we
+// must not get confused about how many remaining arguments we need to process,
+// so this should either succeed or crash safely.
+for (let i = 0; i < 1000; i++) {
+  // Restore the target array based on the template array before every attempt.
+  for (let fieldOffset = 0; fieldOffset < arraySize; fieldOffset += 4) {
+    let fieldValue = memory.getUint32(templateArrayAddress + fieldOffset, true);
+    memory.setUint32(targetArrayAddress + fieldOffset, fieldValue, true);
+  }
+
+  // Push some double values first to increase the race window.
+  targetArray.push(1.1, 2.2, 3.3, 4.4, 5.5, 6.6, 7.7, 8.8, 9.9, {});
+}
diff --git a/deps/v8/test/mjsunit/shared-memory/regress-crbug-408836779.js b/deps/v8/test/mjsunit/shared-memory/regress-crbug-408836779.js
new file mode 100644
index 00000000000000..9f8d9a2946f8ba
--- /dev/null
+++ b/deps/v8/test/mjsunit/shared-memory/regress-crbug-408836779.js
@@ -0,0 +1,16 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --minor-ms --shared-heap
+
+function f() {
+  var x = new Uint32Array();
+  try {
+    f();
+  } catch {}
+}
+for (var i = 0; i < 10; i++) {
+  new Worker(f, {type: 'function'});
+  gc();
+}
diff --git a/deps/v8/test/mjsunit/store_mutable_heap_slot_context_specialized.js b/deps/v8/test/mjsunit/store_mutable_heap_slot_context_specialized.js
index d917941b5c7ee7..fcf3c34b32bf45 100644
--- a/deps/v8/test/mjsunit/store_mutable_heap_slot_context_specialized.js
+++ b/deps/v8/test/mjsunit/store_mutable_heap_slot_context_specialized.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 //
 // Flags: --allow-natives-syntax --turbofan --no-always-turbofan
-// Flags: --script-context-mutable-heap-number
+// Flags: --script-context-cells
 
 let x = 42;
 
diff --git a/deps/v8/test/mjsunit/testcfg.py b/deps/v8/test/mjsunit/testcfg.py
index aadb4fc2c58790..9fd07864e4d66b 100644
--- a/deps/v8/test/mjsunit/testcfg.py
+++ b/deps/v8/test/mjsunit/testcfg.py
@@ -84,7 +84,7 @@ def __init__(self, *args, **kwargs):
     source = self.get_source()
 
     files_list = []  # List of file names to append to command arguments.
-    files_match = FILES_PATTERN.search(source);
+    files_match = FILES_PATTERN.search(source)
     # Accept several lines of 'Files:'.
     while True:
       if files_match:
diff --git a/deps/v8/test/mjsunit/tools/tickprocessor-test-large.log b/deps/v8/test/mjsunit/tools/tickprocessor-test-large.log
index af26edf5ab7737..4e545af589b418 100644
--- a/deps/v8/test/mjsunit/tools/tickprocessor-test-large.log
+++ b/deps/v8/test/mjsunit/tools/tickprocessor-test-large.log
@@ -384,7 +384,7 @@ code-creation,Builtin,2,8575,0x557426364b20,24,KeyedStoreICBaseline
 code-creation,Builtin,2,8588,0x557426364b40,500,StoreInArrayLiteralIC
 code-creation,Builtin,2,8600,0x557426364d40,24,StoreInArrayLiteralICBaseline
 code-creation,Builtin,2,8613,0x557426364d60,152,LookupContextBaseline
-code-creation,Builtin,2,8626,0x557426364e00,152,LookupContextInsideTypeofBaseline
+code-creation,Builtin,2,8626,0x557426364e00,152,LookupContextNoCellInsideTypeofBaseline
 code-creation,Builtin,2,8639,0x557426364ea0,2768,LoadGlobalIC
 code-creation,Builtin,2,8651,0x557426365980,2748,LoadGlobalICInsideTypeof
 code-creation,Builtin,2,8665,0x557426366440,48,LoadGlobalICTrampoline
@@ -1256,12 +1256,12 @@ code-creation,BytecodeHandler,0,17563,0x557426410c60,3760,LdaGlobalInsideTypeof
 code-creation,BytecodeHandler,0,17572,0x557426411b20,180,StaGlobal
 code-creation,BytecodeHandler,0,17581,0x557426411be0,40,PushContext
 code-creation,BytecodeHandler,0,17593,0x557426411c20,36,PopContext
-code-creation,BytecodeHandler,0,17611,0x557426411c60,140,LdaContextSlot
+code-creation,BytecodeHandler,0,17611,0x557426411c60,140,LdaContextSlotNoCell
 code-creation,BytecodeHandler,0,17621,0x557426411d00,140,LdaImmutableContextSlot
-code-creation,BytecodeHandler,0,17630,0x557426411da0,92,LdaCurrentContextSlot
+code-creation,BytecodeHandler,0,17630,0x557426411da0,92,LdaCurrentContextSlotNoCell
 code-creation,BytecodeHandler,0,17639,0x557426411e00,92,LdaImmutableCurrentContextSlot
-code-creation,BytecodeHandler,0,17649,0x557426411e60,176,StaContextSlot
-code-creation,BytecodeHandler,0,17669,0x557426411f20,128,StaCurrentContextSlot
+code-creation,BytecodeHandler,0,17649,0x557426411e60,176,StaContextSlotNoCell
+code-creation,BytecodeHandler,0,17669,0x557426411f20,128,StaCurrentContextSlotNoCell
 code-creation,BytecodeHandler,0,17678,0x557426411fc0,124,LdaLookupSlot
 code-creation,BytecodeHandler,0,17687,0x557426412040,260,LdaLookupContextSlot
 code-creation,BytecodeHandler,0,17697,0x557426412160,3960,LdaLookupGlobalSlot
@@ -1430,12 +1430,12 @@ code-creation,BytecodeHandler,0,19208,0x557426426520,3800,LdaGlobalInsideTypeof.
 code-creation,BytecodeHandler,0,19218,0x557426427400,180,StaGlobal.Wide
 code-creation,BytecodeHandler,0,19227,0x5574264274c0,40,PushContext.Wide
 code-creation,BytecodeHandler,0,19236,0x557426427500,36,PopContext.Wide
-code-creation,BytecodeHandler,0,19245,0x557426427540,100,LdaContextSlot.Wide
+code-creation,BytecodeHandler,0,19245,0x557426427540,100,LdaContextSlotNoCell.Wide
 code-creation,BytecodeHandler,0,19255,0x5574264275c0,100,LdaImmutableContextSlot.Wide
-code-creation,BytecodeHandler,0,19264,0x557426427640,52,LdaCurrentContextSlot.Wide
+code-creation,BytecodeHandler,0,19264,0x557426427640,52,LdaCurrentContextSlotNoCell.Wide
 code-creation,BytecodeHandler,0,19274,0x557426427680,52,LdaImmutableCurrentContextSlot.Wide
-code-creation,BytecodeHandler,0,19284,0x5574264276c0,176,StaContextSlot.Wide
-code-creation,BytecodeHandler,0,19293,0x557426427780,128,StaCurrentContextSlot.Wide
+code-creation,BytecodeHandler,0,19284,0x5574264276c0,176,StaContextSlotNoCell.Wide
+code-creation,BytecodeHandler,0,19293,0x557426427780,128,StaCurrentContextSlotNoCell.Wide
 code-creation,BytecodeHandler,0,19303,0x557426427820,128,LdaLookupSlot.Wide
 code-creation,BytecodeHandler,0,19312,0x5574264278c0,260,LdaLookupContextSlot.Wide
 code-creation,BytecodeHandler,0,19322,0x5574264279e0,4000,LdaLookupGlobalSlot.Wide
@@ -1582,12 +1582,12 @@ code-creation,BytecodeHandler,0,20657,0x55742643a760,3788,LdaGlobalInsideTypeof.
 code-creation,BytecodeHandler,0,20667,0x55742643b640,180,StaGlobal.ExtraWide
 code-creation,BytecodeHandler,0,20676,0x55742643b700,36,PushContext.ExtraWide
 code-creation,BytecodeHandler,0,20685,0x55742643b740,32,PopContext.ExtraWide
-code-creation,BytecodeHandler,0,20698,0x55742643b780,96,LdaContextSlot.ExtraWide
+code-creation,BytecodeHandler,0,20698,0x55742643b780,96,LdaContextSlotNoCell.ExtraWide
 code-creation,BytecodeHandler,0,20707,0x55742643b800,96,LdaImmutableContextSlot.ExtraWide
-code-creation,BytecodeHandler,0,20717,0x55742643b880,52,LdaCurrentContextSlot.ExtraWide
+code-creation,BytecodeHandler,0,20717,0x55742643b880,52,LdaCurrentContextSlotNoCell.ExtraWide
 code-creation,BytecodeHandler,0,20727,0x55742643b8c0,52,LdaImmutableCurrentContextSlot.ExtraWide
-code-creation,BytecodeHandler,0,20737,0x55742643b900,172,StaContextSlot.ExtraWide
-code-creation,BytecodeHandler,0,20747,0x55742643b9c0,128,StaCurrentContextSlot.ExtraWide
+code-creation,BytecodeHandler,0,20737,0x55742643b900,172,StaContextSlotNoCell.ExtraWide
+code-creation,BytecodeHandler,0,20747,0x55742643b9c0,128,StaCurrentContextSlotNoCell.ExtraWide
 code-creation,BytecodeHandler,0,20757,0x55742643ba60,128,LdaLookupSlot.ExtraWide
 code-creation,BytecodeHandler,0,20766,0x55742643bb00,260,LdaLookupContextSlot.ExtraWide
 code-creation,BytecodeHandler,0,20776,0x55742643bc20,3988,LdaLookupGlobalSlot.ExtraWide
diff --git a/deps/v8/test/mjsunit/turbolev/constant-typed-array-load-deopt-detach.js b/deps/v8/test/mjsunit/turbolev/constant-typed-array-load-deopt-detach.js
new file mode 100644
index 00000000000000..1cdd04f26428aa
--- /dev/null
+++ b/deps/v8/test/mjsunit/turbolev/constant-typed-array-load-deopt-detach.js
@@ -0,0 +1,36 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbofan --turbolev --no-always-turbofan
+
+const ab = new ArrayBuffer(100);
+var constTypedArray = new Uint16Array(ab);
+
+function fillTypedArray() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    constTypedArray[i] = i;
+  }
+}
+%NeverOptimizeFunction(fillTypedArray);
+
+fillTypedArray();
+
+function foo(i) {
+  return constTypedArray[i];
+}
+%PrepareFunctionForOptimization(foo);
+
+assertEquals(3, foo(3));
+assertEquals(10, foo(10));
+
+%OptimizeFunctionOnNextCall(foo);
+
+assertEquals(3, foo(3));
+assertEquals(10, foo(10));
+
+assertOptimized(foo);
+
+// Detaching the buffer deopts.
+%ArrayBufferDetach(ab);
+assertUnoptimized(foo);
diff --git a/deps/v8/test/mjsunit/turbolev/constant-typed-array-load-deopt-oob.js b/deps/v8/test/mjsunit/turbolev/constant-typed-array-load-deopt-oob.js
new file mode 100644
index 00000000000000..837531eb8409ec
--- /dev/null
+++ b/deps/v8/test/mjsunit/turbolev/constant-typed-array-load-deopt-oob.js
@@ -0,0 +1,36 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbofan --turbolev --no-always-turbofan
+
+const ab = new ArrayBuffer(100);
+var constTypedArray = new Uint16Array(ab);
+
+function fillTypedArray() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    constTypedArray[i] = i;
+  }
+}
+%NeverOptimizeFunction(fillTypedArray);
+
+fillTypedArray();
+
+function foo(i) {
+  return constTypedArray[i];
+}
+%PrepareFunctionForOptimization(foo);
+
+assertEquals(3, foo(3));
+assertEquals(10, foo(10));
+
+%OptimizeFunctionOnNextCall(foo);
+
+assertEquals(3, foo(3));
+assertEquals(10, foo(10));
+
+assertOptimized(foo);
+
+// Going out of bounds deopts.
+assertEquals(undefined, foo(1000));
+assertUnoptimized(foo);
diff --git a/deps/v8/test/mjsunit/turbolev/constant-typed-array-load-double.js b/deps/v8/test/mjsunit/turbolev/constant-typed-array-load-double.js
new file mode 100644
index 00000000000000..17dcd3415b1b16
--- /dev/null
+++ b/deps/v8/test/mjsunit/turbolev/constant-typed-array-load-double.js
@@ -0,0 +1,37 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbofan --turbolev --no-always-turbofan
+
+const ab = new ArrayBuffer(100);
+var constTypedArray = new Float32Array(ab);
+
+function fillTypedArray() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    constTypedArray[i] = i + 0.5;
+  }
+}
+%NeverOptimizeFunction(fillTypedArray);
+
+fillTypedArray();
+
+function foo(i) {
+  return constTypedArray[i];
+}
+%PrepareFunctionForOptimization(foo);
+
+assertEquals(3.5, foo(3));
+assertEquals(10.5, foo(10));
+
+%OptimizeFunctionOnNextCall(foo);
+
+function test() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    assertEquals(i + 0.5, foo(i));
+  }
+}
+%NeverOptimizeFunction(test);
+test();
+
+assertOptimized(foo);
diff --git a/deps/v8/test/mjsunit/turbolev/constant-typed-array-load-no-rab-gsab.js b/deps/v8/test/mjsunit/turbolev/constant-typed-array-load-no-rab-gsab.js
new file mode 100644
index 00000000000000..0eea9b64bc2956
--- /dev/null
+++ b/deps/v8/test/mjsunit/turbolev/constant-typed-array-load-no-rab-gsab.js
@@ -0,0 +1,44 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbofan --turbolev --no-always-turbofan
+
+const ab = new ArrayBuffer(100, {maxByteLength: 300});
+var constTypedArray = new Uint16Array(ab);
+
+function fillTypedArray() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    constTypedArray[i] = i;
+  }
+}
+%NeverOptimizeFunction(fillTypedArray);
+
+fillTypedArray();
+
+function foo(i) {
+  return constTypedArray[i];
+}
+%PrepareFunctionForOptimization(foo);
+
+assertEquals(3, foo(3));
+assertEquals(10, foo(10));
+
+%OptimizeFunctionOnNextCall(foo);
+
+assertEquals(3, foo(3));
+assertEquals(10, foo(10));
+
+assertOptimized(foo);
+
+// We don't optimize loading from the constant typed array, so we then also
+// don't deopt if we read out of bounds, the array buffer is detached, etc.
+assertEquals(undefined, foo(1000));
+assertOptimized(foo);
+
+ab.resize(50);
+assertEquals(undefined, foo(30));
+assertOptimized(foo);
+
+%ArrayBufferDetach(ab);
+assertOptimized(foo);
diff --git a/deps/v8/test/mjsunit/turbolev/constant-typed-array-load-signed.js b/deps/v8/test/mjsunit/turbolev/constant-typed-array-load-signed.js
new file mode 100644
index 00000000000000..cfcf73737b811a
--- /dev/null
+++ b/deps/v8/test/mjsunit/turbolev/constant-typed-array-load-signed.js
@@ -0,0 +1,37 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbofan --turbolev --no-always-turbofan
+
+const ab = new ArrayBuffer(100);
+var constTypedArray = new Int16Array(ab);
+
+function fillTypedArray() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    constTypedArray[i] = i;
+  }
+}
+%NeverOptimizeFunction(fillTypedArray);
+
+fillTypedArray();
+
+function foo(i) {
+  return constTypedArray[i];
+}
+%PrepareFunctionForOptimization(foo);
+
+assertEquals(3, foo(3));
+assertEquals(10, foo(10));
+
+%OptimizeFunctionOnNextCall(foo);
+
+function test() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    assertEquals(i, foo(i));
+  }
+}
+%NeverOptimizeFunction(test);
+test();
+
+assertOptimized(foo);
diff --git a/deps/v8/test/mjsunit/turbolev/constant-typed-array-load-unsigned.js b/deps/v8/test/mjsunit/turbolev/constant-typed-array-load-unsigned.js
new file mode 100644
index 00000000000000..0c4f6d428de3d2
--- /dev/null
+++ b/deps/v8/test/mjsunit/turbolev/constant-typed-array-load-unsigned.js
@@ -0,0 +1,37 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbofan --turbolev --no-always-turbofan
+
+const ab = new ArrayBuffer(100);
+var constTypedArray = new Uint16Array(ab);
+
+function fillTypedArray() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    constTypedArray[i] = i;
+  }
+}
+%NeverOptimizeFunction(fillTypedArray);
+
+fillTypedArray();
+
+function foo(i) {
+  return constTypedArray[i];
+}
+%PrepareFunctionForOptimization(foo);
+
+assertEquals(3, foo(3));
+assertEquals(10, foo(10));
+
+%OptimizeFunctionOnNextCall(foo);
+
+function test() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    assertEquals(i, foo(i));
+  }
+}
+%NeverOptimizeFunction(test);
+test();
+
+assertOptimized(foo);
diff --git a/deps/v8/test/mjsunit/turbolev/constant-typed-array-store-deopt-detach.js b/deps/v8/test/mjsunit/turbolev/constant-typed-array-store-deopt-detach.js
new file mode 100644
index 00000000000000..da7350e2ffeb0e
--- /dev/null
+++ b/deps/v8/test/mjsunit/turbolev/constant-typed-array-store-deopt-detach.js
@@ -0,0 +1,36 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbofan --turbolev --no-always-turbofan
+
+const ab = new ArrayBuffer(100);
+var constTypedArray = new Uint16Array(ab);
+
+function readTypedArray() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    assertEquals(i, constTypedArray[i]);
+  }
+}
+%NeverOptimizeFunction(readTypedArray);
+
+function foo(i, v) {
+  constTypedArray[i] = v;
+}
+
+%PrepareFunctionForOptimization(foo);
+foo(3, 4);
+foo(10, 20);
+
+assertEquals(4, constTypedArray[3]);
+assertEquals(20, constTypedArray[10]);
+%OptimizeFunctionOnNextCall(foo);
+
+foo(13, 14);
+
+assertOptimized(foo);
+assertEquals(14, constTypedArray[13]);
+
+// Detaching the buffer deopts.
+%ArrayBufferDetach(ab);
+assertUnoptimized(foo);
diff --git a/deps/v8/test/mjsunit/turbolev/constant-typed-array-store-deopt-oob.js b/deps/v8/test/mjsunit/turbolev/constant-typed-array-store-deopt-oob.js
new file mode 100644
index 00000000000000..e5a00923dfb693
--- /dev/null
+++ b/deps/v8/test/mjsunit/turbolev/constant-typed-array-store-deopt-oob.js
@@ -0,0 +1,36 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbofan --turbolev --no-always-turbofan
+
+const ab = new ArrayBuffer(100);
+var constTypedArray = new Uint16Array(ab);
+
+function readTypedArray() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    assertEquals(i, constTypedArray[i]);
+  }
+}
+%NeverOptimizeFunction(readTypedArray);
+
+function foo(i, v) {
+  constTypedArray[i] = v;
+}
+
+%PrepareFunctionForOptimization(foo);
+foo(3, 4);
+foo(10, 20);
+
+assertEquals(4, constTypedArray[3]);
+assertEquals(20, constTypedArray[10]);
+%OptimizeFunctionOnNextCall(foo);
+
+foo(13, 14);
+
+assertOptimized(foo);
+assertEquals(14, constTypedArray[13]);
+
+// Going out of bounds deopts.
+foo(1000, 0);
+assertUnoptimized(foo);
diff --git a/deps/v8/test/mjsunit/turbolev/constant-typed-array-store-double.js b/deps/v8/test/mjsunit/turbolev/constant-typed-array-store-double.js
new file mode 100644
index 00000000000000..f414c89f14f41f
--- /dev/null
+++ b/deps/v8/test/mjsunit/turbolev/constant-typed-array-store-double.js
@@ -0,0 +1,39 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbofan --turbolev --no-always-turbofan
+
+const ab = new ArrayBuffer(100);
+var constTypedArray = new Float32Array(ab);
+
+function readTypedArray() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    assertEquals(i + 0.5, constTypedArray[i]);
+  }
+}
+%NeverOptimizeFunction(readTypedArray);
+
+function foo(i, v) {
+  constTypedArray[i] = v;
+}
+
+%PrepareFunctionForOptimization(foo);
+foo(3, 4.5);
+foo(10, 20.5);
+
+assertEquals(4.5, constTypedArray[3]);
+assertEquals(20.5, constTypedArray[10]);
+
+%OptimizeFunctionOnNextCall(foo);
+
+function test() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    foo(i, i + 0.5);
+  }
+  readTypedArray();
+}
+%NeverOptimizeFunction(test);
+test();
+
+assertOptimized(foo);
diff --git a/deps/v8/test/mjsunit/turbolev/constant-typed-array-store-int.js b/deps/v8/test/mjsunit/turbolev/constant-typed-array-store-int.js
new file mode 100644
index 00000000000000..b55babeadc8af3
--- /dev/null
+++ b/deps/v8/test/mjsunit/turbolev/constant-typed-array-store-int.js
@@ -0,0 +1,39 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbofan --turbolev --no-always-turbofan
+
+const ab = new ArrayBuffer(100);
+var constTypedArray = new Uint16Array(ab);
+
+function readTypedArray() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    assertEquals(i, constTypedArray[i]);
+  }
+}
+%NeverOptimizeFunction(readTypedArray);
+
+function foo(i, v) {
+  constTypedArray[i] = v;
+}
+
+%PrepareFunctionForOptimization(foo);
+foo(3, 4);
+foo(10, 20);
+
+assertEquals(4, constTypedArray[3]);
+assertEquals(20, constTypedArray[10]);
+
+%OptimizeFunctionOnNextCall(foo);
+
+function test() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    foo(i, i);
+  }
+  readTypedArray();
+}
+%NeverOptimizeFunction(test);
+test();
+
+assertOptimized(foo);
diff --git a/deps/v8/test/mjsunit/turbolev/constant-typed-array-store-no-rab-gsab.js b/deps/v8/test/mjsunit/turbolev/constant-typed-array-store-no-rab-gsab.js
new file mode 100644
index 00000000000000..e351ee6c6628dc
--- /dev/null
+++ b/deps/v8/test/mjsunit/turbolev/constant-typed-array-store-no-rab-gsab.js
@@ -0,0 +1,44 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbofan --turbolev --no-always-turbofan
+
+const ab = new ArrayBuffer(100, {maxByteLength: 300});
+var constTypedArray = new Uint16Array(ab);
+
+function readTypedArray() {
+  for (let i = 0; i < constTypedArray.length; ++i) {
+    assertEquals(i, constTypedArray[i]);
+  }
+}
+%NeverOptimizeFunction(readTypedArray);
+
+function foo(i, v) {
+  constTypedArray[i] = v;
+}
+
+%PrepareFunctionForOptimization(foo);
+foo(3, 4);
+foo(10, 20);
+
+assertEquals(4, constTypedArray[3]);
+assertEquals(20, constTypedArray[10]);
+%OptimizeFunctionOnNextCall(foo);
+
+foo(13, 14);
+
+assertOptimized(foo);
+assertEquals(14, constTypedArray[13]);
+
+// We don't optimize storing into the constant typed array, so we then also
+// don't deopt if we store out of bounds, the array buffer is detached, etc.
+foo(1000, 0);
+assertOptimized(foo);
+
+ab.resize(50);
+foo(30, 0);
+assertOptimized(foo);
+
+%ArrayBufferDetach(ab);
+assertOptimized(foo);
diff --git a/deps/v8/test/mjsunit/turbolev/regress-409351652.js b/deps/v8/test/mjsunit/turbolev/regress-409351652.js
new file mode 100644
index 00000000000000..0853515d9d454d
--- /dev/null
+++ b/deps/v8/test/mjsunit/turbolev/regress-409351652.js
@@ -0,0 +1,20 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbolev
+
+function test() {
+  function f4(a5) {
+    a5[11]; // Polymorphic: HOLEY_ELEMENTS + FLOAT64ELEMENTS
+  }
+  %PrepareFunctionForOptimization(f4);
+  f4(Int16Array); // Inlined here; Int16Array is just something which is not a TypedArray
+  const v12 = new Float64Array(16);
+  f4(v12);
+}
+%PrepareFunctionForOptimization(test);
+
+test();
+%OptimizeFunctionOnNextCall(test);
+test();
diff --git a/deps/v8/test/mjsunit/turbolev/regress-409354662.js b/deps/v8/test/mjsunit/turbolev/regress-409354662.js
new file mode 100644
index 00000000000000..0d0a7cbb821d58
--- /dev/null
+++ b/deps/v8/test/mjsunit/turbolev/regress-409354662.js
@@ -0,0 +1,22 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --turbolev
+
+const gsab = new SharedArrayBuffer(4, {maxByteLength: 8});
+const gsab_ta = new Uint16Array(gsab);
+const sab = new SharedArrayBuffer(4);
+function foo(ta) {
+    ta[1] = 0;
+}
+%PrepareFunctionForOptimization(foo);
+function test() {
+  const normal_ta = new Uint32Array(sab);
+  foo(normal_ta);
+  foo(gsab_ta);
+}
+%PrepareFunctionForOptimization(test);
+test();
+%OptimizeFunctionOnNextCall(test);
+test();
diff --git a/deps/v8/test/mjsunit/turbolev/regress-412741826.js b/deps/v8/test/mjsunit/turbolev/regress-412741826.js
new file mode 100644
index 00000000000000..a0eb98109700d2
--- /dev/null
+++ b/deps/v8/test/mjsunit/turbolev/regress-412741826.js
@@ -0,0 +1,14 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --turbolev
+
+const v2 = new Uint8ClampedArray(3345);
+function f4(a5) {
+  Object.defineProperty(Array(v2.length), 3, { configurable: true});
+}
+%PrepareFunctionForOptimization(f4);
+f4();
+ %OptimizeFunctionOnNextCall(f4);
+f4();
diff --git a/deps/v8/test/mjsunit/turboshaft/maglev-frontend/const-tracking-let.js b/deps/v8/test/mjsunit/turboshaft/maglev-frontend/const-tracking-let.js
index 3ebbbde2ee3e13..8ab84790599f43 100644
--- a/deps/v8/test/mjsunit/turboshaft/maglev-frontend/const-tracking-let.js
+++ b/deps/v8/test/mjsunit/turboshaft/maglev-frontend/const-tracking-let.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax --turbolev --turbofan
-// Flags: --no-always-turbofan --const-tracking-let
+// Flags: --no-always-turbofan --script-context-cells
 
 let glob_a = 0;
 let glob_b = 3.35;
diff --git a/deps/v8/test/mjsunit/turboshaft/maglev-frontend/regress-379207983.js b/deps/v8/test/mjsunit/turboshaft/maglev-frontend/regress-379207983.js
index 24aa194b7765ef..9abceded511f76 100644
--- a/deps/v8/test/mjsunit/turboshaft/maglev-frontend/regress-379207983.js
+++ b/deps/v8/test/mjsunit/turboshaft/maglev-frontend/regress-379207983.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
-// Flags: --allow-natives-syntax --script-context-mutable-heap-number
+// Flags: --allow-natives-syntax --script-context-cells
 // Flags: --no-always-turbofan --turbolev
 
 let v0 = 7;
diff --git a/deps/v8/test/mjsunit/turboshaft/maglev-frontend/script-context-smi-generator.js b/deps/v8/test/mjsunit/turboshaft/maglev-frontend/script-context-smi-generator.js
index 035612715a1d47..6872095900f05c 100644
--- a/deps/v8/test/mjsunit/turboshaft/maglev-frontend/script-context-smi-generator.js
+++ b/deps/v8/test/mjsunit/turboshaft/maglev-frontend/script-context-smi-generator.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
-// Flags: --allow-natives-syntax --script-context-mutable-heap-number
+// Flags: --allow-natives-syntax --script-context-cells
 
 let glob = 0;
 
diff --git a/deps/v8/test/mjsunit/turboshaft/maglev-frontend/typed-array-length-store-script-context.js b/deps/v8/test/mjsunit/turboshaft/maglev-frontend/typed-array-length-store-script-context.js
index f53abce6ec4526..cd877ee2913ae0 100644
--- a/deps/v8/test/mjsunit/turboshaft/maglev-frontend/typed-array-length-store-script-context.js
+++ b/deps/v8/test/mjsunit/turboshaft/maglev-frontend/typed-array-length-store-script-context.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 //
 // Flags: --allow-natives-syntax --turbolev --turbofan --no-always-turbofan
-// Flags: --typed-array-length-loading --script-context-mutable-heap-number
+// Flags: --typed-array-length-loading --script-context-cells
 
 let scriptContextSlot = 0;
 
diff --git a/deps/v8/test/mjsunit/wasm/compilation-hints-no-lazy.js b/deps/v8/test/mjsunit/wasm/compilation-hints-no-lazy.js
new file mode 100644
index 00000000000000..7a16f08488db25
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/compilation-hints-no-lazy.js
@@ -0,0 +1,27 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be found
+// in the LICENSE file.
+
+// Flags: --experimental-wasm-compilation-hints --no-wasm-lazy-compilation
+// Flags: --wasm-deopt --liftoff
+
+d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
+
+// This test case tests the combination of using eager compilation hints with
+// the --no-wasm-lazy-compilation flag. In this case the compilation hint set
+// the required_baseline_tier to Turbofan and the required_top_tier to Liftoff
+// which doesn't make a whole lot of sense.
+(function testDecodeCompilationHintsSectionTopTierDefault() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction('sq', kSig_i_i)
+         .addBody([kExprLocalGet, 0,
+                   kExprLocalGet, 0,
+                   kExprI32Mul])
+         .setCompilationHint(kCompilationHintStrategyEager,
+                             kCompilationHintTierOptimized,
+                             kCompilationHintTierDefault)
+         .exportFunc();
+  let instance = builder.instantiate();
+  assertEquals(9, instance.exports.sq(3))
+})();
diff --git a/deps/v8/test/mjsunit/wasm/custom-descriptors-validity.js b/deps/v8/test/mjsunit/wasm/custom-descriptors-validity.js
new file mode 100644
index 00000000000000..9b3118f2de666b
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/custom-descriptors-validity.js
@@ -0,0 +1,162 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-custom-descriptors --experimental-wasm-shared
+
+// At the time of writing, these tests cover the same cases as:
+// https://github.com/WebAssembly/binaryen/pull/7392/files
+
+d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
+
+function Build(...recgroups) {
+  let builder = new WasmModuleBuilder();
+  for (let r of recgroups) {
+    builder.startRecGroup();
+    r(builder);
+    builder.endRecGroup();
+  }
+  return builder;
+}
+
+function CheckValid(...recgroups) {
+  let builder = Build(...recgroups);
+  builder.instantiate();
+}
+
+function CheckInvalid(message, ...recgroups) {
+  let builder = Build(...recgroups);
+  assertThrows(() => builder.instantiate(), WebAssembly.CompileError, message);
+}
+
+CheckValid((builder) => {
+  builder.addStruct({descriptor: 1});
+  builder.addStruct({describes: 0});
+});
+
+CheckInvalid(/Type 0 has descriptor 1 but 1 doesn't describe 0/, (builder) => {
+  builder.addStruct({descriptor: 1});
+  builder.addStruct({});
+});
+
+CheckInvalid(/Type 1 describes 0 but 0 isn't a descriptor for 1/, (builder) => {
+  builder.addStruct({});
+  builder.addStruct({describes: 0});
+});
+
+CheckInvalid(/types can only describe previously-declared types/, (builder) => {
+  builder.addStruct({describes: 1});
+  builder.addStruct({descriptor: 0});
+});
+
+// Defining an array type with a descriptor is so utterly invalid that we
+// don't even have module builder support for it.
+assertThrows(() => {
+  let bytes = new Uint8Array([
+      0x00, 0x61, 0x73, 0x6d,  // wasm magic
+      0x01, 0x00, 0x00, 0x00,  // wasm version
+
+      0x01,                    // section kind: Type
+      0x10,                    // section length 16
+      0x01, 0x4e,              // types count 1: rec. group definition
+      0x02,                    // recursive group size 2
+      0x50, 0x00,              //  subtype extensible, supertype count 0
+      0x4d, 0x01,              //  described_by  $type1
+      0x5e, 0x78, 0x00,        //  kind: array i8 immutable
+      0x50, 0x00,              //  subtype extensible, supertype count 0
+      0x4c, 0x00,              //  describes  $type0
+      0x5f, 0x00,              //  kind: struct, field count 0
+                               // end of rec. group
+  ]);
+  new WebAssembly.Instance(new WebAssembly.Module(bytes));
+}, WebAssembly.CompileError, /'descriptor' may only be used with structs/);
+
+// Defining an array type as a descriptor is so utterly invalid that we
+// don't even have module builder support for it.
+assertThrows(() => {
+  let bytes = new Uint8Array([
+      0x00, 0x61, 0x73, 0x6d,  // wasm magic
+      0x01, 0x00, 0x00, 0x00,  // wasm version
+
+      0x01,                    // section kind: Type
+      0x10,                    // section length 16
+      0x01, 0x4e,              // types count 1: rec. group definition
+      0x02,                    // recursive group size 2
+      0x50, 0x00,              //  subtype extensible, supertype count 0
+      0x4d, 0x01,              //  described_by  $type1
+      0x5f, 0x00,              //  kind: struct, field count 0
+      0x50, 0x00,              //  subtype extensible, supertype count 0
+      0x4c, 0x00,              //  describes  $type0
+      0x5e, 0x78, 0x00,        //  kind: array i8 immutable
+                               // end of rec. group
+  ]);
+  new WebAssembly.Instance(new WebAssembly.Module(bytes));
+}, WebAssembly.CompileError, /'describes' may only be used with structs/);
+
+CheckValid((builder) => {
+  builder.addStruct({descriptor: 1, shared: true});
+  builder.addStruct({describes: 0, shared: true});
+});
+
+CheckInvalid(/Type 0 and its descriptor 1 must have same sharedness/,
+             (builder) => {
+  builder.addStruct({descriptor: 1, shared: true});
+  builder.addStruct({describes: 0});
+});
+
+// Shared descriptors of non-shared types could technically be allowed. TBD.
+CheckInvalid(/Type 0 and its descriptor 1 must have same sharedness/,
+             (builder) => {
+  builder.addStruct({descriptor: 1});
+  builder.addStruct({describes: 0, shared: true});
+});
+
+CheckValid((builder) => {
+  builder.addStruct({descriptor: 1, final: false});  // 0
+  builder.addStruct({describes: 0, final: false});   // 1
+}, (builder) => {
+  builder.addStruct({descriptor: 3, supertype: 0});  // 2
+  builder.addStruct({describes: 2, supertype: 1});   // 3
+});
+
+CheckValid((builder) => {
+  builder.addStruct({final: false});  // 0
+}, (builder) => {
+  builder.addStruct({descriptor: 2});  // 1
+  builder.addStruct({describes: 1});   // 2
+}, (builder) => {
+  builder.addStruct({descriptor: 4, supertype: 0});  // 3
+  builder.addStruct({describes: 3, supertype: 2});   // 4
+});
+
+CheckInvalid(/type 3 has invalid explicit supertype 1/, (builder) => {
+  builder.addStruct({final: false});  // 0
+  builder.addStruct({final: false});  // 1
+}, (builder) => {
+  builder.addStruct({supertype: 0, descriptor: 3});  // 2
+  builder.addStruct({supertype: 1, describes: 2});   // 3
+});
+
+CheckInvalid(/type 4 has invalid explicit supertype 2/, (builder) => {
+  builder.addStruct({descriptor: 1});  // 0
+  builder.addStruct({describes: 0});   // 1
+  builder.addStruct({descriptor: 3, final: false});  // 2
+  builder.addStruct({describes: 2, final: false});   // 3
+}, (builder) => {
+  builder.addStruct({supertype: 2, descriptor: 5});  // 4
+  builder.addStruct({supertype: 1, describes: 4});   // 5
+});
+
+CheckInvalid(/type 2 has invalid explicit supertype 0/, (builder) => {
+  builder.addStruct({descriptor: 1, final: false});  // 0
+  builder.addStruct({describes: 0});                 // 1
+}, (builder) => {
+  builder.addStruct({supertype: 0});  // 2
+});
+
+CheckInvalid(/type 2 has invalid explicit supertype 1/, (builder) => {
+  builder.addStruct({descriptor: 1});               // 0
+  builder.addStruct({describes: 0, final: false});  // 1
+}, (builder) => {
+  builder.addStruct({supertype: 1});  // 2
+});
diff --git a/deps/v8/test/mjsunit/wasm/custom-descriptors.js b/deps/v8/test/mjsunit/wasm/custom-descriptors.js
new file mode 100644
index 00000000000000..324dbb287f0fa1
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/custom-descriptors.js
@@ -0,0 +1,218 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-custom-descriptors
+
+d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
+
+(() => {
+  let bad_builder = new WasmModuleBuilder();
+  let $desc0 = bad_builder.nextTypeIndex() + 1;
+  let $s0 = bad_builder.addStruct({fields: [], descriptor: $desc0});
+  bad_builder.addStruct({fields: [], describes: $s0});
+  // The recgroup is missing.
+  assertThrows(() => bad_builder.instantiate(), WebAssembly.CompileError,
+               /descriptor type index 1 is out of bounds/);
+})();
+
+let builder = new WasmModuleBuilder();
+
+let i32_field = makeField(kWasmI32, true);
+let i64_field = makeField(kWasmI64, true);
+let sig_r_i = makeSig([kWasmI32], [kWasmAnyRef]);
+let sig_r_r = makeSig([kWasmAnyRef], [kWasmAnyRef]);
+let sig_v_r = makeSig([kWasmAnyRef], []);
+let sig_i_r = makeSig([kWasmAnyRef], [kWasmI32])
+let anyref = wasmRefNullType(kWasmAnyRef);
+
+builder.startRecGroup();
+const kNumStructs = 2;
+let $desc0 = builder.nextTypeIndex() + kNumStructs;
+let $desc1 = $desc0 + 1;
+let $s0 = builder.addStruct({fields: [i32_field], descriptor: $desc0});
+let $s1 = builder.addStruct(
+  {fields: [i32_field, i32_field], descriptor: $desc1, supertype: $s0});
+
+/* $desc0 */ builder.addStruct({fields: [i64_field], describes: $s0});
+/* $desc1 */ builder.addStruct(
+    {fields: [i64_field, i64_field], describes: $s1, supertype: $desc0});
+builder.endRecGroup();
+
+let $g_desc0 = builder.addGlobal(wasmRefType($desc0).exact(), false, false,
+                                [kGCPrefix, kExprStructNewDefault, $desc0]);
+
+let $g_desc1 = builder.addGlobal(wasmRefType($desc1).exact(), false, false,
+                                 [kGCPrefix, kExprStructNewDefault, $desc1]);
+
+// For convenience, we ensure matching indices:
+assertEquals($g_desc0.index, $s0);
+assertEquals($g_desc1.index, $s1);
+
+function MakeFunctions(type_index) {
+  let desc_index = type_index + kNumStructs;  // By type section construction.
+  let global_index = type_index;
+
+  builder.addFunction("make_s" + type_index, sig_r_i).exportFunc().addBody([
+    kExprLocalGet, 0,
+    ...(type_index == $s1 ? [kExprI32Const, 2] : []),
+    kExprGlobalGet, global_index,
+    kGCPrefix, kExprStructNew, type_index,
+  ]);
+
+  builder.addFunction("oneshot_s" + type_index, sig_r_i).exportFunc().addBody([
+    kExprLocalGet, 0,
+    ...(type_index == $s1 ? [kExprI32Const, 2] : []),
+    kGCPrefix, kExprStructNewDefault, desc_index,
+    kGCPrefix, kExprStructNew, type_index,
+  ]);
+
+  builder.addFunction("get_desc_s" + type_index, sig_r_r).exportFunc().addBody([
+    kExprLocalGet, 0,
+    kGCPrefix, kExprRefCast, type_index,
+    kGCPrefix, kExprRefGetDesc, type_index,
+  ]);
+
+  builder.addFunction("cast_desc_s" + type_index, sig_v_r).exportFunc()
+  .addBody([
+    kExprLocalGet, 0,
+    kExprGlobalGet, global_index,
+    kGCPrefix, kExprRefCastDesc, type_index,
+    kExprDrop,
+    // Same thing again, with an exact cast.
+    kExprLocalGet, 0,
+    kExprGlobalGet, global_index,
+    kGCPrefix, kExprRefCastDesc, kWasmExact, type_index,
+    kExprDrop,
+  ]);
+
+  builder.addFunction("cast_desc_null_s" + type_index, sig_v_r).exportFunc()
+  .addBody([
+    kExprLocalGet, 0,
+    kExprGlobalGet, global_index,
+    kGCPrefix, kExprRefCastDescNull, type_index,
+    kExprDrop,
+    // Same thing again, with an exact cast.
+    kExprLocalGet, 0,
+    kExprGlobalGet, global_index,
+    kGCPrefix, kExprRefCastDescNull, kWasmExact, type_index,
+    kExprDrop,
+  ]);
+
+  // Increments the descriptor's first field by 1, and returns the
+  // incremented value.
+  builder.addFunction("inc_desc_field_s" + type_index, sig_i_r).exportFunc()
+  .addLocals(wasmRefType(desc_index), 1)
+  .addLocals(kWasmI64, 1)
+  .addBody([
+    kExprLocalGet, 0,
+    kGCPrefix, kExprRefCast, type_index,
+    kGCPrefix, kExprRefGetDesc, type_index,
+    kExprLocalTee, 1,  // One copy for struct.set.
+    kExprLocalGet, 1,  // One copy for struct.get.
+    kGCPrefix, kExprStructGet, desc_index, 0,
+    kExprI64Const, 1,
+    kExprI64Add,
+    kExprLocalTee, 2,
+    kGCPrefix, kExprStructSet, desc_index, 0,
+    kExprLocalGet, 2,
+    kExprI32ConvertI64,
+  ]);
+
+  builder.addFunction("br_on_cast_desc_s" + type_index, sig_i_r)
+  .exportFunc()
+  .addBody([
+    kExprBlock, kAnyRefCode,
+      kExprLocalGet, 0,
+      kExprGlobalGet, global_index,
+      ...wasmBrOnCastDesc(0, anyref, wasmRefNullType(type_index).exact()),
+      kExprI32Const, 0, // If branch not taken, return 0.
+      kExprReturn,
+    kExprEnd,
+    kExprDrop,
+    kExprI32Const, 1, // If branch taken, return 1.
+  ]);
+
+builder.addFunction("br_on_cast_desc_fail_s" + type_index, sig_i_r)
+  .exportFunc()
+  .addBody([
+    kExprBlock, kAnyRefCode,
+      kExprLocalGet, 0,
+      kExprGlobalGet, global_index,
+      ...wasmBrOnCastDescFail(0, anyref, wasmRefType(type_index)),
+      kExprI32Const, 0, // If branch not taken (cast succeeded), return 0.
+      kExprReturn,
+    kExprEnd,
+    kExprDrop,
+    kExprI32Const, 1, // If branch taken (cast failed), return 1.
+  ]);
+}
+
+MakeFunctions($s0);
+MakeFunctions($s1);
+
+let instance = builder.instantiate();
+let wasm = instance.exports;
+
+let s0 = wasm.make_s0(11);
+let s1 = wasm.make_s1(22);
+
+let oneshot_s0 = wasm.oneshot_s0(33);
+let oneshot_s0a = wasm.oneshot_s0(34);
+let oneshot_s1 = wasm.oneshot_s1(44);
+
+assertSame(wasm.get_desc_s0(s0), wasm.get_desc_s0(s0));
+// Treating s1 as its supertype s0 works for get_desc:
+assertSame(wasm.get_desc_s0(s1), wasm.get_desc_s1(s1));
+assertNotSame(wasm.get_desc_s0(s0), wasm.get_desc_s0(oneshot_s0));
+assertNotSame(wasm.get_desc_s0(oneshot_s0), wasm.get_desc_s0(oneshot_s0a));
+assertNotSame(wasm.get_desc_s1(s1), wasm.get_desc_s1(oneshot_s1));
+
+wasm.cast_desc_s0(s0);
+wasm.cast_desc_s1(s1);
+assertThrows(
+    () => wasm.cast_desc_s1(s0), WebAssembly.RuntimeError, 'illegal cast');
+assertThrows(
+    () => wasm.cast_desc_s0(s1), WebAssembly.RuntimeError, 'illegal cast');
+
+wasm.cast_desc_null_s0(s0);
+wasm.cast_desc_null_s1(s1);
+wasm.cast_desc_null_s0(null);
+wasm.cast_desc_null_s1(null);
+assertThrows(
+    () => wasm.cast_desc_null_s1(s0), WebAssembly.RuntimeError, 'illegal cast');
+assertThrows(
+    () => wasm.cast_desc_null_s0(s1), WebAssembly.RuntimeError, 'illegal cast');
+
+let s0_other = wasm.make_s0(33);
+assertEquals(1, wasm.inc_desc_field_s0(s0));
+assertEquals(2, wasm.inc_desc_field_s0(s0_other));
+assertEquals(3, wasm.inc_desc_field_s0(s0));
+
+let s1_other = wasm.make_s1(44);
+assertEquals(1, wasm.inc_desc_field_s1(s1));
+assertEquals(2, wasm.inc_desc_field_s1(s1_other));
+assertEquals(3, wasm.inc_desc_field_s1(s1));
+assertEquals(4, wasm.inc_desc_field_s1(s1_other));
+assertEquals(5, wasm.inc_desc_field_s1(s1));
+
+// inc_desc_field_s0, when operating on s1-typed structs, still updates
+// the $desc1 descriptor.
+assertEquals(6, wasm.inc_desc_field_s0(s1_other));
+assertEquals(7, wasm.inc_desc_field_s0(s1));
+
+assertEquals(1, wasm.br_on_cast_desc_s0(s0));
+assertEquals(0, wasm.br_on_cast_desc_s0(s1));
+assertEquals(1, wasm.br_on_cast_desc_s0(null));
+
+assertEquals(0, wasm.br_on_cast_desc_s1(s0));
+assertEquals(1, wasm.br_on_cast_desc_s1(s1));
+assertEquals(1, wasm.br_on_cast_desc_s1(null));
+
+assertEquals(0, wasm.br_on_cast_desc_fail_s0(s0));
+assertEquals(1, wasm.br_on_cast_desc_fail_s0(s1));
+assertEquals(1, wasm.br_on_cast_desc_fail_s0(null));
+
+assertEquals(1, wasm.br_on_cast_desc_fail_s1(s0));
+assertEquals(0, wasm.br_on_cast_desc_fail_s1(s1));
+assertEquals(1, wasm.br_on_cast_desc_fail_s1(null));
diff --git a/deps/v8/test/mjsunit/wasm/deopt/deopt-too-much-feedback.js b/deps/v8/test/mjsunit/wasm/deopt/deopt-too-much-feedback.js
index e7fb9d1b1bc475..3c02cdf2263e90 100644
--- a/deps/v8/test/mjsunit/wasm/deopt/deopt-too-much-feedback.js
+++ b/deps/v8/test/mjsunit/wasm/deopt/deopt-too-much-feedback.js
@@ -61,7 +61,7 @@ let createUniqueModule = (function() {
 })();
 
 // Test a scenario where each instance only has polymorphic call feedback but
-// the instsances combined sum up to more feedback slots than the maximum
+// the instances combined sum up to more feedback slots than the maximum
 // polymorphism (4).
 (function TestCollectiveFeedbackMoreThanMaxPolymorphism() {
   let module = createUniqueModule();
diff --git a/deps/v8/test/mjsunit/wasm/gc-js-interop-objects.js b/deps/v8/test/mjsunit/wasm/gc-js-interop-objects.js
index 76059783d5239b..ae2937bdfb5964 100644
--- a/deps/v8/test/mjsunit/wasm/gc-js-interop-objects.js
+++ b/deps/v8/test/mjsunit/wasm/gc-js-interop-objects.js
@@ -73,7 +73,10 @@ for (const wasm_obj of [struct, array]) {
     repeated(() => assertSame(wasm_obj, Object.getPrototypeOf(obj)));
     repeated(() => assertSame(wasm_obj, Reflect.getPrototypeOf(obj)));
     repeated(() => assertSame(undefined, obj.__proto__));
-    testThrowsRepeated(() => obj.__proto__ = wasm_obj, TypeError);
+    // __proto__ is not an inherited accessor, so it's a named property
+    // like any other.
+    obj.__proto__ = wasm_obj;
+    repeated(() => assertSame(wasm_obj, obj.__proto__));
     // Property access fails.
     repeated(() => assertSame(undefined, obj[0]));
     repeated(() => assertSame(undefined, obj.prop));
diff --git a/deps/v8/test/mjsunit/wasm/generate-random-module-no-staging.js b/deps/v8/test/mjsunit/wasm/generate-random-module-no-staging.js
index 1a5e3e45e601e4..d667134fd56baf 100644
--- a/deps/v8/test/mjsunit/wasm/generate-random-module-no-staging.js
+++ b/deps/v8/test/mjsunit/wasm/generate-random-module-no-staging.js
@@ -6,7 +6,7 @@
 // %WasmGenerateRandomModule is supposed to also work without that, such that it
 // can be used by fuzzers.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --wasm-allow-mixed-eh-for-testing
 
 (function TestGenerateRandomModule() {
   print(arguments.callee.name);
diff --git a/deps/v8/test/mjsunit/wasm/generate-random-module.js b/deps/v8/test/mjsunit/wasm/generate-random-module.js
index 4d8f3c3bea071b..5766b4e87e0afa 100644
--- a/deps/v8/test/mjsunit/wasm/generate-random-module.js
+++ b/deps/v8/test/mjsunit/wasm/generate-random-module.js
@@ -6,7 +6,7 @@
 // Also enable all features that are used in the randomly generated module. This
 // should stay in sync with `EnableExperimentalWasmFeatures` in
 // `test/fuzzer/wasm/fuzzer-common.cc`.
-// Flags: --wasm-staging
+// Flags: --wasm-staging --wasm-allow-mixed-eh-for-testing
 
 (function TestGenerateRandomModule() {
   print(arguments.callee.name);
diff --git a/deps/v8/test/mjsunit/wasm/mixed-eh-invalid.js b/deps/v8/test/mjsunit/wasm/mixed-eh-invalid.js
new file mode 100644
index 00000000000000..7f2a6a3e129e82
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/mixed-eh-invalid.js
@@ -0,0 +1,96 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --experimental-wasm-exnref
+
+// Test that using a mix of legacy and new exception handling instructions in
+// the same module is invalid without --wasm-allow-mixed-eh-for-testing.
+
+d8.file.execute('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function TestTryAndTryTableInvalid() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("", kSig_v_v)
+      .addBody([
+          kExprTry, kWasmVoid,
+          kExprEnd,
+          kExprTryTable, kWasmVoid, 0,
+          kExprEnd,
+      ]).exportFunc();
+  assertThrows(() => builder.instantiate(),
+      WebAssembly.CompileError, /module uses a mix of legacy and new exception handling instructions/);
+})();
+
+(function TestTryTableAndTryInvalid() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("", kSig_v_v)
+      .addBody([
+          kExprTryTable, kWasmVoid, 0,
+          kExprEnd,
+          kExprTry, kWasmVoid,
+          kExprEnd,
+      ]).exportFunc();
+  assertThrows(() => builder.instantiate(),
+      WebAssembly.CompileError, /module uses a mix of legacy and new exception handling instructions/);
+})();
+
+(function TestLegacyTryAndNullExnRefInvalid() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("", kSig_v_v)
+      .addBody([
+          kExprTry, kWasmVoid,
+          kExprEnd,
+          kExprRefNull, kExnRefCode,
+          kExprDrop,
+      ]).exportFunc();
+  assertThrows(() => builder.instantiate(),
+      WebAssembly.CompileError, /module uses a mix of legacy and new exception handling instructions/);
+})();
+
+(function TestNullExnRefAndLegacyTryInvalid() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("", kSig_v_v)
+      .addBody([
+          kExprRefNull, kExnRefCode,
+          kExprDrop,
+          kExprTry, kWasmVoid,
+          kExprEnd,
+      ]).exportFunc();
+  assertThrows(() => builder.instantiate(),
+      WebAssembly.CompileError, /module uses a mix of legacy and new exception handling instructions/);
+})();
+
+(function TestLegacyTryAndExnRefBlockInvalid() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("", kSig_v_v)
+      .addBody([
+          kExprTry, kWasmVoid,
+          kExprEnd,
+          kExprBlock, kExnRefCode,
+          kExprEnd,
+      ]).exportFunc();
+  assertThrows(() => builder.instantiate(),
+      WebAssembly.CompileError, /module uses a mix of legacy and new exception handling instructions/);
+})();
+
+(function TestExnRefBlockAndLegacyTryInvalid() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("", kSig_v_v)
+      .addBody([
+          kExprBlock, kExnRefCode,
+          kExprUnreachable,
+          kExprEnd,
+          kExprDrop,
+          kExprTry, kWasmVoid,
+          kExprEnd,
+      ]).exportFunc();
+  assertThrows(() => builder.instantiate(),
+      WebAssembly.CompileError, /module uses a mix of legacy and new exception handling instructions/);
+})();
diff --git a/deps/v8/test/mjsunit/wasm/module-memory.js b/deps/v8/test/mjsunit/wasm/module-memory.js
index 91b265989304f6..ab4b03b5beff55 100644
--- a/deps/v8/test/mjsunit/wasm/module-memory.js
+++ b/deps/v8/test/mjsunit/wasm/module-memory.js
@@ -170,3 +170,39 @@ function testOOBThrows() {
 }
 
 testOOBThrows();
+
+function testOOBThrowsInt8() {
+  var builder = new WasmModuleBuilder();
+
+  builder.addMemory(1, 1);
+  builder.addFunction("geti", kSig_i_ii)
+    .addBody([
+      kExprLocalGet, 0,
+      kExprLocalGet, 1,
+      kExprI32LoadMem, 0, 0,
+      kExprI32StoreMem8, 0, 0,
+      kExprLocalGet, 1,
+      kExprI32LoadMem, 0, 0,
+    ])
+    .exportFunc();
+
+  var module = builder.instantiate();
+
+  let write = offset =>  module.exports.geti(offset, 0);
+  assertEquals(0, write(65532));
+
+  // Note that this test might be run concurrently in multiple Isolates, which
+  // makes an exact comparison of the expected trap count unreliable. But is is
+  // still possible to check the lower bound for the expected trap count.
+  let offset = kMemSize
+  const trap_count = %GetWasmRecoveredTrapCount();
+
+  assertTraps(kTrapMemOutOfBounds, () => write(offset));
+
+  // For Int8 stores, explicit OOB checks are removed, so they will always trap.
+  if (%IsWasmTrapHandlerEnabled()) {
+      assertTrue(trap_count + 1 <= %GetWasmRecoveredTrapCount());
+  }
+}
+
+testOOBThrowsInt8();
diff --git a/deps/v8/test/mjsunit/wasm/shared-everything/basic.js b/deps/v8/test/mjsunit/wasm/shared-everything/basic.js
index 8162777574cfa5..4772fd3641c28e 100644
--- a/deps/v8/test/mjsunit/wasm/shared-everything/basic.js
+++ b/deps/v8/test/mjsunit/wasm/shared-everything/basic.js
@@ -3,9 +3,116 @@
 // found in the LICENSE file.
 
 // Flags: --experimental-wasm-shared --no-wasm-inlining-call-indirect
+// Flags: --expose-gc --allow-natives-syntax
 
 d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
 
+(function SharedStruct() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let struct = builder.addStruct(
+      [makeField(kWasmI32, true)], kNoSuperType, false, true);
+  let producer_sig = makeSig([kWasmI32], [wasmRefType(struct)]);
+  builder.addFunction("producer", producer_sig)
+    .addBody([kExprLocalGet, 0, kGCPrefix, kExprStructNew, struct])
+    .exportFunc();
+  let consumer_sig = makeSig([wasmRefNullType(struct)], [kWasmI32]);
+  builder.addFunction("consumer", consumer_sig)
+    .addBody([kExprLocalGet, 0, kGCPrefix, kExprStructGet, struct, 0])
+    .exportFunc();
+
+  let instance = builder.instantiate();
+
+  let value = 42;
+
+  let struct_obj = instance.exports.producer(value);
+  assertTrue(%IsInWritableSharedSpace(struct_obj));
+  assertEquals(value, instance.exports.consumer(struct_obj));
+  gc();
+  assertEquals(value, instance.exports.consumer(struct_obj));
+})();
+
+(function SharedArray() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let array = builder.addArray(kWasmI64, true, kNoSuperType, false, true);
+  let producer_sig = makeSig([kWasmI64, kWasmI32], [wasmRefType(array)])
+  builder.addFunction("producer", producer_sig)
+    .addBody([kExprLocalGet, 0, kExprLocalGet, 1,
+              kGCPrefix, kExprArrayNew, array])
+    .exportFunc();
+  builder.addFunction("producerFixed", producer_sig)
+    .addBody([kExprLocalGet, 0,
+              kGCPrefix, kExprArrayNewFixed, array, 1])
+    .exportFunc();
+  builder.addFunction("producerDefault", producer_sig)
+    .addBody([kExprLocalGet, 1,
+              kGCPrefix, kExprArrayNewDefault, array])
+    .exportFunc();
+  let consumer_sig = makeSig([wasmRefNullType(array), kWasmI32], [kWasmI64]);
+  builder.addFunction("consumer", consumer_sig)
+    .addBody([kExprLocalGet, 0, kExprLocalGet, 1,
+              kGCPrefix, kExprArrayGet, array])
+    .exportFunc();
+
+  let instance = builder.instantiate();
+
+  let value = 42n;
+
+  let array_obj = instance.exports.producer(value, 100);
+  let array_obj_fixed = instance.exports.producerFixed(value, 100);
+  let array_obj_default = instance.exports.producerDefault(value, 100);
+
+  assertTrue(%IsInWritableSharedSpace(array_obj));
+  assertTrue(%IsInWritableSharedSpace(array_obj_fixed));
+  assertTrue(%IsInWritableSharedSpace(array_obj_default));
+  assertEquals(value, instance.exports.consumer(array_obj, 0));
+  assertEquals(value, instance.exports.consumer(array_obj_fixed, 0));
+  assertEquals(0n, instance.exports.consumer(array_obj_default, 0));
+  gc();
+  assertEquals(value, instance.exports.consumer(array_obj, 0));
+  assertEquals(value, instance.exports.consumer(array_obj_fixed, 0));
+  assertEquals(0n, instance.exports.consumer(array_obj_default, 0));
+})();
+
+(function SharedArrayOfStructNewFixed() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let struct = builder.addStruct(
+      [makeField(kWasmI64, true)], kNoSuperType, false, true);
+  let array = builder.addArray(
+      wasmRefNullType(struct), true, kNoSuperType, false, true);
+  let producer_sig = makeSig([kWasmI64, kWasmI64], [wasmRefType(array)]);
+  builder.addFunction("producer", producer_sig)
+    .addBody([kExprLocalGet, 0, kGCPrefix, kExprStructNew, struct,
+              kExprLocalGet, 1, kGCPrefix, kExprStructNew, struct,
+              kGCPrefix, kExprArrayNewFixed, array, 2])
+    .exportFunc();
+  let consumer_sig = makeSig([wasmRefNullType(array), kWasmI32], [kWasmI64]);
+  builder.addFunction("consumer", consumer_sig)
+    .addBody([kExprLocalGet, 0, kExprLocalGet, 1,
+              kGCPrefix, kExprArrayGet, array,
+              kGCPrefix, kExprStructGet, struct, 0])
+    .exportFunc();
+
+  let instance = builder.instantiate();
+
+  let value0 = 10n;
+  let value1 = 11n;
+
+  let array_obj = instance.exports.producer(value0, value1);
+  assertTrue(%IsInWritableSharedSpace(array_obj));
+  assertEquals(value0, instance.exports.consumer(array_obj, 0));
+  assertEquals(value1, instance.exports.consumer(array_obj, 1));
+
+  gc();
+
+  assertEquals(value0, instance.exports.consumer(array_obj, 0));
+  assertEquals(value1, instance.exports.consumer(array_obj, 1));
+})();
+
+/* TODO(42204563): Reinstate these tests as we support the respective features.
+
 (function SharedGlobal() {
   print(arguments.callee.name);
   let builder = new WasmModuleBuilder();
@@ -562,3 +669,5 @@ d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
   assertEquals(0, wasm.get(array, 2));
   assertEquals(1, wasm.get(array, 3));
 })();
+
+*/
diff --git a/deps/v8/test/mjsunit/wasm/shared-everything/post-message.js b/deps/v8/test/mjsunit/wasm/shared-everything/post-message.js
new file mode 100644
index 00000000000000..3f8ea906540f60
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/shared-everything/post-message.js
@@ -0,0 +1,244 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-shared
+
+d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function PostSharedStruct() {
+  print(arguments.callee.name);
+
+  let builder = new WasmModuleBuilder();
+
+  let struct = builder.addStruct([makeField(kWasmI32, true)], kNoSuperType,
+                                  false, true);
+  let producer_sig = makeSig([kWasmI32], [wasmRefType(struct)]);
+  builder.addFunction("producer", producer_sig)
+    .addBody([kExprLocalGet, 0, kGCPrefix, kExprStructNew, struct])
+    .exportFunc();
+  let getter_sig = makeSig([wasmRefNullType(struct)], [kWasmI32]);
+  builder.addFunction("getter", getter_sig)
+    .addBody([kExprLocalGet, 0, kGCPrefix, kExprStructGet, struct, 0])
+    .exportFunc();
+
+  let instance = builder.instantiate();
+
+  let worker = new Worker(function() {
+    onmessage = function({data:msg}) {
+      d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
+
+      let builder = new WasmModuleBuilder();
+
+      let struct = builder.addStruct([makeField(kWasmI32, true)], kNoSuperType,
+                                      false, true);
+      let setter_sig = makeSig([wasmRefNullType(struct), kWasmI32], []);
+      builder.addFunction("setter", setter_sig)
+        .addBody([kExprLocalGet, 0, kExprLocalGet, 1,
+                  kGCPrefix, kExprStructSet, struct, 0])
+        .exportFunc();
+      let instance = builder.instantiate();
+      let value1 = 10;
+      instance.exports.setter(msg.struct, value1);
+      postMessage({struct: msg.struct});
+      return;
+    }
+  }, {type: 'function'});
+
+  let value0 = 5;
+  let value1 = 10;
+  let struct_obj_pre = instance.exports.producer(value0);
+  assertEquals(instance.exports.getter(struct_obj_pre), value0);
+  worker.postMessage({struct: struct_obj_pre});
+
+  let struct_obj_post = worker.getMessage().struct;
+
+  assertEquals(struct_obj_pre, struct_obj_post);
+  assertEquals(instance.exports.getter(struct_obj_post), value1);
+})();
+
+// Trying to postMessage a non-shared struct should fail.
+(function PostNonSharedStruct() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+
+  let struct = builder.addStruct([makeField(kWasmI32, true)], kNoSuperType,
+                                  false, false);
+  let producer_sig = makeSig([kWasmI32], [wasmRefType(struct)]);
+  builder.addFunction("producer", producer_sig)
+    .addBody([kExprLocalGet, 0, kGCPrefix, kExprStructNew, struct])
+    .exportFunc();
+  let getter_sig = makeSig([wasmRefNullType(struct)], [kWasmI32]);
+  builder.addFunction("getter", getter_sig)
+    .addBody([kExprLocalGet, 0, kGCPrefix, kExprStructGet, struct, 0])
+    .exportFunc();
+
+  let instance = builder.instantiate();
+
+  let worker = new Worker(function() {
+    onmessage = function({data:msg}) {
+      d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
+
+      let builder = new WasmModuleBuilder();
+
+      let struct = builder.addStruct([makeField(kWasmI32, true)], kNoSuperType,
+                                      false, false);
+      let setter_sig = makeSig([wasmRefNullType(struct), kWasmI32], []);
+      builder.addFunction("setter", setter_sig)
+        .addBody([kExprLocalGet, 0, kExprLocalGet, 1,
+                  kGCPrefix, kExprStructSet, struct, 0])
+        .exportFunc();
+      let instance = builder.instantiate();
+      let value1 = 10;
+      instance.exports.setter(msg.struct, value1);
+      postMessage({struct: msg.struct});
+      return;
+    }
+  }, {type: 'function'});
+
+  let value0 = 5;
+  let struct_obj_pre = instance.exports.producer(value0);
+  assertEquals(instance.exports.getter(struct_obj_pre), value0);
+  assertThrows(() => worker.postMessage({struct: struct_obj_pre}), Error,
+               "[object Object] could not be cloned.");
+})();
+
+(function PostSharedArray() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+
+  let array = builder.addArray(kWasmI32, true, kNoSuperType, false, true);
+  let producer_sig = makeSig([kWasmI32], [wasmRefType(array)]);
+  builder.addFunction("producer", producer_sig)
+    .addBody([kExprLocalGet, 0, kGCPrefix, kExprArrayNewFixed, array, 1])
+    .exportFunc();
+  let getter_sig = makeSig([wasmRefNullType(array)], [kWasmI32]);
+  builder.addFunction("getter", getter_sig)
+    .addBody([kExprLocalGet, 0, kExprI32Const, 0,
+              kGCPrefix, kExprArrayGet, array])
+    .exportFunc();
+
+  let instance = builder.instantiate();
+
+  let worker = new Worker(function() {
+    onmessage = function({data:msg}) {
+      d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
+
+      let builder = new WasmModuleBuilder();
+
+      let array = builder.addArray(kWasmI32, true, kNoSuperType, false, true);
+      let setter_sig = makeSig([wasmRefNullType(array), kWasmI32], []);
+      builder.addFunction("setter", setter_sig)
+        .addBody([kExprLocalGet, 0, kExprI32Const, 0, kExprLocalGet, 1,
+                  kGCPrefix, kExprArraySet, array])
+        .exportFunc();
+      let instance = builder.instantiate();
+      let value1 = 10;
+      instance.exports.setter(msg.array, value1);
+      postMessage({array: msg.array});
+      return;
+    }
+  }, {type: 'function'});
+
+  let value0 = 5;
+  let value1 = 10;
+  let array_obj_pre = instance.exports.producer(value0);
+  assertEquals(instance.exports.getter(array_obj_pre), value0);
+  worker.postMessage({array: array_obj_pre});
+
+  let array_obj_post = worker.getMessage().array;
+
+  assertEquals(array_obj_pre, array_obj_post);
+  assertEquals(instance.exports.getter(array_obj_post), value1);
+})();
+
+// Trying to postMessage a non-shared array should fail.
+(function PostNonSharedArray() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+
+  let array = builder.addArray(kWasmI32, true, kNoSuperType, false, false);
+  let producer_sig = makeSig([kWasmI32], [wasmRefType(array)]);
+  builder.addFunction("producer", producer_sig)
+    .addBody([kExprLocalGet, 0, kGCPrefix, kExprArrayNewFixed, array, 1])
+    .exportFunc();
+  let getter_sig = makeSig([wasmRefNullType(array)], [kWasmI32]);
+  builder.addFunction("getter", getter_sig)
+    .addBody([kExprLocalGet, 0, kExprI32Const, 0,
+              kGCPrefix, kExprArrayGet, array])
+    .exportFunc();
+
+  let instance = builder.instantiate();
+
+  let worker = new Worker(function() {
+    onmessage = function({data:msg}) {
+      d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
+
+      let builder = new WasmModuleBuilder();
+
+      let array = builder.addArray(kWasmI32, true, kNoSuperType, false, false);
+      let setter_sig = makeSig([wasmRefNullType(array), kWasmI32], []);
+      builder.addFunction("setter", setter_sig)
+        .addBody([kExprLocalGet, 0, kExprI32Const, 0, kExprLocalGet, 1,
+                  kGCPrefix, kExprArraySet, array])
+        .exportFunc();
+      let instance = builder.instantiate();
+      let value1 = 10;
+      instance.exports.setter(msg.array, value1);
+      postMessage({array: msg.array});
+      return;
+    }
+  }, {type: 'function'});
+
+  let value0 = 5;
+  let value1 = 10;
+  let array_obj_pre = instance.exports.producer(value0);
+  assertEquals(instance.exports.getter(array_obj_pre), value0);
+  assertThrows(() => worker.postMessage({array: array_obj_pre}), Error,
+               "[object Object] could not be cloned.");
+})();
+
+(function PostSharedStructAllocatedInWorker() {
+  print(arguments.callee.name);
+
+  let builder = new WasmModuleBuilder();
+
+  let struct = builder.addStruct([makeField(kWasmI32, true)], kNoSuperType,
+                                  false, true);
+
+  let getter_sig = makeSig([wasmRefNullType(struct)], [kWasmI32]);
+  builder.addFunction("getter", getter_sig)
+    .addBody([kExprLocalGet, 0, kGCPrefix, kExprStructGet, struct, 0])
+    .exportFunc();
+
+  let instance = builder.instantiate();
+
+  let worker = new Worker(function() {
+    onmessage = function({data:msg}) {
+      d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
+
+      let builder = new WasmModuleBuilder();
+
+      let struct = builder.addStruct([makeField(kWasmI32, true)], kNoSuperType,
+                                      false, true);
+      let producer_sig = makeSig([kWasmI32], [wasmRefType(struct)])
+      builder.addFunction("producer", producer_sig)
+        .addBody([kExprLocalGet, 0, kGCPrefix, kExprStructNew, struct])
+        .exportFunc();
+
+      let instance = builder.instantiate();
+      let value = 10;
+      let struct_obj = instance.exports.producer(value);
+      postMessage({struct: struct_obj});
+      return;
+    }
+  }, {type: 'function'});
+
+  let value = 10;
+
+  worker.postMessage({});
+
+  let struct_obj = worker.getMessage().struct;
+
+  assertEquals(instance.exports.getter(struct_obj), value);
+})();
diff --git a/deps/v8/test/mjsunit/wasm/shared-everything/shared-type-with-unshared-elem.js b/deps/v8/test/mjsunit/wasm/shared-everything/shared-type-with-unshared-elem.js
index 836a8f517c2159..cb086c11b81b32 100644
--- a/deps/v8/test/mjsunit/wasm/shared-everything/shared-type-with-unshared-elem.js
+++ b/deps/v8/test/mjsunit/wasm/shared-everything/shared-type-with-unshared-elem.js
@@ -2,9 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// TODO(manoskouk): Revisit flags once shared everything threads doesn't
-// conflict with --liftoff any more.
-// Flags: --experimental-wasm-shared --no-liftoff --turbofan
+// TODO(manoskouk): Fix error messages once we support shared globals, tables,
+// and functions
+// Flags: --experimental-wasm-shared
 
 d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
 
@@ -12,36 +12,35 @@ d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
   const builder = new WasmModuleBuilder();
   builder.addTable(kWasmFuncRef, 0, undefined, undefined, /*is_shared*/ true);
   assertThrows(() => builder.instantiate(), WebAssembly.CompileError,
-    /Shared table 0 must have shared element type, actual type funcref/);
+    /shared tables are not supported yet/);
 })();
 
 (function TestSharedGlobalWithUnsharedElementType() {
   const builder = new WasmModuleBuilder();
   builder.addGlobal(kWasmFuncRef, false, /*is_shared*/ true);
   assertThrows(() => builder.instantiate(), WebAssembly.CompileError,
-    /Shared global 0 must have shared type, actual type funcref/);
+    /shared globals are not supported yet/);
 })();
 
 (function TestImportedSharedTableWithUnsharedElementType() {
   const builder = new WasmModuleBuilder();
   builder.addImportedTable("import", "table", 0, 10, kWasmFuncRef, /*is_shared*/ true);
   assertThrows(() => builder.toModule(), WebAssembly.CompileError,
-    /Shared table 0 must have shared element type, actual type funcref/);
+    /shared tables are not supported yet/);
 })();
 
 (function TestImportedSharedGlobalWithUnsharedElementType() {
   const builder = new WasmModuleBuilder();
   builder.addImportedGlobal("import", "global", kWasmFuncRef, true, /*is_shared*/ true);
   assertThrows(() => builder.toModule(), WebAssembly.CompileError,
-    /shared imported global must have shared type/);
+    /shared globals are not supported yet/);
 })();
 
-
 (function TestSharedArrayWithUnsharedElement() {
   const builder = new WasmModuleBuilder();
   builder.addArray(kWasmFuncRef, false, kNoSuperType, false, /*is_shared*/ true);
   assertThrows(() => builder.instantiate(), WebAssembly.CompileError,
-    /Type 0: shared array must have shared element type, actual element type is funcref/);
+    /shared array must have shared element type/);
 })();
 
 (function TestSharedStructWithUnsharedField() {
@@ -58,7 +57,7 @@ d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
   let sig = makeSig([kWasmFuncRef], [kWasmI32]);
   builder.addType(sig, kNoSuperType, false, /*is_shared*/ true);
   assertThrows(() => builder.instantiate(), WebAssembly.CompileError,
-    /Type 0: shared signature must have shared parameter types, actual type for parameter 0 is funcref/);
+    /shared functions\/continuations are not supported yet/);
 })();
 
 (function TestSharedSignatureWithUnsharedReturn() {
@@ -66,5 +65,5 @@ d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
   let sig = makeSig([kWasmI32], [kWasmFuncRef]);
   builder.addType(sig, kNoSuperType, false, /*is_shared*/ true);
   assertThrows(() => builder.instantiate(), WebAssembly.CompileError,
-    /Type 0: shared signature must have shared return types, actual type for return 0 is funcref/);
+    /shared functions\/continuations are not supported yet/);
 })();
diff --git a/deps/v8/test/mjsunit/wasm/shared-everything/wrapper-type-checks.js b/deps/v8/test/mjsunit/wasm/shared-everything/wrapper-type-checks.js
new file mode 100644
index 00000000000000..421706da4bccdd
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/shared-everything/wrapper-type-checks.js
@@ -0,0 +1,220 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-shared
+// Flags: --allow-natives-syntax --shared-string-table --harmony-struct
+
+d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
+
+let sharedJSStruct = new (new SharedStructType(["str"]));
+sharedJSStruct.str = "shared string";
+assertTrue(%IsSharedString(sharedJSStruct.str));
+
+let createHeapNumber = (x) => x + x;
+
+let vNull = () => null;
+let vUndefined = () => undefined;
+let vTrue = () => true;
+let vFalse = () => false;
+let vSmi = () => 1;
+let vHeapNumber = () => 1.5;
+let vHeapNumberSmi = () => createHeapNumber(5.5);
+let vStringLiteral = () => "test";
+let vStringDynamic = () => [1, 2, 3].join("-");
+let vSharedString = () => sharedJSStruct.str;
+let vSharedJSStruct = () => sharedJSStruct;
+let vObject = () => ({object: "literal"});
+let vSharedWasmStruct = (instance) => instance.exports.createSharedStruct();
+let vSharedWasmArray = (instance) => instance.exports.createSharedArray();
+let vUnsharedWasmStruct = (instance) => instance.exports.createUnsharedStruct();
+let vUnsharedWasmArray = (instance) => instance.exports.createUnsharedArray();
+let vSymbol = () => Symbol("symbol");
+
+// List all values here, so they can't be forgotten in individual tests below.
+let valuesToTest = [vNull, vUndefined, vTrue, vFalse, vSmi, vHeapNumber,
+  vHeapNumberSmi, vStringLiteral, vStringDynamic, vSharedString, vObject,
+  vSharedWasmStruct, vSharedWasmArray, vUnsharedWasmStruct, vUnsharedWasmArray,
+  vSymbol];
+
+let tests = [
+  {
+    name: "shared externref",
+    type: wasmRefNullType(kWasmExternRef).shared(),
+    valid: [vNull, vUndefined, vTrue, vFalse, vSmi, vStringLiteral,
+      vSharedString, vSharedJSStruct, vSharedWasmStruct,
+      vSharedWasmArray, vHeapNumber, vHeapNumberSmi, vStringDynamic],
+    invalid: [vUnsharedWasmStruct, vUnsharedWasmArray, vObject, vSymbol]
+  },
+  {
+    name: "shared anyref",
+    type: wasmRefNullType(kWasmAnyRef).shared(),
+    valid: [vNull, vUndefined, vTrue, vFalse, vSmi, vStringLiteral,
+      vSharedString, vSharedJSStruct, vSharedWasmStruct,
+      vSharedWasmArray, vHeapNumber, vHeapNumberSmi, vStringDynamic],
+    invalid: [vUnsharedWasmStruct, vUnsharedWasmArray, vObject, vSymbol]
+  },
+  {
+    name: "externref",
+    type: wasmRefNullType(kWasmExternRef),
+    valid: [vNull, vUndefined, vTrue, vFalse, vSmi, vHeapNumber, vStringLiteral,
+      vStringDynamic, vObject, vUnsharedWasmStruct, vUnsharedWasmArray,
+      vSharedString, vSharedJSStruct, vSharedWasmStruct, vSharedWasmArray,
+      vHeapNumberSmi, vSymbol],
+    invalid: []
+  },
+  {
+    name: "anyref",
+    type: wasmRefNullType(kWasmAnyRef),
+    valid: [vNull, vUndefined, vTrue, vFalse, vSmi, vHeapNumber, vStringLiteral,
+      vStringDynamic, vObject, vUnsharedWasmStruct, vUnsharedWasmArray,
+      vSharedString, vSharedJSStruct, vSharedWasmStruct, vSharedWasmArray,
+      vHeapNumberSmi, vSymbol],
+    invalid: []
+  },
+  {
+    name: "shared eqref",
+    type: wasmRefNullType(kWasmEqRef).shared(),
+    valid: [vNull, vSmi, vHeapNumberSmi, vSharedWasmStruct, vSharedWasmArray],
+    invalid: [vUndefined, vTrue, vFalse, vHeapNumber, vStringLiteral,
+      vStringDynamic, vSharedString, vSharedJSStruct, vObject,
+      vUnsharedWasmStruct, vUnsharedWasmArray, vSymbol]
+  },
+  {
+    name: "eqref",
+    type: wasmRefNullType(kWasmEqRef),
+    valid: [vNull, vSmi, vHeapNumberSmi, vUnsharedWasmStruct,
+      vUnsharedWasmArray],
+    invalid: [vUndefined, vTrue, vFalse, vHeapNumber, vStringLiteral,
+      vStringDynamic, vSharedString, vSharedJSStruct, vObject,
+      vSharedWasmStruct, vSharedWasmArray, vSymbol]
+  },
+  {
+    name: "shared i31ref",
+    type: wasmRefNullType(kWasmI31Ref).shared(),
+    valid: [vNull, vSmi, vHeapNumberSmi],
+    invalid: [vUndefined, vTrue, vFalse, vHeapNumber, vStringLiteral,
+      vStringDynamic, vSharedString, vSharedJSStruct, vObject,
+      vSharedWasmStruct, vSharedWasmArray, vUnsharedWasmStruct,
+      vUnsharedWasmArray, vSymbol]
+  },
+  {
+    name: "i31ref",
+    type: wasmRefNullType(kWasmI31Ref),
+    valid: [vNull, vSmi, vHeapNumberSmi],
+    invalid: [vUndefined, vTrue, vFalse, vHeapNumber, vStringLiteral,
+      vStringDynamic, vSharedString, vSharedJSStruct, vObject,
+      vSharedWasmStruct, vSharedWasmArray, vUnsharedWasmStruct,
+      vUnsharedWasmArray, vSymbol]
+  },
+  {
+    name: "shared arrayref",
+    type: wasmRefNullType(kWasmArrayRef).shared(),
+    valid: [vNull, vSharedWasmArray],
+    invalid: [vUndefined, vTrue, vFalse, vSmi, vHeapNumberSmi, vHeapNumber,
+      vStringLiteral, vStringDynamic, vSharedString, vSharedJSStruct,
+      vObject, vSharedWasmStruct, vUnsharedWasmStruct,
+      vUnsharedWasmArray, vSymbol]
+  },
+  {
+    name: "arrayref",
+    type: wasmRefNullType(kWasmArrayRef),
+    valid: [vNull, vUnsharedWasmArray],
+    invalid: [vUndefined, vTrue, vFalse, vSmi, vHeapNumberSmi, vHeapNumber,
+      vStringLiteral, vStringDynamic, vSharedString, vSharedJSStruct,
+      vObject, vSharedWasmStruct, vUnsharedWasmStruct,
+      vSharedWasmArray, vSymbol]
+  },
+  {
+    name: "shared structref",
+    type: wasmRefNullType(kWasmStructRef).shared(),
+    valid: [vNull, vSharedWasmStruct],
+    invalid: [vUndefined, vTrue, vFalse, vSmi, vHeapNumberSmi, vHeapNumber,
+      vStringLiteral, vStringDynamic, vSharedString, vSharedJSStruct,
+      vObject, vSharedWasmArray, vUnsharedWasmStruct,
+      vUnsharedWasmArray, vSymbol]
+  },
+  {
+    name: "structref",
+    type: wasmRefNullType(kWasmStructRef),
+    valid: [vNull, vUnsharedWasmStruct],
+    invalid: [vUndefined, vTrue, vFalse, vSmi, vHeapNumberSmi, vHeapNumber,
+      vStringLiteral, vStringDynamic, vSharedString, vSharedJSStruct,
+      vObject, vSharedWasmStruct, vSharedWasmArray,
+      vUnsharedWasmArray, vSymbol]
+  },
+  {
+    name: "shared none",
+    type: wasmRefNullType(kWasmNullRef).shared(),
+    valid: [vNull],
+    invalid: [vUndefined, vTrue, vFalse, vSmi, vHeapNumberSmi, vHeapNumber,
+      vStringLiteral, vStringDynamic, vSharedString, vSharedJSStruct,
+      vObject, vSharedWasmStruct, vSharedWasmArray, vUnsharedWasmStruct,
+      vUnsharedWasmArray, vSymbol]
+  },
+  {
+    name: "none",
+    type: wasmRefNullType(kWasmNullRef),
+    valid: [vNull],
+    invalid: [vUndefined, vTrue, vFalse, vSmi, vHeapNumberSmi, vHeapNumber,
+      vStringLiteral, vStringDynamic, vSharedString, vSharedJSStruct,
+      vObject, vSharedWasmStruct, vSharedWasmArray, vUnsharedWasmStruct,
+      vUnsharedWasmArray, vSymbol]
+  },
+];
+
+for (const {name, type, valid, invalid} of tests) {
+  print(`test ${name}`);
+  let builder = new WasmModuleBuilder();
+  let struct = builder.addStruct(
+    [makeField(kWasmI32, true)], kNoSuperType, false, false);
+  let sharedStruct = builder.addStruct(
+    [makeField(kWasmI32, true)], kNoSuperType, false, true);
+  let array = builder.addArray(kWasmI32, true, kNoSuperType, false, false);
+  let sharedArray = builder.addArray(kWasmI32, true, kNoSuperType, false, true);
+
+  builder.addFunction("createUnsharedStruct",
+    makeSig([], [wasmRefType(struct)]))
+  .addBody([
+    kExprI32Const, 42,
+    kGCPrefix, kExprStructNew, struct,
+  ]).exportFunc();
+  builder.addFunction("createSharedStruct",
+    makeSig([], [wasmRefType(sharedStruct)]))
+  .addBody([
+    kExprI32Const, 42,
+    kGCPrefix, kExprStructNew, sharedStruct,
+  ]).exportFunc();
+  builder.addFunction("createUnsharedArray",
+    makeSig([], [wasmRefType(array)]))
+  .addBody([
+    kExprI32Const, 42,
+    kGCPrefix, kExprArrayNewFixed, array, 1,
+  ]).exportFunc();
+  builder.addFunction("createSharedArray",
+    makeSig([], [wasmRefType(sharedArray)]))
+  .addBody([
+    kExprI32Const, 42,
+    kGCPrefix, kExprArrayNewFixed, sharedArray, 1,
+  ]).exportFunc();
+
+  builder.addFunction("consumer", makeSig([type], []))
+    .addBody([]).exportFunc();
+
+  let instance = builder.instantiate();
+
+  for (const creator of valuesToTest) {
+    if (valid.includes(creator)) {
+      let value = creator(instance);
+      print(`-- valid input ${creator.name}`);
+      instance.exports.consumer(value);
+    } else if (invalid.includes(creator)) {
+      let value = creator(instance);
+      print(`-- invalid input ${creator.name}`);
+      assertThrows(() => instance.exports.consumer(value),
+        TypeError, "type incompatibility when transforming from/to JS");
+    } else {
+      assertTrue(false, `${creator.name} neither listed as valid nor invalid`);
+    }
+  }
+}
diff --git a/deps/v8/test/mjsunit/wasm/stack-switching-conditional.js b/deps/v8/test/mjsunit/wasm/stack-switching-conditional.js
index f8248e50bcbf69..c605a6f0020f66 100644
--- a/deps/v8/test/mjsunit/wasm/stack-switching-conditional.js
+++ b/deps/v8/test/mjsunit/wasm/stack-switching-conditional.js
@@ -7,6 +7,7 @@
 //
 // Flags: --allow-natives-syntax
 // Flags: --expose-gc --wasm-stack-switching-stack-size=100
+// Flags: --experimental-wasm-type-reflection
 
 
 // Enable the JSPI flag conditionally (as in a Chrome Origin Trial),
diff --git a/deps/v8/test/mjsunit/wasm/stack-switching-init-safe.js b/deps/v8/test/mjsunit/wasm/stack-switching-init-safe.js
index aa4b7c590f438d..5cc794a6b1c750 100644
--- a/deps/v8/test/mjsunit/wasm/stack-switching-init-safe.js
+++ b/deps/v8/test/mjsunit/wasm/stack-switching-init-safe.js
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --no-experimental-wasm-jspi
+
 // Should result in an exception when trying to use JSPI.
 // Check that we cannot init after installing a SuspendError
 
diff --git a/deps/v8/test/mjsunit/wasm/turboshaft/reduction-shuffle.js b/deps/v8/test/mjsunit/wasm/turboshaft/reduction-shuffle.js
index 2e3f5a30717c57..c8090fedcf8228 100644
--- a/deps/v8/test/mjsunit/wasm/turboshaft/reduction-shuffle.js
+++ b/deps/v8/test/mjsunit/wasm/turboshaft/reduction-shuffle.js
@@ -115,14 +115,10 @@ d8.file.execute('test/mjsunit/value-helper.js');
   const wasm = builder.instantiate().exports;
   for (let a of int8_array) {
     for (let b of int8_array) {
-      for (let c of int8_array) {
-        for (let d of int8_array) {
-          assertEquals(wasm.sadd(a, b, c, d),
-                       wasm.sadd_reduce(a, b, c, d));
-          assertEquals(wasm.uadd(a, b, c, d),
-                       wasm.uadd_reduce(a, b, c, d));
-        }
-      }
+      assertEquals(wasm.sadd(a, b, b, a),
+                   wasm.sadd_reduce(a, b, b, a));
+      assertEquals(wasm.uadd(a, b, a, b),
+                   wasm.uadd_reduce(a, b, a, b));
     }
   }
 })();
@@ -200,14 +196,93 @@ d8.file.execute('test/mjsunit/value-helper.js');
   const wasm = builder.instantiate().exports;
   for (let a of int16_array) {
     for (let b of int16_array) {
-      for (let c of int16_array) {
-        for (let d of int16_array) {
-          assertEquals(wasm.sadd(a, b, c, d),
-                       wasm.sadd_reduce(a, b, c, d));
-          assertEquals(wasm.uadd(a, b, c, d),
-                       wasm.uadd_reduce(a, b, c, d));
-        }
-      }
+      assertEquals(wasm.sadd(b, b, a, a),
+                   wasm.sadd_reduce(b, b, a, a));
+      assertEquals(wasm.uadd(a, a, b, b),
+                   wasm.uadd_reduce(a, a, b, b));
+    }
+  }
+})();
+
+(function I16x8UpperToLowerReduceLeftAndRightMismatch() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  const shared_simd = [
+    kExprLocalGet, 0,
+    kSimdPrefix, kExprI16x8Splat,
+    kExprLocalGet, 1,
+    kSimdPrefix, kExprI16x8ReplaceLane, 1,
+    kExprLocalGet, 2,
+    kSimdPrefix, kExprI16x8ReplaceLane, 2,
+    kExprLocalGet, 3,
+    kSimdPrefix, kExprI16x8ReplaceLane, 3,
+    kExprLocalGet, 1,
+    kSimdPrefix, kExprI16x8ReplaceLane, 5,
+    kExprLocalGet, 2,
+    kSimdPrefix, kExprI16x8ReplaceLane, 6,
+    kExprLocalGet, 3,
+    kSimdPrefix, kExprI16x8ReplaceLane, 7,
+    kExprLocalTee, 4,
+    kExprLocalGet, 4,
+    kExprLocalGet, 2,
+    kSimdPrefix, kExprI16x8Splat,                     // unused input
+    kSimdPrefix, kExprI8x16Shuffle,                   // upper-to-lower 16x8
+    0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    ...SimdInstr(kExprI16x8Add),                       // first step of reduction
+    kExprLocalTee, 4,
+    kExprLocalGet, 4,
+    kExprLocalGet, 2,
+    kSimdPrefix, kExprI16x8Splat,                     // unused input
+    kSimdPrefix, kExprI8x16Shuffle,                   // upper-to-lower 16x4
+    0x04, 0x05, 0x06, 0x07, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    ...SimdInstr(kExprI16x8Add),                       // second step of reduction
+    kExprLocalTee, 4,
+    kExprLocalGet, 4,
+    kExprLocalGet, 4,
+    kSimdPrefix, kExprI8x16Shuffle,                   // upper-to-lower 8x2
+    0x02, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    ...SimdInstr(kExprI16x8Add),                       // final step of reduction
+  ];
+
+  const shared_scalar = wasmI32Const(0xFFFF).concat([
+    kExprLocalGet, 0,
+    kExprLocalGet, 1,
+    kExprLocalGet, 2,
+    kExprLocalGet, 3,
+    kExprLocalGet, 0,
+    kExprLocalGet, 1,
+    kExprLocalGet, 2,
+    kExprLocalGet, 3,
+    kExprI32Add,
+    kExprI32Add,
+    kExprI32Add,
+    kExprI32Add,
+    kExprI32Add,
+    kExprI32Add,
+    kExprI32Add,
+    kExprI32And,
+  ]);
+
+  const s16x8 = shared_simd.concat([kSimdPrefix, kExprI16x8ExtractLaneS, 0]);
+  const u16x8 = shared_simd.concat([kSimdPrefix, kExprI16x8ExtractLaneU, 0]);
+  builder.addFunction("sadd_reduce", kSig_i_iiii).addLocals(kWasmS128, 1).addBody(s16x8).exportFunc();
+  builder.addFunction("uadd_reduce", kSig_i_iiii).addLocals(kWasmS128, 1).addBody(u16x8).exportFunc();
+
+  const signed_scalar = shared_scalar.concat([kExprI32SExtendI16]);
+  const unsigned_scalar = shared_scalar.concat([]);
+  builder.addFunction("sadd", kSig_i_iiii).addBody(signed_scalar).exportFunc();
+  builder.addFunction("uadd", kSig_i_iiii).addBody(unsigned_scalar).exportFunc();
+
+  const wasm = builder.instantiate().exports;
+  for (let a of int16_array) {
+    for (let b of int16_array) {
+      assertEquals(wasm.sadd(a, b, a, b),
+                   wasm.sadd_reduce(a, b, a, b));
+      assertEquals(wasm.uadd(a, b, a, b),
+                   wasm.uadd_reduce(a, b, a, b));
     }
   }
 })();
@@ -256,6 +331,96 @@ d8.file.execute('test/mjsunit/value-helper.js');
   }
 })();
 
+(function I32x4UpperToLowerReduceLeftAndRightMismatch() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  builder.addFunction("add_reduce", kSig_i_iiii).addLocals(kWasmS128, 1).addBody([
+    kExprLocalGet, 0,
+    kSimdPrefix, kExprI32x4Splat,
+    kExprLocalGet, 1,
+    kSimdPrefix, kExprI32x4ReplaceLane, 1,
+    kExprLocalGet, 2,
+    kSimdPrefix, kExprI32x4ReplaceLane, 2,
+    kExprLocalGet, 3,
+    kSimdPrefix, kExprI32x4ReplaceLane, 3,
+    kExprLocalTee, 4,
+    kExprLocalGet, 4,
+    kExprLocalGet, 1,
+    kSimdPrefix, kExprI32x4Splat,                     // unused input
+    kSimdPrefix, kExprI8x16Shuffle,                   // upper-to-lower 32x4
+    0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    ...SimdInstr(kExprI32x4Add),                       // first step of reduction
+    kExprLocalTee, 4,
+    kExprLocalGet, 4,
+    kExprLocalGet, 4,
+    kSimdPrefix, kExprI8x16Shuffle,                   // upper-to-lower 32x2
+    0x04, 0x05, 0x06, 0x07, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    ...SimdInstr(kExprI32x4Add),                       // final step of reduction
+    kSimdPrefix, kExprI32x4ExtractLane, 0,
+  ]).exportFunc();
+
+  const wasm = builder.instantiate().exports;
+  for (let idxa = 0; idxa < int32_array.length; ++idxa) {
+    for (let idxb = 0; idxb < int32_array.length; ++idxb) {
+      const idxc = (idxa + 1) % int32_array.length;
+      const idxd = (idxb + 1) % int32_array.length;
+      const a = int32_array[idxa];
+      const b = int32_array[idxb];
+      const c = int32_array[idxc];
+      const d = int32_array[idxd];
+      const expected = 0xFFFFFFFF & (a + b + c + d);
+      assertEquals(expected, wasm.add_reduce(a, b, c, d));
+    }
+  }
+})();
+
+(function I32x4UpperToLowerReduceLeftAndRightMismatchNotSwizzle() {
+  print(arguments.callee.name);
+  const builder = new WasmModuleBuilder();
+  builder.addFunction("add_reduce", kSig_i_iiii).addLocals(kWasmS128, 1).addBody([
+    kExprLocalGet, 0,
+    kSimdPrefix, kExprI32x4Splat,
+    kExprLocalGet, 1,
+    kSimdPrefix, kExprI32x4ReplaceLane, 1,
+    kExprLocalGet, 2,
+    kSimdPrefix, kExprI32x4ReplaceLane, 2,
+    kExprLocalGet, 3,
+    kSimdPrefix, kExprI32x4ReplaceLane, 3,
+    kExprLocalTee, 4,
+    kExprLocalGet, 4,
+    kExprLocalGet, 1,
+    kSimdPrefix, kExprI32x4Splat,                     // unused input
+    kSimdPrefix, kExprI8x16Shuffle,                   // upper-to-lower 32x4
+    0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
+    0x10, 0x11, 0x12, 0x13, 0x10, 0x11, 0x12, 0x13,
+    ...SimdInstr(kExprI32x4Add),                       // first step of reduction
+    kExprLocalTee, 4,
+    kExprLocalGet, 4,
+    kExprLocalGet, 4,
+    kSimdPrefix, kExprI8x16Shuffle,                   // upper-to-lower 32x2
+    0x04, 0x05, 0x06, 0x07, 0x10, 0x11, 0x12, 0x13,
+    0x10, 0x11, 0x12, 0x13, 0x10, 0x11, 0x12, 0x13,
+    ...SimdInstr(kExprI32x4Add),                       // final step of reduction
+    kSimdPrefix, kExprI32x4ExtractLane, 0,
+  ]).exportFunc();
+
+  const wasm = builder.instantiate().exports;
+  for (let idxa = 0; idxa < int32_array.length; ++idxa) {
+    for (let idxb = 0; idxb < int32_array.length; ++idxb) {
+      const idxc = (idxa + 1) % int32_array.length;
+      const idxd = (idxb + 1) % int32_array.length;
+      const a = int32_array[idxa];
+      const b = int32_array[idxb];
+      const c = int32_array[idxc];
+      const d = int32_array[idxd];
+      const expected = 0xFFFFFFFF & (a + b + c + d);
+      assertEquals(expected, wasm.add_reduce(a, b, c, d));
+    }
+  }
+})();
+
 (function F32x4UpperToLowerReduce() {
   print(arguments.callee.name);
   const builder = new WasmModuleBuilder();
diff --git a/deps/v8/test/mjsunit/wasm/wasm-inlining-catch-unreachable.js b/deps/v8/test/mjsunit/wasm/wasm-inlining-catch-unreachable.js
index ada1eecf2de0c6..f62f7c131f6b0e 100644
--- a/deps/v8/test/mjsunit/wasm/wasm-inlining-catch-unreachable.js
+++ b/deps/v8/test/mjsunit/wasm/wasm-inlining-catch-unreachable.js
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax --wasm-staging
+// Flags: --wasm-allow-mixed-eh-for-testing
 
 // This test case reproduces an issue found in crbug.com/1508213 where
 // reachability is handled differently for unreachable catch blocks in liftoff
diff --git a/deps/v8/test/mjsunit/wasm/wasm-interpreter.js b/deps/v8/test/mjsunit/wasm/wasm-interpreter.js
index d7cecb89381b4e..dab48664439841 100644
--- a/deps/v8/test/mjsunit/wasm/wasm-interpreter.js
+++ b/deps/v8/test/mjsunit/wasm/wasm-interpreter.js
@@ -2918,7 +2918,7 @@ d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
   instance1.exports.main();
 })();
 
-(function TestInmportedCallToJSFunctionWithMultipleRefArgs() {
+(function TestImportedCallToJSFunctionWithMultipleRefArgs() {
   print(arguments.callee.name);
 
   const builder = new WasmModuleBuilder();
@@ -2976,3 +2976,203 @@ d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
 
   instance1.exports.main();
 })();
+
+(function TestInvalidBlockReturnTypesWithUnreachableCode() {
+  print(arguments.callee.name);
+  var builder = new WasmModuleBuilder();
+  var kSig_r_i = makeSig([kWasmI32], [kWasmExternRef]);
+  let sig_r_i = builder.addType(kSig_r_i);
+
+  builder.addFunction("main", kSig_i_v)
+    .addLocals(kWasmI32, 1)
+   .addBody([
+     ...wasmI32Const(1),
+     kExprLoop, sig_r_i,
+       kExprLocalGet, 0,
+       kExprBrIf, 1,
+       ...wasmI32Const(1),
+       kExprLocalSet, 0,
+       kExprBr, 0,
+     kExprEnd,
+     kExprUnreachable,
+    ])
+    .exportAs("main");
+
+  var instance = builder.instantiate();
+  instance.exports.main();
+})();
+
+(function TestTrapHandlerLandingPadOverwrite() {
+  print(arguments.callee.name);
+
+  let run_worker = () => {
+    function workerCode() {
+      onmessage = function () {
+        postMessage('done');
+      }
+    }
+    let worker = new Worker(workerCode, { type: 'function' });
+    worker.postMessage({});
+    worker.getMessage();
+    worker.terminate();
+  };
+
+  var builder = new WasmModuleBuilder();
+  var kSig_r_i = makeSig([kWasmI32], [kWasmExternRef]);
+  let sig_r_i = builder.addType(kSig_r_i);
+
+  // Function 0
+  builder.addImport("imports", "imported_func", kSig_v_v);
+
+  builder.addFunction("main", kSig_i_v)
+    .addLocals(kWasmI32, 1)
+   .addBody([
+      kExprCallFunction, 0, // call $import0
+     ...wasmI32Const(1000000),
+     kExprI32LoadMem, 0, 0, // trigger OOB
+    ])
+    .exportAs("main");
+  builder.addMemory(1, 1, false);
+
+  let instance = builder.instantiate({ imports: { imported_func: run_worker } });
+  assertThrows(() => instance.exports.main(), WebAssembly.RuntimeError);
+})();
+
+(function TestPassingAWasmExportedJSFunctionAsArgument() {
+  print(arguments.callee.name);
+  var builder = new WasmModuleBuilder();
+
+  let = f1 = builder.addImport("o", "fn", kSig_r_r);
+  builder.addExport("fn", 0);
+
+  builder.addFunction("main", kSig_r_r)
+    .addBody([
+      kExprLocalGet, 0,
+      ])
+    .exportAs("main");
+
+  var instance = builder.instantiate({
+    o: {
+      fn: (ref) => { return ref; },
+    }
+  });
+
+  let func = instance.exports.fn;
+  instance.exports.main(func);
+})();
+
+(function TestImportedJSFunctionThrowsZero() {
+  print(arguments.callee.name);
+
+  const builder = new WasmModuleBuilder();
+  var kSig_r_d = makeSig([kWasmF32], [kWasmExternRef]);
+
+  // Function 0
+  builder.addImport("o", "fn", kSig_r_d);
+
+  // Function 1
+  builder.addFunction("main", kSig_r_v)
+    .addBody([
+      ...wasmF32Const(3.14),
+      kExprCallFunction, 0,  // Calls fn.
+    ])
+    .exportAs("main");
+
+  function fn(val) {
+    throw 0;
+    return fn;
+  }
+
+  let instance = builder.instantiate({
+    o: {
+      fn: fn
+    }
+  });
+  try {
+    instance.exports.main();
+  }
+  catch (e) {
+    assertEquals(e, 0);
+  }
+})();
+
+(function TestGCInRecursiveRefCall() {
+  print(arguments.callee.name);
+
+  const builder = new WasmModuleBuilder();
+  let array_type_index = builder.addArray(kWasmI32, true);
+  var kSig_irlii_iiiiiiii = makeSig(
+    [kWasmI32, kWasmI32, kWasmI32, kWasmI32, kWasmI32, kWasmI32, kWasmI32, kWasmI32],
+    [kWasmI32, wasmRefNullType(array_type_index), kWasmI64, kWasmI32, kWasmI32]);
+  const sig_index = builder.addType(kSig_irlii_iiiiiiii);
+  let sig_v_v = builder.addType(kSig_v_v);
+
+  let f2 = builder.addFunction("f2", kSig_v_v)
+    .addBody([
+    ])
+    .exportFunc();
+
+  let f1 = builder.addFunction("f1", kSig_irlii_iiiiiiii)
+    .addLocals(kWasmI31Ref, 1)
+    .addLocals(kWasmI32, 2)
+    .addLocals(kWasmAnyFunc, 1)
+    .addLocals(kWasmI32, 15)
+    .addBody([
+      ...wasmI32Const(6520383),
+      kGCPrefix, kExprRefI31,
+      kExprLocalSet, 8,
+      kExprRefFunc, f2.index,
+      kExprLocalSet, 11,
+      ...wasmI32Const(5),
+      ...wasmI32Const(27725),
+      ...wasmI32Const(212471),
+      ...wasmI32Const(20),
+      kExprI32RemS,
+      kGCPrefix, kExprArrayNew, array_type_index,
+      ...wasmI64Const(-3892508980005251074),
+      ...wasmI32Const(15958772),
+      ...wasmI32Const(1707),
+    ])
+    .exportAs("f1");
+
+  builder.addFunction("main", kSig_v_iii)
+    .addLocals(kWasmF32, 1)
+    .addLocals(kWasmI32, 1)
+    .addBody([
+      ...wasmI32Const(7), // Loop count
+      kExprLocalSet, 4,
+      kExprLoop, sig_v_v,
+      ...wasmI32Const(97009),
+      ...wasmI32Const(722898),
+      ...wasmI32Const(68),
+      ...wasmI32Const(71592),
+      ...wasmI32Const(658174976),
+      ...wasmI32Const(6704202),
+      ...wasmI32Const(3865333),
+      ...wasmI32Const(909),
+      kExprRefFunc, f1.index,
+      kExprCallRef, sig_index,
+      kExprDrop,
+      kExprDrop,
+      kExprDrop,
+      kExprDrop,
+      kExprDrop,
+      kExprLocalGet, 4,
+      ...wasmI32Const(1),
+      kExprI32Sub,
+      kExprLocalTee, 4,
+      kExprIf, sig_v_v,
+      kExprBr, 1,
+      kExprEnd,
+      kExprEnd,
+      ...wasmI32Const(-34),
+      ...wasmI32Const(-82),
+      ...wasmI32Const(-19385),
+      kExprCallFunction, 2,
+    ])
+    .exportAs("main");
+
+  let instance = builder.instantiate({});
+  assertThrows(
+    () => instance.exports.main(0, 0, 0), RangeError);
+})();
diff --git a/deps/v8/test/test262/test262.status b/deps/v8/test/test262/test262.status
index f9c2b3813d0730..7bf0b310ba5e25 100644
--- a/deps/v8/test/test262/test262.status
+++ b/deps/v8/test/test262/test262.status
@@ -263,11 +263,6 @@
   # http://crbug/v8/10905
   'language/identifier-resolution/assign-to-global-undefined': [FAIL],
 
-  # https://bugs.chromium.org/p/v8/issues/detail?id=13174
-  'built-ins/RegExp/prototype/Symbol.replace/flags-tostring-error': [FAIL],
-  'built-ins/RegExp/prototype/Symbol.replace/get-flags-err': [FAIL],
-  'built-ins/RegExp/prototype/Symbol.replace/get-unicode-error': [FAIL],
-
   # https://bugs.chromium.org/p/v8/issues/detail?id=11544
   'built-ins/Temporal/Duration/prototype/total/balance-negative-result': [FAIL],
   'intl402/Temporal/Duration/prototype/total/relativeto-string-datetime': [FAIL],
@@ -996,7 +991,6 @@
   'intl402/Temporal/PlainYearMonth/prototype/with/non-iso-calendar-fields': [FAIL],
   'intl402/Temporal/ZonedDateTime/prototype/with/non-iso-calendar-fields': [FAIL],
 
-  'staging/Intl402/Temporal/old/islamic-calendars': [FAIL],
   'staging/Intl402/Temporal/old/persian-calendar': [FAIL],
 
   'built-ins/Temporal/Duration/prototype/round/round-and-balance-calendar-units-with-increment-disallowed': [FAIL],
@@ -1570,8 +1564,6 @@
   'annexB/language/comments/single-line-html-close-first-line-1': [SKIP],
   'annexB/language/comments/single-line-html-close-first-line-2': [SKIP],
   'annexB/language/comments/single-line-html-close-first-line-3': [SKIP],
-  'built-ins/ArrayBuffer/options-maxbytelength-compared-before-object-creation': [SKIP],
-  'built-ins/SharedArrayBuffer/options-maxbytelength-compared-before-object-creation': [SKIP],
   'built-ins/Temporal/Duration/compare/argument-duration-out-of-range': [SKIP],
   'built-ins/Temporal/Duration/compare/relativeto-plaindate-add24hourdaystonormalizedtimeduration-out-of-range': [SKIP],
   'built-ins/Temporal/Duration/from/argument-duration-out-of-range': [SKIP],
@@ -2145,29 +2137,6 @@
   'built-ins/Temporal/ZonedDateTime/prototype/toPlainDateTime/limits': [FAIL],
   'built-ins/Temporal/ZonedDateTime/prototype/toPlainDateTime/negative-epochnanoseconds': [FAIL],
   'built-ins/Temporal/ZonedDateTime/prototype/toPlainDateTime/pre-epoch': [FAIL],
-  'built-ins/Uint8Array/prototype/setFromBase64/alphabet': [FAIL],
-  'built-ins/Uint8Array/prototype/setFromBase64/descriptor': [FAIL],
-  'built-ins/Uint8Array/prototype/setFromBase64/detached-buffer': [FAIL],
-  'built-ins/Uint8Array/prototype/setFromBase64/illegal-characters': [FAIL],
-  'built-ins/Uint8Array/prototype/setFromBase64/last-chunk-handling': [FAIL],
-  'built-ins/Uint8Array/prototype/setFromBase64/length': [FAIL],
-  'built-ins/Uint8Array/prototype/setFromBase64/name': [FAIL],
-  'built-ins/Uint8Array/prototype/setFromBase64/nonconstructor': [FAIL],
-  'built-ins/Uint8Array/prototype/setFromBase64/option-coercion': [FAIL],
-  'built-ins/Uint8Array/prototype/setFromBase64/results': [FAIL],
-  'built-ins/Uint8Array/prototype/setFromBase64/subarray': [FAIL],
-  'built-ins/Uint8Array/prototype/setFromBase64/target-size': [FAIL],
-  'built-ins/Uint8Array/prototype/setFromBase64/whitespace': [FAIL],
-  'built-ins/Uint8Array/prototype/setFromBase64/writes-up-to-error': [FAIL],
-  'built-ins/Uint8Array/prototype/setFromHex/descriptor': [FAIL],
-  'built-ins/Uint8Array/prototype/setFromHex/illegal-characters': [FAIL],
-  'built-ins/Uint8Array/prototype/setFromHex/length': [FAIL],
-  'built-ins/Uint8Array/prototype/setFromHex/name': [FAIL],
-  'built-ins/Uint8Array/prototype/setFromHex/nonconstructor': [FAIL],
-  'built-ins/Uint8Array/prototype/setFromHex/results': [FAIL],
-  'built-ins/Uint8Array/prototype/setFromHex/subarray': [FAIL],
-  'built-ins/Uint8Array/prototype/setFromHex/target-size': [FAIL],
-  'built-ins/Uint8Array/prototype/setFromHex/writes-up-to-error': [FAIL],
   'intl402/Temporal/ZonedDateTime/from/zoneddatetime-sub-minute-offset': [FAIL],
   'intl402/Temporal/ZonedDateTime/prototype/toPlainDateTime/basic': [FAIL],
   'intl402/Temporal/ZonedDateTime/prototype/toPlainDateTime/dst': [FAIL],
@@ -2192,19 +2161,6 @@
 ####
 # Roll-watcher patch
 [ALWAYS, {
-  'built-ins/TypedArrayConstructors/internals/Set/BigInt/key-is-canonical-invalid-index-prototype-chain-set': [SKIP],
-  'built-ins/TypedArrayConstructors/internals/Set/BigInt/key-is-canonical-invalid-index-reflect-set': [SKIP],
-  'built-ins/TypedArrayConstructors/internals/Set/key-is-canonical-invalid-index-prototype-chain-set': [SKIP],
-  'built-ins/TypedArrayConstructors/internals/Set/key-is-canonical-invalid-index-reflect-set': [SKIP],
-}],
-# End roll-watcher patch
-####
-
-####
-# Roll-watcher patch
-[ALWAYS, {
-  'built-ins/TypedArrayConstructors/internals/Set/key-is-out-of-bounds-receiver-is-not-object': [SKIP],
-  'built-ins/TypedArrayConstructors/internals/Set/key-is-out-of-bounds-receiver-is-not-typed-array': [SKIP],
   'language/statements/with/get-mutable-binding-binding-deleted-in-get-unscopables-strict-mode': [SKIP],
   'language/statements/with/set-mutable-binding-binding-deleted-in-get-unscopables-strict-mode': [SKIP],
   'language/statements/with/set-mutable-binding-binding-deleted-with-typed-array-in-proto-chain-strict-mode': [SKIP],
@@ -2291,30 +2247,6 @@
 ####
 # Roll-watcher patch
 [ALWAYS, {
-  'built-ins/Date/prototype/setDate/date-value-read-before-tonumber-when-date-is-invalid': [SKIP],
-  'built-ins/Date/prototype/setDate/date-value-read-before-tonumber-when-date-is-valid': [SKIP],
-  'built-ins/Date/prototype/setHours/date-value-read-before-tonumber-when-date-is-invalid': [SKIP],
-  'built-ins/Date/prototype/setHours/date-value-read-before-tonumber-when-date-is-valid': [SKIP],
-  'built-ins/Date/prototype/setMilliseconds/date-value-read-before-tonumber-when-date-is-invalid': [SKIP],
-  'built-ins/Date/prototype/setMilliseconds/date-value-read-before-tonumber-when-date-is-valid': [SKIP],
-  'built-ins/Date/prototype/setMinutes/date-value-read-before-tonumber-when-date-is-invalid': [SKIP],
-  'built-ins/Date/prototype/setMinutes/date-value-read-before-tonumber-when-date-is-valid': [SKIP],
-  'built-ins/Date/prototype/setMonth/date-value-read-before-tonumber-when-date-is-invalid': [SKIP],
-  'built-ins/Date/prototype/setMonth/date-value-read-before-tonumber-when-date-is-valid': [SKIP],
-  'built-ins/Date/prototype/setSeconds/date-value-read-before-tonumber-when-date-is-invalid': [SKIP],
-  'built-ins/Date/prototype/setSeconds/date-value-read-before-tonumber-when-date-is-valid': [SKIP],
-  'built-ins/Date/prototype/setUTCDate/date-value-read-before-tonumber-when-date-is-invalid': [SKIP],
-  'built-ins/Date/prototype/setUTCDate/date-value-read-before-tonumber-when-date-is-valid': [SKIP],
-  'built-ins/Date/prototype/setUTCHours/date-value-read-before-tonumber-when-date-is-invalid': [SKIP],
-  'built-ins/Date/prototype/setUTCHours/date-value-read-before-tonumber-when-date-is-valid': [SKIP],
-  'built-ins/Date/prototype/setUTCMilliseconds/date-value-read-before-tonumber-when-date-is-invalid': [SKIP],
-  'built-ins/Date/prototype/setUTCMilliseconds/date-value-read-before-tonumber-when-date-is-valid': [SKIP],
-  'built-ins/Date/prototype/setUTCMinutes/date-value-read-before-tonumber-when-date-is-invalid': [SKIP],
-  'built-ins/Date/prototype/setUTCMinutes/date-value-read-before-tonumber-when-date-is-valid': [SKIP],
-  'built-ins/Date/prototype/setUTCMonth/date-value-read-before-tonumber-when-date-is-invalid': [SKIP],
-  'built-ins/Date/prototype/setUTCMonth/date-value-read-before-tonumber-when-date-is-valid': [SKIP],
-  'built-ins/Date/prototype/setUTCSeconds/date-value-read-before-tonumber-when-date-is-invalid': [SKIP],
-  'built-ins/Date/prototype/setUTCSeconds/date-value-read-before-tonumber-when-date-is-valid': [SKIP],
   'intl402/DurationFormat/prototype/format/duration-out-of-range-3': [SKIP],
   'intl402/DurationFormat/prototype/format/duration-out-of-range-4': [SKIP],
 }],
@@ -2483,7 +2415,6 @@
   'staging/sm/lexical-environment/var-in-catch-body-annex-b-eval': [FAIL],
   'staging/sm/object/clear-dictionary-accessor-getset': [FAIL],
   'staging/sm/object/values-entries-typedarray': [FAIL],
-  'staging/sm/RegExp/replace-trace': [FAIL],
   'staging/sm/regress/regress-1507322-deep-weakmap': [FAIL],
   'staging/sm/regress/regress-563221': [FAIL],
   'staging/sm/regress/regress-592556-c35': [FAIL],
@@ -2684,6 +2615,20 @@
 # end import test262@44d71fbe7dccabcc071cbe66cc4b105d896d3c2a
 ###
 
+####
+# import test262@4ba104a21c5f8ede20ee5105bc89fa9693c2bfe1
+[ALWAYS, {
+  'intl402/DateTimeFormat/canonicalize-timezone': [FAIL],
+  'intl402/Intl/supportedValuesOf/timeZones-include-non-continental': [FAIL],
+  'staging/Intl402/Temporal/old/islamic-calendars-islamic': [FAIL],
+  'staging/Intl402/Temporal/old/islamic-calendars-islamic-civil': [FAIL],
+  'staging/Intl402/Temporal/old/islamic-calendars-islamic-rgsa': [FAIL],
+  'staging/Intl402/Temporal/old/islamic-calendars-islamic-tbla': [FAIL],
+  'staging/Intl402/Temporal/old/islamic-calendars-islamic-umalqura': [FAIL],
+}],
+# end import test262@44d71fbe7dccabcc071cbe66cc4b105d896d3c2a
+###
+
 ####
 # Roll-watcher patch
 [ALWAYS, {
diff --git a/deps/v8/test/unittests/BUILD.gn b/deps/v8/test/unittests/BUILD.gn
index 2b12033787bc79..0ffca5c8b1077c 100644
--- a/deps/v8/test/unittests/BUILD.gn
+++ b/deps/v8/test/unittests/BUILD.gn
@@ -5,12 +5,7 @@
 import("../../gni/v8.gni")
 
 if (v8_enable_webassembly) {
-  # Specifies if the target build is a simulator build. Comparing target cpu
-  # with v8 target cpu to not affect simulator builds for making cross-compile
-  # snapshots.
-  target_is_simulator = (target_cpu != v8_target_cpu && !v8_multi_arch_build) ||
-                        (current_cpu != v8_current_cpu && v8_multi_arch_build)
-  if (!target_is_simulator && v8_current_cpu == "x64") {
+  if (!v8_target_is_simulator && v8_current_cpu == "x64") {
     v8_enable_wasm_simd256_revec = true
   }
 }
@@ -336,6 +331,7 @@ v8_source_set("v8_unittests_sources") {
     "gay-shortest.cc",
     "gay-shortest.h",
     "heap/allocation-observer-unittest.cc",
+    "heap/conservative-stack-visitor-unittest.cc",
     "heap/cppgc-js/embedder-roots-handler-unittest.cc",
     "heap/cppgc-js/traced-reference-unittest.cc",
     "heap/cppgc-js/unified-heap-snapshot-unittest.cc",
@@ -347,11 +343,13 @@ v8_source_set("v8_unittests_sources") {
     "heap/gc-tracer-unittest.cc",
     "heap/global-handles-unittest.cc",
     "heap/global-safepoint-unittest.cc",
+    "heap/heap-allocator-unittest.cc",
     "heap/heap-controller-unittest.cc",
     "heap/heap-unittest.cc",
     "heap/heap-utils.cc",
     "heap/heap-utils.h",
     "heap/index-generator-unittest.cc",
+    "heap/inner-pointer-resolution-unittest.cc",
     "heap/iterators-unittest.cc",
     "heap/list-unittest.cc",
     "heap/local-factory-unittest.cc",
@@ -648,11 +646,6 @@ v8_source_set("v8_unittests_sources") {
     sources += [ "wasm/wasm-gdbserver-unittest.cc" ]
   }
 
-  if (v8_enable_conservative_stack_scanning) {
-    sources += [ "heap/conservative-stack-visitor-unittest.cc" ]
-    sources += [ "heap/inner-pointer-resolution-unittest.cc" ]
-  }
-
   if (v8_enable_i18n_support) {
     defines = [ "V8_INTL_SUPPORT" ]
     public_deps = [ v8_icu_path ]
@@ -681,7 +674,8 @@ v8_source_set("v8_unittests_sources") {
       sources +=
           [ "compiler/arm64/turboshaft-instruction-selector-arm64-unittest.cc" ]
     }
-    if (v8_enable_webassembly && current_cpu == "arm64") {
+    if (v8_enable_webassembly && current_cpu == "arm64" &&
+        !v8_target_is_simulator) {
       sources += [ "wasm/trap-handler-native-unittest.cc" ]
     }
   } else if (v8_current_cpu == "x86") {
@@ -769,11 +763,13 @@ v8_source_set("v8_unittests_sources") {
       sources += [ "wasm/trap-handler-win-unittest.cc" ]
     }
 
-    # Include this test only on simulator builds on x64 on Linux, Mac and
-    # Windows.
-    if (current_cpu == "x64" &&
-        (v8_current_cpu == "arm64" || v8_current_cpu == "loong64" ||
-         v8_current_cpu == "riscv64") && (is_linux || is_mac || is_win)) {
+    # Include this test on simulator builds on x64 on Linux, Mac and
+    # Windows, and on simulator builds on arm64 on Linux and Mac.
+    if ((current_cpu == "x64" &&
+         (v8_current_cpu == "arm64" || v8_current_cpu == "loong64" ||
+          v8_current_cpu == "riscv64") && (is_linux || is_mac || is_win)) ||
+        (current_cpu == "arm64" && (is_linux || is_mac) &&
+         v8_target_is_simulator)) {
       sources += [ "wasm/trap-handler-simulator-unittest.cc" ]
     }
   }
diff --git a/deps/v8/test/unittests/api/api-wasm-unittest.cc b/deps/v8/test/unittests/api/api-wasm-unittest.cc
index eceef8a5423798..ea7e3b30d65d72 100644
--- a/deps/v8/test/unittests/api/api-wasm-unittest.cc
+++ b/deps/v8/test/unittests/api/api-wasm-unittest.cc
@@ -256,6 +256,7 @@ TEST_F(ApiWasmTest, WasmEnableDisableImportedStrings) {
 }
 
 TEST_F(ApiWasmTest, WasmEnableDisableJSPI) {
+  FLAG_VALUE_SCOPE(experimental_wasm_jspi, false);
   Local<Context> context_local = Context::New(isolate());
   Context::Scope context_scope(context_local);
   i::DirectHandle<i::NativeContext> context =
@@ -277,6 +278,7 @@ TEST_F(ApiWasmTest, WasmEnableDisableJSPI) {
 }
 
 TEST_F(ApiWasmTest, WasmInstallJSPI) {
+  FLAG_VALUE_SCOPE(experimental_wasm_jspi, false);
   Local<Context> context_local = Context::New(isolate());
   Context::Scope context_scope(context_local);
   i::DirectHandle<i::NativeContext> context =
diff --git a/deps/v8/test/unittests/assembler/disasm-arm64-unittest.cc b/deps/v8/test/unittests/assembler/disasm-arm64-unittest.cc
index 3f23817d36c8c6..ea941cd9fad928 100644
--- a/deps/v8/test/unittests/assembler/disasm-arm64-unittest.cc
+++ b/deps/v8/test/unittests/assembler/disasm-arm64-unittest.cc
@@ -789,6 +789,8 @@ TEST_F(DisasmArm64Test, branch) {
   COMPARE_PREFIX(b(INST_OFF(-0x8000000)), "b #-0x8000000");
   COMPARE_PREFIX(b(INST_OFF(0xffffc), eq), "b.eq #+0xffffc");
   COMPARE_PREFIX(b(INST_OFF(-0x100000), mi), "b.mi #-0x100000");
+  COMPARE_PREFIX(bc(INST_OFF(0xffffc), ge), "bc.ge #+0xffffc");
+  COMPARE_PREFIX(bc(INST_OFF(-0x100000), lt), "bc.lt #-0x100000");
   COMPARE_PREFIX(bl(INST_OFF(0x4)), "bl #+0x4");
   COMPARE_PREFIX(bl(INST_OFF(-0x4)), "bl #-0x4");
   COMPARE_PREFIX(bl(INST_OFF(0xffffc)), "bl #+0xffffc");
@@ -4718,6 +4720,19 @@ TEST_F(DisasmArm64Test, neon_2regmisc) {
   CLEANUP();
 }
 
+TEST_F(DisasmArm64Test, neon_sha3) {
+  SET_UP_MASM();
+
+  CpuFeatureScope feature_scope(assm, SHA3,
+                                CpuFeatureScope::kDontCheckSupported);
+  COMPARE(Bcax(v0.V16B(), v1.V16B(), v2.V16B(), v3.V16B()),
+          "bcax v0.16b, v1.16b, v2.16b, v3.16b");
+  COMPARE(Eor3(v10.V16B(), v11.V16B(), v12.V16B(), v13.V16B()),
+          "eor3 v10.16b, v11.16b, v12.16b, v13.16b");
+
+  CLEANUP();
+}
+
 TEST_F(DisasmArm64Test, neon_acrosslanes) {
   SET_UP_MASM();
 
@@ -5125,6 +5140,23 @@ TEST_F(DisasmArm64Test, neon_shift_immediate) {
   CLEANUP();
 }
 
+TEST_F(DisasmArm64Test, cssc) {
+  SET_UP_MASM();
+
+  CpuFeatureScope feature_scope(assm, CSSC,
+                                CpuFeatureScope::kDontCheckSupported);
+
+  COMPARE(Abs(w0, w22), "abs w0, w22");
+  COMPARE(Abs(x0, x23), "abs x0, x23");
+  COMPARE(Cnt(w21, w30), "cnt w21, w30");
+  COMPARE(Cnt(x19, x9), "cnt x19, x9");
+  COMPARE(Ctz(w3, w5), "ctz w3, w5");
+  COMPARE(Ctz(x3, x28), "ctz x3, x28");
+  COMPARE(Ctz(w0, wzr), "ctz w0, wzr");
+
+  CLEANUP();
+}
+
 #undef TEST_
 #undef EXP_SIZE
 #undef INSTR_SIZE
diff --git a/deps/v8/test/unittests/base/region-allocator-unittest.cc b/deps/v8/test/unittests/base/region-allocator-unittest.cc
index 4fe9fb3aa2bb32..19b20e7cd4db8a 100644
--- a/deps/v8/test/unittests/base/region-allocator-unittest.cc
+++ b/deps/v8/test/unittests/base/region-allocator-unittest.cc
@@ -372,6 +372,66 @@ TEST(RegionAllocatorTest, TrimRegion) {
   CHECK_EQ(ra.AllocateRegion(kSize), kBegin);
 }
 
+TEST(RegionAllocatorTest, TryGrowRegion) {
+  const size_t kPageSize = 4 * KB;
+  const size_t kPageCount = 60;
+  const size_t kSize = kPageSize * kPageCount;
+  const Address kBegin = static_cast<Address>(kPageSize * 153);
+
+  RegionAllocator ra(kBegin, kSize, kPageSize);
+
+  // Allocate the main region in the middle of the reservation initially.
+  Address address = kBegin + 10 * kPageSize;
+  size_t size = 10 * kPageSize;
+  CHECK(ra.AllocateRegionAt(address, size));
+
+  // Grow the allocation to 1 page before the end.
+  CHECK(ra.TryGrowRegion(address, 49 * kPageSize));
+  CHECK_EQ(ra.free_size(), 11 * kPageSize);
+
+  // Allocate in the free regions before and after the main allocation.
+  CHECK_EQ(ra.AllocateRegion(10 * kPageSize), kBegin);
+  CHECK_EQ(ra.AllocateRegion(kPageSize), kBegin + 59 * kPageSize);
+
+  // Free the regions around the main region again.
+  CHECK_EQ(ra.FreeRegion(kBegin), 10 * kPageSize);
+  CHECK_EQ(ra.free_size(), 10 * kPageSize);
+
+  CHECK_EQ(ra.FreeRegion(kBegin + 59 * kPageSize), kPageSize);
+  CHECK_EQ(ra.free_size(), 11 * kPageSize);
+
+  // Try to grow the region on purpose beyond the reservation.
+  CHECK(!ra.TryGrowRegion(address, 51 * kPageSize));
+  CHECK_EQ(ra.FreeRegion(address), 49 * kPageSize);
+  CHECK_EQ(ra.free_size(), 60 * kPageSize);
+}
+
+TEST(RegionAllocatorTest, TryGrowRegionLimitedByOtherRegion) {
+  const size_t kPageSize = 4 * KB;
+  const size_t kPageCount = 60;
+  const size_t kSize = kPageSize * kPageCount;
+  const Address kBegin = static_cast<Address>(kPageSize * 153);
+
+  RegionAllocator ra(kBegin, kSize, kPageSize);
+
+  // Allocate the main region in the middle of the reservation initially.
+  Address address = kBegin + 10 * kPageSize;
+  size_t size = 10 * kPageSize;
+  CHECK(ra.AllocateRegionAt(address, size));
+
+  // Place a barrier to growth, such that the previous region cannot be made
+  // larger than 30 pages.
+  CHECK(ra.AllocateRegionAt(kBegin + 40 * kPageSize, 10 * kPageSize));
+
+  // Growing to 31 pages should fail.
+  CHECK(!ra.TryGrowRegion(address, 31 * kPageSize));
+
+  // Grow region to 30 pages.
+  CHECK(ra.TryGrowRegion(address, 30 * kPageSize));
+  CHECK_EQ(ra.FreeRegion(address), 30 * kPageSize);
+  CHECK_EQ(ra.free_size(), 50 * kPageSize);
+}
+
 TEST(RegionAllocatorTest, AllocateExcluded) {
   const size_t kPageSize = 4 * KB;
   const size_t kPageCount = 64;
diff --git a/deps/v8/test/unittests/codegen/code-layout-unittest.cc b/deps/v8/test/unittests/codegen/code-layout-unittest.cc
index 213ea186a06610..c6a45204517ee5 100644
--- a/deps/v8/test/unittests/codegen/code-layout-unittest.cc
+++ b/deps/v8/test/unittests/codegen/code-layout-unittest.cc
@@ -34,8 +34,8 @@ TEST_F(CodeLayoutTest, CodeLayoutWithoutUnwindingInfo) {
   code_desc.handler_table_size = 0;
   code_desc.constant_pool_offset = buffer_size;
   code_desc.constant_pool_size = 0;
-  code_desc.builtin_jump_table_info_offset = buffer_size;
-  code_desc.builtin_jump_table_info_size = 0;
+  code_desc.jump_table_info_offset = buffer_size;
+  code_desc.jump_table_info_size = 0;
   code_desc.code_comments_offset = buffer_size;
   code_desc.code_comments_size = 0;
   code_desc.reloc_offset = buffer_size;
@@ -83,8 +83,8 @@ TEST_F(CodeLayoutTest, CodeLayoutWithUnwindingInfo) {
   code_desc.handler_table_size = 0;
   code_desc.constant_pool_offset = buffer_size;
   code_desc.constant_pool_size = 0;
-  code_desc.builtin_jump_table_info_offset = buffer_size;
-  code_desc.builtin_jump_table_info_size = 0;
+  code_desc.jump_table_info_offset = buffer_size;
+  code_desc.jump_table_info_size = 0;
   code_desc.code_comments_offset = buffer_size;
   code_desc.code_comments_size = 0;
   code_desc.reloc_offset = buffer_size;
diff --git a/deps/v8/test/unittests/compiler/arm64/turboshaft-instruction-selector-arm64-unittest.cc b/deps/v8/test/unittests/compiler/arm64/turboshaft-instruction-selector-arm64-unittest.cc
index 25d057156e36eb..10f2e0f07c2239 100644
--- a/deps/v8/test/unittests/compiler/arm64/turboshaft-instruction-selector-arm64-unittest.cc
+++ b/deps/v8/test/unittests/compiler/arm64/turboshaft-instruction-selector-arm64-unittest.cc
@@ -1648,6 +1648,58 @@ TEST_F(TurboshaftInstructionSelectorTest, EqualZeroAndBranch) {
   }
 }
 
+TEST_F(TurboshaftInstructionSelectorTest, BranchHints) {
+  {
+    StreamBuilder m(this, MachineType::Int64(), MachineType::Int64());
+    Block *a = m.NewBlock(), *b = m.NewBlock();
+    OpIndex p0 = m.Parameter(0);
+    m.Branch(m.Word64NotEqual(p0, m.Int64Constant(0)), a, b, BranchHint::kTrue);
+    m.Bind(a);
+    m.Return(m.Int64Constant(1));
+    m.Bind(b);
+    m.Return(m.Int64Constant(0));
+    Stream s = m.Build();
+    ASSERT_EQ(1U, s.size());
+    EXPECT_EQ(kArm64CompareAndBranch, s[0]->arch_opcode());
+    EXPECT_TRUE(s[0]->branch_hinted());
+    EXPECT_EQ(3U, s[0]->InputCount());
+    EXPECT_EQ(s.ToVreg(p0), s.ToVreg(s[0]->InputAt(0)));
+  }
+
+  {
+    StreamBuilder m(this, MachineType::Int64(), MachineType::Int32(),
+                    MachineType::Int32());
+    Block *a = m.NewBlock(), *b = m.NewBlock();
+    OpIndex p0 = m.Parameter(0);
+    OpIndex p1 = m.Parameter(1);
+    m.Branch(m.Int32LessThan(p0, p1), a, b, BranchHint::kFalse);
+    m.Bind(a);
+    m.Return(m.Int64Constant(1));
+    m.Bind(b);
+    m.Return(m.Int64Constant(0));
+    Stream s = m.Build();
+    EXPECT_EQ(kArm64Cmp32, s[0]->arch_opcode());
+    EXPECT_TRUE(s[0]->branch_hinted());
+    EXPECT_EQ(s.ToVreg(p0), s.ToVreg(s[0]->InputAt(0)));
+  }
+
+  {
+    StreamBuilder m(this, MachineType::Int64(), MachineType::Int64());
+    Block *a = m.NewBlock(), *b = m.NewBlock();
+    OpIndex p0 = m.Parameter(0);
+    m.Branch(m.Uint64LessThanOrEqual(p0, m.Int64Constant(42)), a, b,
+             BranchHint::kNone);
+    m.Bind(a);
+    m.Return(m.Int64Constant(1));
+    m.Bind(b);
+    m.Return(m.Int64Constant(0));
+    Stream s = m.Build();
+    EXPECT_EQ(kArm64Cmp, s[0]->arch_opcode());
+    EXPECT_EQ(kFlags_branch, s[0]->flags_mode());
+    EXPECT_FALSE(s[0]->branch_hinted());
+  }
+}
+
 TEST_F(TurboshaftInstructionSelectorTest, ConditionalCompares) {
   {
     StreamBuilder m(this, MachineType::Int32(), MachineType::Int32(),
@@ -1758,6 +1810,40 @@ TEST_F(TurboshaftInstructionSelectorTest, ConditionalCompares) {
     EXPECT_EQ(0x2d, s.ToInt32(s[0]->InputAt(1)));
     EXPECT_EQ(kFlags_conditional_branch, s[0]->flags_mode());
   }
+  {
+    // Test float32 support
+    StreamBuilder m(this, MachineType::Int64(), MachineType::Float32(),
+                    MachineType::Float32(), MachineType::Float32());
+    Block *a = m.NewBlock(), *b = m.NewBlock();
+    OpIndex cond_a = m.Float32Equal(m.Float32Constant(0.0), m.Parameter(0));
+    OpIndex cond_b = m.Float32LessThan(m.Parameter(1), m.Parameter(2));
+    m.Branch(m.Word32BitwiseOr(cond_a, cond_b), a, b);
+    m.Bind(a);
+    m.Return(m.Int64Constant(1));
+    m.Bind(b);
+    m.Return(m.Int64Constant(0));
+    Stream s = m.Build();
+    EXPECT_EQ(kArm64Float32Cmp, s[0]->arch_opcode());
+    EXPECT_EQ(kFlags_conditional_branch, s[0]->flags_mode());
+  }
+  {
+    // Test float64 support
+    StreamBuilder m(this, MachineType::Int64(), MachineType::Float64(),
+                    MachineType::Float64(), MachineType::Float64());
+    Block *a = m.NewBlock(), *b = m.NewBlock();
+    OpIndex cond_a = m.Float64Equal(m.Parameter(1), m.Parameter(0));
+    OpIndex not_cond_a = m.Word32Equal(cond_a, m.Int32Constant(0));
+    OpIndex cond_b =
+        m.Float64LessThanOrEqual(m.Parameter(2), m.Float64Constant(9.9));
+    m.Branch(m.Word32BitwiseAnd(not_cond_a, cond_b), a, b);
+    m.Bind(a);
+    m.Return(m.Int64Constant(1));
+    m.Bind(b);
+    m.Return(m.Int64Constant(0));
+    Stream s = m.Build();
+    EXPECT_EQ(kArm64Float64Cmp, s[0]->arch_opcode());
+    EXPECT_EQ(kFlags_conditional_branch, s[0]->flags_mode());
+  }
 }
 
 // -----------------------------------------------------------------------------
@@ -2153,6 +2239,168 @@ INSTANTIATE_TEST_SUITE_P(
     TurboshaftInstructionSelectorBranchIfOverflowTest,
     ::testing::ValuesIn(kOverflowBinaryOperationsForBranchFusion));
 
+// -----------------------------------------------------------------------------
+// Switches.
+
+namespace {
+template <typename StreamBuilder>
+void GenerateTestSwitch(OpIndex param, StreamBuilder& m, int n,
+                        SwitchOp::Case* cases) {
+  Block *default_case = m.NewBlock(), *end = m.NewBlock();
+  m.Switch(param, base::VectorOf(cases, n), default_case);
+  for (int i = 0; i < n; i++) {
+    auto c = cases[i];
+    m.Bind(c.destination);
+    m.Goto(end);
+  }
+  m.Bind(default_case);
+  m.Goto(end);
+
+  m.Bind(end);
+  m.Return(param);
+}
+}  // namespace
+
+TEST_F(TurboshaftInstructionSelectorTest, BinarySwitch) {
+  StreamBuilder m(this, MachineType::TaggedSigned(),
+                  MachineType::TaggedSigned());
+  OpIndex param = m.Parameter(0);
+  // We need more than 4 cases to generate a table switch.
+  SwitchOp::Case cases[] = {
+      {0, m.NewBlock(), BranchHint::kNone},
+      {1, m.NewBlock(), BranchHint::kNone},
+      {2, m.NewBlock(), BranchHint::kNone},
+  };
+  GenerateTestSwitch<StreamBuilder>(param, m, 3, cases);
+
+  Stream s = m.Build(kAllExceptNopInstructions);
+  EXPECT_EQ(kArchBinarySearchSwitch, s[0]->arch_opcode());
+  EXPECT_FALSE(s.BlockAt(1)->IsTableSwitchTarget());
+  EXPECT_FALSE(s.BlockAt(2)->IsTableSwitchTarget());
+  EXPECT_FALSE(s.BlockAt(3)->IsTableSwitchTarget());
+  EXPECT_FALSE(s.BlockAt(4)->IsTableSwitchTarget());
+}
+
+TEST_F(TurboshaftInstructionSelectorTest, TableSwitch) {
+  StreamBuilder m(this, MachineType::TaggedSigned(),
+                  MachineType::TaggedSigned());
+  OpIndex param = m.Parameter(0);
+  // We need more than 4 cases to generate a table switch.
+  SwitchOp::Case cases[] = {
+      {0, m.NewBlock(), BranchHint::kNone},
+      {1, m.NewBlock(), BranchHint::kNone},
+      {2, m.NewBlock(), BranchHint::kNone},
+      {3, m.NewBlock(), BranchHint::kNone},
+      {4, m.NewBlock(), BranchHint::kNone},
+  };
+  GenerateTestSwitch<StreamBuilder>(param, m, 5, cases);
+
+  Stream s = m.Build(kAllExceptNopInstructions);
+
+  EXPECT_EQ(kArm64Mov32, s[0]->arch_opcode());
+
+  EXPECT_EQ(kArchTableSwitch, s[1]->arch_opcode());
+  // With no gaps in the switch, the default block is not reached via an
+  // indirect jump.
+  EXPECT_FALSE(s.BlockAt(1)->IsTableSwitchTarget());
+  EXPECT_TRUE(s.BlockAt(2)->IsTableSwitchTarget());
+  EXPECT_TRUE(s.BlockAt(3)->IsTableSwitchTarget());
+  EXPECT_TRUE(s.BlockAt(4)->IsTableSwitchTarget());
+  EXPECT_TRUE(s.BlockAt(5)->IsTableSwitchTarget());
+  EXPECT_TRUE(s.BlockAt(6)->IsTableSwitchTarget());
+}
+
+TEST_F(TurboshaftInstructionSelectorTest, TableSwitchWithGaps) {
+  StreamBuilder m(this, MachineType::TaggedSigned(),
+                  MachineType::TaggedSigned());
+  OpIndex param = m.Parameter(0);
+  // We need more than 4 cases to generate a table switch.
+  SwitchOp::Case cases[] = {
+      {0, m.NewBlock(), BranchHint::kNone},
+      {1, m.NewBlock(), BranchHint::kNone},
+      // 2: Gap
+      {3, m.NewBlock(), BranchHint::kNone},
+      {4, m.NewBlock(), BranchHint::kNone},
+      // 5: Gap
+      {6, m.NewBlock(), BranchHint::kNone},
+  };
+  GenerateTestSwitch<StreamBuilder>(param, m, 5, cases);
+
+  Stream s = m.Build(kAllExceptNopInstructions);
+
+  EXPECT_EQ(kArm64Mov32, s[0]->arch_opcode());
+
+  EXPECT_EQ(kArchTableSwitch, s[1]->arch_opcode());
+  // The gaps mean that the default block may be reached via an indirect jump.
+  EXPECT_TRUE(s.BlockAt(1)->IsTableSwitchTarget());
+  EXPECT_TRUE(s.BlockAt(2)->IsTableSwitchTarget());
+  EXPECT_TRUE(s.BlockAt(3)->IsTableSwitchTarget());
+  EXPECT_TRUE(s.BlockAt(4)->IsTableSwitchTarget());
+  EXPECT_TRUE(s.BlockAt(5)->IsTableSwitchTarget());
+  EXPECT_TRUE(s.BlockAt(6)->IsTableSwitchTarget());
+}
+
+TEST_F(TurboshaftInstructionSelectorTest, TableSwitchImplicitZeroExtend) {
+  StreamBuilder m(this, MachineType::TaggedSigned(),
+                  MachineType::TaggedSigned());
+  OpIndex param = m.Parameter(0);
+  // We need more than 4 cases to generate a table switch.
+  SwitchOp::Case cases[] = {
+      {0, m.NewBlock(), BranchHint::kNone},
+      {1, m.NewBlock(), BranchHint::kNone},
+      {2, m.NewBlock(), BranchHint::kNone},
+      {3, m.NewBlock(), BranchHint::kNone},
+      {4, m.NewBlock(), BranchHint::kNone},
+  };
+  GenerateTestSwitch<StreamBuilder>(
+      m.Word32BitwiseAnd(param, m.Int32Constant(0xff)), m, 5, cases);
+
+  Stream s = m.Build(kAllExceptNopInstructions);
+
+  EXPECT_EQ(kArm64And32, s[0]->arch_opcode());
+
+  EXPECT_EQ(kArchTableSwitch, s[1]->arch_opcode());
+  // With no gaps in the switch, the default block is not reached via an
+  // indirect jump.
+  EXPECT_FALSE(s.BlockAt(1)->IsTableSwitchTarget());
+  EXPECT_TRUE(s.BlockAt(2)->IsTableSwitchTarget());
+  EXPECT_TRUE(s.BlockAt(3)->IsTableSwitchTarget());
+  EXPECT_TRUE(s.BlockAt(4)->IsTableSwitchTarget());
+  EXPECT_TRUE(s.BlockAt(5)->IsTableSwitchTarget());
+  EXPECT_TRUE(s.BlockAt(6)->IsTableSwitchTarget());
+}
+
+TEST_F(TurboshaftInstructionSelectorTest, TableSwitchNonZeroMinimum) {
+  StreamBuilder m(this, MachineType::TaggedSigned(),
+                  MachineType::TaggedSigned());
+  OpIndex param = m.Parameter(0);
+  // We need more than 4 cases to generate a table switch.
+  SwitchOp::Case cases[] = {
+      {42, m.NewBlock(), BranchHint::kNone},
+      {43, m.NewBlock(), BranchHint::kNone},
+      {44, m.NewBlock(), BranchHint::kNone},
+      {45, m.NewBlock(), BranchHint::kNone},
+      {46, m.NewBlock(), BranchHint::kNone},
+  };
+  GenerateTestSwitch<StreamBuilder>(param, m, 5, cases);
+
+  Stream s = m.Build(kAllExceptNopInstructions);
+
+  EXPECT_EQ(kArm64Sub32, s[0]->arch_opcode());
+  EXPECT_TRUE(s[0]->InputAt(1)->IsImmediate());
+  EXPECT_EQ(42, s.ToInt32(s[0]->InputAt(1)));
+
+  EXPECT_EQ(kArchTableSwitch, s[1]->arch_opcode());
+  // With no gaps in the switch, the default block is not reached via an
+  // indirect jump.
+  EXPECT_FALSE(s.BlockAt(1)->IsTableSwitchTarget());
+  EXPECT_TRUE(s.BlockAt(2)->IsTableSwitchTarget());
+  EXPECT_TRUE(s.BlockAt(3)->IsTableSwitchTarget());
+  EXPECT_TRUE(s.BlockAt(4)->IsTableSwitchTarget());
+  EXPECT_TRUE(s.BlockAt(5)->IsTableSwitchTarget());
+  EXPECT_TRUE(s.BlockAt(6)->IsTableSwitchTarget());
+}
+
 // -----------------------------------------------------------------------------
 // Shift instructions.
 
@@ -3647,6 +3895,97 @@ TEST_F(TurboshaftInstructionSelectorTest, LoadTwoMultiple) {
 
 #endif  // V8_ENABLE_INTERLEAVE_MEM_OPS
 
+TEST_F(TurboshaftInstructionSelectorTest, Sha3Test) {
+  const MachineType type = MachineType::Simd128();
+  {
+    StreamBuilder m(this, type, type, type, type);
+    m.Return(m.S128Xor(m.Parameter(0),
+                       m.S128AndNot(m.Parameter(1), m.Parameter(2))));
+    Stream s = m.Build();
+    if (CpuFeatures::IsSupported(SHA3)) {
+      ASSERT_EQ(1U, s.size());
+      EXPECT_EQ(kArm64Bcax, s[0]->arch_opcode());
+      EXPECT_EQ(s.ToVreg(m.Parameter(0)), s.ToVreg(s[0]->InputAt(0)));
+      EXPECT_EQ(s.ToVreg(m.Parameter(1)), s.ToVreg(s[0]->InputAt(1)));
+      EXPECT_EQ(s.ToVreg(m.Parameter(2)), s.ToVreg(s[0]->InputAt(2)));
+      EXPECT_EQ(1U, s[0]->OutputCount());
+    } else {
+      ASSERT_EQ(2U, s.size());
+      EXPECT_EQ(kArm64S128AndNot, s[0]->arch_opcode());
+      EXPECT_EQ(kArm64S128Xor, s[1]->arch_opcode());
+      EXPECT_EQ(s.ToVreg(m.Parameter(0)), s.ToVreg(s[1]->InputAt(0)));
+      EXPECT_EQ(s.ToVreg(m.Parameter(1)), s.ToVreg(s[0]->InputAt(0)));
+      EXPECT_EQ(s.ToVreg(m.Parameter(2)), s.ToVreg(s[0]->InputAt(1)));
+      EXPECT_EQ(1U, s[0]->OutputCount());
+    }
+  }
+  {
+    StreamBuilder m(this, type, type, type, type);
+    m.Return(m.S128Xor(m.S128AndNot(m.Parameter(0), m.Parameter(1)),
+                       m.Parameter(2)));
+    Stream s = m.Build();
+    if (CpuFeatures::IsSupported(SHA3)) {
+      EXPECT_EQ(kArm64Bcax, s[0]->arch_opcode());
+      ASSERT_EQ(1U, s.size());
+      EXPECT_EQ(s.ToVreg(m.Parameter(2)), s.ToVreg(s[0]->InputAt(0)));
+      EXPECT_EQ(s.ToVreg(m.Parameter(0)), s.ToVreg(s[0]->InputAt(1)));
+      EXPECT_EQ(s.ToVreg(m.Parameter(1)), s.ToVreg(s[0]->InputAt(2)));
+      EXPECT_EQ(1U, s[0]->OutputCount());
+    } else {
+      ASSERT_EQ(2U, s.size());
+      EXPECT_EQ(kArm64S128AndNot, s[0]->arch_opcode());
+      EXPECT_EQ(kArm64S128Xor, s[1]->arch_opcode());
+      EXPECT_EQ(s.ToVreg(m.Parameter(0)), s.ToVreg(s[0]->InputAt(0)));
+      EXPECT_EQ(s.ToVreg(m.Parameter(1)), s.ToVreg(s[0]->InputAt(1)));
+      EXPECT_EQ(s.ToVreg(m.Parameter(2)), s.ToVreg(s[1]->InputAt(1)));
+      EXPECT_EQ(1U, s[0]->OutputCount());
+    }
+  }
+  {
+    StreamBuilder m(this, type, type, type, type);
+    m.Return(
+        m.S128Xor(m.Parameter(0), m.S128Xor(m.Parameter(1), m.Parameter(2))));
+    Stream s = m.Build();
+    if (CpuFeatures::IsSupported(SHA3)) {
+      EXPECT_EQ(kArm64Eor3, s[0]->arch_opcode());
+      ASSERT_EQ(1U, s.size());
+      EXPECT_EQ(s.ToVreg(m.Parameter(0)), s.ToVreg(s[0]->InputAt(0)));
+      EXPECT_EQ(s.ToVreg(m.Parameter(1)), s.ToVreg(s[0]->InputAt(1)));
+      EXPECT_EQ(s.ToVreg(m.Parameter(2)), s.ToVreg(s[0]->InputAt(2)));
+      EXPECT_EQ(1U, s[0]->OutputCount());
+    } else {
+      EXPECT_EQ(kArm64S128Xor, s[0]->arch_opcode());
+      EXPECT_EQ(kArm64S128Xor, s[1]->arch_opcode());
+      ASSERT_EQ(2U, s.size());
+      EXPECT_EQ(s.ToVreg(m.Parameter(0)), s.ToVreg(s[1]->InputAt(0)));
+      EXPECT_EQ(s.ToVreg(m.Parameter(1)), s.ToVreg(s[0]->InputAt(0)));
+      EXPECT_EQ(s.ToVreg(m.Parameter(2)), s.ToVreg(s[0]->InputAt(1)));
+      EXPECT_EQ(1U, s[0]->OutputCount());
+    }
+  }
+  {
+    StreamBuilder m(this, type, type, type, type);
+    m.Return(
+        m.S128Xor(m.S128Xor(m.Parameter(0), m.Parameter(1)), m.Parameter(2)));
+    Stream s = m.Build();
+    if (CpuFeatures::IsSupported(SHA3)) {
+      EXPECT_EQ(kArm64Eor3, s[0]->arch_opcode());
+      ASSERT_EQ(1U, s.size());
+      EXPECT_EQ(s.ToVreg(m.Parameter(2)), s.ToVreg(s[0]->InputAt(0)));
+      EXPECT_EQ(s.ToVreg(m.Parameter(0)), s.ToVreg(s[0]->InputAt(1)));
+      EXPECT_EQ(s.ToVreg(m.Parameter(1)), s.ToVreg(s[0]->InputAt(2)));
+      EXPECT_EQ(1U, s[0]->OutputCount());
+    } else {
+      EXPECT_EQ(kArm64S128Xor, s[0]->arch_opcode());
+      EXPECT_EQ(kArm64S128Xor, s[1]->arch_opcode());
+      ASSERT_EQ(2U, s.size());
+      EXPECT_EQ(s.ToVreg(m.Parameter(0)), s.ToVreg(s[0]->InputAt(0)));
+      EXPECT_EQ(s.ToVreg(m.Parameter(1)), s.ToVreg(s[0]->InputAt(1)));
+      EXPECT_EQ(s.ToVreg(m.Parameter(2)), s.ToVreg(s[1]->InputAt(1)));
+      EXPECT_EQ(1U, s[0]->OutputCount());
+    }
+  }
+}
 #endif  // V8_ENABLE_WEBASSEMBLY
 
 TEST_F(TurboshaftInstructionSelectorTest, Word32MulWithImmediate) {
diff --git a/deps/v8/test/unittests/compiler/backend/turboshaft-instruction-selector-unittest.cc b/deps/v8/test/unittests/compiler/backend/turboshaft-instruction-selector-unittest.cc
index 3d11dfac2150b3..70e357380e30fc 100644
--- a/deps/v8/test/unittests/compiler/backend/turboshaft-instruction-selector-unittest.cc
+++ b/deps/v8/test/unittests/compiler/backend/turboshaft-instruction-selector-unittest.cc
@@ -73,6 +73,7 @@ TurboshaftInstructionSelectorTest::StreamBuilder::Build(
   }
   Stream s;
   s.virtual_registers_ = selector.GetVirtualRegistersForTesting();
+  s.instruction_blocks_ = instruction_blocks;
   // Map virtual registers.
   for (Instruction* const instr : sequence) {
     if (instr->opcode() < 0) continue;
diff --git a/deps/v8/test/unittests/compiler/backend/turboshaft-instruction-selector-unittest.h b/deps/v8/test/unittests/compiler/backend/turboshaft-instruction-selector-unittest.h
index 0b4422ac43cacd..a99ef0336b2f14 100644
--- a/deps/v8/test/unittests/compiler/backend/turboshaft-instruction-selector-unittest.h
+++ b/deps/v8/test/unittests/compiler/backend/turboshaft-instruction-selector-unittest.h
@@ -490,6 +490,10 @@ class TurboshaftInstructionSelectorTest : public TestWithNativeContextAndZone {
       return instructions_[index];
     }
 
+    const InstructionBlock* BlockAt(size_t index) {
+      return instruction_blocks_->at(index);
+    }
+
     bool IsDouble(const InstructionOperand* operand) const {
       return IsDouble(ToVreg(operand));
     }
@@ -596,6 +600,7 @@ class TurboshaftInstructionSelectorTest : public TestWithNativeContextAndZone {
     ConstantMap constants_;
     ConstantMap immediates_;
     std::deque<Instruction*> instructions_;
+    InstructionBlocks* instruction_blocks_;
     std::set<int> doubles_;
     std::set<int> references_;
     VirtualRegisters virtual_registers_;
diff --git a/deps/v8/test/unittests/compiler/compiler-unittest.cc b/deps/v8/test/unittests/compiler/compiler-unittest.cc
index 6a52b8425fde9b..0da40769ddbd63 100644
--- a/deps/v8/test/unittests/compiler/compiler-unittest.cc
+++ b/deps/v8/test/unittests/compiler/compiler-unittest.cc
@@ -970,7 +970,6 @@ TEST_F(BackgroundMergeTest, GCDuringMerge) {
 
   // Compile the script once to warm up the compilation cache.
   IndirectHandle<JSFunction> old_g;
-  IsCompiledScope old_g_bytecode_keepalive;
   ([&]() V8_NOINLINE {
     // Compile in a new handle scope inside a non-inlined function, so that the
     // script can die while select inner functions stay alive.
diff --git a/deps/v8/test/unittests/compiler/function-tester.cc b/deps/v8/test/unittests/compiler/function-tester.cc
index 7ae035564636eb..373d121ec6aad9 100644
--- a/deps/v8/test/unittests/compiler/function-tester.cc
+++ b/deps/v8/test/unittests/compiler/function-tester.cc
@@ -59,7 +59,7 @@ FunctionTester::FunctionTester(Isolate* isolate, DirectHandle<Code> code,
       flags_(0) {
   CHECK(!code.is_null());
   Compile(function);
-  function->UpdateCode(*code);
+  function->UpdateCode(isolate, *code);
 }
 
 void FunctionTester::CheckThrows(Handle<Object> a) {
diff --git a/deps/v8/test/unittests/compiler/js-typed-lowering-unittest.cc b/deps/v8/test/unittests/compiler/js-typed-lowering-unittest.cc
index ffc26d0f1e74ce..69e42d98e4e28f 100644
--- a/deps/v8/test/unittests/compiler/js-typed-lowering-unittest.cc
+++ b/deps/v8/test/unittests/compiler/js-typed-lowering-unittest.cc
@@ -319,26 +319,26 @@ TEST_F(JSTypedLoweringTest, JSShiftRightLogicalWithUnsigned32AndUnsigned32) {
   EXPECT_THAT(r.replacement(), IsNumberShiftRightLogical(lhs, rhs));
 }
 
-
 // -----------------------------------------------------------------------------
-// JSLoadContext
-
+// JSLoadContextNoCell
 
-TEST_F(JSTypedLoweringTest, JSLoadContext) {
+TEST_F(JSTypedLoweringTest, JSLoadContextNoCell) {
   Node* const context = Parameter(Type::Any());
   Node* const effect = graph()->start();
   static bool kBooleans[] = {false, true};
   TRACED_FOREACH(size_t, index, kIndices) {
     TRACED_FOREACH(bool, immutable, kBooleans) {
-      Reduction const r1 = Reduce(graph()->NewNode(
-          javascript()->LoadContext(0, index, immutable), context, effect));
+      Reduction const r1 = Reduce(
+          graph()->NewNode(javascript()->LoadContextNoCell(0, index, immutable),
+                           context, effect));
       ASSERT_TRUE(r1.Changed());
       EXPECT_THAT(r1.replacement(),
                   IsLoadField(AccessBuilder::ForContextSlot(index), context,
                               effect, graph()->start()));
 
-      Reduction const r2 = Reduce(graph()->NewNode(
-          javascript()->LoadContext(1, index, immutable), context, effect));
+      Reduction const r2 = Reduce(
+          graph()->NewNode(javascript()->LoadContextNoCell(1, index, immutable),
+                           context, effect));
       ASSERT_TRUE(r2.Changed());
       EXPECT_THAT(
           r2.replacement(),
@@ -351,12 +351,10 @@ TEST_F(JSTypedLoweringTest, JSLoadContext) {
   }
 }
 
-
 // -----------------------------------------------------------------------------
-// JSStoreContext
+// JSStoreContextNoCell
 
-
-TEST_F(JSTypedLoweringTest, JSStoreContext) {
+TEST_F(JSTypedLoweringTest, JSStoreContextNoCell) {
   Node* const context = Parameter(Type::Any());
   Node* const effect = graph()->start();
   Node* const control = graph()->start();
@@ -365,16 +363,16 @@ TEST_F(JSTypedLoweringTest, JSStoreContext) {
       Node* const value = Parameter(type);
 
       Reduction const r1 =
-          Reduce(graph()->NewNode(javascript()->StoreContext(0, index), value,
-                                  context, effect, control));
+          Reduce(graph()->NewNode(javascript()->StoreContextNoCell(0, index),
+                                  value, context, effect, control));
       ASSERT_TRUE(r1.Changed());
       EXPECT_THAT(r1.replacement(),
                   IsStoreField(AccessBuilder::ForContextSlot(index), context,
                                value, effect, control));
 
       Reduction const r2 =
-          Reduce(graph()->NewNode(javascript()->StoreContext(1, index), value,
-                                  context, effect, control));
+          Reduce(graph()->NewNode(javascript()->StoreContextNoCell(1, index),
+                                  value, context, effect, control));
       ASSERT_TRUE(r2.Changed());
       EXPECT_THAT(
           r2.replacement(),
@@ -387,7 +385,6 @@ TEST_F(JSTypedLoweringTest, JSStoreContext) {
   }
 }
 
-
 // -----------------------------------------------------------------------------
 // JSLoadNamed
 
diff --git a/deps/v8/test/unittests/compiler/node-test-utils.cc b/deps/v8/test/unittests/compiler/node-test-utils.cc
index acbe5ddb40871f..a3aa32cbc2feab 100644
--- a/deps/v8/test/unittests/compiler/node-test-utils.cc
+++ b/deps/v8/test/unittests/compiler/node-test-utils.cc
@@ -1327,11 +1327,11 @@ class IsToNumberMatcher final : public TestNodeMatcher {
   const Matcher<Node*> control_matcher_;
 };
 
-class IsLoadContextMatcher final : public TestNodeMatcher {
+class IsLoadContextNoCellMatcher final : public TestNodeMatcher {
  public:
-  IsLoadContextMatcher(const Matcher<ContextAccess>& access_matcher,
-                       const Matcher<Node*>& context_matcher)
-      : TestNodeMatcher(IrOpcode::kJSLoadContext),
+  IsLoadContextNoCellMatcher(const Matcher<ContextAccess>& access_matcher,
+                             const Matcher<Node*>& context_matcher)
+      : TestNodeMatcher(IrOpcode::kJSLoadContextNoCell),
         access_matcher_(access_matcher),
         context_matcher_(context_matcher) {}
 
@@ -2173,13 +2173,12 @@ Matcher<Node*> IsToNumber(const Matcher<Node*>& base_matcher,
                                            effect_matcher, control_matcher));
 }
 
-
-Matcher<Node*> IsLoadContext(const Matcher<ContextAccess>& access_matcher,
-                             const Matcher<Node*>& context_matcher) {
-  return MakeMatcher(new IsLoadContextMatcher(access_matcher, context_matcher));
+Matcher<Node*> IsLoadContextNoCell(const Matcher<ContextAccess>& access_matcher,
+                                   const Matcher<Node*>& context_matcher) {
+  return MakeMatcher(
+      new IsLoadContextNoCellMatcher(access_matcher, context_matcher));
 }
 
-
 Matcher<Node*> IsParameter(const Matcher<int> index_matcher) {
   return MakeMatcher(new IsParameterMatcher(index_matcher));
 }
diff --git a/deps/v8/test/unittests/compiler/node-test-utils.h b/deps/v8/test/unittests/compiler/node-test-utils.h
index 66a9d825b6e8ca..872c2d51f9159e 100644
--- a/deps/v8/test/unittests/compiler/node-test-utils.h
+++ b/deps/v8/test/unittests/compiler/node-test-utils.h
@@ -472,8 +472,8 @@ Matcher<Node*> IsToNumber(const Matcher<Node*>& base_matcher,
                           const Matcher<Node*>& context_matcher,
                           const Matcher<Node*>& effect_matcher,
                           const Matcher<Node*>& control_matcher);
-Matcher<Node*> IsLoadContext(const Matcher<ContextAccess>& access_matcher,
-                             const Matcher<Node*>& context_matcher);
+Matcher<Node*> IsLoadContextNoCell(const Matcher<ContextAccess>& access_matcher,
+                                   const Matcher<Node*>& context_matcher);
 Matcher<Node*> IsNumberToBoolean(const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsNumberToInt32(const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsNumberToUint32(const Matcher<Node*>& input_matcher);
diff --git a/deps/v8/test/unittests/compiler/regalloc/register-allocator-unittest.cc b/deps/v8/test/unittests/compiler/regalloc/register-allocator-unittest.cc
index 713fe3b17fc3c5..64c9e2dc478454 100644
--- a/deps/v8/test/unittests/compiler/regalloc/register-allocator-unittest.cc
+++ b/deps/v8/test/unittests/compiler/regalloc/register-allocator-unittest.cc
@@ -99,7 +99,7 @@ class RegisterAllocatorTest : public InstructionSequenceTest {
     }
 
     turboshaft::Pipeline pipeline(&data);
-    pipeline.AllocateRegisters(config(), nullptr, true);
+    CHECK(pipeline.AllocateRegisters(config(), nullptr, true));
   }
 };
 
diff --git a/deps/v8/test/unittests/compiler/riscv32/turboshaft-instruction-selector-riscv32-unittest.cc b/deps/v8/test/unittests/compiler/riscv32/turboshaft-instruction-selector-riscv32-unittest.cc
index 8688669ca0cdb7..c9ef3d0692eed6 100644
--- a/deps/v8/test/unittests/compiler/riscv32/turboshaft-instruction-selector-riscv32-unittest.cc
+++ b/deps/v8/test/unittests/compiler/riscv32/turboshaft-instruction-selector-riscv32-unittest.cc
@@ -50,18 +50,18 @@ const FPCmp kFPCmpInstructions[] = {
      kEqual},
     {{TSBinop::kFloat64LessThan, "Float64LessThan", kRiscvCmpD,
       MachineType::Float64()},
-     kUnsignedLessThan},
+     kFloatLessThan},
     {{TSBinop::kFloat64LessThanOrEqual, "Float64LessThanOrEqual", kRiscvCmpD,
       MachineType::Float64()},
-     kUnsignedLessThanOrEqual},
-    //TODO(riscv): ADD kFloat64GreaterThan/kFloat64GreaterThanOrEqual
-    // in turboshaft-unittestes.
-    // {{TSBinop::kFloat64GreaterThan, "Float64GreaterThan",
-    //   kRiscvCmpD, MachineType::Float64()},
-    //  kUnsignedLessThan},
-    // {{TSBinop::kFloat64GreaterThanOrEqual,
-    //   "Float64GreaterThanOrEqual", kRiscvCmpD, MachineType::Float64()},
-    //  kUnsignedLessThanOrEqual}
+     kFloatLessThanOrEqual},
+    // TODO(riscv): ADD kFloat64GreaterThan/kFloat64GreaterThanOrEqual
+    //  in turboshaft-unittestes.
+    //  {{TSBinop::kFloat64GreaterThan, "Float64GreaterThan",
+    //    kRiscvCmpD, MachineType::Float64()},
+    //   kUnsignedLessThan},
+    //  {{TSBinop::kFloat64GreaterThanOrEqual,
+    //    "Float64GreaterThanOrEqual", kRiscvCmpD, MachineType::Float64()},
+    //   kUnsignedLessThanOrEqual}
 };
 
 struct Conversion {
diff --git a/deps/v8/test/unittests/compiler/riscv64/turboshaft-instruction-selector-riscv64-unittest.cc b/deps/v8/test/unittests/compiler/riscv64/turboshaft-instruction-selector-riscv64-unittest.cc
index 23f9d33af31a5a..72d34aff5cd293 100644
--- a/deps/v8/test/unittests/compiler/riscv64/turboshaft-instruction-selector-riscv64-unittest.cc
+++ b/deps/v8/test/unittests/compiler/riscv64/turboshaft-instruction-selector-riscv64-unittest.cc
@@ -51,10 +51,10 @@ const FPCmp kFPCmpInstructions[] = {
      kEqual},
     {{TSBinop::kFloat64LessThan, "Float64LessThan", kRiscvCmpD,
       MachineType::Float64()},
-     kUnsignedLessThan},
+     kFloatLessThan},
     {{TSBinop::kFloat64LessThanOrEqual, "Float64LessThanOrEqual", kRiscvCmpD,
       MachineType::Float64()},
-     kUnsignedLessThanOrEqual},
+     kFloatLessThanOrEqual},
     // {{TSBinop::kFloat64GreaterThan, "Float64GreaterThan",
     //   kRiscvCmpD, MachineType::Float64()},
     //  kUnsignedLessThan},
diff --git a/deps/v8/test/unittests/compiler/run-bytecode-graph-builder-unittest.cc b/deps/v8/test/unittests/compiler/run-bytecode-graph-builder-unittest.cc
index ec3746538e8502..c5db863d0919c1 100644
--- a/deps/v8/test/unittests/compiler/run-bytecode-graph-builder-unittest.cc
+++ b/deps/v8/test/unittests/compiler/run-bytecode-graph-builder-unittest.cc
@@ -1607,7 +1607,7 @@ TEST_F(RunBytecodeGraphBuilderTest, BytecodeGraphBuilderContext) {
   }
 }
 
-TEST_F(RunBytecodeGraphBuilderTest, BytecodeGraphBuilderLoadContext) {
+TEST_F(RunBytecodeGraphBuilderTest, BytecodeGraphBuilderLoadContextNoCell) {
   Isolate* isolate = i_isolate();
   Factory* factory = isolate->factory();
 
diff --git a/deps/v8/test/unittests/flags/flag-definitions-unittest.cc b/deps/v8/test/unittests/flags/flag-definitions-unittest.cc
index 1099a90c4ed133..ae91ce6dbd33a1 100644
--- a/deps/v8/test/unittests/flags/flag-definitions-unittest.cc
+++ b/deps/v8/test/unittests/flags/flag-definitions-unittest.cc
@@ -361,7 +361,6 @@ TEST(FlagContradictionsTest, ResolvesNegContradictions) {
   FlagList::EnforceFlagImplications();
   CHECK(v8_flags.fuzzing);
   CHECK(!v8_flags.turbofan);
-  CHECK(!v8_flags.always_osr_from_maglev);
   CHECK(!v8_flags.osr_from_maglev);
 #endif
 }
diff --git a/deps/v8/test/unittests/heap/cppgc-js/unified-heap-utils.cc b/deps/v8/test/unittests/heap/cppgc-js/unified-heap-utils.cc
index bec3edec7b0940..e9fad7e6805372 100644
--- a/deps/v8/test/unittests/heap/cppgc-js/unified-heap-utils.cc
+++ b/deps/v8/test/unittests/heap/cppgc-js/unified-heap-utils.cc
@@ -10,6 +10,7 @@
 #include "src/api/api-inl.h"
 #include "src/heap/cppgc-js/cpp-heap.h"
 #include "src/heap/heap.h"
+#include "src/objects/cpp-heap-object-wrapper-inl.h"
 #include "src/objects/js-objects.h"
 #include "src/objects/objects-inl.h"
 #include "test/unittests/heap/heap-utils.h"
@@ -48,7 +49,7 @@ void WrapperHelper::ResetWrappableConnection(v8::Isolate* isolate,
                                              v8::Local<v8::Object> api_object) {
   i::DirectHandle<i::JSReceiver> js_obj =
       v8::Utils::OpenDirectHandle(*api_object);
-  JSApiWrapper(Cast<JSObject>(*js_obj))
+  CppHeapObjectWrapper(Cast<JSObject>(*js_obj))
       .SetCppHeapWrappable<CppHeapPointerTag::kDefaultTag>(
           reinterpret_cast<i::Isolate*>(isolate), nullptr);
 }
@@ -59,7 +60,7 @@ void WrapperHelper::SetWrappableConnection(v8::Isolate* isolate,
                                            void* instance) {
   i::DirectHandle<i::JSReceiver> js_obj =
       v8::Utils::OpenDirectHandle(*api_object);
-  JSApiWrapper(Cast<JSObject>(*js_obj))
+  CppHeapObjectWrapper(Cast<JSObject>(*js_obj))
       .SetCppHeapWrappable<CppHeapPointerTag::kDefaultTag>(
           reinterpret_cast<i::Isolate*>(isolate), instance);
 }
@@ -69,7 +70,7 @@ void* WrapperHelper::ReadWrappablePointer(v8::Isolate* isolate,
                                           v8::Local<v8::Object> api_object) {
   i::DirectHandle<i::JSReceiver> js_obj =
       v8::Utils::OpenDirectHandle(*api_object);
-  return JSApiWrapper(Cast<JSObject>(*js_obj))
+  return CppHeapObjectWrapper(Cast<JSObject>(*js_obj))
       .GetCppHeapWrappable(reinterpret_cast<i::Isolate*>(isolate),
                            kAnyCppHeapPointer);
 }
diff --git a/deps/v8/test/unittests/heap/cppgc/member-unittest.cc b/deps/v8/test/unittests/heap/cppgc/member-unittest.cc
index e7cf2517391ddf..b164a75039540a 100644
--- a/deps/v8/test/unittests/heap/cppgc/member-unittest.cc
+++ b/deps/v8/test/unittests/heap/cppgc/member-unittest.cc
@@ -13,6 +13,7 @@
 #include "include/cppgc/internal/pointer-policies.h"
 #include "include/cppgc/persistent.h"
 #include "include/cppgc/sentinel-pointer.h"
+#include "include/cppgc/tagged-member.h"
 #include "include/cppgc/type-traits.h"
 #include "test/unittests/heap/cppgc/tests.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -762,5 +763,56 @@ TEST_F(MemberTest, CompressedPointerFindCandidates) {
 
 #endif  // defined(CPPGC_CAGED_HEAP)
 
+// Define two distinct tag types for TaggedUncompressedMember
+struct TestTag1 {};
+struct TestTag2 {};
+
+TEST_F(MemberTest, TaggedUncompressedMemberSetAsAndStateChange) {
+  auto* obj1 = MakeGarbageCollected<GCed>(GetAllocationHandle());
+  auto* obj2 = MakeGarbageCollected<GCed>(GetAllocationHandle());
+  subtle::TaggedUncompressedMember<GCed, TestTag1, TestTag2> member(TestTag1{},
+                                                                    obj1);
+
+  // Change pointer, keep TestTag1.
+  member.SetAs<TestTag1>(obj2);
+  EXPECT_TRUE(member.Is<TestTag1>());
+  EXPECT_EQ(obj2, member.GetUntagged());
+  EXPECT_EQ(obj2, member.GetAs<TestTag1>());
+
+  // Change to TestTag2 with obj1.
+  member.SetAs<TestTag2>(obj1);
+  EXPECT_TRUE(member.Is<TestTag2>());
+  EXPECT_FALSE(member.Is<TestTag1>());
+  EXPECT_EQ(obj1, member.GetUntagged());
+  EXPECT_EQ(obj1, member.GetAs<TestTag2>());
+
+  // Change back to TestTag1 with obj2.
+  member.SetAs<TestTag1>(obj2);
+  EXPECT_TRUE(member.Is<TestTag1>());
+  EXPECT_EQ(obj2, member.GetUntagged());
+}
+
+TEST_F(MemberTest, TaggedUncompressedMemberTryGetAs) {
+  auto* obj = MakeGarbageCollected<GCed>(GetAllocationHandle());
+
+  // Constructed with TestTag1.
+  subtle::TaggedUncompressedMember<GCed, TestTag1, TestTag2> member_t1(
+      TestTag1{}, obj);
+  EXPECT_EQ(obj, member_t1.TryGetAs<TestTag1>());
+  EXPECT_EQ(nullptr, member_t1.TryGetAs<TestTag2>());
+
+  // Constructed with TestTag2.
+  subtle::TaggedUncompressedMember<GCed, TestTag1, TestTag2> member_t2(
+      TestTag2{}, obj);
+  EXPECT_EQ(nullptr, member_t2.TryGetAs<TestTag1>());
+  EXPECT_EQ(obj, member_t2.TryGetAs<TestTag2>());
+
+  // Test with nullptr.
+  subtle::TaggedUncompressedMember<GCed, TestTag1, TestTag2> member_null(
+      TestTag1{}, nullptr);
+  EXPECT_EQ(nullptr, member_null.TryGetAs<TestTag1>());
+  EXPECT_EQ(nullptr, member_null.TryGetAs<TestTag2>());
+}
+
 }  // namespace internal
 }  // namespace cppgc
diff --git a/deps/v8/test/unittests/heap/gc-tracer-unittest.cc b/deps/v8/test/unittests/heap/gc-tracer-unittest.cc
index 86e0006f38e630..5f31ddcd812e74 100644
--- a/deps/v8/test/unittests/heap/gc-tracer-unittest.cc
+++ b/deps/v8/test/unittests/heap/gc-tracer-unittest.cc
@@ -73,10 +73,8 @@ void StopTracing(Heap* heap, GarbageCollector collector,
   tracer->StopObservablePause(collector, time.value_or(base::TimeTicks::Now()));
   switch (collector) {
     case GarbageCollector::SCAVENGER:
-      tracer->StopYoungCycleIfNeeded();
-      break;
     case GarbageCollector::MINOR_MARK_SWEEPER:
-      tracer->NotifyYoungSweepingCompleted();
+      tracer->NotifyYoungSweepingCompletedAndStopCycleIfFinished();
       break;
     case GarbageCollector::MARK_COMPACTOR:
       if (heap->cpp_heap()) {
@@ -90,7 +88,7 @@ void StopTracing(Heap* heap, GarbageCollector collector,
         stats_collector->NotifySweepingCompleted(
             cppgc::Heap::SweepingType::kAtomic);
       }
-      tracer->NotifyFullSweepingCompleted();
+      tracer->NotifyFullSweepingCompletedAndStopCycleIfFinished();
       break;
   }
 }
@@ -250,12 +248,6 @@ TEST_F(GCTracerTest, IncrementalMarkingSpeed) {
   tracer->AddIncrementalMarkingStep(100, 1000000);
   EXPECT_EQ(1000000 / 100,
             tracer->IncrementalMarkingSpeedInBytesPerMillisecond());
-  if (!v8_flags.separate_gc_phases) {
-    // Scavenger has no impact on incremental marking details.
-    StartTracing(tracer, GarbageCollector::SCAVENGER,
-                 StartTracingMode::kAtomic);
-    StopTracing(i_isolate()->heap(), GarbageCollector::SCAVENGER);
-  }
   // 1000000 bytes in 100ms.
   tracer->AddIncrementalMarkingStep(100, 1000000);
   EXPECT_EQ(base::TimeDelta::FromMilliseconds(300),
@@ -381,12 +373,6 @@ TEST_F(GCTracerTest, BackgroundMajorMCScope) {
                          base::TimeDelta::FromMilliseconds(200));
   tracer->AddScopeSample(GCTracer::Scope::MC_BACKGROUND_MARKING,
                          base::TimeDelta::FromMilliseconds(10));
-  if (!v8_flags.separate_gc_phases) {
-    // Scavenger should not affect the major mark-compact scopes.
-    StartTracing(tracer, GarbageCollector::SCAVENGER,
-                 StartTracingMode::kAtomic);
-    StopTracing(i_isolate()->heap(), GarbageCollector::SCAVENGER);
-  }
   tracer->AddScopeSample(GCTracer::Scope::MC_BACKGROUND_SWEEPING,
                          base::TimeDelta::FromMilliseconds(20));
   tracer->AddScopeSample(GCTracer::Scope::MC_BACKGROUND_MARKING,
diff --git a/deps/v8/test/unittests/heap/heap-allocator-unittest.cc b/deps/v8/test/unittests/heap/heap-allocator-unittest.cc
new file mode 100644
index 00000000000000..c5c32d3adcc553
--- /dev/null
+++ b/deps/v8/test/unittests/heap/heap-allocator-unittest.cc
@@ -0,0 +1,54 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "include/v8-isolate.h"
+#include "src/common/assert-scope.h"
+#include "src/common/globals.h"
+#include "src/handles/handles-inl.h"
+#include "src/handles/handles.h"
+#include "src/heap/local-factory-inl.h"
+#include "src/objects/fixed-array.h"
+#include "src/objects/slots-inl.h"
+#include "test/unittests/test-utils.h"
+
+namespace v8 {
+namespace internal {
+
+using HeapAllocatorTest = TestWithIsolate;
+
+TEST_F(HeapAllocatorTest, TryResizeLargeObject) {
+  if (!COMPRESS_POINTERS_BOOL) return;
+  Isolate* i_isolate = this->i_isolate();
+  HeapAllocator* allocator = i_isolate->main_thread_local_heap()->allocator();
+  v8::Isolate::Scope isolate_scope(this->v8_isolate());
+  HandleScope scope(i_isolate);
+  constexpr size_t kInitialElements = 64 * KB;
+  constexpr size_t kResizedElements = 2 * kInitialElements;
+  Handle<FixedArray> array = i_isolate->factory()->NewFixedArray(
+      kInitialElements, AllocationType::kYoung);
+  ReadOnlyRoots roots{i_isolate};
+
+  for (size_t i = kInitialElements; i < kResizedElements; i++) {
+    CHECK(allocator->TryResizeLargeObject(
+        *array, FixedArray::SizeFor(static_cast<int>(i)),
+        FixedArray::SizeFor(static_cast<int>(i + 1))));
+    array->set_capacity(static_cast<int>(i + 1));
+    MemsetTagged((*array)->RawFieldOfElementAt(static_cast<int>(i)),
+                 roots.undefined_value(), 1);
+
+    if (i % 20'000 == 0) {
+      InvokeMinorGC();
+    }
+  }
+
+  CHECK_EQ(roots.undefined_value(), array->get(0));
+  CHECK_EQ(roots.undefined_value(), array->get(kInitialElements - 1));
+  CHECK_EQ(roots.undefined_value(), array->get(kInitialElements));
+  CHECK_EQ(roots.undefined_value(), array->get(kResizedElements - 1));
+
+  InvokeMajorGC();
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/test/unittests/heap/heap-unittest.cc b/deps/v8/test/unittests/heap/heap-unittest.cc
index bf8a0042d8573d..15732593b8895c 100644
--- a/deps/v8/test/unittests/heap/heap-unittest.cc
+++ b/deps/v8/test/unittests/heap/heap-unittest.cc
@@ -287,7 +287,7 @@ void ShrinkNewSpace(NewSpace* new_space) {
     stats_collector->NotifySweepingCompleted(
         cppgc::Heap::SweepingType::kAtomic);
   }
-  tracer->NotifyFullSweepingCompleted();
+  tracer->NotifyFullSweepingCompletedAndStopCycleIfFinished();
 }
 }  // namespace
 
@@ -314,9 +314,8 @@ TEST_F(HeapTest, GrowAndShrinkNewSpace) {
   // Explicitly growing should double the space capacity.
   size_t old_capacity, new_capacity;
   old_capacity = new_space->TotalCapacity();
-  GrowNewSpace();
+  GrowNewSpaceToMaximumCapacity();
   new_capacity = new_space->TotalCapacity();
-  CHECK_EQ(2 * old_capacity, new_capacity);
 
   old_capacity = new_space->TotalCapacity();
   {
@@ -345,7 +344,7 @@ TEST_F(HeapTest, GrowAndShrinkNewSpace) {
     // objects.
     CHECK_GE(old_capacity, new_capacity);
   } else {
-    CHECK_EQ(old_capacity, 2 * new_capacity);
+    CHECK_EQ(new_capacity, new_space->MinimumCapacity());
   }
 
   // Consecutive shrinking should not affect space capacity.
@@ -367,18 +366,13 @@ TEST_F(HeapTest, CollectingAllAvailableGarbageShrinksNewSpace) {
   v8::Isolate* iso = reinterpret_cast<v8::Isolate*>(isolate());
   v8::HandleScope scope(iso);
   NewSpace* new_space = heap()->new_space();
-  size_t old_capacity, new_capacity;
-  old_capacity = new_space->TotalCapacity();
-  GrowNewSpace();
-  new_capacity = new_space->TotalCapacity();
-  CHECK_EQ(2 * old_capacity, new_capacity);
+  GrowNewSpaceToMaximumCapacity();
   {
     v8::HandleScope temporary_scope(iso);
     SimulateFullSpace(new_space);
   }
   InvokeMemoryReducingMajorGCs();
-  new_capacity = new_space->TotalCapacity();
-  CHECK_EQ(old_capacity, new_capacity);
+  CHECK_EQ(new_space->TotalCapacity(), new_space->MinimumCapacity());
 }
 
 // Test that HAllocateObject will always return an object in new-space.
@@ -457,8 +451,7 @@ TEST_F(HeapTest, RememberedSet_InsertOnPromotingObjectToOld) {
     SimulateFullSpace(new_space, &handles);
     IsolateSafepointScope scope(heap);
     // New empty pages should remain in new space.
-    heap->ExpandNewSpaceSizeForTesting();
-    CHECK(new_space->EnsureCurrentCapacity());
+    GrowNewSpaceToMaximumCapacity();
   }
   InvokeMinorGC();
   CHECK(HeapLayout::InYoungGeneration(*arr));
@@ -529,7 +522,6 @@ TEST_F(HeapTest, SemiSpaceNewSpaceGrowsDuringFullGCIncrementalMarking) {
   if (!v8_flags.incremental_marking) return;
   if (v8_flags.single_generation) return;
   if (v8_flags.minor_ms) return;
-  v8_flags.separate_gc_phases = true;
   ManualGCScope manual_gc_scope(isolate());
 
   HandleScope handle_scope(isolate());
@@ -717,79 +709,9 @@ TEST_F(HeapTest, ContainsSlow) {
   CHECK(!heap->lo_space()->ContainsSlow(0));
 }
 
-#if defined(V8_COMPRESS_POINTERS) && defined(V8_ENABLE_SANDBOX)
-TEST_F(HeapTest, Regress364396306) {
-  if (v8_flags.single_generation) return;
-  if (v8_flags.separate_gc_phases) return;
-  if (v8_flags.minor_ms) return;
-
-  auto* iso = i_isolate();
-  auto* heap = iso->heap();
-  auto* space = heap->young_external_pointer_space();
-  ManualGCScope manual_gc_scope(iso);
-
-  int* external_int = new int;
-
-  {
-    {
-      // Almost fill a segment with unreachable entries. Leave behind one unused
-      // entry.
-      v8::HandleScope scope(reinterpret_cast<v8::Isolate*>(iso));
-      do {
-        iso->factory()->NewExternal(external_int);
-      } while (space->freelist_length() > 1);
-    }
-    {
-      v8::HandleScope scope(reinterpret_cast<v8::Isolate*>(iso));
-      // Allocate one reachable entry on the same segment to prevent discarding
-      // the segment.
-      iso->factory()->NewExternal(external_int);
-      CHECK_EQ(1, space->NumSegmentsForTesting());
-      // Allocate an entry on a new segment that will later be evacuated.
-      DirectHandle<JSObject> to_be_evacuated =
-          iso->factory()->NewExternal(external_int);
-      CHECK_EQ(2, space->NumSegmentsForTesting());
-      CHECK(HeapLayout::InYoungGeneration(*to_be_evacuated));
-      // Unmark to-be-evacuated entry and populate the freelist.
-      InvokeMinorGC();
-      CHECK(HeapLayout::InYoungGeneration(*to_be_evacuated));
-      // Set up a global to make sure `to_be_evacuated` is visited before the
-      // atomic pause.
-      Global<JSObject> global_to_be_evacuated(
-          v8_isolate(), Utils::Convert<JSObject, JSObject>(to_be_evacuated));
-      // Make sure compaction is enabled for the space so that an evacuation
-      // entry is created for `to_be_evacuated`.
-      bool old_stress_compaction_flag =
-          std::exchange(v8_flags.stress_compaction, true);
-      heap->StartIncrementalMarking(GCFlag::kNoFlags,
-                                    GarbageCollectionReason::kTesting);
-      // Finish all available marking work to make sure the to-be-evacuated
-      // entry is already marked.
-      heap->incremental_marking()->AdvanceForTesting(
-          v8::base::TimeDelta::Max());
-      // Reset the `stress_compaction` flag. If it remains enabled, the minor
-      // GCs below will be overriden with full GCs.
-      v8_flags.stress_compaction = old_stress_compaction_flag;
-    }
-
-    // The to-be-evacuated entry is no longer reachable. Scavenger will override
-    // the evacuation entry with a null address.
-    InvokeMinorGC();
-    // Iterating over segments again should not crash because of the null
-    // address set by the previous Scavenger.
-    InvokeMinorGC();
-  }
-
-  // Finalize the incremental GC so there are no references to `external_int`
-  // before we free it.
-  InvokeMajorGC();
-
-  delete external_int;
-}
-#endif  // defined(V8_COMPRESS_POINTERS) && defined(V8_ENABLE_SANDBOX)
-
-TEST_F(HeapTest,
-       PinningScavengerDoesntMoveObjectReachableFromStackNoPromotion) {
+TEST_F(
+    HeapTest,
+    ConservativePinningScavengerDoesntMoveObjectReachableFromStackNoPromotion) {
   if (v8_flags.single_generation) return;
   if (v8_flags.minor_ms) return;
   v8_flags.scavenger_conservative_object_pinning = true;
@@ -823,7 +745,8 @@ TEST_F(HeapTest,
   CHECK_NE(number_address, number->address());
 }
 
-TEST_F(HeapTest, PinningScavengerDoesntMoveObjectReachableFromStack) {
+TEST_F(HeapTest,
+       ConservativePinningScavengerDoesntMoveObjectReachableFromStack) {
   if (v8_flags.single_generation) return;
   if (v8_flags.minor_ms) return;
   v8_flags.scavenger_conservative_object_pinning = true;
@@ -851,7 +774,7 @@ TEST_F(HeapTest, PinningScavengerDoesntMoveObjectReachableFromStack) {
   CHECK_EQ(number_address, number->address());
 }
 
-TEST_F(HeapTest, PinningScavengerObjectWithSelfReference) {
+TEST_F(HeapTest, ConservativePinningScavengerObjectWithSelfReference) {
   if (v8_flags.single_generation) return;
   if (v8_flags.minor_ms) return;
   v8_flags.scavenger_conservative_object_pinning = true;
diff --git a/deps/v8/test/unittests/heap/heap-utils.h b/deps/v8/test/unittests/heap/heap-utils.h
index 3cf0bae6b3745b..7b968dcb1e88e6 100644
--- a/deps/v8/test/unittests/heap/heap-utils.h
+++ b/deps/v8/test/unittests/heap/heap-utils.h
@@ -106,11 +106,10 @@ class WithHeapInternals : public TMixin, HeapInternalsBase {
     return HeapInternalsBase::SimulateFullSpace(space);
   }
 
-  void GrowNewSpace() {
+  void GrowNewSpaceToMaximumCapacity() {
     IsolateSafepointScope scope(heap());
     NewSpace* new_space = heap()->new_space();
-    heap()->ExpandNewSpaceSizeForTesting();
-    CHECK(new_space->EnsureCurrentCapacity());
+    new_space->GrowToMaximumCapacityForTesting();
   }
 
   void SealCurrentObjects() {
diff --git a/deps/v8/test/unittests/heap/inner-pointer-resolution-unittest.cc b/deps/v8/test/unittests/heap/inner-pointer-resolution-unittest.cc
index f62ce8d3951f9f..95cccfb57b088e 100644
--- a/deps/v8/test/unittests/heap/inner-pointer-resolution-unittest.cc
+++ b/deps/v8/test/unittests/heap/inner-pointer-resolution-unittest.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "src/flags/flags.h"
 #include "src/heap/conservative-stack-visitor-inl.h"
 #include "src/heap/gc-tracer.h"
 #include "test/unittests/heap/heap-utils.h"
@@ -57,8 +58,8 @@ class InnerPointerResolutionTest
   InnerPointerResolutionTest& operator=(const InnerPointerResolutionTest&) =
       delete;
 
-  Heap* heap() { return isolate()->heap(); }
-  MemoryAllocator* allocator() { return heap()->memory_allocator(); }
+  Heap* heap() const { return isolate()->heap(); }
+  MemoryAllocator* allocator() const { return heap()->memory_allocator(); }
 
   // Create, free and lookup pages, normal or large.
 
@@ -259,13 +260,20 @@ class InnerPointerResolutionTest
       RunTestInside(object, object.size - 1);
     }
     for (auto [id, page] : pages_) {
-      const Address outside_ptr = page->ChunkAddress() + 1;
+      const Address outside_ptr = page->area_start() - 3;
       DCHECK_LE(page->ChunkAddress(), outside_ptr);
       RunTestOutside(outside_ptr);
     }
     RunTestOutside(kNullAddress);
     RunTestOutside(static_cast<Address>(42));
-    RunTestOutside(static_cast<Address>(kZapValue));
+    if (!IsZapPageAllocated()) {
+      RunTestOutside(static_cast<Address>(kZapValue));
+    }
+  }
+
+  bool IsZapPageAllocated() const {
+    return allocator()->LookupChunkContainingAddress(
+               static_cast<Address>(kZapValue)) != nullptr;
   }
 
  private:
@@ -588,6 +596,8 @@ using InnerPointerResolutionHeapTest =
     WithInnerPointerResolutionMixin<TestWithHeapInternalsAndContext>;
 
 TEST_F(InnerPointerResolutionHeapTest, UnusedRegularYoungPages) {
+  if (v8_flags.single_generation) return;
+
   ManualGCScope manual_gc_scope(isolate());
   DisableConservativeStackScanningScopeForTesting no_stack_scanning(heap());
 
@@ -728,6 +738,8 @@ TEST_F(InnerPointerResolutionHeapTest, UnusedRegularYoungPages) {
 }
 
 TEST_F(InnerPointerResolutionHeapTest, UnusedLargeYoungPage) {
+  if (v8_flags.single_generation) return;
+
   ManualGCScope manual_gc_scope(isolate());
   DisableConservativeStackScanningScopeForTesting no_stack_scanning(heap());
 
@@ -769,35 +781,6 @@ TEST_F(InnerPointerResolutionHeapTest, UnusedLargeYoungPage) {
   EXPECT_EQ(kNullAddress, ResolveInnerPointer(inner_ptr));
 }
 
-TEST_F(InnerPointerResolutionHeapTest, RegularPageAfterEnd) {
-  auto allocator = heap()->memory_allocator();
-
-  // Allocate a regular page.
-  OldSpace* old_space = heap()->old_space();
-  DCHECK_NE(nullptr, old_space);
-  auto* page = allocator->AllocatePage(
-      MemoryAllocator::AllocationMode::kRegular, old_space, NOT_EXECUTABLE);
-  EXPECT_NE(nullptr, page);
-
-  // The end of the page area is expected not to coincide with the beginning of
-  // the next page.
-  const int size = (1 << kPageSizeBits) / 2;
-  const Address mark = page->area_start() + size;
-  heap()->CreateFillerObjectAt(page->area_start(), size);
-  heap()->CreateFillerObjectAt(mark, static_cast<int>(page->area_end() - mark));
-  PageMetadata::UpdateHighWaterMark(mark);
-  page->ShrinkToHighWaterMark();
-  EXPECT_FALSE(PageMetadata::IsAlignedToPageSize(page->area_end()));
-
-  // Inner pointer resolution after the end of the page area should work.
-  Address inner_ptr = page->area_end() + kTaggedSize;
-  EXPECT_FALSE(PageMetadata::IsAlignedToPageSize(inner_ptr));
-  EXPECT_EQ(kNullAddress, ResolveInnerPointer(inner_ptr));
-
-  // Deallocate the page.
-  allocator->Free(MemoryAllocator::FreeMode::kImmediately, page);
-}
-
 TEST_F(InnerPointerResolutionHeapTest, LargePageAfterEnd) {
   auto allocator = heap()->memory_allocator();
 
diff --git a/deps/v8/test/unittests/heap/local-heap-unittest.cc b/deps/v8/test/unittests/heap/local-heap-unittest.cc
index eef784aea670db..e9082b3f5c957c 100644
--- a/deps/v8/test/unittests/heap/local-heap-unittest.cc
+++ b/deps/v8/test/unittests/heap/local-heap-unittest.cc
@@ -8,6 +8,7 @@
 
 #include "src/base/platform/condition-variable.h"
 #include "src/base/platform/mutex.h"
+#include "src/heap/gc-callbacks-inl.h"
 #include "src/heap/heap.h"
 #include "src/heap/parked-scope.h"
 #include "src/heap/safepoint.h"
@@ -184,5 +185,52 @@ TEST_F(LocalHeapTest, GCEpilogue) {
   }
 }
 
+class DirectPointerUser final : public GCRootsProvider {
+ public:
+  DirectPointerUser() = default;
+
+  Tagged<FixedArray> array() const { return array_; }
+  void set_array(Handle<FixedArray> array) { array_ = *array; }
+
+  void Iterate(RootVisitor* v) final {
+    v->VisitRootPointer(Root::kStrongRoots, nullptr, FullObjectSlot(&array_));
+  }
+
+ private:
+  Tagged<FixedArray> array_;
+};
+
+TEST_F(LocalHeapTest, RootsProvider) {
+  Factory* factory = i_isolate()->factory();
+  v8::Isolate::Scope isolate_scope(v8_isolate());
+  HandleScope global_handle_scope(i_isolate());
+  ManualGCScope manual_gc_scope(i_isolate());
+
+  LocalHeap* lh = i_isolate()->heap()->main_thread_local_heap();
+  auto data = std::make_unique<DirectPointerUser>();
+  GCRootsProviderScope roots_provider_scope(lh, data.get());
+
+  {
+    HandleScope handle_scope(i_isolate());
+    DirectHandle<HeapNumber> value = factory->NewHeapNumber(101);
+    Handle<FixedArray> array =
+        Cast<FixedArray>(factory->NewFixedArray(3, AllocationType::kYoung));
+    array->set(2, *value);
+    data->set_array(array);
+  }
+
+  InvokeMinorGC(i_isolate());
+
+  Tagged<Object> value = data->array()->get(2, kRelaxedLoad);
+  Tagged<HeapNumber> number = Tagged<HeapNumber>::cast(value);
+  CHECK_EQ(number->value(), 101);
+
+  InvokeMajorGC(i_isolate());
+
+  value = data->array()->get(2, kRelaxedLoad);
+  number = Tagged<HeapNumber>::cast(value);
+  CHECK_EQ(number->value(), 101);
+}
+
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/unittests/heap/shared-heap-unittest.cc b/deps/v8/test/unittests/heap/shared-heap-unittest.cc
index 19c14bfc1d7043..292347a581819c 100644
--- a/deps/v8/test/unittests/heap/shared-heap-unittest.cc
+++ b/deps/v8/test/unittests/heap/shared-heap-unittest.cc
@@ -759,8 +759,6 @@ TEST_ALL_SCENARIA(SharedHeapTestStateWithHandleParked, ToEachTheirOwn,
 TEST_ALL_SCENARIA(SharedHeapTestStateWithHandleUnparked, ToEachTheirOwn,
                   ToEachTheirOwnWithHandle)
 
-#ifdef V8_ENABLE_CONSERVATIVE_STACK_SCANNING
-
 namespace {
 
 // Testing the shared heap using raw pointers.
@@ -790,6 +788,8 @@ using SharedHeapTestStateWithRawPointerUnparked =
 
 template <typename TestType, AllocationType allocation, AllocationSpace space>
 void ToEachTheirOwnWithRawPointer(TestType* test) {
+  if (!v8_flags.conservative_stack_scanning) return;
+
   using ThreadType = typename TestType::ThreadType;
   ThreadType* thread = test->thread();
 
@@ -837,8 +837,6 @@ TEST_ALL_SCENARIA(SharedHeapTestStateWithRawPointerParked, ToEachTheirOwn,
 TEST_ALL_SCENARIA(SharedHeapTestStateWithRawPointerUnparked, ToEachTheirOwn,
                   ToEachTheirOwnWithRawPointer)
 
-#endif  // V8_ENABLE_CONSERVATIVE_STACK_SCANNING
-
 #undef TEST_SCENARIO
 #undef TEST_ALL_SCENARIA
 
diff --git a/deps/v8/test/unittests/heap/spaces-unittest.cc b/deps/v8/test/unittests/heap/spaces-unittest.cc
index 8d2926e2b75b9d..622bf6cdbd3c97 100644
--- a/deps/v8/test/unittests/heap/spaces-unittest.cc
+++ b/deps/v8/test/unittests/heap/spaces-unittest.cc
@@ -64,7 +64,7 @@ TEST_F(SpacesTest, CompactionSpaceMerge) {
   for (PageMetadata* p : *old_space) {
     // Unlink free lists from the main space to avoid reusing the memory for
     // compaction spaces.
-    old_space->UnlinkFreeListCategories(p);
+    old_space->free_list()->EvictFreeListItems(p);
   }
 
   // Cannot loop until "Available()" since we initially have 0 bytes available
diff --git a/deps/v8/test/unittests/interpreter/bytecode-array-builder-unittest.cc b/deps/v8/test/unittests/interpreter/bytecode-array-builder-unittest.cc
index 8a263b69e5afa1..12336b24e3191a 100644
--- a/deps/v8/test/unittests/interpreter/bytecode-array-builder-unittest.cc
+++ b/deps/v8/test/unittests/interpreter/bytecode-array-builder-unittest.cc
@@ -33,9 +33,7 @@ class BytecodeArrayBuilderTest : public TestWithIsolateAndZone {
 using ToBooleanMode = BytecodeArrayBuilder::ToBooleanMode;
 
 TEST_F(BytecodeArrayBuilderTest, AllBytecodesGenerated) {
-  FlagScope<bool> const_tracking_let(&i::v8_flags.const_tracking_let, true);
-  FlagScope<bool> script_context_mutable_heap_number(
-      &i::v8_flags.script_context_mutable_heap_number, true);
+  FlagScope<bool> script_context_cells(&i::v8_flags.script_context_cells, true);
 
   FeedbackVectorSpec feedback_spec(zone());
   BytecodeArrayBuilder builder(zone(), 1, 131, &feedback_spec);
@@ -138,13 +136,13 @@ TEST_F(BytecodeArrayBuilderTest, AllBytecodesGenerated) {
       .StoreGlobal(name, sloppy_store_global_slot.ToInt());
 
   // Emit context operations.
-  Variable var1(&scope, name, VariableMode::kVar, VariableKind::NORMAL_VARIABLE,
+  Variable var1(&scope, name, VariableMode::kLet, VariableKind::NORMAL_VARIABLE,
                 InitializationFlag::kCreatedInitialized);
   var1.AllocateTo(VariableLocation::CONTEXT, 1);
-  Variable var2(&scope, name, VariableMode::kVar, VariableKind::NORMAL_VARIABLE,
+  Variable var2(&scope, name, VariableMode::kLet, VariableKind::NORMAL_VARIABLE,
                 InitializationFlag::kCreatedInitialized);
   var2.AllocateTo(VariableLocation::CONTEXT, 1);
-  Variable var3(&scope, name, VariableMode::kVar, VariableKind::NORMAL_VARIABLE,
+  Variable var3(&scope, name, VariableMode::kLet, VariableKind::NORMAL_VARIABLE,
                 InitializationFlag::kCreatedInitialized);
   var3.AllocateTo(VariableLocation::CONTEXT, 3);
 
@@ -230,13 +228,13 @@ TEST_F(BytecodeArrayBuilderTest, AllBytecodesGenerated) {
   // Emit load / store lookup slots with context fast paths.
   builder
       .LoadLookupContextSlot(name, TypeofMode::kNotInside,
-                             ContextKind::kDefault, 1, 0)
-      .LoadLookupContextSlot(name, TypeofMode::kInside, ContextKind::kDefault,
-                             1, 0)
+                             ContextMode::kNoContextCells, 1, 0)
+      .LoadLookupContextSlot(name, TypeofMode::kInside,
+                             ContextMode::kNoContextCells, 1, 0)
       .LoadLookupContextSlot(name, TypeofMode::kNotInside,
-                             ContextKind::kScriptContext, 1, 0)
+                             ContextMode::kHasContextCells, 1, 0)
       .LoadLookupContextSlot(name, TypeofMode::kInside,
-                             ContextKind::kScriptContext, 1, 0);
+                             ContextMode::kHasContextCells, 1, 0);
 
   // Emit load / store lookup slots with global fast paths.
   builder.LoadLookupGlobalSlot(name, TypeofMode::kNotInside, 1, 0)
@@ -283,6 +281,8 @@ TEST_F(BytecodeArrayBuilderTest, AllBytecodesGenerated) {
       .BinaryOperation(Token::kMod, reg, 5)
       .BinaryOperation(Token::kExp, reg, 6);
 
+  builder.Add_LhsIsStringConstant_Internalize(Token::kAdd, reg, 1);
+
   // Emit bitwise operator invocations
   builder.BinaryOperation(Token::kBitOr, reg, 6)
       .BinaryOperation(Token::kBitXor, reg, 7)
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/BasicLoops.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/BasicLoops.golden
index d812f808fabc6b..b5a2e9343baf78 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/BasicLoops.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/BasicLoops.golden
@@ -668,19 +668,19 @@ bytecodes: [
                 B(CreateBlockContext), U8(0),
                 B(PushContext), R(3),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(CreateClosure), U8(1), U8(0), U8(2),
                 B(Star2),
   /*   73 S> */ B(LdaSmi), I8(1),
-  /*   73 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   73 E> */ B(StaCurrentContextSlotNoCell), U8(2),
   /*  102 S> */ B(Mov), R(2), R(1),
-  /*  106 S> */ B(LdaCurrentContextSlot), U8(2),
+  /*  106 S> */ B(LdaCurrentContextSlotNoCell), U8(2),
                 B(JumpIfToBooleanFalse), U8(6),
   /*  113 S> */ B(PopContext), R(3),
                 B(Jump), U8(10),
-  /*  126 S> */ B(LdaCurrentContextSlot), U8(2),
+  /*  126 S> */ B(LdaCurrentContextSlotNoCell), U8(2),
                 B(Inc), U8(0),
-  /*  127 E> */ B(StaCurrentContextSlot), U8(2),
+  /*  127 E> */ B(StaCurrentContextSlotNoCell), U8(2),
                 B(PopContext), R(3),
   /*   45 E> */ B(JumpLoop), U8(39), I8(0), U8(1),
                 B(LdaUndefined),
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/BreakableBlocks.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/BreakableBlocks.golden
index 6e3cdd74566a8b..54db745d3fe832 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/BreakableBlocks.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/BreakableBlocks.golden
@@ -102,11 +102,11 @@ bytecodes: [
   /*   30 E> */ B(CreateBlockContext), U8(0),
                 B(PushContext), R(2),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(CreateClosure), U8(1), U8(0), U8(2),
                 B(Star1),
   /*   53 S> */ B(LdaSmi), I8(10),
-  /*   53 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   53 E> */ B(StaCurrentContextSlotNoCell), U8(2),
   /*   85 S> */ B(Mov), R(1), R(0),
                 B(Ldar), R(1),
   /*   88 S> */ B(Jump), U8(2),
@@ -141,27 +141,27 @@ bytecodes: [
   /*   30 E> */ B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(2),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
   /*   42 S> */ B(LdaSmi), I8(1),
-  /*   42 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   42 E> */ B(StaCurrentContextSlotNoCell), U8(2),
                 B(CreateBlockContext), U8(1),
                 B(PushContext), R(3),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(CreateClosure), U8(2), U8(0), U8(2),
                 B(Star1),
   /*   76 S> */ B(LdaSmi), I8(2),
-  /*   76 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   76 E> */ B(StaCurrentContextSlotNoCell), U8(2),
   /*  113 S> */ B(Mov), R(1), R(0),
-  /*  118 S> */ B(LdaCurrentContextSlot), U8(2),
+  /*  118 S> */ B(LdaCurrentContextSlotNoCell), U8(2),
                 B(JumpIfToBooleanFalse), U8(6),
   /*  125 S> */ B(PopContext), R(3),
                 B(Jump), U8(8),
   /*  142 S> */ B(LdaSmi), I8(3),
-  /*  144 E> */ B(StaCurrentContextSlot), U8(2),
+  /*  144 E> */ B(StaCurrentContextSlotNoCell), U8(2),
                 B(PopContext), R(3),
   /*  155 S> */ B(LdaSmi), I8(4),
-  /*  157 E> */ B(StaCurrentContextSlot), U8(2),
+  /*  157 E> */ B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaUndefined),
   /*  162 S> */ B(Return),
 ]
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/CallLookupSlot.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/CallLookupSlot.golden
index b0a2834195d892..04bd88f97f55c2 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/CallLookupSlot.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/CallLookupSlot.golden
@@ -16,11 +16,11 @@ bytecodes: [
   /*   30 E> */ B(CreateFunctionContext), U8(0), U8(4),
                 B(PushContext), R(1),
                 B(Ldar), R(this),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(CreateMappedArguments),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlotNoCell), U8(5),
                 B(Ldar), R(0),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlotNoCell), U8(4),
   /*   34 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
   /*   36 E> */ B(StaLookupSlot), U8(2), U8(0),
   /*   52 S> */ B(LdaLookupGlobalSlot), U8(3), U8(0), U8(1),
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/ClassDeclarations.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/ClassDeclarations.golden
index 9309d0e20d8f69..6d90ed8c785268 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/ClassDeclarations.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/ClassDeclarations.golden
@@ -95,9 +95,9 @@ bytecodes: [
   /*   30 E> */ B(CreateFunctionContext), U8(0), U8(2),
                 B(PushContext), R(1),
   /*   43 S> */ B(LdaConstant), U8(1),
-  /*   43 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   43 E> */ B(StaCurrentContextSlotNoCell), U8(2),
   /*   57 S> */ B(LdaConstant), U8(2),
-  /*   57 E> */ B(StaCurrentContextSlot), U8(3),
+  /*   57 E> */ B(StaCurrentContextSlotNoCell), U8(3),
                 B(CreateBlockContext), U8(3),
                 B(PushContext), R(2),
                 B(LdaTheHole),
@@ -154,7 +154,7 @@ bytecodes: [
   /*   30 E> */ B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(1),
   /*   46 S> */ B(LdaZero),
-  /*   46 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   46 E> */ B(StaCurrentContextSlotNoCell), U8(2),
                 B(CreateBlockContext), U8(1),
                 B(PushContext), R(2),
                 B(LdaTheHole),
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/CompoundExpressions.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/CompoundExpressions.golden
index 5231ae7a0cb408..95250fcc99a445 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/CompoundExpressions.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/CompoundExpressions.golden
@@ -103,11 +103,11 @@ bytecodes: [
   /*   30 E> */ B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
   /*   42 S> */ B(LdaSmi), I8(1),
-  /*   42 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   42 E> */ B(StaCurrentContextSlotNoCell), U8(2),
   /*   45 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
-  /*   75 S> */ B(LdaCurrentContextSlot), U8(2),
+  /*   75 S> */ B(LdaCurrentContextSlotNoCell), U8(2),
                 B(BitwiseOrSmi), I8(24), U8(0),
-  /*   77 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   77 E> */ B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaUndefined),
   /*   84 S> */ B(Return),
 ]
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/ConstVariableContextSlot.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/ConstVariableContextSlot.golden
index 8e5c9cc1003c1d..eb1241ba90009c 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/ConstVariableContextSlot.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/ConstVariableContextSlot.golden
@@ -16,9 +16,9 @@ bytecodes: [
   /*   30 E> */ B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
   /*   44 S> */ B(LdaSmi), I8(10),
-  /*   44 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   44 E> */ B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaUndefined),
   /*   74 S> */ B(Return),
 ]
@@ -39,9 +39,9 @@ bytecodes: [
   /*   30 E> */ B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
   /*   44 S> */ B(LdaSmi), I8(10),
-  /*   44 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   44 E> */ B(StaCurrentContextSlotNoCell), U8(2),
   /*   74 S> */ B(LdaImmutableCurrentContextSlot), U8(2),
   /*   83 S> */ B(Return),
 ]
@@ -62,13 +62,13 @@ bytecodes: [
   /*   30 E> */ B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
   /*   44 S> */ B(LdaSmi), I8(20),
                 B(Star1),
-                B(LdaCurrentContextSlot), U8(2),
+                B(LdaCurrentContextSlotNoCell), U8(2),
   /*   47 E> */ B(ThrowReferenceErrorIfHole), U8(1),
                 B(CallRuntime), U16(Runtime::kThrowConstAssignError), R(0), U8(0),
-  /*   44 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   44 E> */ B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaUndefined),
   /*   80 S> */ B(Return),
 ]
@@ -90,9 +90,9 @@ bytecodes: [
   /*   30 E> */ B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
   /*   44 S> */ B(LdaSmi), I8(10),
-  /*   44 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   44 E> */ B(StaCurrentContextSlotNoCell), U8(2),
   /*   48 S> */ B(LdaSmi), I8(20),
   /*   50 E> */ B(CallRuntime), U16(Runtime::kThrowConstAssignError), R(0), U8(0),
                 B(LdaUndefined),
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/ContextParameters.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/ContextParameters.golden
index 368f86533433f6..4f2ae3617c9f10 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/ContextParameters.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/ContextParameters.golden
@@ -18,7 +18,7 @@ bytecodes: [
   /*   10 E> */ B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
                 B(Ldar), R(arg0),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
   /*   19 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
   /*   51 S> */ B(Return),
 ]
@@ -41,10 +41,10 @@ bytecodes: [
   /*   10 E> */ B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(1),
                 B(Ldar), R(arg0),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
   /*   27 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
                 B(Star0),
-  /*   53 S> */ B(LdaCurrentContextSlot), U8(2),
+  /*   53 S> */ B(LdaCurrentContextSlotNoCell), U8(2),
   /*   65 S> */ B(Return),
 ]
 constant pool: [
@@ -66,9 +66,9 @@ bytecodes: [
   /*   10 E> */ B(CreateFunctionContext), U8(0), U8(2),
                 B(PushContext), R(0),
                 B(Ldar), R(arg0),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(Ldar), R(arg2),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
   /*   29 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
   /*   60 S> */ B(Return),
 ]
@@ -91,7 +91,7 @@ bytecodes: [
   /*   10 E> */ B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
   /*   26 S> */ B(Ldar), R(this),
-  /*   26 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   26 E> */ B(StaCurrentContextSlotNoCell), U8(2),
   /*   32 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
   /*   64 S> */ B(Return),
 ]
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/ContextVariables.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/ContextVariables.golden
index adfbf08d8a914a..bdadbcb72c21fa 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/ContextVariables.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/ContextVariables.golden
@@ -36,7 +36,7 @@ bytecodes: [
   /*   30 E> */ B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
   /*   42 S> */ B(LdaSmi), I8(1),
-  /*   42 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   42 E> */ B(StaCurrentContextSlotNoCell), U8(2),
   /*   45 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
   /*   74 S> */ B(Return),
 ]
@@ -58,9 +58,9 @@ bytecodes: [
   /*   30 E> */ B(CreateFunctionContext), U8(0), U8(2),
                 B(PushContext), R(0),
   /*   42 S> */ B(LdaSmi), I8(1),
-  /*   42 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   42 E> */ B(StaCurrentContextSlotNoCell), U8(2),
   /*   53 S> */ B(LdaSmi), I8(2),
-  /*   53 E> */ B(StaCurrentContextSlot), U8(3),
+  /*   53 E> */ B(StaCurrentContextSlotNoCell), U8(3),
   /*   56 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
   /*   91 S> */ B(Return),
 ]
@@ -84,7 +84,7 @@ bytecodes: [
   /*   41 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
                 B(Star1),
   /*   64 E> */ B(CallUndefinedReceiver0), R(1), U8(0),
-  /*   68 S> */ B(LdaCurrentContextSlot), U8(2),
+  /*   68 S> */ B(LdaCurrentContextSlotNoCell), U8(2),
   /*   77 S> */ B(Return),
 ]
 constant pool: [
@@ -107,15 +107,15 @@ bytecodes: [
   /*   30 E> */ B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
   /*   56 S> */ B(LdaSmi), I8(1),
-  /*   56 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   56 E> */ B(StaCurrentContextSlotNoCell), U8(2),
                 B(CreateBlockContext), U8(1),
                 B(PushContext), R(1),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
   /*   69 S> */ B(LdaSmi), I8(2),
-  /*   69 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   69 E> */ B(StaCurrentContextSlotNoCell), U8(2),
   /*   72 S> */ B(CreateClosure), U8(2), U8(0), U8(2),
   /*  101 S> */ B(Return),
 ]
@@ -393,521 +393,521 @@ bytecodes: [
   /*   30 E> */ B(Wide), B(CreateFunctionContext), U16(0), U16(256),
                 B(PushContext), R(1),
                 B(Ldar), R(this),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(CreateUnmappedArguments),
-                B(Wide), B(StaCurrentContextSlot), U16(257),
+                B(Wide), B(StaCurrentContextSlotNoCell), U16(257),
                 B(Ldar), R(0),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
   /*   59 S> */ B(LdaZero),
-  /*   59 E> */ B(StaCurrentContextSlot), U8(4),
+  /*   59 E> */ B(StaCurrentContextSlotNoCell), U8(4),
   /*   73 S> */ B(LdaZero),
-  /*   73 E> */ B(StaCurrentContextSlot), U8(5),
+  /*   73 E> */ B(StaCurrentContextSlotNoCell), U8(5),
   /*   87 S> */ B(LdaZero),
-  /*   87 E> */ B(StaCurrentContextSlot), U8(6),
+  /*   87 E> */ B(StaCurrentContextSlotNoCell), U8(6),
   /*  101 S> */ B(LdaZero),
-  /*  101 E> */ B(StaCurrentContextSlot), U8(7),
+  /*  101 E> */ B(StaCurrentContextSlotNoCell), U8(7),
   /*  115 S> */ B(LdaZero),
-  /*  115 E> */ B(StaCurrentContextSlot), U8(8),
+  /*  115 E> */ B(StaCurrentContextSlotNoCell), U8(8),
   /*  129 S> */ B(LdaZero),
-  /*  129 E> */ B(StaCurrentContextSlot), U8(9),
+  /*  129 E> */ B(StaCurrentContextSlotNoCell), U8(9),
   /*  143 S> */ B(LdaZero),
-  /*  143 E> */ B(StaCurrentContextSlot), U8(10),
+  /*  143 E> */ B(StaCurrentContextSlotNoCell), U8(10),
   /*  157 S> */ B(LdaZero),
-  /*  157 E> */ B(StaCurrentContextSlot), U8(11),
+  /*  157 E> */ B(StaCurrentContextSlotNoCell), U8(11),
   /*  171 S> */ B(LdaZero),
-  /*  171 E> */ B(StaCurrentContextSlot), U8(12),
+  /*  171 E> */ B(StaCurrentContextSlotNoCell), U8(12),
   /*  185 S> */ B(LdaZero),
-  /*  185 E> */ B(StaCurrentContextSlot), U8(13),
+  /*  185 E> */ B(StaCurrentContextSlotNoCell), U8(13),
   /*  199 S> */ B(LdaZero),
-  /*  199 E> */ B(StaCurrentContextSlot), U8(14),
+  /*  199 E> */ B(StaCurrentContextSlotNoCell), U8(14),
   /*  213 S> */ B(LdaZero),
-  /*  213 E> */ B(StaCurrentContextSlot), U8(15),
+  /*  213 E> */ B(StaCurrentContextSlotNoCell), U8(15),
   /*  227 S> */ B(LdaZero),
-  /*  227 E> */ B(StaCurrentContextSlot), U8(16),
+  /*  227 E> */ B(StaCurrentContextSlotNoCell), U8(16),
   /*  241 S> */ B(LdaZero),
-  /*  241 E> */ B(StaCurrentContextSlot), U8(17),
+  /*  241 E> */ B(StaCurrentContextSlotNoCell), U8(17),
   /*  255 S> */ B(LdaZero),
-  /*  255 E> */ B(StaCurrentContextSlot), U8(18),
+  /*  255 E> */ B(StaCurrentContextSlotNoCell), U8(18),
   /*  269 S> */ B(LdaZero),
-  /*  269 E> */ B(StaCurrentContextSlot), U8(19),
+  /*  269 E> */ B(StaCurrentContextSlotNoCell), U8(19),
   /*  283 S> */ B(LdaZero),
-  /*  283 E> */ B(StaCurrentContextSlot), U8(20),
+  /*  283 E> */ B(StaCurrentContextSlotNoCell), U8(20),
   /*  297 S> */ B(LdaZero),
-  /*  297 E> */ B(StaCurrentContextSlot), U8(21),
+  /*  297 E> */ B(StaCurrentContextSlotNoCell), U8(21),
   /*  311 S> */ B(LdaZero),
-  /*  311 E> */ B(StaCurrentContextSlot), U8(22),
+  /*  311 E> */ B(StaCurrentContextSlotNoCell), U8(22),
   /*  325 S> */ B(LdaZero),
-  /*  325 E> */ B(StaCurrentContextSlot), U8(23),
+  /*  325 E> */ B(StaCurrentContextSlotNoCell), U8(23),
   /*  339 S> */ B(LdaZero),
-  /*  339 E> */ B(StaCurrentContextSlot), U8(24),
+  /*  339 E> */ B(StaCurrentContextSlotNoCell), U8(24),
   /*  353 S> */ B(LdaZero),
-  /*  353 E> */ B(StaCurrentContextSlot), U8(25),
+  /*  353 E> */ B(StaCurrentContextSlotNoCell), U8(25),
   /*  367 S> */ B(LdaZero),
-  /*  367 E> */ B(StaCurrentContextSlot), U8(26),
+  /*  367 E> */ B(StaCurrentContextSlotNoCell), U8(26),
   /*  381 S> */ B(LdaZero),
-  /*  381 E> */ B(StaCurrentContextSlot), U8(27),
+  /*  381 E> */ B(StaCurrentContextSlotNoCell), U8(27),
   /*  395 S> */ B(LdaZero),
-  /*  395 E> */ B(StaCurrentContextSlot), U8(28),
+  /*  395 E> */ B(StaCurrentContextSlotNoCell), U8(28),
   /*  409 S> */ B(LdaZero),
-  /*  409 E> */ B(StaCurrentContextSlot), U8(29),
+  /*  409 E> */ B(StaCurrentContextSlotNoCell), U8(29),
   /*  423 S> */ B(LdaZero),
-  /*  423 E> */ B(StaCurrentContextSlot), U8(30),
+  /*  423 E> */ B(StaCurrentContextSlotNoCell), U8(30),
   /*  437 S> */ B(LdaZero),
-  /*  437 E> */ B(StaCurrentContextSlot), U8(31),
+  /*  437 E> */ B(StaCurrentContextSlotNoCell), U8(31),
   /*  451 S> */ B(LdaZero),
-  /*  451 E> */ B(StaCurrentContextSlot), U8(32),
+  /*  451 E> */ B(StaCurrentContextSlotNoCell), U8(32),
   /*  465 S> */ B(LdaZero),
-  /*  465 E> */ B(StaCurrentContextSlot), U8(33),
+  /*  465 E> */ B(StaCurrentContextSlotNoCell), U8(33),
   /*  479 S> */ B(LdaZero),
-  /*  479 E> */ B(StaCurrentContextSlot), U8(34),
+  /*  479 E> */ B(StaCurrentContextSlotNoCell), U8(34),
   /*  493 S> */ B(LdaZero),
-  /*  493 E> */ B(StaCurrentContextSlot), U8(35),
+  /*  493 E> */ B(StaCurrentContextSlotNoCell), U8(35),
   /*  507 S> */ B(LdaZero),
-  /*  507 E> */ B(StaCurrentContextSlot), U8(36),
+  /*  507 E> */ B(StaCurrentContextSlotNoCell), U8(36),
   /*  521 S> */ B(LdaZero),
-  /*  521 E> */ B(StaCurrentContextSlot), U8(37),
+  /*  521 E> */ B(StaCurrentContextSlotNoCell), U8(37),
   /*  535 S> */ B(LdaZero),
-  /*  535 E> */ B(StaCurrentContextSlot), U8(38),
+  /*  535 E> */ B(StaCurrentContextSlotNoCell), U8(38),
   /*  549 S> */ B(LdaZero),
-  /*  549 E> */ B(StaCurrentContextSlot), U8(39),
+  /*  549 E> */ B(StaCurrentContextSlotNoCell), U8(39),
   /*  563 S> */ B(LdaZero),
-  /*  563 E> */ B(StaCurrentContextSlot), U8(40),
+  /*  563 E> */ B(StaCurrentContextSlotNoCell), U8(40),
   /*  577 S> */ B(LdaZero),
-  /*  577 E> */ B(StaCurrentContextSlot), U8(41),
+  /*  577 E> */ B(StaCurrentContextSlotNoCell), U8(41),
   /*  591 S> */ B(LdaZero),
-  /*  591 E> */ B(StaCurrentContextSlot), U8(42),
+  /*  591 E> */ B(StaCurrentContextSlotNoCell), U8(42),
   /*  605 S> */ B(LdaZero),
-  /*  605 E> */ B(StaCurrentContextSlot), U8(43),
+  /*  605 E> */ B(StaCurrentContextSlotNoCell), U8(43),
   /*  619 S> */ B(LdaZero),
-  /*  619 E> */ B(StaCurrentContextSlot), U8(44),
+  /*  619 E> */ B(StaCurrentContextSlotNoCell), U8(44),
   /*  633 S> */ B(LdaZero),
-  /*  633 E> */ B(StaCurrentContextSlot), U8(45),
+  /*  633 E> */ B(StaCurrentContextSlotNoCell), U8(45),
   /*  647 S> */ B(LdaZero),
-  /*  647 E> */ B(StaCurrentContextSlot), U8(46),
+  /*  647 E> */ B(StaCurrentContextSlotNoCell), U8(46),
   /*  661 S> */ B(LdaZero),
-  /*  661 E> */ B(StaCurrentContextSlot), U8(47),
+  /*  661 E> */ B(StaCurrentContextSlotNoCell), U8(47),
   /*  675 S> */ B(LdaZero),
-  /*  675 E> */ B(StaCurrentContextSlot), U8(48),
+  /*  675 E> */ B(StaCurrentContextSlotNoCell), U8(48),
   /*  689 S> */ B(LdaZero),
-  /*  689 E> */ B(StaCurrentContextSlot), U8(49),
+  /*  689 E> */ B(StaCurrentContextSlotNoCell), U8(49),
   /*  703 S> */ B(LdaZero),
-  /*  703 E> */ B(StaCurrentContextSlot), U8(50),
+  /*  703 E> */ B(StaCurrentContextSlotNoCell), U8(50),
   /*  717 S> */ B(LdaZero),
-  /*  717 E> */ B(StaCurrentContextSlot), U8(51),
+  /*  717 E> */ B(StaCurrentContextSlotNoCell), U8(51),
   /*  731 S> */ B(LdaZero),
-  /*  731 E> */ B(StaCurrentContextSlot), U8(52),
+  /*  731 E> */ B(StaCurrentContextSlotNoCell), U8(52),
   /*  745 S> */ B(LdaZero),
-  /*  745 E> */ B(StaCurrentContextSlot), U8(53),
+  /*  745 E> */ B(StaCurrentContextSlotNoCell), U8(53),
   /*  759 S> */ B(LdaZero),
-  /*  759 E> */ B(StaCurrentContextSlot), U8(54),
+  /*  759 E> */ B(StaCurrentContextSlotNoCell), U8(54),
   /*  773 S> */ B(LdaZero),
-  /*  773 E> */ B(StaCurrentContextSlot), U8(55),
+  /*  773 E> */ B(StaCurrentContextSlotNoCell), U8(55),
   /*  787 S> */ B(LdaZero),
-  /*  787 E> */ B(StaCurrentContextSlot), U8(56),
+  /*  787 E> */ B(StaCurrentContextSlotNoCell), U8(56),
   /*  801 S> */ B(LdaZero),
-  /*  801 E> */ B(StaCurrentContextSlot), U8(57),
+  /*  801 E> */ B(StaCurrentContextSlotNoCell), U8(57),
   /*  815 S> */ B(LdaZero),
-  /*  815 E> */ B(StaCurrentContextSlot), U8(58),
+  /*  815 E> */ B(StaCurrentContextSlotNoCell), U8(58),
   /*  829 S> */ B(LdaZero),
-  /*  829 E> */ B(StaCurrentContextSlot), U8(59),
+  /*  829 E> */ B(StaCurrentContextSlotNoCell), U8(59),
   /*  843 S> */ B(LdaZero),
-  /*  843 E> */ B(StaCurrentContextSlot), U8(60),
+  /*  843 E> */ B(StaCurrentContextSlotNoCell), U8(60),
   /*  857 S> */ B(LdaZero),
-  /*  857 E> */ B(StaCurrentContextSlot), U8(61),
+  /*  857 E> */ B(StaCurrentContextSlotNoCell), U8(61),
   /*  871 S> */ B(LdaZero),
-  /*  871 E> */ B(StaCurrentContextSlot), U8(62),
+  /*  871 E> */ B(StaCurrentContextSlotNoCell), U8(62),
   /*  885 S> */ B(LdaZero),
-  /*  885 E> */ B(StaCurrentContextSlot), U8(63),
+  /*  885 E> */ B(StaCurrentContextSlotNoCell), U8(63),
   /*  899 S> */ B(LdaZero),
-  /*  899 E> */ B(StaCurrentContextSlot), U8(64),
+  /*  899 E> */ B(StaCurrentContextSlotNoCell), U8(64),
   /*  913 S> */ B(LdaZero),
-  /*  913 E> */ B(StaCurrentContextSlot), U8(65),
+  /*  913 E> */ B(StaCurrentContextSlotNoCell), U8(65),
   /*  927 S> */ B(LdaZero),
-  /*  927 E> */ B(StaCurrentContextSlot), U8(66),
+  /*  927 E> */ B(StaCurrentContextSlotNoCell), U8(66),
   /*  941 S> */ B(LdaZero),
-  /*  941 E> */ B(StaCurrentContextSlot), U8(67),
+  /*  941 E> */ B(StaCurrentContextSlotNoCell), U8(67),
   /*  955 S> */ B(LdaZero),
-  /*  955 E> */ B(StaCurrentContextSlot), U8(68),
+  /*  955 E> */ B(StaCurrentContextSlotNoCell), U8(68),
   /*  969 S> */ B(LdaZero),
-  /*  969 E> */ B(StaCurrentContextSlot), U8(69),
+  /*  969 E> */ B(StaCurrentContextSlotNoCell), U8(69),
   /*  983 S> */ B(LdaZero),
-  /*  983 E> */ B(StaCurrentContextSlot), U8(70),
+  /*  983 E> */ B(StaCurrentContextSlotNoCell), U8(70),
   /*  997 S> */ B(LdaZero),
-  /*  997 E> */ B(StaCurrentContextSlot), U8(71),
+  /*  997 E> */ B(StaCurrentContextSlotNoCell), U8(71),
   /* 1011 S> */ B(LdaZero),
-  /* 1011 E> */ B(StaCurrentContextSlot), U8(72),
+  /* 1011 E> */ B(StaCurrentContextSlotNoCell), U8(72),
   /* 1025 S> */ B(LdaZero),
-  /* 1025 E> */ B(StaCurrentContextSlot), U8(73),
+  /* 1025 E> */ B(StaCurrentContextSlotNoCell), U8(73),
   /* 1039 S> */ B(LdaZero),
-  /* 1039 E> */ B(StaCurrentContextSlot), U8(74),
+  /* 1039 E> */ B(StaCurrentContextSlotNoCell), U8(74),
   /* 1053 S> */ B(LdaZero),
-  /* 1053 E> */ B(StaCurrentContextSlot), U8(75),
+  /* 1053 E> */ B(StaCurrentContextSlotNoCell), U8(75),
   /* 1067 S> */ B(LdaZero),
-  /* 1067 E> */ B(StaCurrentContextSlot), U8(76),
+  /* 1067 E> */ B(StaCurrentContextSlotNoCell), U8(76),
   /* 1081 S> */ B(LdaZero),
-  /* 1081 E> */ B(StaCurrentContextSlot), U8(77),
+  /* 1081 E> */ B(StaCurrentContextSlotNoCell), U8(77),
   /* 1095 S> */ B(LdaZero),
-  /* 1095 E> */ B(StaCurrentContextSlot), U8(78),
+  /* 1095 E> */ B(StaCurrentContextSlotNoCell), U8(78),
   /* 1109 S> */ B(LdaZero),
-  /* 1109 E> */ B(StaCurrentContextSlot), U8(79),
+  /* 1109 E> */ B(StaCurrentContextSlotNoCell), U8(79),
   /* 1123 S> */ B(LdaZero),
-  /* 1123 E> */ B(StaCurrentContextSlot), U8(80),
+  /* 1123 E> */ B(StaCurrentContextSlotNoCell), U8(80),
   /* 1137 S> */ B(LdaZero),
-  /* 1137 E> */ B(StaCurrentContextSlot), U8(81),
+  /* 1137 E> */ B(StaCurrentContextSlotNoCell), U8(81),
   /* 1151 S> */ B(LdaZero),
-  /* 1151 E> */ B(StaCurrentContextSlot), U8(82),
+  /* 1151 E> */ B(StaCurrentContextSlotNoCell), U8(82),
   /* 1165 S> */ B(LdaZero),
-  /* 1165 E> */ B(StaCurrentContextSlot), U8(83),
+  /* 1165 E> */ B(StaCurrentContextSlotNoCell), U8(83),
   /* 1179 S> */ B(LdaZero),
-  /* 1179 E> */ B(StaCurrentContextSlot), U8(84),
+  /* 1179 E> */ B(StaCurrentContextSlotNoCell), U8(84),
   /* 1193 S> */ B(LdaZero),
-  /* 1193 E> */ B(StaCurrentContextSlot), U8(85),
+  /* 1193 E> */ B(StaCurrentContextSlotNoCell), U8(85),
   /* 1207 S> */ B(LdaZero),
-  /* 1207 E> */ B(StaCurrentContextSlot), U8(86),
+  /* 1207 E> */ B(StaCurrentContextSlotNoCell), U8(86),
   /* 1221 S> */ B(LdaZero),
-  /* 1221 E> */ B(StaCurrentContextSlot), U8(87),
+  /* 1221 E> */ B(StaCurrentContextSlotNoCell), U8(87),
   /* 1235 S> */ B(LdaZero),
-  /* 1235 E> */ B(StaCurrentContextSlot), U8(88),
+  /* 1235 E> */ B(StaCurrentContextSlotNoCell), U8(88),
   /* 1249 S> */ B(LdaZero),
-  /* 1249 E> */ B(StaCurrentContextSlot), U8(89),
+  /* 1249 E> */ B(StaCurrentContextSlotNoCell), U8(89),
   /* 1263 S> */ B(LdaZero),
-  /* 1263 E> */ B(StaCurrentContextSlot), U8(90),
+  /* 1263 E> */ B(StaCurrentContextSlotNoCell), U8(90),
   /* 1277 S> */ B(LdaZero),
-  /* 1277 E> */ B(StaCurrentContextSlot), U8(91),
+  /* 1277 E> */ B(StaCurrentContextSlotNoCell), U8(91),
   /* 1291 S> */ B(LdaZero),
-  /* 1291 E> */ B(StaCurrentContextSlot), U8(92),
+  /* 1291 E> */ B(StaCurrentContextSlotNoCell), U8(92),
   /* 1305 S> */ B(LdaZero),
-  /* 1305 E> */ B(StaCurrentContextSlot), U8(93),
+  /* 1305 E> */ B(StaCurrentContextSlotNoCell), U8(93),
   /* 1319 S> */ B(LdaZero),
-  /* 1319 E> */ B(StaCurrentContextSlot), U8(94),
+  /* 1319 E> */ B(StaCurrentContextSlotNoCell), U8(94),
   /* 1333 S> */ B(LdaZero),
-  /* 1333 E> */ B(StaCurrentContextSlot), U8(95),
+  /* 1333 E> */ B(StaCurrentContextSlotNoCell), U8(95),
   /* 1347 S> */ B(LdaZero),
-  /* 1347 E> */ B(StaCurrentContextSlot), U8(96),
+  /* 1347 E> */ B(StaCurrentContextSlotNoCell), U8(96),
   /* 1361 S> */ B(LdaZero),
-  /* 1361 E> */ B(StaCurrentContextSlot), U8(97),
+  /* 1361 E> */ B(StaCurrentContextSlotNoCell), U8(97),
   /* 1375 S> */ B(LdaZero),
-  /* 1375 E> */ B(StaCurrentContextSlot), U8(98),
+  /* 1375 E> */ B(StaCurrentContextSlotNoCell), U8(98),
   /* 1389 S> */ B(LdaZero),
-  /* 1389 E> */ B(StaCurrentContextSlot), U8(99),
+  /* 1389 E> */ B(StaCurrentContextSlotNoCell), U8(99),
   /* 1403 S> */ B(LdaZero),
-  /* 1403 E> */ B(StaCurrentContextSlot), U8(100),
+  /* 1403 E> */ B(StaCurrentContextSlotNoCell), U8(100),
   /* 1417 S> */ B(LdaZero),
-  /* 1417 E> */ B(StaCurrentContextSlot), U8(101),
+  /* 1417 E> */ B(StaCurrentContextSlotNoCell), U8(101),
   /* 1431 S> */ B(LdaZero),
-  /* 1431 E> */ B(StaCurrentContextSlot), U8(102),
+  /* 1431 E> */ B(StaCurrentContextSlotNoCell), U8(102),
   /* 1445 S> */ B(LdaZero),
-  /* 1445 E> */ B(StaCurrentContextSlot), U8(103),
+  /* 1445 E> */ B(StaCurrentContextSlotNoCell), U8(103),
   /* 1459 S> */ B(LdaZero),
-  /* 1459 E> */ B(StaCurrentContextSlot), U8(104),
+  /* 1459 E> */ B(StaCurrentContextSlotNoCell), U8(104),
   /* 1473 S> */ B(LdaZero),
-  /* 1473 E> */ B(StaCurrentContextSlot), U8(105),
+  /* 1473 E> */ B(StaCurrentContextSlotNoCell), U8(105),
   /* 1487 S> */ B(LdaZero),
-  /* 1487 E> */ B(StaCurrentContextSlot), U8(106),
+  /* 1487 E> */ B(StaCurrentContextSlotNoCell), U8(106),
   /* 1501 S> */ B(LdaZero),
-  /* 1501 E> */ B(StaCurrentContextSlot), U8(107),
+  /* 1501 E> */ B(StaCurrentContextSlotNoCell), U8(107),
   /* 1516 S> */ B(LdaZero),
-  /* 1516 E> */ B(StaCurrentContextSlot), U8(108),
+  /* 1516 E> */ B(StaCurrentContextSlotNoCell), U8(108),
   /* 1531 S> */ B(LdaZero),
-  /* 1531 E> */ B(StaCurrentContextSlot), U8(109),
+  /* 1531 E> */ B(StaCurrentContextSlotNoCell), U8(109),
   /* 1546 S> */ B(LdaZero),
-  /* 1546 E> */ B(StaCurrentContextSlot), U8(110),
+  /* 1546 E> */ B(StaCurrentContextSlotNoCell), U8(110),
   /* 1561 S> */ B(LdaZero),
-  /* 1561 E> */ B(StaCurrentContextSlot), U8(111),
+  /* 1561 E> */ B(StaCurrentContextSlotNoCell), U8(111),
   /* 1576 S> */ B(LdaZero),
-  /* 1576 E> */ B(StaCurrentContextSlot), U8(112),
+  /* 1576 E> */ B(StaCurrentContextSlotNoCell), U8(112),
   /* 1591 S> */ B(LdaZero),
-  /* 1591 E> */ B(StaCurrentContextSlot), U8(113),
+  /* 1591 E> */ B(StaCurrentContextSlotNoCell), U8(113),
   /* 1606 S> */ B(LdaZero),
-  /* 1606 E> */ B(StaCurrentContextSlot), U8(114),
+  /* 1606 E> */ B(StaCurrentContextSlotNoCell), U8(114),
   /* 1621 S> */ B(LdaZero),
-  /* 1621 E> */ B(StaCurrentContextSlot), U8(115),
+  /* 1621 E> */ B(StaCurrentContextSlotNoCell), U8(115),
   /* 1636 S> */ B(LdaZero),
-  /* 1636 E> */ B(StaCurrentContextSlot), U8(116),
+  /* 1636 E> */ B(StaCurrentContextSlotNoCell), U8(116),
   /* 1651 S> */ B(LdaZero),
-  /* 1651 E> */ B(StaCurrentContextSlot), U8(117),
+  /* 1651 E> */ B(StaCurrentContextSlotNoCell), U8(117),
   /* 1666 S> */ B(LdaZero),
-  /* 1666 E> */ B(StaCurrentContextSlot), U8(118),
+  /* 1666 E> */ B(StaCurrentContextSlotNoCell), U8(118),
   /* 1681 S> */ B(LdaZero),
-  /* 1681 E> */ B(StaCurrentContextSlot), U8(119),
+  /* 1681 E> */ B(StaCurrentContextSlotNoCell), U8(119),
   /* 1696 S> */ B(LdaZero),
-  /* 1696 E> */ B(StaCurrentContextSlot), U8(120),
+  /* 1696 E> */ B(StaCurrentContextSlotNoCell), U8(120),
   /* 1711 S> */ B(LdaZero),
-  /* 1711 E> */ B(StaCurrentContextSlot), U8(121),
+  /* 1711 E> */ B(StaCurrentContextSlotNoCell), U8(121),
   /* 1726 S> */ B(LdaZero),
-  /* 1726 E> */ B(StaCurrentContextSlot), U8(122),
+  /* 1726 E> */ B(StaCurrentContextSlotNoCell), U8(122),
   /* 1741 S> */ B(LdaZero),
-  /* 1741 E> */ B(StaCurrentContextSlot), U8(123),
+  /* 1741 E> */ B(StaCurrentContextSlotNoCell), U8(123),
   /* 1756 S> */ B(LdaZero),
-  /* 1756 E> */ B(StaCurrentContextSlot), U8(124),
+  /* 1756 E> */ B(StaCurrentContextSlotNoCell), U8(124),
   /* 1771 S> */ B(LdaZero),
-  /* 1771 E> */ B(StaCurrentContextSlot), U8(125),
+  /* 1771 E> */ B(StaCurrentContextSlotNoCell), U8(125),
   /* 1786 S> */ B(LdaZero),
-  /* 1786 E> */ B(StaCurrentContextSlot), U8(126),
+  /* 1786 E> */ B(StaCurrentContextSlotNoCell), U8(126),
   /* 1801 S> */ B(LdaZero),
-  /* 1801 E> */ B(StaCurrentContextSlot), U8(127),
+  /* 1801 E> */ B(StaCurrentContextSlotNoCell), U8(127),
   /* 1816 S> */ B(LdaZero),
-  /* 1816 E> */ B(StaCurrentContextSlot), U8(128),
+  /* 1816 E> */ B(StaCurrentContextSlotNoCell), U8(128),
   /* 1831 S> */ B(LdaZero),
-  /* 1831 E> */ B(StaCurrentContextSlot), U8(129),
+  /* 1831 E> */ B(StaCurrentContextSlotNoCell), U8(129),
   /* 1846 S> */ B(LdaZero),
-  /* 1846 E> */ B(StaCurrentContextSlot), U8(130),
+  /* 1846 E> */ B(StaCurrentContextSlotNoCell), U8(130),
   /* 1861 S> */ B(LdaZero),
-  /* 1861 E> */ B(StaCurrentContextSlot), U8(131),
+  /* 1861 E> */ B(StaCurrentContextSlotNoCell), U8(131),
   /* 1876 S> */ B(LdaZero),
-  /* 1876 E> */ B(StaCurrentContextSlot), U8(132),
+  /* 1876 E> */ B(StaCurrentContextSlotNoCell), U8(132),
   /* 1891 S> */ B(LdaZero),
-  /* 1891 E> */ B(StaCurrentContextSlot), U8(133),
+  /* 1891 E> */ B(StaCurrentContextSlotNoCell), U8(133),
   /* 1906 S> */ B(LdaZero),
-  /* 1906 E> */ B(StaCurrentContextSlot), U8(134),
+  /* 1906 E> */ B(StaCurrentContextSlotNoCell), U8(134),
   /* 1921 S> */ B(LdaZero),
-  /* 1921 E> */ B(StaCurrentContextSlot), U8(135),
+  /* 1921 E> */ B(StaCurrentContextSlotNoCell), U8(135),
   /* 1936 S> */ B(LdaZero),
-  /* 1936 E> */ B(StaCurrentContextSlot), U8(136),
+  /* 1936 E> */ B(StaCurrentContextSlotNoCell), U8(136),
   /* 1951 S> */ B(LdaZero),
-  /* 1951 E> */ B(StaCurrentContextSlot), U8(137),
+  /* 1951 E> */ B(StaCurrentContextSlotNoCell), U8(137),
   /* 1966 S> */ B(LdaZero),
-  /* 1966 E> */ B(StaCurrentContextSlot), U8(138),
+  /* 1966 E> */ B(StaCurrentContextSlotNoCell), U8(138),
   /* 1981 S> */ B(LdaZero),
-  /* 1981 E> */ B(StaCurrentContextSlot), U8(139),
+  /* 1981 E> */ B(StaCurrentContextSlotNoCell), U8(139),
   /* 1996 S> */ B(LdaZero),
-  /* 1996 E> */ B(StaCurrentContextSlot), U8(140),
+  /* 1996 E> */ B(StaCurrentContextSlotNoCell), U8(140),
   /* 2011 S> */ B(LdaZero),
-  /* 2011 E> */ B(StaCurrentContextSlot), U8(141),
+  /* 2011 E> */ B(StaCurrentContextSlotNoCell), U8(141),
   /* 2026 S> */ B(LdaZero),
-  /* 2026 E> */ B(StaCurrentContextSlot), U8(142),
+  /* 2026 E> */ B(StaCurrentContextSlotNoCell), U8(142),
   /* 2041 S> */ B(LdaZero),
-  /* 2041 E> */ B(StaCurrentContextSlot), U8(143),
+  /* 2041 E> */ B(StaCurrentContextSlotNoCell), U8(143),
   /* 2056 S> */ B(LdaZero),
-  /* 2056 E> */ B(StaCurrentContextSlot), U8(144),
+  /* 2056 E> */ B(StaCurrentContextSlotNoCell), U8(144),
   /* 2071 S> */ B(LdaZero),
-  /* 2071 E> */ B(StaCurrentContextSlot), U8(145),
+  /* 2071 E> */ B(StaCurrentContextSlotNoCell), U8(145),
   /* 2086 S> */ B(LdaZero),
-  /* 2086 E> */ B(StaCurrentContextSlot), U8(146),
+  /* 2086 E> */ B(StaCurrentContextSlotNoCell), U8(146),
   /* 2101 S> */ B(LdaZero),
-  /* 2101 E> */ B(StaCurrentContextSlot), U8(147),
+  /* 2101 E> */ B(StaCurrentContextSlotNoCell), U8(147),
   /* 2116 S> */ B(LdaZero),
-  /* 2116 E> */ B(StaCurrentContextSlot), U8(148),
+  /* 2116 E> */ B(StaCurrentContextSlotNoCell), U8(148),
   /* 2131 S> */ B(LdaZero),
-  /* 2131 E> */ B(StaCurrentContextSlot), U8(149),
+  /* 2131 E> */ B(StaCurrentContextSlotNoCell), U8(149),
   /* 2146 S> */ B(LdaZero),
-  /* 2146 E> */ B(StaCurrentContextSlot), U8(150),
+  /* 2146 E> */ B(StaCurrentContextSlotNoCell), U8(150),
   /* 2161 S> */ B(LdaZero),
-  /* 2161 E> */ B(StaCurrentContextSlot), U8(151),
+  /* 2161 E> */ B(StaCurrentContextSlotNoCell), U8(151),
   /* 2176 S> */ B(LdaZero),
-  /* 2176 E> */ B(StaCurrentContextSlot), U8(152),
+  /* 2176 E> */ B(StaCurrentContextSlotNoCell), U8(152),
   /* 2191 S> */ B(LdaZero),
-  /* 2191 E> */ B(StaCurrentContextSlot), U8(153),
+  /* 2191 E> */ B(StaCurrentContextSlotNoCell), U8(153),
   /* 2206 S> */ B(LdaZero),
-  /* 2206 E> */ B(StaCurrentContextSlot), U8(154),
+  /* 2206 E> */ B(StaCurrentContextSlotNoCell), U8(154),
   /* 2221 S> */ B(LdaZero),
-  /* 2221 E> */ B(StaCurrentContextSlot), U8(155),
+  /* 2221 E> */ B(StaCurrentContextSlotNoCell), U8(155),
   /* 2236 S> */ B(LdaZero),
-  /* 2236 E> */ B(StaCurrentContextSlot), U8(156),
+  /* 2236 E> */ B(StaCurrentContextSlotNoCell), U8(156),
   /* 2251 S> */ B(LdaZero),
-  /* 2251 E> */ B(StaCurrentContextSlot), U8(157),
+  /* 2251 E> */ B(StaCurrentContextSlotNoCell), U8(157),
   /* 2266 S> */ B(LdaZero),
-  /* 2266 E> */ B(StaCurrentContextSlot), U8(158),
+  /* 2266 E> */ B(StaCurrentContextSlotNoCell), U8(158),
   /* 2281 S> */ B(LdaZero),
-  /* 2281 E> */ B(StaCurrentContextSlot), U8(159),
+  /* 2281 E> */ B(StaCurrentContextSlotNoCell), U8(159),
   /* 2296 S> */ B(LdaZero),
-  /* 2296 E> */ B(StaCurrentContextSlot), U8(160),
+  /* 2296 E> */ B(StaCurrentContextSlotNoCell), U8(160),
   /* 2311 S> */ B(LdaZero),
-  /* 2311 E> */ B(StaCurrentContextSlot), U8(161),
+  /* 2311 E> */ B(StaCurrentContextSlotNoCell), U8(161),
   /* 2326 S> */ B(LdaZero),
-  /* 2326 E> */ B(StaCurrentContextSlot), U8(162),
+  /* 2326 E> */ B(StaCurrentContextSlotNoCell), U8(162),
   /* 2341 S> */ B(LdaZero),
-  /* 2341 E> */ B(StaCurrentContextSlot), U8(163),
+  /* 2341 E> */ B(StaCurrentContextSlotNoCell), U8(163),
   /* 2356 S> */ B(LdaZero),
-  /* 2356 E> */ B(StaCurrentContextSlot), U8(164),
+  /* 2356 E> */ B(StaCurrentContextSlotNoCell), U8(164),
   /* 2371 S> */ B(LdaZero),
-  /* 2371 E> */ B(StaCurrentContextSlot), U8(165),
+  /* 2371 E> */ B(StaCurrentContextSlotNoCell), U8(165),
   /* 2386 S> */ B(LdaZero),
-  /* 2386 E> */ B(StaCurrentContextSlot), U8(166),
+  /* 2386 E> */ B(StaCurrentContextSlotNoCell), U8(166),
   /* 2401 S> */ B(LdaZero),
-  /* 2401 E> */ B(StaCurrentContextSlot), U8(167),
+  /* 2401 E> */ B(StaCurrentContextSlotNoCell), U8(167),
   /* 2416 S> */ B(LdaZero),
-  /* 2416 E> */ B(StaCurrentContextSlot), U8(168),
+  /* 2416 E> */ B(StaCurrentContextSlotNoCell), U8(168),
   /* 2431 S> */ B(LdaZero),
-  /* 2431 E> */ B(StaCurrentContextSlot), U8(169),
+  /* 2431 E> */ B(StaCurrentContextSlotNoCell), U8(169),
   /* 2446 S> */ B(LdaZero),
-  /* 2446 E> */ B(StaCurrentContextSlot), U8(170),
+  /* 2446 E> */ B(StaCurrentContextSlotNoCell), U8(170),
   /* 2461 S> */ B(LdaZero),
-  /* 2461 E> */ B(StaCurrentContextSlot), U8(171),
+  /* 2461 E> */ B(StaCurrentContextSlotNoCell), U8(171),
   /* 2476 S> */ B(LdaZero),
-  /* 2476 E> */ B(StaCurrentContextSlot), U8(172),
+  /* 2476 E> */ B(StaCurrentContextSlotNoCell), U8(172),
   /* 2491 S> */ B(LdaZero),
-  /* 2491 E> */ B(StaCurrentContextSlot), U8(173),
+  /* 2491 E> */ B(StaCurrentContextSlotNoCell), U8(173),
   /* 2506 S> */ B(LdaZero),
-  /* 2506 E> */ B(StaCurrentContextSlot), U8(174),
+  /* 2506 E> */ B(StaCurrentContextSlotNoCell), U8(174),
   /* 2521 S> */ B(LdaZero),
-  /* 2521 E> */ B(StaCurrentContextSlot), U8(175),
+  /* 2521 E> */ B(StaCurrentContextSlotNoCell), U8(175),
   /* 2536 S> */ B(LdaZero),
-  /* 2536 E> */ B(StaCurrentContextSlot), U8(176),
+  /* 2536 E> */ B(StaCurrentContextSlotNoCell), U8(176),
   /* 2551 S> */ B(LdaZero),
-  /* 2551 E> */ B(StaCurrentContextSlot), U8(177),
+  /* 2551 E> */ B(StaCurrentContextSlotNoCell), U8(177),
   /* 2566 S> */ B(LdaZero),
-  /* 2566 E> */ B(StaCurrentContextSlot), U8(178),
+  /* 2566 E> */ B(StaCurrentContextSlotNoCell), U8(178),
   /* 2581 S> */ B(LdaZero),
-  /* 2581 E> */ B(StaCurrentContextSlot), U8(179),
+  /* 2581 E> */ B(StaCurrentContextSlotNoCell), U8(179),
   /* 2596 S> */ B(LdaZero),
-  /* 2596 E> */ B(StaCurrentContextSlot), U8(180),
+  /* 2596 E> */ B(StaCurrentContextSlotNoCell), U8(180),
   /* 2611 S> */ B(LdaZero),
-  /* 2611 E> */ B(StaCurrentContextSlot), U8(181),
+  /* 2611 E> */ B(StaCurrentContextSlotNoCell), U8(181),
   /* 2626 S> */ B(LdaZero),
-  /* 2626 E> */ B(StaCurrentContextSlot), U8(182),
+  /* 2626 E> */ B(StaCurrentContextSlotNoCell), U8(182),
   /* 2641 S> */ B(LdaZero),
-  /* 2641 E> */ B(StaCurrentContextSlot), U8(183),
+  /* 2641 E> */ B(StaCurrentContextSlotNoCell), U8(183),
   /* 2656 S> */ B(LdaZero),
-  /* 2656 E> */ B(StaCurrentContextSlot), U8(184),
+  /* 2656 E> */ B(StaCurrentContextSlotNoCell), U8(184),
   /* 2671 S> */ B(LdaZero),
-  /* 2671 E> */ B(StaCurrentContextSlot), U8(185),
+  /* 2671 E> */ B(StaCurrentContextSlotNoCell), U8(185),
   /* 2686 S> */ B(LdaZero),
-  /* 2686 E> */ B(StaCurrentContextSlot), U8(186),
+  /* 2686 E> */ B(StaCurrentContextSlotNoCell), U8(186),
   /* 2701 S> */ B(LdaZero),
-  /* 2701 E> */ B(StaCurrentContextSlot), U8(187),
+  /* 2701 E> */ B(StaCurrentContextSlotNoCell), U8(187),
   /* 2716 S> */ B(LdaZero),
-  /* 2716 E> */ B(StaCurrentContextSlot), U8(188),
+  /* 2716 E> */ B(StaCurrentContextSlotNoCell), U8(188),
   /* 2731 S> */ B(LdaZero),
-  /* 2731 E> */ B(StaCurrentContextSlot), U8(189),
+  /* 2731 E> */ B(StaCurrentContextSlotNoCell), U8(189),
   /* 2746 S> */ B(LdaZero),
-  /* 2746 E> */ B(StaCurrentContextSlot), U8(190),
+  /* 2746 E> */ B(StaCurrentContextSlotNoCell), U8(190),
   /* 2761 S> */ B(LdaZero),
-  /* 2761 E> */ B(StaCurrentContextSlot), U8(191),
+  /* 2761 E> */ B(StaCurrentContextSlotNoCell), U8(191),
   /* 2776 S> */ B(LdaZero),
-  /* 2776 E> */ B(StaCurrentContextSlot), U8(192),
+  /* 2776 E> */ B(StaCurrentContextSlotNoCell), U8(192),
   /* 2791 S> */ B(LdaZero),
-  /* 2791 E> */ B(StaCurrentContextSlot), U8(193),
+  /* 2791 E> */ B(StaCurrentContextSlotNoCell), U8(193),
   /* 2806 S> */ B(LdaZero),
-  /* 2806 E> */ B(StaCurrentContextSlot), U8(194),
+  /* 2806 E> */ B(StaCurrentContextSlotNoCell), U8(194),
   /* 2821 S> */ B(LdaZero),
-  /* 2821 E> */ B(StaCurrentContextSlot), U8(195),
+  /* 2821 E> */ B(StaCurrentContextSlotNoCell), U8(195),
   /* 2836 S> */ B(LdaZero),
-  /* 2836 E> */ B(StaCurrentContextSlot), U8(196),
+  /* 2836 E> */ B(StaCurrentContextSlotNoCell), U8(196),
   /* 2851 S> */ B(LdaZero),
-  /* 2851 E> */ B(StaCurrentContextSlot), U8(197),
+  /* 2851 E> */ B(StaCurrentContextSlotNoCell), U8(197),
   /* 2866 S> */ B(LdaZero),
-  /* 2866 E> */ B(StaCurrentContextSlot), U8(198),
+  /* 2866 E> */ B(StaCurrentContextSlotNoCell), U8(198),
   /* 2881 S> */ B(LdaZero),
-  /* 2881 E> */ B(StaCurrentContextSlot), U8(199),
+  /* 2881 E> */ B(StaCurrentContextSlotNoCell), U8(199),
   /* 2896 S> */ B(LdaZero),
-  /* 2896 E> */ B(StaCurrentContextSlot), U8(200),
+  /* 2896 E> */ B(StaCurrentContextSlotNoCell), U8(200),
   /* 2911 S> */ B(LdaZero),
-  /* 2911 E> */ B(StaCurrentContextSlot), U8(201),
+  /* 2911 E> */ B(StaCurrentContextSlotNoCell), U8(201),
   /* 2926 S> */ B(LdaZero),
-  /* 2926 E> */ B(StaCurrentContextSlot), U8(202),
+  /* 2926 E> */ B(StaCurrentContextSlotNoCell), U8(202),
   /* 2941 S> */ B(LdaZero),
-  /* 2941 E> */ B(StaCurrentContextSlot), U8(203),
+  /* 2941 E> */ B(StaCurrentContextSlotNoCell), U8(203),
   /* 2956 S> */ B(LdaZero),
-  /* 2956 E> */ B(StaCurrentContextSlot), U8(204),
+  /* 2956 E> */ B(StaCurrentContextSlotNoCell), U8(204),
   /* 2971 S> */ B(LdaZero),
-  /* 2971 E> */ B(StaCurrentContextSlot), U8(205),
+  /* 2971 E> */ B(StaCurrentContextSlotNoCell), U8(205),
   /* 2986 S> */ B(LdaZero),
-  /* 2986 E> */ B(StaCurrentContextSlot), U8(206),
+  /* 2986 E> */ B(StaCurrentContextSlotNoCell), U8(206),
   /* 3001 S> */ B(LdaZero),
-  /* 3001 E> */ B(StaCurrentContextSlot), U8(207),
+  /* 3001 E> */ B(StaCurrentContextSlotNoCell), U8(207),
   /* 3016 S> */ B(LdaZero),
-  /* 3016 E> */ B(StaCurrentContextSlot), U8(208),
+  /* 3016 E> */ B(StaCurrentContextSlotNoCell), U8(208),
   /* 3031 S> */ B(LdaZero),
-  /* 3031 E> */ B(StaCurrentContextSlot), U8(209),
+  /* 3031 E> */ B(StaCurrentContextSlotNoCell), U8(209),
   /* 3046 S> */ B(LdaZero),
-  /* 3046 E> */ B(StaCurrentContextSlot), U8(210),
+  /* 3046 E> */ B(StaCurrentContextSlotNoCell), U8(210),
   /* 3061 S> */ B(LdaZero),
-  /* 3061 E> */ B(StaCurrentContextSlot), U8(211),
+  /* 3061 E> */ B(StaCurrentContextSlotNoCell), U8(211),
   /* 3076 S> */ B(LdaZero),
-  /* 3076 E> */ B(StaCurrentContextSlot), U8(212),
+  /* 3076 E> */ B(StaCurrentContextSlotNoCell), U8(212),
   /* 3091 S> */ B(LdaZero),
-  /* 3091 E> */ B(StaCurrentContextSlot), U8(213),
+  /* 3091 E> */ B(StaCurrentContextSlotNoCell), U8(213),
   /* 3106 S> */ B(LdaZero),
-  /* 3106 E> */ B(StaCurrentContextSlot), U8(214),
+  /* 3106 E> */ B(StaCurrentContextSlotNoCell), U8(214),
   /* 3121 S> */ B(LdaZero),
-  /* 3121 E> */ B(StaCurrentContextSlot), U8(215),
+  /* 3121 E> */ B(StaCurrentContextSlotNoCell), U8(215),
   /* 3136 S> */ B(LdaZero),
-  /* 3136 E> */ B(StaCurrentContextSlot), U8(216),
+  /* 3136 E> */ B(StaCurrentContextSlotNoCell), U8(216),
   /* 3151 S> */ B(LdaZero),
-  /* 3151 E> */ B(StaCurrentContextSlot), U8(217),
+  /* 3151 E> */ B(StaCurrentContextSlotNoCell), U8(217),
   /* 3166 S> */ B(LdaZero),
-  /* 3166 E> */ B(StaCurrentContextSlot), U8(218),
+  /* 3166 E> */ B(StaCurrentContextSlotNoCell), U8(218),
   /* 3181 S> */ B(LdaZero),
-  /* 3181 E> */ B(StaCurrentContextSlot), U8(219),
+  /* 3181 E> */ B(StaCurrentContextSlotNoCell), U8(219),
   /* 3196 S> */ B(LdaZero),
-  /* 3196 E> */ B(StaCurrentContextSlot), U8(220),
+  /* 3196 E> */ B(StaCurrentContextSlotNoCell), U8(220),
   /* 3211 S> */ B(LdaZero),
-  /* 3211 E> */ B(StaCurrentContextSlot), U8(221),
+  /* 3211 E> */ B(StaCurrentContextSlotNoCell), U8(221),
   /* 3226 S> */ B(LdaZero),
-  /* 3226 E> */ B(StaCurrentContextSlot), U8(222),
+  /* 3226 E> */ B(StaCurrentContextSlotNoCell), U8(222),
   /* 3241 S> */ B(LdaZero),
-  /* 3241 E> */ B(StaCurrentContextSlot), U8(223),
+  /* 3241 E> */ B(StaCurrentContextSlotNoCell), U8(223),
   /* 3256 S> */ B(LdaZero),
-  /* 3256 E> */ B(StaCurrentContextSlot), U8(224),
+  /* 3256 E> */ B(StaCurrentContextSlotNoCell), U8(224),
   /* 3271 S> */ B(LdaZero),
-  /* 3271 E> */ B(StaCurrentContextSlot), U8(225),
+  /* 3271 E> */ B(StaCurrentContextSlotNoCell), U8(225),
   /* 3286 S> */ B(LdaZero),
-  /* 3286 E> */ B(StaCurrentContextSlot), U8(226),
+  /* 3286 E> */ B(StaCurrentContextSlotNoCell), U8(226),
   /* 3301 S> */ B(LdaZero),
-  /* 3301 E> */ B(StaCurrentContextSlot), U8(227),
+  /* 3301 E> */ B(StaCurrentContextSlotNoCell), U8(227),
   /* 3316 S> */ B(LdaZero),
-  /* 3316 E> */ B(StaCurrentContextSlot), U8(228),
+  /* 3316 E> */ B(StaCurrentContextSlotNoCell), U8(228),
   /* 3331 S> */ B(LdaZero),
-  /* 3331 E> */ B(StaCurrentContextSlot), U8(229),
+  /* 3331 E> */ B(StaCurrentContextSlotNoCell), U8(229),
   /* 3346 S> */ B(LdaZero),
-  /* 3346 E> */ B(StaCurrentContextSlot), U8(230),
+  /* 3346 E> */ B(StaCurrentContextSlotNoCell), U8(230),
   /* 3361 S> */ B(LdaZero),
-  /* 3361 E> */ B(StaCurrentContextSlot), U8(231),
+  /* 3361 E> */ B(StaCurrentContextSlotNoCell), U8(231),
   /* 3376 S> */ B(LdaZero),
-  /* 3376 E> */ B(StaCurrentContextSlot), U8(232),
+  /* 3376 E> */ B(StaCurrentContextSlotNoCell), U8(232),
   /* 3391 S> */ B(LdaZero),
-  /* 3391 E> */ B(StaCurrentContextSlot), U8(233),
+  /* 3391 E> */ B(StaCurrentContextSlotNoCell), U8(233),
   /* 3406 S> */ B(LdaZero),
-  /* 3406 E> */ B(StaCurrentContextSlot), U8(234),
+  /* 3406 E> */ B(StaCurrentContextSlotNoCell), U8(234),
   /* 3421 S> */ B(LdaZero),
-  /* 3421 E> */ B(StaCurrentContextSlot), U8(235),
+  /* 3421 E> */ B(StaCurrentContextSlotNoCell), U8(235),
   /* 3436 S> */ B(LdaZero),
-  /* 3436 E> */ B(StaCurrentContextSlot), U8(236),
+  /* 3436 E> */ B(StaCurrentContextSlotNoCell), U8(236),
   /* 3451 S> */ B(LdaZero),
-  /* 3451 E> */ B(StaCurrentContextSlot), U8(237),
+  /* 3451 E> */ B(StaCurrentContextSlotNoCell), U8(237),
   /* 3466 S> */ B(LdaZero),
-  /* 3466 E> */ B(StaCurrentContextSlot), U8(238),
+  /* 3466 E> */ B(StaCurrentContextSlotNoCell), U8(238),
   /* 3481 S> */ B(LdaZero),
-  /* 3481 E> */ B(StaCurrentContextSlot), U8(239),
+  /* 3481 E> */ B(StaCurrentContextSlotNoCell), U8(239),
   /* 3496 S> */ B(LdaZero),
-  /* 3496 E> */ B(StaCurrentContextSlot), U8(240),
+  /* 3496 E> */ B(StaCurrentContextSlotNoCell), U8(240),
   /* 3511 S> */ B(LdaZero),
-  /* 3511 E> */ B(StaCurrentContextSlot), U8(241),
+  /* 3511 E> */ B(StaCurrentContextSlotNoCell), U8(241),
   /* 3526 S> */ B(LdaZero),
-  /* 3526 E> */ B(StaCurrentContextSlot), U8(242),
+  /* 3526 E> */ B(StaCurrentContextSlotNoCell), U8(242),
   /* 3541 S> */ B(LdaZero),
-  /* 3541 E> */ B(StaCurrentContextSlot), U8(243),
+  /* 3541 E> */ B(StaCurrentContextSlotNoCell), U8(243),
   /* 3556 S> */ B(LdaZero),
-  /* 3556 E> */ B(StaCurrentContextSlot), U8(244),
+  /* 3556 E> */ B(StaCurrentContextSlotNoCell), U8(244),
   /* 3571 S> */ B(LdaZero),
-  /* 3571 E> */ B(StaCurrentContextSlot), U8(245),
+  /* 3571 E> */ B(StaCurrentContextSlotNoCell), U8(245),
   /* 3586 S> */ B(LdaZero),
-  /* 3586 E> */ B(StaCurrentContextSlot), U8(246),
+  /* 3586 E> */ B(StaCurrentContextSlotNoCell), U8(246),
   /* 3601 S> */ B(LdaZero),
-  /* 3601 E> */ B(StaCurrentContextSlot), U8(247),
+  /* 3601 E> */ B(StaCurrentContextSlotNoCell), U8(247),
   /* 3616 S> */ B(LdaZero),
-  /* 3616 E> */ B(StaCurrentContextSlot), U8(248),
+  /* 3616 E> */ B(StaCurrentContextSlotNoCell), U8(248),
   /* 3631 S> */ B(LdaZero),
-  /* 3631 E> */ B(StaCurrentContextSlot), U8(249),
+  /* 3631 E> */ B(StaCurrentContextSlotNoCell), U8(249),
   /* 3646 S> */ B(LdaZero),
-  /* 3646 E> */ B(StaCurrentContextSlot), U8(250),
+  /* 3646 E> */ B(StaCurrentContextSlotNoCell), U8(250),
   /* 3661 S> */ B(LdaZero),
-  /* 3661 E> */ B(StaCurrentContextSlot), U8(251),
+  /* 3661 E> */ B(StaCurrentContextSlotNoCell), U8(251),
   /* 3676 S> */ B(LdaZero),
-  /* 3676 E> */ B(StaCurrentContextSlot), U8(252),
+  /* 3676 E> */ B(StaCurrentContextSlotNoCell), U8(252),
   /* 3691 S> */ B(LdaZero),
-  /* 3691 E> */ B(StaCurrentContextSlot), U8(253),
+  /* 3691 E> */ B(StaCurrentContextSlotNoCell), U8(253),
   /* 3706 S> */ B(LdaZero),
-  /* 3706 E> */ B(StaCurrentContextSlot), U8(254),
+  /* 3706 E> */ B(StaCurrentContextSlotNoCell), U8(254),
   /* 3721 S> */ B(LdaZero),
-  /* 3721 E> */ B(StaCurrentContextSlot), U8(255),
+  /* 3721 E> */ B(StaCurrentContextSlotNoCell), U8(255),
   /* 3724 S> */ B(LdaGlobal), U8(1), U8(0),
                 B(Star2),
   /* 3724 E> */ B(CallUndefinedReceiver0), R(2), U8(2),
   /* 3740 S> */ B(LdaSmi), I8(100),
-  /* 3740 E> */ B(Wide), B(StaCurrentContextSlot), U16(256),
-  /* 3745 S> */ B(Wide), B(LdaCurrentContextSlot), U16(256),
+  /* 3740 E> */ B(Wide), B(StaCurrentContextSlotNoCell), U16(256),
+  /* 3745 S> */ B(Wide), B(LdaCurrentContextSlotNoCell), U16(256),
   /* 3753 S> */ B(Return),
 ]
 constant pool: [
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/CountOperators.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/CountOperators.golden
index 3517b41504e5ba..10dcf37c0f6830 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/CountOperators.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/CountOperators.golden
@@ -204,12 +204,12 @@ bytecodes: [
   /*   30 E> */ B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(1),
   /*   42 S> */ B(LdaSmi), I8(1),
-  /*   42 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   42 E> */ B(StaCurrentContextSlotNoCell), U8(2),
   /*   53 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
                 B(Star0),
-  /*   78 S> */ B(LdaCurrentContextSlot), U8(2),
+  /*   78 S> */ B(LdaCurrentContextSlotNoCell), U8(2),
                 B(Inc), U8(0),
-  /*   87 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   87 E> */ B(StaCurrentContextSlotNoCell), U8(2),
   /*   89 S> */ B(Return),
 ]
 constant pool: [
@@ -230,14 +230,14 @@ bytecodes: [
   /*   30 E> */ B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(1),
   /*   42 S> */ B(LdaSmi), I8(1),
-  /*   42 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   42 E> */ B(StaCurrentContextSlotNoCell), U8(2),
   /*   53 S> */ B(CreateClosure), U8(1), U8(0), U8(2),
                 B(Star0),
-  /*   78 S> */ B(LdaCurrentContextSlot), U8(2),
+  /*   78 S> */ B(LdaCurrentContextSlotNoCell), U8(2),
                 B(ToNumeric), U8(0),
                 B(Star2),
                 B(Dec), U8(0),
-  /*   86 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   86 E> */ B(StaCurrentContextSlotNoCell), U8(2),
                 B(Ldar), R(2),
   /*   89 S> */ B(Return),
 ]
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/CreateArguments.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/CreateArguments.golden
index af428803f600fc..85d25acc1938eb 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/CreateArguments.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/CreateArguments.golden
@@ -74,7 +74,7 @@ bytecodes: [
   /*   10 E> */ B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(1),
                 B(Ldar), R(arg0),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(CreateMappedArguments),
                 B(Star0),
   /*   16 S> */ B(LdaZero),
@@ -99,11 +99,11 @@ bytecodes: [
   /*   10 E> */ B(CreateFunctionContext), U8(0), U8(3),
                 B(PushContext), R(1),
                 B(Ldar), R(arg0),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlotNoCell), U8(4),
                 B(Ldar), R(arg1),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(Ldar), R(arg2),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(CreateMappedArguments),
                 B(Star0),
   /*   39 S> */ B(Return),
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/Delete.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/Delete.golden
index 3e6c5d6f697d0f..292076d95e9c15 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/Delete.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/Delete.golden
@@ -99,7 +99,7 @@ bytecodes: [
   /*   30 E> */ B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
   /*   56 S> */ B(CreateObjectLiteral), U8(1), U8(0), U8(41),
-  /*   56 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   56 E> */ B(StaCurrentContextSlotNoCell), U8(2),
   /*   64 S> */ B(CreateClosure), U8(2), U8(0), U8(2),
   /*   93 S> */ B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star1),
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/ElideRedundantHoleChecks.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/ElideRedundantHoleChecks.golden
index c5a5bf50fa3cb5..35c49d1ead25f3 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/ElideRedundantHoleChecks.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/ElideRedundantHoleChecks.golden
@@ -284,15 +284,15 @@ bytecodes: [
                 B(ForInNext), R(0), R(4), R(1), U8(0),
                 B(JumpIfUndefined), U8(15),
                 B(Star5),
-                B(LdaCurrentContextSlot), U8(2),
+                B(LdaCurrentContextSlotNoCell), U8(2),
   /*   29 E> */ B(ThrowReferenceErrorIfHole), U8(2),
                 B(Ldar), R(5),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
   /*   41 S> */ B(LdaImmutableCurrentContextSlot), U8(4),
                 B(ThrowReferenceErrorIfHole), U8(3),
                 B(ForInStep), R(4),
   /*   24 E> */ B(JumpLoop), U8(26), I8(0), U8(4),
-  /*   46 S> */ B(LdaCurrentContextSlot), U8(2),
+  /*   46 S> */ B(LdaCurrentContextSlotNoCell), U8(2),
                 B(ThrowReferenceErrorIfHole), U8(2),
   /*   49 S> */ B(LdaImmutableCurrentContextSlot), U8(3),
   /*   52 S> */ B(LdaImmutableCurrentContextSlot), U8(4),
@@ -352,10 +352,10 @@ bytecodes: [
                 B(Star7),
                 B(LdaFalse),
                 B(Star2),
-                B(LdaCurrentContextSlot), U8(2),
+                B(LdaCurrentContextSlotNoCell), U8(2),
                 B(ThrowReferenceErrorIfHole), U8(5),
                 B(Ldar), R(7),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
   /*   41 S> */ B(LdaImmutableCurrentContextSlot), U8(4),
                 B(ThrowReferenceErrorIfHole), U8(6),
   /*   24 E> */ B(JumpLoop), U8(39), I8(0), U8(15),
@@ -393,7 +393,7 @@ bytecodes: [
                 B(SetPendingMessage),
                 B(Ldar), R(4),
                 B(ReThrow),
-  /*   46 S> */ B(LdaCurrentContextSlot), U8(2),
+  /*   46 S> */ B(LdaCurrentContextSlotNoCell), U8(2),
                 B(ThrowReferenceErrorIfHole), U8(5),
   /*   49 S> */ B(LdaImmutableCurrentContextSlot), U8(3),
   /*   52 S> */ B(LdaImmutableCurrentContextSlot), U8(4),
@@ -708,13 +708,13 @@ frame size: 0
 parameter count: 2
 bytecode array length: 20
 bytecodes: [
-  /*   24 S> */ B(LdaCurrentContextSlot), U8(2),
+  /*   24 S> */ B(LdaCurrentContextSlotNoCell), U8(2),
                 B(ThrowReferenceErrorIfHole), U8(0),
                 B(JumpIfToBooleanFalse), U8(8),
                 B(LdaImmutableCurrentContextSlot), U8(3),
   /*   30 E> */ B(ThrowReferenceErrorIfHole), U8(1),
-  /*   26 E> */ B(StaCurrentContextSlot), U8(2),
-  /*   33 S> */ B(LdaCurrentContextSlot), U8(2),
+  /*   26 E> */ B(StaCurrentContextSlotNoCell), U8(2),
+  /*   33 S> */ B(LdaCurrentContextSlotNoCell), U8(2),
   /*   36 S> */ B(LdaImmutableCurrentContextSlot), U8(3),
                 B(ThrowReferenceErrorIfHole), U8(1),
                 B(LdaUndefined),
@@ -742,13 +742,13 @@ frame size: 0
 parameter count: 2
 bytecode array length: 20
 bytecodes: [
-  /*   24 S> */ B(LdaCurrentContextSlot), U8(2),
+  /*   24 S> */ B(LdaCurrentContextSlotNoCell), U8(2),
                 B(ThrowReferenceErrorIfHole), U8(0),
                 B(JumpIfToBooleanTrue), U8(8),
                 B(LdaImmutableCurrentContextSlot), U8(3),
   /*   30 E> */ B(ThrowReferenceErrorIfHole), U8(1),
-  /*   26 E> */ B(StaCurrentContextSlot), U8(2),
-  /*   33 S> */ B(LdaCurrentContextSlot), U8(2),
+  /*   26 E> */ B(StaCurrentContextSlotNoCell), U8(2),
+  /*   33 S> */ B(LdaCurrentContextSlotNoCell), U8(2),
   /*   36 S> */ B(LdaImmutableCurrentContextSlot), U8(3),
                 B(ThrowReferenceErrorIfHole), U8(1),
                 B(LdaUndefined),
@@ -776,14 +776,14 @@ frame size: 0
 parameter count: 2
 bytecode array length: 22
 bytecodes: [
-  /*   24 S> */ B(LdaCurrentContextSlot), U8(2),
+  /*   24 S> */ B(LdaCurrentContextSlotNoCell), U8(2),
                 B(ThrowReferenceErrorIfHole), U8(0),
                 B(JumpIfUndefinedOrNull), U8(4),
                 B(Jump), U8(8),
                 B(LdaImmutableCurrentContextSlot), U8(3),
   /*   30 E> */ B(ThrowReferenceErrorIfHole), U8(1),
-  /*   26 E> */ B(StaCurrentContextSlot), U8(2),
-  /*   33 S> */ B(LdaCurrentContextSlot), U8(2),
+  /*   26 E> */ B(StaCurrentContextSlotNoCell), U8(2),
+  /*   33 S> */ B(LdaCurrentContextSlotNoCell), U8(2),
   /*   36 S> */ B(LdaImmutableCurrentContextSlot), U8(3),
                 B(ThrowReferenceErrorIfHole), U8(1),
                 B(LdaUndefined),
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/Eval.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/Eval.golden
index abd6f12cf45fbf..850ec518082080 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/Eval.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/Eval.golden
@@ -16,11 +16,11 @@ bytecodes: [
   /*   30 E> */ B(CreateFunctionContext), U8(0), U8(4),
                 B(PushContext), R(1),
                 B(Ldar), R(this),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(CreateMappedArguments),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlotNoCell), U8(5),
                 B(Ldar), R(0),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlotNoCell), U8(4),
   /*   34 S> */ B(LdaLookupGlobalSlot), U8(1), U8(0), U8(1),
                 B(Star2),
                 B(LdaConstant), U8(2),
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/ForOfLoop.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/ForOfLoop.golden
index 25fd44d48c2ca7..657dc4d8a02ebb 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/ForOfLoop.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/ForOfLoop.golden
@@ -105,18 +105,18 @@ bytecodes: [
   /*   10 E> */ B(CreateFunctionContext), U8(0), U8(5),
                 B(PushContext), R(2),
                 B(Ldar), R(this),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(Ldar), R(arg0),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlotNoCell), U8(4),
                 B(CreateMappedArguments),
-                B(StaCurrentContextSlot), U8(6),
+                B(StaCurrentContextSlotNoCell), U8(6),
                 B(Ldar), R(1),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlotNoCell), U8(5),
                 B(CreateBlockContext), U8(1),
                 B(PushContext), R(3),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
-  /*   34 S> */ B(LdaContextSlot), R(3), U8(4), U8(0),
+                B(StaCurrentContextSlotNoCell), U8(2),
+  /*   34 S> */ B(LdaContextSlotNoCell), R(3), U8(4), U8(0),
                 B(Star6),
                 B(GetIterator), R(6), U8(0), U8(2),
                 B(Star5),
@@ -143,9 +143,9 @@ bytecodes: [
                 B(CreateBlockContext), U8(5),
                 B(PushContext), R(11),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
   /*   29 S> */ B(Ldar), R(0),
-  /*   29 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   29 E> */ B(StaCurrentContextSlotNoCell), U8(2),
   /*   41 S> */ B(LdaLookupGlobalSlot), U8(6), U8(12), U8(3),
                 B(Star12),
                 B(LdaConstant), U8(7),
@@ -254,9 +254,9 @@ bytecodes: [
                 B(CreateBlockContext), U8(3),
                 B(PushContext), R(9),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
   /*   29 S> */ B(Ldar), R(0),
-  /*   29 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   29 E> */ B(StaCurrentContextSlotNoCell), U8(2),
   /*   41 S> */ B(CreateClosure), U8(4), U8(0), U8(2),
                 B(Star10),
   /*   67 E> */ B(CallUndefinedReceiver0), R(10), U8(12),
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/LetVariableContextSlot.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/LetVariableContextSlot.golden
index f154cb7631ae9d..6cb30db803cd3c 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/LetVariableContextSlot.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/LetVariableContextSlot.golden
@@ -16,9 +16,9 @@ bytecodes: [
   /*   30 E> */ B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
   /*   42 S> */ B(LdaSmi), I8(10),
-  /*   42 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   42 E> */ B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaUndefined),
   /*   72 S> */ B(Return),
 ]
@@ -39,9 +39,9 @@ bytecodes: [
   /*   30 E> */ B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
   /*   42 S> */ B(LdaSmi), I8(10),
-  /*   42 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   42 E> */ B(StaCurrentContextSlotNoCell), U8(2),
   /*   72 S> */ B(LdaImmutableCurrentContextSlot), U8(2),
   /*   81 S> */ B(Return),
 ]
@@ -62,14 +62,14 @@ bytecodes: [
   /*   30 E> */ B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
   /*   42 S> */ B(LdaSmi), I8(20),
                 B(Star1),
-                B(LdaCurrentContextSlot), U8(2),
+                B(LdaCurrentContextSlotNoCell), U8(2),
   /*   45 E> */ B(ThrowReferenceErrorIfHole), U8(1),
                 B(Ldar), R(1),
-                B(StaCurrentContextSlot), U8(2),
-  /*   42 E> */ B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
+  /*   42 E> */ B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaUndefined),
   /*   78 S> */ B(Return),
 ]
@@ -91,11 +91,11 @@ bytecodes: [
   /*   30 E> */ B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
   /*   42 S> */ B(LdaSmi), I8(10),
-  /*   42 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   42 E> */ B(StaCurrentContextSlotNoCell), U8(2),
   /*   46 S> */ B(LdaSmi), I8(20),
-  /*   48 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   48 E> */ B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaUndefined),
   /*   80 S> */ B(Return),
 ]
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/LookupSlot.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/LookupSlot.golden
index cd8c87619ef51e..a9ffbe7a9aded0 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/LookupSlot.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/LookupSlot.golden
@@ -17,11 +17,11 @@ bytecodes: [
   /*   10 E> */ B(CreateFunctionContext), U8(0), U8(4),
                 B(PushContext), R(1),
                 B(Ldar), R(this),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(CreateMappedArguments),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlotNoCell), U8(5),
                 B(Ldar), R(0),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlotNoCell), U8(4),
   /*   14 S> */ B(LdaLookupGlobalSlot), U8(1), U8(0), U8(1),
                 B(Star2),
                 B(LdaConstant), U8(2),
@@ -61,11 +61,11 @@ bytecodes: [
   /*   10 E> */ B(CreateFunctionContext), U8(0), U8(4),
                 B(PushContext), R(1),
                 B(Ldar), R(this),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(CreateMappedArguments),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlotNoCell), U8(5),
                 B(Ldar), R(0),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlotNoCell), U8(4),
   /*   14 S> */ B(LdaLookupGlobalSlot), U8(1), U8(0), U8(1),
                 B(Star2),
                 B(LdaConstant), U8(2),
@@ -106,11 +106,11 @@ bytecodes: [
   /*   10 E> */ B(CreateFunctionContext), U8(0), U8(4),
                 B(PushContext), R(1),
                 B(Ldar), R(this),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(CreateMappedArguments),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlotNoCell), U8(5),
                 B(Ldar), R(0),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlotNoCell), U8(4),
   /*   14 S> */ B(LdaSmi), I8(20),
   /*   16 E> */ B(StaLookupSlot), U8(1), U8(0),
   /*   22 S> */ B(LdaLookupGlobalSlot), U8(2), U8(0), U8(1),
@@ -156,11 +156,11 @@ bytecodes: [
   /*   38 E> */ B(CreateFunctionContext), U8(0), U8(4),
                 B(PushContext), R(1),
                 B(Ldar), R(this),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(CreateMappedArguments),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlotNoCell), U8(5),
                 B(Ldar), R(0),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlotNoCell), U8(4),
   /*   44 S> */ B(LdaLookupGlobalSlot), U8(1), U8(0), U8(1),
                 B(Star2),
                 B(LdaConstant), U8(2),
@@ -177,7 +177,7 @@ bytecodes: [
                 B(CallRuntime), U16(Runtime::kResolvePossiblyDirectEval), R(4), U8(6),
                 B(Star2),
   /*   44 E> */ B(CallUndefinedReceiver1), R(2), R(3), U8(2),
-  /*   66 S> */ B(LdaLookupContextSlot), U8(3), U8(4), U8(1),
+  /*   66 S> */ B(LdaLookupContextSlotNoCell), U8(3), U8(4), U8(1),
   /*   75 S> */ B(Return),
 ]
 constant pool: [
@@ -205,11 +205,11 @@ bytecodes: [
   /*   34 E> */ B(CreateFunctionContext), U8(0), U8(4),
                 B(PushContext), R(1),
                 B(Ldar), R(this),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(CreateMappedArguments),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlotNoCell), U8(5),
                 B(Ldar), R(0),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlotNoCell), U8(4),
   /*   40 S> */ B(LdaLookupGlobalSlot), U8(1), U8(0), U8(1),
                 B(Star2),
                 B(LdaConstant), U8(2),
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/OuterContextVariables.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/OuterContextVariables.golden
index 1b8f118a93bd47..e2bb1f22bdf16d 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/OuterContextVariables.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/OuterContextVariables.golden
@@ -50,7 +50,7 @@ parameter count: 1
 bytecode array length: 8
 bytecodes: [
   /*  102 S> */ B(LdaImmutableCurrentContextSlot), U8(2),
-  /*  111 E> */ B(StaContextSlot), R(context), U8(2), U8(1),
+  /*  111 E> */ B(StaContextSlotNoCell), R(context), U8(2), U8(1),
                 B(LdaUndefined),
   /*  123 S> */ B(Return),
 ]
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/PrivateAccessorDeclaration.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/PrivateAccessorDeclaration.golden
index 969e28aa717336..5e3def36261a52 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/PrivateAccessorDeclaration.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/PrivateAccessorDeclaration.golden
@@ -23,7 +23,7 @@ bytecodes: [
                 B(LdaConstant), U8(2),
                 B(Star3),
                 B(CallRuntime), U16(Runtime::kCreatePrivateBrandSymbol), R(3), U8(1),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(LdaTheHole),
                 B(Star5),
                 B(CreateClosure), U8(3), U8(0), U8(2),
@@ -37,7 +37,7 @@ bytecodes: [
                 B(CreateClosure), U8(5), U8(2), U8(2),
                 B(Star4),
                 B(CallRuntime), U16(Runtime::kCreatePrivateAccessors), R(3), U8(2),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(PopContext), R(1),
                 B(Mov), R(2), R(0),
                 B(LdaUndefined),
@@ -71,7 +71,7 @@ bytecodes: [
                 B(LdaConstant), U8(2),
                 B(Star3),
                 B(CallRuntime), U16(Runtime::kCreatePrivateBrandSymbol), R(3), U8(1),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(LdaTheHole),
                 B(Star5),
                 B(CreateClosure), U8(3), U8(0), U8(2),
@@ -85,7 +85,7 @@ bytecodes: [
                 B(LdaNull),
                 B(Star4),
                 B(CallRuntime), U16(Runtime::kCreatePrivateAccessors), R(3), U8(2),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(PopContext), R(1),
                 B(Mov), R(2), R(0),
                 B(LdaUndefined),
@@ -118,7 +118,7 @@ bytecodes: [
                 B(LdaConstant), U8(2),
                 B(Star3),
                 B(CallRuntime), U16(Runtime::kCreatePrivateBrandSymbol), R(3), U8(1),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(LdaTheHole),
                 B(Star5),
                 B(CreateClosure), U8(3), U8(0), U8(2),
@@ -132,7 +132,7 @@ bytecodes: [
                 B(CreateClosure), U8(4), U8(1), U8(2),
                 B(Star4),
                 B(CallRuntime), U16(Runtime::kCreatePrivateAccessors), R(3), U8(2),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(PopContext), R(1),
                 B(Mov), R(2), R(0),
                 B(LdaUndefined),
@@ -171,7 +171,7 @@ bytecodes: [
                 B(LdaConstant), U8(2),
                 B(Star4),
                 B(CallRuntime), U16(Runtime::kCreatePrivateBrandSymbol), R(4), U8(1),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(LdaTheHole),
                 B(Star6),
                 B(CreateClosure), U8(3), U8(0), U8(2),
@@ -185,7 +185,7 @@ bytecodes: [
                 B(CreateClosure), U8(5), U8(2), U8(2),
                 B(Star5),
                 B(CallRuntime), U16(Runtime::kCreatePrivateAccessors), R(4), U8(2),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(PopContext), R(2),
                 B(Mov), R(3), R(0),
   /*   38 E> */ B(CreateBlockContext), U8(6),
@@ -193,7 +193,7 @@ bytecodes: [
                 B(LdaConstant), U8(8),
                 B(Star4),
                 B(CallRuntime), U16(Runtime::kCreatePrivateBrandSymbol), R(4), U8(1),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
   /*  118 E> */ B(CreateClosure), U8(9), U8(3), U8(2),
                 B(Star3),
                 B(LdaConstant), U8(7),
@@ -206,7 +206,7 @@ bytecodes: [
                 B(CreateClosure), U8(11), U8(5), U8(2),
                 B(Star5),
                 B(CallRuntime), U16(Runtime::kCreatePrivateAccessors), R(4), U8(2),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(PopContext), R(2),
                 B(Mov), R(3), R(1),
                 B(LdaUndefined),
@@ -262,7 +262,7 @@ bytecodes: [
                 B(LdaConstant), U8(6),
                 B(Star4),
                 B(CallRuntime), U16(Runtime::kCreatePrivateBrandSymbol), R(4), U8(1),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
   /*   77 E> */ B(CreateClosure), U8(7), U8(2), U8(2),
                 B(Star3),
                 B(LdaConstant), U8(5),
@@ -270,15 +270,15 @@ bytecodes: [
                 B(Mov), R(3), R(5),
                 B(Mov), R(0), R(6),
                 B(CallRuntime), U16(Runtime::kDefineClass), R(4), U8(3),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlotNoCell), U8(4),
                 B(Ldar), R(5),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlotNoCell), U8(5),
                 B(CreateClosure), U8(8), U8(3), U8(2),
                 B(Star4),
                 B(LdaNull),
                 B(Star5),
                 B(CallRuntime), U16(Runtime::kCreatePrivateAccessors), R(4), U8(2),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(PopContext), R(2),
                 B(Mov), R(3), R(1),
   /*  122 S> */ B(Ldar), R(1),
@@ -333,7 +333,7 @@ bytecodes: [
                 B(LdaConstant), U8(6),
                 B(Star4),
                 B(CallRuntime), U16(Runtime::kCreatePrivateBrandSymbol), R(4), U8(1),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
   /*   80 E> */ B(CreateClosure), U8(7), U8(2), U8(2),
                 B(Star3),
                 B(LdaConstant), U8(5),
@@ -341,15 +341,15 @@ bytecodes: [
                 B(Mov), R(3), R(5),
                 B(Mov), R(0), R(6),
                 B(CallRuntime), U16(Runtime::kDefineClass), R(4), U8(3),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlotNoCell), U8(4),
                 B(Ldar), R(5),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlotNoCell), U8(5),
                 B(LdaNull),
                 B(Star4),
                 B(CreateClosure), U8(8), U8(3), U8(2),
                 B(Star5),
                 B(CallRuntime), U16(Runtime::kCreatePrivateAccessors), R(4), U8(2),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(PopContext), R(2),
                 B(Mov), R(3), R(1),
   /*  126 S> */ B(Ldar), R(1),
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/PrivateClassFields.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/PrivateClassFields.golden
index 81996e074d03d3..df4e6a1f2fc0e9 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/PrivateClassFields.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/PrivateClassFields.golden
@@ -33,7 +33,7 @@ bytecodes: [
                 B(LdaConstant), U8(2),
                 B(Star4),
                 B(CallRuntime), U16(Runtime::kCreatePrivateNameSymbol), R(4), U8(1),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaTheHole),
                 B(Star6),
                 B(CreateClosure), U8(3), U8(0), U8(2),
@@ -53,7 +53,7 @@ bytecodes: [
                 B(LdaConstant), U8(2),
                 B(Star4),
                 B(CallRuntime), U16(Runtime::kCreatePrivateNameSymbol), R(4), U8(1),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaTheHole),
                 B(Star6),
                 B(CreateClosure), U8(8), U8(2), U8(2),
@@ -134,7 +134,7 @@ bytecodes: [
                 B(LdaConstant), U8(2),
                 B(Star5),
                 B(CallRuntime), U16(Runtime::kCreatePrivateNameSymbol), R(5), U8(1),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaTheHole),
                 B(Star11),
                 B(CreateClosure), U8(4), U8(0), U8(2),
@@ -161,13 +161,13 @@ bytecodes: [
                 B(LdaConstant), U8(2),
                 B(Star5),
                 B(CallRuntime), U16(Runtime::kCreatePrivateNameSymbol), R(5), U8(1),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaConstant), U8(10),
                 B(Star5),
                 B(LdaConstant), U8(10),
                 B(Star5),
                 B(CallRuntime), U16(Runtime::kCreatePrivateNameSymbol), R(5), U8(1),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(LdaTheHole),
                 B(Star11),
                 B(CreateClosure), U8(12), U8(3), U8(2),
@@ -198,7 +198,7 @@ bytecodes: [
                 B(LdaConstant), U8(2),
                 B(Star5),
                 B(CallRuntime), U16(Runtime::kCreatePrivateNameSymbol), R(5), U8(1),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
   /*  356 E> */ B(CreateClosure), U8(19), U8(8), U8(2),
                 B(Star4),
                 B(LdaConstant), U8(18),
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/PrivateMethodAccess.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/PrivateMethodAccess.golden
index ec47510fd42b64..f02078fa547441 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/PrivateMethodAccess.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/PrivateMethodAccess.golden
@@ -121,7 +121,7 @@ bytecodes: [
   /*   44 E> */ B(CreateFunctionContext), U8(0), U8(1),
                 B(PushContext), R(0),
                 B(Ldar), R(this),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaImmutableContextSlot), R(0), U8(3), U8(0),
                 B(Star1),
                 B(Ldar), R(0),
@@ -171,10 +171,10 @@ bytecodes: [
                 B(Ldar), R(2),
   /*   89 E> */ B(Construct), R(1), R(0), U8(0), U8(0),
                 B(Star1),
-                B(LdaCurrentContextSlot), U8(2),
+                B(LdaCurrentContextSlotNoCell), U8(2),
                 B(ThrowSuperAlreadyCalledIfNotHole),
                 B(Ldar), R(1),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaImmutableContextSlot), R(context), U8(3), U8(1),
                 B(Star3),
                 B(LdaSmi), I8(1),
@@ -223,10 +223,10 @@ bytecodes: [
                 B(Ldar), R(2),
   /*   88 E> */ B(Construct), R(1), R(0), U8(0), U8(0),
                 B(Star1),
-                B(LdaCurrentContextSlot), U8(2),
+                B(LdaCurrentContextSlotNoCell), U8(2),
                 B(ThrowSuperAlreadyCalledIfNotHole),
                 B(Ldar), R(1),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaImmutableContextSlot), R(context), U8(3), U8(1),
                 B(Star3),
                 B(LdaSmi), I8(1),
@@ -274,10 +274,10 @@ bytecodes: [
                 B(Ldar), R(2),
   /*   88 E> */ B(Construct), R(1), R(0), U8(0), U8(0),
                 B(Star1),
-                B(LdaCurrentContextSlot), U8(2),
+                B(LdaCurrentContextSlotNoCell), U8(2),
                 B(ThrowSuperAlreadyCalledIfNotHole),
                 B(Ldar), R(1),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaImmutableContextSlot), R(context), U8(3), U8(1),
                 B(Star3),
                 B(LdaSmi), I8(1),
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/PrivateMethodDeclaration.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/PrivateMethodDeclaration.golden
index 74bc9918e0ad37..b4b69d0f69e936 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/PrivateMethodDeclaration.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/PrivateMethodDeclaration.golden
@@ -22,9 +22,9 @@ bytecodes: [
                 B(LdaConstant), U8(2),
                 B(Star3),
                 B(CallRuntime), U16(Runtime::kCreatePrivateBrandSymbol), R(3), U8(1),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(CreateClosure), U8(3), U8(0), U8(2),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaTheHole),
                 B(Star5),
                 B(CreateClosure), U8(4), U8(1), U8(2),
@@ -68,9 +68,9 @@ bytecodes: [
                 B(LdaConstant), U8(2),
                 B(Star4),
                 B(CallRuntime), U16(Runtime::kCreatePrivateBrandSymbol), R(4), U8(1),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(CreateClosure), U8(3), U8(0), U8(2),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaTheHole),
                 B(Star6),
                 B(CreateClosure), U8(4), U8(1), U8(2),
@@ -86,9 +86,9 @@ bytecodes: [
                 B(LdaConstant), U8(7),
                 B(Star4),
                 B(CallRuntime), U16(Runtime::kCreatePrivateBrandSymbol), R(4), U8(1),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(CreateClosure), U8(8), U8(2), U8(2),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
   /*   93 E> */ B(CreateClosure), U8(9), U8(3), U8(2),
                 B(Star3),
                 B(LdaConstant), U8(6),
@@ -148,9 +148,9 @@ bytecodes: [
                 B(LdaConstant), U8(6),
                 B(Star4),
                 B(CallRuntime), U16(Runtime::kCreatePrivateBrandSymbol), R(4), U8(1),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(CreateClosure), U8(7), U8(2), U8(2),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
   /*   77 E> */ B(CreateClosure), U8(8), U8(3), U8(2),
                 B(Star3),
                 B(LdaConstant), U8(5),
@@ -158,9 +158,9 @@ bytecodes: [
                 B(Mov), R(3), R(5),
                 B(Mov), R(0), R(6),
                 B(CallRuntime), U16(Runtime::kDefineClass), R(4), U8(3),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlotNoCell), U8(4),
                 B(Ldar), R(5),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlotNoCell), U8(5),
                 B(PopContext), R(2),
                 B(Star1),
                 B(LdaUndefined),
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/PublicClassFields.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/PublicClassFields.golden
index 4d82a8d4db0994..84fa9a28e107fd 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/PublicClassFields.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/PublicClassFields.golden
@@ -28,7 +28,7 @@ bytecodes: [
   /*   30 E> */ B(CreateBlockContext), U8(0),
                 B(PushContext), R(2),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaTheHole),
                 B(Star6),
                 B(CreateClosure), U8(2), U8(0), U8(2),
@@ -36,7 +36,7 @@ bytecodes: [
                 B(LdaConstant), U8(1),
                 B(Star4),
   /*   60 S> */ B(LdaConstant), U8(3),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(Star7),
                 B(Mov), R(3), R(5),
                 B(CallRuntime), U16(Runtime::kDefineClass), R(4), U8(4),
@@ -47,7 +47,7 @@ bytecodes: [
   /*   38 E> */ B(CreateBlockContext), U8(6),
                 B(PushContext), R(2),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaTheHole),
                 B(Star6),
                 B(CreateClosure), U8(8), U8(2), U8(2),
@@ -55,7 +55,7 @@ bytecodes: [
                 B(LdaConstant), U8(7),
                 B(Star4),
   /*   99 S> */ B(LdaConstant), U8(3),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(Star7),
                 B(Mov), R(3), R(5),
                 B(CallRuntime), U16(Runtime::kDefineClass), R(4), U8(4),
@@ -122,7 +122,7 @@ bytecodes: [
   /*   30 E> */ B(CreateBlockContext), U8(0),
                 B(PushContext), R(3),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaTheHole),
                 B(Star11),
                 B(CreateClosure), U8(3), U8(0), U8(2),
@@ -136,7 +136,7 @@ bytecodes: [
                 B(LdaConstant), U8(1),
                 B(Star5),
   /*   77 S> */ B(LdaConstant), U8(5),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(Star8),
                 B(Mov), R(4), R(6),
                 B(Mov), R(10), R(7),
@@ -148,7 +148,7 @@ bytecodes: [
   /*   38 E> */ B(CreateBlockContext), U8(8),
                 B(PushContext), R(3),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaTheHole),
                 B(Star11),
                 B(CreateClosure), U8(11), U8(3), U8(2),
@@ -162,7 +162,7 @@ bytecodes: [
                 B(LdaConstant), U8(9),
                 B(Star5),
   /*  133 S> */ B(LdaConstant), U8(5),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(Star8),
                 B(CreateClosure), U8(13), U8(5), U8(2),
                 B(Star9),
@@ -176,13 +176,13 @@ bytecodes: [
   /*   90 E> */ B(CreateBlockContext), U8(15),
                 B(PushContext), R(3),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
   /*  236 E> */ B(CreateClosure), U8(17), U8(7), U8(2),
                 B(Star4),
                 B(LdaConstant), U8(16),
                 B(Star5),
   /*  256 S> */ B(LdaConstant), U8(5),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(Star8),
                 B(Mov), R(4), R(6),
                 B(Mov), R(1), R(7),
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/StandardForLoop.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/StandardForLoop.golden
index 644e31f89b4f0b..36a7fddb54e797 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/StandardForLoop.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/StandardForLoop.golden
@@ -49,39 +49,39 @@ bytecodes: [
   /*   10 E> */ B(CreateFunctionContext), U8(0), U8(4),
                 B(PushContext), R(4),
                 B(Ldar), R(this),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(CreateMappedArguments),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlotNoCell), U8(5),
                 B(Ldar), R(3),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlotNoCell), U8(4),
                 B(CreateBlockContext), U8(1),
                 B(PushContext), R(5),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
   /*   30 S> */ B(LdaZero),
-  /*   30 E> */ B(StaCurrentContextSlot), U8(2),
-                B(LdaCurrentContextSlot), U8(2),
+  /*   30 E> */ B(StaCurrentContextSlotNoCell), U8(2),
+                B(LdaCurrentContextSlotNoCell), U8(2),
                 B(Star0),
                 B(LdaSmi), I8(1),
                 B(Star1),
   /*   59 E> */ B(CreateBlockContext), U8(2),
                 B(PushContext), R(6),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(Ldar), R(0),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaSmi), I8(1),
                 B(TestEqual), R(1), U8(0),
                 B(JumpIfFalse), U8(6),
                 B(LdaZero),
                 B(Star1),
                 B(Jump), U8(8),
-  /*   43 S> */ B(LdaCurrentContextSlot), U8(2),
+  /*   43 S> */ B(LdaCurrentContextSlotNoCell), U8(2),
                 B(Inc), U8(1),
-  /*   43 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   43 E> */ B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaSmi), I8(1),
                 B(Star2),
-  /*   35 S> */ B(LdaCurrentContextSlot), U8(2),
+  /*   35 S> */ B(LdaCurrentContextSlotNoCell), U8(2),
                 B(Star7),
                 B(LdaSmi), I8(10),
   /*   35 E> */ B(TestLessThan), R(7), U8(2),
@@ -110,7 +110,7 @@ bytecodes: [
   /*   48 E> */ B(CallUndefinedReceiver1), R(7), R(8), U8(6),
                 B(LdaZero),
                 B(Star2),
-                B(LdaCurrentContextSlot), U8(2),
+                B(LdaCurrentContextSlotNoCell), U8(2),
                 B(Star0),
   /*   17 E> */ B(JumpLoop), U8(47), I8(1), U8(8),
                 B(LdaSmi), I8(1),
@@ -153,21 +153,21 @@ bytecodes: [
   /*   78 E> */ B(CreateBlockContext), U8(0),
                 B(PushContext), R(4),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(Ldar), R(0),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaSmi), I8(1),
                 B(TestEqual), R(1), U8(0),
                 B(JumpIfFalse), U8(6),
                 B(LdaZero),
                 B(Star1),
                 B(Jump), U8(8),
-  /*   43 S> */ B(LdaCurrentContextSlot), U8(2),
+  /*   43 S> */ B(LdaCurrentContextSlotNoCell), U8(2),
                 B(Inc), U8(1),
-  /*   43 E> */ B(StaCurrentContextSlot), U8(2),
+  /*   43 E> */ B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaSmi), I8(1),
                 B(Star2),
-  /*   35 S> */ B(LdaCurrentContextSlot), U8(2),
+  /*   35 S> */ B(LdaCurrentContextSlotNoCell), U8(2),
                 B(Star5),
                 B(LdaSmi), I8(10),
   /*   35 E> */ B(TestLessThan), R(5), U8(2),
@@ -183,7 +183,7 @@ bytecodes: [
   /*   74 E> */ B(CallUndefinedReceiver0), R(5), U8(4),
                 B(LdaZero),
                 B(Star2),
-                B(LdaCurrentContextSlot), U8(2),
+                B(LdaCurrentContextSlotNoCell), U8(2),
                 B(Star0),
   /*   17 E> */ B(JumpLoop), U8(20), I8(1), U8(6),
                 B(LdaSmi), I8(1),
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/StaticClassFields.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/StaticClassFields.golden
index f6638873025492..2079cbdff0b3eb 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/StaticClassFields.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/StaticClassFields.golden
@@ -32,9 +32,9 @@ bytecodes: [
   /*   30 E> */ B(CreateBlockContext), U8(0),
                 B(PushContext), R(2),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(LdaTheHole),
                 B(Star6),
                 B(CreateClosure), U8(2), U8(0), U8(2),
@@ -42,7 +42,7 @@ bytecodes: [
                 B(LdaConstant), U8(1),
                 B(Star4),
   /*   60 S> */ B(LdaConstant), U8(3),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(Star7),
   /*   92 S> */ B(LdaConstant), U8(4),
                 B(Star8),
@@ -52,7 +52,7 @@ bytecodes: [
                 B(JumpIfFalse), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowStaticPrototypeError), R(0), U8(0),
                 B(Ldar), R(8),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(CallRuntime), U16(Runtime::kDefineClass), R(4), U8(5),
                 B(CreateClosure), U8(6), U8(1), U8(2),
                 B(SetNamedProperty), R(3), U8(7), U8(1),
@@ -64,9 +64,9 @@ bytecodes: [
   /*   38 E> */ B(CreateBlockContext), U8(9),
                 B(PushContext), R(2),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(LdaTheHole),
                 B(Star6),
                 B(CreateClosure), U8(11), U8(3), U8(2),
@@ -74,7 +74,7 @@ bytecodes: [
                 B(LdaConstant), U8(10),
                 B(Star4),
   /*  131 S> */ B(LdaConstant), U8(3),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(Star7),
   /*  176 S> */ B(LdaConstant), U8(4),
                 B(Star8),
@@ -84,7 +84,7 @@ bytecodes: [
                 B(JumpIfFalse), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowStaticPrototypeError), R(0), U8(0),
                 B(Ldar), R(8),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(CallRuntime), U16(Runtime::kDefineClass), R(4), U8(5),
                 B(CreateClosure), U8(12), U8(4), U8(2),
                 B(SetNamedProperty), R(3), U8(7), U8(5),
@@ -162,9 +162,9 @@ bytecodes: [
   /*   30 E> */ B(CreateBlockContext), U8(0),
                 B(PushContext), R(3),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(LdaTheHole),
                 B(Star11),
                 B(CreateClosure), U8(3), U8(0), U8(2),
@@ -178,7 +178,7 @@ bytecodes: [
                 B(LdaConstant), U8(1),
                 B(Star5),
   /*   77 S> */ B(LdaConstant), U8(5),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(Star8),
   /*  109 S> */ B(LdaConstant), U8(6),
                 B(Star9),
@@ -189,7 +189,7 @@ bytecodes: [
                 B(JumpIfFalse), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowStaticPrototypeError), R(0), U8(0),
                 B(Ldar), R(9),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(CallRuntime), U16(Runtime::kDefineClass), R(5), U8(5),
                 B(CreateClosure), U8(8), U8(2), U8(2),
                 B(SetNamedProperty), R(4), U8(9), U8(1),
@@ -201,9 +201,9 @@ bytecodes: [
   /*   38 E> */ B(CreateBlockContext), U8(11),
                 B(PushContext), R(3),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(LdaTheHole),
                 B(Star11),
                 B(CreateClosure), U8(14), U8(4), U8(2),
@@ -217,7 +217,7 @@ bytecodes: [
                 B(LdaConstant), U8(12),
                 B(Star5),
   /*  165 S> */ B(LdaConstant), U8(5),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(Star8),
   /*  210 S> */ B(LdaConstant), U8(6),
                 B(Star9),
@@ -228,7 +228,7 @@ bytecodes: [
                 B(JumpIfFalse), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowStaticPrototypeError), R(0), U8(0),
                 B(Ldar), R(9),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(CreateClosure), U8(16), U8(6), U8(2),
                 B(Star10),
                 B(CallRuntime), U16(Runtime::kDefineClass), R(5), U8(6),
@@ -242,15 +242,15 @@ bytecodes: [
   /*  122 E> */ B(CreateBlockContext), U8(19),
                 B(PushContext), R(3),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaTheHole),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
   /*  313 E> */ B(CreateClosure), U8(21), U8(9), U8(2),
                 B(Star4),
                 B(LdaConstant), U8(20),
                 B(Star5),
   /*  333 S> */ B(LdaConstant), U8(5),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(Star8),
   /*  378 S> */ B(LdaConstant), U8(6),
                 B(Star9),
@@ -261,11 +261,11 @@ bytecodes: [
                 B(JumpIfFalse), U8(7),
                 B(CallRuntime), U16(Runtime::kThrowStaticPrototypeError), R(0), U8(0),
                 B(Ldar), R(9),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(CallRuntime), U16(Runtime::kDefineClass), R(5), U8(5),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlotNoCell), U8(4),
                 B(Ldar), R(4),
-                B(StaCurrentContextSlot), U8(5),
+                B(StaCurrentContextSlotNoCell), U8(5),
                 B(CreateClosure), U8(22), U8(10), U8(2),
                 B(SetNamedProperty), R(4), U8(9), U8(9),
                 B(CreateClosure), U8(23), U8(11), U8(2),
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/StaticPrivateMethodAccess.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/StaticPrivateMethodAccess.golden
index 3e8c5e4ae97676..1f64336bc795c9 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/StaticPrivateMethodAccess.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/StaticPrivateMethodAccess.golden
@@ -20,7 +20,7 @@ frame size: 4
 parameter count: 1
 bytecode array length: 32
 bytecodes: [
-  /*   56 S> */ B(LdaCurrentContextSlot), U8(3),
+  /*   56 S> */ B(LdaCurrentContextSlotNoCell), U8(3),
                 B(TestReferenceEqual), R(this),
                 B(Mov), R(this), R(1),
                 B(JumpIfTrue), U8(16),
@@ -57,7 +57,7 @@ bytecode array length: 40
 bytecodes: [
   /*   56 S> */ B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star1),
-                B(LdaCurrentContextSlot), U8(3),
+                B(LdaCurrentContextSlotNoCell), U8(3),
                 B(TestReferenceEqual), R(this),
                 B(Mov), R(this), R(0),
                 B(JumpIfTrue), U8(16),
@@ -95,7 +95,7 @@ frame size: 3
 parameter count: 1
 bytecode array length: 37
 bytecodes: [
-  /*   56 S> */ B(LdaCurrentContextSlot), U8(3),
+  /*   56 S> */ B(LdaCurrentContextSlotNoCell), U8(3),
                 B(TestReferenceEqual), R(this),
                 B(Mov), R(this), R(0),
                 B(JumpIfTrue), U8(16),
@@ -141,7 +141,7 @@ bytecode array length: 127
 bytecodes: [
   /*   90 S> */ B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star1),
-                B(LdaCurrentContextSlot), U8(3),
+                B(LdaCurrentContextSlotNoCell), U8(3),
                 B(TestReferenceEqual), R(this),
                 B(Mov), R(this), R(0),
                 B(JumpIfTrue), U8(16),
@@ -163,7 +163,7 @@ bytecodes: [
                 B(Star1),
                 B(LdaSmi), I8(1),
                 B(Star2),
-                B(LdaCurrentContextSlot), U8(3),
+                B(LdaCurrentContextSlotNoCell), U8(3),
                 B(TestReferenceEqual), R(this),
                 B(Mov), R(this), R(0),
                 B(JumpIfTrue), U8(16),
@@ -178,7 +178,7 @@ bytecodes: [
                 B(CallProperty1), R(3), R(0), R(2), U8(5),
   /*  122 S> */ B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star1),
-                B(LdaCurrentContextSlot), U8(3),
+                B(LdaCurrentContextSlotNoCell), U8(3),
                 B(TestReferenceEqual), R(this),
                 B(Mov), R(this), R(0),
                 B(JumpIfTrue), U8(16),
@@ -212,7 +212,7 @@ frame size: 3
 parameter count: 1
 bytecode array length: 37
 bytecodes: [
-  /*   60 S> */ B(LdaCurrentContextSlot), U8(3),
+  /*   60 S> */ B(LdaCurrentContextSlotNoCell), U8(3),
                 B(TestReferenceEqual), R(this),
                 B(Mov), R(this), R(0),
                 B(JumpIfTrue), U8(16),
@@ -249,7 +249,7 @@ frame size: 3
 parameter count: 1
 bytecode array length: 37
 bytecodes: [
-  /*   53 S> */ B(LdaCurrentContextSlot), U8(3),
+  /*   53 S> */ B(LdaCurrentContextSlotNoCell), U8(3),
                 B(TestReferenceEqual), R(this),
                 B(Mov), R(this), R(0),
                 B(JumpIfTrue), U8(16),
@@ -288,7 +288,7 @@ bytecode array length: 40
 bytecodes: [
   /*   60 S> */ B(LdaImmutableCurrentContextSlot), U8(2),
                 B(Star1),
-                B(LdaCurrentContextSlot), U8(3),
+                B(LdaCurrentContextSlotNoCell), U8(3),
                 B(TestReferenceEqual), R(this),
                 B(Mov), R(this), R(0),
                 B(JumpIfTrue), U8(16),
diff --git a/deps/v8/test/unittests/interpreter/bytecode_expectations/StaticPrivateMethodDeclaration.golden b/deps/v8/test/unittests/interpreter/bytecode_expectations/StaticPrivateMethodDeclaration.golden
index 239e112d62270c..656417b6a7d844 100644
--- a/deps/v8/test/unittests/interpreter/bytecode_expectations/StaticPrivateMethodDeclaration.golden
+++ b/deps/v8/test/unittests/interpreter/bytecode_expectations/StaticPrivateMethodDeclaration.golden
@@ -20,7 +20,7 @@ bytecodes: [
   /*   30 E> */ B(CreateBlockContext), U8(0),
                 B(PushContext), R(1),
                 B(CreateClosure), U8(2), U8(0), U8(2),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(LdaTheHole),
                 B(Star5),
                 B(CreateClosure), U8(3), U8(1), U8(2),
@@ -70,7 +70,7 @@ bytecodes: [
                 B(LdaNull),
                 B(Star4),
                 B(CallRuntime), U16(Runtime::kCreatePrivateAccessors), R(3), U8(2),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(PopContext), R(1),
                 B(Mov), R(2), R(0),
                 B(LdaUndefined),
@@ -112,7 +112,7 @@ bytecodes: [
                 B(CreateClosure), U8(3), U8(1), U8(2),
                 B(Star4),
                 B(CallRuntime), U16(Runtime::kCreatePrivateAccessors), R(3), U8(2),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(PopContext), R(1),
                 B(Mov), R(2), R(0),
                 B(LdaUndefined),
@@ -155,7 +155,7 @@ bytecodes: [
                 B(CreateClosure), U8(4), U8(2), U8(2),
                 B(Star4),
                 B(CallRuntime), U16(Runtime::kCreatePrivateAccessors), R(3), U8(2),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(PopContext), R(1),
                 B(Mov), R(2), R(0),
                 B(LdaUndefined),
@@ -189,11 +189,11 @@ bytecodes: [
                 B(LdaConstant), U8(2),
                 B(Star3),
                 B(CallRuntime), U16(Runtime::kCreatePrivateBrandSymbol), R(3), U8(1),
-                B(StaCurrentContextSlot), U8(4),
+                B(StaCurrentContextSlotNoCell), U8(4),
                 B(CreateClosure), U8(3), U8(0), U8(2),
-                B(StaCurrentContextSlot), U8(2),
+                B(StaCurrentContextSlotNoCell), U8(2),
                 B(CreateClosure), U8(4), U8(1), U8(2),
-                B(StaCurrentContextSlot), U8(3),
+                B(StaCurrentContextSlotNoCell), U8(3),
                 B(LdaTheHole),
                 B(Star5),
                 B(CreateClosure), U8(5), U8(2), U8(2),
diff --git a/deps/v8/test/unittests/interpreter/interpreter-tester.h b/deps/v8/test/unittests/interpreter/interpreter-tester.h
index c88a671598fa67..f0aae6c1c54d91 100644
--- a/deps/v8/test/unittests/interpreter/interpreter-tester.h
+++ b/deps/v8/test/unittests/interpreter/interpreter-tester.h
@@ -163,7 +163,8 @@ class InterpreterTester {
       source += "){})";
       function = Cast<JSFunction>(v8::Utils::OpenHandle(
           *v8::Local<v8::Function>::Cast(CompileRun(source.c_str()))));
-      function->UpdateCode(*BUILTIN_CODE(isolate_, InterpreterEntryTrampoline));
+      function->UpdateCode(isolate_,
+                           *BUILTIN_CODE(isolate_, InterpreterEntryTrampoline));
       is_compiled_scope = function->shared()->is_compiled_scope(isolate_);
     }
 
diff --git a/deps/v8/test/unittests/logging/runtime-call-stats-unittest.cc b/deps/v8/test/unittests/logging/runtime-call-stats-unittest.cc
index 82c506fdf83e10..2191ed1224c678 100644
--- a/deps/v8/test/unittests/logging/runtime-call-stats-unittest.cc
+++ b/deps/v8/test/unittests/logging/runtime-call-stats-unittest.cc
@@ -16,6 +16,7 @@
 #include "src/logging/counters.h"
 #include "src/objects/objects-inl.h"
 #include "src/tracing/tracing-category-observer.h"
+#include "test/unittests/heap/heap-utils.h"
 #include "test/unittests/test-utils.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -648,6 +649,7 @@ TEST_F(RuntimeCallStatsTest, GarbageCollection) {
   v8_flags.single_threaded_gc = true;
 
   FlagList::EnforceFlagImplications();
+  ManualGCScope manual_gc_scope(i_isolate());
   v8::Isolate* isolate = v8_isolate();
   RunJS(
       "let root = [];"
diff --git a/deps/v8/test/unittests/maglev/node-type-unittest.cc b/deps/v8/test/unittests/maglev/node-type-unittest.cc
index 1ef266d9f081ae..2f230b3af9e56b 100644
--- a/deps/v8/test/unittests/maglev/node-type-unittest.cc
+++ b/deps/v8/test/unittests/maglev/node-type-unittest.cc
@@ -17,53 +17,28 @@ static std::initializer_list<NodeType> kAllNodeTypes{
 #undef TYPE
 };
 
-inline constexpr bool IsKnownNodeTypeConstant(NodeType type) {
-  switch (type) {
-#define CASE(Name, _) case NodeType::k##Name:
-    NODE_TYPE_LIST(CASE)
-#undef CASE
-    return true;
-  }
-  return false;
+TEST_F(MaglevTest, NodeTypeSmokeTests) {
+  // A couple of quick sanity checks that the type inference works.
+  CHECK(NodeTypeIs(NodeType::kNumberOrBoolean, NodeType::kNumberOrOddball));
+  CHECK(!NodeTypeIs(NodeType::kNumberOrOddball, NodeType::kNumberOrBoolean));
+
+  CHECK_EQ(CombineType(NodeType::kNumberOrBoolean, NodeType::kNumberOrOddball),
+           NodeType::kNumberOrBoolean);
+  CHECK_EQ(
+      IntersectType(NodeType::kNumberOrBoolean, NodeType::kNumberOrOddball),
+      NodeType::kNumberOrOddball);
+
+  CHECK(!NodeTypeIs(NodeType::kStringWrapper, NodeType::kName));
 }
 
-template <typename Function>
-inline std::unordered_set<NodeType> CompleteLattice(Function Combine) {
-  std::unordered_set completed_lattice(kAllNodeTypes);
-  bool complete = false;
-  while (!complete) {
-    complete = true;
-    std::unordered_set<NodeType> discovered;
-    for (NodeType a : completed_lattice) {
-      for (NodeType b : completed_lattice) {
-        NodeType combined = Combine(a, b);
-        if (!completed_lattice.count(combined)) {
-          discovered.insert(combined);
-        }
-      }
-    }
-    if (!discovered.empty()) {
-      completed_lattice.insert(discovered.begin(), discovered.end());
-      complete = false;
-    }
+TEST_F(MaglevTest, EmptyTypeIsAnything) {
+  for (NodeType a : kAllNodeTypes) {
+    CHECK(NodeTypeIs(EmptyNodeType(), a));
   }
-  return completed_lattice;
 }
 
-static std::unordered_set<NodeType> kJoinLattice =
-    CompleteLattice([](NodeType a, NodeType b) { return IntersectType(a, b); });
-static std::unordered_set<NodeType> kMeetLattice =
-    CompleteLattice([](NodeType a, NodeType b) { return CombineType(a, b); });
-static std::unordered_set<NodeType> kCompleteLattice = []() {
-  std::unordered_set completed_lattice(kJoinLattice.begin(),
-                                       kJoinLattice.end());
-  completed_lattice.insert(kMeetLattice.begin(), kMeetLattice.end());
-  return completed_lattice;
-}();
-
-// Allow-list of joins we have consciously omitted from the join lattice since
-// they are not needed often. Checking these types can be more expensive in
-// some cases.
+// Allow-list of types we have consciously omitted from the combined types since
+// they are not needed often.
 std::unordered_set<NodeType> kMissingEntries{
     // HeapNumberOrOddball
     CombineType(NodeType::kNumberOrOddball, NodeType::kAnyHeapObject),
@@ -74,44 +49,7 @@ std::unordered_set<NodeType> kMissingEntries{
 // The missing node types must be inhabited.
 TEST_F(MaglevTest, NodeTypeMissingEntriesExist) {
   for (NodeType missing : kMissingEntries) {
-    CHECK(!NodeTypeCannotHaveInstances(missing));
-  }
-}
-
-// Ensures important NodeTypes are closed under intersection.
-TEST_F(MaglevTest, NodeTypeIsClosedUnderIntersect) {
-  for (NodeType join : kJoinLattice) {
-    CHECK(NodeTypeIs(join, NodeType::kUnknown));
-    CHECK_EQ(!kMissingEntries.count(join), IsKnownNodeTypeConstant(join));
-  }
-}
-
-// Every join of node types must be inhabited.
-TEST_F(MaglevTest, NodeTypeIntersectsAreInhabited) {
-  for (NodeType t : kCompleteLattice) {
-    CHECK_IMPLIES(kJoinLattice.count(t) || kMissingEntries.count(t),
-                  !NodeTypeCannotHaveInstances(t));
-    CHECK_IMPLIES(NodeTypeCannotHaveInstances(t),
-                  !kJoinLattice.count(t) && !kMissingEntries.count(t));
-  }
-}
-
-// Check that the uninhabitated check behaves.
-TEST_F(MaglevTest, NodeTypeCheckIsUninhabited) {
-  for (NodeType t : kCompleteLattice) {
-    CHECK_IMPLIES(NodeTypeCannotHaveInstances(t),
-                  !IsKnownNodeTypeConstant(t) && !kMissingEntries.count(t));
-    CHECK_IMPLIES(IsKnownNodeTypeConstant(t) || kMissingEntries.count(t),
-                  !NodeTypeCannotHaveInstances(t));
-  }
-}
-
-// Check impossible pairs are actually impossible.
-TEST_F(MaglevTest, NodeTypeCheckLeafTypes) {
-  for (auto pair : kNodeTypeExclusivePairs) {
-    for (NodeType t : kJoinLattice) {
-      CHECK(!NodeTypeIs(t, pair.first) || !NodeTypeIs(t, pair.second));
-    }
+    CHECK(!IsEmptyNodeType(missing));
   }
 }
 
@@ -122,8 +60,8 @@ TEST_F(MaglevTest, ConstantNodeTypeApproximationIsConsistent) {
     if (obj.ptr() == kNullAddress || !obj.IsHeapObject()) continue;
     compiler::HeapObjectRef ref = MakeRef(broker(), Cast<HeapObject>(obj));
     NodeType t = StaticTypeForConstant(broker(), ref);
-    CHECK(!NodeTypeCannotHaveInstances(t));
-    for (NodeType a : kCompleteLattice) {
+    CHECK(!IsEmptyNodeType(t));
+    for (NodeType a : kAllNodeTypes) {
       bool is_instance = IsInstanceOfNodeType(ref.map(broker()), a, broker());
       bool is_subtype = NodeTypeIs(t, a);
       CHECK_IMPLIES(is_subtype, is_instance);
@@ -140,7 +78,7 @@ TEST_F(MaglevTest, NodeTypeApproximationIsConsistent) {
     Tagged<Map> map = Cast<Map>(obj);
     compiler::MapRef map_ref = MakeRef(broker(), map);
 
-    for (NodeType a : kCompleteLattice) {
+    for (NodeType a : kAllNodeTypes) {
       bool is_instance = IsInstanceOfNodeType(map_ref, a, broker());
       bool is_subtype = NodeTypeIs(StaticTypeForMap(map_ref, broker()), a);
       CHECK_IMPLIES(is_subtype, is_instance);
@@ -157,19 +95,16 @@ TEST_F(MaglevTest, NodeTypeCombineIsConsistent) {
     Tagged<Map> map = Cast<Map>(obj);
     compiler::MapRef map_ref = MakeRef(broker(), map);
 
-    for (NodeType a : kCompleteLattice) {
-      for (NodeType b : kJoinLattice) {
+    for (NodeType a : kAllNodeTypes) {
+      for (NodeType b : kAllNodeTypes) {
         NodeType combined_type = CombineType(a, b);
-
         bool map_is_a = IsInstanceOfNodeType(map_ref, a, broker());
         bool map_is_b = IsInstanceOfNodeType(map_ref, b, broker());
         bool is_instance =
             IsInstanceOfNodeType(map_ref, combined_type, broker());
         CHECK_EQ(is_instance, map_is_a && map_is_b);
-        DCHECK_IMPLIES(NodeTypeCannotHaveInstances(combined_type),
-                       !is_instance);
-        DCHECK_IMPLIES(is_instance,
-                       !NodeTypeCannotHaveInstances(combined_type));
+        DCHECK_IMPLIES(IsEmptyNodeType(combined_type), !is_instance);
+        DCHECK_IMPLIES(is_instance, !IsEmptyNodeType(combined_type));
       }
     }
   }
@@ -183,8 +118,8 @@ TEST_F(MaglevTest, NodeTypeIntersectIsConsistent) {
     Tagged<Map> map = Cast<Map>(obj);
     compiler::MapRef map_ref = MakeRef(broker(), map);
 
-    for (NodeType a : kCompleteLattice) {
-      for (NodeType b : kMeetLattice) {
+    for (NodeType a : kAllNodeTypes) {
+      for (NodeType b : kAllNodeTypes) {
         NodeType join_type = IntersectType(a, b);
         bool map_is_a = IsInstanceOfNodeType(map_ref, a, broker());
         bool map_is_b = IsInstanceOfNodeType(map_ref, b, broker());
diff --git a/deps/v8/test/unittests/objects/object-unittest.cc b/deps/v8/test/unittests/objects/object-unittest.cc
index b241cd76fb804e..e22bd80aa37c73 100644
--- a/deps/v8/test/unittests/objects/object-unittest.cc
+++ b/deps/v8/test/unittests/objects/object-unittest.cc
@@ -627,7 +627,7 @@ TEST_F(ObjectTest, ConstructorInstanceTypes) {
 
   DisallowGarbageCollection no_gc;
   for (int i = 0; i < Context::NATIVE_CONTEXT_SLOTS; i++) {
-    Tagged<Object> value = context->get(i);
+    Tagged<Object> value = context->GetNoCell(i);
     if (!IsJSFunction(value)) continue;
     InstanceType instance_type =
         Cast<JSFunction>(value)->map()->instance_type();
diff --git a/deps/v8/test/unittests/utils/allocation-unittest.cc b/deps/v8/test/unittests/utils/allocation-unittest.cc
index 56c639850db2dc..5199aeb402acff 100644
--- a/deps/v8/test/unittests/utils/allocation-unittest.cc
+++ b/deps/v8/test/unittests/utils/allocation-unittest.cc
@@ -179,5 +179,48 @@ TEST_F(AllocationTest, ReserveMemory) {
   v8::internal::FreePages(page_allocator, mem_addr, kAllocationSize);
 }
 
+TEST_F(AllocationTest, ResizeMemory) {
+  v8::PageAllocator* page_allocator = v8::internal::GetPlatformPageAllocator();
+  constexpr size_t kReservationSize = 10 * PageMetadata::kPageSize;
+  size_t page_size = v8::internal::AllocatePageSize();
+
+  VirtualMemory reservation(page_allocator, kReservationSize, nullptr,
+                            PageMetadata::kPageSize,
+                            PageAllocator::Permission::kReadWrite);
+
+  base::BoundedPageAllocator bpa(
+      page_allocator, reservation.address(), kReservationSize,
+      PageMetadata::kPageSize,
+      base::PageInitializationMode::kAllocatedPagesMustBeZeroInitialized,
+      base::PageFreeingMode::kMakeInaccessible);
+
+  const Address allocate_at = bpa.begin() + 8 * PageMetadata::kPageSize;
+  CHECK(bpa.AllocatePagesAt(allocate_at, PageMetadata::kPageSize,
+                            PageAllocator::Permission::kReadWrite));
+  VirtualMemory allocation(&bpa, allocate_at, PageMetadata::kPageSize);
+  uint8_t* byte_address = reinterpret_cast<uint8_t*>(
+      allocate_at + PageMetadata::kPageSize - page_size);
+
+  // Not enough space to resize the allocation to 3 pages.
+  CHECK(!allocation.Resize(allocate_at, 3 * PageMetadata::kPageSize,
+                           PageAllocator::Permission::kReadWrite));
+  // Just enough space to resize the allocation to 2 pages.
+  CHECK(allocation.Resize(allocate_at, 2 * PageMetadata::kPageSize,
+                          PageAllocator::Permission::kReadWrite));
+  CHECK_EQ(*byte_address, 0);
+
+  // Update byte in allocation. This byte should be cleared during the following
+  // Release()/Resize() cycle.
+  *byte_address = 42;
+
+  // Shrink down to slightly below 1 page.
+  CHECK(allocation.Release(allocate_at + PageMetadata::kPageSize - page_size));
+  // Resize back to slightly below 2 pages.
+  CHECK(allocation.Resize(allocate_at, 2 * PageMetadata::kPageSize - page_size,
+                          PageAllocator::Permission::kReadWrite));
+  // Growing the allocation back again should still result in zero-initialized
+  // memory.
+  CHECK_EQ(*byte_address, 0);
+}
 }  // namespace internal
 }  // namespace v8
diff --git a/deps/v8/test/unittests/wasm/function-body-decoder-unittest.cc b/deps/v8/test/unittests/wasm/function-body-decoder-unittest.cc
index 9efb4d07a059b7..536c96ac391593 100644
--- a/deps/v8/test/unittests/wasm/function-body-decoder-unittest.cc
+++ b/deps/v8/test/unittests/wasm/function-body-decoder-unittest.cc
@@ -97,6 +97,15 @@ class TestModuleBuilder {
     GetTypeCanonicalizer()->AddRecursiveSingletonGroup(module());
     return ModuleTypeIndex{static_cast<uint8_t>(mod.types.size() - 1)};
   }
+  ModuleTypeIndex AddCont(const FunctionSig* sig) {
+    const bool is_final = true;
+    const bool is_shared = false;
+    ModuleTypeIndex funIndex = AddSignature(sig);
+    mod.AddContTypeForTesting(mod.signature_zone.New<ContType>(funIndex),
+                              kNoSuperType, is_final, is_shared);
+    GetTypeCanonicalizer()->AddRecursiveSingletonGroup(module());
+    return ModuleTypeIndex{static_cast<uint8_t>(mod.types.size() - 1)};
+  }
   uint8_t AddFunction(const FunctionSig* sig, bool declared = true) {
     ModuleTypeIndex sig_index = AddSignature(sig);
     return AddFunctionImpl(sig, sig_index, declared);
@@ -111,7 +120,7 @@ class TestModuleBuilder {
     mod.functions[result].imported = true;
     return result;
   }
-  uint8_t AddException(WasmTagSig* sig) {
+  uint8_t AddTag(WasmTagSig* sig) {
     mod.tags.emplace_back(sig, AddSignature(sig));
     CHECK_LE(mod.types.size(), kMaxByteSizedLeb128);
     return static_cast<uint8_t>(mod.tags.size() - 1);
@@ -2874,9 +2883,9 @@ TEST_F(FunctionBodyDecoderTest, SelectWithType_fail) {
 }
 
 TEST_F(FunctionBodyDecoderTest, Throw) {
-  uint8_t ex1 = builder.AddException(sigs.v_v());
-  uint8_t ex2 = builder.AddException(sigs.v_i());
-  uint8_t ex3 = builder.AddException(sigs.v_ii());
+  uint8_t ex1 = builder.AddTag(sigs.v_v());
+  uint8_t ex2 = builder.AddTag(sigs.v_i());
+  uint8_t ex3 = builder.AddTag(sigs.v_ii());
   ExpectValidates(sigs.v_v(), {kExprThrow, ex1});
   ExpectValidates(sigs.v_v(), {WASM_I32V(0), kExprThrow, ex2});
   ExpectFailure(sigs.v_v(), {WASM_F32(0.0), kExprThrow, ex2});
@@ -2886,8 +2895,8 @@ TEST_F(FunctionBodyDecoderTest, Throw) {
 }
 
 TEST_F(FunctionBodyDecoderTest, ThrowUnreachable) {
-  uint8_t ex1 = builder.AddException(sigs.v_v());
-  uint8_t ex2 = builder.AddException(sigs.v_i());
+  uint8_t ex1 = builder.AddTag(sigs.v_v());
+  uint8_t ex2 = builder.AddTag(sigs.v_i());
   ExpectValidates(sigs.i_i(), {WASM_LOCAL_GET(0), kExprThrow, ex1, WASM_NOP});
   ExpectValidates(sigs.v_i(), {WASM_LOCAL_GET(0), kExprThrow, ex2, WASM_NOP});
   ExpectValidates(sigs.i_i(), {WASM_LOCAL_GET(0), kExprThrow, ex1, WASM_ZERO});
@@ -2902,7 +2911,7 @@ TEST_F(FunctionBodyDecoderTest, ThrowUnreachable) {
 
 TEST_F(FunctionBodyDecoderTest, TryCatch) {
   WASM_FEATURE_SCOPE(legacy_eh);
-  uint8_t ex = builder.AddException(sigs.v_v());
+  uint8_t ex = builder.AddTag(sigs.v_v());
   ExpectValidates(sigs.v_v(), {WASM_TRY_OP, kExprCatch, ex, kExprEnd});
   ExpectValidates(sigs.v_v(),
                   {WASM_TRY_OP, kExprCatch, ex, kExprCatchAll, kExprEnd});
@@ -2933,7 +2942,7 @@ TEST_F(FunctionBodyDecoderTest, Rethrow) {
 
 TEST_F(FunctionBodyDecoderTest, TryDelegate) {
   WASM_FEATURE_SCOPE(legacy_eh);
-  uint8_t ex = builder.AddException(sigs.v_v());
+  uint8_t ex = builder.AddTag(sigs.v_v());
 
   ExpectValidates(sigs.v_v(), {WASM_TRY_OP,
                                WASM_TRY_DELEGATE(WASM_STMTS(kExprThrow, ex), 0),
@@ -2987,7 +2996,7 @@ TEST_F(FunctionBodyDecoderTest, ThrowRef) {
 
 TEST_F(FunctionBodyDecoderTest, TryTable) {
   WASM_FEATURE_SCOPE(exnref);
-  uint8_t ex = builder.AddException(sigs.v_v());
+  uint8_t ex = builder.AddTag(sigs.v_v());
   ExpectValidates(sigs.v_v(),
                   {WASM_TRY_TABLE_OP, U32V_1(1), CatchKind::kCatch, ex,
                    U32V_1(0), kExprEnd},
@@ -3060,8 +3069,8 @@ TEST_F(FunctionBodyDecoderTest, TryTable) {
 TEST_F(FunctionBodyDecoderTest, BadTryTable) {
   WASM_FEATURE_SCOPE(exnref);
   WASM_FEATURE_SCOPE(wasmfx);
-  uint8_t ex = builder.AddException(sigs.v_v());
-  uint8_t bd = builder.AddException(sigs.i_i());
+  uint8_t ex = builder.AddTag(sigs.v_v());
+  uint8_t bd = builder.AddTag(sigs.i_i());
   ExpectValidates(sigs.v_v(),
                   {WASM_TRY_TABLE_OP, U32V_1(1), CatchKind::kCatch, ex,
                    U32V_1(0), kExprEnd},
@@ -3710,7 +3719,7 @@ TEST_F(FunctionBodyDecoderTest, NonDefaultableLocals) {
   ValueType rep = ref(struct_type);
   FunctionSig sig(0, 1, &rep);
   AddLocals(rep, 2);
-  uint8_t ex = builder.AddException(sigs.v_v());
+  uint8_t ex = builder.AddTag(sigs.v_v());
   // Declaring non-defaultable locals is fine.
   ExpectValidates(&sig, {});
   // Loading from an uninitialized non-defaultable local fails.
@@ -5045,12 +5054,13 @@ class TypeReaderTest : public TestWithZone {
     Decoder decoder(start, end);
     auto [heap_type, length] =
         value_type_reader::read_heap_type<Decoder::FullValidationTag>(
-            &decoder, start, enabled_features_);
+            &decoder, start, enabled_features_, &detected_features_);
     return heap_type;
   }
 
   // This variable is modified by WASM_FEATURE_SCOPE.
   WasmEnabledFeatures enabled_features_;
+  WasmDetectedFeatures detected_features_;
 };
 
 TEST_F(TypeReaderTest, HeapTypeDecodingTest) {
@@ -5673,6 +5683,413 @@ TEST_P(FunctionBodyDecoderTestTable64, Table64CopyDifferentTypes) {
           : "table.copy[0] expected type i32, found i64.const of type i64");
 }
 
+/*******************************************************************************
+ * WasmFx
+ ******************************************************************************/
+
+TEST_F(FunctionBodyDecoderTest, WasmContNew) {
+  WASM_FEATURE_SCOPE(wasmfx);
+  ModuleTypeIndex cont_index = builder.AddCont(sigs.i_i());
+  ModuleTypeIndex sig_index = builder.AddSignature(sigs.i_i());
+  ModuleTypeIndex void_index = builder.AddSignature(sigs.v_v());
+  uint8_t func_index = builder.AddFunction(sig_index);
+  uint8_t bad_func_index = builder.AddFunction(void_index);
+
+  ExpectValidates(sigs.v_v(), {WASM_REF_FUNC(func_index),
+                               WASM_CONT_NEW(ToByte(cont_index)), WASM_DROP});
+
+  ExpectFailure(
+      sigs.v_v(),
+      {WASM_REF_FUNC(func_index), WASM_CONT_NEW(ToByte(sig_index)), WASM_DROP},
+      kAppendEnd, "invalid cont index: 2");
+  ExpectFailure(
+      sigs.v_v(),
+      {WASM_REF_FUNC(bad_func_index), WASM_CONT_NEW(ToByte(cont_index)),
+       WASM_DROP},
+      kAppendEnd,
+      "cont.new[0] expected type (ref null 0), found ref.func of type (ref 3)");
+}
+
+TEST_F(FunctionBodyDecoderTest, WasmContBind) {
+  WASM_FEATURE_SCOPE(wasmfx);
+  ModuleTypeIndex i_di_cont = builder.AddCont(sigs.i_di());
+  ModuleTypeIndex i_i_cont = builder.AddCont(sigs.i_i());
+  ModuleTypeIndex i_di_sig = builder.AddSignature(sigs.i_di());
+  uint8_t i_di_func = builder.AddFunction(i_di_sig);
+
+  ExpectValidates(
+      sigs.v_v(),
+      {WASM_F64(42.0), WASM_REF_FUNC(i_di_func),
+       WASM_CONT_NEW(ToByte(i_di_cont)),
+       WASM_CONT_BIND(ToByte(i_di_cont), ToByte(i_i_cont)), WASM_DROP});
+
+  ExpectValidates(
+      sigs.v_v(),
+      {WASM_REF_FUNC(i_di_func), WASM_CONT_NEW(ToByte(i_di_cont)),
+       WASM_CONT_BIND(ToByte(i_di_cont), ToByte(i_di_cont)), WASM_DROP});
+}
+
+TEST_F(FunctionBodyDecoderTest, WasmContBindNegative) {
+  WASM_FEATURE_SCOPE(wasmfx);
+  ModuleTypeIndex i_di_cont = builder.AddCont(sigs.i_di());
+  ModuleTypeIndex i_i_cont = builder.AddCont(sigs.i_i());
+  ModuleTypeIndex d_i_cont = builder.AddCont(sigs.d_i());
+  ModuleTypeIndex i_d_cont = builder.AddCont(sigs.i_d());
+  ModuleTypeIndex i_di_sig = builder.AddSignature(sigs.i_di());
+  uint8_t i_di_func = builder.AddFunction(i_di_sig);
+
+  ExpectFailure(
+      sigs.v_v(),
+      {WASM_REF_FUNC(i_di_func), WASM_CONT_NEW(ToByte(i_di_cont)),
+       WASM_CONT_BIND(ToByte(i_i_cont), ToByte(i_di_cont)), WASM_DROP},
+      kAppendEnd, "source cont type 3 has fewer parameters than target 1");
+
+  ExpectFailure(
+      sigs.v_v(),
+      {WASM_I32V(42.0), WASM_REF_FUNC(i_di_func),
+       WASM_CONT_NEW(ToByte(i_di_cont)),
+       WASM_CONT_BIND(ToByte(i_di_cont), ToByte(i_i_cont)), WASM_DROP},
+      kAppendEnd, "expected type f64, found i32.const of type i32");
+
+  ExpectFailure(
+      sigs.v_v(),
+      {WASM_F64(42.0), WASM_REF_FUNC(i_di_func),
+       WASM_CONT_NEW(ToByte(i_di_cont)),
+       WASM_CONT_BIND(ToByte(i_di_cont), ToByte(d_i_cont)), WASM_DROP},
+      kAppendEnd, "expecting returns of 1 to match returns of 5");
+
+  ExpectFailure(
+      sigs.v_v(),
+      {WASM_F64(42.0), WASM_REF_FUNC(i_di_func),
+       WASM_CONT_NEW(ToByte(i_di_cont)),
+       WASM_CONT_BIND(ToByte(i_di_cont), ToByte(i_d_cont)), WASM_DROP},
+      kAppendEnd,
+      "parameters of new continuation 7 should be subtypes of parameters of "
+      "input continuation 1");
+}
+
+TEST_F(FunctionBodyDecoderTest, WasmResume) {
+  WASM_FEATURE_SCOPE(wasmfx);
+  ModuleTypeIndex cont_index = builder.AddCont(sigs.i_i());
+  ModuleTypeIndex sig_index = builder.AddSignature(sigs.i_i());
+  uint8_t func_index = builder.AddFunction(sig_index);
+
+  uint8_t tag_v_v = builder.AddTag(sigs.v_v());
+  uint8_t tag_i_i = builder.AddTag(sigs.i_i());
+
+  ExpectValidates(sigs.v_v(), {WASM_I32V(42), WASM_REF_FUNC(func_index),
+                               WASM_CONT_NEW(ToByte(cont_index)),
+                               WASM_RESUME(ToByte(cont_index), 0), WASM_DROP});
+
+  ExpectValidates(
+      sigs.v_v(),
+      {WASM_BLOCK_I(WASM_I32V(43), WASM_REF_FUNC(func_index),
+                    WASM_CONT_NEW(ToByte(cont_index)),
+                    WASM_RESUME(ToByte(cont_index), 1, WASM_ON_TAG(tag_i_i, 0)),
+                    WASM_RETURN0),
+       WASM_DROP});
+
+  ExpectValidates(
+      sigs.v_v(),
+      {WASM_BLOCK(WASM_BLOCK_I(WASM_I32V(43), WASM_REF_FUNC(func_index),
+                               WASM_CONT_NEW(ToByte(cont_index)),
+                               WASM_RESUME(ToByte(cont_index), 1,
+                                           WASM_ON_TAG(tag_i_i, 0),
+                                           WASM_ON_TAG(tag_v_v, 1)),
+                               WASM_RETURN0),
+                  WASM_DROP)});
+
+  ExpectValidates(
+      sigs.v_v(),
+      {WASM_BLOCK_I(WASM_I32V(43), WASM_REF_FUNC(func_index),
+                    WASM_CONT_NEW(ToByte(cont_index)),
+                    WASM_RESUME(ToByte(cont_index), 2, WASM_ON_TAG(tag_i_i, 0),
+                                WASM_SWITCH_TAG(tag_v_v)),
+                    WASM_RETURN0),
+       WASM_DROP});
+}
+
+TEST_F(FunctionBodyDecoderTest, WasmResumeNegative) {
+  WASM_FEATURE_SCOPE(wasmfx);
+  ModuleTypeIndex cont_index = builder.AddCont(sigs.i_i());
+  ModuleTypeIndex sig_index = builder.AddSignature(sigs.i_i());
+  uint8_t func_index = builder.AddFunction(sig_index);
+
+  uint8_t tag_i_i = builder.AddTag(sigs.i_i());
+
+  ExpectFailure(sigs.v_v(),
+                {WASM_I32V(42), WASM_REF_FUNC(func_index),
+                 WASM_CONT_NEW(ToByte(cont_index)),
+                 WASM_RESUME(ToByte(cont_index), 1), WASM_DROP},
+                kAppendEnd, "Invalid tag index");
+
+  ExpectFailure(
+      sigs.v_v(),
+      {WASM_BLOCK(WASM_I32V(43), WASM_REF_FUNC(func_index),
+                  WASM_CONT_NEW(ToByte(cont_index)),
+                  WASM_RESUME(ToByte(cont_index), 1, WASM_ON_TAG(tag_i_i, 0)),
+                  WASM_RETURN0),
+       WASM_DROP},
+      kAppendEnd, "handler generates 1 operand, target block returns 0");
+
+  ExpectFailure(
+      sigs.v_v(),
+      {WASM_BLOCK_D(WASM_I32V(43), WASM_REF_FUNC(func_index),
+                    WASM_CONT_NEW(ToByte(cont_index)),
+                    WASM_RESUME(ToByte(cont_index), 1, WASM_ON_TAG(tag_i_i, 0)),
+                    WASM_RETURN0),
+       WASM_DROP},
+      kAppendEnd, "type error in branch[0] (expected f64, got i32)");
+
+  ExpectFailure(sigs.v_v(),
+                {WASM_F64(42.0), WASM_REF_FUNC(func_index),
+                 WASM_CONT_NEW(ToByte(cont_index)),
+                 WASM_RESUME(ToByte(cont_index), 0), WASM_DROP},
+                kAppendEnd,
+                "resume[0] expected type i32, found f64.const of type f64");
+
+  ExpectFailure(
+      sigs.v_v(),
+      {WASM_BLOCK_I(WASM_I32V(43), WASM_REF_FUNC(func_index),
+                    WASM_CONT_NEW(ToByte(cont_index)),
+                    WASM_RESUME(ToByte(cont_index), 1, WASM_ON_TAG(tag_i_i, 2)),
+                    WASM_RETURN0),
+       WASM_DROP},
+      kAppendEnd, "invalid branch depth: 2");
+}
+
+TEST_F(FunctionBodyDecoderTest, WasmResumeThrow) {
+  WASM_FEATURE_SCOPE(wasmfx);
+  ModuleTypeIndex cont_index = builder.AddCont(sigs.i_i());
+  ModuleTypeIndex sig_index = builder.AddSignature(sigs.i_i());
+  uint8_t ex_tag = builder.AddTag(sigs.v_i());
+  uint8_t func_index = builder.AddFunction(sig_index);
+
+  uint8_t tag_v_v = builder.AddTag(sigs.v_v());
+  uint8_t tag_i_i = builder.AddTag(sigs.i_i());
+
+  ExpectValidates(sigs.v_v(), {WASM_I32V(42), WASM_REF_FUNC(func_index),
+                               WASM_CONT_NEW(ToByte(cont_index)),
+                               WASM_RESUME_THROW(ToByte(cont_index), ex_tag, 0),
+                               WASM_DROP});
+
+  ExpectValidates(sigs.v_v(),
+                  {WASM_BLOCK_I(WASM_I32V(43), WASM_REF_FUNC(func_index),
+                                WASM_CONT_NEW(ToByte(cont_index)),
+                                WASM_RESUME_THROW(ToByte(cont_index), ex_tag, 1,
+                                                  WASM_ON_TAG(tag_i_i, 0)),
+                                WASM_RETURN0),
+                   WASM_DROP});
+
+  ExpectValidates(
+      sigs.v_v(),
+      {WASM_BLOCK(WASM_BLOCK_I(WASM_I32V(43), WASM_REF_FUNC(func_index),
+                               WASM_CONT_NEW(ToByte(cont_index)),
+                               WASM_RESUME_THROW(ToByte(cont_index), ex_tag, 2,
+                                                 WASM_ON_TAG(tag_i_i, 0),
+                                                 WASM_ON_TAG(tag_v_v, 1)),
+                               WASM_RETURN0),
+                  WASM_DROP)});
+
+  ExpectValidates(sigs.v_v(),
+                  {WASM_BLOCK_I(WASM_I32V(43), WASM_REF_FUNC(func_index),
+                                WASM_CONT_NEW(ToByte(cont_index)),
+                                WASM_RESUME_THROW(ToByte(cont_index), ex_tag, 2,
+                                                  WASM_ON_TAG(tag_i_i, 0),
+                                                  WASM_SWITCH_TAG(tag_v_v)),
+                                WASM_RETURN0),
+                   WASM_DROP});
+}
+
+TEST_F(FunctionBodyDecoderTest, WasmResumeThrowNegative) {
+  WASM_FEATURE_SCOPE(wasmfx);
+  ModuleTypeIndex cont_index = builder.AddCont(sigs.i_i());
+  ModuleTypeIndex sig_index = builder.AddSignature(sigs.i_i());
+  uint8_t ex_tag = builder.AddTag(sigs.v_i());
+  uint8_t d_tag = builder.AddTag(sigs.v_d());
+  uint8_t func_index = builder.AddFunction(sig_index);
+  uint8_t tag_i_i = builder.AddTag(sigs.i_i());
+
+  ExpectFailure(sigs.v_v(),
+                {WASM_I32V(42), WASM_REF_FUNC(func_index),
+                 WASM_CONT_NEW(ToByte(cont_index)),
+                 WASM_RESUME_THROW(ToByte(cont_index), 10, 0), WASM_DROP},
+                kAppendEnd, "Invalid tag index");
+
+  ExpectFailure(sigs.v_v(),
+                {WASM_BLOCK_I(WASM_I32V(43), WASM_REF_FUNC(func_index),
+                              WASM_CONT_NEW(ToByte(cont_index)),
+                              WASM_RESUME_THROW(ToByte(cont_index), tag_i_i, 1,
+                                                WASM_ON_TAG(tag_i_i, 0)),
+                              WASM_RETURN0),
+                 WASM_DROP},
+                kAppendEnd, "tag signature 2 has non-void return");
+
+  ExpectFailure(sigs.v_v(),
+                {WASM_I32V(43), WASM_REF_FUNC(func_index),
+                 WASM_CONT_NEW(ToByte(cont_index)),
+                 WASM_RESUME_THROW(ToByte(cont_index), ex_tag, 1,
+                                   WASM_ON_TAG(tag_i_i, 0)),
+                 WASM_DROP},
+                kAppendEnd,
+                "handler generates 1 operand, target block returns 0");
+
+  ExpectFailure(sigs.v_v(),
+                {WASM_I32V(42.0), WASM_REF_FUNC(func_index),
+                 WASM_CONT_NEW(ToByte(cont_index)),
+                 WASM_RESUME_THROW(ToByte(cont_index), d_tag, 0), WASM_DROP},
+                kAppendEnd, "expected type f64, found i32.const of type i32");
+
+  ExpectFailure(sigs.v_v(),
+                {WASM_BLOCK_D(WASM_I32V(43), WASM_REF_FUNC(func_index),
+                              WASM_CONT_NEW(ToByte(cont_index)),
+                              WASM_RESUME_THROW(ToByte(cont_index), ex_tag, 1,
+                                                WASM_ON_TAG(tag_i_i, 0)),
+                              WASM_RETURN0),
+                 WASM_DROP},
+                kAppendEnd, "type error in branch[0] (expected f64, got i32)");
+
+  ExpectFailure(sigs.v_v(),
+                {WASM_BLOCK_I(WASM_I32V(43), WASM_REF_FUNC(func_index),
+                              WASM_CONT_NEW(ToByte(cont_index)),
+                              WASM_RESUME_THROW(ToByte(cont_index), ex_tag, 1,
+                                                WASM_ON_TAG(tag_i_i, 2)),
+                              WASM_RETURN0),
+                 WASM_DROP},
+                kAppendEnd, "invalid branch depth: 2");
+}
+
+TEST_F(FunctionBodyDecoderTest, WasmSuspend) {
+  WASM_FEATURE_SCOPE(wasmfx);
+
+  uint8_t tag_v_v = builder.AddTag(sigs.v_v());
+  uint8_t tag_i_i = builder.AddTag(sigs.i_i());
+
+  ExpectValidates(sigs.v_v(),
+                  {WASM_I32V(42), WASM_SUSPEND(tag_i_i), WASM_DROP});
+  ExpectValidates(sigs.v_v(),
+                  {WASM_I32V(42), WASM_SUSPEND(tag_v_v), WASM_DROP});
+  ExpectValidates(sigs.v_v(), {WASM_SUSPEND(tag_v_v)});
+
+  ExpectFailure(sigs.v_v(), {WASM_I32V(42), WASM_SUSPEND(12), WASM_DROP},
+                kAppendEnd, "Invalid tag index: 12");
+  ExpectFailure(
+      sigs.v_v(), {WASM_SUSPEND(tag_i_i), WASM_DROP}, kAppendEnd,
+      "not enough arguments on the stack for suspend (need 1, got 0)");
+  ExpectFailure(sigs.v_v(), {WASM_I32V(42), WASM_SUSPEND(tag_i_i)}, kAppendEnd,
+                "expected 0 elements on the stack for fallthru, found 1");
+  ExpectFailure(sigs.v_v(), {WASM_F64(42.0), WASM_SUSPEND(tag_i_i)}, kAppendEnd,
+                "suspend[0] expected type i32, found f64.const of type f64");
+}
+
+TEST_F(FunctionBodyDecoderTest, WasmSwitch) {
+  WASM_FEATURE_SCOPE(wasmfx);
+
+  TestModuleBuilder builder;
+  uint8_t tag_d_v = builder.AddTag(sigs.d_v());
+  ModuleTypeIndex ct2_index = builder.AddCont(sigs.d_ii());
+
+  FunctionSig* ct1_sig = FunctionSig::Build(
+      zone(), {kWasmF64},
+      {kWasmI32, ValueType::RefNull(ct2_index, false, RefTypeKind::kCont)});
+
+  ModuleTypeIndex ct1_index = builder.AddCont(ct1_sig);
+
+  uint8_t func_index = builder.AddFunction(ct1_sig);
+
+  module = builder.module();
+
+  ExpectValidates(sigs.v_v(), {WASM_I32V(42), WASM_REF_FUNC(func_index),
+                               WASM_CONT_NEW(ToByte(ct1_index)),
+                               WASM_SWITCH(ToByte(ct1_index), tag_d_v),
+                               WASM_DROP, WASM_DROP});
+}
+
+TEST_F(FunctionBodyDecoderTest, WasmSwitchNegative) {
+  WASM_FEATURE_SCOPE(wasmfx);
+
+  TestModuleBuilder builder;
+  uint8_t tag_d_v = builder.AddTag(sigs.d_v());
+  uint8_t tag_i_v = builder.AddTag(sigs.i_v());
+  uint8_t tag_f_v = builder.AddTag(sigs.f_v());
+  ModuleTypeIndex ct2_index = builder.AddCont(sigs.d_ii());
+
+  FunctionSig* ct1_sig = FunctionSig::Build(
+      zone(), {kWasmF64},
+      {kWasmI32, ValueType::RefNull(ct2_index, false, RefTypeKind::kCont)});
+
+  ModuleTypeIndex ct1_index = builder.AddCont(ct1_sig);
+  ModuleTypeIndex ct3_index = builder.AddCont(FunctionSig::Build(
+      zone(), {kWasmI32},
+      {kWasmI32, ValueType::RefNull(ct1_index, false, RefTypeKind::kCont)}));
+  uint8_t func_index = builder.AddFunction(ct1_sig);
+
+  module = builder.module();
+
+  ExpectFailure(sigs.v_v(),
+                {WASM_F64(42.0), WASM_REF_FUNC(func_index),
+                 WASM_CONT_NEW(ToByte(ct1_index)),
+                 WASM_SWITCH(ToByte(ct1_index), tag_d_v), WASM_DROP, WASM_DROP},
+                kAppendEnd, "switch[0] expected type i32, found f64.const");
+
+  ExpectFailure(sigs.v_v(),
+                {WASM_I32V(42), WASM_REF_FUNC(func_index),
+                 WASM_CONT_NEW(ToByte(ct1_index)),
+                 WASM_SWITCH(ToByte(ct2_index), tag_d_v), WASM_DROP, WASM_DROP},
+                kAppendEnd,
+                "expecting a (ref null? cont) as last parameter of type 4");
+
+  ExpectFailure(sigs.v_v(),
+                {WASM_I32V(42), WASM_REF_FUNC(func_index),
+                 WASM_CONT_NEW(ToByte(ct1_index)),
+                 WASM_SWITCH(ToByte(ct1_index), tag_i_v), WASM_DROP, WASM_DROP},
+                kAppendEnd, "return(s) from continuation 6 do not match tag 1");
+
+  ExpectFailure(sigs.v_v(),
+                {WASM_I32V(42), WASM_REF_FUNC(func_index),
+                 WASM_CONT_NEW(ToByte(ct1_index)),
+                 WASM_SWITCH(ToByte(ct3_index), tag_d_v), WASM_DROP, WASM_DROP},
+                kAppendEnd, "return(s) from continuation 8 do not match tag 0");
+
+  ExpectFailure(sigs.v_v(),
+                {WASM_I32V(42), WASM_REF_FUNC(func_index),
+                 WASM_CONT_NEW(ToByte(ct1_index)),
+                 WASM_SWITCH(ToByte(ct3_index), tag_f_v), WASM_DROP, WASM_DROP},
+                kAppendEnd, "return(s) from continuation 8 do not match tag 2");
+
+  ExpectFailure(sigs.v_v(),
+                {WASM_I32V(42), WASM_REF_FUNC(func_index),
+                 WASM_CONT_NEW(ToByte(ct1_index)),
+                 WASM_SWITCH(ToByte(ct3_index), tag_i_v), WASM_DROP, WASM_DROP},
+                kAppendEnd,
+                "tag 1's return types should be a subtype of return "
+                "continuation 6's return types");
+}
+
+TEST_F(FunctionBodyDecoderTest, WasmNoWasmFx) {
+  ModuleTypeIndex cont_index = builder.AddCont(sigs.i_i());
+  ModuleTypeIndex sig_index = builder.AddSignature(sigs.i_i());
+  uint8_t func_index = builder.AddFunction(sig_index);
+  uint8_t tag_i_i = builder.AddTag(sigs.i_i());
+
+  ExpectFailure(sigs.v_v(),
+                {WASM_I32V(42), WASM_REF_FUNC(func_index),
+                 WASM_CONT_NEW(ToByte(cont_index)),
+                 WASM_RESUME(ToByte(cont_index), 0), WASM_DROP},
+                kAppendEnd,
+                "Invalid opcode 0xe0 (enable with --experimental-wasm-wasmfx)");
+
+  ExpectFailure(sigs.v_v(), {WASM_RESUME(ToByte(cont_index), 0), WASM_DROP},
+                kAppendEnd,
+                "Invalid opcode 0xe3 (enable with --experimental-wasm-wasmfx)");
+
+  ExpectFailure(
+      sigs.v_v(),
+      {WASM_SWITCH(ToByte(cont_index), tag_i_i), WASM_DROP, WASM_DROP},
+      kAppendEnd,
+      "Invalid opcode 0xe5 (enable with --experimental-wasm-wasmfx)");
+}
+
 #undef B1
 #undef B2
 #undef B3
diff --git a/deps/v8/test/unittests/wasm/module-decoder-unittest.cc b/deps/v8/test/unittests/wasm/module-decoder-unittest.cc
index c0d3a2b144a20c..c97c4d6aea1d5b 100644
--- a/deps/v8/test/unittests/wasm/module-decoder-unittest.cc
+++ b/deps/v8/test/unittests/wasm/module-decoder-unittest.cc
@@ -3620,9 +3620,7 @@ TEST_F(WasmModuleVerifyTest, InvalidSharedGlobal) {
 
   ModuleResult result = DecodeModule(base::ArrayVector(data));
 
-  EXPECT_NOT_OK(
-      result,
-      "invalid global flags 0x3 (enable via --experimental-wasm-shared)");
+  EXPECT_NOT_OK(result, "invalid global flags 0x3");
 }
 
 TEST_F(WasmModuleVerifyTest, ContTypesBasic) {
diff --git a/deps/v8/third_party/abseil-cpp/BUILD.gn b/deps/v8/third_party/abseil-cpp/BUILD.gn
index 8b8bcfe69fe760..938ffe540df1c2 100644
--- a/deps/v8/third_party/abseil-cpp/BUILD.gn
+++ b/deps/v8/third_party/abseil-cpp/BUILD.gn
@@ -62,6 +62,7 @@ group("absl_component_deps") {
     "//third_party/abseil-cpp/absl/base",
     "//third_party/abseil-cpp/absl/base:config",
     "//third_party/abseil-cpp/absl/base:core_headers",
+    "//third_party/abseil-cpp/absl/base:fast_type_id",
     "//third_party/abseil-cpp/absl/base:log_severity",
     "//third_party/abseil-cpp/absl/base:no_destructor",
     "//third_party/abseil-cpp/absl/base:nullability",
@@ -296,6 +297,7 @@ if (absl_build_tests) {
         "absl/container:node_hash_set_test",
         "absl/container:node_slot_policy_test",
         "absl/container:raw_hash_set_allocator_test",
+        "absl/container:raw_hash_set_resize_impl_test",
         "absl/container:sample_element_size_test",
         "absl/crc:crc32c_test",
         "absl/crc:crc_cord_state_test",
diff --git a/deps/v8/third_party/abseil-cpp/CMake/AbseilDll.cmake b/deps/v8/third_party/abseil-cpp/CMake/AbseilDll.cmake
index fc9e1ffce34f3a..1a1898d2e9ba03 100644
--- a/deps/v8/third_party/abseil-cpp/CMake/AbseilDll.cmake
+++ b/deps/v8/third_party/abseil-cpp/CMake/AbseilDll.cmake
@@ -10,6 +10,7 @@ set(ABSL_INTERNAL_DLL_FILES
   "base/config.h"
   "base/const_init.h"
   "base/dynamic_annotations.h"
+  "base/fast_type_id.h"
   "base/internal/atomic_hook.h"
   "base/internal/cycleclock.cc"
   "base/internal/cycleclock.h"
@@ -17,14 +18,13 @@ set(ABSL_INTERNAL_DLL_FILES
   "base/internal/direct_mmap.h"
   "base/internal/endian.h"
   "base/internal/errno_saver.h"
-  "base/internal/fast_type_id.h"
   "base/internal/hide_ptr.h"
   "base/internal/identity.h"
   "base/internal/iterator_traits.h"
   "base/internal/low_level_alloc.cc"
   "base/internal/low_level_alloc.h"
   "base/internal/low_level_scheduling.h"
-  "base/internal/nullability_impl.h"
+  "base/internal/nullability_deprecated.h"
   "base/internal/per_thread_tls.h"
   "base/internal/poison.cc"
   "base/internal/poison.h"
@@ -93,6 +93,7 @@ set(ABSL_INTERNAL_DLL_FILES
   "container/internal/raw_hash_map.h"
   "container/internal/raw_hash_set.cc"
   "container/internal/raw_hash_set.h"
+  "container/internal/raw_hash_set_resize_impl.h"
   "container/internal/tracked.h"
   "container/node_hash_map.h"
   "container/node_hash_set.h"
@@ -160,6 +161,7 @@ set(ABSL_INTERNAL_DLL_FILES
   "hash/internal/spy_hash_state.h"
   "hash/internal/low_level_hash.h"
   "hash/internal/low_level_hash.cc"
+  "hash/internal/weakly_mixed_integer.h"
   "log/absl_check.h"
   "log/absl_log.h"
   "log/absl_vlog_is_on.h"
diff --git a/deps/v8/third_party/abseil-cpp/MODULE.bazel b/deps/v8/third_party/abseil-cpp/MODULE.bazel
index f8f7458125eb59..405d2c6f714518 100644
--- a/deps/v8/third_party/abseil-cpp/MODULE.bazel
+++ b/deps/v8/third_party/abseil-cpp/MODULE.bazel
@@ -25,13 +25,13 @@ cc_configure = use_extension("@rules_cc//cc:extensions.bzl",
                              dev_dependency = True)
 use_repo(cc_configure, "local_config_cc")
 
-bazel_dep(name = "rules_cc", version = "0.0.17")
+bazel_dep(name = "rules_cc", version = "0.1.1")
 bazel_dep(name = "bazel_skylib", version = "1.7.1")
-bazel_dep(name = "platforms", version = "0.0.10")
+bazel_dep(name = "platforms", version = "0.0.11")
 
 bazel_dep(
     name = "google_benchmark",
-    version = "1.8.5",
+    version = "1.9.2",
     dev_dependency = True,
 )
 
@@ -39,5 +39,5 @@ bazel_dep(
 # intended to be used by Abseil users depend on GoogleTest.
 bazel_dep(
     name = "googletest",
-    version = "1.16.0",
+    version = "1.16.0.bcr.1",
 )
diff --git a/deps/v8/third_party/abseil-cpp/README.chromium b/deps/v8/third_party/abseil-cpp/README.chromium
index 80a0cfe4d9a98a..7c65eac2692ddc 100644
--- a/deps/v8/third_party/abseil-cpp/README.chromium
+++ b/deps/v8/third_party/abseil-cpp/README.chromium
@@ -4,7 +4,7 @@ URL: https://github.com/abseil/abseil-cpp
 License: Apache-2.0
 License File: LICENSE
 Version: N/A
-Revision: fd39cfa4670a1f7995ecf0247f04bda757384ad9
+Revision: e5e2a9de560c8190042bcf7a2425b2213c0a020f
 Security Critical: yes
 Shipped: yes
 
@@ -30,6 +30,16 @@ third_party/abseil-cpp/BUILD.gn target
 
 4. If abseil adds new features, update styleguide/c++/c++-features.md and add headers for that feature into exclude list in root DEPS
 
+5. Verify your roll no-ops upon `third_party/abseil-cpp/roll_abseil.py --no-branch --no-pull --no-upload --revision <Revision>`
+
+How to review a roll:
+
+1. `git cl patch <CL number>`, then verify that `third_party/abseil-cpp/roll_abseil.py --no-branch --no-pull --no-upload --revision <Revision>`
+   no-ops.
+2. Check that changes to the .def files exist, or whether there is a comment in the CL description calling out they don't change.
+3. Check that every change in BUILD.bazel is matched by a counterpart in BUILD.gn.
+
+
 Local Modifications:
 
 * absl/copts.bzl has been translated to //third_party/absl-cpp/BUILD.gn. Both
diff --git a/deps/v8/third_party/abseil-cpp/absl/base/BUILD.bazel b/deps/v8/third_party/abseil-cpp/absl/base/BUILD.bazel
index 16a697d4bfbf96..ed75fedade8ad9 100644
--- a/deps/v8/third_party/abseil-cpp/absl/base/BUILD.bazel
+++ b/deps/v8/third_party/abseil-cpp/absl/base/BUILD.bazel
@@ -82,14 +82,13 @@ cc_library(
 
 cc_library(
     name = "nullability",
-    srcs = ["internal/nullability_impl.h"],
+    srcs = ["internal/nullability_deprecated.h"],
     hdrs = ["nullability.h"],
     copts = ABSL_DEFAULT_COPTS,
     linkopts = ABSL_DEFAULT_LINKOPTS,
     deps = [
         ":config",
         ":core_headers",
-        "//absl/meta:type_traits",
     ],
 )
 
@@ -538,6 +537,9 @@ cc_library(
     ],
     copts = ABSL_DEFAULT_COPTS,
     linkopts = ABSL_DEFAULT_LINKOPTS,
+    visibility = [
+        "//absl:__subpackages__",
+    ],
     deps = [
         ":base",
         ":config",
@@ -801,12 +803,9 @@ cc_binary(
 
 cc_library(
     name = "fast_type_id",
-    hdrs = ["internal/fast_type_id.h"],
+    hdrs = ["fast_type_id.h"],
     copts = ABSL_DEFAULT_COPTS,
     linkopts = ABSL_DEFAULT_LINKOPTS,
-    visibility = [
-        "//absl:__subpackages__",
-    ],
     deps = [
         ":config",
     ],
@@ -815,10 +814,11 @@ cc_library(
 cc_test(
     name = "fast_type_id_test",
     size = "small",
-    srcs = ["internal/fast_type_id_test.cc"],
+    srcs = ["fast_type_id_test.cc"],
     copts = ABSL_TEST_COPTS,
     linkopts = ABSL_DEFAULT_LINKOPTS,
     deps = [
+        ":core_headers",
         ":fast_type_id",
         "@googletest//:gtest",
         "@googletest//:gtest_main",
diff --git a/deps/v8/third_party/abseil-cpp/absl/base/BUILD.gn b/deps/v8/third_party/abseil-cpp/absl/base/BUILD.gn
index a491514b5a6c6d..6f581bfa30b078 100644
--- a/deps/v8/third_party/abseil-cpp/absl/base/BUILD.gn
+++ b/deps/v8/third_party/abseil-cpp/absl/base/BUILD.gn
@@ -37,12 +37,11 @@ absl_source_set("no_destructor") {
 }
 
 absl_source_set("nullability") {
-  sources = [ "internal/nullability_impl.h" ]
+  sources = [ "internal/nullability_deprecated.h" ]
   public = [ "nullability.h" ]
   deps = [
     ":config",
     ":core_headers",
-    "//third_party/abseil-cpp/absl/meta:type_traits",
   ]
 }
 
@@ -253,6 +252,7 @@ absl_source_set("endian") {
     "internal/endian.h",
     "internal/unaligned_access.h",
   ]
+  visibility = [ "//third_party/abseil-cpp/absl/*" ]
   deps = [
     ":base",
     ":config",
@@ -284,9 +284,8 @@ absl_source_set("strerror") {
 }
 
 absl_source_set("fast_type_id") {
-  public = [ "internal/fast_type_id.h" ]
+  public = [ "fast_type_id.h" ]
   deps = [ ":config" ]
-  visibility = [ "//third_party/abseil-cpp/absl/*" ]
 }
 
 absl_source_set("prefetch") {
diff --git a/deps/v8/third_party/abseil-cpp/absl/base/CMakeLists.txt b/deps/v8/third_party/abseil-cpp/absl/base/CMakeLists.txt
index cfa24cb0ce44ba..74df2716961b90 100644
--- a/deps/v8/third_party/abseil-cpp/absl/base/CMakeLists.txt
+++ b/deps/v8/third_party/abseil-cpp/absl/base/CMakeLists.txt
@@ -73,11 +73,10 @@ absl_cc_library(
   HDRS
     "nullability.h"
   SRCS
-    "internal/nullability_impl.h"
+    "internal/nullability_deprecated.h"
   DEPS
     absl::config
     absl::core_headers
-    absl::type_traits
   COPTS
     ${ABSL_DEFAULT_COPTS}
 )
@@ -667,12 +666,11 @@ absl_cc_test(
     GTest::gtest_main
 )
 
-# Internal-only target, do not depend on directly.
 absl_cc_library(
   NAME
     fast_type_id
   HDRS
-    "internal/fast_type_id.h"
+    "fast_type_id.h"
   COPTS
     ${ABSL_DEFAULT_COPTS}
   LINKOPTS
@@ -685,10 +683,11 @@ absl_cc_test(
   NAME
     fast_type_id_test
   SRCS
-    "internal/fast_type_id_test.cc"
+    "fast_type_id_test.cc"
   COPTS
     ${ABSL_TEST_COPTS}
   DEPS
+    absl::core_headers
     absl::fast_type_id
     GTest::gtest_main
 )
diff --git a/deps/v8/third_party/abseil-cpp/absl/base/attributes.h b/deps/v8/third_party/abseil-cpp/absl/base/attributes.h
index 300a1380e2f36a..d009f6d49122f9 100644
--- a/deps/v8/third_party/abseil-cpp/absl/base/attributes.h
+++ b/deps/v8/third_party/abseil-cpp/absl/base/attributes.h
@@ -339,9 +339,9 @@
 #ifndef ABSL_ATTRIBUTE_SECTION_VARIABLE
 #ifdef _AIX
 // __attribute__((section(#name))) on AIX is achieved by using the `.csect`
-// psudo op which includes an additional integer as part of its syntax indcating
-// alignment. If data fall under different alignments then you might get a
-// compilation error indicating a `Section type conflict`.
+// pseudo op which includes an additional integer as part of its syntax
+// indicating alignment. If data fall under different alignments then you might
+// get a compilation error indicating a `Section type conflict`.
 #define ABSL_ATTRIBUTE_SECTION_VARIABLE(name)
 #else
 #define ABSL_ATTRIBUTE_SECTION_VARIABLE(name) __attribute__((section(#name)))
diff --git a/deps/v8/third_party/abseil-cpp/absl/base/call_once.h b/deps/v8/third_party/abseil-cpp/absl/base/call_once.h
index 321ea629654f62..7bfd91610e5e6e 100644
--- a/deps/v8/third_party/abseil-cpp/absl/base/call_once.h
+++ b/deps/v8/third_party/abseil-cpp/absl/base/call_once.h
@@ -28,6 +28,7 @@
 #include <algorithm>
 #include <atomic>
 #include <cstdint>
+#include <functional>
 #include <type_traits>
 #include <utility>
 
@@ -48,8 +49,8 @@ ABSL_NAMESPACE_BEGIN
 class once_flag;
 
 namespace base_internal {
-absl::Nonnull<std::atomic<uint32_t>*> ControlWord(
-    absl::Nonnull<absl::once_flag*> flag);
+std::atomic<uint32_t>* absl_nonnull ControlWord(
+    absl::once_flag* absl_nonnull flag);
 }  // namespace base_internal
 
 // call_once()
@@ -92,8 +93,8 @@ class once_flag {
   once_flag& operator=(const once_flag&) = delete;
 
  private:
-  friend absl::Nonnull<std::atomic<uint32_t>*> base_internal::ControlWord(
-      absl::Nonnull<once_flag*> flag);
+  friend std::atomic<uint32_t>* absl_nonnull base_internal::ControlWord(
+      once_flag* absl_nonnull flag);
   std::atomic<uint32_t> control_;
 };
 
@@ -107,7 +108,7 @@ namespace base_internal {
 // Like call_once, but uses KERNEL_ONLY scheduling. Intended to be used to
 // initialize entities used by the scheduler implementation.
 template <typename Callable, typename... Args>
-void LowLevelCallOnce(absl::Nonnull<absl::once_flag*> flag, Callable&& fn,
+void LowLevelCallOnce(absl::once_flag* absl_nonnull flag, Callable&& fn,
                       Args&&... args);
 
 // Disables scheduling while on stack when scheduling mode is non-cooperative.
@@ -149,7 +150,7 @@ enum {
 
 template <typename Callable, typename... Args>
     void
-    CallOnceImpl(absl::Nonnull<std::atomic<uint32_t>*> control,
+    CallOnceImpl(std::atomic<uint32_t>* absl_nonnull control,
                  base_internal::SchedulingMode scheduling_mode, Callable&& fn,
                  Args&&... args) {
 #ifndef NDEBUG
@@ -189,13 +190,13 @@ template <typename Callable, typename... Args>
   }  // else *control is already kOnceDone
 }
 
-inline absl::Nonnull<std::atomic<uint32_t>*> ControlWord(
-    absl::Nonnull<once_flag*> flag) {
+inline std::atomic<uint32_t>* absl_nonnull ControlWord(
+    once_flag* absl_nonnull flag) {
   return &flag->control_;
 }
 
 template <typename Callable, typename... Args>
-void LowLevelCallOnce(absl::Nonnull<absl::once_flag*> flag, Callable&& fn,
+void LowLevelCallOnce(absl::once_flag* absl_nonnull flag, Callable&& fn,
                       Args&&... args) {
   std::atomic<uint32_t>* once = base_internal::ControlWord(flag);
   uint32_t s = once->load(std::memory_order_acquire);
diff --git a/deps/v8/third_party/abseil-cpp/absl/base/internal/fast_type_id.h b/deps/v8/third_party/abseil-cpp/absl/base/fast_type_id.h
similarity index 72%
rename from deps/v8/third_party/abseil-cpp/absl/base/internal/fast_type_id.h
rename to deps/v8/third_party/abseil-cpp/absl/base/fast_type_id.h
index 36372f525ef34c..ff250276739fea 100644
--- a/deps/v8/third_party/abseil-cpp/absl/base/internal/fast_type_id.h
+++ b/deps/v8/third_party/abseil-cpp/absl/base/fast_type_id.h
@@ -1,4 +1,3 @@
-//
 // Copyright 2020 The Abseil Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
@@ -14,32 +13,33 @@
 // limitations under the License.
 //
 
-#ifndef ABSL_BASE_INTERNAL_FAST_TYPE_ID_H_
-#define ABSL_BASE_INTERNAL_FAST_TYPE_ID_H_
+#ifndef ABSL_BASE_FAST_TYPE_ID_H_
+#define ABSL_BASE_FAST_TYPE_ID_H_
 
 #include "absl/base/config.h"
 
 namespace absl {
 ABSL_NAMESPACE_BEGIN
-namespace base_internal {
 
+namespace base_internal {
 template <typename Type>
 struct FastTypeTag {
-  constexpr static char dummy_var = 0;
+  static constexpr char kDummyVar = 0;
 };
+}  // namespace base_internal
 
-// FastTypeId<Type>() evaluates at compile/link-time to a unique pointer for the
-// passed-in type. These are meant to be good match for keys into maps or
-// straight up comparisons.
+// The type returned by `absl::FastTypeId<T>()`.
 using FastTypeIdType = const void*;
 
+// `absl::FastTypeId<Type>()` evaluates at compile-time to a unique id for the
+// passed-in type. These are meant to be good match for keys into maps or
+// straight up comparisons.
 template <typename Type>
-constexpr inline FastTypeIdType FastTypeId() {
-  return &FastTypeTag<Type>::dummy_var;
+constexpr FastTypeIdType FastTypeId() {
+  return &base_internal::FastTypeTag<Type>::kDummyVar;
 }
 
-}  // namespace base_internal
 ABSL_NAMESPACE_END
 }  // namespace absl
 
-#endif  // ABSL_BASE_INTERNAL_FAST_TYPE_ID_H_
+#endif  // ABSL_BASE_FAST_TYPE_ID_H_
diff --git a/deps/v8/third_party/abseil-cpp/absl/base/internal/fast_type_id_test.cc b/deps/v8/third_party/abseil-cpp/absl/base/fast_type_id_test.cc
similarity index 56%
rename from deps/v8/third_party/abseil-cpp/absl/base/internal/fast_type_id_test.cc
rename to deps/v8/third_party/abseil-cpp/absl/base/fast_type_id_test.cc
index 16f3c1458bdf0b..3068e4bb70fd72 100644
--- a/deps/v8/third_party/abseil-cpp/absl/base/internal/fast_type_id_test.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/base/fast_type_id_test.cc
@@ -12,18 +12,19 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-#include "absl/base/internal/fast_type_id.h"
+#include "absl/base/fast_type_id.h"
 
+#include <cstddef>
 #include <cstdint>
 #include <map>
 #include <vector>
 
 #include "gtest/gtest.h"
+#include "absl/base/macros.h"
 
 namespace {
-namespace bi = absl::base_internal;
 
-// NOLINTNEXTLINE
+// NOLINTBEGIN(runtime/int)
 #define PRIM_TYPES(A)   \
   A(bool)               \
   A(short)              \
@@ -37,28 +38,30 @@ namespace bi = absl::base_internal;
   A(float)              \
   A(double)             \
   A(long double)
+// NOLINTEND(runtime/int)
 
 TEST(FastTypeIdTest, PrimitiveTypes) {
-  bi::FastTypeIdType type_ids[] = {
-#define A(T) bi::FastTypeId<T>(),
+  // clang-format off
+  constexpr absl::FastTypeIdType kTypeIds[] = {
+#define A(T) absl::FastTypeId<T>(),
     PRIM_TYPES(A)
 #undef A
-#define A(T) bi::FastTypeId<const T>(),
+#define A(T) absl::FastTypeId<const T>(),
     PRIM_TYPES(A)
 #undef A
-#define A(T) bi::FastTypeId<volatile T>(),
+#define A(T) absl::FastTypeId<volatile T>(),
     PRIM_TYPES(A)
 #undef A
-#define A(T) bi::FastTypeId<const volatile T>(),
+#define A(T) absl::FastTypeId<const volatile T>(),
     PRIM_TYPES(A)
 #undef A
   };
-  size_t total_type_ids = sizeof(type_ids) / sizeof(bi::FastTypeIdType);
+  // clang-format on
 
-  for (int i = 0; i < total_type_ids; ++i) {
-    EXPECT_EQ(type_ids[i], type_ids[i]);
-    for (int j = 0; j < i; ++j) {
-      EXPECT_NE(type_ids[i], type_ids[j]);
+  for (size_t i = 0; i < ABSL_ARRAYSIZE(kTypeIds); ++i) {
+    EXPECT_EQ(kTypeIds[i], kTypeIds[i]);
+    for (size_t j = 0; j < i; ++j) {
+      EXPECT_NE(kTypeIds[i], kTypeIds[j]);
     }
   }
 }
@@ -74,41 +77,42 @@ TEST(FastTypeIdTest, PrimitiveTypes) {
   A(uint64_t)
 
 TEST(FastTypeIdTest, FixedWidthTypes) {
-  bi::FastTypeIdType type_ids[] = {
-#define A(T) bi::FastTypeId<T>(),
+  // clang-format off
+  constexpr absl::FastTypeIdType kTypeIds[] = {
+#define A(T) absl::FastTypeId<T>(),
     FIXED_WIDTH_TYPES(A)
 #undef A
-#define A(T) bi::FastTypeId<const T>(),
+#define A(T) absl::FastTypeId<const T>(),
     FIXED_WIDTH_TYPES(A)
 #undef A
-#define A(T) bi::FastTypeId<volatile T>(),
+#define A(T) absl::FastTypeId<volatile T>(),
     FIXED_WIDTH_TYPES(A)
 #undef A
-#define A(T) bi::FastTypeId<const volatile T>(),
+#define A(T) absl::FastTypeId<const volatile T>(),
     FIXED_WIDTH_TYPES(A)
 #undef A
   };
-  size_t total_type_ids = sizeof(type_ids) / sizeof(bi::FastTypeIdType);
+  // clang-format on
 
-  for (int i = 0; i < total_type_ids; ++i) {
-    EXPECT_EQ(type_ids[i], type_ids[i]);
-    for (int j = 0; j < i; ++j) {
-      EXPECT_NE(type_ids[i], type_ids[j]);
+  for (size_t i = 0; i < ABSL_ARRAYSIZE(kTypeIds); ++i) {
+    EXPECT_EQ(kTypeIds[i], kTypeIds[i]);
+    for (size_t j = 0; j < i; ++j) {
+      EXPECT_NE(kTypeIds[i], kTypeIds[j]);
     }
   }
 }
 
 TEST(FastTypeIdTest, AliasTypes) {
   using int_alias = int;
-  EXPECT_EQ(bi::FastTypeId<int_alias>(), bi::FastTypeId<int>());
+  EXPECT_EQ(absl::FastTypeId<int_alias>(), absl::FastTypeId<int>());
 }
 
 TEST(FastTypeIdTest, TemplateSpecializations) {
-  EXPECT_NE(bi::FastTypeId<std::vector<int>>(),
-            bi::FastTypeId<std::vector<long>>());
+  EXPECT_NE(absl::FastTypeId<std::vector<int>>(),
+            absl::FastTypeId<std::vector<long>>());  // NOLINT(runtime/int)
 
-  EXPECT_NE((bi::FastTypeId<std::map<int, float>>()),
-            (bi::FastTypeId<std::map<int, double>>()));
+  EXPECT_NE((absl::FastTypeId<std::map<int, float>>()),
+            (absl::FastTypeId<std::map<int, double>>()));
 }
 
 struct Base {};
@@ -116,8 +120,8 @@ struct Derived : Base {};
 struct PDerived : private Base {};
 
 TEST(FastTypeIdTest, Inheritance) {
-  EXPECT_NE(bi::FastTypeId<Base>(), bi::FastTypeId<Derived>());
-  EXPECT_NE(bi::FastTypeId<Base>(), bi::FastTypeId<PDerived>());
+  EXPECT_NE(absl::FastTypeId<Base>(), absl::FastTypeId<Derived>());
+  EXPECT_NE(absl::FastTypeId<Base>(), absl::FastTypeId<PDerived>());
 }
 
 }  // namespace
diff --git a/deps/v8/third_party/abseil-cpp/absl/base/internal/endian.h b/deps/v8/third_party/abseil-cpp/absl/base/internal/endian.h
index e1a67f587b0e97..fb38f6024704ff 100644
--- a/deps/v8/third_party/abseil-cpp/absl/base/internal/endian.h
+++ b/deps/v8/third_party/abseil-cpp/absl/base/internal/endian.h
@@ -157,27 +157,27 @@ inline int64_t ToHost(int64_t x) {
 }
 
 // Functions to do unaligned loads and stores in little-endian order.
-inline uint16_t Load16(absl::Nonnull<const void *> p) {
+inline uint16_t Load16(const void* absl_nonnull p) {
   return ToHost16(ABSL_INTERNAL_UNALIGNED_LOAD16(p));
 }
 
-inline void Store16(absl::Nonnull<void *> p, uint16_t v) {
+inline void Store16(void* absl_nonnull p, uint16_t v) {
   ABSL_INTERNAL_UNALIGNED_STORE16(p, FromHost16(v));
 }
 
-inline uint32_t Load32(absl::Nonnull<const void *> p) {
+inline uint32_t Load32(const void* absl_nonnull p) {
   return ToHost32(ABSL_INTERNAL_UNALIGNED_LOAD32(p));
 }
 
-inline void Store32(absl::Nonnull<void *> p, uint32_t v) {
+inline void Store32(void* absl_nonnull p, uint32_t v) {
   ABSL_INTERNAL_UNALIGNED_STORE32(p, FromHost32(v));
 }
 
-inline uint64_t Load64(absl::Nonnull<const void *> p) {
+inline uint64_t Load64(const void* absl_nonnull p) {
   return ToHost64(ABSL_INTERNAL_UNALIGNED_LOAD64(p));
 }
 
-inline void Store64(absl::Nonnull<void *> p, uint64_t v) {
+inline void Store64(void* absl_nonnull p, uint64_t v) {
   ABSL_INTERNAL_UNALIGNED_STORE64(p, FromHost64(v));
 }
 
@@ -247,27 +247,27 @@ inline int64_t ToHost(int64_t x) {
 }
 
 // Functions to do unaligned loads and stores in big-endian order.
-inline uint16_t Load16(absl::Nonnull<const void *> p) {
+inline uint16_t Load16(const void* absl_nonnull p) {
   return ToHost16(ABSL_INTERNAL_UNALIGNED_LOAD16(p));
 }
 
-inline void Store16(absl::Nonnull<void *> p, uint16_t v) {
+inline void Store16(void* absl_nonnull p, uint16_t v) {
   ABSL_INTERNAL_UNALIGNED_STORE16(p, FromHost16(v));
 }
 
-inline uint32_t Load32(absl::Nonnull<const void *> p) {
+inline uint32_t Load32(const void* absl_nonnull p) {
   return ToHost32(ABSL_INTERNAL_UNALIGNED_LOAD32(p));
 }
 
-inline void Store32(absl::Nonnull<void *>p, uint32_t v) {
+inline void Store32(void* absl_nonnull p, uint32_t v) {
   ABSL_INTERNAL_UNALIGNED_STORE32(p, FromHost32(v));
 }
 
-inline uint64_t Load64(absl::Nonnull<const void *> p) {
+inline uint64_t Load64(const void* absl_nonnull p) {
   return ToHost64(ABSL_INTERNAL_UNALIGNED_LOAD64(p));
 }
 
-inline void Store64(absl::Nonnull<void *> p, uint64_t v) {
+inline void Store64(void* absl_nonnull p, uint64_t v) {
   ABSL_INTERNAL_UNALIGNED_STORE64(p, FromHost64(v));
 }
 
diff --git a/deps/v8/third_party/abseil-cpp/absl/base/internal/low_level_alloc.cc b/deps/v8/third_party/abseil-cpp/absl/base/internal/low_level_alloc.cc
index a563f7b9f9bda2..158b60982f1051 100644
--- a/deps/v8/third_party/abseil-cpp/absl/base/internal/low_level_alloc.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/base/internal/low_level_alloc.cc
@@ -330,7 +330,7 @@ size_t GetPageSize() {
   GetSystemInfo(&system_info);
   return std::max(system_info.dwPageSize, system_info.dwAllocationGranularity);
 #elif defined(__wasm__) || defined(__asmjs__) || defined(__hexagon__)
-  return getpagesize();
+  return static_cast<size_t>(getpagesize());
 #else
   return static_cast<size_t>(sysconf(_SC_PAGESIZE));
 #endif
@@ -448,8 +448,8 @@ static inline uintptr_t RoundUp(uintptr_t addr, uintptr_t align) {
 // that the freelist is in the correct order, that it
 // consists of regions marked "unallocated", and that no two regions
 // are adjacent in memory (they should have been coalesced).
-// L >= arena->mu
-static AllocList *Next(int i, AllocList *prev, LowLevelAlloc::Arena *arena) {
+static AllocList *Next(int i, AllocList *prev, LowLevelAlloc::Arena *arena)
+    ABSL_EXCLUSIVE_LOCKS_REQUIRED(arena->mu) {
   ABSL_RAW_CHECK(i < prev->levels, "too few levels in Next()");
   AllocList *next = prev->next[i];
   if (next != nullptr) {
@@ -473,6 +473,7 @@ static void Coalesce(AllocList *a) {
   if (n != nullptr && reinterpret_cast<char *>(a) + a->header.size ==
                           reinterpret_cast<char *>(n)) {
     LowLevelAlloc::Arena *arena = a->header.arena;
+    arena->mu.AssertHeld();
     a->header.size += n->header.size;
     n->header.magic = 0;
     n->header.arena = nullptr;
@@ -486,8 +487,8 @@ static void Coalesce(AllocList *a) {
 }
 
 // Adds block at location "v" to the free list
-// L >= arena->mu
-static void AddToFreelist(void *v, LowLevelAlloc::Arena *arena) {
+static void AddToFreelist(void *v, LowLevelAlloc::Arena *arena)
+    ABSL_EXCLUSIVE_LOCKS_REQUIRED(arena->mu) {
   AllocList *f = reinterpret_cast<AllocList *>(reinterpret_cast<char *>(v) -
                                                sizeof(f->header));
   ABSL_RAW_CHECK(f->header.magic == Magic(kMagicAllocated, &f->header),
diff --git a/deps/v8/third_party/abseil-cpp/absl/base/internal/nullability_impl.h b/deps/v8/third_party/abseil-cpp/absl/base/internal/nullability_deprecated.h
similarity index 55%
rename from deps/v8/third_party/abseil-cpp/absl/base/internal/nullability_impl.h
rename to deps/v8/third_party/abseil-cpp/absl/base/internal/nullability_deprecated.h
index b601fc4ce94603..b6405f1d9b269a 100644
--- a/deps/v8/third_party/abseil-cpp/absl/base/internal/nullability_impl.h
+++ b/deps/v8/third_party/abseil-cpp/absl/base/internal/nullability_deprecated.h
@@ -11,16 +11,11 @@
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
-
-#ifndef ABSL_BASE_INTERNAL_NULLABILITY_IMPL_H_
-#define ABSL_BASE_INTERNAL_NULLABILITY_IMPL_H_
-
-#include <memory>
-#include <type_traits>
+#ifndef ABSL_BASE_INTERNAL_NULLABILITY_DEPRECATED_H_
+#define ABSL_BASE_INTERNAL_NULLABILITY_DEPRECATED_H_
 
 #include "absl/base/attributes.h"
 #include "absl/base/config.h"
-#include "absl/meta/type_traits.h"
 
 namespace absl {
 ABSL_NAMESPACE_BEGIN
@@ -63,7 +58,49 @@ using NullabilityUnknownImpl
 #endif
 
 }  // namespace nullability_internal
+
+// The following template aliases are deprecated forms of nullability
+// annotations. They have some limitations, for example, an incompatibility with
+// `auto*` pointers, as `auto` cannot be used in a template argument.
+//
+// It is important to note that these annotations are not distinct strong
+// *types*. They are alias templates defined to be equal to the underlying
+// pointer type. A pointer annotated `Nonnull<T*>`, for example, is simply a
+// pointer of type `T*`.
+//
+// Prefer the macro style annotations in `absl/base/nullability.h` instead.
+
+// absl::Nonnull, analogous to absl_nonnull
+//
+// Example:
+// absl::Nonnull<int*> foo;
+// Is equivalent to:
+// int* absl_nonnull foo;
+template <typename T>
+using Nonnull =
+    nullability_internal::NonnullImpl<T>;
+
+// absl::Nullable, analogous to absl_nullable
+//
+// Example:
+// absl::Nullable<int*> foo;
+// Is equivalent to:
+// int* absl_nullable foo;
+template <typename T>
+using Nullable =
+    nullability_internal::NullableImpl<T>;
+
+// absl::NullabilityUnknown, analogous to absl_nullability_unknown
+//
+// Example:
+// absl::NullabilityUnknown<int*> foo;
+// Is equivalent to:
+// int* absl_nullability_unknown foo;
+template <typename T>
+using NullabilityUnknown =
+    nullability_internal::NullabilityUnknownImpl<T>;
+
 ABSL_NAMESPACE_END
 }  // namespace absl
 
-#endif  // ABSL_BASE_INTERNAL_NULLABILITY_IMPL_H_
+#endif  // ABSL_BASE_INTERNAL_NULLABILITY_DEPRECATED_H_
diff --git a/deps/v8/third_party/abseil-cpp/absl/base/internal/sysinfo_test.cc b/deps/v8/third_party/abseil-cpp/absl/base/internal/sysinfo_test.cc
index f305b6c532793a..c2b59aa6fa4d77 100644
--- a/deps/v8/third_party/abseil-cpp/absl/base/internal/sysinfo_test.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/base/internal/sysinfo_test.cc
@@ -41,7 +41,7 @@ TEST(SysinfoTest, GetTID) {
   EXPECT_EQ(GetTID(), GetTID());  // Basic compile and equality test.
 #ifdef __native_client__
   // Native Client has a race condition bug that leads to memory
-  // exaustion when repeatedly creating and joining threads.
+  // exhaustion when repeatedly creating and joining threads.
   // https://bugs.chromium.org/p/nativeclient/issues/detail?id=1027
   return;
 #endif
diff --git a/deps/v8/third_party/abseil-cpp/absl/base/internal/unaligned_access.h b/deps/v8/third_party/abseil-cpp/absl/base/internal/unaligned_access.h
index 4fea457491c2fe..3f5dd6f9ff9be4 100644
--- a/deps/v8/third_party/abseil-cpp/absl/base/internal/unaligned_access.h
+++ b/deps/v8/third_party/abseil-cpp/absl/base/internal/unaligned_access.h
@@ -36,33 +36,33 @@ namespace absl {
 ABSL_NAMESPACE_BEGIN
 namespace base_internal {
 
-inline uint16_t UnalignedLoad16(absl::Nonnull<const void *> p) {
+inline uint16_t UnalignedLoad16(const void* absl_nonnull p) {
   uint16_t t;
   memcpy(&t, p, sizeof t);
   return t;
 }
 
-inline uint32_t UnalignedLoad32(absl::Nonnull<const void *> p) {
+inline uint32_t UnalignedLoad32(const void* absl_nonnull p) {
   uint32_t t;
   memcpy(&t, p, sizeof t);
   return t;
 }
 
-inline uint64_t UnalignedLoad64(absl::Nonnull<const void *> p) {
+inline uint64_t UnalignedLoad64(const void* absl_nonnull p) {
   uint64_t t;
   memcpy(&t, p, sizeof t);
   return t;
 }
 
-inline void UnalignedStore16(absl::Nonnull<void *> p, uint16_t v) {
+inline void UnalignedStore16(void* absl_nonnull p, uint16_t v) {
   memcpy(p, &v, sizeof v);
 }
 
-inline void UnalignedStore32(absl::Nonnull<void *> p, uint32_t v) {
+inline void UnalignedStore32(void* absl_nonnull p, uint32_t v) {
   memcpy(p, &v, sizeof v);
 }
 
-inline void UnalignedStore64(absl::Nonnull<void *> p, uint64_t v) {
+inline void UnalignedStore64(void* absl_nonnull p, uint64_t v) {
   memcpy(p, &v, sizeof v);
 }
 
diff --git a/deps/v8/third_party/abseil-cpp/absl/base/internal/unscaledcycleclock.h b/deps/v8/third_party/abseil-cpp/absl/base/internal/unscaledcycleclock.h
index 965c42de4eafc6..bfd98873152aef 100644
--- a/deps/v8/third_party/abseil-cpp/absl/base/internal/unscaledcycleclock.h
+++ b/deps/v8/third_party/abseil-cpp/absl/base/internal/unscaledcycleclock.h
@@ -88,9 +88,14 @@ inline int64_t UnscaledCycleClock::Now() {
 #elif defined(__aarch64__)
 
 // System timer of ARMv8 runs at a different frequency than the CPU's.
-// The frequency is fixed, typically in the range 1-50MHz.  It can be
-// read at CNTFRQ special register.  We assume the OS has set up
-// the virtual timer properly.
+//
+// Frequency is fixed. From Armv8.6-A and Armv9.1-A on, the frequency is 1GHz.
+// Pre-Armv8.6-A, the frequency was a system design choice, typically in the
+// range of 1MHz to 50MHz. See also:
+// https://developer.arm.com/documentation/102379/0101/What-is-the-Generic-Timer-
+//
+// It can be read at CNTFRQ special register.  We assume the OS has set up the
+// virtual timer properly.
 inline int64_t UnscaledCycleClock::Now() {
   int64_t virtual_timer_value;
   asm volatile("mrs %0, cntvct_el0" : "=r"(virtual_timer_value));
diff --git a/deps/v8/third_party/abseil-cpp/absl/base/no_destructor.h b/deps/v8/third_party/abseil-cpp/absl/base/no_destructor.h
index 2478d691c10386..9d960ee33488bf 100644
--- a/deps/v8/third_party/abseil-cpp/absl/base/no_destructor.h
+++ b/deps/v8/third_party/abseil-cpp/absl/base/no_destructor.h
@@ -135,11 +135,11 @@ class NoDestructor {
   // Pretend to be a smart pointer to T with deep constness.
   // Never returns a null pointer.
   T& operator*() { return *get(); }
-  absl::Nonnull<T*> operator->() { return get(); }
-  absl::Nonnull<T*> get() { return impl_.get(); }
+  T* absl_nonnull operator->() { return get(); }
+  T* absl_nonnull get() { return impl_.get(); }
   const T& operator*() const { return *get(); }
-  absl::Nonnull<const T*> operator->() const { return get(); }
-  absl::Nonnull<const T*> get() const { return impl_.get(); }
+  const T* absl_nonnull operator->() const { return get(); }
+  const T* absl_nonnull get() const { return impl_.get(); }
 
  private:
   class DirectImpl {
@@ -147,8 +147,8 @@ class NoDestructor {
     template <typename... Args>
     explicit constexpr DirectImpl(Args&&... args)
         : value_(std::forward<Args>(args)...) {}
-    absl::Nonnull<const T*> get() const { return &value_; }
-    absl::Nonnull<T*> get() { return &value_; }
+    const T* absl_nonnull get() const { return &value_; }
+    T* absl_nonnull get() { return &value_; }
 
    private:
     T value_;
@@ -160,10 +160,10 @@ class NoDestructor {
     explicit PlacementImpl(Args&&... args) {
       new (&space_) T(std::forward<Args>(args)...);
     }
-    absl::Nonnull<const T*> get() const {
+    const T* absl_nonnull get() const {
       return std::launder(reinterpret_cast<const T*>(&space_));
     }
-    absl::Nonnull<T*> get() {
+    T* absl_nonnull get() {
       return std::launder(reinterpret_cast<T*>(&space_));
     }
 
diff --git a/deps/v8/third_party/abseil-cpp/absl/base/nullability.h b/deps/v8/third_party/abseil-cpp/absl/base/nullability.h
index d11da5793b3844..3a5d6e83e20608 100644
--- a/deps/v8/third_party/abseil-cpp/absl/base/nullability.h
+++ b/deps/v8/third_party/abseil-cpp/absl/base/nullability.h
@@ -86,6 +86,9 @@
 // // A non-null function pointer.
 // void (*absl_nonnull func)(int, double);
 //
+// // A non-null array of `Employee`s as a parameter.
+// void func(Employee employees[absl_nonnull]);
+//
 // // A non-null std::unique_ptr to an `Employee`.
 // // As with `const`, it is possible to place the annotation on either side of
 // // a named type not ending in `*`, but placing it before the type it
@@ -181,7 +184,7 @@
 #define ABSL_BASE_NULLABILITY_H_
 
 #include "absl/base/config.h"
-#include "absl/base/internal/nullability_impl.h"
+#include "absl/base/internal/nullability_deprecated.h"
 
 // ABSL_POINTERS_DEFAULT_NONNULL
 //
@@ -312,46 +315,4 @@
 #define ABSL_NULLABILITY_COMPATIBLE
 #endif
 
-namespace absl {
-ABSL_NAMESPACE_BEGIN
-
-// The following template aliases are alternate forms of the macro annotations
-// above. They have some limitations, for example, an incompatibility with
-// `auto*` pointers, as `auto` cannot be used in a template argument.
-//
-// It is important to note that these annotations are not distinct strong
-// *types*. They are alias templates defined to be equal to the underlying
-// pointer type. A pointer annotated `Nonnull<T*>`, for example, is simply a
-// pointer of type `T*`.
-
-// absl::Nonnull, analogous to absl_nonnull
-//
-// Example:
-// absl::Nonnull<int*> foo;
-// Is equivalent to:
-// int* absl_nonnull foo;
-template <typename T>
-using Nonnull = nullability_internal::NonnullImpl<T>;
-
-// absl::Nullable, analogous to absl_nullable
-//
-// Example:
-// absl::Nullable<int*> foo;
-// Is equivalent to:
-// int* absl_nullable foo;
-template <typename T>
-using Nullable = nullability_internal::NullableImpl<T>;
-
-// absl::NullabilityUnknown, analogous to absl_nullability_unknown
-//
-// Example:
-// absl::NullabilityUnknown<int*> foo;
-// Is equivalent to:
-// int* absl_nullability_unknown foo;
-template <typename T>
-using NullabilityUnknown = nullability_internal::NullabilityUnknownImpl<T>;
-
-ABSL_NAMESPACE_END
-}  // namespace absl
-
 #endif  // ABSL_BASE_NULLABILITY_H_
diff --git a/deps/v8/third_party/abseil-cpp/absl/base/nullability_test.cc b/deps/v8/third_party/abseil-cpp/absl/base/nullability_test.cc
index b4a22e890040af..bccc388beb9d48 100644
--- a/deps/v8/third_party/abseil-cpp/absl/base/nullability_test.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/base/nullability_test.cc
@@ -20,6 +20,7 @@
 #include <utility>
 
 #include "gtest/gtest.h"
+#include "absl/base/attributes.h"
 
 namespace {
 namespace macro_annotations {
@@ -91,6 +92,9 @@ TEST(PassThroughTest, PassesThroughPointerToMemberFunction) {
 }
 }  // namespace macro_annotations
 
+// Allow testing of the deprecated type alias annotations.
+ABSL_INTERNAL_DISABLE_DEPRECATED_DECLARATION_WARNING
+
 using ::absl::Nonnull;
 using ::absl::NullabilityUnknown;
 using ::absl::Nullable;
@@ -197,4 +201,6 @@ TEST(NullableAdlTest, NullableAddsNothingToArgumentDependentLookup) {
   EXPECT_TRUE(DidAdlWin((util::MakeAdlWin*)nullptr));
   EXPECT_TRUE(DidAdlWin((Nullable<util::MakeAdlWin*>)nullptr));
 }
+
+ABSL_INTERNAL_RESTORE_DEPRECATED_DECLARATION_WARNING
 }  // namespace
diff --git a/deps/v8/third_party/abseil-cpp/absl/base/raw_logging_test.cc b/deps/v8/third_party/abseil-cpp/absl/base/raw_logging_test.cc
index 03a88ff8153b1d..f4f3445d19e786 100644
--- a/deps/v8/third_party/abseil-cpp/absl/base/raw_logging_test.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/base/raw_logging_test.cc
@@ -43,12 +43,27 @@ TEST(RawLoggingCompilationTest, PassingCheck) {
   ABSL_RAW_CHECK(true, "RAW CHECK");
 }
 
+TEST(RawLoggingCompilationTest, DebugLog) {
+  ABSL_RAW_DLOG(INFO, "RAW DLOG: %d", 1);
+}
+
+TEST(RawLoggingCompilationTest, PassingDebugCheck) {
+  ABSL_RAW_DCHECK(true, "failure message");
+}
+
 // Not all platforms support output from raw log, so we don't verify any
 // particular output for RAW check failures (expecting the empty string
 // accomplishes this).  This test is primarily a compilation test, but we
 // are verifying process death when EXPECT_DEATH works for a platform.
 const char kExpectedDeathOutput[] = "";
 
+#if !defined(NDEBUG)  // if debug build
+TEST(RawLoggingDeathTest, FailingDebugCheck) {
+  EXPECT_DEATH_IF_SUPPORTED(ABSL_RAW_DCHECK(1 == 0, "explanation"),
+                            kExpectedDeathOutput);
+}
+#endif  // if debug build
+
 TEST(RawLoggingDeathTest, FailingCheck) {
   EXPECT_DEATH_IF_SUPPORTED(ABSL_RAW_CHECK(1 == 0, "explanation"),
                             kExpectedDeathOutput);
diff --git a/deps/v8/third_party/abseil-cpp/absl/container/BUILD.bazel b/deps/v8/third_party/abseil-cpp/absl/container/BUILD.bazel
index ccaed1c71bcaed..91f930a48c47ae 100644
--- a/deps/v8/third_party/abseil-cpp/absl/container/BUILD.bazel
+++ b/deps/v8/third_party/abseil-cpp/absl/container/BUILD.bazel
@@ -72,6 +72,7 @@ cc_library(
         "//absl/base:dynamic_annotations",
         "//absl/base:iterator_traits_internal",
         "//absl/base:throw_delegate",
+        "//absl/hash:weakly_mixed_integer",
         "//absl/memory",
     ],
 )
@@ -148,6 +149,7 @@ cc_library(
         "//absl/base:core_headers",
         "//absl/base:iterator_traits_internal",
         "//absl/base:throw_delegate",
+        "//absl/hash:weakly_mixed_integer",
         "//absl/memory",
         "//absl/meta:type_traits",
     ],
@@ -693,6 +695,27 @@ cc_library(
     ],
 )
 
+cc_library(
+    name = "raw_hash_set_resize_impl",
+    hdrs = ["internal/raw_hash_set_resize_impl.h"],
+    copts = ABSL_DEFAULT_COPTS,
+    linkopts = ABSL_DEFAULT_LINKOPTS,
+    deps = ["//absl/base:config"],
+)
+
+cc_test(
+    name = "raw_hash_set_resize_impl_test",
+    srcs = ["internal/raw_hash_set_resize_impl_test.cc"],
+    copts = ABSL_TEST_COPTS,
+    linkopts = ABSL_DEFAULT_LINKOPTS,
+    deps = [
+        ":raw_hash_set_resize_impl",
+        "//absl/base:config",
+        "@googletest//:gtest",
+        "@googletest//:gtest_main",
+    ],
+)
+
 cc_library(
     name = "raw_hash_set",
     srcs = ["internal/raw_hash_set.cc"],
@@ -709,6 +732,7 @@ cc_library(
         ":hashtable_control_bytes",
         ":hashtable_debug_hooks",
         ":hashtablez_sampler",
+        ":raw_hash_set_resize_impl",
         "//absl/base:config",
         "//absl/base:core_headers",
         "//absl/base:dynamic_annotations",
@@ -718,6 +742,7 @@ cc_library(
         "//absl/base:raw_logging_internal",
         "//absl/functional:function_ref",
         "//absl/hash",
+        "//absl/hash:weakly_mixed_integer",
         "//absl/memory",
         "//absl/meta:type_traits",
         "//absl/numeric:bits",
@@ -746,6 +771,7 @@ cc_test(
         ":hashtablez_sampler",
         ":node_hash_set",
         ":raw_hash_set",
+        ":raw_hash_set_resize_impl",
         ":test_allocator",
         ":test_instance_tracker",
         "//absl/base",
@@ -1063,6 +1089,7 @@ cc_library(
         "//absl/base:core_headers",
         "//absl/base:raw_logging_internal",
         "//absl/base:throw_delegate",
+        "//absl/hash:weakly_mixed_integer",
         "//absl/memory",
         "//absl/meta:type_traits",
         "//absl/strings",
diff --git a/deps/v8/third_party/abseil-cpp/absl/container/BUILD.gn b/deps/v8/third_party/abseil-cpp/absl/container/BUILD.gn
index 8738c43a878eca..8702f4d2a6147d 100644
--- a/deps/v8/third_party/abseil-cpp/absl/container/BUILD.gn
+++ b/deps/v8/third_party/abseil-cpp/absl/container/BUILD.gn
@@ -19,6 +19,7 @@ absl_source_set("fixed_array") {
     "//third_party/abseil-cpp/absl/base:dynamic_annotations",
     "//third_party/abseil-cpp/absl/base:iterator_traits_internal",
     "//third_party/abseil-cpp/absl/base:throw_delegate",
+    "//third_party/abseil-cpp/absl/hash:weakly_mixed_integer",
     "//third_party/abseil-cpp/absl/memory",
   ]
 }
@@ -58,6 +59,7 @@ absl_source_set("inlined_vector") {
     "//third_party/abseil-cpp/absl/base:core_headers",
     "//third_party/abseil-cpp/absl/base:iterator_traits_internal",
     "//third_party/abseil-cpp/absl/base:throw_delegate",
+    "//third_party/abseil-cpp/absl/hash:weakly_mixed_integer",
     "//third_party/abseil-cpp/absl/memory",
     "//third_party/abseil-cpp/absl/meta:type_traits",
   ]
@@ -398,6 +400,19 @@ absl_source_set("hashtable_control_bytes") {
   ]
 }
 
+absl_source_set("raw_hash_set_resize_impl") {
+  public = [ "internal/raw_hash_set_resize_impl.h" ]
+  deps = [ "//third_party/abseil-cpp/absl/base:config" ]
+}
+
+absl_test("raw_hash_set_resize_impl_test") {
+  sources = [ "internal/raw_hash_set_resize_impl_test.cc" ]
+  deps = [
+    ":raw_hash_set_resize_impl",
+    "//third_party/abseil-cpp/absl/base:config",
+  ]
+}
+
 absl_source_set("raw_hash_set") {
   sources = [ "internal/raw_hash_set.cc" ]
   public = [ "internal/raw_hash_set.h" ]
@@ -411,6 +426,7 @@ absl_source_set("raw_hash_set") {
     ":hashtable_control_bytes",
     ":hashtable_debug_hooks",
     ":hashtablez_sampler",
+    ":raw_hash_set_resize_impl",
     "//third_party/abseil-cpp/absl/base:config",
     "//third_party/abseil-cpp/absl/base:core_headers",
     "//third_party/abseil-cpp/absl/base:dynamic_annotations",
@@ -420,6 +436,7 @@ absl_source_set("raw_hash_set") {
     "//third_party/abseil-cpp/absl/base:raw_logging_internal",
     "//third_party/abseil-cpp/absl/functional:function_ref",
     "//third_party/abseil-cpp/absl/hash",
+    "//third_party/abseil-cpp/absl/hash:weakly_mixed_integer",
     "//third_party/abseil-cpp/absl/memory",
     "//third_party/abseil-cpp/absl/meta:type_traits",
     "//third_party/abseil-cpp/absl/numeric:bits",
@@ -578,6 +595,7 @@ absl_source_set("btree") {
     "//third_party/abseil-cpp/absl/base:core_headers",
     "//third_party/abseil-cpp/absl/base:raw_logging_internal",
     "//third_party/abseil-cpp/absl/base:throw_delegate",
+    "//third_party/abseil-cpp/absl/hash:weakly_mixed_integer",
     "//third_party/abseil-cpp/absl/memory",
     "//third_party/abseil-cpp/absl/meta:type_traits",
     "//third_party/abseil-cpp/absl/strings:cord",
diff --git a/deps/v8/third_party/abseil-cpp/absl/container/CMakeLists.txt b/deps/v8/third_party/abseil-cpp/absl/container/CMakeLists.txt
index 39ff083f28274d..70f78c4be6a1e0 100644
--- a/deps/v8/third_party/abseil-cpp/absl/container/CMakeLists.txt
+++ b/deps/v8/third_party/abseil-cpp/absl/container/CMakeLists.txt
@@ -41,6 +41,7 @@ absl_cc_library(
     absl::strings
     absl::throw_delegate
     absl::type_traits
+    absl::weakly_mixed_integer
 )
 
 # Internal-only target, do not depend on directly.
@@ -134,6 +135,7 @@ absl_cc_library(
     absl::iterator_traits_internal
     absl::throw_delegate
     absl::memory
+    absl::weakly_mixed_integer
   PUBLIC
 )
 
@@ -202,6 +204,7 @@ absl_cc_library(
     absl::throw_delegate
     absl::memory
     absl::type_traits
+    absl::weakly_mixed_integer
   PUBLIC
 )
 
@@ -790,6 +793,7 @@ absl_cc_library(
     absl::prefetch
     absl::raw_logging_internal
     absl::utility
+    absl::weakly_mixed_integer
   PUBLIC
 )
 
@@ -828,6 +832,32 @@ absl_cc_test(
     GTest::gmock_main
 )
 
+# Internal-only target, do not depend on directly.
+absl_cc_library(
+  NAME
+    raw_hash_set_resize_impl
+  HDRS
+    "internal/raw_hash_set_resize_impl.h"
+  COPTS
+    ${ABSL_DEFAULT_COPTS}
+  DEPS
+    absl::config
+  PUBLIC
+)
+
+absl_cc_test(
+  NAME
+    raw_hash_set_resize_impl_test
+  SRCS
+    "internal/raw_hash_set_resize_impl_test.cc"
+  COPTS
+    ${ABSL_TEST_COPTS}
+  DEPS
+    absl::config
+    absl::raw_hash_set_resize_impl
+    GTest::gmock_main
+)
+
 absl_cc_test(
   NAME
     raw_hash_set_allocator_test
diff --git a/deps/v8/third_party/abseil-cpp/absl/container/fixed_array.h b/deps/v8/third_party/abseil-cpp/absl/container/fixed_array.h
index 8bf8e6cf1afc45..6c238fc381f5d1 100644
--- a/deps/v8/third_party/abseil-cpp/absl/container/fixed_array.h
+++ b/deps/v8/third_party/abseil-cpp/absl/container/fixed_array.h
@@ -50,6 +50,7 @@
 #include "absl/base/optimization.h"
 #include "absl/base/port.h"
 #include "absl/container/internal/compressed_tuple.h"
+#include "absl/hash/internal/weakly_mixed_integer.h"
 #include "absl/memory/memory.h"
 
 namespace absl {
@@ -392,7 +393,7 @@ class ABSL_ATTRIBUTE_WARN_UNUSED FixedArray {
   template <typename H>
   friend H AbslHashValue(H h, const FixedArray& v) {
     return H::combine(H::combine_contiguous(std::move(h), v.data(), v.size()),
-                      v.size());
+                      hash_internal::WeaklyMixedInteger{v.size()});
   }
 
  private:
diff --git a/deps/v8/third_party/abseil-cpp/absl/container/flat_hash_map.h b/deps/v8/third_party/abseil-cpp/absl/container/flat_hash_map.h
index 735ee3424dfd7d..bc86ced9971efb 100644
--- a/deps/v8/third_party/abseil-cpp/absl/container/flat_hash_map.h
+++ b/deps/v8/third_party/abseil-cpp/absl/container/flat_hash_map.h
@@ -104,6 +104,11 @@ struct FlatHashMapPolicy;
 // If your types are not moveable or you require pointer stability for keys,
 // consider `absl::node_hash_map`.
 //
+// PERFORMANCE WARNING: Erasure & sparsity can negatively affect performance:
+//  * Iteration takes O(capacity) time, not O(size).
+//  * erase() slows down begin() and ++iterator.
+//  * Capacity only shrinks on rehash() or clear() -- not on erase().
+//
 // Example:
 //
 //   // Create a flat hash map of three strings (that map to strings)
diff --git a/deps/v8/third_party/abseil-cpp/absl/container/flat_hash_set.h b/deps/v8/third_party/abseil-cpp/absl/container/flat_hash_set.h
index e1fd2a32468bc3..bf63eb59867cb9 100644
--- a/deps/v8/third_party/abseil-cpp/absl/container/flat_hash_set.h
+++ b/deps/v8/third_party/abseil-cpp/absl/container/flat_hash_set.h
@@ -103,6 +103,11 @@ struct FlatHashSetPolicy;
 // `absl::flat_hash_set<std::unique_ptr<T>>`. If your type is not moveable and
 // you require pointer stability, consider `absl::node_hash_set` instead.
 //
+// PERFORMANCE WARNING: Erasure & sparsity can negatively affect performance:
+//  * Iteration takes O(capacity) time, not O(size).
+//  * erase() slows down begin() and ++iterator.
+//  * Capacity only shrinks on rehash() or clear() -- not on erase().
+//
 // Example:
 //
 //   // Create a flat hash set of three strings
diff --git a/deps/v8/third_party/abseil-cpp/absl/container/inlined_vector.h b/deps/v8/third_party/abseil-cpp/absl/container/inlined_vector.h
index 318d654dcbbeee..f871b349134f71 100644
--- a/deps/v8/third_party/abseil-cpp/absl/container/inlined_vector.h
+++ b/deps/v8/third_party/abseil-cpp/absl/container/inlined_vector.h
@@ -53,6 +53,7 @@
 #include "absl/base/optimization.h"
 #include "absl/base/port.h"
 #include "absl/container/internal/inlined_vector.h"
+#include "absl/hash/internal/weakly_mixed_integer.h"
 #include "absl/memory/memory.h"
 #include "absl/meta/type_traits.h"
 
@@ -1008,7 +1009,8 @@ bool operator>=(const absl::InlinedVector<T, N, A>& a,
 template <typename H, typename T, size_t N, typename A>
 H AbslHashValue(H h, const absl::InlinedVector<T, N, A>& a) {
   auto size = a.size();
-  return H::combine(H::combine_contiguous(std::move(h), a.data(), size), size);
+  return H::combine(H::combine_contiguous(std::move(h), a.data(), size),
+                    hash_internal::WeaklyMixedInteger{size});
 }
 
 ABSL_NAMESPACE_END
diff --git a/deps/v8/third_party/abseil-cpp/absl/container/internal/btree.h b/deps/v8/third_party/abseil-cpp/absl/container/internal/btree.h
index bed6be1a8458ac..ed541e758a66ad 100644
--- a/deps/v8/third_party/abseil-cpp/absl/container/internal/btree.h
+++ b/deps/v8/third_party/abseil-cpp/absl/container/internal/btree.h
@@ -225,7 +225,7 @@ struct key_compare_adapter {
 
    public:
     using Base::Base;
-    checked_compare(Compare comp) : Base(std::move(comp)) {}  // NOLINT
+    checked_compare(Compare cmp) : Base(std::move(cmp)) {}  // NOLINT
 
     // Allow converting to Compare for use in key_comp()/value_comp().
     explicit operator Compare() const { return comp(); }
diff --git a/deps/v8/third_party/abseil-cpp/absl/container/internal/btree_container.h b/deps/v8/third_party/abseil-cpp/absl/container/internal/btree_container.h
index 5e2abb245c682f..21f00ae414ce05 100644
--- a/deps/v8/third_party/abseil-cpp/absl/container/internal/btree_container.h
+++ b/deps/v8/third_party/abseil-cpp/absl/container/internal/btree_container.h
@@ -25,6 +25,7 @@
 #include "absl/base/internal/throw_delegate.h"
 #include "absl/container/internal/btree.h"  // IWYU pragma: export
 #include "absl/container/internal/common.h"
+#include "absl/hash/internal/weakly_mixed_integer.h"
 #include "absl/memory/memory.h"
 #include "absl/meta/type_traits.h"
 
@@ -267,7 +268,8 @@ class btree_container {
     for (const auto &v : b) {
       h = State::combine(std::move(h), v);
     }
-    return State::combine(std::move(h), b.size());
+    return State::combine(std::move(h),
+                          hash_internal::WeaklyMixedInteger{b.size()});
   }
 
  protected:
diff --git a/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set.cc b/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set.cc
index 262376337c8dec..adba8b1715332c 100644
--- a/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set.cc
@@ -29,6 +29,7 @@
 #include "absl/container/internal/container_memory.h"
 #include "absl/container/internal/hashtable_control_bytes.h"
 #include "absl/container/internal/hashtablez_sampler.h"
+#include "absl/container/internal/raw_hash_set_resize_impl.h"
 #include "absl/functional/function_ref.h"
 #include "absl/hash/hash.h"
 #include "absl/numeric/bits.h"
@@ -69,6 +70,15 @@ static_assert(NumControlBytes(SooCapacity()) <= 17,
 
 namespace {
 
+#ifdef ABSL_SWISSTABLE_ASSERT
+#error ABSL_SWISSTABLE_ASSERT cannot be directly set
+#else
+// We use this macro for assertions that users may see when the table is in an
+// invalid state that sanitizers may help diagnose.
+#define ABSL_SWISSTABLE_ASSERT(CONDITION) \
+  assert((CONDITION) && "Try enabling sanitizers.")
+#endif
+
 [[noreturn]] ABSL_ATTRIBUTE_NOINLINE void HashTableSizeOverflow() {
   ABSL_RAW_LOG(FATAL, "Hash table size overflow");
 }
@@ -104,9 +114,9 @@ bool ShouldRehashForBugDetection(PerTableSeed seed, size_t capacity) {
 // Find a non-deterministic hash for single group table.
 // Last two bits are used to find a position for a newly inserted element after
 // resize.
-// This function is mixing all bits of hash and seed to maximize entropy.
+// This function basically using H2 last bits to save on shift operation.
 size_t SingleGroupTableH1(size_t hash, PerTableSeed seed) {
-  return static_cast<size_t>(absl::popcount(hash ^ seed.seed()));
+  return hash ^ seed.seed();
 }
 
 // Returns the address of the slot `i` iterations after `slot` assuming each
@@ -147,11 +157,44 @@ bool CommonFieldsGenerationInfoEnabled::should_rehash_for_bug_detection_on_move(
   return ShouldRehashForBugDetection(seed, capacity);
 }
 
-bool ShouldInsertBackwardsForDebug(size_t capacity, size_t hash,
-                                   PerTableSeed seed) {
-  // To avoid problems with weak hashes and single bit tests, we use % 13.
-  // TODO(kfm,sbenza): revisit after we do unconditional mixing
-  return !is_small(capacity) && (H1(hash, seed) ^ RandomSeed()) % 13 > 6;
+namespace {
+
+FindInfo find_first_non_full_from_h1(const ctrl_t* ctrl, size_t h1,
+                                     size_t capacity) {
+  auto seq = probe(h1, capacity);
+  if (IsEmptyOrDeleted(ctrl[seq.offset()])) {
+    return {seq.offset(), /*probe_length=*/0};
+  }
+  while (true) {
+    GroupFullEmptyOrDeleted g{ctrl + seq.offset()};
+    auto mask = g.MaskEmptyOrDeleted();
+    if (mask) {
+      return {seq.offset(mask.LowestBitSet()), seq.index()};
+    }
+    seq.next();
+    ABSL_SWISSTABLE_ASSERT(seq.index() <= capacity && "full table!");
+  }
+}
+
+// Whether a table is "small". A small table fits entirely into a probing
+// group, i.e., has a capacity < `Group::kWidth`.
+//
+// In small mode we are able to use the whole capacity. The extra control
+// bytes give us at least one "empty" control byte to stop the iteration.
+// This is important to make 1 a valid capacity.
+//
+// In small mode only the first `capacity` control bytes after the sentinel
+// are valid. The rest contain dummy ctrl_t::kEmpty values that do not
+// represent a real slot.
+constexpr bool is_small(size_t capacity) {
+  return capacity < Group::kWidth - 1;
+}
+
+}  // namespace
+
+FindInfo find_first_non_full(const CommonFields& common, size_t hash) {
+  return find_first_non_full_from_h1(common.control(), H1(hash, common.seed()),
+                                     common.capacity());
 }
 
 void IterateOverFullSlots(const CommonFields& c, size_t slot_size,
@@ -167,8 +210,8 @@ void IterateOverFullSlots(const CommonFields& c, size_t slot_size,
     // Small tables capacity fits into portable group, where
     // GroupPortableImpl::MaskFull is more efficient for the
     // capacity <= GroupPortableImpl::kWidth.
-    assert(cap <= GroupPortableImpl::kWidth &&
-           "unexpectedly large small capacity");
+    ABSL_SWISSTABLE_ASSERT(cap <= GroupPortableImpl::kWidth &&
+                           "unexpectedly large small capacity");
     static_assert(Group::kWidth >= GroupPortableImpl::kWidth,
                   "unexpected group width");
     // Group starts from kSentinel slot, so indices in the mask will
@@ -185,38 +228,26 @@ void IterateOverFullSlots(const CommonFields& c, size_t slot_size,
   ABSL_ATTRIBUTE_UNUSED const size_t original_size_for_assert = remaining;
   while (remaining != 0) {
     for (uint32_t i : GroupFullEmptyOrDeleted(ctrl).MaskFull()) {
-      assert(IsFull(ctrl[i]) && "hash table was modified unexpectedly");
+      ABSL_SWISSTABLE_ASSERT(IsFull(ctrl[i]) &&
+                             "hash table was modified unexpectedly");
       cb(ctrl + i, SlotAddress(slot, i, slot_size));
       --remaining;
     }
     ctrl += Group::kWidth;
     slot = NextSlot(slot, slot_size, Group::kWidth);
-    assert((remaining == 0 || *(ctrl - 1) != ctrl_t::kSentinel) &&
-           "hash table was modified unexpectedly");
+    ABSL_SWISSTABLE_ASSERT(
+        (remaining == 0 || *(ctrl - 1) != ctrl_t::kSentinel) &&
+        "hash table was modified unexpectedly");
   }
   // NOTE: erasure of the current element is allowed in callback for
   // absl::erase_if specialization. So we use `>=`.
-  assert(original_size_for_assert >= c.size() &&
-         "hash table was modified unexpectedly");
-}
-
-size_t PrepareInsertAfterSoo(size_t hash, size_t slot_size,
-                             CommonFields& common) {
-  assert(common.capacity() == NextCapacity(SooCapacity()));
-  // After resize from capacity 1 to 3, we always have exactly the slot with
-  // index 1 occupied, so we need to insert either at index 0 or index 2.
-  static_assert(SooSlotIndex() == 1, "");
-  PrepareInsertCommon(common);
-  const size_t offset = SingleGroupTableH1(hash, common.seed()) & 2;
-  common.growth_info().OverwriteEmptyAsFull();
-  SetCtrlInSingleGroupTable(common, offset, H2(hash), slot_size);
-  common.infoz().RecordInsert(hash, /*distance_from_desired=*/0);
-  return offset;
+  ABSL_SWISSTABLE_ASSERT(original_size_for_assert >= c.size() &&
+                         "hash table was modified unexpectedly");
 }
 
 void ConvertDeletedToEmptyAndFullToDeleted(ctrl_t* ctrl, size_t capacity) {
-  assert(ctrl[capacity] == ctrl_t::kSentinel);
-  assert(IsValidCapacity(capacity));
+  ABSL_SWISSTABLE_ASSERT(ctrl[capacity] == ctrl_t::kSentinel);
+  ABSL_SWISSTABLE_ASSERT(IsValidCapacity(capacity));
   for (ctrl_t* pos = ctrl; pos < ctrl + capacity; pos += Group::kWidth) {
     Group{pos}.ConvertSpecialToEmptyAndFullToDeleted(pos);
   }
@@ -224,19 +255,15 @@ void ConvertDeletedToEmptyAndFullToDeleted(ctrl_t* ctrl, size_t capacity) {
   std::memcpy(ctrl + capacity + 1, ctrl, NumClonedBytes());
   ctrl[capacity] = ctrl_t::kSentinel;
 }
-// Extern template instantiation for inline function.
-template FindInfo find_first_non_full(const CommonFields&, size_t);
-
-FindInfo find_first_non_full_outofline(const CommonFields& common,
-                                       size_t hash) {
-  return find_first_non_full(common, hash);
-}
 
 namespace {
 
+void ResetGrowthLeft(GrowthInfo& growth_info, size_t capacity, size_t size) {
+  growth_info.InitGrowthLeftNoDeleted(CapacityToGrowth(capacity) - size);
+}
+
 void ResetGrowthLeft(CommonFields& common) {
-  common.growth_info().InitGrowthLeftNoDeleted(
-      CapacityToGrowth(common.capacity()) - common.size());
+  ResetGrowthLeft(common.growth_info(), common.capacity(), common.size());
 }
 
 // Finds guaranteed to exists empty slot from the given position.
@@ -270,8 +297,8 @@ size_t DropDeletesWithoutResizeAndPrepareInsert(CommonFields& common,
   void* set = &common;
   void* slot_array = common.slot_array();
   const size_t capacity = common.capacity();
-  assert(IsValidCapacity(capacity));
-  assert(!is_small(capacity));
+  ABSL_SWISSTABLE_ASSERT(IsValidCapacity(capacity));
+  ABSL_SWISSTABLE_ASSERT(!is_single_group(capacity));
   // Algorithm:
   // - mark all DELETED slots as EMPTY
   // - mark all FULL slots as DELETED
@@ -292,7 +319,7 @@ size_t DropDeletesWithoutResizeAndPrepareInsert(CommonFields& common,
   ConvertDeletedToEmptyAndFullToDeleted(ctrl, capacity);
   const void* hash_fn = policy.hash_fn(common);
   auto hasher = policy.hash_slot;
-  auto transfer = policy.transfer;
+  auto transfer_n = policy.transfer_n;
   const size_t slot_size = policy.slot_size;
 
   size_t total_probe_length = 0;
@@ -305,7 +332,7 @@ size_t DropDeletesWithoutResizeAndPrepareInsert(CommonFields& common,
 
   for (size_t i = 0; i != capacity;
        ++i, slot_ptr = NextSlot(slot_ptr, slot_size)) {
-    assert(slot_ptr == SlotAddress(slot_array, i, slot_size));
+    ABSL_SWISSTABLE_ASSERT(slot_ptr == SlotAddress(slot_array, i, slot_size));
     if (IsEmpty(ctrl[i])) {
       tmp_space_id = i;
       continue;
@@ -337,12 +364,12 @@ size_t DropDeletesWithoutResizeAndPrepareInsert(CommonFields& common,
       // SetCtrl poisons/unpoisons the slots so we have to call it at the
       // right time.
       SetCtrlInLargeTable(common, new_i, h2, slot_size);
-      (*transfer)(set, new_slot_ptr, slot_ptr, 1);
+      (*transfer_n)(set, new_slot_ptr, slot_ptr, 1);
       SetCtrlInLargeTable(common, i, ctrl_t::kEmpty, slot_size);
       // Initialize or change empty space id.
       tmp_space_id = i;
     } else {
-      assert(IsDeleted(ctrl[new_i]));
+      ABSL_SWISSTABLE_ASSERT(IsDeleted(ctrl[new_i]));
       SetCtrlInLargeTable(common, new_i, h2, slot_size);
       // Until we are done rehashing, DELETED marks previously FULL slots.
 
@@ -353,9 +380,9 @@ size_t DropDeletesWithoutResizeAndPrepareInsert(CommonFields& common,
       SanitizerUnpoisonMemoryRegion(tmp_space, slot_size);
 
       // Swap i and new_i elements.
-      (*transfer)(set, tmp_space, new_slot_ptr, 1);
-      (*transfer)(set, new_slot_ptr, slot_ptr, 1);
-      (*transfer)(set, slot_ptr, tmp_space, 1);
+      (*transfer_n)(set, tmp_space, new_slot_ptr, 1);
+      (*transfer_n)(set, new_slot_ptr, slot_ptr, 1);
+      (*transfer_n)(set, slot_ptr, tmp_space, 1);
 
       SanitizerPoisonMemoryRegion(tmp_space, slot_size);
 
@@ -391,6 +418,28 @@ static bool WasNeverFull(CommonFields& c, size_t index) {
              Group::kWidth;
 }
 
+// Updates the control bytes to indicate a completely empty table such that all
+// control bytes are kEmpty except for the kSentinel byte.
+void ResetCtrl(CommonFields& common, size_t slot_size) {
+  const size_t capacity = common.capacity();
+  ctrl_t* ctrl = common.control();
+  static constexpr size_t kTwoGroupCapacity = 2 * Group::kWidth - 1;
+  if (ABSL_PREDICT_TRUE(capacity <= kTwoGroupCapacity)) {
+    std::memset(ctrl, static_cast<int8_t>(ctrl_t::kEmpty), Group::kWidth);
+    std::memset(ctrl + capacity, static_cast<int8_t>(ctrl_t::kEmpty),
+                Group::kWidth);
+    if (capacity == kTwoGroupCapacity) {
+      std::memset(ctrl + Group::kWidth, static_cast<int8_t>(ctrl_t::kEmpty),
+                  Group::kWidth);
+    }
+  } else {
+    std::memset(ctrl, static_cast<int8_t>(ctrl_t::kEmpty),
+                capacity + 1 + NumClonedBytes());
+  }
+  ctrl[capacity] = ctrl_t::kSentinel;
+  SanitizerPoisonMemoryRegion(common.slot_array(), slot_size * capacity);
+}
+
 // Initializes control bytes for single element table.
 // Capacity of the table must be 1.
 ABSL_ATTRIBUTE_ALWAYS_INLINE inline void InitializeSingleElementControlBytes(
@@ -415,14 +464,19 @@ ABSL_ATTRIBUTE_ALWAYS_INLINE inline void InitializeSingleElementControlBytes(
   absl::little_endian::Store64(new_ctrl, first_ctrl_bytes);
 }
 
-// Initializes control bytes after SOO to the next capacity.
+// Initializes control bytes for growing after SOO to the next capacity.
+// `soo_ctrl` is placed in the position `SooSlotIndex()`.
+// `new_hash` is placed in the position `new_offset`.
 // The table must be non-empty SOO.
 ABSL_ATTRIBUTE_ALWAYS_INLINE inline void
-InitializeThreeElementsControlBytesAfterSoo(size_t hash, ctrl_t* new_ctrl) {
+InitializeThreeElementsControlBytesAfterSoo(ctrl_t soo_ctrl, size_t new_hash,
+                                            size_t new_offset,
+                                            ctrl_t* new_ctrl) {
   static constexpr size_t kNewCapacity = NextCapacity(SooCapacity());
   static_assert(kNewCapacity == 3);
   static_assert(is_single_group(kNewCapacity));
   static_assert(SooSlotIndex() == 1);
+  ABSL_SWISSTABLE_ASSERT(new_offset == 0 || new_offset == 2);
 
   static constexpr uint64_t kEmptyXorSentinel =
       static_cast<uint8_t>(ctrl_t::kEmpty) ^
@@ -430,20 +484,33 @@ InitializeThreeElementsControlBytesAfterSoo(size_t hash, ctrl_t* new_ctrl) {
   static constexpr uint64_t kEmpty64 = static_cast<uint8_t>(ctrl_t::kEmpty);
   static constexpr size_t kMirroredSooSlotIndex =
       SooSlotIndex() + kNewCapacity + 1;
-  // The first 8 bytes, where present slot positions are replaced with 0.
+  // The first 8 bytes, where SOO slot original and mirrored positions are
+  // replaced with 0.
+  // Result will look like: E0ESE0EE
   static constexpr uint64_t kFirstCtrlBytesWithZeroes =
       k8EmptyBytes ^ (kEmpty64 << (8 * SooSlotIndex())) ^
       (kEmptyXorSentinel << (8 * kNewCapacity)) ^
       (kEmpty64 << (8 * kMirroredSooSlotIndex));
 
-  const uint64_t h2 = static_cast<uint64_t>(H2(hash));
-  // Fill the original 0th and mirrored 2nd bytes with the hash.
+  const uint64_t soo_h2 = static_cast<uint64_t>(soo_ctrl);
+  const uint64_t new_h2_xor_empty = static_cast<uint64_t>(
+      H2(new_hash) ^ static_cast<uint8_t>(ctrl_t::kEmpty));
+  // Fill the original and mirrored bytes for SOO slot.
   // Result will look like:
   // EHESEHEE
-  // Where H = h2, E = kEmpty, S = kSentinel.
-  const uint64_t first_ctrl_bytes =
-      ((h2 << (8 * SooSlotIndex())) | kFirstCtrlBytesWithZeroes) |
-      (h2 << (8 * kMirroredSooSlotIndex));
+  // Where H = soo_h2, E = kEmpty, S = kSentinel.
+  uint64_t first_ctrl_bytes =
+      ((soo_h2 << (8 * SooSlotIndex())) | kFirstCtrlBytesWithZeroes) |
+      (soo_h2 << (8 * kMirroredSooSlotIndex));
+  // Replace original and mirrored empty bytes for the new position.
+  // Result for new_offset 0 will look like:
+  // NHESNHEE
+  // Where H = soo_h2, N = H2(new_hash), E = kEmpty, S = kSentinel.
+  // Result for new_offset 2 will look like:
+  // EHNSEHNE
+  first_ctrl_bytes ^= (new_h2_xor_empty << (8 * new_offset));
+  size_t new_mirrored_offset = new_offset + kNewCapacity + 1;
+  first_ctrl_bytes ^= (new_h2_xor_empty << (8 * new_mirrored_offset));
 
   // Fill last bytes with kEmpty.
   std::memset(new_ctrl + kNewCapacity, static_cast<int8_t>(ctrl_t::kEmpty),
@@ -453,17 +520,24 @@ InitializeThreeElementsControlBytesAfterSoo(size_t hash, ctrl_t* new_ctrl) {
 
   // Example for group size 16:
   // new_ctrl after 1st memset =      ???EEEEEEEEEEEEEEEE
-  // new_ctrl after 2nd store  =      EHESEHEEEEEEEEEEEEE
+  // new_offset 0:
+  // new_ctrl after 2nd store  =      NHESNHEEEEEEEEEEEEE
+  // new_offset 2:
+  // new_ctrl after 2nd store  =      EHNSEHNEEEEEEEEEEEE
 
   // Example for group size 8:
   // new_ctrl after 1st memset =      ???EEEEEEEE
-  // new_ctrl after 2nd store  =      EHESEHEEEEE
+  // new_offset 0:
+  // new_ctrl after 2nd store  =      NHESNHEEEEE
+  // new_offset 2:
+  // new_ctrl after 2nd store  =      EHNSEHNEEEE
 }
 
 }  // namespace
 
 void EraseMetaOnly(CommonFields& c, size_t index, size_t slot_size) {
-  assert(IsFull(c.control()[index]) && "erasing a dangling iterator");
+  ABSL_SWISSTABLE_ASSERT(IsFull(c.control()[index]) &&
+                         "erasing a dangling iterator");
   c.decrement_size();
   c.infoz().RecordErase();
 
@@ -481,7 +555,7 @@ void ClearBackingArray(CommonFields& c, const PolicyFunctions& policy,
                        void* alloc, bool reuse, bool soo_enabled) {
   if (reuse) {
     c.set_size_to_zero();
-    assert(!soo_enabled || c.capacity() > SooCapacity());
+    ABSL_SWISSTABLE_ASSERT(!soo_enabled || c.capacity() > SooCapacity());
     ResetCtrl(c, policy.slot_size);
     ResetGrowthLeft(c);
     c.infoz().RecordStorageChanged(0, c.capacity());
@@ -499,27 +573,47 @@ void ClearBackingArray(CommonFields& c, const PolicyFunctions& policy,
 
 namespace {
 
-// Poisons empty slots. It is useful when slots are transferred via memcpy.
-// PRECONDITIONs: common.control() is fully initialized.
-void PoisonEmptySlots(CommonFields& c, size_t slot_size) {
-  for (size_t i = 0; i < c.capacity(); ++i) {
-    if (!IsFull(c.control()[i])) {
-      SanitizerPoisonMemoryRegion(SlotAddress(c.slot_array(), i, slot_size),
-                                  slot_size);
-    }
-  }
-}
-
 enum class ResizeNonSooMode {
   kGuaranteedEmpty,
   kGuaranteedAllocated,
 };
 
+// Iterates over full slots in old table, finds new positions for them and
+// transfers the slots.
+// This function is used for reserving or rehashing non-empty tables.
+// This use case is rare so the function is type erased.
+// Returns the total probe length.
+size_t FindNewPositionsAndTransferSlots(CommonFields& common,
+                                        const PolicyFunctions& policy,
+                                        ctrl_t* old_ctrl, void* old_slots,
+                                        size_t old_capacity) {
+  void* new_slots = common.slot_array();
+  const void* hash_fn = policy.hash_fn(common);
+  const size_t slot_size = policy.slot_size;
+
+  const auto insert_slot = [&](void* slot) {
+    size_t hash = policy.hash_slot(hash_fn, slot);
+    auto target = find_first_non_full(common, hash);
+    SetCtrl(common, target.offset, H2(hash), slot_size);
+    policy.transfer_n(&common, SlotAddress(new_slots, target.offset, slot_size),
+                      slot, 1);
+    return target.probe_length;
+  };
+  size_t total_probe_length = 0;
+  for (size_t i = 0; i < old_capacity; ++i) {
+    if (IsFull(old_ctrl[i])) {
+      total_probe_length += insert_slot(old_slots);
+    }
+    old_slots = NextSlot(old_slots, slot_size);
+  }
+  return total_probe_length;
+}
+
 template <ResizeNonSooMode kMode>
 void ResizeNonSooImpl(CommonFields& common, const PolicyFunctions& policy,
                       size_t new_capacity, HashtablezInfoHandle infoz) {
-  assert(IsValidCapacity(new_capacity));
-  assert(new_capacity > policy.soo_capacity);
+  ABSL_SWISSTABLE_ASSERT(IsValidCapacity(new_capacity));
+  ABSL_SWISSTABLE_ASSERT(new_capacity > policy.soo_capacity);
 
   const size_t old_capacity = common.capacity();
   [[maybe_unused]] ctrl_t* old_ctrl = common.control();
@@ -538,23 +632,28 @@ void ResizeNonSooImpl(CommonFields& common, const PolicyFunctions& policy,
       reinterpret_cast<GenerationType*>(mem + layout.generation_offset()));
   common.set_generation(NextGeneration(old_generation));
 
-  common.set_control</*kGenerateSeed=*/true>(
-      reinterpret_cast<ctrl_t*>(mem + layout.control_offset()));
+  ctrl_t* new_ctrl = reinterpret_cast<ctrl_t*>(mem + layout.control_offset());
+  common.set_control</*kGenerateSeed=*/true>(new_ctrl);
   common.set_slots(mem + layout.slot_offset());
 
   size_t total_probe_length = 0;
   ResetCtrl(common, slot_size);
-  assert(kMode != ResizeNonSooMode::kGuaranteedEmpty ||
-         old_capacity == policy.soo_capacity);
-  assert(kMode != ResizeNonSooMode::kGuaranteedAllocated || old_capacity > 0);
+  ABSL_SWISSTABLE_ASSERT(kMode != ResizeNonSooMode::kGuaranteedEmpty ||
+                         old_capacity == policy.soo_capacity);
+  ABSL_SWISSTABLE_ASSERT(kMode != ResizeNonSooMode::kGuaranteedAllocated ||
+                         old_capacity > 0);
   if constexpr (kMode == ResizeNonSooMode::kGuaranteedAllocated) {
-    total_probe_length = policy.find_new_positions_and_transfer_slots(
-        common, old_ctrl, old_slots, old_capacity);
+    total_probe_length = FindNewPositionsAndTransferSlots(
+        common, policy, old_ctrl, old_slots, old_capacity);
     (*policy.dealloc)(alloc, old_capacity, old_ctrl, slot_size, slot_align,
                       has_infoz);
+    ResetGrowthLeft(GetGrowthInfoFromControl(new_ctrl), new_capacity,
+                    common.size());
+  } else {
+    GetGrowthInfoFromControl(new_ctrl).InitGrowthLeftNoDeleted(
+        CapacityToGrowth(new_capacity));
   }
 
-  ResetGrowthLeft(common);
   if (has_infoz) {
     common.set_has_infoz();
     infoz.RecordStorageChanged(common.size(), new_capacity);
@@ -566,11 +665,11 @@ void ResizeNonSooImpl(CommonFields& common, const PolicyFunctions& policy,
 void ResizeEmptyNonAllocatedTableImpl(CommonFields& common,
                                       const PolicyFunctions& policy,
                                       size_t new_capacity, bool force_infoz) {
-  assert(IsValidCapacity(new_capacity));
-  assert(new_capacity > policy.soo_capacity);
-  assert(!force_infoz || policy.soo_capacity > 0);
-  assert(common.capacity() <= policy.soo_capacity);
-  assert(common.empty());
+  ABSL_SWISSTABLE_ASSERT(IsValidCapacity(new_capacity));
+  ABSL_SWISSTABLE_ASSERT(new_capacity > policy.soo_capacity);
+  ABSL_SWISSTABLE_ASSERT(!force_infoz || policy.soo_capacity > 0);
+  ABSL_SWISSTABLE_ASSERT(common.capacity() <= policy.soo_capacity);
+  ABSL_SWISSTABLE_ASSERT(common.empty());
   const size_t slot_size = policy.slot_size;
   HashtablezInfoHandle infoz;
   const bool should_sample =
@@ -591,8 +690,8 @@ void InsertOldSooSlotAndInitializeControlBytes(CommonFields& c,
                                                const PolicyFunctions& policy,
                                                size_t hash, ctrl_t* new_ctrl,
                                                void* new_slots) {
-  assert(c.size() == policy.soo_capacity);
-  assert(policy.soo_capacity == SooCapacity());
+  ABSL_SWISSTABLE_ASSERT(c.size() == policy.soo_capacity);
+  ABSL_SWISSTABLE_ASSERT(policy.soo_capacity == SooCapacity());
   size_t new_capacity = c.capacity();
 
   c.generate_new_seed();
@@ -601,7 +700,7 @@ void InsertOldSooSlotAndInitializeControlBytes(CommonFields& c,
   SanitizerPoisonMemoryRegion(new_slots, policy.slot_size * new_capacity);
   void* target_slot = SlotAddress(new_slots, offset, policy.slot_size);
   SanitizerUnpoisonMemoryRegion(target_slot, policy.slot_size);
-  policy.transfer(&c, target_slot, c.soo_data(), 1);
+  policy.transfer_n(&c, target_slot, c.soo_data(), 1);
   c.set_control</*kGenerateSeed=*/false>(new_ctrl);
   c.set_slots(new_slots);
   ResetCtrl(c, policy.slot_size);
@@ -617,9 +716,9 @@ enum class ResizeFullSooTableSamplingMode {
 void ResizeFullSooTable(CommonFields& common, const PolicyFunctions& policy,
                         size_t new_capacity,
                         ResizeFullSooTableSamplingMode sampling_mode) {
-  assert(common.capacity() == policy.soo_capacity);
-  assert(common.size() == policy.soo_capacity);
-  assert(policy.soo_capacity == SooCapacity());
+  ABSL_SWISSTABLE_ASSERT(common.capacity() == policy.soo_capacity);
+  ABSL_SWISSTABLE_ASSERT(common.size() == policy.soo_capacity);
+  ABSL_SWISSTABLE_ASSERT(policy.soo_capacity == SooCapacity());
   const size_t slot_size = policy.slot_size;
   const size_t slot_align = policy.slot_align;
 
@@ -669,7 +768,7 @@ void GrowIntoSingleGroupShuffleControlBytes(ctrl_t* __restrict old_ctrl,
                                             size_t old_capacity,
                                             ctrl_t* __restrict new_ctrl,
                                             size_t new_capacity) {
-  assert(is_single_group(new_capacity));
+  ABSL_SWISSTABLE_ASSERT(is_single_group(new_capacity));
   constexpr size_t kHalfWidth = Group::kWidth / 2;
   ABSL_ASSUME(old_capacity < kHalfWidth);
   ABSL_ASSUME(old_capacity > 0);
@@ -707,7 +806,8 @@ void GrowIntoSingleGroupShuffleControlBytes(ctrl_t* __restrict old_ctrl,
 
   if (Group::kWidth == 8) {
     // With group size 8, we can grow with two write operations.
-    assert(old_capacity < 8 && "old_capacity is too large for group size 8");
+    ABSL_SWISSTABLE_ASSERT(old_capacity < 8 &&
+                           "old_capacity is too large for group size 8");
     absl::little_endian::Store64(new_ctrl, copied_bytes);
 
     static constexpr uint64_t kSentinal64 =
@@ -733,7 +833,7 @@ void GrowIntoSingleGroupShuffleControlBytes(ctrl_t* __restrict old_ctrl,
     return;
   }
 
-  assert(Group::kWidth == 16);
+  ABSL_SWISSTABLE_ASSERT(Group::kWidth == 16);
 
   // Fill the second half of the main control bytes with kEmpty.
   // For small capacity that may write into mirrored control bytes.
@@ -789,16 +889,335 @@ void GrowIntoSingleGroupShuffleControlBytes(ctrl_t* __restrict old_ctrl,
   // new_ctrl after 2nd store =  E0123456EEEEEEESE0123456EEEEEEE
 }
 
+// Size of the buffer we allocate on stack for storing probed elements in
+// GrowToNextCapacity algorithm.
+constexpr size_t kProbedElementsBufferSize = 512;
+
+// Decodes information about probed elements from contiguous memory.
+// Finds new position for each element and transfers it to the new slots.
+// Returns the total probe length.
+template <typename ProbedItem>
+ABSL_ATTRIBUTE_NOINLINE size_t DecodeAndInsertImpl(
+    CommonFields& c, const PolicyFunctions& policy, const ProbedItem* start,
+    const ProbedItem* end, void* old_slots) {
+  const size_t new_capacity = c.capacity();
+
+  void* new_slots = c.slot_array();
+  ctrl_t* new_ctrl = c.control();
+  size_t total_probe_length = 0;
+
+  const size_t slot_size = policy.slot_size;
+  auto transfer_n = policy.transfer_n;
+
+  for (; start < end; ++start) {
+    const FindInfo target = find_first_non_full_from_h1(
+        new_ctrl, static_cast<size_t>(start->h1), new_capacity);
+    total_probe_length += target.probe_length;
+    const size_t old_index = static_cast<size_t>(start->source_offset);
+    const size_t new_i = target.offset;
+    ABSL_SWISSTABLE_ASSERT(old_index < new_capacity / 2);
+    ABSL_SWISSTABLE_ASSERT(new_i < new_capacity);
+    ABSL_SWISSTABLE_ASSERT(IsEmpty(new_ctrl[new_i]));
+    void* src_slot = SlotAddress(old_slots, old_index, slot_size);
+    void* dst_slot = SlotAddress(new_slots, new_i, slot_size);
+    SanitizerUnpoisonMemoryRegion(dst_slot, slot_size);
+    transfer_n(&c, dst_slot, src_slot, 1);
+    SetCtrlInLargeTable(c, new_i, static_cast<h2_t>(start->h2), slot_size);
+  }
+  return total_probe_length;
+}
+
+// Sentinel value for the start of marked elements.
+// Signals that there are no marked elements.
+constexpr size_t kNoMarkedElementsSentinel = ~size_t{};
+
+// Process probed elements that did not fit into available buffers.
+// We marked them in control bytes as kSentinel.
+// Hash recomputation and full probing is done here.
+// This use case should be extremely rare.
+ABSL_ATTRIBUTE_NOINLINE size_t
+ProcessProbedMarkedElements(CommonFields& c, const PolicyFunctions& policy,
+                            ctrl_t* old_ctrl, void* old_slots, size_t start) {
+  size_t old_capacity = PreviousCapacity(c.capacity());
+  const size_t slot_size = policy.slot_size;
+  void* new_slots = c.slot_array();
+  size_t total_probe_length = 0;
+  const void* hash_fn = policy.hash_fn(c);
+  auto hash_slot = policy.hash_slot;
+  auto transfer_n = policy.transfer_n;
+  for (size_t old_index = start; old_index < old_capacity; ++old_index) {
+    if (old_ctrl[old_index] != ctrl_t::kSentinel) {
+      continue;
+    }
+    void* src_slot = SlotAddress(old_slots, old_index, slot_size);
+    const size_t hash = hash_slot(hash_fn, src_slot);
+    const FindInfo target = find_first_non_full(c, hash);
+    total_probe_length += target.probe_length;
+    const size_t new_i = target.offset;
+    void* dst_slot = SlotAddress(new_slots, new_i, slot_size);
+    SetCtrlInLargeTable(c, new_i, H2(hash), slot_size);
+    transfer_n(&c, dst_slot, src_slot, 1);
+  }
+  return total_probe_length;
+}
+
+// The largest old capacity for which it is guaranteed that all probed elements
+// fit in ProbedItemEncoder's local buffer.
+// For such tables, `encode_probed_element` is trivial.
+constexpr size_t kMaxLocalBufferOldCapacity =
+    kProbedElementsBufferSize / sizeof(ProbedItem4Bytes) - 1;
+static_assert(IsValidCapacity(kMaxLocalBufferOldCapacity));
+constexpr size_t kMaxLocalBufferNewCapacity =
+    NextCapacity(kMaxLocalBufferOldCapacity);
+static_assert(kMaxLocalBufferNewCapacity <= ProbedItem4Bytes::kMaxNewCapacity);
+static_assert(NextCapacity(kMaxLocalBufferNewCapacity) <=
+              ProbedItem4Bytes::kMaxNewCapacity);
+
+// Initializes mirrored control bytes after
+// transfer_unprobed_elements_to_next_capacity.
+void InitializeMirroredControlBytes(ctrl_t* new_ctrl, size_t new_capacity) {
+  std::memcpy(new_ctrl + new_capacity,
+              // We own GrowthInfo just before control bytes. So it is ok
+              // to read one byte from it.
+              new_ctrl - 1, Group::kWidth);
+  new_ctrl[new_capacity] = ctrl_t::kSentinel;
+}
+
+// Encodes probed elements into available memory.
+// At first, a local (on stack) buffer is used. The size of the buffer is
+// kProbedElementsBufferSize bytes.
+// When the local buffer is full, we switch to `control_` buffer. We are allowed
+// to overwrite `control_` buffer till the `source_offset` byte. In case we have
+// no space in `control_` buffer, we fallback to a naive algorithm for all the
+// rest of the probed elements. We mark elements as kSentinel in control bytes
+// and later process them fully. See ProcessMarkedElements for details. It
+// should be extremely rare.
+template <typename ProbedItemType,
+          // If true, we only use the local buffer and never switch to the
+          // control buffer.
+          bool kGuaranteedFitToBuffer = false>
+class ProbedItemEncoder {
+ public:
+  using ProbedItem = ProbedItemType;
+  explicit ProbedItemEncoder(ctrl_t* control) : control_(control) {}
+
+  // Encode item into the best available location.
+  void EncodeItem(ProbedItem item) {
+    if (ABSL_PREDICT_FALSE(!kGuaranteedFitToBuffer && pos_ >= end_)) {
+      return ProcessEncodeWithOverflow(item);
+    }
+    ABSL_SWISSTABLE_ASSERT(pos_ < end_);
+    *pos_ = item;
+    ++pos_;
+  }
+
+  // Decodes information about probed elements from all available sources.
+  // Finds new position for each element and transfers it to the new slots.
+  // Returns the total probe length.
+  size_t DecodeAndInsertToTable(CommonFields& common,
+                                const PolicyFunctions& policy,
+                                void* old_slots) const {
+    if (pos_ == buffer_) {
+      return 0;
+    }
+    if constexpr (kGuaranteedFitToBuffer) {
+      return DecodeAndInsertImpl(common, policy, buffer_, pos_, old_slots);
+    }
+    size_t total_probe_length = DecodeAndInsertImpl(
+        common, policy, buffer_,
+        local_buffer_full_ ? buffer_ + kBufferSize : pos_, old_slots);
+    if (!local_buffer_full_) {
+      return total_probe_length;
+    }
+    total_probe_length +=
+        DecodeAndInsertToTableOverflow(common, policy, old_slots);
+    return total_probe_length;
+  }
+
+ private:
+  static ProbedItem* AlignToNextItem(void* ptr) {
+    return reinterpret_cast<ProbedItem*>(AlignUpTo(
+        reinterpret_cast<uintptr_t>(ptr), alignof(ProbedItem)));
+  }
+
+  ProbedItem* OverflowBufferStart() const {
+    // We reuse GrowthInfo memory as well.
+    return AlignToNextItem(control_ - ControlOffset(/*has_infoz=*/false));
+  }
+
+  // Encodes item when previously allocated buffer is full.
+  // At first that happens when local buffer is full.
+  // We switch from the local buffer to the control buffer.
+  // Every time this function is called, the available buffer is extended till
+  // `item.source_offset` byte in the control buffer.
+  // After the buffer is extended, this function wouldn't be called till the
+  // buffer is exhausted.
+  //
+  // If there's no space in the control buffer, we fallback to naive algorithm
+  // and mark probed elements as kSentinel in the control buffer. In this case,
+  // we will call this function for every subsequent probed element.
+  ABSL_ATTRIBUTE_NOINLINE void ProcessEncodeWithOverflow(ProbedItem item) {
+    if (!local_buffer_full_) {
+      local_buffer_full_ = true;
+      pos_ = OverflowBufferStart();
+    }
+    const size_t source_offset = static_cast<size_t>(item.source_offset);
+    // We are in fallback mode so we can't reuse control buffer anymore.
+    // Probed elements are marked as kSentinel in the control buffer.
+    if (ABSL_PREDICT_FALSE(marked_elements_starting_position_ !=
+                           kNoMarkedElementsSentinel)) {
+      control_[source_offset] = ctrl_t::kSentinel;
+      return;
+    }
+    // Refresh the end pointer to the new available position.
+    // Invariant: if pos < end, then we have at least sizeof(ProbedItem) bytes
+    // to write.
+    end_ = control_ + source_offset + 1 - sizeof(ProbedItem);
+    if (ABSL_PREDICT_TRUE(pos_ < end_)) {
+      *pos_ = item;
+      ++pos_;
+      return;
+    }
+    control_[source_offset] = ctrl_t::kSentinel;
+    marked_elements_starting_position_ = source_offset;
+    // Now we will always fall down to `ProcessEncodeWithOverflow`.
+    ABSL_SWISSTABLE_ASSERT(pos_ >= end_);
+  }
+
+  // Decodes information about probed elements from control buffer and processes
+  // marked elements.
+  // Finds new position for each element and transfers it to the new slots.
+  // Returns the total probe length.
+  ABSL_ATTRIBUTE_NOINLINE size_t DecodeAndInsertToTableOverflow(
+      CommonFields& common, const PolicyFunctions& policy,
+      void* old_slots) const {
+    ABSL_SWISSTABLE_ASSERT(local_buffer_full_ &&
+                           "must not be called when local buffer is not full");
+    size_t total_probe_length = DecodeAndInsertImpl(
+        common, policy, OverflowBufferStart(), pos_, old_slots);
+    if (ABSL_PREDICT_TRUE(marked_elements_starting_position_ ==
+                          kNoMarkedElementsSentinel)) {
+      return total_probe_length;
+    }
+    total_probe_length +=
+        ProcessProbedMarkedElements(common, policy, control_, old_slots,
+                                    marked_elements_starting_position_);
+    return total_probe_length;
+  }
+
+  static constexpr size_t kBufferSize =
+      kProbedElementsBufferSize / sizeof(ProbedItem);
+  ProbedItem buffer_[kBufferSize];
+  // If local_buffer_full_ is false, then pos_/end_ are in the local buffer,
+  // otherwise, they're in the overflow buffer.
+  ProbedItem* pos_ = buffer_;
+  const void* end_ = buffer_ + kBufferSize;
+  ctrl_t* const control_;
+  size_t marked_elements_starting_position_ = kNoMarkedElementsSentinel;
+  bool local_buffer_full_ = false;
+};
+
+// Grows to next capacity with specified encoder type.
+// Encoder is used to store probed elements that are processed later.
+// Different encoder is used depending on the capacity of the table.
+// Returns total probe length.
+template <typename Encoder>
+size_t GrowToNextCapacity(CommonFields& common, const PolicyFunctions& policy,
+                          ctrl_t* old_ctrl, void* old_slots) {
+  using ProbedItem = typename Encoder::ProbedItem;
+  ABSL_SWISSTABLE_ASSERT(common.capacity() <= ProbedItem::kMaxNewCapacity);
+  Encoder encoder(old_ctrl);
+  policy.transfer_unprobed_elements_to_next_capacity(
+      common, old_ctrl, old_slots, &encoder,
+      [](void* probed_storage, h2_t h2, size_t source_offset, size_t h1) {
+        auto encoder_ptr = static_cast<Encoder*>(probed_storage);
+        encoder_ptr->EncodeItem(ProbedItem(h2, source_offset, h1));
+      });
+  InitializeMirroredControlBytes(common.control(), common.capacity());
+  return encoder.DecodeAndInsertToTable(common, policy, old_slots);
+}
+
+// Grows to next capacity for relatively small tables so that even if all
+// elements are probed, we don't need to overflow the local buffer.
+// Returns total probe length.
+size_t GrowToNextCapacityThatFitsInLocalBuffer(CommonFields& common,
+                                               const PolicyFunctions& policy,
+                                               ctrl_t* old_ctrl,
+                                               void* old_slots) {
+  ABSL_SWISSTABLE_ASSERT(common.capacity() <= kMaxLocalBufferNewCapacity);
+  return GrowToNextCapacity<
+      ProbedItemEncoder<ProbedItem4Bytes, /*kGuaranteedFitToBuffer=*/true>>(
+      common, policy, old_ctrl, old_slots);
+}
+
+// Grows to next capacity with different encodings. Returns total probe length.
+// These functions are useful to simplify profile analysis.
+size_t GrowToNextCapacity4BytesEncoder(CommonFields& common,
+                                       const PolicyFunctions& policy,
+                                       ctrl_t* old_ctrl, void* old_slots) {
+  return GrowToNextCapacity<ProbedItemEncoder<ProbedItem4Bytes>>(
+      common, policy, old_ctrl, old_slots);
+}
+size_t GrowToNextCapacity8BytesEncoder(CommonFields& common,
+                                       const PolicyFunctions& policy,
+                                       ctrl_t* old_ctrl, void* old_slots) {
+  return GrowToNextCapacity<ProbedItemEncoder<ProbedItem8Bytes>>(
+      common, policy, old_ctrl, old_slots);
+}
+size_t GrowToNextCapacity16BytesEncoder(CommonFields& common,
+                                        const PolicyFunctions& policy,
+                                        ctrl_t* old_ctrl, void* old_slots) {
+  return GrowToNextCapacity<ProbedItemEncoder<ProbedItem16Bytes>>(
+      common, policy, old_ctrl, old_slots);
+}
+
+// Grows to next capacity for tables with relatively large capacity so that we
+// can't guarantee that all probed elements fit in the local buffer. Returns
+// total probe length.
+size_t GrowToNextCapacityOverflowLocalBuffer(CommonFields& common,
+                                             const PolicyFunctions& policy,
+                                             ctrl_t* old_ctrl,
+                                             void* old_slots) {
+  const size_t new_capacity = common.capacity();
+  if (ABSL_PREDICT_TRUE(new_capacity <= ProbedItem4Bytes::kMaxNewCapacity)) {
+    return GrowToNextCapacity4BytesEncoder(common, policy, old_ctrl, old_slots);
+  }
+  if (ABSL_PREDICT_TRUE(new_capacity <= ProbedItem8Bytes::kMaxNewCapacity)) {
+    return GrowToNextCapacity8BytesEncoder(common, policy, old_ctrl, old_slots);
+  }
+  // 16 bytes encoding supports the maximum swisstable capacity.
+  return GrowToNextCapacity16BytesEncoder(common, policy, old_ctrl, old_slots);
+}
+
+// Dispatches to the appropriate `GrowToNextCapacity*` function based on the
+// capacity of the table. Returns total probe length.
+ABSL_ATTRIBUTE_NOINLINE
+size_t GrowToNextCapacityDispatch(CommonFields& common,
+                                  const PolicyFunctions& policy,
+                                  ctrl_t* old_ctrl, void* old_slots) {
+  const size_t new_capacity = common.capacity();
+  if (ABSL_PREDICT_TRUE(new_capacity <= kMaxLocalBufferNewCapacity)) {
+    return GrowToNextCapacityThatFitsInLocalBuffer(common, policy, old_ctrl,
+                                                   old_slots);
+  } else {
+    return GrowToNextCapacityOverflowLocalBuffer(common, policy, old_ctrl,
+                                                 old_slots);
+  }
+}
+
+// Grows to next capacity and prepares insert for the given new_hash.
+// Returns the offset of the new element.
 size_t GrowToNextCapacityAndPrepareInsert(CommonFields& common,
                                           const PolicyFunctions& policy,
                                           size_t new_hash) {
-  assert(common.growth_left() == 0);
+  ABSL_SWISSTABLE_ASSERT(common.growth_left() == 0);
   const size_t old_capacity = common.capacity();
-  assert(old_capacity == 0 || old_capacity > policy.soo_capacity);
+  ABSL_SWISSTABLE_ASSERT(old_capacity == 0 ||
+                         old_capacity > policy.soo_capacity);
 
   const size_t new_capacity = NextCapacity(old_capacity);
-  assert(IsValidCapacity(new_capacity));
-  assert(new_capacity > policy.soo_capacity);
+  ABSL_SWISSTABLE_ASSERT(IsValidCapacity(new_capacity));
+  ABSL_SWISSTABLE_ASSERT(new_capacity > policy.soo_capacity);
 
   ctrl_t* old_ctrl = common.control();
   void* old_slots = common.slot_array();
@@ -831,6 +1250,7 @@ size_t GrowToNextCapacityAndPrepareInsert(CommonFields& common,
   void* new_slots = mem + layout.slot_offset();
   common.set_control</*kGenerateSeed=*/false>(new_ctrl);
   common.set_slots(new_slots);
+  SanitizerPoisonMemoryRegion(new_slots, new_capacity * slot_size);
 
   h2_t new_h2 = H2(new_hash);
   size_t total_probe_length = 0;
@@ -840,40 +1260,41 @@ size_t GrowToNextCapacityAndPrepareInsert(CommonFields& common,
     InitializeSingleElementControlBytes(new_h2, new_ctrl);
     common.generate_new_seed();
     find_info = FindInfo{0, 0};
+    SanitizerUnpoisonMemoryRegion(new_slots, slot_size);
   } else {
-    if (is_single_group(new_capacity)) {
+    if (ABSL_PREDICT_TRUE(is_single_group(new_capacity))) {
       GrowIntoSingleGroupShuffleControlBytes(old_ctrl, old_capacity, new_ctrl,
                                              new_capacity);
-      // Single group tables have no deleted slots, so we can transfer all slots
-      // without checking the control bytes.
-      assert(common.size() == old_capacity);
-      policy.transfer(&common, NextSlot(new_slots, slot_size), old_slots,
-                      old_capacity);
-      PoisonEmptySlots(common, slot_size);
+      // Single group tables have all slots full on resize. So we can transfer
+      // all slots without checking the control bytes.
+      ABSL_SWISSTABLE_ASSERT(common.size() == old_capacity);
+      auto* target = NextSlot(new_slots, slot_size);
+      SanitizerUnpoisonMemoryRegion(target, old_capacity * slot_size);
+      policy.transfer_n(&common, target, old_slots, old_capacity);
       // We put the new element either at the beginning or at the end of the
       // table with approximately equal probability.
       size_t offset = SingleGroupTableH1(new_hash, common.seed()) & 1
                           ? 0
                           : new_capacity - 1;
 
-      assert(IsEmpty(new_ctrl[offset]));
+      ABSL_SWISSTABLE_ASSERT(IsEmpty(new_ctrl[offset]));
       SetCtrlInSingleGroupTable(common, offset, new_h2, policy.slot_size);
       find_info = FindInfo{offset, 0};
     } else {
-      ResetCtrl(common, slot_size);
-      total_probe_length = policy.find_new_positions_and_transfer_slots(
-          common, old_ctrl, old_slots, old_capacity);
+      total_probe_length =
+          GrowToNextCapacityDispatch(common, policy, old_ctrl, old_slots);
       find_info = find_first_non_full(common, new_hash);
       SetCtrlInLargeTable(common, find_info.offset, new_h2, policy.slot_size);
     }
-    assert(old_capacity > policy.soo_capacity);
+    ABSL_SWISSTABLE_ASSERT(old_capacity > policy.soo_capacity);
     (*policy.dealloc)(alloc, old_capacity, old_ctrl, slot_size, slot_align,
                       has_infoz);
   }
   PrepareInsertCommon(common);
-  ResetGrowthLeft(common);
+  ResetGrowthLeft(GetGrowthInfoFromControl(new_ctrl), new_capacity,
+                  common.size());
 
-  if (has_infoz) {
+  if (ABSL_PREDICT_FALSE(has_infoz)) {
     common.set_has_infoz();
     infoz.RecordStorageChanged(common.size() - 1, new_capacity);
     infoz.RecordRehash(total_probe_length);
@@ -947,10 +1368,11 @@ size_t RehashOrGrowToNextCapacityAndPrepareInsert(CommonFields& common,
 size_t PrepareInsertNonSooSlow(CommonFields& common,
                                const PolicyFunctions& policy, size_t hash) {
   const GrowthInfo growth_info = common.growth_info();
-  assert(!growth_info.HasNoDeletedAndGrowthLeft());
+  ABSL_SWISSTABLE_ASSERT(!growth_info.HasNoDeletedAndGrowthLeft());
   if (ABSL_PREDICT_TRUE(growth_info.HasNoGrowthLeftAndNoDeleted())) {
     // Table without deleted slots (>95% cases) that needs to be resized.
-    assert(growth_info.HasNoDeleted() && growth_info.GetGrowthLeft() == 0);
+    ABSL_SWISSTABLE_ASSERT(growth_info.HasNoDeleted() &&
+                           growth_info.GetGrowthLeft() == 0);
     return GrowToNextCapacityAndPrepareInsert(common, policy, hash);
   }
   if (ABSL_PREDICT_FALSE(growth_info.HasNoGrowthLeftAssumingMayHaveDeleted())) {
@@ -966,6 +1388,68 @@ size_t PrepareInsertNonSooSlow(CommonFields& common,
   return target.offset;
 }
 
+
+// Resizes empty non-allocated SOO table to NextCapacity(SooCapacity()),
+// forces the table to be sampled and prepares the insert.
+// SOO tables need to switch from SOO to heap in order to store the infoz.
+// Requires:
+//   1. `c.capacity() == SooCapacity()`.
+//   2. `c.empty()`.
+ABSL_ATTRIBUTE_NOINLINE size_t
+GrowEmptySooTableToNextCapacityForceSamplingAndPrepareInsert(
+    CommonFields& common, const PolicyFunctions& policy, size_t new_hash) {
+  ResizeEmptyNonAllocatedTableImpl(common, policy, NextCapacity(SooCapacity()),
+                                   /*force_infoz=*/true);
+  PrepareInsertCommon(common);
+  common.growth_info().OverwriteEmptyAsFull();
+  SetCtrlInSingleGroupTable(common, SooSlotIndex(), H2(new_hash),
+                            policy.slot_size);
+  common.infoz().RecordInsert(new_hash, /*distance_from_desired=*/0);
+  return SooSlotIndex();
+}
+
+// Resizes empty non-allocated table to the capacity to fit new_size elements.
+// Requires:
+//   1. `c.capacity() == policy.soo_capacity`.
+//   2. `c.empty()`.
+//   3. `new_size > policy.soo_capacity`.
+// The table will be attempted to be sampled.
+void ReserveEmptyNonAllocatedTableToFitNewSize(CommonFields& common,
+                                               const PolicyFunctions& policy,
+                                               size_t new_size) {
+  ValidateMaxSize(new_size, policy.slot_size);
+  ABSL_ASSUME(new_size > 0);
+  ResizeEmptyNonAllocatedTableImpl(common, policy, SizeToCapacity(new_size),
+                                   /*force_infoz=*/false);
+  // This is after resize, to ensure that we have completed the allocation
+  // and have potentially sampled the hashtable.
+  common.infoz().RecordReservation(new_size);
+}
+
+// Type erased version of raw_hash_set::reserve for tables that have an
+// allocated backing array.
+//
+// Requires:
+//   1. `c.capacity() > policy.soo_capacity` OR `!c.empty()`.
+// Reserving already allocated tables is considered to be a rare case.
+ABSL_ATTRIBUTE_NOINLINE void ReserveAllocatedTable(
+    CommonFields& common, const PolicyFunctions& policy, size_t new_size) {
+  const size_t cap = common.capacity();
+  ValidateMaxSize(new_size, policy.slot_size);
+  ABSL_ASSUME(new_size > 0);
+  const size_t new_capacity = SizeToCapacity(new_size);
+  if (cap == policy.soo_capacity) {
+    ABSL_SWISSTABLE_ASSERT(!common.empty());
+    ResizeFullSooTable(common, policy, new_capacity,
+                       ResizeFullSooTableSamplingMode::kNoSampling);
+  } else {
+    ABSL_SWISSTABLE_ASSERT(cap > policy.soo_capacity);
+    // TODO(b/382423690): consider using GrowToNextCapacity, when applicable.
+    ResizeAllocatedTableWithSeedChange(common, policy, new_capacity);
+  }
+  common.infoz().RecordReservation(new_size);
+}
+
 }  // namespace
 
 void* GetRefForEmptyClass(CommonFields& common) {
@@ -983,20 +1467,6 @@ void ResizeAllocatedTableWithSeedChange(CommonFields& common,
       common, policy, new_capacity, common.infoz());
 }
 
-void ReserveEmptyNonAllocatedTableToFitNewSize(CommonFields& common,
-                                               const PolicyFunctions& policy,
-                                               size_t new_size) {
-  ValidateMaxSize(new_size, policy.slot_size);
-  ResizeEmptyNonAllocatedTableImpl(
-      common, policy, NormalizeCapacity(GrowthToLowerboundCapacity(new_size)),
-      /*force_infoz=*/false);
-  // This is after resize, to ensure that we have completed the allocation
-  // and have potentially sampled the hashtable.
-  common.infoz().RecordReservation(new_size);
-  common.reset_reserved_growth(new_size);
-  common.set_reservation_size(new_size);
-}
-
 void ReserveEmptyNonAllocatedTableToFitBucketCount(
     CommonFields& common, const PolicyFunctions& policy, size_t bucket_count) {
   size_t new_capacity = NormalizeCapacity(bucket_count);
@@ -1005,22 +1475,22 @@ void ReserveEmptyNonAllocatedTableToFitBucketCount(
                                    /*force_infoz=*/false);
 }
 
-void GrowEmptySooTableToNextCapacityForceSampling(
-    CommonFields& common, const PolicyFunctions& policy) {
-  ResizeEmptyNonAllocatedTableImpl(common, policy, NextCapacity(SooCapacity()),
-                                   /*force_infoz=*/true);
-}
-
 // Resizes a full SOO table to the NextCapacity(SooCapacity()).
 template <size_t SooSlotMemcpySize, bool TransferUsesMemcpy>
-void GrowFullSooTableToNextCapacity(CommonFields& common,
-                                    const PolicyFunctions& policy,
-                                    size_t soo_slot_hash) {
-  assert(common.capacity() == policy.soo_capacity);
-  assert(common.size() == policy.soo_capacity);
+size_t GrowSooTableToNextCapacityAndPrepareInsert(CommonFields& common,
+                                                  const PolicyFunctions& policy,
+                                                  size_t new_hash,
+                                                  ctrl_t soo_slot_ctrl) {
+  ABSL_SWISSTABLE_ASSERT(common.capacity() == policy.soo_capacity);
+  ABSL_SWISSTABLE_ASSERT(policy.soo_capacity == SooCapacity());
+  if (ABSL_PREDICT_FALSE(soo_slot_ctrl == ctrl_t::kEmpty)) {
+    // The table is empty, it is only used for forced sampling of SOO tables.
+    return GrowEmptySooTableToNextCapacityForceSamplingAndPrepareInsert(
+        common, policy, new_hash);
+  }
+  ABSL_SWISSTABLE_ASSERT(common.size() == policy.soo_capacity);
   static constexpr size_t kNewCapacity = NextCapacity(SooCapacity());
-  assert(kNewCapacity > policy.soo_capacity);
-  assert(policy.soo_capacity == SooCapacity());
+  ABSL_SWISSTABLE_ASSERT(kNewCapacity > policy.soo_capacity);
   const size_t slot_size = policy.slot_size;
   const size_t slot_align = policy.slot_align;
   common.set_capacity(kNewCapacity);
@@ -1041,7 +1511,17 @@ void GrowFullSooTableToNextCapacity(CommonFields& common,
   ctrl_t* new_ctrl = reinterpret_cast<ctrl_t*>(mem + layout.control_offset());
   void* new_slots = mem + layout.slot_offset();
 
-  InitializeThreeElementsControlBytesAfterSoo(soo_slot_hash, new_ctrl);
+  PrepareInsertCommon(common);
+  ABSL_SWISSTABLE_ASSERT(common.size() == 2);
+  GetGrowthInfoFromControl(new_ctrl).InitGrowthLeftNoDeleted(kNewCapacity - 2);
+  common.generate_new_seed();
+
+  // After resize from capacity 1 to 3, we always have exactly the slot with
+  // index 1 occupied, so we need to insert either at index 0 or index 2.
+  static_assert(SooSlotIndex() == 1);
+  const size_t offset = SingleGroupTableH1(new_hash, common.seed()) & 2;
+  InitializeThreeElementsControlBytesAfterSoo(soo_slot_ctrl, new_hash, offset,
+                                              new_ctrl);
 
   SanitizerPoisonMemoryRegion(new_slots, slot_size * kNewCapacity);
   void* target_slot = SlotAddress(new_slots, SooSlotIndex(), slot_size);
@@ -1053,27 +1533,31 @@ void GrowFullSooTableToNextCapacity(CommonFields& common,
     static_assert(SooSlotIndex() == 1);
     static_assert(SooSlotMemcpySize > 0);
     static_assert(SooSlotMemcpySize <= MaxSooSlotSize());
-    assert(SooSlotMemcpySize <= 2 * slot_size);
-    assert(SooSlotMemcpySize >= slot_size);
+    ABSL_SWISSTABLE_ASSERT(SooSlotMemcpySize <= 2 * slot_size);
+    ABSL_SWISSTABLE_ASSERT(SooSlotMemcpySize >= slot_size);
     void* next_slot = SlotAddress(target_slot, 1, slot_size);
     SanitizerUnpoisonMemoryRegion(next_slot, SooSlotMemcpySize - slot_size);
     std::memcpy(target_slot, common.soo_data(), SooSlotMemcpySize);
     SanitizerPoisonMemoryRegion(next_slot, SooSlotMemcpySize - slot_size);
   } else {
     static_assert(SooSlotMemcpySize == 0);
-    policy.transfer(&common, target_slot, common.soo_data(), 1);
+    policy.transfer_n(&common, target_slot, common.soo_data(), 1);
   }
-  common.set_control</*kGenerateSeed=*/true>(new_ctrl);
+  // Seed was already generated above.
+  common.set_control</*kGenerateSeed=*/false>(new_ctrl);
   common.set_slots(new_slots);
 
-  ResetGrowthLeft(common);
+  common.infoz().RecordInsert(new_hash, /*distance_from_desired=*/0);
+  SanitizerUnpoisonMemoryRegion(SlotAddress(new_slots, offset, slot_size),
+                                slot_size);
+  return offset;
 }
 
 void GrowFullSooTableToNextCapacityForceSampling(
     CommonFields& common, const PolicyFunctions& policy) {
-  assert(common.capacity() == policy.soo_capacity);
-  assert(common.size() == policy.soo_capacity);
-  assert(policy.soo_capacity == SooCapacity());
+  ABSL_SWISSTABLE_ASSERT(common.capacity() == policy.soo_capacity);
+  ABSL_SWISSTABLE_ASSERT(common.size() == policy.soo_capacity);
+  ABSL_SWISSTABLE_ASSERT(policy.soo_capacity == SooCapacity());
   ResizeFullSooTable(
       common, policy, NextCapacity(SooCapacity()),
       ResizeFullSooTableSamplingMode::kForceSampleNoResizeIfUnsampled);
@@ -1105,28 +1589,28 @@ void Rehash(CommonFields& common, const PolicyFunctions& policy, size_t n) {
                                              kInitialSampledCapacity);
         }
         // This asserts that we didn't lose sampling coverage in `resize`.
-        assert(common.infoz().IsSampled());
+        ABSL_SWISSTABLE_ASSERT(common.infoz().IsSampled());
         return;
       }
-      assert(slot_size <= sizeof(HeapOrSoo));
-      assert(policy.slot_align <= alignof(HeapOrSoo));
+      ABSL_SWISSTABLE_ASSERT(slot_size <= sizeof(HeapOrSoo));
+      ABSL_SWISSTABLE_ASSERT(policy.slot_align <= alignof(HeapOrSoo));
       HeapOrSoo tmp_slot(uninitialized_tag_t{});
       size_t begin_offset = FindFirstFullSlot(0, cap, common.control());
-      policy.transfer(&common, &tmp_slot,
-                      SlotAddress(common.slot_array(), begin_offset, slot_size),
-                      1);
+      policy.transfer_n(
+          &common, &tmp_slot,
+          SlotAddress(common.slot_array(), begin_offset, slot_size), 1);
       clear_backing_array();
-      policy.transfer(&common, common.soo_data(), &tmp_slot, 1);
+      policy.transfer_n(&common, common.soo_data(), &tmp_slot, 1);
       common.set_full_soo();
       return;
     }
   }
 
+  ValidateMaxSize(n, policy.slot_size);
   // bitor is a faster way of doing `max` here. We will round up to the next
   // power-of-2-minus-1, so bitor is good enough.
-  size_t new_size = n | GrowthToLowerboundCapacity(common.size());
-  ValidateMaxSize(n, policy.slot_size);
-  const size_t new_capacity = NormalizeCapacity(new_size);
+  const size_t new_capacity =
+      NormalizeCapacity(n | SizeToCapacity(common.size()));
   // n == 0 unconditionally rehashes as per the standard.
   if (n == 0 || new_capacity > cap) {
     if (cap == policy.soo_capacity) {
@@ -1146,31 +1630,25 @@ void Rehash(CommonFields& common, const PolicyFunctions& policy, size_t n) {
   }
 }
 
-void ReserveAllocatedTable(CommonFields& common, const PolicyFunctions& policy,
-                           size_t n) {
-  common.reset_reserved_growth(n);
-  common.set_reservation_size(n);
-
+void ReserveTableToFitNewSize(CommonFields& common,
+                              const PolicyFunctions& policy, size_t new_size) {
+  common.reset_reserved_growth(new_size);
+  common.set_reservation_size(new_size);
+  ABSL_SWISSTABLE_ASSERT(new_size > policy.soo_capacity);
   const size_t cap = common.capacity();
-  assert(!common.empty() || cap > policy.soo_capacity);
-  assert(cap > 0);
+  if (ABSL_PREDICT_TRUE(common.empty() && cap <= policy.soo_capacity)) {
+    return ReserveEmptyNonAllocatedTableToFitNewSize(common, policy, new_size);
+  }
+
+  ABSL_SWISSTABLE_ASSERT(!common.empty() || cap > policy.soo_capacity);
+  ABSL_SWISSTABLE_ASSERT(cap > 0);
   const size_t max_size_before_growth =
       cap <= policy.soo_capacity ? policy.soo_capacity
                                  : common.size() + common.growth_left();
-  if (n <= max_size_before_growth) {
+  if (new_size <= max_size_before_growth) {
     return;
   }
-  ValidateMaxSize(n, policy.slot_size);
-  const size_t new_capacity = NormalizeCapacity(GrowthToLowerboundCapacity(n));
-  if (cap == policy.soo_capacity) {
-    assert(!common.empty());
-    ResizeFullSooTable(common, policy, new_capacity,
-                       ResizeFullSooTableSamplingMode::kNoSampling);
-  } else {
-    assert(cap > policy.soo_capacity);
-    ResizeAllocatedTableWithSeedChange(common, policy, new_capacity);
-  }
-  common.infoz().RecordReservation(n);
+  ReserveAllocatedTable(common, policy, new_size);
 }
 
 size_t PrepareInsertNonSoo(CommonFields& common, const PolicyFunctions& policy,
@@ -1226,32 +1704,41 @@ constexpr bool VerifyOptimalMemcpySizeForSooSlotTransferRange(size_t left,
 }
 }  // namespace
 
+// Extern template instantiation for inline function.
+template size_t TryFindNewIndexWithoutProbing(size_t h1, size_t old_index,
+                                              size_t old_capacity,
+                                              ctrl_t* new_ctrl,
+                                              size_t new_capacity);
+
 // We need to instantiate ALL possible template combinations because we define
 // the function in the cc file.
-template void GrowFullSooTableToNextCapacity<0, false>(CommonFields&,
-                                                       const PolicyFunctions&,
-                                                       size_t);
-template void
-GrowFullSooTableToNextCapacity<OptimalMemcpySizeForSooSlotTransfer(1), true>(
-    CommonFields&, const PolicyFunctions&, size_t);
+template size_t GrowSooTableToNextCapacityAndPrepareInsert<0, false>(
+    CommonFields&, const PolicyFunctions&, size_t, ctrl_t);
+template size_t GrowSooTableToNextCapacityAndPrepareInsert<
+    OptimalMemcpySizeForSooSlotTransfer(1), true>(CommonFields&,
+                                                  const PolicyFunctions&,
+                                                  size_t, ctrl_t);
 
 static_assert(VerifyOptimalMemcpySizeForSooSlotTransferRange(2, 3));
-template void
-GrowFullSooTableToNextCapacity<OptimalMemcpySizeForSooSlotTransfer(3), true>(
-    CommonFields&, const PolicyFunctions&, size_t);
+template size_t GrowSooTableToNextCapacityAndPrepareInsert<
+    OptimalMemcpySizeForSooSlotTransfer(3), true>(CommonFields&,
+                                                  const PolicyFunctions&,
+                                                  size_t, ctrl_t);
 
 static_assert(VerifyOptimalMemcpySizeForSooSlotTransferRange(4, 8));
-template void
-GrowFullSooTableToNextCapacity<OptimalMemcpySizeForSooSlotTransfer(8), true>(
-    CommonFields&, const PolicyFunctions&, size_t);
+template size_t GrowSooTableToNextCapacityAndPrepareInsert<
+    OptimalMemcpySizeForSooSlotTransfer(8), true>(CommonFields&,
+                                                  const PolicyFunctions&,
+                                                  size_t, ctrl_t);
 
 #if UINTPTR_MAX == UINT32_MAX
 static_assert(MaxSooSlotSize() == 8);
 #else
 static_assert(VerifyOptimalMemcpySizeForSooSlotTransferRange(9, 16));
-template void
-GrowFullSooTableToNextCapacity<OptimalMemcpySizeForSooSlotTransfer(16), true>(
-    CommonFields&, const PolicyFunctions&, size_t);
+template size_t GrowSooTableToNextCapacityAndPrepareInsert<
+    OptimalMemcpySizeForSooSlotTransfer(16), true>(CommonFields&,
+                                                   const PolicyFunctions&,
+                                                   size_t, ctrl_t);
 static_assert(MaxSooSlotSize() == 16);
 #endif
 
diff --git a/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set.h b/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set.h
index 3f4646f81bfd49..b22f8177252461 100644
--- a/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set.h
+++ b/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set.h
@@ -214,6 +214,7 @@
 #include "absl/container/internal/hashtablez_sampler.h"
 #include "absl/functional/function_ref.h"
 #include "absl/hash/hash.h"
+#include "absl/hash/internal/weakly_mixed_integer.h"
 #include "absl/memory/memory.h"
 #include "absl/meta/type_traits.h"
 #include "absl/numeric/bits.h"
@@ -451,7 +452,9 @@ class PerTableSeed {
   // The number of bits in the seed.
   // It is big enough to ensure non-determinism of iteration order.
   // We store the seed inside a uint64_t together with size and other metadata.
-  static constexpr size_t kBitCount = 19;
+  // Using 16 bits allows us to save one `and` instruction in H1 (we use movzwl
+  // instead of movq+and).
+  static constexpr size_t kBitCount = 16;
 
   // Returns the seed for the table. Only the lowest kBitCount are non zero.
   size_t seed() const { return seed_; }
@@ -463,16 +466,12 @@ class PerTableSeed {
   const size_t seed_;
 };
 
-// Returns next seed base number that is used for generating per-table seeds.
-// Only the lowest PerTableSeed::kBitCount bits are used for actual hash table
-// seed.
-inline size_t NextSeedBaseNumber() {
-  thread_local size_t seed = reinterpret_cast<uintptr_t>(&seed);
-  if constexpr (sizeof(size_t) == 4) {
-    seed += uint32_t{0xcc9e2d51};
-  } else {
-    seed += uint64_t{0xdcb22ca68cb134ed};
-  }
+// Returns next per-table seed.
+inline uint16_t NextSeed() {
+  static_assert(PerTableSeed::kBitCount == 16);
+  thread_local uint16_t seed =
+      static_cast<uint16_t>(reinterpret_cast<uintptr_t>(&seed));
+  seed += uint16_t{0xad53};
   return seed;
 }
 
@@ -504,8 +503,7 @@ class HashtableSize {
   }
 
   void generate_new_seed() {
-    size_t seed = NextSeedBaseNumber();
-    data_ = (data_ & ~kSeedMask) | (seed & kSeedMask);
+    data_ = (data_ & ~kSeedMask) ^ uint64_t{NextSeed()};
   }
 
   // Returns true if the table has infoz.
@@ -537,40 +535,6 @@ inline size_t H1(size_t hash, PerTableSeed seed) {
 // These are used as an occupied control byte.
 inline h2_t H2(size_t hash) { return hash & 0x7F; }
 
-// Mixes a randomly generated per-process seed with `hash` and `ctrl` to
-// randomize insertion order within groups.
-bool ShouldInsertBackwardsForDebug(size_t capacity, size_t hash,
-                                   PerTableSeed seed);
-
-ABSL_ATTRIBUTE_ALWAYS_INLINE inline bool ShouldInsertBackwards(
-    ABSL_ATTRIBUTE_UNUSED size_t capacity, ABSL_ATTRIBUTE_UNUSED size_t hash,
-    ABSL_ATTRIBUTE_UNUSED PerTableSeed seed) {
-#if defined(NDEBUG)
-  return false;
-#else
-  return ShouldInsertBackwardsForDebug(capacity, hash, seed);
-#endif
-}
-
-// Returns insert position for the given mask.
-// We want to add entropy even when ASLR is not enabled.
-// In debug build we will randomly insert in either the front or back of
-// the group.
-// TODO(kfm,sbenza): revisit after we do unconditional mixing
-template <class Mask>
-ABSL_ATTRIBUTE_ALWAYS_INLINE inline auto GetInsertionOffset(
-    Mask mask, ABSL_ATTRIBUTE_UNUSED size_t capacity,
-    ABSL_ATTRIBUTE_UNUSED size_t hash,
-    ABSL_ATTRIBUTE_UNUSED PerTableSeed seed) {
-#if defined(NDEBUG)
-  return mask.LowestBitSet();
-#else
-  return ShouldInsertBackwardsForDebug(capacity, hash, seed)
-             ? mask.HighestBitSet()
-             : mask.LowestBitSet();
-#endif
-}
-
 // When there is an insertion with no reserved growth, we rehash with
 // probability `min(1, RehashProbabilityConstant() / capacity())`. Using a
 // constant divided by capacity ensures that inserting N elements is still O(N)
@@ -829,10 +793,16 @@ constexpr size_t NumControlBytes(size_t capacity) {
 
 // Computes the offset from the start of the backing allocation of control.
 // infoz and growth_info are stored at the beginning of the backing array.
-constexpr static size_t ControlOffset(bool has_infoz) {
+constexpr size_t ControlOffset(bool has_infoz) {
   return (has_infoz ? sizeof(HashtablezInfoHandle) : 0) + sizeof(GrowthInfo);
 }
 
+// Returns the offset of the next item after `offset` that is aligned to `align`
+// bytes. `align` must be a power of two.
+constexpr size_t AlignUpTo(size_t offset, size_t align) {
+  return (offset + align - 1) & (~align + 1);
+}
+
 // Helper class for computing offsets and allocation size of hash set fields.
 class RawHashSetLayout {
  public:
@@ -841,8 +811,7 @@ class RawHashSetLayout {
       : control_offset_(ControlOffset(has_infoz)),
         generation_offset_(control_offset_ + NumControlBytes(capacity)),
         slot_offset_(
-            (generation_offset_ + NumGenerationBytes() + slot_align - 1) &
-            (~slot_align + 1)),
+            AlignUpTo(generation_offset_ + NumGenerationBytes(), slot_align)),
         alloc_size_(slot_offset_ + capacity * slot_size) {
     ABSL_SWISSTABLE_ASSERT(IsValidCapacity(capacity));
     ABSL_SWISSTABLE_ASSERT(
@@ -953,6 +922,15 @@ union HeapOrSoo {
   unsigned char soo_data[MaxSooSlotSize()];
 };
 
+// Returns a reference to the GrowthInfo object stored immediately before
+// `control`.
+inline GrowthInfo& GetGrowthInfoFromControl(ctrl_t* control) {
+  auto* gl_ptr = reinterpret_cast<GrowthInfo*>(control) - 1;
+  ABSL_SWISSTABLE_ASSERT(
+      reinterpret_cast<uintptr_t>(gl_ptr) % alignof(GrowthInfo) == 0);
+  return *gl_ptr;
+}
+
 // CommonFields hold the fields in raw_hash_set that do not depend
 // on template parameters. This allows us to conveniently pass all
 // of this state to helper functions as a single argument.
@@ -1076,10 +1054,7 @@ class CommonFields : public CommonFieldsGenerationInfo {
   size_t growth_left() const { return growth_info().GetGrowthLeft(); }
 
   GrowthInfo& growth_info() {
-    auto* gl_ptr = reinterpret_cast<GrowthInfo*>(control()) - 1;
-    ABSL_SWISSTABLE_ASSERT(
-        reinterpret_cast<uintptr_t>(gl_ptr) % alignof(GrowthInfo) == 0);
-    return *gl_ptr;
+    return GetGrowthInfoFromControl(control());
   }
   GrowthInfo growth_info() const {
     return const_cast<CommonFields*>(this)->growth_info();
@@ -1190,6 +1165,12 @@ constexpr size_t NextCapacity(size_t n) {
   return n * 2 + 1;
 }
 
+// Returns the previous valid capacity before `n`.
+constexpr size_t PreviousCapacity(size_t n) {
+  ABSL_SWISSTABLE_ASSERT(IsValidCapacity(n));
+  return n / 2;
+}
+
 // Applies the following mapping to every byte in the control array:
 //   * kDeleted -> kEmpty
 //   * kEmpty -> kEmpty
@@ -1225,18 +1206,28 @@ constexpr size_t CapacityToGrowth(size_t capacity) {
   return capacity - capacity / 8;
 }
 
-// Given `growth`, "unapplies" the load factor to find how large the capacity
+// Given `size`, "unapplies" the load factor to find how large the capacity
 // should be to stay within the load factor.
 //
-// This might not be a valid capacity and `NormalizeCapacity()` should be
-// called on this.
-inline size_t GrowthToLowerboundCapacity(size_t growth) {
-  // `growth*8/7`
-  if (Group::kWidth == 8 && growth == 7) {
-    // x+(x-1)/7 does not work when x==7.
-    return 8;
-  }
-  return growth + static_cast<size_t>((static_cast<int64_t>(growth) - 1) / 7);
+// For size == 0, returns 0.
+// For other values, returns the same as `NormalizeCapacity(size*8/7)`.
+constexpr size_t SizeToCapacity(size_t size) {
+  if (size == 0) {
+    return 0;
+  }
+  // The minimum possible capacity is NormalizeCapacity(size).
+  // Shifting right `~size_t{}` by `leading_zeros` yields
+  // NormalizeCapacity(size).
+  int leading_zeros = absl::countl_zero(size);
+  constexpr size_t kLast3Bits = size_t{7} << (sizeof(size_t) * 8 - 3);
+  size_t max_size_for_next_capacity = kLast3Bits >> leading_zeros;
+  // Decrease shift if size is too big for the minimum capacity.
+  leading_zeros -= static_cast<int>(size > max_size_for_next_capacity);
+  if constexpr (Group::kWidth == 8) {
+    // Formula doesn't work when size==7 for 8-wide groups.
+    leading_zeros -= (size == 7);
+  }
+  return (~size_t{}) >> leading_zeros;
 }
 
 template <class InputIter>
@@ -1247,8 +1238,7 @@ size_t SelectBucketCountForIterRange(InputIter first, InputIter last,
   }
   if (base_internal::IsAtLeastIterator<std::random_access_iterator_tag,
                                        InputIter>()) {
-    return GrowthToLowerboundCapacity(
-        static_cast<size_t>(std::distance(first, last)));
+    return SizeToCapacity(static_cast<size_t>(std::distance(first, last)));
   }
   return 0;
 }
@@ -1321,7 +1311,7 @@ inline void AssertIsValidForComparison(const ctrl_t* ctrl,
           FATAL, "Invalid iterator comparison. The element was likely erased.");
     }
   } else {
-    ABSL_HARDENING_ASSERT(
+    ABSL_HARDENING_ASSERT_SLOW(
         ctrl_is_valid_for_comparison &&
         "Invalid iterator comparison. The element might have been erased or "
         "the table might have rehashed. Consider running with --config=asan to "
@@ -1419,22 +1409,6 @@ struct FindInfo {
   size_t probe_length;
 };
 
-// Whether a table is "small". A small table fits entirely into a probing
-// group, i.e., has a capacity < `Group::kWidth`.
-//
-// In small mode we are able to use the whole capacity. The extra control
-// bytes give us at least one "empty" control byte to stop the iteration.
-// This is important to make 1 a valid capacity.
-//
-// In small mode only the first `capacity` control bytes after the sentinel
-// are valid. The rest contain dummy ctrl_t::kEmpty values that do not
-// represent a real slot. This is important to take into account on
-// `find_first_non_full()`, where we never try
-// `ShouldInsertBackwards()` for small tables.
-constexpr bool is_small(size_t capacity) {
-  return capacity < Group::kWidth - 1;
-}
-
 // Whether a table fits entirely into a probing group.
 // Arbitrary order of elements in such tables is correct.
 constexpr bool is_single_group(size_t capacity) {
@@ -1442,9 +1416,12 @@ constexpr bool is_single_group(size_t capacity) {
 }
 
 // Begins a probing operation on `common.control`, using `hash`.
-inline probe_seq<Group::kWidth> probe(PerTableSeed seed, const size_t capacity,
+inline probe_seq<Group::kWidth> probe(size_t h1, size_t capacity) {
+  return probe_seq<Group::kWidth>(h1, capacity);
+}
+inline probe_seq<Group::kWidth> probe(PerTableSeed seed, size_t capacity,
                                       size_t hash) {
-  return probe_seq<Group::kWidth>(H1(hash, seed), capacity);
+  return probe(H1(hash, seed), capacity);
 }
 inline probe_seq<Group::kWidth> probe(const CommonFields& common, size_t hash) {
   return probe(common.seed(), common.capacity(), hash);
@@ -1457,47 +1434,70 @@ inline probe_seq<Group::kWidth> probe(const CommonFields& common, size_t hash) {
 //
 // NOTE: this function must work with tables having both empty and deleted
 // slots in the same group. Such tables appear during `erase()`.
+FindInfo find_first_non_full(const CommonFields& common, size_t hash);
+
+constexpr size_t kProbedElementIndexSentinel = ~size_t{};
+
+// Implementation detail of transfer_unprobed_elements_to_next_capacity_fn.
+// Tries to find the new index for an element whose hash corresponds to
+// `h1` for growth to the next capacity.
+// Returns kProbedElementIndexSentinel if full probing is required.
+//
+// If element is located in the first probing group in the table before growth,
+// returns one of two positions: `old_index` or `old_index + old_capacity + 1`.
+//
+// Otherwise, we will try to insert it into the first probe group of the new
+// table. We only attempt to do so if the first probe group is already
+// initialized.
 template <typename = void>
-inline FindInfo find_first_non_full(const CommonFields& common, size_t hash) {
-  auto seq = probe(common, hash);
-  const ctrl_t* ctrl = common.control();
-  const PerTableSeed seed = common.seed();
-  if (IsEmptyOrDeleted(ctrl[seq.offset()]) &&
-      !ShouldInsertBackwards(common.capacity(), hash, seed)) {
-    return {seq.offset(), /*probe_length=*/0};
-  }
-  while (true) {
-    GroupFullEmptyOrDeleted g{ctrl + seq.offset()};
-    auto mask = g.MaskEmptyOrDeleted();
-    if (mask) {
-      return {
-          seq.offset(GetInsertionOffset(mask, common.capacity(), hash, seed)),
-          seq.index()};
-    }
-    seq.next();
-    ABSL_SWISSTABLE_ASSERT(seq.index() <= common.capacity() && "full table!");
-  }
+inline size_t TryFindNewIndexWithoutProbing(size_t h1, size_t old_index,
+                                            size_t old_capacity,
+                                            ctrl_t* new_ctrl,
+                                            size_t new_capacity) {
+  size_t index_diff = old_index - h1;
+  // The first probe group starts with h1 & capacity.
+  // All following groups start at (h1 + Group::kWidth * K) & capacity.
+  // We can find an index within the floating group as index_diff modulo
+  // Group::kWidth.
+  // Both old and new capacity are larger than Group::kWidth so we can avoid
+  // computing `& capacity`.
+  size_t in_floating_group_index = index_diff & (Group::kWidth - 1);
+  // By subtracting we will get the difference between the first probe group
+  // and the probe group corresponding to old_index.
+  index_diff -= in_floating_group_index;
+  if (ABSL_PREDICT_TRUE((index_diff & old_capacity) == 0)) {
+    size_t new_index = (h1 + in_floating_group_index) & new_capacity;
+    ABSL_ASSUME(new_index != kProbedElementIndexSentinel);
+    return new_index;
+  }
+  ABSL_SWISSTABLE_ASSERT(((old_index - h1) & old_capacity) >= Group::kWidth);
+  // Try to insert element into the first probe group.
+  // new_ctrl is not yet fully initialized so we can't use regular search via
+  // find_first_non_full.
+
+  // We can search in the first probe group only if it is located in already
+  // initialized part of the table.
+  if (ABSL_PREDICT_FALSE((h1 & old_capacity) >= old_index)) {
+    return kProbedElementIndexSentinel;
+  }
+  size_t offset = h1 & new_capacity;
+  Group new_g(new_ctrl + offset);
+  if (auto mask = new_g.MaskNonFull(); ABSL_PREDICT_TRUE(mask)) {
+    size_t result = offset + mask.LowestBitSet();
+    ABSL_ASSUME(result != kProbedElementIndexSentinel);
+    return result;
+  }
+  return kProbedElementIndexSentinel;
 }
 
-// Extern template for inline function keep possibility of inlining.
+// Extern template for inline function keeps possibility of inlining.
 // When compiler decided to not inline, no symbols will be added to the
 // corresponding translation unit.
-extern template FindInfo find_first_non_full(const CommonFields&, size_t);
-
-// Non-inlined version of find_first_non_full for use in less
-// performance critical routines.
-FindInfo find_first_non_full_outofline(const CommonFields&, size_t);
-
-// Sets `ctrl` to `{kEmpty, kSentinel, ..., kEmpty}`, marking the entire
-// array as marked as empty.
-inline void ResetCtrl(CommonFields& common, size_t slot_size) {
-  const size_t capacity = common.capacity();
-  ctrl_t* ctrl = common.control();
-  std::memset(ctrl, static_cast<int8_t>(ctrl_t::kEmpty),
-              capacity + 1 + NumClonedBytes());
-  ctrl[capacity] = ctrl_t::kSentinel;
-  SanitizerPoisonMemoryRegion(common.slot_array(), slot_size * capacity);
-}
+extern template size_t TryFindNewIndexWithoutProbing(size_t h1,
+                                                     size_t old_index,
+                                                     size_t old_capacity,
+                                                     ctrl_t* new_ctrl,
+                                                     size_t new_capacity);
 
 // Sets sanitizer poisoning for slot corresponding to control byte being set.
 inline void DoSanitizeOnSetCtrl(const CommonFields& c, size_t i, ctrl_t h,
@@ -1648,8 +1648,7 @@ struct PolicyFunctions {
 
   // Transfers the contents of `count` slots from src_slot to dst_slot.
   // We use ability to transfer several slots in single group table growth.
-  // TODO(b/382423690): consider having separate `transfer` and `transfer_n`.
-  void (*transfer)(void* set, void* dst_slot, void* src_slot, size_t count);
+  void (*transfer_n)(void* set, void* dst_slot, void* src_slot, size_t count);
 
   // Returns the pointer to the CharAlloc stored in the set.
   void* (*get_char_alloc)(CommonFields& common);
@@ -1661,13 +1660,21 @@ struct PolicyFunctions {
   void (*dealloc)(void* alloc, size_t capacity, ctrl_t* ctrl, size_t slot_size,
                   size_t slot_align, bool had_infoz);
 
-  // Iterates over full slots in old table, finds new positions
-  // for them and transfers the slots.
-  // Returns the total probe length.
-  size_t (*find_new_positions_and_transfer_slots)(CommonFields& common,
-                                                  ctrl_t* old_ctrl,
-                                                  void* old_slots,
-                                                  size_t old_capacity);
+  // Implementation detail of GrowToNextCapacity.
+  // Iterates over all full slots and transfers unprobed elements.
+  // Initializes the new control bytes except mirrored bytes and kSentinel.
+  // Caller must finish the initialization.
+  // All slots corresponding to the full control bytes are transferred.
+  // Probed elements are reported by `encode_probed_element` callback.
+  // encode_probed_element may overwrite old_ctrl buffer till source_offset.
+  // Different encoding is used depending on the capacity of the table.
+  // See ProbedItem*Bytes classes for details.
+  void (*transfer_unprobed_elements_to_next_capacity)(
+      CommonFields& common, const ctrl_t* old_ctrl, void* old_slots,
+      // TODO(b/382423690): Try to use absl::FunctionRef here.
+      void* probed_storage,
+      void (*encode_probed_element)(void* probed_storage, h2_t h2,
+                                    size_t source_offset, size_t h1));
 };
 
 // Returns the maximum valid size for a table with 1-byte slots.
@@ -1729,42 +1736,23 @@ constexpr size_t SooSlotIndex() { return 1; }
 // Allowing till 16 would require additional store that can be avoided.
 constexpr size_t MaxSmallAfterSooCapacity() { return 7; }
 
-// Resizes empty non-allocated table to the capacity to fit new_size elements.
-// Requires:
+// Type erased version of raw_hash_set::reserve.
+// Requires: `new_size > policy.soo_capacity`.
+void ReserveTableToFitNewSize(CommonFields& common,
+                              const PolicyFunctions& policy, size_t new_size);
+
+// Resizes empty non-allocated table to the next valid capacity after
+// `bucket_count`. Requires:
 //   1. `c.capacity() == policy.soo_capacity`.
 //   2. `c.empty()`.
 //   3. `new_size > policy.soo_capacity`.
 // The table will be attempted to be sampled.
-void ReserveEmptyNonAllocatedTableToFitNewSize(CommonFields& common,
-                                               const PolicyFunctions& policy,
-                                               size_t new_size);
-
-// The same as ReserveEmptyNonAllocatedTableToFitNewSize, but resizes to the
-// next valid capacity after `bucket_count`.
 void ReserveEmptyNonAllocatedTableToFitBucketCount(
     CommonFields& common, const PolicyFunctions& policy, size_t bucket_count);
 
-// Resizes empty non-allocated SOO table to NextCapacity(SooCapacity()) and
-// forces the table to be sampled.
-// SOO tables need to switch from SOO to heap in order to store the infoz.
-// Requires:
-//   1. `c.capacity() == SooCapacity()`.
-//   2. `c.empty()`.
-void GrowEmptySooTableToNextCapacityForceSampling(
-    CommonFields& common, const PolicyFunctions& policy);
-
 // Type erased version of raw_hash_set::rehash.
 void Rehash(CommonFields& common, const PolicyFunctions& policy, size_t n);
 
-// Type erased version of raw_hash_set::reserve for tables that have an
-// allocated backing array.
-//
-// Requires:
-//   1. `c.capacity() > policy.soo_capacity` OR `!c.empty()`.
-// Reserving already allocated tables is considered to be a rare case.
-void ReserveAllocatedTable(CommonFields& common, const PolicyFunctions& policy,
-                           size_t n);
-
 // Returns the optimal size for memcpy when transferring SOO slot.
 // Otherwise, returns the optimal size for memcpy SOO slot transfer
 // to SooSlotIndex().
@@ -1800,13 +1788,19 @@ constexpr size_t OptimalMemcpySizeForSooSlotTransfer(
   return 24;
 }
 
-// Resizes a full SOO table to the NextCapacity(SooCapacity()).
+// Resizes SOO table to the NextCapacity(SooCapacity()) and prepares insert for
+// the given new_hash. Returns the offset of the new element.
+// `soo_slot_ctrl` is the control byte of the SOO slot.
+// If soo_slot_ctrl is kEmpty
+//   1. The table must be empty.
+//   2. Table will be forced to be sampled.
 // All possible template combinations are defined in cc file to improve
 // compilation time.
 template <size_t SooSlotMemcpySize, bool TransferUsesMemcpy>
-void GrowFullSooTableToNextCapacity(CommonFields& common,
-                                    const PolicyFunctions& policy,
-                                    size_t soo_slot_hash);
+size_t GrowSooTableToNextCapacityAndPrepareInsert(CommonFields& common,
+                                                  const PolicyFunctions& policy,
+                                                  size_t new_hash,
+                                                  ctrl_t soo_slot_ctrl);
 
 // As `ResizeFullSooTableToNextCapacity`, except that we also force the SOO
 // table to be sampled. SOO tables need to switch from SOO to heap in order to
@@ -1826,10 +1820,6 @@ inline void PrepareInsertCommon(CommonFields& common) {
   common.maybe_increment_generation_on_insert();
 }
 
-// Like prepare_insert, but for the case of inserting into a full SOO table.
-size_t PrepareInsertAfterSoo(size_t hash, size_t slot_size,
-                             CommonFields& common);
-
 // ClearBackingArray clears the backing array, either modifying it in place,
 // or creating a new one based on the value of "reuse".
 // REQUIRES: c.capacity > 0
@@ -1842,10 +1832,10 @@ void EraseMetaOnly(CommonFields& c, size_t index, size_t slot_size);
 // For trivially relocatable types we use memcpy directly. This allows us to
 // share the same function body for raw_hash_set instantiations that have the
 // same slot size as long as they are relocatable.
+// Separate function for relocating single slot cause significant binary bloat.
 template <size_t SizeOfSlot>
-ABSL_ATTRIBUTE_NOINLINE void TransferRelocatable(void*, void* dst, void* src,
-                                                 size_t count) {
-  // TODO(b/382423690): Experiment with transfer and transfer_n.
+ABSL_ATTRIBUTE_NOINLINE void TransferNRelocatable(void*, void* dst, void* src,
+                                                  size_t count) {
   // TODO(b/382423690): Experiment with making specialization for power of 2 and
   // non power of 2. This would require passing the size of the slot.
   memcpy(dst, src, SizeOfSlot * count);
@@ -2288,7 +2278,7 @@ class raw_hash_set {
                                allocator_type(that.char_alloc_ref()))) {}
 
   raw_hash_set(const raw_hash_set& that, const allocator_type& a)
-      : raw_hash_set(GrowthToLowerboundCapacity(that.size()), that.hash_ref(),
+      : raw_hash_set(SizeToCapacity(that.size()), that.hash_ref(),
                      that.eq_ref(), a) {
     that.AssertNotDebugCapacity();
     const size_t size = that.size();
@@ -2331,7 +2321,7 @@ class raw_hash_set {
             // a full `insert`.
             const size_t hash = PolicyTraits::apply(
                 HashElement{hash_ref()}, PolicyTraits::element(that_slot));
-            FindInfo target = find_first_non_full_outofline(common(), hash);
+            FindInfo target = find_first_non_full(common(), hash);
             infoz().RecordInsert(hash, target.probe_length);
             offset = target.offset;
           } else {
@@ -2862,17 +2852,8 @@ class raw_hash_set {
   void rehash(size_t n) { Rehash(common(), GetPolicyFunctions(), n); }
 
   void reserve(size_t n) {
-    const size_t cap = capacity();
-    if (ABSL_PREDICT_TRUE(cap > DefaultCapacity() ||
-                          // !SooEnabled() implies empty(), so we can skip the
-                          // check for optimization.
-                          (SooEnabled() && !empty()))) {
-      ReserveAllocatedTable(common(), GetPolicyFunctions(), n);
-    } else {
-      if (ABSL_PREDICT_TRUE(n > DefaultCapacity())) {
-        ReserveEmptyNonAllocatedTableToFitNewSize(common(),
-                                                  GetPolicyFunctions(), n);
-      }
+    if (ABSL_PREDICT_TRUE(n > DefaultCapacity())) {
+      ReserveTableToFitNewSize(common(), GetPolicyFunctions(), n);
     }
   }
 
@@ -3005,7 +2986,7 @@ class raw_hash_set {
                                  H>::type
   AbslHashValue(H h, const raw_hash_set& s) {
     return H::combine(H::combine_unordered(std::move(h), s.begin(), s.end()),
-                      s.size());
+                      hash_internal::WeaklyMixedInteger{s.size()});
   }
 
   friend void swap(raw_hash_set& a,
@@ -3113,6 +3094,9 @@ class raw_hash_set {
     const h2_t h2 = H2(hash);
     const ctrl_t* ctrl = control();
     while (true) {
+#ifndef ABSL_HAVE_MEMORY_SANITIZER
+      absl::PrefetchToLocalCache(slot_array() + seq.offset());
+#endif
       Group g{ctrl + seq.offset()};
       for (uint32_t i : g.Match(h2)) {
         if (ABSL_PREDICT_TRUE(PolicyTraits::apply(
@@ -3199,20 +3183,6 @@ class raw_hash_set {
                                PolicyTraits::element(slot));
   }
 
-  void resize_full_soo_table_to_next_capacity() {
-    ABSL_SWISSTABLE_ASSERT(SooEnabled());
-    ABSL_SWISSTABLE_ASSERT(capacity() == SooCapacity());
-    ABSL_SWISSTABLE_ASSERT(!empty());
-    if constexpr (SooEnabled()) {
-      GrowFullSooTableToNextCapacity<PolicyTraits::transfer_uses_memcpy()
-                                         ? OptimalMemcpySizeForSooSlotTransfer(
-                                               sizeof(slot_type))
-                                         : 0,
-                                     PolicyTraits::transfer_uses_memcpy()>(
-          common(), GetPolicyFunctions(), hash_of(soo_slot()));
-    }
-  }
-
   // Casting directly from e.g. char* to slot_type* can cause compilation errors
   // on objective-C. This function converts to void* first, avoiding the issue.
   static slot_type* to_slot(void* buf) { return static_cast<slot_type*>(buf); }
@@ -3323,22 +3293,25 @@ class raw_hash_set {
 
   template <class K>
   std::pair<iterator, bool> find_or_prepare_insert_soo(const K& key) {
+    ctrl_t soo_slot_ctrl;
     if (empty()) {
-      if (should_sample_soo()) {
-        GrowEmptySooTableToNextCapacityForceSampling(common(),
-                                                     GetPolicyFunctions());
-      } else {
+      if (!should_sample_soo()) {
         common().set_full_soo();
         return {soo_iterator(), true};
       }
+      soo_slot_ctrl = ctrl_t::kEmpty;
     } else if (PolicyTraits::apply(EqualElement<K>{key, eq_ref()},
                                    PolicyTraits::element(soo_slot()))) {
       return {soo_iterator(), false};
     } else {
-      resize_full_soo_table_to_next_capacity();
-    }
-    const size_t index =
-        PrepareInsertAfterSoo(hash_ref()(key), sizeof(slot_type), common());
+      soo_slot_ctrl = static_cast<ctrl_t>(H2(hash_of(soo_slot())));
+    }
+    constexpr bool kUseMemcpy =
+        PolicyTraits::transfer_uses_memcpy() && SooEnabled();
+    size_t index = GrowSooTableToNextCapacityAndPrepareInsert<
+        kUseMemcpy ? OptimalMemcpySizeForSooSlotTransfer(sizeof(slot_type)) : 0,
+        kUseMemcpy>(common(), GetPolicyFunctions(), hash_ref()(key),
+                    soo_slot_ctrl);
     return {iterator_at(index), true};
   }
 
@@ -3351,6 +3324,9 @@ class raw_hash_set {
     const h2_t h2 = H2(hash);
     const ctrl_t* ctrl = control();
     while (true) {
+#ifndef ABSL_HAVE_MEMORY_SANITIZER
+      absl::PrefetchToLocalCache(slot_array() + seq.offset());
+#endif
       Group g{ctrl + seq.offset()};
       for (uint32_t i : g.Match(h2)) {
         if (ABSL_PREDICT_TRUE(PolicyTraits::apply(
@@ -3360,8 +3336,7 @@ class raw_hash_set {
       }
       auto mask_empty = g.MaskEmpty();
       if (ABSL_PREDICT_TRUE(mask_empty)) {
-        size_t target = seq.offset(
-            GetInsertionOffset(mask_empty, capacity(), hash, common().seed()));
+        size_t target = seq.offset(mask_empty.LowestBitSet());
         return {iterator_at(PrepareInsertNonSoo(common(), GetPolicyFunctions(),
                                                 hash,
                                                 FindInfo{target, seq.index()})),
@@ -3576,7 +3551,8 @@ class raw_hash_set {
     // TODO(b/397453582): Remove support for const hasher.
     return const_cast<std::remove_const_t<hasher>*>(&h->hash_ref());
   }
-  static void transfer_slots_fn(void* set, void* dst, void* src, size_t count) {
+  static void transfer_n_slots_fn(void* set, void* dst, void* src,
+                                  size_t count) {
     auto* src_slot = to_slot(src);
     auto* dst_slot = to_slot(dst);
 
@@ -3586,29 +3562,60 @@ class raw_hash_set {
     }
   }
 
-  // TODO(b/382423690): Type erase by GetKey + Hash for memcpyable types.
-  static size_t find_new_positions_and_transfer_slots_fn(CommonFields& common,
-                                                         ctrl_t* old_ctrl,
-                                                         void* old_slots,
-                                                         size_t old_capacity) {
+  // TODO(b/382423690): Try to type erase entire function or at least type erase
+  // by GetKey + Hash for memcpyable types.
+  // TODO(b/382423690): Try to type erase for big slots: sizeof(slot_type) > 16.
+  static void transfer_unprobed_elements_to_next_capacity_fn(
+      CommonFields& common, const ctrl_t* old_ctrl, void* old_slots,
+      void* probed_storage,
+      void (*encode_probed_element)(void* probed_storage, h2_t h2,
+                                    size_t source_offset, size_t h1)) {
+    const size_t new_capacity = common.capacity();
+    const size_t old_capacity = PreviousCapacity(new_capacity);
+    ABSL_ASSUME(old_capacity + 1 >= Group::kWidth);
+    ABSL_ASSUME((old_capacity + 1) % Group::kWidth == 0);
+
     auto* set = reinterpret_cast<raw_hash_set*>(&common);
-    slot_type* new_slots = set->slot_array();
     slot_type* old_slots_ptr = to_slot(old_slots);
-    const auto insert_slot = [&](slot_type* slot) {
-      size_t hash = PolicyTraits::apply(HashElement{set->hash_ref()},
-                                        PolicyTraits::element(slot));
-      auto target = find_first_non_full(common, hash);
-      SetCtrl(common, target.offset, H2(hash), sizeof(slot_type));
-      set->transfer(new_slots + target.offset, slot);
-      return target.probe_length;
-    };
-    size_t total_probe_length = 0;
-    for (size_t i = 0; i < old_capacity; ++i) {
-      if (IsFull(old_ctrl[i])) {
-        total_probe_length += insert_slot(old_slots_ptr + i);
+    ctrl_t* new_ctrl = common.control();
+    slot_type* new_slots = set->slot_array();
+
+    const PerTableSeed seed = common.seed();
+
+    for (size_t group_index = 0; group_index < old_capacity;
+         group_index += Group::kWidth) {
+      GroupFullEmptyOrDeleted old_g(old_ctrl + group_index);
+      std::memset(new_ctrl + group_index, static_cast<int8_t>(ctrl_t::kEmpty),
+                  Group::kWidth);
+      std::memset(new_ctrl + group_index + old_capacity + 1,
+                  static_cast<int8_t>(ctrl_t::kEmpty), Group::kWidth);
+      // TODO(b/382423690): try to type erase everything outside of the loop.
+      // We will share a lot of code in expense of one function call per group.
+      for (auto in_fixed_group_index : old_g.MaskFull()) {
+        size_t old_index = group_index + in_fixed_group_index;
+        slot_type* old_slot = old_slots_ptr + old_index;
+        // TODO(b/382423690): try to avoid entire hash calculation since we need
+        // only one new bit of h1.
+        size_t hash = set->hash_of(old_slot);
+        size_t h1 = H1(hash, seed);
+        h2_t h2 = H2(hash);
+        size_t new_index = TryFindNewIndexWithoutProbing(
+            h1, old_index, old_capacity, new_ctrl, new_capacity);
+        // Note that encode_probed_element is allowed to use old_ctrl buffer
+        // till and included the old_index.
+        if (ABSL_PREDICT_FALSE(new_index == kProbedElementIndexSentinel)) {
+          encode_probed_element(probed_storage, h2, old_index, h1);
+          continue;
+        }
+        ABSL_SWISSTABLE_ASSERT((new_index & old_capacity) <= old_index);
+        ABSL_SWISSTABLE_ASSERT(IsEmpty(new_ctrl[new_index]));
+        new_ctrl[new_index] = static_cast<ctrl_t>(h2);
+        auto* new_slot = new_slots + new_index;
+        SanitizerUnpoisonMemoryRegion(new_slot, sizeof(slot_type));
+        set->transfer(new_slot, old_slot);
+        SanitizerPoisonMemoryRegion(old_slot, sizeof(slot_type));
       }
     }
-    return total_probe_length;
   }
 
   static const PolicyFunctions& GetPolicyFunctions() {
@@ -3636,13 +3643,13 @@ class raw_hash_set {
                                 : &raw_hash_set::get_hash_ref_fn,
         PolicyTraits::template get_hash_slot_fn<hasher>(),
         PolicyTraits::transfer_uses_memcpy()
-            ? TransferRelocatable<sizeof(slot_type)>
-            : &raw_hash_set::transfer_slots_fn,
+            ? TransferNRelocatable<sizeof(slot_type)>
+            : &raw_hash_set::transfer_n_slots_fn,
         std::is_empty_v<Alloc> ? &GetRefForEmptyClass
                                : &raw_hash_set::get_char_alloc_ref_fn,
         &AllocateBackingArray<kBackingArrayAlignment, CharAlloc>,
         &DeallocateBackingArray<kBackingArrayAlignment, CharAlloc>,
-        &raw_hash_set::find_new_positions_and_transfer_slots_fn};
+        &raw_hash_set::transfer_unprobed_elements_to_next_capacity_fn};
     return value;
   }
 
@@ -3784,17 +3791,17 @@ struct HashtableDebugAccess<Set, absl::void_t<typename Set::raw_hash_set>> {
 
 // Extern template instantiations reduce binary size and linker input size.
 // Function definition is in raw_hash_set.cc.
-extern template void GrowFullSooTableToNextCapacity<0, false>(
-    CommonFields&, const PolicyFunctions&, size_t);
-extern template void GrowFullSooTableToNextCapacity<1, true>(
-    CommonFields&, const PolicyFunctions&, size_t);
-extern template void GrowFullSooTableToNextCapacity<4, true>(
-    CommonFields&, const PolicyFunctions&, size_t);
-extern template void GrowFullSooTableToNextCapacity<8, true>(
-    CommonFields&, const PolicyFunctions&, size_t);
+extern template size_t GrowSooTableToNextCapacityAndPrepareInsert<0, false>(
+    CommonFields&, const PolicyFunctions&, size_t, ctrl_t);
+extern template size_t GrowSooTableToNextCapacityAndPrepareInsert<1, true>(
+    CommonFields&, const PolicyFunctions&, size_t, ctrl_t);
+extern template size_t GrowSooTableToNextCapacityAndPrepareInsert<4, true>(
+    CommonFields&, const PolicyFunctions&, size_t, ctrl_t);
+extern template size_t GrowSooTableToNextCapacityAndPrepareInsert<8, true>(
+    CommonFields&, const PolicyFunctions&, size_t, ctrl_t);
 #if UINTPTR_MAX == UINT64_MAX
-extern template void GrowFullSooTableToNextCapacity<16, true>(
-    CommonFields&, const PolicyFunctions&, size_t);
+extern template size_t GrowSooTableToNextCapacityAndPrepareInsert<16, true>(
+    CommonFields&, const PolicyFunctions&, size_t, ctrl_t);
 #endif
 
 }  // namespace container_internal
diff --git a/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set_benchmark.cc b/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set_benchmark.cc
index 424b72cffca6ec..b593283c66e6d3 100644
--- a/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set_benchmark.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set_benchmark.cc
@@ -418,7 +418,17 @@ void BM_ReserveIntTable(benchmark::State& state) {
     }
   }
 }
-BENCHMARK(BM_ReserveIntTable)->Range(1, 64);
+BENCHMARK(BM_ReserveIntTable)
+    ->Arg(1)
+    ->Arg(2)
+    ->Arg(4)
+    ->Arg(8)
+    ->Arg(16)
+    ->Arg(32)
+    ->Arg(64)
+    ->Arg(128)
+    ->Arg(256)
+    ->Arg(512);
 
 void BM_ReserveStringTable(benchmark::State& state) {
   constexpr size_t kBatchSize = 1024;
@@ -437,7 +447,17 @@ void BM_ReserveStringTable(benchmark::State& state) {
     }
   }
 }
-BENCHMARK(BM_ReserveStringTable)->Range(1, 64);
+BENCHMARK(BM_ReserveStringTable)
+    ->Arg(1)
+    ->Arg(2)
+    ->Arg(4)
+    ->Arg(8)
+    ->Arg(16)
+    ->Arg(32)
+    ->Arg(64)
+    ->Arg(128)
+    ->Arg(256)
+    ->Arg(512);
 
 // Like std::iota, except that ctrl_t doesn't support operator++.
 template <typename CtrlIter>
diff --git a/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set_probe_benchmark.cc b/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set_probe_benchmark.cc
index 8f36305d1b654f..e56648f3bf9d93 100644
--- a/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set_probe_benchmark.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set_probe_benchmark.cc
@@ -245,13 +245,28 @@ struct PtrIdentity {
   }
 };
 
-constexpr char kStringFormat[] = "/path/to/file/name-%07d-of-9999999.txt";
+enum class StringSize { kSmall, kMedium, kLarge, kExtraLarge };
+constexpr char kStringFormat[] = "%s/name-%07d-of-9999999.txt";
 
-template <bool small>
+template <StringSize size>
 struct String {
   std::string value;
   static std::string Make(uint32_t v) {
-    return {small ? absl::StrCat(v) : absl::StrFormat(kStringFormat, v)};
+    switch (size) {
+      case StringSize::kSmall:
+        return absl::StrCat(v);
+      case StringSize::kMedium:  // < 32 bytes
+        return absl::StrFormat(kStringFormat, "/path", v);
+      case StringSize::kLarge:  // 33-64 bytes
+        return absl::StrFormat(kStringFormat, "/path/to/file", v);
+      case StringSize::kExtraLarge:  // > 64 bytes
+        return absl::StrFormat(kStringFormat,
+                               "/path/to/a/very/long/file/name/so/that/total/"
+                               "length/is/larger/than/64/bytes",
+                               v);
+      default:
+        return "";
+    }
   }
 };
 
@@ -285,10 +300,9 @@ struct Sequential<Ptr<Align>*> {
   mutable uintptr_t current = PointerForAlignment<Align>();
 };
 
-
-template <bool small>
-struct Sequential<String<small>> {
-  std::string operator()() const { return String<small>::Make(current++); }
+template <StringSize size>
+struct Sequential<String<size>> {
+  std::string operator()() const { return String<size>::Make(current++); }
   mutable uint32_t current = 0;
 };
 
@@ -389,10 +403,10 @@ struct Random<PtrIdentity<Align>, Dist> {
   }
 };
 
-template <class Dist, bool small>
-struct Random<String<small>, Dist> {
+template <class Dist, StringSize size>
+struct Random<String<size>, Dist> {
   std::string operator()() const {
-    return String<small>::Make(Random<uint32_t, Dist>{}());
+    return String<size>::Make(Random<uint32_t, Dist>{}());
   }
 };
 
@@ -421,9 +435,20 @@ std::string Name(PtrIdentity<Align>*) {
   return absl::StrCat("PtrIdentity", Align);
 }
 
-template <bool small>
-std::string Name(String<small>*) {
-  return small ? "StrS" : "StrL";
+template <StringSize size>
+std::string Name(String<size>*) {
+  switch (size) {
+    case StringSize::kSmall:
+      return "StrS";
+    case StringSize::kMedium:
+      return "StrM";
+    case StringSize::kLarge:
+      return "StrL";
+    case StringSize::kExtraLarge:
+      return "StrXL";
+    default:
+      return "";
+  }
 }
 
 template <class T, class U>
@@ -543,12 +568,18 @@ int main(int argc, char** argv) {
   RunForType<PtrIdentity<32>>(results);
   RunForType<PtrIdentity<64>>(results);
   RunForType<std::pair<uint32_t, uint32_t>>(results);
-  RunForType<String<true>>(results);
-  RunForType<String<false>>(results);
-  RunForType<std::pair<uint64_t, String<true>>>(results);
-  RunForType<std::pair<String<true>, uint64_t>>(results);
-  RunForType<std::pair<uint64_t, String<false>>>(results);
-  RunForType<std::pair<String<false>, uint64_t>>(results);
+  RunForType<String<StringSize::kSmall>>(results);
+  RunForType<String<StringSize::kMedium>>(results);
+  RunForType<String<StringSize::kLarge>>(results);
+  RunForType<String<StringSize::kExtraLarge>>(results);
+  RunForType<std::pair<uint64_t, String<StringSize::kSmall>>>(results);
+  RunForType<std::pair<String<StringSize::kSmall>, uint64_t>>(results);
+  RunForType<std::pair<uint64_t, String<StringSize::kMedium>>>(results);
+  RunForType<std::pair<String<StringSize::kMedium>, uint64_t>>(results);
+  RunForType<std::pair<uint64_t, String<StringSize::kLarge>>>(results);
+  RunForType<std::pair<String<StringSize::kLarge>, uint64_t>>(results);
+  RunForType<std::pair<uint64_t, String<StringSize::kExtraLarge>>>(results);
+  RunForType<std::pair<String<StringSize::kExtraLarge>, uint64_t>>(results);
 
   switch (output()) {
     case OutputStyle::kRegular:
diff --git a/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set_resize_impl.h b/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set_resize_impl.h
new file mode 100644
index 00000000000000..149d9e825e5cd8
--- /dev/null
+++ b/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set_resize_impl.h
@@ -0,0 +1,80 @@
+// Copyright 2025 The Abseil Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// This is a private implementation detail of resize algorithm of
+// raw_hash_set. It is exposed in a separate file for testing purposes.
+
+#ifndef ABSL_CONTAINER_INTERNAL_RAW_HASH_SET_RESIZE_IMPL_H_
+#define ABSL_CONTAINER_INTERNAL_RAW_HASH_SET_RESIZE_IMPL_H_
+
+#include <cstddef>
+#include <cstdint>
+
+#include "absl/base/config.h"
+
+namespace absl {
+ABSL_NAMESPACE_BEGIN
+namespace container_internal {
+
+// Encoding for probed elements used for smaller tables.
+// Data is encoded into single integer.
+// Storage format for 4 bytes:
+// - 7 bits for h2
+// - 12 bits for source_offset
+// - 13 bits for h1
+// Storage format for 8 bytes:
+// - 7 bits for h2
+// - 28 bits for source_offset
+// - 29 bits for h1
+// Storage format for 16 bytes:
+// - 7 bits for h2
+// - 57 bits for source_offset
+// - 58 bits for h1
+template <typename IntType, size_t kTotalBits>
+struct ProbedItemImpl {
+  static constexpr IntType kH2Bits = 7;
+
+  static constexpr IntType kMaxOldBits = (kTotalBits - kH2Bits) / 2;
+  static constexpr IntType kMaxOldCapacity = (IntType{1} << kMaxOldBits) - 1;
+
+  // We always have one bit more for h1.
+  static constexpr IntType kMaxNewBits = kMaxOldBits + 1;
+  static constexpr IntType kMaxNewCapacity = (IntType{1} << kMaxNewBits) - 1;
+
+  static constexpr IntType kH2Shift = (kTotalBits - kH2Bits);
+  static_assert(kMaxNewBits + kMaxOldBits + kH2Bits == kTotalBits);
+
+  ProbedItemImpl() = default;
+  ProbedItemImpl(uint8_t h2_arg, size_t source_offset_arg, size_t h1_arg)
+      : h2(h2_arg),
+        source_offset(static_cast<IntType>(source_offset_arg)),
+        h1(static_cast<IntType>(h1_arg)) {}
+
+  IntType h2 : kH2Bits;
+  IntType source_offset : kMaxOldBits;
+  IntType h1 : kMaxNewBits;
+};
+
+using ProbedItem4Bytes = ProbedItemImpl<uint32_t, 32>;
+static_assert(sizeof(ProbedItem4Bytes) == 4);
+using ProbedItem8Bytes = ProbedItemImpl<uint64_t, 64>;
+static_assert(sizeof(ProbedItem8Bytes) == 8);
+using ProbedItem16Bytes = ProbedItemImpl<uint64_t, 7 + 57 + 58>;
+static_assert(sizeof(ProbedItem16Bytes) == 16);
+
+}  // namespace container_internal
+ABSL_NAMESPACE_END
+}  // namespace absl
+
+#endif  // ABSL_CONTAINER_INTERNAL_RAW_HASH_SET_RESIZE_IMPL_H_
diff --git a/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set_resize_impl_test.cc b/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set_resize_impl_test.cc
new file mode 100644
index 00000000000000..5020fca18057ec
--- /dev/null
+++ b/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set_resize_impl_test.cc
@@ -0,0 +1,66 @@
+// Copyright 2025 The Abseil Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "absl/container/internal/raw_hash_set_resize_impl.h"
+
+#include <cstddef>
+#include <cstdint>
+#include <limits>
+
+#include "gtest/gtest.h"
+#include "absl/base/config.h"
+
+namespace absl {
+ABSL_NAMESPACE_BEGIN
+namespace container_internal {
+namespace {
+
+constexpr size_t kSmallSourceOffset = 17;
+constexpr size_t kSmallH1 = 25;
+
+template <class Encoder>
+class EncoderTest : public testing::Test {};
+
+using ProbedItemTypes =
+    ::testing::Types<ProbedItem4Bytes, ProbedItem8Bytes, ProbedItem16Bytes>;
+TYPED_TEST_SUITE(EncoderTest, ProbedItemTypes);
+
+TYPED_TEST(EncoderTest, EncodeDecodeSmall) {
+  using ProbedItem = TypeParam;
+  for (uint8_t h2 = 0; h2 < 128; ++h2) {
+    ProbedItem item(h2, kSmallSourceOffset, kSmallH1);
+    EXPECT_EQ(item.h2, h2);
+    EXPECT_EQ(item.source_offset, kSmallSourceOffset);
+    EXPECT_EQ(item.h1 & ProbedItem::kMaxNewCapacity, kSmallH1);
+  }
+}
+
+TYPED_TEST(EncoderTest, EncodeDecodeMax) {
+  using ProbedItem = TypeParam;
+  for (uint8_t h2 = 0; h2 < 128; ++h2) {
+    size_t source_offset = static_cast<size_t>(std::min<uint64_t>(
+        ProbedItem::kMaxOldCapacity, (std::numeric_limits<size_t>::max)()));
+    size_t h1 = static_cast<size_t>(std::min<uint64_t>(
+        ProbedItem::kMaxNewCapacity, (std::numeric_limits<size_t>::max)()));
+    ProbedItem item(h2, source_offset, h1);
+    EXPECT_EQ(item.h2, h2);
+    EXPECT_EQ(item.source_offset, source_offset);
+    EXPECT_EQ(item.h1 & ProbedItem::kMaxNewCapacity, h1);
+  }
+}
+
+}  // namespace
+}  // namespace container_internal
+ABSL_NAMESPACE_END
+}  // namespace absl
diff --git a/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set_test.cc b/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set_test.cc
index 41cc6ec74fa7f2..235926946bfaf4 100644
--- a/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set_test.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/container/internal/raw_hash_set_test.cc
@@ -14,8 +14,6 @@
 
 #include "absl/container/internal/raw_hash_set.h"
 
-#include <sys/types.h>
-
 #include <algorithm>
 #include <array>
 #include <atomic>
@@ -60,6 +58,7 @@
 #include "absl/container/internal/hashtable_control_bytes.h"
 #include "absl/container/internal/hashtable_debug.h"
 #include "absl/container/internal/hashtablez_sampler.h"
+#include "absl/container/internal/raw_hash_set_resize_impl.h"
 #include "absl/container/internal/test_allocator.h"
 #include "absl/container/internal/test_instance_tracker.h"
 #include "absl/container/node_hash_set.h"
@@ -80,8 +79,8 @@ namespace container_internal {
 
 struct RawHashSetTestOnlyAccess {
   template <typename C>
-  static auto GetCommon(const C& c) -> decltype(c.common()) {
-    return c.common();
+  static auto GetCommon(C&& c) -> decltype(std::forward<C>(c).common()) {
+    return std::forward<C>(c).common();
   }
   template <typename C>
   static auto GetSlots(const C& c) -> decltype(c.slot_array()) {
@@ -282,9 +281,14 @@ TEST(Util, NormalizeCapacity) {
 TEST(Util, GrowthAndCapacity) {
   // Verify that GrowthToCapacity gives the minimum capacity that has enough
   // growth.
-  for (size_t growth = 0; growth < 10000; ++growth) {
+  EXPECT_EQ(SizeToCapacity(0), 0);
+  EXPECT_EQ(SizeToCapacity(1), 1);
+  EXPECT_EQ(SizeToCapacity(2), 3);
+  EXPECT_EQ(SizeToCapacity(3), 3);
+  for (size_t growth = 1; growth < 10000; ++growth) {
     SCOPED_TRACE(growth);
-    size_t capacity = NormalizeCapacity(GrowthToLowerboundCapacity(growth));
+    size_t capacity = SizeToCapacity(growth);
+    ASSERT_TRUE(IsValidCapacity(capacity));
     // The capacity is large enough for `growth`.
     EXPECT_THAT(CapacityToGrowth(capacity), Ge(growth));
     // For (capacity+1) < kWidth, growth should equal capacity.
@@ -304,8 +308,8 @@ TEST(Util, GrowthAndCapacity) {
     SCOPED_TRACE(capacity);
     size_t growth = CapacityToGrowth(capacity);
     EXPECT_THAT(growth, Lt(capacity));
-    EXPECT_LE(GrowthToLowerboundCapacity(growth), capacity);
-    EXPECT_EQ(NormalizeCapacity(GrowthToLowerboundCapacity(growth)), capacity);
+    EXPECT_EQ(SizeToCapacity(growth), capacity);
+    EXPECT_EQ(NormalizeCapacity(SizeToCapacity(growth)), capacity);
   }
 }
 
@@ -2710,7 +2714,7 @@ std::vector<int> OrderOfIteration(const T& t) {
 // in seed.
 void GenerateIrrelevantSeeds(int cnt) {
   for (int i = cnt % 17; i > 0; --i) {
-    NextSeedBaseNumber();
+    NextSeed();
   }
 }
 
@@ -3177,6 +3181,20 @@ TYPED_TEST(SanitizerTest, PoisoningUnused) {
   }
 }
 
+TYPED_TEST(SanitizerTest, PoisoningUnusedOnGrowth) {
+  TypeParam t;
+  for (int64_t i = 0; i < 100; ++i) {
+    t.insert(i);
+
+    int64_t* slots = RawHashSetTestOnlyAccess::GetSlots(t);
+    int poisoned = 0;
+    for (size_t i = 0; i < t.capacity(); ++i) {
+      poisoned += static_cast<int>(__asan_address_is_poisoned(slots + i));
+    }
+    ASSERT_EQ(poisoned, t.capacity() - t.size());
+  }
+}
+
 // TODO(b/289225379): poison inline space when empty SOO.
 TEST(Sanitizer, PoisoningOnErase) {
   NonSooIntTable t;
@@ -4088,7 +4106,7 @@ TEST(Table, MaxValidSize) {
         ASSERT_FALSE(IsAboveValidSize(size_t{1} << 40, slot_size));
         ASSERT_GE(max_size, uint64_t{1} << 40);
       }
-      ASSERT_LT(NormalizeCapacity(GrowthToLowerboundCapacity(max_size)),
+      ASSERT_LT(SizeToCapacity(max_size),
                 uint64_t{1} << HashtableSize::kSizeBitCount);
       ASSERT_LT(absl::uint128(max_size) * slot_size, uint64_t{1} << 63);
     }
@@ -4101,8 +4119,7 @@ TEST(Table, MaxValidSize) {
     ASSERT_FALSE(IsAboveValidSize</*kSizeOfSizeT=*/4>(max_size, slot_size));
     ASSERT_TRUE(IsAboveValidSize</*kSizeOfSizeT=*/4>(max_size + 1, slot_size));
     ASSERT_LT(max_size, 1 << 30);
-    size_t max_capacity =
-        NormalizeCapacity(GrowthToLowerboundCapacity(max_size));
+    size_t max_capacity = SizeToCapacity(max_size);
     ASSERT_LT(max_capacity, (size_t{1} << 31) / slot_size);
     ASSERT_GT(max_capacity, (1 << 29) / slot_size);
     ASSERT_LT(max_capacity * slot_size, size_t{1} << 31);
@@ -4124,9 +4141,13 @@ TEST(Table, MaxSizeOverflow) {
                             "Hash table size overflow");
   EXPECT_DEATH_IF_SUPPORTED(t.rehash(slightly_overflow),
                             "Hash table size overflow");
+  IntTable non_empty_table;
+  non_empty_table.insert(0);
+  EXPECT_DEATH_IF_SUPPORTED(non_empty_table.reserve(slightly_overflow),
+                            "Hash table size overflow");
 }
 
-// TODO(b/397453582): Remove support for const hasher and ermove this test.
+// TODO(b/397453582): Remove support for const hasher and remove this test.
 TEST(Table, ConstLambdaHash) {
   int64_t multiplier = 17;
   // Make sure that code compiles and work OK with non-empty hasher with const
@@ -4147,6 +4168,64 @@ TEST(Table, ConstLambdaHash) {
   EXPECT_EQ(t.find(3), t.end());
 }
 
+struct ConstUint8Hash {
+  size_t operator()(uint8_t) const { return *value; }
+  size_t* value;
+};
+
+// This test is imitating growth of a very big table and triggers all buffer
+// overflows.
+// We try to insert all elements into the first probe group.
+// So the resize codepath in test does the following:
+// 1. Insert 16 elements into the first probe group. No other elements will be
+//    inserted into the first probe group.
+// 2. There will be enough elements to fill up the local buffer even for
+//    encoding with 4 bytes.
+// 3. After local buffer is full, we will fill up the control buffer till
+//    some point.
+// 4. Then a few times we will extend control buffer end.
+// 5. Finally we will catch up and go to overflow codepath.
+TEST(Table, GrowExtremelyLargeTable) {
+  constexpr size_t kTargetCapacity =
+#if defined(__wasm__) || defined(__asmjs__)
+      NextCapacity(ProbedItem4Bytes::kMaxNewCapacity);  // OOMs on WASM.
+#else
+      NextCapacity(ProbedItem8Bytes::kMaxNewCapacity);
+#endif
+
+  size_t hash = 0;
+  // In order to save memory we use 1 byte slot.
+  // There are not enough different values to achieve big capacity, so we
+  // artificially update growth info to force resize.
+  absl::flat_hash_set<uint8_t, ConstUint8Hash> t(63, ConstUint8Hash{&hash});
+  CommonFields& common = RawHashSetTestOnlyAccess::GetCommon(t);
+  // Assign value to the seed, so that H1 is always 0.
+  // That helps to test all buffer overflows in GrowToNextCapacity.
+  hash = common.seed().seed() << 7;
+  ASSERT_EQ(H1(t.hash_function()(75), common.seed()), 0);
+  uint8_t inserted_till = 210;
+  for (uint8_t i = 0; i < inserted_till; ++i) {
+    t.insert(i);
+  }
+  for (uint8_t i = 0; i < inserted_till; ++i) {
+    ASSERT_TRUE(t.contains(i));
+  }
+
+  for (size_t cap = t.capacity(); cap < kTargetCapacity;
+       cap = NextCapacity(cap)) {
+    ASSERT_EQ(t.capacity(), cap);
+    // Update growth info to force resize on the next insert.
+    common.growth_info().OverwriteManyEmptyAsFull(CapacityToGrowth(cap) -
+                                                  t.size());
+    t.insert(inserted_till++);
+    ASSERT_EQ(t.capacity(), NextCapacity(cap));
+    for (uint8_t i = 0; i < inserted_till; ++i) {
+      ASSERT_TRUE(t.contains(i));
+    }
+  }
+  EXPECT_EQ(t.capacity(), kTargetCapacity);
+}
+
 }  // namespace
 }  // namespace container_internal
 ABSL_NAMESPACE_END
diff --git a/deps/v8/third_party/abseil-cpp/absl/container/node_hash_map.h b/deps/v8/third_party/abseil-cpp/absl/container/node_hash_map.h
index 127c893739089f..8aed18b2e6154b 100644
--- a/deps/v8/third_party/abseil-cpp/absl/container/node_hash_map.h
+++ b/deps/v8/third_party/abseil-cpp/absl/container/node_hash_map.h
@@ -99,6 +99,11 @@ class NodeHashMapPolicy;
 // In most cases `T` needs only to provide the `absl_container_hash`. In this
 // case `std::equal_to<void>` will be used instead of `eq` part.
 //
+// PERFORMANCE WARNING: Erasure & sparsity can negatively affect performance:
+//  * Iteration takes O(capacity) time, not O(size).
+//  * erase() slows down begin() and ++iterator.
+//  * Capacity only shrinks on rehash() or clear() -- not on erase().
+//
 // Example:
 //
 //   // Create a node hash map of three strings (that map to strings)
diff --git a/deps/v8/third_party/abseil-cpp/absl/container/node_hash_set.h b/deps/v8/third_party/abseil-cpp/absl/container/node_hash_set.h
index cffa50ec776742..6240e2d91543db 100644
--- a/deps/v8/third_party/abseil-cpp/absl/container/node_hash_set.h
+++ b/deps/v8/third_party/abseil-cpp/absl/container/node_hash_set.h
@@ -97,6 +97,11 @@ struct NodeHashSetPolicy;
 // In most cases `T` needs only to provide the `absl_container_hash`. In this
 // case `std::equal_to<void>` will be used instead of `eq` part.
 //
+// PERFORMANCE WARNING: Erasure & sparsity can negatively affect performance:
+//  * Iteration takes O(capacity) time, not O(size).
+//  * erase() slows down begin() and ++iterator.
+//  * Capacity only shrinks on rehash() or clear() -- not on erase().
+//
 // Example:
 //
 //   // Create a node hash set of three strings
diff --git a/deps/v8/third_party/abseil-cpp/absl/copts/GENERATED_AbseilCopts.cmake b/deps/v8/third_party/abseil-cpp/absl/copts/GENERATED_AbseilCopts.cmake
index b88b202b1c97fc..cc0f4bb2d9375d 100644
--- a/deps/v8/third_party/abseil-cpp/absl/copts/GENERATED_AbseilCopts.cmake
+++ b/deps/v8/third_party/abseil-cpp/absl/copts/GENERATED_AbseilCopts.cmake
@@ -97,6 +97,7 @@ list(APPEND ABSL_LLVM_FLAGS
     "-Winvalid-constexpr"
     "-Wliteral-conversion"
     "-Wmissing-declarations"
+    "-Wnullability-completeness"
     "-Woverlength-strings"
     "-Wpointer-arith"
     "-Wself-assign"
@@ -106,6 +107,7 @@ list(APPEND ABSL_LLVM_FLAGS
     "-Wstring-conversion"
     "-Wtautological-overlap-compare"
     "-Wtautological-unsigned-zero-compare"
+    "-Wthread-safety"
     "-Wundef"
     "-Wuninitialized"
     "-Wunreachable-code"
@@ -137,6 +139,7 @@ list(APPEND ABSL_LLVM_TEST_FLAGS
     "-Winvalid-constexpr"
     "-Wliteral-conversion"
     "-Wmissing-declarations"
+    "-Wnullability-completeness"
     "-Woverlength-strings"
     "-Wpointer-arith"
     "-Wself-assign"
@@ -144,6 +147,7 @@ list(APPEND ABSL_LLVM_TEST_FLAGS
     "-Wstring-conversion"
     "-Wtautological-overlap-compare"
     "-Wtautological-unsigned-zero-compare"
+    "-Wthread-safety"
     "-Wundef"
     "-Wuninitialized"
     "-Wunreachable-code"
diff --git a/deps/v8/third_party/abseil-cpp/absl/copts/GENERATED_copts.bzl b/deps/v8/third_party/abseil-cpp/absl/copts/GENERATED_copts.bzl
index 8f3b9a48d862ef..35319f08afeb20 100644
--- a/deps/v8/third_party/abseil-cpp/absl/copts/GENERATED_copts.bzl
+++ b/deps/v8/third_party/abseil-cpp/absl/copts/GENERATED_copts.bzl
@@ -98,6 +98,7 @@ ABSL_LLVM_FLAGS = [
     "-Winvalid-constexpr",
     "-Wliteral-conversion",
     "-Wmissing-declarations",
+    "-Wnullability-completeness",
     "-Woverlength-strings",
     "-Wpointer-arith",
     "-Wself-assign",
@@ -107,6 +108,7 @@ ABSL_LLVM_FLAGS = [
     "-Wstring-conversion",
     "-Wtautological-overlap-compare",
     "-Wtautological-unsigned-zero-compare",
+    "-Wthread-safety",
     "-Wundef",
     "-Wuninitialized",
     "-Wunreachable-code",
@@ -138,6 +140,7 @@ ABSL_LLVM_TEST_FLAGS = [
     "-Winvalid-constexpr",
     "-Wliteral-conversion",
     "-Wmissing-declarations",
+    "-Wnullability-completeness",
     "-Woverlength-strings",
     "-Wpointer-arith",
     "-Wself-assign",
@@ -145,6 +148,7 @@ ABSL_LLVM_TEST_FLAGS = [
     "-Wstring-conversion",
     "-Wtautological-overlap-compare",
     "-Wtautological-unsigned-zero-compare",
+    "-Wthread-safety",
     "-Wundef",
     "-Wuninitialized",
     "-Wunreachable-code",
diff --git a/deps/v8/third_party/abseil-cpp/absl/copts/copts.py b/deps/v8/third_party/abseil-cpp/absl/copts/copts.py
index 61f3a84673092d..941528e0ba4173 100644
--- a/deps/v8/third_party/abseil-cpp/absl/copts/copts.py
+++ b/deps/v8/third_party/abseil-cpp/absl/copts/copts.py
@@ -57,6 +57,7 @@
     "-Winvalid-constexpr",
     "-Wliteral-conversion",
     "-Wmissing-declarations",
+    "-Wnullability-completeness",
     "-Woverlength-strings",
     "-Wpointer-arith",
     "-Wself-assign",
@@ -66,6 +67,7 @@
     "-Wstring-conversion",
     "-Wtautological-overlap-compare",
     "-Wtautological-unsigned-zero-compare",
+    "-Wthread-safety",
     "-Wundef",
     "-Wuninitialized",
     "-Wunreachable-code",
diff --git a/deps/v8/third_party/abseil-cpp/absl/debugging/internal/decode_rust_punycode.cc b/deps/v8/third_party/abseil-cpp/absl/debugging/internal/decode_rust_punycode.cc
index 43b46bf940b112..6652dc221a3bd6 100644
--- a/deps/v8/third_party/abseil-cpp/absl/debugging/internal/decode_rust_punycode.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/debugging/internal/decode_rust_punycode.cc
@@ -172,7 +172,7 @@ bool ScanNextDelta(const char*& punycode_begin, const char* const punycode_end,
 
 }  // namespace
 
-absl::Nullable<char*> DecodeRustPunycode(DecodeRustPunycodeOptions options) {
+char* absl_nullable DecodeRustPunycode(DecodeRustPunycodeOptions options) {
   const char* punycode_begin = options.punycode_begin;
   const char* const punycode_end = options.punycode_end;
   char* const out_begin = options.out_begin;
diff --git a/deps/v8/third_party/abseil-cpp/absl/debugging/internal/decode_rust_punycode.h b/deps/v8/third_party/abseil-cpp/absl/debugging/internal/decode_rust_punycode.h
index 0ae53ff31ec18e..b1b1c97feea9ba 100644
--- a/deps/v8/third_party/abseil-cpp/absl/debugging/internal/decode_rust_punycode.h
+++ b/deps/v8/third_party/abseil-cpp/absl/debugging/internal/decode_rust_punycode.h
@@ -46,7 +46,7 @@ struct DecodeRustPunycodeOptions {
 // DecodeRustPunycode is async-signal-safe with bounded runtime and a small
 // stack footprint, making it suitable for use in demangling Rust symbol names
 // from a signal handler.
-absl::Nullable<char*> DecodeRustPunycode(DecodeRustPunycodeOptions options);
+char* absl_nullable DecodeRustPunycode(DecodeRustPunycodeOptions options);
 
 }  // namespace debugging_internal
 ABSL_NAMESPACE_END
diff --git a/deps/v8/third_party/abseil-cpp/absl/debugging/internal/stacktrace_aarch64-inl.inc b/deps/v8/third_party/abseil-cpp/absl/debugging/internal/stacktrace_aarch64-inl.inc
index d1f67f189a603a..d396c58844cfd7 100644
--- a/deps/v8/third_party/abseil-cpp/absl/debugging/internal/stacktrace_aarch64-inl.inc
+++ b/deps/v8/third_party/abseil-cpp/absl/debugging/internal/stacktrace_aarch64-inl.inc
@@ -102,7 +102,8 @@ static bool InsideSignalStack(void** ptr, const StackInfo* stack_info) {
 // "STRICT_UNWINDING") to reduce the chance that a bad pointer is returned.
 template<bool STRICT_UNWINDING, bool WITH_CONTEXT>
 ABSL_ATTRIBUTE_NO_SANITIZE_ADDRESS  // May read random elements from stack.
-ABSL_ATTRIBUTE_NO_SANITIZE_MEMORY  // May read random elements from stack.
+ABSL_ATTRIBUTE_NO_SANITIZE_MEMORY   // May read random elements from stack.
+ABSL_ATTRIBUTE_NO_SANITIZE_THREAD   // May read random elements from stack.
 static void **NextStackFrame(void **old_frame_pointer, const void *uc,
                              const StackInfo *stack_info) {
   void **new_frame_pointer = reinterpret_cast<void**>(*old_frame_pointer);
@@ -185,6 +186,7 @@ template <bool IS_STACK_FRAMES, bool IS_WITH_CONTEXT>
 ABSL_ATTRIBUTE_NOINLINE
 ABSL_ATTRIBUTE_NO_SANITIZE_ADDRESS  // May read random elements from stack.
 ABSL_ATTRIBUTE_NO_SANITIZE_MEMORY   // May read random elements from stack.
+ABSL_ATTRIBUTE_NO_SANITIZE_THREAD   // May read random elements from stack.
 static int UnwindImpl(void **result, uintptr_t *frames, int *sizes,
                       int max_depth, int skip_count, const void *ucp,
                       int *min_dropped_frames) {
diff --git a/deps/v8/third_party/abseil-cpp/absl/debugging/internal/stacktrace_emscripten-inl.inc b/deps/v8/third_party/abseil-cpp/absl/debugging/internal/stacktrace_emscripten-inl.inc
index 6689300f605b66..2f39c70506ba8a 100644
--- a/deps/v8/third_party/abseil-cpp/absl/debugging/internal/stacktrace_emscripten-inl.inc
+++ b/deps/v8/third_party/abseil-cpp/absl/debugging/internal/stacktrace_emscripten-inl.inc
@@ -24,6 +24,7 @@
 #include <stdint.h>
 
 #include <atomic>
+#include <cstddef>
 #include <cstring>
 
 #include "absl/base/attributes.h"
@@ -77,7 +78,8 @@ static int UnwindImpl(void **result, uintptr_t *frames, int *sizes,
 
   int size;
   uintptr_t pc = emscripten_stack_snapshot();
-  size = emscripten_stack_unwind_buffer(pc, stack, kStackLength);
+  size =
+      static_cast<int>(emscripten_stack_unwind_buffer(pc, stack, kStackLength));
 
   int result_count = size - skip_count;
   if (result_count < 0) result_count = 0;
@@ -87,10 +89,10 @@ static int UnwindImpl(void **result, uintptr_t *frames, int *sizes,
   if (IS_STACK_FRAMES) {
     // No implementation for finding out the stack frames yet.
     if (frames != nullptr) {
-      memset(frames, 0, sizeof(*frames) * result_count);
+      memset(frames, 0, sizeof(*frames) * static_cast<size_t>(result_count));
     }
     if (sizes != nullptr) {
-      memset(sizes, 0, sizeof(*sizes) * result_count);
+      memset(sizes, 0, sizeof(*sizes) * static_cast<size_t>(result_count));
     }
   }
   if (min_dropped_frames != nullptr) {
diff --git a/deps/v8/third_party/abseil-cpp/absl/debugging/internal/stacktrace_powerpc-inl.inc b/deps/v8/third_party/abseil-cpp/absl/debugging/internal/stacktrace_powerpc-inl.inc
index b84782bdd44c89..f82ca8f2c17018 100644
--- a/deps/v8/third_party/abseil-cpp/absl/debugging/internal/stacktrace_powerpc-inl.inc
+++ b/deps/v8/third_party/abseil-cpp/absl/debugging/internal/stacktrace_powerpc-inl.inc
@@ -69,6 +69,7 @@ static inline void **StacktracePowerPCGetLRPtr(void **sp) {
 template<bool STRICT_UNWINDING, bool IS_WITH_CONTEXT>
 ABSL_ATTRIBUTE_NO_SANITIZE_ADDRESS  // May read random elements from stack.
 ABSL_ATTRIBUTE_NO_SANITIZE_MEMORY   // May read random elements from stack.
+ABSL_ATTRIBUTE_NO_SANITIZE_THREAD   // May read random elements from stack.
 static void **NextStackFrame(void **old_sp, const void *uc) {
   void **new_sp = (void **) *old_sp;
   enum { kStackAlignment = 16 };
@@ -164,6 +165,7 @@ ABSL_ATTRIBUTE_NOINLINE static void AbslStacktracePowerPCDummyFunction() {
 template <bool IS_STACK_FRAMES, bool IS_WITH_CONTEXT>
 ABSL_ATTRIBUTE_NO_SANITIZE_ADDRESS  // May read random elements from stack.
 ABSL_ATTRIBUTE_NO_SANITIZE_MEMORY   // May read random elements from stack.
+ABSL_ATTRIBUTE_NO_SANITIZE_THREAD   // May read random elements from stack.
 static int UnwindImpl(void **result, uintptr_t *frames, int *sizes,
                       int max_depth, int skip_count, const void *ucp,
                       int *min_dropped_frames) {
diff --git a/deps/v8/third_party/abseil-cpp/absl/debugging/internal/stacktrace_riscv-inl.inc b/deps/v8/third_party/abseil-cpp/absl/debugging/internal/stacktrace_riscv-inl.inc
index 59f291360c0517..f9919c6156b974 100644
--- a/deps/v8/third_party/abseil-cpp/absl/debugging/internal/stacktrace_riscv-inl.inc
+++ b/deps/v8/third_party/abseil-cpp/absl/debugging/internal/stacktrace_riscv-inl.inc
@@ -56,6 +56,7 @@ static inline ptrdiff_t ComputeStackFrameSize(const T *low, const T *high) {
 template <bool STRICT_UNWINDING, bool WITH_CONTEXT>
 ABSL_ATTRIBUTE_NO_SANITIZE_ADDRESS  // May read random elements from stack.
 ABSL_ATTRIBUTE_NO_SANITIZE_MEMORY   // May read random elements from stack.
+ABSL_ATTRIBUTE_NO_SANITIZE_THREAD   // May read random elements from stack.
 static void ** NextStackFrame(void **old_frame_pointer, const void *uc,
                               const std::pair<size_t, size_t> range) {
   //               .
@@ -118,6 +119,7 @@ static void ** NextStackFrame(void **old_frame_pointer, const void *uc,
 template <bool IS_STACK_FRAMES, bool IS_WITH_CONTEXT>
 ABSL_ATTRIBUTE_NO_SANITIZE_ADDRESS  // May read random elements from stack.
 ABSL_ATTRIBUTE_NO_SANITIZE_MEMORY   // May read random elements from stack.
+ABSL_ATTRIBUTE_NO_SANITIZE_THREAD   // May read random elements from stack.
 static int UnwindImpl(void **result, uintptr_t *frames, int *sizes,
                       int max_depth, int skip_count, const void *ucp,
                       int *min_dropped_frames) {
diff --git a/deps/v8/third_party/abseil-cpp/absl/debugging/internal/stacktrace_win32-inl.inc b/deps/v8/third_party/abseil-cpp/absl/debugging/internal/stacktrace_win32-inl.inc
index 513a392b57c21b..f57c187253fe89 100644
--- a/deps/v8/third_party/abseil-cpp/absl/debugging/internal/stacktrace_win32-inl.inc
+++ b/deps/v8/third_party/abseil-cpp/absl/debugging/internal/stacktrace_win32-inl.inc
@@ -37,39 +37,20 @@
 #ifndef ABSL_DEBUGGING_INTERNAL_STACKTRACE_WIN32_INL_H_
 #define ABSL_DEBUGGING_INTERNAL_STACKTRACE_WIN32_INL_H_
 
-#include <windows.h>    // for GetProcAddress and GetModuleHandle
-#include <cassert>
-
-typedef USHORT NTAPI RtlCaptureStackBackTrace_Function(
-    IN ULONG frames_to_skip,
-    IN ULONG frames_to_capture,
-    OUT PVOID *backtrace,
-    OUT PULONG backtrace_hash);
+#include <windows.h>  // CaptureStackBackTrace
 
-// It is not possible to load RtlCaptureStackBackTrace at static init time in
-// UWP. CaptureStackBackTrace is the public version of RtlCaptureStackBackTrace
-#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP) && \
-    !WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP)
-static RtlCaptureStackBackTrace_Function* const RtlCaptureStackBackTrace_fn =
-    &::CaptureStackBackTrace;
-#else
-// Load the function we need at static init time, where we don't have
-// to worry about someone else holding the loader's lock.
-static RtlCaptureStackBackTrace_Function* const RtlCaptureStackBackTrace_fn =
-    (RtlCaptureStackBackTrace_Function*)GetProcAddress(
-        GetModuleHandleA("ntdll.dll"), "RtlCaptureStackBackTrace");
-#endif  // WINAPI_PARTITION_APP && !WINAPI_PARTITION_DESKTOP
+#include <cassert>
 
 template <bool IS_STACK_FRAMES, bool IS_WITH_CONTEXT>
 static int UnwindImpl(void** result, uintptr_t* frames, int* sizes,
                       int max_depth, int skip_count, const void*,
                       int* min_dropped_frames) {
   USHORT n = 0;
-  if (!RtlCaptureStackBackTrace_fn || skip_count < 0 || max_depth < 0) {
+  if (skip_count < 0 || max_depth < 0) {
     // can't get a stacktrace with no function/invalid args
   } else {
-    n = RtlCaptureStackBackTrace_fn(static_cast<ULONG>(skip_count) + 2,
-                                    static_cast<ULONG>(max_depth), result, 0);
+    n = CaptureStackBackTrace(static_cast<ULONG>(skip_count) + 2,
+                              static_cast<ULONG>(max_depth), result, 0);
   }
   if (IS_STACK_FRAMES) {
     // No implementation for finding out the stack frames yet.
diff --git a/deps/v8/third_party/abseil-cpp/absl/debugging/internal/stacktrace_x86-inl.inc b/deps/v8/third_party/abseil-cpp/absl/debugging/internal/stacktrace_x86-inl.inc
index 2662dab3563018..96b128e04ea4c9 100644
--- a/deps/v8/third_party/abseil-cpp/absl/debugging/internal/stacktrace_x86-inl.inc
+++ b/deps/v8/third_party/abseil-cpp/absl/debugging/internal/stacktrace_x86-inl.inc
@@ -164,6 +164,7 @@ static uintptr_t GetFP(const void *vuc) {
 template <bool STRICT_UNWINDING, bool WITH_CONTEXT>
 ABSL_ATTRIBUTE_NO_SANITIZE_ADDRESS  // May read random elements from stack.
 ABSL_ATTRIBUTE_NO_SANITIZE_MEMORY   // May read random elements from stack.
+ABSL_ATTRIBUTE_NO_SANITIZE_THREAD   // May read random elements from stack.
 static void **NextStackFrame(void **old_fp, const void *uc,
                              size_t stack_low, size_t stack_high) {
   void **new_fp = (void **)*old_fp;
@@ -327,6 +328,7 @@ static void **NextStackFrame(void **old_fp, const void *uc,
 template <bool IS_STACK_FRAMES, bool IS_WITH_CONTEXT>
 ABSL_ATTRIBUTE_NO_SANITIZE_ADDRESS  // May read random elements from stack.
 ABSL_ATTRIBUTE_NO_SANITIZE_MEMORY   // May read random elements from stack.
+ABSL_ATTRIBUTE_NO_SANITIZE_THREAD   // May read random elements from stack.
 ABSL_ATTRIBUTE_NOINLINE
 static int UnwindImpl(void **result, uintptr_t *frames, int *sizes,
                       int max_depth, int skip_count, const void *ucp,
diff --git a/deps/v8/third_party/abseil-cpp/absl/debugging/stacktrace.cc b/deps/v8/third_party/abseil-cpp/absl/debugging/stacktrace.cc
index d8ad0e61218e41..f71e80cfef0d83 100644
--- a/deps/v8/third_party/abseil-cpp/absl/debugging/stacktrace.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/debugging/stacktrace.cc
@@ -36,6 +36,7 @@
 
 #include "absl/debugging/stacktrace.h"
 
+#include <stddef.h>
 #include <stdint.h>
 
 #include <algorithm>
@@ -47,6 +48,30 @@
 #include "absl/base/port.h"
 #include "absl/debugging/internal/stacktrace_config.h"
 
+#ifdef ABSL_INTERNAL_HAVE_ALLOCA
+#error ABSL_INTERNAL_HAVE_ALLOCA cannot be directly set
+#endif
+
+#ifdef _WIN32
+#include <malloc.h>
+#define ABSL_INTERNAL_HAVE_ALLOCA 1
+#else
+#ifdef __has_include
+#if __has_include(<alloca.h>)
+#include <alloca.h>
+#define ABSL_INTERNAL_HAVE_ALLOCA 1
+#elif !defined(alloca)
+static void* alloca(size_t) noexcept { return nullptr; }
+#endif
+#endif
+#endif
+
+#ifdef ABSL_INTERNAL_HAVE_ALLOCA
+static constexpr bool kHaveAlloca = true;
+#else
+static constexpr bool kHaveAlloca = false;
+#endif
+
 #if defined(ABSL_STACKTRACE_INL_HEADER)
 #include ABSL_STACKTRACE_INL_HEADER
 #else
@@ -98,6 +123,14 @@ ABSL_ATTRIBUTE_ALWAYS_INLINE inline int Unwind(void** result, uintptr_t* frames,
 ABSL_ATTRIBUTE_NOINLINE ABSL_ATTRIBUTE_NO_TAIL_CALL int
 internal_stacktrace::GetStackFrames(void** result, uintptr_t* frames,
                                     int* sizes, int max_depth, int skip_count) {
+  if (internal_stacktrace::ShouldFixUpStack()) {
+    size_t depth = static_cast<size_t>(Unwind<true, true>(
+        result, frames, sizes, max_depth, skip_count, nullptr, nullptr));
+    internal_stacktrace::FixUpStack(result, frames, sizes,
+                                    static_cast<size_t>(max_depth), depth);
+    return static_cast<int>(depth);
+  }
+
   return Unwind<true, false>(result, frames, sizes, max_depth, skip_count,
                              nullptr, nullptr);
 }
@@ -107,12 +140,33 @@ internal_stacktrace::GetStackFramesWithContext(void** result, uintptr_t* frames,
                                                int* sizes, int max_depth,
                                                int skip_count, const void* uc,
                                                int* min_dropped_frames) {
+  if (internal_stacktrace::ShouldFixUpStack()) {
+    size_t depth = static_cast<size_t>(Unwind<true, true>(
+        result, frames, sizes, max_depth, skip_count, uc, min_dropped_frames));
+    internal_stacktrace::FixUpStack(result, frames, sizes,
+                                    static_cast<size_t>(max_depth), depth);
+    return static_cast<int>(depth);
+  }
+
   return Unwind<true, true>(result, frames, sizes, max_depth, skip_count, uc,
                             min_dropped_frames);
 }
 
 ABSL_ATTRIBUTE_NOINLINE ABSL_ATTRIBUTE_NO_TAIL_CALL int GetStackTrace(
     void** result, int max_depth, int skip_count) {
+  if (internal_stacktrace::ShouldFixUpStack()) {
+    if constexpr (kHaveAlloca) {
+      const size_t nmax = static_cast<size_t>(max_depth);
+      uintptr_t* frames =
+          static_cast<uintptr_t*>(alloca(nmax * sizeof(*frames)));
+      int* sizes = static_cast<int*>(alloca(nmax * sizeof(*sizes)));
+      size_t depth = static_cast<size_t>(Unwind<true, false>(
+          result, frames, sizes, max_depth, skip_count, nullptr, nullptr));
+      internal_stacktrace::FixUpStack(result, frames, sizes, nmax, depth);
+      return static_cast<int>(depth);
+    }
+  }
+
   return Unwind<false, false>(result, nullptr, nullptr, max_depth, skip_count,
                               nullptr, nullptr);
 }
@@ -120,6 +174,20 @@ ABSL_ATTRIBUTE_NOINLINE ABSL_ATTRIBUTE_NO_TAIL_CALL int GetStackTrace(
 ABSL_ATTRIBUTE_NOINLINE ABSL_ATTRIBUTE_NO_TAIL_CALL int
 GetStackTraceWithContext(void** result, int max_depth, int skip_count,
                          const void* uc, int* min_dropped_frames) {
+  if (internal_stacktrace::ShouldFixUpStack()) {
+    if constexpr (kHaveAlloca) {
+      const size_t nmax = static_cast<size_t>(max_depth);
+      uintptr_t* frames =
+          static_cast<uintptr_t*>(alloca(nmax * sizeof(*frames)));
+      int* sizes = static_cast<int*>(alloca(nmax * sizeof(*sizes)));
+      size_t depth = static_cast<size_t>(
+          Unwind<true, true>(result, frames, sizes, max_depth, skip_count, uc,
+                             min_dropped_frames));
+      internal_stacktrace::FixUpStack(result, frames, sizes, nmax, depth);
+      return static_cast<int>(depth);
+    }
+  }
+
   return Unwind<false, true>(result, nullptr, nullptr, max_depth, skip_count,
                              uc, min_dropped_frames);
 }
@@ -169,5 +237,23 @@ ABSL_ATTRIBUTE_NOINLINE ABSL_ATTRIBUTE_NO_TAIL_CALL int DefaultStackUnwinder(
   return n;
 }
 
+ABSL_ATTRIBUTE_WEAK bool internal_stacktrace::ShouldFixUpStack() {
+  return false;
+}
+
+// Fixes up the stack trace of the current thread, in the first `depth` frames
+// of each buffer. The buffers need to be larger than `depth`, to accommodate
+// any newly inserted elements. `depth` is updated to reflect the new number of
+// elements valid across all the buffers. (It is therefore recommended that all
+// buffer sizes be equal.)
+//
+// The `frames` and `sizes` parameters denote the bounds of the stack frame
+// corresponding to each instruction pointer in the `pcs`.
+// Any elements inside these buffers may be zero or null, in which case that
+// information is assumed to be absent/unavailable.
+ABSL_ATTRIBUTE_WEAK void internal_stacktrace::FixUpStack(void**, uintptr_t*,
+                                                         int*, size_t,
+                                                         size_t&) {}
+
 ABSL_NAMESPACE_END
 }  // namespace absl
diff --git a/deps/v8/third_party/abseil-cpp/absl/debugging/stacktrace.h b/deps/v8/third_party/abseil-cpp/absl/debugging/stacktrace.h
index b55babbcbd4548..87771724d8c961 100644
--- a/deps/v8/third_party/abseil-cpp/absl/debugging/stacktrace.h
+++ b/deps/v8/third_party/abseil-cpp/absl/debugging/stacktrace.h
@@ -31,6 +31,7 @@
 #ifndef ABSL_DEBUGGING_STACKTRACE_H_
 #define ABSL_DEBUGGING_STACKTRACE_H_
 
+#include <stddef.h>
 #include <stdint.h>
 
 #include "absl/base/attributes.h"
@@ -274,6 +275,24 @@ namespace debugging_internal {
 // working.
 extern bool StackTraceWorksForTest();
 }  // namespace debugging_internal
+
+namespace internal_stacktrace {
+extern bool ShouldFixUpStack();
+
+// Fixes up the stack trace of the current thread, in the first `depth` frames
+// of each buffer. The buffers need to be larger than `depth`, to accommodate
+// any newly inserted elements. `depth` is updated to reflect the new number of
+// elements valid across all the buffers. (It is therefore recommended that all
+// buffer sizes be equal.)
+//
+// The `frames` and `sizes` parameters denote the bounds of the stack frame
+// corresponding to each instruction pointer in the `pcs`.
+// Any elements inside these buffers may be zero or null, in which case that
+// information is assumed to be absent/unavailable.
+extern void FixUpStack(void** pcs, uintptr_t* frames, int* sizes,
+                       size_t capacity, size_t& depth);
+}  // namespace internal_stacktrace
+
 ABSL_NAMESPACE_END
 }  // namespace absl
 
diff --git a/deps/v8/third_party/abseil-cpp/absl/debugging/stacktrace_test.cc b/deps/v8/third_party/abseil-cpp/absl/debugging/stacktrace_test.cc
index f31f624765d1ca..4477d84c1dffa2 100644
--- a/deps/v8/third_party/abseil-cpp/absl/debugging/stacktrace_test.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/debugging/stacktrace_test.cc
@@ -26,9 +26,27 @@
 #include "absl/base/optimization.h"
 #include "absl/types/span.h"
 
+static int g_should_fixup_calls = 0;
+static int g_fixup_calls = 0;
+static bool g_enable_fixup = false;
+
+#if ABSL_HAVE_ATTRIBUTE_WEAK
+bool absl::internal_stacktrace::ShouldFixUpStack() {
+  ++g_should_fixup_calls;
+  return g_enable_fixup;
+}
+
+void absl::internal_stacktrace::FixUpStack(void**, uintptr_t*, int*, size_t,
+                                           size_t&) {
+  ++g_fixup_calls;
+}
+#endif
+
 namespace {
 
+using ::testing::ContainerEq;
 using ::testing::Contains;
+using ::testing::internal::Cleanup;
 
 struct StackTrace {
   static constexpr int kStackCount = 64;
@@ -62,6 +80,141 @@ TEST(StackTrace, HugeFrame) {
 }
 #endif
 
+// This is a separate function to avoid inlining.
+ABSL_ATTRIBUTE_NOINLINE static void FixupNoFixupEquivalenceNoInline() {
+#if defined(__riscv)
+  GTEST_SKIP() << "Skipping test on RISC-V due to pre-existing failure";
+#endif
+
+#if ABSL_HAVE_ATTRIBUTE_WEAK
+  // This test is known not to pass on MSVC (due to weak symbols)
+
+  const Cleanup restore_state([enable_fixup = g_enable_fixup,
+                               fixup_calls = g_fixup_calls,
+                               should_fixup_calls = g_should_fixup_calls]() {
+    g_enable_fixup = enable_fixup;
+    g_fixup_calls = fixup_calls;
+    g_should_fixup_calls = should_fixup_calls;
+  });
+
+  constexpr int kSkip = 1;  // Skip our own frame, whose return PCs won't match
+  constexpr auto kStackCount = 1;
+
+  StackTrace a;
+  StackTrace b;
+
+  // ==========================================================================
+
+  g_fixup_calls = 0;
+  g_should_fixup_calls = 0;
+  a.depth = absl::GetStackTrace(a.result, kStackCount, kSkip);
+  g_enable_fixup = !g_enable_fixup;
+  b.depth = absl::GetStackTrace(b.result, kStackCount, kSkip);
+  EXPECT_THAT(
+      absl::MakeSpan(a.result, static_cast<size_t>(a.depth)),
+      ContainerEq(absl::MakeSpan(b.result, static_cast<size_t>(b.depth))));
+  EXPECT_GT(g_should_fixup_calls, 0);
+  EXPECT_GE(g_should_fixup_calls, g_fixup_calls);
+
+  // ==========================================================================
+
+  g_fixup_calls = 0;
+  g_should_fixup_calls = 0;
+  a.depth = absl::GetStackFrames(a.result, a.sizes, kStackCount, kSkip);
+  g_enable_fixup = !g_enable_fixup;
+  b.depth = absl::GetStackFrames(b.result, b.sizes, kStackCount, kSkip);
+  EXPECT_THAT(
+      absl::MakeSpan(a.result, static_cast<size_t>(a.depth)),
+      ContainerEq(absl::MakeSpan(b.result, static_cast<size_t>(b.depth))));
+  EXPECT_THAT(
+      absl::MakeSpan(a.sizes, static_cast<size_t>(a.depth)),
+      ContainerEq(absl::MakeSpan(b.sizes, static_cast<size_t>(b.depth))));
+  EXPECT_GT(g_should_fixup_calls, 0);
+  EXPECT_GE(g_should_fixup_calls, g_fixup_calls);
+
+  // ==========================================================================
+
+  g_fixup_calls = 0;
+  g_should_fixup_calls = 0;
+  a.depth = absl::GetStackTraceWithContext(a.result, kStackCount, kSkip,
+                                           nullptr, nullptr);
+  g_enable_fixup = !g_enable_fixup;
+  b.depth = absl::GetStackTraceWithContext(b.result, kStackCount, kSkip,
+                                           nullptr, nullptr);
+  EXPECT_THAT(
+      absl::MakeSpan(a.result, static_cast<size_t>(a.depth)),
+      ContainerEq(absl::MakeSpan(b.result, static_cast<size_t>(b.depth))));
+  EXPECT_GT(g_should_fixup_calls, 0);
+  EXPECT_GE(g_should_fixup_calls, g_fixup_calls);
+
+  // ==========================================================================
+
+  g_fixup_calls = 0;
+  g_should_fixup_calls = 0;
+  a.depth = absl::GetStackFramesWithContext(a.result, a.sizes, kStackCount,
+                                            kSkip, nullptr, nullptr);
+  g_enable_fixup = !g_enable_fixup;
+  b.depth = absl::GetStackFramesWithContext(b.result, b.sizes, kStackCount,
+                                            kSkip, nullptr, nullptr);
+  EXPECT_THAT(
+      absl::MakeSpan(a.result, static_cast<size_t>(a.depth)),
+      ContainerEq(absl::MakeSpan(b.result, static_cast<size_t>(b.depth))));
+  EXPECT_THAT(
+      absl::MakeSpan(a.sizes, static_cast<size_t>(a.depth)),
+      ContainerEq(absl::MakeSpan(b.sizes, static_cast<size_t>(b.depth))));
+  EXPECT_GT(g_should_fixup_calls, 0);
+  EXPECT_GE(g_should_fixup_calls, g_fixup_calls);
+
+  // ==========================================================================
+
+  g_fixup_calls = 0;
+  g_should_fixup_calls = 0;
+  a.depth = absl::internal_stacktrace::GetStackFrames(
+      a.result, a.frames, a.sizes, kStackCount, kSkip);
+  g_enable_fixup = !g_enable_fixup;
+  b.depth = absl::internal_stacktrace::GetStackFrames(
+      b.result, b.frames, b.sizes, kStackCount, kSkip);
+  EXPECT_THAT(
+      absl::MakeSpan(a.result, static_cast<size_t>(a.depth)),
+      ContainerEq(absl::MakeSpan(b.result, static_cast<size_t>(b.depth))));
+  EXPECT_THAT(
+      absl::MakeSpan(a.sizes, static_cast<size_t>(a.depth)),
+      ContainerEq(absl::MakeSpan(b.sizes, static_cast<size_t>(b.depth))));
+  EXPECT_THAT(
+      absl::MakeSpan(a.frames, static_cast<size_t>(a.depth)),
+      ContainerEq(absl::MakeSpan(b.frames, static_cast<size_t>(b.depth))));
+  EXPECT_GT(g_should_fixup_calls, 0);
+  EXPECT_GE(g_should_fixup_calls, g_fixup_calls);
+
+  // ==========================================================================
+
+  g_fixup_calls = 0;
+  g_should_fixup_calls = 0;
+  a.depth = absl::internal_stacktrace::GetStackFramesWithContext(
+      a.result, a.frames, a.sizes, kStackCount, kSkip, nullptr, nullptr);
+  g_enable_fixup = !g_enable_fixup;
+  b.depth = absl::internal_stacktrace::GetStackFramesWithContext(
+      b.result, b.frames, b.sizes, kStackCount, kSkip, nullptr, nullptr);
+  EXPECT_THAT(
+      absl::MakeSpan(a.result, static_cast<size_t>(a.depth)),
+      ContainerEq(absl::MakeSpan(b.result, static_cast<size_t>(b.depth))));
+  EXPECT_THAT(
+      absl::MakeSpan(a.sizes, static_cast<size_t>(a.depth)),
+      ContainerEq(absl::MakeSpan(b.sizes, static_cast<size_t>(b.depth))));
+  EXPECT_THAT(
+      absl::MakeSpan(a.frames, static_cast<size_t>(a.depth)),
+      ContainerEq(absl::MakeSpan(b.frames, static_cast<size_t>(b.depth))));
+  EXPECT_GT(g_should_fixup_calls, 0);
+  EXPECT_GE(g_should_fixup_calls, g_fixup_calls);
+
+  // ==========================================================================
+#else
+  GTEST_SKIP() << "Need weak symbol support";
+#endif
+}
+
+TEST(StackTrace, FixupNoFixupEquivalence) { FixupNoFixupEquivalenceNoInline(); }
+
 #if ABSL_HAVE_BUILTIN(__builtin_frame_address)
 struct FrameInfo {
   const void* return_address;
diff --git a/deps/v8/third_party/abseil-cpp/absl/debugging/symbolize_elf.inc b/deps/v8/third_party/abseil-cpp/absl/debugging/symbolize_elf.inc
index a98ca81d175ed1..9836c93295c334 100644
--- a/deps/v8/third_party/abseil-cpp/absl/debugging/symbolize_elf.inc
+++ b/deps/v8/third_party/abseil-cpp/absl/debugging/symbolize_elf.inc
@@ -125,12 +125,20 @@ namespace {
 // Some platforms use a special .opd section to store function pointers.
 const char kOpdSectionName[] = ".opd";
 
-#if (defined(__powerpc__) && !(_CALL_ELF > 1)) || defined(__ia64)
+#if defined(__powerpc64__) && defined(_CALL_ELF)
+#if _CALL_ELF <= 1
+#define ABSL_INTERNAL_HAVE_PPC64_ELFV1_ABI 1
+#endif
+#endif
+#if defined(ABSL_INTERNAL_HAVE_PPC64_ELFV1_ABI) || defined(__ia64)
 // Use opd section for function descriptors on these platforms, the function
 // address is the first word of the descriptor.
-enum { kPlatformUsesOPDSections = 1 };
-#else  // not PPC or IA64
-enum { kPlatformUsesOPDSections = 0 };
+//
+// https://maskray.me/blog/2023-02-26-linker-notes-on-power-isa notes that
+// opd sections are used on 64-bit PowerPC with the ELFv1 ABI.
+inline constexpr bool kPlatformUsesOPDSections = true;
+#else
+inline constexpr bool kPlatformUsesOPDSections = false;
 #endif
 
 // This works for PowerPC & IA64 only.  A function descriptor consist of two
@@ -1451,11 +1459,11 @@ static bool MaybeInitializeObjFile(ObjFile *obj) {
       }
       phoff += phentsize;
 
-#if defined(__powerpc__) && !(_CALL_ELF > 1)
-      // On the PowerPC ELF v1 ABI, function pointers actually point to function
-      // descriptors. These descriptors are stored in an .opd section, which is
-      // mapped read-only. We thus need to look at all readable segments, not
-      // just the executable ones.
+#ifdef ABSL_INTERNAL_HAVE_PPC64_ELFV1_ABI
+      // On the PowerPC 64-bit ELFv1 ABI, function pointers actually point to
+      // function descriptors. These descriptors are stored in an .opd section,
+      // which is mapped read-only. We thus need to look at all readable
+      // segments, not just the executable ones.
       constexpr int interesting = PF_R;
 #else
       constexpr int interesting = PF_X | PF_R;
@@ -1762,3 +1770,5 @@ extern "C" bool AbslInternalGetFileMappingHint(const void **start,
   return absl::debugging_internal::GetFileMappingHint(start, end, offset,
                                                       filename);
 }
+
+#undef ABSL_INTERNAL_HAVE_PPC64_ELFV1_ABI
diff --git a/deps/v8/third_party/abseil-cpp/absl/debugging/symbolize_emscripten.inc b/deps/v8/third_party/abseil-cpp/absl/debugging/symbolize_emscripten.inc
index a0f344dd9b509e..f6da0ac202f175 100644
--- a/deps/v8/third_party/abseil-cpp/absl/debugging/symbolize_emscripten.inc
+++ b/deps/v8/third_party/abseil-cpp/absl/debugging/symbolize_emscripten.inc
@@ -58,12 +58,13 @@ bool Symbolize(const void* pc, char* out, int out_size) {
     return false;
   }
 
-  strncpy(out, func_name, out_size);
+  strncpy(out, func_name, static_cast<size_t>(out_size));
 
   if (out[out_size - 1] != '\0') {
     // strncpy() does not '\0' terminate when it truncates.
     static constexpr char kEllipsis[] = "...";
-    int ellipsis_size = std::min<int>(sizeof(kEllipsis) - 1, out_size - 1);
+    size_t ellipsis_size =
+        std::min(sizeof(kEllipsis) - 1, static_cast<size_t>(out_size) - 1);
     memcpy(out + out_size - ellipsis_size - 1, kEllipsis, ellipsis_size);
     out[out_size - 1] = '\0';
   }
diff --git a/deps/v8/third_party/abseil-cpp/absl/debugging/symbolize_win32.inc b/deps/v8/third_party/abseil-cpp/absl/debugging/symbolize_win32.inc
index 53a099a1814933..589890f31e3d10 100644
--- a/deps/v8/third_party/abseil-cpp/absl/debugging/symbolize_win32.inc
+++ b/deps/v8/third_party/abseil-cpp/absl/debugging/symbolize_win32.inc
@@ -15,7 +15,9 @@
 // See "Retrieving Symbol Information by Address":
 // https://msdn.microsoft.com/en-us/library/windows/desktop/ms680578(v=vs.85).aspx
 
+#include <ntstatus.h>
 #include <windows.h>
+#include <winternl.h>
 
 // MSVC header dbghelp.h has a warning for an ignored typedef.
 #pragma warning(push)
@@ -45,13 +47,30 @@ void InitializeSymbolizer(const char*) {
   // symbols be loaded. This is the fastest, most efficient way to use
   // the symbol handler.
   SymSetOptions(SYMOPT_DEFERRED_LOADS | SYMOPT_UNDNAME);
-  if (!SymInitialize(process, nullptr, true)) {
-    // GetLastError() returns a Win32 DWORD, but we assign to
-    // unsigned long long to simplify the ABSL_RAW_LOG case below.  The uniform
-    // initialization guarantees this is not a narrowing conversion.
-    const unsigned long long error{GetLastError()};  // NOLINT(runtime/int)
-    ABSL_RAW_LOG(FATAL, "SymInitialize() failed: %llu", error);
+  DWORD syminitialize_error;
+  constexpr int kSymInitializeRetries = 5;
+  for (int i = 0; i < kSymInitializeRetries; ++i) {
+    if (SymInitialize(process, nullptr, true)) {
+      return;
+    }
+
+    // SymInitialize can fail sometimes with a STATUS_INFO_LENGTH_MISMATCH
+    // NTSTATUS (0xC0000004), which can happen when a module load occurs during
+    // the SymInitialize call. In this case, we should try calling SymInitialize
+    // again.
+    syminitialize_error = GetLastError();
+    // Both NTSTATUS and DWORD are 32-bit numbers, which makes the cast safe.
+    if (syminitialize_error !=
+        static_cast<DWORD>(STATUS_INFO_LENGTH_MISMATCH)) {
+      break;
+    }
   }
+
+  // GetLastError() returns a Win32 DWORD, but we assign to
+  // unsigned long long to simplify the ABSL_RAW_LOG case below.  The uniform
+  // initialization guarantees this is not a narrowing conversion.
+  const unsigned long long error{syminitialize_error};
+  ABSL_RAW_LOG(FATAL, "SymInitialize() failed: %llu", error);
 }
 
 bool Symbolize(const void* pc, char* out, int out_size) {
diff --git a/deps/v8/third_party/abseil-cpp/absl/flags/BUILD.bazel b/deps/v8/third_party/abseil-cpp/absl/flags/BUILD.bazel
index 5e9bec466ff76c..620af2b5aaea5a 100644
--- a/deps/v8/third_party/abseil-cpp/absl/flags/BUILD.bazel
+++ b/deps/v8/third_party/abseil-cpp/absl/flags/BUILD.bazel
@@ -192,6 +192,7 @@ cc_library(
         ":private_handle_accessor",
         "//absl/base:config",
         "//absl/base:core_headers",
+        "//absl/base:fast_type_id",
         "//absl/base:no_destructor",
         "//absl/container:flat_hash_map",
         "//absl/strings",
@@ -221,6 +222,7 @@ cc_library(
         "//absl/base:config",
         "//absl/base:core_headers",
         "//absl/base:dynamic_annotations",
+        "//absl/base:fast_type_id",
         "//absl/base:no_destructor",
         "//absl/memory",
         "//absl/meta:type_traits",
diff --git a/deps/v8/third_party/abseil-cpp/absl/flags/BUILD.gn b/deps/v8/third_party/abseil-cpp/absl/flags/BUILD.gn
index 0ab663ca41df0b..ad46b336ff5c23 100644
--- a/deps/v8/third_party/abseil-cpp/absl/flags/BUILD.gn
+++ b/deps/v8/third_party/abseil-cpp/absl/flags/BUILD.gn
@@ -118,6 +118,7 @@ absl_source_set("reflection") {
     ":private_handle_accessor",
     "//third_party/abseil-cpp/absl/base:config",
     "//third_party/abseil-cpp/absl/base:core_headers",
+    "//third_party/abseil-cpp/absl/base:fast_type_id",
     "//third_party/abseil-cpp/absl/base:no_destructor",
     "//third_party/abseil-cpp/absl/container:flat_hash_map",
     "//third_party/abseil-cpp/absl/strings",
@@ -142,6 +143,7 @@ absl_source_set("flag_internal") {
     "//third_party/abseil-cpp/absl/base:config",
     "//third_party/abseil-cpp/absl/base:core_headers",
     "//third_party/abseil-cpp/absl/base:dynamic_annotations",
+    "//third_party/abseil-cpp/absl/base:fast_type_id",
     "//third_party/abseil-cpp/absl/base:no_destructor",
     "//third_party/abseil-cpp/absl/memory",
     "//third_party/abseil-cpp/absl/meta:type_traits",
diff --git a/deps/v8/third_party/abseil-cpp/absl/flags/CMakeLists.txt b/deps/v8/third_party/abseil-cpp/absl/flags/CMakeLists.txt
index f9959573ac8fbd..d0ea452c604e95 100644
--- a/deps/v8/third_party/abseil-cpp/absl/flags/CMakeLists.txt
+++ b/deps/v8/third_party/abseil-cpp/absl/flags/CMakeLists.txt
@@ -165,6 +165,7 @@ absl_cc_library(
     ${ABSL_DEFAULT_LINKOPTS}
   DEPS
     absl::config
+    absl::fast_type_id
     absl::flags_commandlineflag
     absl::flags_private_handle_accessor
     absl::flags_config
@@ -190,6 +191,7 @@ absl_cc_library(
   DEPS
     absl::base
     absl::config
+    absl::fast_type_id
     absl::flags_commandlineflag
     absl::flags_commandlineflag_internal
     absl::flags_config
diff --git a/deps/v8/third_party/abseil-cpp/absl/flags/commandlineflag.h b/deps/v8/third_party/abseil-cpp/absl/flags/commandlineflag.h
index a9ffd0208449c0..9098b4cb27d069 100644
--- a/deps/v8/third_party/abseil-cpp/absl/flags/commandlineflag.h
+++ b/deps/v8/third_party/abseil-cpp/absl/flags/commandlineflag.h
@@ -30,7 +30,7 @@
 #include <string>
 
 #include "absl/base/config.h"
-#include "absl/base/internal/fast_type_id.h"
+#include "absl/base/fast_type_id.h"
 #include "absl/flags/internal/commandlineflag.h"
 #include "absl/strings/string_view.h"
 #include "absl/types/optional.h"
@@ -80,7 +80,7 @@ class CommandLineFlag {
   // Return true iff flag has type T.
   template <typename T>
   inline bool IsOfType() const {
-    return TypeId() == base_internal::FastTypeId<T>();
+    return TypeId() == FastTypeId<T>();
   }
 
   // absl::CommandLineFlag::TryGet()
diff --git a/deps/v8/third_party/abseil-cpp/absl/flags/internal/commandlineflag.h b/deps/v8/third_party/abseil-cpp/absl/flags/internal/commandlineflag.h
index ebfe81ba1e3a01..daef4e354ce792 100644
--- a/deps/v8/third_party/abseil-cpp/absl/flags/internal/commandlineflag.h
+++ b/deps/v8/third_party/abseil-cpp/absl/flags/internal/commandlineflag.h
@@ -17,7 +17,7 @@
 #define ABSL_FLAGS_INTERNAL_COMMANDLINEFLAG_H_
 
 #include "absl/base/config.h"
-#include "absl/base/internal/fast_type_id.h"
+#include "absl/base/fast_type_id.h"
 
 namespace absl {
 ABSL_NAMESPACE_BEGIN
@@ -28,7 +28,7 @@ namespace flags_internal {
 // cases this id is enough to uniquely identify the flag's value type. In a few
 // cases we'll have to resort to using actual RTTI implementation if it is
 // available.
-using FlagFastTypeId = absl::base_internal::FastTypeIdType;
+using FlagFastTypeId = absl::FastTypeIdType;
 
 // Options that control SetCommandLineOptionWithMode.
 enum FlagSettingMode {
diff --git a/deps/v8/third_party/abseil-cpp/absl/flags/internal/flag.cc b/deps/v8/third_party/abseil-cpp/absl/flags/internal/flag.cc
index ccd26670cf8797..37f6ef1e9d6577 100644
--- a/deps/v8/third_party/abseil-cpp/absl/flags/internal/flag.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/flags/internal/flag.cc
@@ -34,6 +34,7 @@
 #include "absl/base/config.h"
 #include "absl/base/const_init.h"
 #include "absl/base/dynamic_annotations.h"
+#include "absl/base/fast_type_id.h"
 #include "absl/base/no_destructor.h"
 #include "absl/base/optimization.h"
 #include "absl/base/thread_annotations.h"
@@ -59,7 +60,7 @@ namespace {
 // Currently we only validate flag values for user-defined flag types.
 bool ShouldValidateFlagValue(FlagFastTypeId flag_type_id) {
 #define DONT_VALIDATE(T, _) \
-  if (flag_type_id == base_internal::FastTypeId<T>()) return false;
+  if (flag_type_id == absl::FastTypeId<T>()) return false;
   ABSL_FLAGS_INTERNAL_SUPPORTED_TYPES(DONT_VALIDATE)
 #undef DONT_VALIDATE
 
diff --git a/deps/v8/third_party/abseil-cpp/absl/flags/internal/flag.h b/deps/v8/third_party/abseil-cpp/absl/flags/internal/flag.h
index ef739e7f7a0545..b61a24737fd16a 100644
--- a/deps/v8/third_party/abseil-cpp/absl/flags/internal/flag.h
+++ b/deps/v8/third_party/abseil-cpp/absl/flags/internal/flag.h
@@ -828,7 +828,7 @@ class Flag {
     U u;
 
 #if !defined(NDEBUG)
-    impl_.AssertValidType(base_internal::FastTypeId<T>(), &GenRuntimeTypeId<T>);
+    impl_.AssertValidType(absl::FastTypeId<T>(), &GenRuntimeTypeId<T>);
 #endif
 
     if (ABSL_PREDICT_FALSE(!value_.Get(impl_.seq_lock_, u.value))) {
@@ -837,7 +837,7 @@ class Flag {
     return std::move(u.value);
   }
   void Set(const T& v) {
-    impl_.AssertValidType(base_internal::FastTypeId<T>(), &GenRuntimeTypeId<T>);
+    impl_.AssertValidType(absl::FastTypeId<T>(), &GenRuntimeTypeId<T>);
     impl_.Write(&v);
   }
 
@@ -902,7 +902,7 @@ void* FlagOps(FlagOp op, const void* v1, void* v2, void* v3) {
     case FlagOp::kSizeof:
       return reinterpret_cast<void*>(static_cast<uintptr_t>(sizeof(T)));
     case FlagOp::kFastTypeId:
-      return const_cast<void*>(base_internal::FastTypeId<T>());
+      return const_cast<void*>(absl::FastTypeId<T>());
     case FlagOp::kRuntimeTypeId:
       return const_cast<std::type_info*>(GenRuntimeTypeId<T>());
     case FlagOp::kParse: {
diff --git a/deps/v8/third_party/abseil-cpp/absl/flags/internal/registry.h b/deps/v8/third_party/abseil-cpp/absl/flags/internal/registry.h
index a57ba3c540474b..be9aaccc7ef578 100644
--- a/deps/v8/third_party/abseil-cpp/absl/flags/internal/registry.h
+++ b/deps/v8/third_party/abseil-cpp/absl/flags/internal/registry.h
@@ -19,6 +19,7 @@
 #include <functional>
 
 #include "absl/base/config.h"
+#include "absl/base/fast_type_id.h"
 #include "absl/flags/commandlineflag.h"
 #include "absl/flags/internal/commandlineflag.h"
 #include "absl/strings/string_view.h"
@@ -83,7 +84,7 @@ template <typename T>
 class RetiredFlag {
  public:
   void Retire(const char* flag_name) {
-    flags_internal::Retire(flag_name, base_internal::FastTypeId<T>(), buf_);
+    flags_internal::Retire(flag_name, absl::FastTypeId<T>(), buf_);
   }
 
  private:
diff --git a/deps/v8/third_party/abseil-cpp/absl/functional/function_ref.h b/deps/v8/third_party/abseil-cpp/absl/functional/function_ref.h
index 0b8c402daedbaf..f1d087a77a2693 100644
--- a/deps/v8/third_party/abseil-cpp/absl/functional/function_ref.h
+++ b/deps/v8/third_party/abseil-cpp/absl/functional/function_ref.h
@@ -82,10 +82,6 @@ class FunctionRef;
 //   // replaced by an `absl::FunctionRef`:
 //   bool Visitor(absl::FunctionRef<void(my_proto&, absl::string_view)>
 //                  callback);
-//
-// Note: the assignment operator within an `absl::FunctionRef` is intentionally
-// deleted to prevent misuse; because the `absl::FunctionRef` does not own the
-// underlying type, assignment likely indicates misuse.
 template <typename R, typename... Args>
 class FunctionRef<R(Args...)> {
  private:
@@ -121,9 +117,7 @@ class FunctionRef<R(Args...)> {
     ptr_.fun = reinterpret_cast<decltype(ptr_.fun)>(f);
   }
 
-  // To help prevent subtle lifetime bugs, FunctionRef is not assignable.
-  // Typically, it should only be used as an argument type.
-  FunctionRef& operator=(const FunctionRef& rhs) = delete;
+  FunctionRef& operator=(const FunctionRef& rhs) = default;
   FunctionRef(const FunctionRef& rhs) = default;
 
   // Call the underlying object.
diff --git a/deps/v8/third_party/abseil-cpp/absl/functional/function_ref_test.cc b/deps/v8/third_party/abseil-cpp/absl/functional/function_ref_test.cc
index c0211135a2bf0b..98d11f72666323 100644
--- a/deps/v8/third_party/abseil-cpp/absl/functional/function_ref_test.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/functional/function_ref_test.cc
@@ -52,6 +52,16 @@ TEST(FunctionRefTest, ConstFunction) {
   EXPECT_EQ(1337, ref());
 }
 
+TEST(FunctionRefTest, CopyAssignment) {
+  FunctionRef<int()> a = +[]() -> int {
+    ADD_FAILURE() << "Unexpectedly called";
+    return 0;
+  };
+  FunctionRef<int()> b = +[] { return 1337; };
+  a = b;
+  EXPECT_EQ(1337, a());
+}
+
 int NoExceptFunction() noexcept { return 1337; }
 
 // TODO(jdennett): Add a test for noexcept member functions.
diff --git a/deps/v8/third_party/abseil-cpp/absl/hash/BUILD.bazel b/deps/v8/third_party/abseil-cpp/absl/hash/BUILD.bazel
index 84911c9b7cfb42..b2ffcd08d5d3ec 100644
--- a/deps/v8/third_party/abseil-cpp/absl/hash/BUILD.bazel
+++ b/deps/v8/third_party/abseil-cpp/absl/hash/BUILD.bazel
@@ -44,6 +44,7 @@ cc_library(
     deps = [
         ":city",
         ":low_level_hash",
+        ":weakly_mixed_integer",
         "//absl/base:config",
         "//absl/base:core_headers",
         "//absl/base:endian",
@@ -86,6 +87,7 @@ cc_test(
         ":hash_testing",
         ":spy_hash_state",
         "//absl/base:config",
+        "//absl/container:flat_hash_map",
         "//absl/container:flat_hash_set",
         "//absl/memory",
         "//absl/meta:type_traits",
@@ -150,6 +152,7 @@ cc_library(
     visibility = ["//visibility:private"],
     deps = [
         ":hash",
+        ":weakly_mixed_integer",
         "//absl/strings",
         "//absl/strings:str_format",
     ],
@@ -198,6 +201,21 @@ cc_library(
     ],
 )
 
+cc_library(
+    name = "weakly_mixed_integer",
+    hdrs = ["internal/weakly_mixed_integer.h"],
+    copts = ABSL_DEFAULT_COPTS,
+    linkopts = ABSL_DEFAULT_LINKOPTS,
+    visibility = [
+        "//absl/container:__pkg__",
+        "//absl/strings:__pkg__",
+        "//absl/types:__pkg__",
+    ],
+    deps = [
+        "//absl/base:config",
+    ],
+)
+
 cc_test(
     name = "low_level_hash_test",
     srcs = ["internal/low_level_hash_test.cc"],
diff --git a/deps/v8/third_party/abseil-cpp/absl/hash/BUILD.gn b/deps/v8/third_party/abseil-cpp/absl/hash/BUILD.gn
index d9e4a8302f6112..d1603706ecf201 100644
--- a/deps/v8/third_party/abseil-cpp/absl/hash/BUILD.gn
+++ b/deps/v8/third_party/abseil-cpp/absl/hash/BUILD.gn
@@ -14,6 +14,7 @@ absl_source_set("hash") {
   deps = [
     ":city",
     ":low_level_hash",
+    ":weakly_mixed_integer",
     "//third_party/abseil-cpp/absl/base:config",
     "//third_party/abseil-cpp/absl/base:core_headers",
     "//third_party/abseil-cpp/absl/base:endian",
@@ -51,6 +52,7 @@ absl_test("hash_test") {
     ":hash_testing",
     ":spy_hash_state",
     "//third_party/abseil-cpp/absl/base:config",
+    "//third_party/abseil-cpp/absl/container:flat_hash_map",
     "//third_party/abseil-cpp/absl/container:flat_hash_set",
     "//third_party/abseil-cpp/absl/memory",
     "//third_party/abseil-cpp/absl/meta:type_traits",
@@ -84,6 +86,7 @@ absl_source_set("spy_hash_state") {
   public = [ "internal/spy_hash_state.h" ]
   deps = [
     ":hash",
+    ":weakly_mixed_integer",
     "//third_party/abseil-cpp/absl/strings",
     "//third_party/abseil-cpp/absl/strings:str_format",
   ]
@@ -113,6 +116,12 @@ absl_source_set("low_level_hash") {
   visibility = [ ":*" ]
 }
 
+absl_source_set("weakly_mixed_integer") {
+  public = [ "internal/weakly_mixed_integer.h" ]
+  visibility = [ "//third_party/abseil-cpp/absl/*" ]
+  deps = [ "//third_party/abseil-cpp/absl/base:config" ]
+}
+
 absl_test("low_level_hash_test") {
   sources = [ "internal/low_level_hash_test.cc" ]
   deps = [
diff --git a/deps/v8/third_party/abseil-cpp/absl/hash/CMakeLists.txt b/deps/v8/third_party/abseil-cpp/absl/hash/CMakeLists.txt
index 4b43787b0ab7d2..6996d930e72c45 100644
--- a/deps/v8/third_party/abseil-cpp/absl/hash/CMakeLists.txt
+++ b/deps/v8/third_party/abseil-cpp/absl/hash/CMakeLists.txt
@@ -39,6 +39,7 @@ absl_cc_library(
     absl::variant
     absl::utility
     absl::low_level_hash
+    absl::weakly_mixed_integer
   PUBLIC
 )
 
@@ -70,6 +71,7 @@ absl_cc_test(
   DEPS
     absl::bits
     absl::cord_test_helpers
+    absl::flat_hash_map
     absl::flat_hash_set
     absl::hash
     absl::hash_testing
@@ -118,6 +120,7 @@ absl_cc_library(
     absl::hash
     absl::strings
     absl::str_format
+    absl::weakly_mixed_integer
   TESTONLY
   PUBLIC
 )
@@ -168,6 +171,18 @@ absl_cc_library(
     absl::prefetch
 )
 
+# Internal-only target, do not depend on directly.
+absl_cc_library(
+  NAME
+    weakly_mixed_integer
+  HDRS
+    "internal/weakly_mixed_integer.h"
+  COPTS
+    ${ABSL_DEFAULT_COPTS}
+  DEPS
+    absl::config
+)
+
 absl_cc_test(
   NAME
     low_level_hash_test
diff --git a/deps/v8/third_party/abseil-cpp/absl/hash/hash.h b/deps/v8/third_party/abseil-cpp/absl/hash/hash.h
index 479b17b7b17a6c..23f4e9d374c7f4 100644
--- a/deps/v8/third_party/abseil-cpp/absl/hash/hash.h
+++ b/deps/v8/third_party/abseil-cpp/absl/hash/hash.h
@@ -87,6 +87,7 @@
 #include "absl/base/config.h"
 #include "absl/functional/function_ref.h"
 #include "absl/hash/internal/hash.h"
+#include "absl/hash/internal/weakly_mixed_integer.h"
 #include "absl/meta/type_traits.h"
 
 namespace absl {
@@ -356,6 +357,12 @@ class HashState : public hash_internal::HashStateBase<HashState> {
     hash_state.combine_contiguous_(hash_state.state_, first, size);
     return hash_state;
   }
+
+  static HashState combine_weakly_mixed_integer(
+      HashState hash_state, hash_internal::WeaklyMixedInteger value) {
+    hash_state.combine_weakly_mixed_integer_(hash_state.state_, value);
+    return hash_state;
+  }
   using HashState::HashStateBase::combine_contiguous;
 
  private:
@@ -371,6 +378,13 @@ class HashState : public hash_internal::HashStateBase<HashState> {
     state = T::combine_contiguous(std::move(state), first, size);
   }
 
+  template <typename T>
+  static void CombineWeaklyMixedIntegerImpl(
+      void* p, hash_internal::WeaklyMixedInteger value) {
+    T& state = *static_cast<T*>(p);
+    state = T::combine_weakly_mixed_integer(std::move(state), value);
+  }
+
   static HashState combine_raw(HashState hash_state, uint64_t value) {
     hash_state.combine_raw_(hash_state.state_, value);
     return hash_state;
@@ -385,6 +399,7 @@ class HashState : public hash_internal::HashStateBase<HashState> {
   template <typename T>
   void Init(T* state) {
     state_ = state;
+    combine_weakly_mixed_integer_ = &CombineWeaklyMixedIntegerImpl<T>;
     combine_contiguous_ = &CombineContiguousImpl<T>;
     combine_raw_ = &CombineRawImpl<T>;
     run_combine_unordered_ = &RunCombineUnorderedImpl<T>;
@@ -424,6 +439,7 @@ class HashState : public hash_internal::HashStateBase<HashState> {
   // Do not erase an already erased state.
   void Init(HashState* state) {
     state_ = state->state_;
+    combine_weakly_mixed_integer_ = state->combine_weakly_mixed_integer_;
     combine_contiguous_ = state->combine_contiguous_;
     combine_raw_ = state->combine_raw_;
     run_combine_unordered_ = state->run_combine_unordered_;
@@ -435,6 +451,8 @@ class HashState : public hash_internal::HashStateBase<HashState> {
   }
 
   void* state_;
+  void (*combine_weakly_mixed_integer_)(
+      void*, absl::hash_internal::WeaklyMixedInteger);
   void (*combine_contiguous_)(void*, const unsigned char*, size_t);
   void (*combine_raw_)(void*, uint64_t);
   HashState (*run_combine_unordered_)(
diff --git a/deps/v8/third_party/abseil-cpp/absl/hash/hash_benchmark.cc b/deps/v8/third_party/abseil-cpp/absl/hash/hash_benchmark.cc
index c2b95e895d8e62..73b037d13355e2 100644
--- a/deps/v8/third_party/abseil-cpp/absl/hash/hash_benchmark.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/hash/hash_benchmark.cc
@@ -378,7 +378,10 @@ struct StringRand {
 
 MAKE_LATENCY_BENCHMARK(AbslHash, Int32, PodRand<int32_t>)
 MAKE_LATENCY_BENCHMARK(AbslHash, Int64, PodRand<int64_t>)
+MAKE_LATENCY_BENCHMARK(AbslHash, String3, StringRand<3>)
+MAKE_LATENCY_BENCHMARK(AbslHash, String5, StringRand<5>)
 MAKE_LATENCY_BENCHMARK(AbslHash, String9, StringRand<9>)
+MAKE_LATENCY_BENCHMARK(AbslHash, String17, StringRand<17>)
 MAKE_LATENCY_BENCHMARK(AbslHash, String33, StringRand<33>)
 MAKE_LATENCY_BENCHMARK(AbslHash, String65, StringRand<65>)
 MAKE_LATENCY_BENCHMARK(AbslHash, String257, StringRand<257>)
diff --git a/deps/v8/third_party/abseil-cpp/absl/hash/hash_instantiated_test.cc b/deps/v8/third_party/abseil-cpp/absl/hash/hash_instantiated_test.cc
index e65de9ca9edfd1..f0df86fab716ac 100644
--- a/deps/v8/third_party/abseil-cpp/absl/hash/hash_instantiated_test.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/hash/hash_instantiated_test.cc
@@ -51,7 +51,7 @@ using ::absl::hash_test_internal::TypeErasedContainer;
 
 // Dummy type with unordered equality and hashing semantics.  This preserves
 // input order internally, and is used below to ensure we get test coverage
-// for equal sequences with different iteraton orders.
+// for equal sequences with different iteration orders.
 template <typename T>
 class UnorderedSequence {
  public:
diff --git a/deps/v8/third_party/abseil-cpp/absl/hash/hash_test.cc b/deps/v8/third_party/abseil-cpp/absl/hash/hash_test.cc
index e25c0acad36ffb..c3182f1ff6a357 100644
--- a/deps/v8/third_party/abseil-cpp/absl/hash/hash_test.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/hash/hash_test.cc
@@ -38,6 +38,7 @@
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
 #include "absl/base/config.h"
+#include "absl/container/flat_hash_map.h"
 #include "absl/container/flat_hash_set.h"
 #include "absl/hash/hash_testing.h"
 #include "absl/hash/internal/hash_test.h"
@@ -190,9 +191,8 @@ TEST(HashValueTest, PointerAlignment) {
     // Limit the scope to the bits we would be using for Swisstable.
     constexpr size_t kMask = (1 << (kLog2NumValues + 7)) - 1;
     size_t stuck_bits = (~bits_or | bits_and) & kMask;
-    // Test that there are at most 2 stuck bits. Sometimes we see stuck_bits
-    // of 0x3.
-    EXPECT_LE(absl::popcount(stuck_bits), 2) << "0x" << std::hex << stuck_bits;
+    // Test that there are at most 3 stuck bits.
+    EXPECT_LE(absl::popcount(stuck_bits), 3) << "0x" << std::hex << stuck_bits;
   }
 }
 
@@ -400,7 +400,7 @@ TEST(HashValueTest, TestIntrinsicInt128) {
   EXPECT_TRUE((is_hashable<__int128_t>::value));
   EXPECT_TRUE((is_hashable<__uint128_t>::value));
 
-  absl::flat_hash_set<size_t> hashes;
+  absl::flat_hash_map<size_t, int> hash_to_index;
   std::vector<__uint128_t> values;
   for (int i = 0; i < 128; ++i) {
     // Some arbitrary pattern to check if changing each bit changes the hash.
@@ -411,13 +411,14 @@ TEST(HashValueTest, TestIntrinsicInt128) {
     const __int128_t as_signed = static_cast<__int128_t>(value);
 
     values.push_back(value);
-    hashes.insert(absl::Hash<__uint128_t>{}(value));
+    auto [it, inserted] =
+        hash_to_index.insert({absl::Hash<__uint128_t>{}(value), i});
+    ASSERT_TRUE(inserted) << "Duplicate hash: " << i << " vs " << it->second;
 
     // Verify that the fast-path for MixingHashState does not break the hash.
     EXPECT_EQ(absl::HashOf(value), absl::Hash<__uint128_t>{}(value));
     EXPECT_EQ(absl::HashOf(as_signed), absl::Hash<__int128_t>{}(as_signed));
   }
-  EXPECT_THAT(hashes, SizeIs(128));
 
   EXPECT_TRUE(absl::VerifyTypeImplementsAbslHashCorrectly(values));
   EXPECT_TRUE(absl::VerifyTypeImplementsAbslHashCorrectly(
@@ -706,7 +707,9 @@ TEST(HashValueTest, CombinePiecewiseBuffer) {
   //
   // This test is run on a buffer that is a multiple of the stride size, and one
   // that isn't.
-  for (size_t big_buffer_size : {1024u * 2 + 512u, 1024u * 3}) {
+  const size_t kChunkSize = absl::hash_internal::PiecewiseChunkSize();
+  for (size_t big_buffer_size :
+       {2 * kChunkSize + kChunkSize / 2, 3 * kChunkSize}) {
     SCOPED_TRACE(big_buffer_size);
     std::string big_buffer;
     for (size_t i = 0; i < big_buffer_size; ++i) {
@@ -716,8 +719,15 @@ TEST(HashValueTest, CombinePiecewiseBuffer) {
     auto big_buffer_hash = hash(PiecewiseHashTester(big_buffer));
 
     const int possible_breaks = 9;
-    size_t breaks[possible_breaks] = {1,    512,  1023, 1024, 1025,
-                                      1536, 2047, 2048, 2049};
+    size_t breaks[possible_breaks] = {1,
+                                      kChunkSize / 2,
+                                      kChunkSize - 1,
+                                      kChunkSize,
+                                      kChunkSize + 1,
+                                      kChunkSize + kChunkSize / 2,
+                                      2 * kChunkSize - 1,
+                                      2 * kChunkSize,
+                                      2 * kChunkSize + 1};
     for (unsigned test_mask = 0; test_mask < (1u << possible_breaks);
          ++test_mask) {
       SCOPED_TRACE(test_mask);
@@ -727,7 +737,7 @@ TEST(HashValueTest, CombinePiecewiseBuffer) {
           break_locations.insert(breaks[j]);
         }
       }
-      EXPECT_EQ(
+      ASSERT_EQ(
           hash(PiecewiseHashTester(big_buffer, std::move(break_locations))),
           big_buffer_hash);
     }
@@ -1213,4 +1223,20 @@ TEST(HashOf, MatchesTypeErasedHashState) {
                                     TypeErasedHashStateUser{1, s}));
 }
 
+struct AutoReturnTypeUser {
+  int a;
+  std::string b;
+
+  template <typename H>
+  friend auto AbslHashValue(H state, const AutoReturnTypeUser& value) {
+    return H::combine(std::move(state), value.a, value.b);
+  }
+};
+
+TEST(HashOf, AutoReturnTypeUser) {
+  std::string s = "s";
+  EXPECT_EQ(absl::HashOf(1, s),
+            absl::Hash<AutoReturnTypeUser>{}(AutoReturnTypeUser{1, s}));
+}
+
 }  // namespace
diff --git a/deps/v8/third_party/abseil-cpp/absl/hash/hash_testing.h b/deps/v8/third_party/abseil-cpp/absl/hash/hash_testing.h
index 207dfafa5f116f..817a40da58e8a4 100644
--- a/deps/v8/third_party/abseil-cpp/absl/hash/hash_testing.h
+++ b/deps/v8/third_party/abseil-cpp/absl/hash/hash_testing.h
@@ -15,7 +15,9 @@
 #ifndef ABSL_HASH_HASH_TESTING_H_
 #define ABSL_HASH_HASH_TESTING_H_
 
+#include <cstddef>
 #include <initializer_list>
+#include <string>
 #include <tuple>
 #include <type_traits>
 #include <vector>
diff --git a/deps/v8/third_party/abseil-cpp/absl/hash/internal/hash.h b/deps/v8/third_party/abseil-cpp/absl/hash/internal/hash.h
index 4db7f0f6d40d4c..c1b1f66b6af030 100644
--- a/deps/v8/third_party/abseil-cpp/absl/hash/internal/hash.h
+++ b/deps/v8/third_party/abseil-cpp/absl/hash/internal/hash.h
@@ -24,6 +24,8 @@
 #include <TargetConditionals.h>
 #endif
 
+// We include config.h here to make sure that ABSL_INTERNAL_CPLUSPLUS_LANG is
+// defined.
 #include "absl/base/config.h"
 
 // For feature testing and determining which headers can be included.
@@ -65,7 +67,7 @@
 #include "absl/base/port.h"
 #include "absl/container/fixed_array.h"
 #include "absl/hash/internal/city.h"
-#include "absl/hash/internal/low_level_hash.h"
+#include "absl/hash/internal/weakly_mixed_integer.h"
 #include "absl/meta/type_traits.h"
 #include "absl/numeric/bits.h"
 #include "absl/numeric/int128.h"
@@ -394,6 +396,11 @@ H hash_bytes(H hash_state, const T& value) {
   return H::combine_contiguous(std::move(hash_state), start, sizeof(value));
 }
 
+template <typename H>
+H hash_weakly_mixed_integer(H hash_state, WeaklyMixedInteger value) {
+  return H::combine_weakly_mixed_integer(std::move(hash_state), value);
+}
+
 // -----------------------------------------------------------------------------
 // AbslHashValue for Basic Types
 // -----------------------------------------------------------------------------
@@ -609,7 +616,7 @@ template <typename H>
 H AbslHashValue(H hash_state, absl::string_view str) {
   return H::combine(
       H::combine_contiguous(std::move(hash_state), str.data(), str.size()),
-      str.size());
+      WeaklyMixedInteger{str.size()});
 }
 
 // Support std::wstring, std::u16string and std::u32string.
@@ -622,7 +629,7 @@ H AbslHashValue(
     const std::basic_string<Char, std::char_traits<Char>, Alloc>& str) {
   return H::combine(
       H::combine_contiguous(std::move(hash_state), str.data(), str.size()),
-      str.size());
+      WeaklyMixedInteger{str.size()});
 }
 
 #ifdef ABSL_HAVE_STD_STRING_VIEW
@@ -635,7 +642,7 @@ template <typename Char, typename H,
 H AbslHashValue(H hash_state, std::basic_string_view<Char> str) {
   return H::combine(
       H::combine_contiguous(std::move(hash_state), str.data(), str.size()),
-      str.size());
+      WeaklyMixedInteger{str.size()});
 }
 
 #endif  // ABSL_HAVE_STD_STRING_VIEW
@@ -685,7 +692,7 @@ typename std::enable_if<is_hashable<T>::value, H>::type AbslHashValue(
   for (const auto& t : deque) {
     hash_state = H::combine(std::move(hash_state), t);
   }
-  return H::combine(std::move(hash_state), deque.size());
+  return H::combine(std::move(hash_state), WeaklyMixedInteger{deque.size()});
 }
 
 // AbslHashValue for hashing std::forward_list
@@ -697,7 +704,7 @@ typename std::enable_if<is_hashable<T>::value, H>::type AbslHashValue(
     hash_state = H::combine(std::move(hash_state), t);
     ++size;
   }
-  return H::combine(std::move(hash_state), size);
+  return H::combine(std::move(hash_state), WeaklyMixedInteger{size});
 }
 
 // AbslHashValue for hashing std::list
@@ -707,7 +714,7 @@ typename std::enable_if<is_hashable<T>::value, H>::type AbslHashValue(
   for (const auto& t : list) {
     hash_state = H::combine(std::move(hash_state), t);
   }
-  return H::combine(std::move(hash_state), list.size());
+  return H::combine(std::move(hash_state), WeaklyMixedInteger{list.size()});
 }
 
 // AbslHashValue for hashing std::vector
@@ -721,7 +728,7 @@ typename std::enable_if<is_hashable<T>::value && !std::is_same<T, bool>::value,
 AbslHashValue(H hash_state, const std::vector<T, Allocator>& vector) {
   return H::combine(H::combine_contiguous(std::move(hash_state), vector.data(),
                                           vector.size()),
-                    vector.size());
+                    WeaklyMixedInteger{vector.size()});
 }
 
 // AbslHashValue special cases for hashing std::vector<bool>
@@ -742,7 +749,8 @@ AbslHashValue(H hash_state, const std::vector<T, Allocator>& vector) {
     unsigned char c = static_cast<unsigned char>(i);
     hash_state = combiner.add_buffer(std::move(hash_state), &c, sizeof(c));
   }
-  return H::combine(combiner.finalize(std::move(hash_state)), vector.size());
+  return H::combine(combiner.finalize(std::move(hash_state)),
+                    WeaklyMixedInteger{vector.size()});
 }
 #else
 // When not working around the libstdc++ bug above, we still have to contend
@@ -758,7 +766,7 @@ typename std::enable_if<is_hashable<T>::value && std::is_same<T, bool>::value,
 AbslHashValue(H hash_state, const std::vector<T, Allocator>& vector) {
   return H::combine(std::move(hash_state),
                     std::hash<std::vector<T, Allocator>>{}(vector),
-                    vector.size());
+                    WeaklyMixedInteger{vector.size()});
 }
 #endif
 
@@ -775,7 +783,7 @@ AbslHashValue(H hash_state, const std::map<Key, T, Compare, Allocator>& map) {
   for (const auto& t : map) {
     hash_state = H::combine(std::move(hash_state), t);
   }
-  return H::combine(std::move(hash_state), map.size());
+  return H::combine(std::move(hash_state), WeaklyMixedInteger{map.size()});
 }
 
 // AbslHashValue for hashing std::multimap
@@ -788,7 +796,7 @@ AbslHashValue(H hash_state,
   for (const auto& t : map) {
     hash_state = H::combine(std::move(hash_state), t);
   }
-  return H::combine(std::move(hash_state), map.size());
+  return H::combine(std::move(hash_state), WeaklyMixedInteger{map.size()});
 }
 
 // AbslHashValue for hashing std::set
@@ -798,7 +806,7 @@ typename std::enable_if<is_hashable<Key>::value, H>::type AbslHashValue(
   for (const auto& t : set) {
     hash_state = H::combine(std::move(hash_state), t);
   }
-  return H::combine(std::move(hash_state), set.size());
+  return H::combine(std::move(hash_state), WeaklyMixedInteger{set.size()});
 }
 
 // AbslHashValue for hashing std::multiset
@@ -808,7 +816,7 @@ typename std::enable_if<is_hashable<Key>::value, H>::type AbslHashValue(
   for (const auto& t : set) {
     hash_state = H::combine(std::move(hash_state), t);
   }
-  return H::combine(std::move(hash_state), set.size());
+  return H::combine(std::move(hash_state), WeaklyMixedInteger{set.size()});
 }
 
 // -----------------------------------------------------------------------------
@@ -822,7 +830,7 @@ typename std::enable_if<is_hashable<Key>::value, H>::type AbslHashValue(
     H hash_state, const std::unordered_set<Key, Hash, KeyEqual, Alloc>& s) {
   return H::combine(
       H::combine_unordered(std::move(hash_state), s.begin(), s.end()),
-      s.size());
+      WeaklyMixedInteger{s.size()});
 }
 
 // AbslHashValue for hashing std::unordered_multiset
@@ -833,7 +841,7 @@ typename std::enable_if<is_hashable<Key>::value, H>::type AbslHashValue(
     const std::unordered_multiset<Key, Hash, KeyEqual, Alloc>& s) {
   return H::combine(
       H::combine_unordered(std::move(hash_state), s.begin(), s.end()),
-      s.size());
+      WeaklyMixedInteger{s.size()});
 }
 
 // AbslHashValue for hashing std::unordered_set
@@ -845,7 +853,7 @@ AbslHashValue(H hash_state,
               const std::unordered_map<Key, T, Hash, KeyEqual, Alloc>& s) {
   return H::combine(
       H::combine_unordered(std::move(hash_state), s.begin(), s.end()),
-      s.size());
+      WeaklyMixedInteger{s.size()});
 }
 
 // AbslHashValue for hashing std::unordered_multiset
@@ -857,7 +865,7 @@ AbslHashValue(H hash_state,
               const std::unordered_multimap<Key, T, Hash, KeyEqual, Alloc>& s) {
   return H::combine(
       H::combine_unordered(std::move(hash_state), s.begin(), s.end()),
-      s.size());
+      WeaklyMixedInteger{s.size()});
 }
 
 // -----------------------------------------------------------------------------
@@ -968,11 +976,20 @@ hash_range_or_bytes(H hash_state, const T* data, size_t size) {
 // `false`.
 struct HashSelect {
  private:
+  struct WeaklyMixedIntegerProbe {
+    template <typename H>
+    static H Invoke(H state, WeaklyMixedInteger value) {
+      return hash_internal::hash_weakly_mixed_integer(std::move(state), value);
+    }
+  };
+
   struct State : HashStateBase<State> {
     static State combine_contiguous(State hash_state, const unsigned char*,
                                     size_t);
     using State::HashStateBase::combine_contiguous;
     static State combine_raw(State state, uint64_t value);
+    static State combine_weakly_mixed_integer(State hash_state,
+                                              WeaklyMixedInteger value);
   };
 
   struct UniquelyRepresentedProbe {
@@ -1034,6 +1051,7 @@ struct HashSelect {
   // disjunction provides short circuiting wrt instantiation.
   template <typename T>
   using Apply = absl::disjunction<         //
+      Probe<WeaklyMixedIntegerProbe, T>,   //
       Probe<UniquelyRepresentedProbe, T>,  //
       Probe<HashValueProbe, T>,            //
       Probe<LegacyHashProbe, T>,           //
@@ -1114,6 +1132,19 @@ class ABSL_DLL MixingHashState : public HashStateBase<MixingHashState> {
   MixingHashState() : state_(Seed()) {}
 
   friend class MixingHashState::HashStateBase;
+  template <typename H>
+  friend H absl::hash_internal::hash_weakly_mixed_integer(H,
+                                                          WeaklyMixedInteger);
+
+  static MixingHashState combine_weakly_mixed_integer(
+      MixingHashState hash_state, WeaklyMixedInteger value) {
+    // Some transformation for the value is needed to make an empty
+    // string/container change the mixing hash state.
+    // Seed() is most likely already in a register.
+    // TODO(b/384509507): experiment with using kMul or last 31 bits of kMul.
+    // See https://godbolt.org/z/6cM77s3PW for ideas.
+    return MixingHashState{hash_state.state_ + (Seed() + value.value)};
+  }
 
   template <typename CombinerT>
   static MixingHashState RunCombineUnordered(MixingHashState state,
@@ -1222,8 +1253,8 @@ class ABSL_DLL MixingHashState : public HashStateBase<MixingHashState> {
                                                size_t len);
 
   // Reads 9 to 16 bytes from p.
-  // The least significant 8 bytes are in .first, the rest (zero padded) bytes
-  // are in .second.
+  // The least significant 8 bytes are in .first, and the rest of the bytes are
+  // in .second along with duplicated bytes from .first if len<16.
   static std::pair<uint64_t, uint64_t> Read9To16(const unsigned char* p,
                                                  size_t len) {
     uint64_t low_mem = Read8(p);
@@ -1286,13 +1317,16 @@ class ABSL_DLL MixingHashState : public HashStateBase<MixingHashState> {
   }
 
   ABSL_ATTRIBUTE_ALWAYS_INLINE static uint64_t Mix(uint64_t lhs, uint64_t rhs) {
+    // For 32 bit platforms we are trying to use all 64 lower bits.
+    if constexpr (sizeof(size_t) < 8) {
+      uint64_t m = lhs * rhs;
+      return m ^ (m >> 32);
+    }
     // Though the 128-bit product on AArch64 needs two instructions, it is
     // still a good balance between speed and hash quality.
-    using MultType =
-        absl::conditional_t<sizeof(size_t) == 4, uint64_t, uint128>;
-    MultType m = lhs;
+    uint128 m = lhs;
     m *= rhs;
-    return static_cast<uint64_t>(m ^ (m >> (sizeof(m) * 8 / 2)));
+    return Uint128High64(m) ^ Uint128Low64(m);
   }
 
   // Slightly lower latency than Mix, but with lower quality. The byte swap
@@ -1302,13 +1336,7 @@ class ABSL_DLL MixingHashState : public HashStateBase<MixingHashState> {
     const uint64_t n = lhs ^ rhs;
     // WeakMix doesn't work well on 32-bit platforms so just use Mix.
     if constexpr (sizeof(size_t) < 8) return Mix(n, kMul);
-#ifdef __ARM_ACLE
-    // gbswap_64 compiles to `rev` on ARM, but `rbit` is better because it
-    // reverses bits rather than reversing bytes.
-    return __rbitll(n * kMul);
-#else
     return absl::gbswap_64(n * kMul);
-#endif
   }
 
   // An extern to avoid bloat on a direct call to LowLevelHash() with fixed
diff --git a/deps/v8/third_party/abseil-cpp/absl/hash/internal/spy_hash_state.h b/deps/v8/third_party/abseil-cpp/absl/hash/internal/spy_hash_state.h
index 92490b1a21ea34..e403113b0ea081 100644
--- a/deps/v8/third_party/abseil-cpp/absl/hash/internal/spy_hash_state.h
+++ b/deps/v8/third_party/abseil-cpp/absl/hash/internal/spy_hash_state.h
@@ -16,12 +16,14 @@
 #define ABSL_HASH_INTERNAL_SPY_HASH_STATE_H_
 
 #include <algorithm>
+#include <cstddef>
 #include <cstdint>
 #include <ostream>
 #include <string>
 #include <vector>
 
 #include "absl/hash/hash.h"
+#include "absl/hash/internal/weakly_mixed_integer.h"
 #include "absl/strings/match.h"
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_join.h"
@@ -167,6 +169,11 @@ class SpyHashStateImpl : public HashStateBase<SpyHashStateImpl<T>> {
     return hash_state;
   }
 
+  static SpyHashStateImpl combine_weakly_mixed_integer(
+      SpyHashStateImpl hash_state, WeaklyMixedInteger value) {
+    return combine(std::move(hash_state), value.value);
+  }
+
   using SpyHashStateImpl::HashStateBase::combine_contiguous;
 
   template <typename CombinerT>
diff --git a/deps/v8/third_party/abseil-cpp/absl/hash/internal/weakly_mixed_integer.h b/deps/v8/third_party/abseil-cpp/absl/hash/internal/weakly_mixed_integer.h
new file mode 100644
index 00000000000000..55754366c03b99
--- /dev/null
+++ b/deps/v8/third_party/abseil-cpp/absl/hash/internal/weakly_mixed_integer.h
@@ -0,0 +1,38 @@
+// Copyright 2025 The Abseil Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef ABSL_HASH_INTERNAL_WEAKLY_MIXED_INTEGER_H_
+#define ABSL_HASH_INTERNAL_WEAKLY_MIXED_INTEGER_H_
+
+#include <cstddef>
+
+#include "absl/base/config.h"
+
+namespace absl {
+ABSL_NAMESPACE_BEGIN
+namespace hash_internal {
+
+// Contains an integer that will be mixed into a hash state more weakly than
+// regular integers. It is useful for cases in which an integer is a part of a
+// larger object and needs to be mixed as a supplement. E.g., absl::string_view
+// and absl::Span are mixing their size wrapped with WeaklyMixedInteger.
+struct WeaklyMixedInteger {
+  size_t value;
+};
+
+}  // namespace hash_internal
+ABSL_NAMESPACE_END
+}  // namespace absl
+
+#endif  // ABSL_HASH_INTERNAL_WEAKLY_MIXED_INTEGER_H_
diff --git a/deps/v8/third_party/abseil-cpp/absl/log/internal/BUILD.bazel b/deps/v8/third_party/abseil-cpp/absl/log/internal/BUILD.bazel
index 5d54b6fce2a827..c0521055c0c5f0 100644
--- a/deps/v8/third_party/abseil-cpp/absl/log/internal/BUILD.bazel
+++ b/deps/v8/third_party/abseil-cpp/absl/log/internal/BUILD.bazel
@@ -68,9 +68,7 @@ cc_library(
     hdrs = ["check_op.h"],
     copts = ABSL_DEFAULT_COPTS,
     linkopts = ABSL_DEFAULT_LINKOPTS,
-    visibility = [
-        "//absl/log:__pkg__",
-    ],
+    visibility = ["//absl/log:__pkg__"],
     deps = [
         ":nullguard",
         ":nullstream",
diff --git a/deps/v8/third_party/abseil-cpp/absl/log/internal/check_op.cc b/deps/v8/third_party/abseil-cpp/absl/log/internal/check_op.cc
index bda8c095c32087..23db63bf101f83 100644
--- a/deps/v8/third_party/abseil-cpp/absl/log/internal/check_op.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/log/internal/check_op.cc
@@ -36,8 +36,8 @@ ABSL_NAMESPACE_BEGIN
 namespace log_internal {
 
 #define ABSL_LOG_INTERNAL_DEFINE_MAKE_CHECK_OP_STRING(x) \
-  template absl::Nonnull<const char*> MakeCheckOpString( \
-      x, x, absl::Nonnull<const char*>)
+  template const char* absl_nonnull MakeCheckOpString(   \
+      x, x, const char* absl_nonnull)
 ABSL_LOG_INTERNAL_DEFINE_MAKE_CHECK_OP_STRING(bool);
 ABSL_LOG_INTERNAL_DEFINE_MAKE_CHECK_OP_STRING(int64_t);
 ABSL_LOG_INTERNAL_DEFINE_MAKE_CHECK_OP_STRING(uint64_t);
@@ -54,7 +54,7 @@ ABSL_LOG_INTERNAL_DEFINE_MAKE_CHECK_OP_STRING(const void*);
 #undef ABSL_LOG_INTERNAL_DEFINE_MAKE_CHECK_OP_STRING
 
 CheckOpMessageBuilder::CheckOpMessageBuilder(
-    absl::Nonnull<const char*> exprtext) {
+    const char* absl_nonnull exprtext) {
   stream_ << exprtext << " (";
 }
 
@@ -63,7 +63,7 @@ std::ostream& CheckOpMessageBuilder::ForVar2() {
   return stream_;
 }
 
-absl::Nonnull<const char*> CheckOpMessageBuilder::NewString() {
+const char* absl_nonnull CheckOpMessageBuilder::NewString() {
   stream_ << ")";
   // There's no need to free this string since the process is crashing.
   return absl::IgnoreLeak(new std::string(std::move(stream_).str()))->c_str();
@@ -103,9 +103,9 @@ void MakeCheckOpValueString(std::ostream& os, const void* p) {
 
 // Helper functions for string comparisons.
 #define DEFINE_CHECK_STROP_IMPL(name, func, expected)                          \
-  absl::Nullable<const char*> Check##func##expected##Impl(                     \
-      absl::Nullable<const char*> s1, absl::Nullable<const char*> s2,          \
-      absl::Nonnull<const char*> exprtext) {                                   \
+  const char* absl_nullable Check##func##expected##Impl(                       \
+      const char* absl_nullable s1, const char* absl_nullable s2,              \
+      const char* absl_nonnull exprtext) {                                     \
     bool equal = s1 == s2 || (s1 && s2 && !func(s1, s2));                      \
     if (equal == expected) {                                                   \
       return nullptr;                                                          \
diff --git a/deps/v8/third_party/abseil-cpp/absl/log/internal/check_op.h b/deps/v8/third_party/abseil-cpp/absl/log/internal/check_op.h
index 8d7ade4427e5a2..dc7d19e9a13bf2 100644
--- a/deps/v8/third_party/abseil-cpp/absl/log/internal/check_op.h
+++ b/deps/v8/third_party/abseil-cpp/absl/log/internal/check_op.h
@@ -64,49 +64,48 @@
 #endif
 
 #define ABSL_LOG_INTERNAL_CHECK_OP(name, op, val1, val1_text, val2, val2_text) \
-  while (absl::Nullable<const char*> absl_log_internal_check_op_result         \
-             [[maybe_unused]] =                 \
-                 ::absl::log_internal::name##Impl(                             \
-                     ::absl::log_internal::GetReferenceableValue(val1),        \
-                     ::absl::log_internal::GetReferenceableValue(val2),        \
-                     ABSL_LOG_INTERNAL_STRIP_STRING_LITERAL(                   \
-                         val1_text " " #op " " val2_text)))                    \
+  while (const char* absl_nullable absl_log_internal_check_op_result           \
+         [[maybe_unused]] = ::absl::log_internal::name##Impl(                  \
+             ::absl::log_internal::GetReferenceableValue(val1),                \
+             ::absl::log_internal::GetReferenceableValue(val2),                \
+             ABSL_LOG_INTERNAL_STRIP_STRING_LITERAL(val1_text " " #op          \
+                                                              " " val2_text))) \
     ABSL_LOG_INTERNAL_CONDITION_FATAL(STATELESS, true)                         \
-  ABSL_LOG_INTERNAL_CHECK(absl::implicit_cast<absl::Nonnull<const char*>>(     \
+  ABSL_LOG_INTERNAL_CHECK(::absl::implicit_cast<const char* absl_nonnull>(     \
                               absl_log_internal_check_op_result))              \
       .InternalStream()
 #define ABSL_LOG_INTERNAL_QCHECK_OP(name, op, val1, val1_text, val2,        \
                                     val2_text)                              \
-  while (absl::Nullable<const char*> absl_log_internal_qcheck_op_result =   \
+  while (const char* absl_nullable absl_log_internal_qcheck_op_result =     \
              ::absl::log_internal::name##Impl(                              \
                  ::absl::log_internal::GetReferenceableValue(val1),         \
                  ::absl::log_internal::GetReferenceableValue(val2),         \
                  ABSL_LOG_INTERNAL_STRIP_STRING_LITERAL(                    \
                      val1_text " " #op " " val2_text)))                     \
     ABSL_LOG_INTERNAL_CONDITION_QFATAL(STATELESS, true)                     \
-  ABSL_LOG_INTERNAL_QCHECK(absl::implicit_cast<absl::Nonnull<const char*>>( \
+  ABSL_LOG_INTERNAL_QCHECK(::absl::implicit_cast<const char* absl_nonnull>( \
                                absl_log_internal_qcheck_op_result))         \
       .InternalStream()
 #define ABSL_LOG_INTERNAL_CHECK_STROP(func, op, expected, s1, s1_text, s2,     \
                                       s2_text)                                 \
-  while (absl::Nullable<const char*> absl_log_internal_check_strop_result =    \
+  while (const char* absl_nullable absl_log_internal_check_strop_result =      \
              ::absl::log_internal::Check##func##expected##Impl(                \
                  (s1), (s2),                                                   \
                  ABSL_LOG_INTERNAL_STRIP_STRING_LITERAL(s1_text " " #op        \
                                                                 " " s2_text))) \
     ABSL_LOG_INTERNAL_CONDITION_FATAL(STATELESS, true)                         \
-  ABSL_LOG_INTERNAL_CHECK(absl::implicit_cast<absl::Nonnull<const char*>>(     \
+  ABSL_LOG_INTERNAL_CHECK(::absl::implicit_cast<const char* absl_nonnull>(     \
                               absl_log_internal_check_strop_result))           \
       .InternalStream()
 #define ABSL_LOG_INTERNAL_QCHECK_STROP(func, op, expected, s1, s1_text, s2,    \
                                        s2_text)                                \
-  while (absl::Nullable<const char*> absl_log_internal_qcheck_strop_result =   \
+  while (const char* absl_nullable absl_log_internal_qcheck_strop_result =     \
              ::absl::log_internal::Check##func##expected##Impl(                \
                  (s1), (s2),                                                   \
                  ABSL_LOG_INTERNAL_STRIP_STRING_LITERAL(s1_text " " #op        \
                                                                 " " s2_text))) \
     ABSL_LOG_INTERNAL_CONDITION_QFATAL(STATELESS, true)                        \
-  ABSL_LOG_INTERNAL_QCHECK(absl::implicit_cast<absl::Nonnull<const char*>>(    \
+  ABSL_LOG_INTERNAL_QCHECK(::absl::implicit_cast<const char* absl_nonnull>(    \
                                absl_log_internal_qcheck_strop_result))         \
       .InternalStream()
 
@@ -135,8 +134,8 @@
 //   strip the call to stringify the non-ok `Status` as long as we don't log it;
 //   dropping the `Status`'s message text is out of scope.
 #define ABSL_LOG_INTERNAL_CHECK_OK(val, val_text)                          \
-  for (::std::pair<absl::Nonnull<const ::absl::Status*>,                   \
-                   absl::Nullable<const char*>>                            \
+  for (::std::pair<const ::absl::Status* absl_nonnull,                     \
+                   const char* absl_nullable>                              \
            absl_log_internal_check_ok_goo;                                 \
        absl_log_internal_check_ok_goo.first =                              \
            ::absl::log_internal::AsStatus(val),                            \
@@ -149,12 +148,12 @@
                                                             " is OK")),    \
        !ABSL_PREDICT_TRUE(absl_log_internal_check_ok_goo.first->ok());)    \
     ABSL_LOG_INTERNAL_CONDITION_FATAL(STATELESS, true)                     \
-  ABSL_LOG_INTERNAL_CHECK(absl::implicit_cast<absl::Nonnull<const char*>>( \
+  ABSL_LOG_INTERNAL_CHECK(::absl::implicit_cast<const char* absl_nonnull>( \
                               absl_log_internal_check_ok_goo.second))      \
       .InternalStream()
 #define ABSL_LOG_INTERNAL_QCHECK_OK(val, val_text)                          \
-  for (::std::pair<absl::Nonnull<const ::absl::Status*>,                    \
-                   absl::Nullable<const char*>>                             \
+  for (::std::pair<const ::absl::Status* absl_nonnull,                      \
+                   const char* absl_nullable>                               \
            absl_log_internal_qcheck_ok_goo;                                 \
        absl_log_internal_qcheck_ok_goo.first =                              \
            ::absl::log_internal::AsStatus(val),                             \
@@ -167,7 +166,7 @@
                                                             " is OK")),     \
        !ABSL_PREDICT_TRUE(absl_log_internal_qcheck_ok_goo.first->ok());)    \
     ABSL_LOG_INTERNAL_CONDITION_QFATAL(STATELESS, true)                     \
-  ABSL_LOG_INTERNAL_QCHECK(absl::implicit_cast<absl::Nonnull<const char*>>( \
+  ABSL_LOG_INTERNAL_QCHECK(::absl::implicit_cast<const char* absl_nonnull>( \
                                absl_log_internal_qcheck_ok_goo.second))     \
       .InternalStream()
 
@@ -179,9 +178,8 @@ template <typename T>
 class StatusOr;
 
 namespace status_internal {
-ABSL_ATTRIBUTE_PURE_FUNCTION absl::Nonnull<const char*> MakeCheckFailString(
-    absl::Nonnull<const absl::Status*> status,
-    absl::Nonnull<const char*> prefix);
+ABSL_ATTRIBUTE_PURE_FUNCTION const char* absl_nonnull MakeCheckFailString(
+    const absl::Status* absl_nonnull status, const char* absl_nonnull prefix);
 }  // namespace status_internal
 
 namespace log_internal {
@@ -189,11 +187,11 @@ namespace log_internal {
 // Convert a Status or a StatusOr to its underlying status value.
 //
 // (This implementation does not require a dep on absl::Status to work.)
-inline absl::Nonnull<const absl::Status*> AsStatus(const absl::Status& s) {
+inline const absl::Status* absl_nonnull AsStatus(const absl::Status& s) {
   return &s;
 }
 template <typename T>
-absl::Nonnull<const absl::Status*> AsStatus(const absl::StatusOr<T>& s) {
+const absl::Status* absl_nonnull AsStatus(const absl::StatusOr<T>& s) {
   return &s.status();
 }
 
@@ -202,14 +200,14 @@ absl::Nonnull<const absl::Status*> AsStatus(const absl::StatusOr<T>& s) {
 class CheckOpMessageBuilder final {
  public:
   // Inserts `exprtext` and ` (` to the stream.
-  explicit CheckOpMessageBuilder(absl::Nonnull<const char*> exprtext);
+  explicit CheckOpMessageBuilder(const char* absl_nonnull exprtext);
   ~CheckOpMessageBuilder() = default;
   // For inserting the first variable.
   std::ostream& ForVar1() { return stream_; }
   // For inserting the second variable (adds an intermediate ` vs. `).
   std::ostream& ForVar2();
   // Get the result (inserts the closing `)`).
-  absl::Nonnull<const char*> NewString();
+  const char* absl_nonnull NewString();
 
  private:
   std::ostringstream stream_;
@@ -352,12 +350,12 @@ using CheckOpStreamType = decltype(detect_specialization::Detect<T>(0));
 
 // Build the error message string.  Specify no inlining for code size.
 template <typename T1, typename T2>
-ABSL_ATTRIBUTE_RETURNS_NONNULL absl::Nonnull<const char*> MakeCheckOpString(
-    T1 v1, T2 v2, absl::Nonnull<const char*> exprtext) ABSL_ATTRIBUTE_NOINLINE;
+ABSL_ATTRIBUTE_RETURNS_NONNULL const char* absl_nonnull MakeCheckOpString(
+    T1 v1, T2 v2, const char* absl_nonnull exprtext) ABSL_ATTRIBUTE_NOINLINE;
 
 template <typename T1, typename T2>
-absl::Nonnull<const char*> MakeCheckOpString(
-    T1 v1, T2 v2, absl::Nonnull<const char*> exprtext) {
+const char* absl_nonnull MakeCheckOpString(T1 v1, T2 v2,
+                                           const char* absl_nonnull exprtext) {
   CheckOpMessageBuilder comb(exprtext);
   MakeCheckOpValueString(comb.ForVar1(), v1);
   MakeCheckOpValueString(comb.ForVar2(), v2);
@@ -367,8 +365,8 @@ absl::Nonnull<const char*> MakeCheckOpString(
 // Add a few commonly used instantiations as extern to reduce size of objects
 // files.
 #define ABSL_LOG_INTERNAL_DEFINE_MAKE_CHECK_OP_STRING_EXTERN(x) \
-  extern template absl::Nonnull<const char*> MakeCheckOpString( \
-      x, x, absl::Nonnull<const char*>)
+  extern template const char* absl_nonnull MakeCheckOpString(   \
+      x, x, const char* absl_nonnull)
 ABSL_LOG_INTERNAL_DEFINE_MAKE_CHECK_OP_STRING_EXTERN(bool);
 ABSL_LOG_INTERNAL_DEFINE_MAKE_CHECK_OP_STRING_EXTERN(int64_t);
 ABSL_LOG_INTERNAL_DEFINE_MAKE_CHECK_OP_STRING_EXTERN(uint64_t);
@@ -404,8 +402,8 @@ ABSL_LOG_INTERNAL_DEFINE_MAKE_CHECK_OP_STRING_EXTERN(const void*);
 // type.
 #define ABSL_LOG_INTERNAL_CHECK_OP_IMPL(name, op)                          \
   template <typename T1, typename T2>                                      \
-  inline constexpr absl::Nullable<const char*> name##Impl(                 \
-      const T1& v1, const T2& v2, absl::Nonnull<const char*> exprtext) {   \
+  inline constexpr const char* absl_nullable name##Impl(                   \
+      const T1& v1, const T2& v2, const char* absl_nonnull exprtext) {     \
     using U1 = CheckOpStreamType<T1>;                                      \
     using U2 = CheckOpStreamType<T2>;                                      \
     return ABSL_PREDICT_TRUE(v1 op v2)                                     \
@@ -413,8 +411,8 @@ ABSL_LOG_INTERNAL_DEFINE_MAKE_CHECK_OP_STRING_EXTERN(const void*);
                : ABSL_LOG_INTERNAL_CHECK_OP_IMPL_RESULT(U1, U2, U1(v1),    \
                                                         U2(v2), exprtext); \
   }                                                                        \
-  inline constexpr absl::Nullable<const char*> name##Impl(                 \
-      int v1, int v2, absl::Nonnull<const char*> exprtext) {               \
+  inline constexpr const char* absl_nullable name##Impl(                   \
+      int v1, int v2, const char* absl_nonnull exprtext) {                 \
     return name##Impl<int, int>(v1, v2, exprtext);                         \
   }
 
@@ -427,18 +425,18 @@ ABSL_LOG_INTERNAL_CHECK_OP_IMPL(Check_GT, >)
 #undef ABSL_LOG_INTERNAL_CHECK_OP_IMPL_RESULT
 #undef ABSL_LOG_INTERNAL_CHECK_OP_IMPL
 
-absl::Nullable<const char*> CheckstrcmptrueImpl(
-    absl::Nullable<const char*> s1, absl::Nullable<const char*> s2,
-    absl::Nonnull<const char*> exprtext);
-absl::Nullable<const char*> CheckstrcmpfalseImpl(
-    absl::Nullable<const char*> s1, absl::Nullable<const char*> s2,
-    absl::Nonnull<const char*> exprtext);
-absl::Nullable<const char*> CheckstrcasecmptrueImpl(
-    absl::Nullable<const char*> s1, absl::Nullable<const char*> s2,
-    absl::Nonnull<const char*> exprtext);
-absl::Nullable<const char*> CheckstrcasecmpfalseImpl(
-    absl::Nullable<const char*> s1, absl::Nullable<const char*> s2,
-    absl::Nonnull<const char*> exprtext);
+const char* absl_nullable CheckstrcmptrueImpl(
+    const char* absl_nullable s1, const char* absl_nullable s2,
+    const char* absl_nonnull exprtext);
+const char* absl_nullable CheckstrcmpfalseImpl(
+    const char* absl_nullable s1, const char* absl_nullable s2,
+    const char* absl_nonnull exprtext);
+const char* absl_nullable CheckstrcasecmptrueImpl(
+    const char* absl_nullable s1, const char* absl_nullable s2,
+    const char* absl_nonnull exprtext);
+const char* absl_nullable CheckstrcasecmpfalseImpl(
+    const char* absl_nullable s1, const char* absl_nullable s2,
+    const char* absl_nonnull exprtext);
 
 // `CHECK_EQ` and friends want to pass their arguments by reference, however
 // this winds up exposing lots of cases where people have defined and
diff --git a/deps/v8/third_party/abseil-cpp/absl/log/internal/log_message.cc b/deps/v8/third_party/abseil-cpp/absl/log/internal/log_message.cc
index 8dc5722abf2a70..aaaaf0357b1c60 100644
--- a/deps/v8/third_party/abseil-cpp/absl/log/internal/log_message.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/log/internal/log_message.cc
@@ -147,7 +147,7 @@ void WriteToStream(const char* data, void* os) {
 }  // namespace
 
 struct LogMessage::LogMessageData final {
-  LogMessageData(absl::Nonnull<const char*> file, int line,
+  LogMessageData(const char* absl_nonnull file, int line,
                  absl::LogSeverity severity, absl::Time timestamp);
   LogMessageData(const LogMessageData&) = delete;
   LogMessageData& operator=(const LogMessageData&) = delete;
@@ -163,7 +163,7 @@ struct LogMessage::LogMessageData final {
   bool is_perror;
 
   // Extra `LogSink`s to log to, in addition to `global_sinks`.
-  absl::InlinedVector<absl::Nonnull<absl::LogSink*>, 16> extra_sinks;
+  absl::InlinedVector<absl::LogSink* absl_nonnull, 16> extra_sinks;
   // If true, log to `extra_sinks` but not to `global_sinks` or hardcoded
   // non-sink targets (e.g. stderr, log files).
   bool extra_sinks_only;
@@ -199,7 +199,7 @@ struct LogMessage::LogMessageData final {
   void FinalizeEncodingAndFormat();
 };
 
-LogMessage::LogMessageData::LogMessageData(absl::Nonnull<const char*> file,
+LogMessage::LogMessageData::LogMessageData(const char* absl_nonnull file,
                                            int line, absl::LogSeverity severity,
                                            absl::Time timestamp)
     : extra_sinks_only(false), manipulated(nullptr) {
@@ -270,7 +270,7 @@ void LogMessage::LogMessageData::FinalizeEncodingAndFormat() {
       absl::MakeSpan(string_buf).subspan(0, chars_written);
 }
 
-LogMessage::LogMessage(absl::Nonnull<const char*> file, int line,
+LogMessage::LogMessage(const char* absl_nonnull file, int line,
                        absl::LogSeverity severity)
     : data_(absl::make_unique<LogMessageData>(file, line, severity,
                                               absl::Now())) {
@@ -284,11 +284,11 @@ LogMessage::LogMessage(absl::Nonnull<const char*> file, int line,
   LogBacktraceIfNeeded();
 }
 
-LogMessage::LogMessage(absl::Nonnull<const char*> file, int line, InfoTag)
+LogMessage::LogMessage(const char* absl_nonnull file, int line, InfoTag)
     : LogMessage(file, line, absl::LogSeverity::kInfo) {}
-LogMessage::LogMessage(absl::Nonnull<const char*> file, int line, WarningTag)
+LogMessage::LogMessage(const char* absl_nonnull file, int line, WarningTag)
     : LogMessage(file, line, absl::LogSeverity::kWarning) {}
-LogMessage::LogMessage(absl::Nonnull<const char*> file, int line, ErrorTag)
+LogMessage::LogMessage(const char* absl_nonnull file, int line, ErrorTag)
     : LogMessage(file, line, absl::LogSeverity::kError) {}
 
 // This cannot go in the header since LogMessageData is defined in this file.
@@ -343,13 +343,13 @@ LogMessage& LogMessage::WithPerror() {
   return *this;
 }
 
-LogMessage& LogMessage::ToSinkAlso(absl::Nonnull<absl::LogSink*> sink) {
+LogMessage& LogMessage::ToSinkAlso(absl::LogSink* absl_nonnull sink) {
   ABSL_INTERNAL_CHECK(sink, "null LogSink*");
   data_->extra_sinks.push_back(sink);
   return *this;
 }
 
-LogMessage& LogMessage::ToSinkOnly(absl::Nonnull<absl::LogSink*> sink) {
+LogMessage& LogMessage::ToSinkOnly(absl::LogSink* absl_nonnull sink) {
   ABSL_INTERNAL_CHECK(sink, "null LogSink*");
   data_->extra_sinks.clear();
   data_->extra_sinks.push_back(sink);
@@ -673,11 +673,11 @@ void LogMessage::CopyToEncodedBufferWithStructuredProtoField(
 #pragma warning(disable : 4722)
 #endif
 
-LogMessageFatal::LogMessageFatal(absl::Nonnull<const char*> file, int line)
+LogMessageFatal::LogMessageFatal(const char* absl_nonnull file, int line)
     : LogMessage(file, line, absl::LogSeverity::kFatal) {}
 
-LogMessageFatal::LogMessageFatal(absl::Nonnull<const char*> file, int line,
-                                 absl::Nonnull<const char*> failure_msg)
+LogMessageFatal::LogMessageFatal(const char* absl_nonnull file, int line,
+                                 const char* absl_nonnull failure_msg)
     : LogMessage(file, line, absl::LogSeverity::kFatal) {
   *this << "Check failed: " << failure_msg << " ";
 }
@@ -686,7 +686,7 @@ LogMessageFatal::~LogMessageFatal() {
   FailWithoutStackTrace();
 }
 
-LogMessageDebugFatal::LogMessageDebugFatal(absl::Nonnull<const char*> file,
+LogMessageDebugFatal::LogMessageDebugFatal(const char* absl_nonnull file,
                                            int line)
     : LogMessage(file, line, absl::LogSeverity::kFatal) {}
 
@@ -695,7 +695,7 @@ LogMessageDebugFatal::~LogMessageDebugFatal() {
 }
 
 LogMessageQuietlyDebugFatal::LogMessageQuietlyDebugFatal(
-    absl::Nonnull<const char*> file, int line)
+    const char* absl_nonnull file, int line)
     : LogMessage(file, line, absl::LogSeverity::kFatal) {
   SetFailQuietly();
 }
@@ -704,15 +704,15 @@ LogMessageQuietlyDebugFatal::~LogMessageQuietlyDebugFatal() {
   FailQuietly();
 }
 
-LogMessageQuietlyFatal::LogMessageQuietlyFatal(absl::Nonnull<const char*> file,
+LogMessageQuietlyFatal::LogMessageQuietlyFatal(const char* absl_nonnull file,
                                                int line)
     : LogMessage(file, line, absl::LogSeverity::kFatal) {
   SetFailQuietly();
 }
 
 LogMessageQuietlyFatal::LogMessageQuietlyFatal(
-    absl::Nonnull<const char*> file, int line,
-    absl::Nonnull<const char*> failure_msg)
+    const char* absl_nonnull file, int line,
+    const char* absl_nonnull failure_msg)
     : LogMessageQuietlyFatal(file, line) {
   *this << "Check failed: " << failure_msg << " ";
 }
diff --git a/deps/v8/third_party/abseil-cpp/absl/log/internal/log_message.h b/deps/v8/third_party/abseil-cpp/absl/log/internal/log_message.h
index 8acc4a15eb92c6..e7eff47b40666e 100644
--- a/deps/v8/third_party/abseil-cpp/absl/log/internal/log_message.h
+++ b/deps/v8/third_party/abseil-cpp/absl/log/internal/log_message.h
@@ -62,15 +62,15 @@ class LogMessage {
   struct ErrorTag {};
 
   // Used for `LOG`.
-  LogMessage(absl::Nonnull<const char*> file, int line,
+  LogMessage(const char* absl_nonnull file, int line,
              absl::LogSeverity severity) ABSL_ATTRIBUTE_COLD;
   // These constructors are slightly smaller/faster to call; the severity is
   // curried into the function pointer.
-  LogMessage(absl::Nonnull<const char*> file, int line,
+  LogMessage(const char* absl_nonnull file, int line,
              InfoTag) ABSL_ATTRIBUTE_COLD ABSL_ATTRIBUTE_NOINLINE;
-  LogMessage(absl::Nonnull<const char*> file, int line,
+  LogMessage(const char* absl_nonnull file, int line,
              WarningTag) ABSL_ATTRIBUTE_COLD ABSL_ATTRIBUTE_NOINLINE;
-  LogMessage(absl::Nonnull<const char*> file, int line,
+  LogMessage(const char* absl_nonnull file, int line,
              ErrorTag) ABSL_ATTRIBUTE_COLD ABSL_ATTRIBUTE_NOINLINE;
   LogMessage(const LogMessage&) = delete;
   LogMessage& operator=(const LogMessage&) = delete;
@@ -102,9 +102,9 @@ class LogMessage {
   LogMessage& WithPerror();
   // Sends this message to `*sink` in addition to whatever other sinks it would
   // otherwise have been sent to.
-  LogMessage& ToSinkAlso(absl::Nonnull<absl::LogSink*> sink);
+  LogMessage& ToSinkAlso(absl::LogSink* absl_nonnull sink);
   // Sends this message to `*sink` and no others.
-  LogMessage& ToSinkOnly(absl::Nonnull<absl::LogSink*> sink);
+  LogMessage& ToSinkOnly(absl::LogSink* absl_nonnull sink);
 
   // Don't call this method from outside this library.
   LogMessage& InternalStream() { return *this; }
@@ -141,10 +141,10 @@ class LogMessage {
   LogMessage& operator<<(unsigned long long v) {
     return operator<< <unsigned long long>(v);
   }
-  LogMessage& operator<<(absl::Nullable<void*> v) {
+  LogMessage& operator<<(void* absl_nullable  v) {
     return operator<< <void*>(v);
   }
-  LogMessage& operator<<(absl::Nullable<const void*> v) {
+  LogMessage& operator<<(const void* absl_nullable  v) {
     return operator<< <const void*>(v);
   }
   LogMessage& operator<<(float v) { return operator<< <float>(v); }
@@ -159,9 +159,8 @@ class LogMessage {
   LogMessage& operator<<(absl::string_view v);
 
   // Handle stream manipulators e.g. std::endl.
-  LogMessage& operator<<(absl::Nonnull<std::ostream& (*)(std::ostream & os)> m);
-  LogMessage& operator<<(
-      absl::Nonnull<std::ios_base& (*)(std::ios_base & os)> m);
+  LogMessage& operator<<(std::ostream& (*absl_nonnull m)(std::ostream& os));
+  LogMessage& operator<<(std::ios_base& (*absl_nonnull m)(std::ios_base& os));
 
   // Literal strings.  This allows us to record C string literals as literals in
   // the logging.proto.Value.
@@ -271,7 +270,7 @@ class LogMessage {
 
   // We keep the data in a separate struct so that each instance of `LogMessage`
   // uses less stack space.
-  absl::Nonnull<std::unique_ptr<LogMessageData>> data_;
+  absl_nonnull std::unique_ptr<LogMessageData> data_;
 };
 
 // Helper class so that `AbslStringify()` can modify the LogMessage.
@@ -289,7 +288,7 @@ class StringifySink final {
   }
 
   // For types that implement `AbslStringify` using `absl::Format()`.
-  friend void AbslFormatFlush(absl::Nonnull<StringifySink*> sink,
+  friend void AbslFormatFlush(StringifySink* absl_nonnull sink,
                               absl::string_view v) {
     sink->Append(v);
   }
@@ -341,9 +340,9 @@ extern template LogMessage& LogMessage::operator<<(const unsigned long& v);
 extern template LogMessage& LogMessage::operator<<(const long long& v);
 extern template LogMessage& LogMessage::operator<<(const unsigned long long& v);
 extern template LogMessage& LogMessage::operator<<(
-    absl::Nullable<void*> const& v);
+    void* absl_nullable const& v);
 extern template LogMessage& LogMessage::operator<<(
-    absl::Nullable<const void*> const& v);
+    const void* absl_nullable const& v);
 extern template LogMessage& LogMessage::operator<<(const float& v);
 extern template LogMessage& LogMessage::operator<<(const double& v);
 extern template LogMessage& LogMessage::operator<<(const bool& v);
@@ -364,10 +363,9 @@ extern template void LogMessage::CopyToEncodedBuffer<
 // message.
 class LogMessageFatal final : public LogMessage {
  public:
-  LogMessageFatal(absl::Nonnull<const char*> file,
-                  int line) ABSL_ATTRIBUTE_COLD;
-  LogMessageFatal(absl::Nonnull<const char*> file, int line,
-                  absl::Nonnull<const char*> failure_msg) ABSL_ATTRIBUTE_COLD;
+  LogMessageFatal(const char* absl_nonnull file, int line) ABSL_ATTRIBUTE_COLD;
+  LogMessageFatal(const char* absl_nonnull file, int line,
+                  const char* absl_nonnull failure_msg) ABSL_ATTRIBUTE_COLD;
   [[noreturn]] ~LogMessageFatal();
 };
 
@@ -376,7 +374,7 @@ class LogMessageFatal final : public LogMessage {
 // for DLOG(FATAL) variants.
 class LogMessageDebugFatal final : public LogMessage {
  public:
-  LogMessageDebugFatal(absl::Nonnull<const char*> file,
+  LogMessageDebugFatal(const char* absl_nonnull file,
                        int line) ABSL_ATTRIBUTE_COLD;
   ~LogMessageDebugFatal();
 };
@@ -386,7 +384,7 @@ class LogMessageQuietlyDebugFatal final : public LogMessage {
   // DLOG(QFATAL) calls this instead of LogMessageQuietlyFatal to make sure the
   // destructor is not [[noreturn]] even if this is always FATAL as this is only
   // invoked when DLOG() is enabled.
-  LogMessageQuietlyDebugFatal(absl::Nonnull<const char*> file,
+  LogMessageQuietlyDebugFatal(const char* absl_nonnull file,
                               int line) ABSL_ATTRIBUTE_COLD;
   ~LogMessageQuietlyDebugFatal();
 };
@@ -394,10 +392,10 @@ class LogMessageQuietlyDebugFatal final : public LogMessage {
 // Used for LOG(QFATAL) to make sure it's properly understood as [[noreturn]].
 class LogMessageQuietlyFatal final : public LogMessage {
  public:
-  LogMessageQuietlyFatal(absl::Nonnull<const char*> file,
+  LogMessageQuietlyFatal(const char* absl_nonnull file,
                          int line) ABSL_ATTRIBUTE_COLD;
-  LogMessageQuietlyFatal(absl::Nonnull<const char*> file, int line,
-                         absl::Nonnull<const char*> failure_msg)
+  LogMessageQuietlyFatal(const char* absl_nonnull file, int line,
+                         const char* absl_nonnull failure_msg)
       ABSL_ATTRIBUTE_COLD;
   [[noreturn]] ~LogMessageQuietlyFatal();
 };
diff --git a/deps/v8/third_party/abseil-cpp/absl/log/internal/vlog_config.h b/deps/v8/third_party/abseil-cpp/absl/log/internal/vlog_config.h
index c6543a29de49b8..84e817a3e20f34 100644
--- a/deps/v8/third_party/abseil-cpp/absl/log/internal/vlog_config.h
+++ b/deps/v8/third_party/abseil-cpp/absl/log/internal/vlog_config.h
@@ -46,7 +46,7 @@ namespace log_internal {
 class SyntheticBinary;
 class VLogSite;
 
-int RegisterAndInitialize(VLogSite* v);
+int RegisterAndInitialize(VLogSite* absl_nonnull v);
 void UpdateVLogSites();
 constexpr int kUseFlag = (std::numeric_limits<int16_t>::min)();
 
@@ -94,7 +94,7 @@ class VLogSite final {
   }
 
  private:
-  friend int log_internal::RegisterAndInitialize(VLogSite* v);
+  friend int log_internal::RegisterAndInitialize(VLogSite* absl_nonnull v);
   friend void log_internal::UpdateVLogSites();
   friend class log_internal::SyntheticBinary;
   static constexpr int kUninitialized = (std::numeric_limits<int>::max)();
@@ -131,7 +131,7 @@ int VLogLevel(absl::string_view file);
 // Registers a site `v` to get updated as `vmodule` and `v` change.  Also
 // initializes the site based on their current values, and returns that result.
 // Does not allocate memory.
-int RegisterAndInitialize(VLogSite* v);
+int RegisterAndInitialize(VLogSite* absl_nonnull v);
 
 // Allocates memory.
 void UpdateVLogSites();
@@ -155,7 +155,8 @@ int PrependVModule(absl::string_view module_pattern, int log_level);
 void OnVLogVerbosityUpdate(std::function<void()> cb);
 
 // Does not allocate memory.
-VLogSite* SetVModuleListHeadForTestOnly(VLogSite* v);
+VLogSite* absl_nullable SetVModuleListHeadForTestOnly(
+    VLogSite* absl_nullable v);
 
 }  // namespace log_internal
 ABSL_NAMESPACE_END
diff --git a/deps/v8/third_party/abseil-cpp/absl/log/log_sink_registry.h b/deps/v8/third_party/abseil-cpp/absl/log/log_sink_registry.h
index 3aa3bf67953b17..a3fa9a3db35b33 100644
--- a/deps/v8/third_party/abseil-cpp/absl/log/log_sink_registry.h
+++ b/deps/v8/third_party/abseil-cpp/absl/log/log_sink_registry.h
@@ -44,10 +44,10 @@ ABSL_NAMESPACE_BEGIN
 // sink instead which writes them to `stderr`.
 //
 // Do not call these inside `absl::LogSink::Send`.
-inline void AddLogSink(absl::Nonnull<absl::LogSink*> sink) {
+inline void AddLogSink(absl::LogSink* absl_nonnull sink) {
   log_internal::AddLogSink(sink);
 }
-inline void RemoveLogSink(absl::Nonnull<absl::LogSink*> sink) {
+inline void RemoveLogSink(absl::LogSink* absl_nonnull sink) {
   log_internal::RemoveLogSink(sink);
 }
 
diff --git a/deps/v8/third_party/abseil-cpp/absl/random/bit_gen_ref.h b/deps/v8/third_party/abseil-cpp/absl/random/bit_gen_ref.h
index fa36eb75d639b4..dfce2c481b542d 100644
--- a/deps/v8/third_party/abseil-cpp/absl/random/bit_gen_ref.h
+++ b/deps/v8/third_party/abseil-cpp/absl/random/bit_gen_ref.h
@@ -31,7 +31,7 @@
 
 #include "absl/base/attributes.h"
 #include "absl/base/config.h"
-#include "absl/base/internal/fast_type_id.h"
+#include "absl/base/fast_type_id.h"
 #include "absl/meta/type_traits.h"
 #include "absl/random/internal/distribution_caller.h"
 #include "absl/random/internal/fast_uniform_bits.h"
@@ -100,7 +100,7 @@ class BitGenRef {
 
   template <class T>
   using invoke_mock_t = decltype(std::declval<T*>()->InvokeMock(
-      std::declval<base_internal::FastTypeIdType>(), std::declval<void*>(),
+      std::declval<FastTypeIdType>(), std::declval<void*>(),
       std::declval<void*>()));
 
   template <typename T>
@@ -145,8 +145,7 @@ class BitGenRef {
 
  private:
   using impl_fn = result_type (*)(uintptr_t);
-  using mock_call_fn = bool (*)(uintptr_t, base_internal::FastTypeIdType, void*,
-                                void*);
+  using mock_call_fn = bool (*)(uintptr_t, FastTypeIdType, void*, void*);
 
   template <typename URBG>
   static result_type ImplFn(uintptr_t ptr) {
@@ -158,16 +157,16 @@ class BitGenRef {
 
   // Get a type-erased InvokeMock pointer.
   template <typename URBG>
-  static bool MockCall(uintptr_t gen_ptr, base_internal::FastTypeIdType key_id,
-                       void* result, void* arg_tuple) {
+  static bool MockCall(uintptr_t gen_ptr, FastTypeIdType key_id, void* result,
+                       void* arg_tuple) {
     return reinterpret_cast<URBG*>(gen_ptr)->InvokeMock(key_id, result,
                                                         arg_tuple);
   }
-  static bool NotAMock(uintptr_t, base_internal::FastTypeIdType, void*, void*) {
+  static bool NotAMock(uintptr_t, FastTypeIdType, void*, void*) {
     return false;
   }
 
-  inline bool InvokeMock(base_internal::FastTypeIdType key_id, void* args_tuple,
+  inline bool InvokeMock(FastTypeIdType key_id, void* args_tuple,
                          void* result) {
     if (mock_call_ == NotAMock) return false;  // avoids an indirect call.
     return mock_call_(t_erased_gen_ptr_, key_id, args_tuple, result);
diff --git a/deps/v8/third_party/abseil-cpp/absl/random/bit_gen_ref_test.cc b/deps/v8/third_party/abseil-cpp/absl/random/bit_gen_ref_test.cc
index 00876d996a90ac..d581352cad2125 100644
--- a/deps/v8/third_party/abseil-cpp/absl/random/bit_gen_ref_test.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/random/bit_gen_ref_test.cc
@@ -22,7 +22,7 @@
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
 #include "absl/base/config.h"
-#include "absl/base/internal/fast_type_id.h"
+#include "absl/base/fast_type_id.h"
 #include "absl/random/internal/sequence_urbg.h"
 #include "absl/random/random.h"
 
@@ -39,7 +39,7 @@ class ConstBitGen {
   result_type operator()() { return 1; }
 
   // InvokeMock method
-  bool InvokeMock(base_internal::FastTypeIdType, void*, void* result) {
+  bool InvokeMock(FastTypeIdType, void*, void* result) {
     *static_cast<int*>(result) = 42;
     return true;
   }
diff --git a/deps/v8/third_party/abseil-cpp/absl/random/gaussian_distribution.h b/deps/v8/third_party/abseil-cpp/absl/random/gaussian_distribution.h
index ce84d4a56bc78c..eb75bfee251318 100644
--- a/deps/v8/third_party/abseil-cpp/absl/random/gaussian_distribution.h
+++ b/deps/v8/third_party/abseil-cpp/absl/random/gaussian_distribution.h
@@ -244,7 +244,7 @@ inline double gaussian_distribution_base::zignor(
         bits);  // U(-1, 1)
     const double x = j * zg_.x[i];
 
-    // Retangular box. Handles >97% of all cases.
+    // Rectangular box. Handles >97% of all cases.
     // For any given box, this handles between 75% and 99% of values.
     // Equivalent to U(01) < (x[i+1] / x[i]), and when i == 0, ~93.5%
     if (std::abs(x) < zg_.x[i + 1]) {
diff --git a/deps/v8/third_party/abseil-cpp/absl/random/internal/distribution_caller.h b/deps/v8/third_party/abseil-cpp/absl/random/internal/distribution_caller.h
index bfe8faca7829e2..e84ec8caa17f43 100644
--- a/deps/v8/third_party/abseil-cpp/absl/random/internal/distribution_caller.h
+++ b/deps/v8/third_party/abseil-cpp/absl/random/internal/distribution_caller.h
@@ -22,7 +22,7 @@
 #include <utility>
 
 #include "absl/base/config.h"
-#include "absl/base/internal/fast_type_id.h"
+#include "absl/base/fast_type_id.h"
 #include "absl/meta/type_traits.h"
 #include "absl/utility/utility.h"
 
@@ -50,7 +50,7 @@ struct DistributionCaller {
 
   template <class T>
   using invoke_mock_t = decltype(std::declval<T*>()->InvokeMock(
-      std::declval<base_internal::FastTypeIdType>(), std::declval<void*>(),
+      std::declval<FastTypeIdType>(), std::declval<void*>(),
       std::declval<void*>()));
 
   using HasInvokeMock = typename detector<invoke_mock_t, void, URBG>::type;
@@ -74,8 +74,7 @@ struct DistributionCaller {
 
     ArgTupleT arg_tuple(std::forward<Args>(args)...);
     ResultT result;
-    if (!urbg->InvokeMock(base_internal::FastTypeId<KeyT>(), &arg_tuple,
-                          &result)) {
+    if (!urbg->InvokeMock(FastTypeId<KeyT>(), &arg_tuple, &result)) {
       auto dist = absl::make_from_tuple<DistrT>(arg_tuple);
       result = dist(*urbg);
     }
diff --git a/deps/v8/third_party/abseil-cpp/absl/random/internal/entropy_pool.cc b/deps/v8/third_party/abseil-cpp/absl/random/internal/entropy_pool.cc
index 092730d433c42d..fa47d0de6f5c67 100644
--- a/deps/v8/third_party/abseil-cpp/absl/random/internal/entropy_pool.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/random/internal/entropy_pool.cc
@@ -44,9 +44,11 @@ namespace {
 // single generator within a RandenPool<T>. It is an internal implementation
 // detail, and does not aim to conform to [rand.req.urng].
 //
-// NOTE: There are alignment issues when used on ARM, for instance.
-// See the allocation code in PoolAlignedAlloc().
-class RandenPoolEntry {
+// At least 32-byte alignment is required for the state_ array on some ARM
+// platforms.  We also want this aligned to a cacheline to eliminate false
+// sharing.
+class alignas(std::max(size_t{ABSL_CACHELINE_SIZE}, size_t{32}))
+    RandenPoolEntry {
  public:
   static constexpr size_t kState = RandenTraits::kStateBytes / sizeof(uint32_t);
   static constexpr size_t kCapacity =
@@ -74,7 +76,8 @@ class RandenPoolEntry {
 
  private:
   // Randen URBG state.
-  uint32_t state_[kState] ABSL_GUARDED_BY(mu_);  // First to satisfy alignment.
+  // At least 32-byte alignment is required by ARM platform code.
+  alignas(32) uint32_t state_[kState] ABSL_GUARDED_BY(mu_);
   SpinLock mu_;
   const Randen impl_;
   size_t next_ ABSL_GUARDED_BY(mu_);
@@ -148,22 +151,6 @@ size_t GetPoolID() {
 #endif
 }
 
-// Allocate a RandenPoolEntry with at least 32-byte alignment, which is required
-// by ARM platform code.
-RandenPoolEntry* PoolAlignedAlloc() {
-  constexpr size_t kAlignment =
-      ABSL_CACHELINE_SIZE > 32 ? ABSL_CACHELINE_SIZE : 32;
-
-  // Not all the platforms that we build for have std::aligned_alloc, however
-  // since we never free these objects, we can over allocate and munge the
-  // pointers to the correct alignment.
-  uintptr_t x = reinterpret_cast<uintptr_t>(
-      new char[sizeof(RandenPoolEntry) + kAlignment]);
-  auto y = x % kAlignment;
-  void* aligned = reinterpret_cast<void*>(y == 0 ? x : (x + kAlignment - y));
-  return new (aligned) RandenPoolEntry();
-}
-
 // Allocate and initialize kPoolSize objects of type RandenPoolEntry.
 void InitPoolURBG() {
   static constexpr size_t kSeedSize =
@@ -174,7 +161,7 @@ void InitPoolURBG() {
     ThrowSeedGenException();
   }
   for (size_t i = 0; i < kPoolSize; i++) {
-    shared_pools[i] = PoolAlignedAlloc();
+    shared_pools[i] = new RandenPoolEntry();
     shared_pools[i]->Init(
         absl::MakeSpan(&seed_material[i * kSeedSize], kSeedSize));
   }
diff --git a/deps/v8/third_party/abseil-cpp/absl/random/internal/mock_helpers.h b/deps/v8/third_party/abseil-cpp/absl/random/internal/mock_helpers.h
index b78b2514165871..85f7387f4a79fc 100644
--- a/deps/v8/third_party/abseil-cpp/absl/random/internal/mock_helpers.h
+++ b/deps/v8/third_party/abseil-cpp/absl/random/internal/mock_helpers.h
@@ -19,7 +19,7 @@
 #include <utility>
 
 #include "absl/base/config.h"
-#include "absl/base/internal/fast_type_id.h"
+#include "absl/base/fast_type_id.h"
 #include "absl/types/optional.h"
 
 namespace absl {
@@ -48,7 +48,7 @@ struct NoOpValidator {
 //   result_type(args...)
 //
 class MockHelpers {
-  using IdType = ::absl::base_internal::FastTypeIdType;
+  using IdType = ::absl::FastTypeIdType;
 
   // Given a key signature type used to index the mock, extract the components.
   // KeyT is expected to have the form:
@@ -82,8 +82,7 @@ class MockHelpers {
                                                 Args&&... args) {
     ArgTupleT arg_tuple(std::forward<Args>(args)...);
     ReturnT result;
-    if (urbg->InvokeMock(base_internal::FastTypeId<KeyT>(), &arg_tuple,
-                         &result)) {
+    if (urbg->InvokeMock(FastTypeId<KeyT>(), &arg_tuple, &result)) {
       return result;
     }
     return absl::nullopt;
@@ -138,7 +137,7 @@ class MockHelpers {
           m, std::declval<IdType>(), ValidatorT())) {
     return m.template RegisterMock<typename KeySignature<KeyT>::result_type,
                                    typename KeySignature<KeyT>::arg_tuple_type>(
-        m, ::absl::base_internal::FastTypeId<KeyT>(), ValidatorT());
+        m, ::absl::FastTypeId<KeyT>(), ValidatorT());
   }
 
   // Acquire a mock for the KeyT (may or may not be a signature).
diff --git a/deps/v8/third_party/abseil-cpp/absl/random/mocking_bit_gen.h b/deps/v8/third_party/abseil-cpp/absl/random/mocking_bit_gen.h
index 7cecd88f3b72ef..1680ff4dacfe44 100644
--- a/deps/v8/third_party/abseil-cpp/absl/random/mocking_bit_gen.h
+++ b/deps/v8/third_party/abseil-cpp/absl/random/mocking_bit_gen.h
@@ -35,7 +35,7 @@
 
 #include "gmock/gmock.h"
 #include "absl/base/config.h"
-#include "absl/base/internal/fast_type_id.h"
+#include "absl/base/fast_type_id.h"
 #include "absl/container/flat_hash_map.h"
 #include "absl/meta/type_traits.h"
 #include "absl/random/internal/mock_helpers.h"
@@ -175,7 +175,7 @@ class MockingBitGen {
   // distribution parameters of the expectation.
   template <typename ResultT, typename ArgTupleT, typename SelfT,
             typename ValidatorT>
-  auto RegisterMock(SelfT&, base_internal::FastTypeIdType type, ValidatorT)
+  auto RegisterMock(SelfT&, FastTypeIdType type, ValidatorT)
       -> decltype(GetMockFnType(std::declval<ResultT>(),
                                 std::declval<ArgTupleT>()))& {
     using MockFnType = decltype(GetMockFnType(std::declval<ResultT>(),
@@ -212,7 +212,7 @@ class MockingBitGen {
   // Requires tuple_args to point to a ArgTupleT, which is a std::tuple<Args...>
   // used to invoke the mock function.
   // Requires result to point to a ResultT, which is the result of the call.
-  inline bool InvokeMock(base_internal::FastTypeIdType key_id, void* args_tuple,
+  inline bool InvokeMock(FastTypeIdType key_id, void* args_tuple,
                          void* result) {
     // Trigger a mock, if there exists one that matches `param`.
     auto it = mocks_.find(key_id);
@@ -221,9 +221,7 @@ class MockingBitGen {
     return true;
   }
 
-  absl::flat_hash_map<base_internal::FastTypeIdType,
-                      std::unique_ptr<FunctionHolder>>
-      mocks_;
+  absl::flat_hash_map<FastTypeIdType, std::unique_ptr<FunctionHolder>> mocks_;
   absl::BitGen gen_;
 
   template <typename>
diff --git a/deps/v8/third_party/abseil-cpp/absl/status/internal/status_internal.cc b/deps/v8/third_party/abseil-cpp/absl/status/internal/status_internal.cc
index 99bf8faca305c7..988418904a874c 100644
--- a/deps/v8/third_party/abseil-cpp/absl/status/internal/status_internal.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/status/internal/status_internal.cc
@@ -189,7 +189,7 @@ bool StatusRep::operator==(const StatusRep& other) const {
   return true;
 }
 
-absl::Nonnull<StatusRep*> StatusRep::CloneAndUnref() const {
+StatusRep* absl_nonnull StatusRep::CloneAndUnref() const {
   // Optimization: no need to create a clone if we already have a refcount of 1.
   if (ref_.load(std::memory_order_acquire) == 1) {
     // All StatusRep instances are heap allocated and mutable, therefore this
@@ -235,9 +235,8 @@ absl::StatusCode MapToLocalCode(int value) {
   }
 }
 
-absl::Nonnull<const char*> MakeCheckFailString(
-    absl::Nonnull<const absl::Status*> status,
-    absl::Nonnull<const char*> prefix) {
+const char* absl_nonnull MakeCheckFailString(
+    const absl::Status* absl_nonnull status, const char* absl_nonnull prefix) {
   // There's no need to free this string since the process is crashing.
   return absl::IgnoreLeak(
              new std::string(absl::StrCat(
diff --git a/deps/v8/third_party/abseil-cpp/absl/status/internal/status_internal.h b/deps/v8/third_party/abseil-cpp/absl/status/internal/status_internal.h
index fe335b0b7caf65..45b90f3648fb1b 100644
--- a/deps/v8/third_party/abseil-cpp/absl/status/internal/status_internal.h
+++ b/deps/v8/third_party/abseil-cpp/absl/status/internal/status_internal.h
@@ -100,7 +100,7 @@ class StatusRep {
   // Returns an equivalent heap allocated StatusRep with refcount 1.
   //
   // `this` is not safe to be used after calling as it may have been deleted.
-  absl::Nonnull<StatusRep*> CloneAndUnref() const;
+  StatusRep* absl_nonnull CloneAndUnref() const;
 
  private:
   mutable std::atomic<int32_t> ref_;
@@ -120,9 +120,8 @@ absl::StatusCode MapToLocalCode(int value);
 //
 // This is an internal implementation detail for Abseil logging.
 ABSL_ATTRIBUTE_PURE_FUNCTION
-absl::Nonnull<const char*> MakeCheckFailString(
-    absl::Nonnull<const absl::Status*> status,
-    absl::Nonnull<const char*> prefix);
+const char* absl_nonnull MakeCheckFailString(
+    const absl::Status* absl_nonnull status, const char* absl_nonnull prefix);
 
 }  // namespace status_internal
 
diff --git a/deps/v8/third_party/abseil-cpp/absl/status/internal/statusor_internal.h b/deps/v8/third_party/abseil-cpp/absl/status/internal/statusor_internal.h
index 67603156a49b66..ca7c5502c2e322 100644
--- a/deps/v8/third_party/abseil-cpp/absl/status/internal/statusor_internal.h
+++ b/deps/v8/third_party/abseil-cpp/absl/status/internal/statusor_internal.h
@@ -185,7 +185,7 @@ using IsStatusOrAssignmentValid = absl::conjunction<
 class Helper {
  public:
   // Move type-agnostic error handling to the .cc.
-  static void HandleInvalidStatusCtorArg(absl::Nonnull<Status*>);
+  static void HandleInvalidStatusCtorArg(Status* absl_nonnull);
   [[noreturn]] static void Crash(const absl::Status& status);
 };
 
@@ -194,7 +194,7 @@ class Helper {
 // This abstraction is here mostly for the gcc performance fix.
 template <typename T, typename... Args>
 ABSL_ATTRIBUTE_NONNULL(1)
-void PlacementNew(absl::Nonnull<void*> p, Args&&... args) {
+void PlacementNew(void* absl_nonnull p, Args&&... args) {
   new (p) T(std::forward<Args>(args)...);
 }
 
diff --git a/deps/v8/third_party/abseil-cpp/absl/status/status.cc b/deps/v8/third_party/abseil-cpp/absl/status/status.cc
index 72a2526083d125..963dab6723cc6c 100644
--- a/deps/v8/third_party/abseil-cpp/absl/status/status.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/status/status.cc
@@ -91,12 +91,12 @@ std::ostream& operator<<(std::ostream& os, StatusCode code) {
   return os << StatusCodeToString(code);
 }
 
-absl::Nonnull<const std::string*> Status::EmptyString() {
+const std::string* absl_nonnull Status::EmptyString() {
   static const absl::NoDestructor<std::string> kEmpty;
   return kEmpty.get();
 }
 
-absl::Nonnull<const std::string*> Status::MovedFromString() {
+const std::string* absl_nonnull Status::MovedFromString() {
   static const absl::NoDestructor<std::string> kMovedFrom(kMovedFromString);
   return kMovedFrom.get();
 }
@@ -108,7 +108,7 @@ Status::Status(absl::StatusCode code, absl::string_view msg)
   }
 }
 
-absl::Nonnull<status_internal::StatusRep*> Status::PrepareToModify(
+status_internal::StatusRep* absl_nonnull Status::PrepareToModify(
     uintptr_t rep) {
   if (IsInlined(rep)) {
     return new status_internal::StatusRep(InlinedRepToCode(rep),
@@ -406,7 +406,7 @@ Status ErrnoToStatus(int error_number, absl::string_view message) {
                 MessageForErrnoToStatus(error_number, message));
 }
 
-absl::Nonnull<const char*> StatusMessageAsCStr(const Status& status) {
+const char* absl_nonnull StatusMessageAsCStr(const Status& status) {
   // As an internal implementation detail, we guarantee that if status.message()
   // is non-empty, then the resulting string_view is null terminated.
   auto sv_message = status.message();
diff --git a/deps/v8/third_party/abseil-cpp/absl/status/status.h b/deps/v8/third_party/abseil-cpp/absl/status/status.h
index 02fd296485431d..45168225842cd7 100644
--- a/deps/v8/third_party/abseil-cpp/absl/status/status.h
+++ b/deps/v8/third_party/abseil-cpp/absl/status/status.h
@@ -623,15 +623,15 @@ class ABSL_ATTRIBUTE_TRIVIAL_ABI Status final {
 
   // REQUIRES: !ok()
   // Ensures rep is not inlined or shared with any other Status.
-  static absl::Nonnull<status_internal::StatusRep*> PrepareToModify(
+  static status_internal::StatusRep* absl_nonnull PrepareToModify(
       uintptr_t rep);
 
   // MSVC 14.0 limitation requires the const.
   static constexpr const char kMovedFromString[] =
       "Status accessed after move.";
 
-  static absl::Nonnull<const std::string*> EmptyString();
-  static absl::Nonnull<const std::string*> MovedFromString();
+  static const std::string* absl_nonnull EmptyString();
+  static const std::string* absl_nonnull MovedFromString();
 
   // Returns whether rep contains an inlined representation.
   // See rep_ for details.
@@ -649,8 +649,8 @@ class ABSL_ATTRIBUTE_TRIVIAL_ABI Status final {
 
   // Converts between StatusRep* and the external uintptr_t representation used
   // by rep_. See rep_ for details.
-  static uintptr_t PointerToRep(absl::Nonnull<status_internal::StatusRep*> r);
-  static absl::Nonnull<const status_internal::StatusRep*> RepToPointer(
+  static uintptr_t PointerToRep(status_internal::StatusRep* absl_nonnull r);
+  static const status_internal::StatusRep* absl_nonnull RepToPointer(
       uintptr_t r);
 
   static std::string ToStringSlow(uintptr_t rep, StatusToStringMode mode);
@@ -902,14 +902,14 @@ constexpr uintptr_t Status::MovedFromRep() {
   return CodeToInlinedRep(absl::StatusCode::kInternal) | 2;
 }
 
-inline absl::Nonnull<const status_internal::StatusRep*> Status::RepToPointer(
+inline const status_internal::StatusRep* absl_nonnull Status::RepToPointer(
     uintptr_t rep) {
   assert(!IsInlined(rep));
   return reinterpret_cast<const status_internal::StatusRep*>(rep);
 }
 
 inline uintptr_t Status::PointerToRep(
-    absl::Nonnull<status_internal::StatusRep*> rep) {
+    status_internal::StatusRep* absl_nonnull rep) {
   return reinterpret_cast<uintptr_t>(rep);
 }
 
@@ -934,7 +934,7 @@ inline Status CancelledError() { return Status(absl::StatusCode::kCancelled); }
 // If the status's message is empty, the empty string is returned.
 //
 // StatusMessageAsCStr exists for C support. Use `status.message()` in C++.
-absl::Nonnull<const char*> StatusMessageAsCStr(
+const char* absl_nonnull StatusMessageAsCStr(
     const Status& status ABSL_ATTRIBUTE_LIFETIME_BOUND);
 
 ABSL_NAMESPACE_END
diff --git a/deps/v8/third_party/abseil-cpp/absl/status/status_payload_printer.h b/deps/v8/third_party/abseil-cpp/absl/status/status_payload_printer.h
index f22255e1c6cd27..fc555152e9e96c 100644
--- a/deps/v8/third_party/abseil-cpp/absl/status/status_payload_printer.h
+++ b/deps/v8/third_party/abseil-cpp/absl/status/status_payload_printer.h
@@ -35,8 +35,8 @@ namespace status_internal {
 // NOTE: This is an internal API and the design is subject to change in the
 // future in a non-backward-compatible way. Since it's only meant for debugging
 // purpose, you should not rely on it in any critical logic.
-using StatusPayloadPrinter = absl::Nullable<absl::optional<std::string> (*)(
-    absl::string_view, const absl::Cord&)>;
+using StatusPayloadPrinter = absl::optional<std::string> (*absl_nullable)(
+    absl::string_view, const absl::Cord&);
 
 // Sets the global payload printer. Only one printer should be set per process.
 // If multiple printers are set, it's undefined which one will be used.
diff --git a/deps/v8/third_party/abseil-cpp/absl/status/statusor.cc b/deps/v8/third_party/abseil-cpp/absl/status/statusor.cc
index 7e6b334c74b8d5..d8f66a646195c8 100644
--- a/deps/v8/third_party/abseil-cpp/absl/status/statusor.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/status/statusor.cc
@@ -55,7 +55,7 @@ BadStatusOrAccess& BadStatusOrAccess::operator=(BadStatusOrAccess&& other) {
 BadStatusOrAccess::BadStatusOrAccess(BadStatusOrAccess&& other)
     : status_(std::move(other.status_)) {}
 
-absl::Nonnull<const char*> BadStatusOrAccess::what() const noexcept {
+const char* absl_nonnull BadStatusOrAccess::what() const noexcept {
   InitWhat();
   return what_.c_str();
 }
@@ -70,7 +70,7 @@ void BadStatusOrAccess::InitWhat() const {
 
 namespace internal_statusor {
 
-void Helper::HandleInvalidStatusCtorArg(absl::Nonnull<absl::Status*> status) {
+void Helper::HandleInvalidStatusCtorArg(absl::Status* absl_nonnull status) {
   const char* kMessage =
       "An OK status is not a valid constructor argument to StatusOr<T>";
 #ifdef NDEBUG
diff --git a/deps/v8/third_party/abseil-cpp/absl/status/statusor.h b/deps/v8/third_party/abseil-cpp/absl/status/statusor.h
index 322d448be78d57..5257af0eb24abe 100644
--- a/deps/v8/third_party/abseil-cpp/absl/status/statusor.h
+++ b/deps/v8/third_party/abseil-cpp/absl/status/statusor.h
@@ -93,7 +93,7 @@ class BadStatusOrAccess : public std::exception {
   //
   // The pointer of this string is guaranteed to be valid until any non-const
   // function is invoked on the exception object.
-  absl::Nonnull<const char*> what() const noexcept override;
+  const char* absl_nonnull what() const noexcept override;
 
   // BadStatusOrAccess::status()
   //
@@ -756,13 +756,13 @@ T&& StatusOr<T>::operator*() && {
 }
 
 template <typename T>
-absl::Nonnull<const T*> StatusOr<T>::operator->() const {
+const T* absl_nonnull StatusOr<T>::operator->() const {
   this->EnsureOk();
   return &this->data_;
 }
 
 template <typename T>
-absl::Nonnull<T*> StatusOr<T>::operator->() {
+T* absl_nonnull StatusOr<T>::operator->() {
   this->EnsureOk();
   return &this->data_;
 }
diff --git a/deps/v8/third_party/abseil-cpp/absl/status/statusor_test.cc b/deps/v8/third_party/abseil-cpp/absl/status/statusor_test.cc
index 834104044865fd..17a33842cc9c7a 100644
--- a/deps/v8/third_party/abseil-cpp/absl/status/statusor_test.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/status/statusor_test.cc
@@ -459,7 +459,7 @@ TEST(StatusOr, TestAssignmentStatusOk) {
     EXPECT_EQ(p, *source);
   }
 
-  // Move asssignment
+  // Move assignment
   {
     const auto p = std::make_shared<int>(17);
     absl::StatusOr<std::shared_ptr<int>> source(p);
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/BUILD.bazel b/deps/v8/third_party/abseil-cpp/absl/strings/BUILD.bazel
index ddc115dc71a0f6..3b0aab593e5827 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/BUILD.bazel
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/BUILD.bazel
@@ -606,6 +606,7 @@ cc_library(
         "//absl/crc:crc32c",
         "//absl/crc:crc_cord_state",
         "//absl/functional:function_ref",
+        "//absl/hash:weakly_mixed_integer",
         "//absl/meta:type_traits",
         "//absl/numeric:bits",
         "//absl/types:compare",
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/BUILD.gn b/deps/v8/third_party/abseil-cpp/absl/strings/BUILD.gn
index bb4e68f69baeef..30c6708fc6c8d8 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/BUILD.gn
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/BUILD.gn
@@ -375,6 +375,7 @@ absl_source_set("cord") {
     "//third_party/abseil-cpp/absl/crc:crc32c",
     "//third_party/abseil-cpp/absl/crc:crc_cord_state",
     "//third_party/abseil-cpp/absl/functional:function_ref",
+    "//third_party/abseil-cpp/absl/hash:weakly_mixed_integer",
     "//third_party/abseil-cpp/absl/meta:type_traits",
     "//third_party/abseil-cpp/absl/numeric:bits",
     "//third_party/abseil-cpp/absl/types:compare",
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/CMakeLists.txt b/deps/v8/third_party/abseil-cpp/absl/strings/CMakeLists.txt
index 40c57f6db53ff3..ec731d86909891 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/CMakeLists.txt
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/CMakeLists.txt
@@ -998,6 +998,7 @@ absl_cc_library(
     absl::span
     absl::strings
     absl::type_traits
+    absl::weakly_mixed_integer
   PUBLIC
 )
 
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/ascii.cc b/deps/v8/third_party/abseil-cpp/absl/strings/ascii.cc
index d15e4249ec17b8..4cd9ff942bccd1 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/ascii.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/ascii.cc
@@ -183,8 +183,8 @@ constexpr bool AsciiInAZRangeNaive(unsigned char c) {
 }
 
 template <bool ToUpper, bool Naive>
-constexpr void AsciiStrCaseFoldImpl(absl::Nonnull<char*> dst,
-                                    absl::Nullable<const char*> src,
+constexpr void AsciiStrCaseFoldImpl(char* absl_nonnull dst,
+                                    const char* absl_nullable src,
                                     size_t size) {
   // The upper- and lowercase versions of ASCII characters differ by only 1 bit.
   // When we need to flip the case, we can xor with this bit to achieve the
@@ -211,18 +211,18 @@ constexpr void AsciiStrCaseFoldImpl(absl::Nonnull<char*> dst,
 // strings it's not important).
 // `src` may be null iff `size` is zero.
 template <bool ToUpper>
-constexpr void AsciiStrCaseFold(absl::Nonnull<char*> dst,
-                                absl::Nullable<const char*> src, size_t size) {
+constexpr void AsciiStrCaseFold(char* absl_nonnull dst,
+                                const char* absl_nullable src, size_t size) {
   size < 16 ? AsciiStrCaseFoldImpl<ToUpper, /*Naive=*/true>(dst, src, size)
             : AsciiStrCaseFoldImpl<ToUpper, /*Naive=*/false>(dst, src, size);
 }
 
-void AsciiStrToLower(absl::Nonnull<char*> dst, absl::Nullable<const char*> src,
+void AsciiStrToLower(char* absl_nonnull dst, const char* absl_nullable src,
                      size_t n) {
   return AsciiStrCaseFold<false>(dst, src, n);
 }
 
-void AsciiStrToUpper(absl::Nonnull<char*> dst, absl::Nullable<const char*> src,
+void AsciiStrToUpper(char* absl_nonnull dst, const char* absl_nullable src,
                      size_t n) {
   return AsciiStrCaseFold<true>(dst, src, n);
 }
@@ -253,17 +253,17 @@ static_assert(ValidateAsciiCasefold() == 0, "error in case conversion");
 
 }  // namespace ascii_internal
 
-void AsciiStrToLower(absl::Nonnull<std::string*> s) {
+void AsciiStrToLower(std::string* absl_nonnull s) {
   char* p = &(*s)[0];
   return ascii_internal::AsciiStrCaseFold<false>(p, p, s->size());
 }
 
-void AsciiStrToUpper(absl::Nonnull<std::string*> s) {
+void AsciiStrToUpper(std::string* absl_nonnull s) {
   char* p = &(*s)[0];
   return ascii_internal::AsciiStrCaseFold<true>(p, p, s->size());
 }
 
-void RemoveExtraAsciiWhitespace(absl::Nonnull<std::string*> str) {
+void RemoveExtraAsciiWhitespace(std::string* absl_nonnull str) {
   auto stripped = StripAsciiWhitespace(*str);
 
   if (stripped.empty()) {
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/ascii.h b/deps/v8/third_party/abseil-cpp/absl/strings/ascii.h
index bf60baeb8a0a2e..ca0747e56b8334 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/ascii.h
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/ascii.h
@@ -76,10 +76,10 @@ ABSL_DLL extern const char kToUpper[256];
 // Declaration for the array of characters to lower-case characters.
 ABSL_DLL extern const char kToLower[256];
 
-void AsciiStrToLower(absl::Nonnull<char*> dst, absl::Nullable<const char*> src,
+void AsciiStrToLower(char* absl_nonnull dst, const char* absl_nullable src,
                      size_t n);
 
-void AsciiStrToUpper(absl::Nonnull<char*> dst, absl::Nullable<const char*> src,
+void AsciiStrToUpper(char* absl_nonnull dst, const char* absl_nullable src,
                      size_t n);
 
 }  // namespace ascii_internal
@@ -185,7 +185,7 @@ inline char ascii_tolower(unsigned char c) {
 }
 
 // Converts the characters in `s` to lowercase, changing the contents of `s`.
-void AsciiStrToLower(absl::Nonnull<std::string*> s);
+void AsciiStrToLower(std::string* absl_nonnull s);
 
 // Creates a lowercase string from a given absl::string_view.
 [[nodiscard]] inline std::string AsciiStrToLower(absl::string_view s) {
@@ -214,7 +214,7 @@ inline char ascii_toupper(unsigned char c) {
 }
 
 // Converts the characters in `s` to uppercase, changing the contents of `s`.
-void AsciiStrToUpper(absl::Nonnull<std::string*> s);
+void AsciiStrToUpper(std::string* absl_nonnull s);
 
 // Creates an uppercase string from a given absl::string_view.
 [[nodiscard]] inline std::string AsciiStrToUpper(absl::string_view s) {
@@ -243,7 +243,7 @@ template <int&... DoNotSpecify>
 }
 
 // Strips in place whitespace from the beginning of the given string.
-inline void StripLeadingAsciiWhitespace(absl::Nonnull<std::string*> str) {
+inline void StripLeadingAsciiWhitespace(std::string* absl_nonnull str) {
   auto it = std::find_if_not(str->begin(), str->end(), absl::ascii_isspace);
   str->erase(str->begin(), it);
 }
@@ -257,7 +257,7 @@ inline void StripLeadingAsciiWhitespace(absl::Nonnull<std::string*> str) {
 }
 
 // Strips in place whitespace from the end of the given string
-inline void StripTrailingAsciiWhitespace(absl::Nonnull<std::string*> str) {
+inline void StripTrailingAsciiWhitespace(std::string* absl_nonnull str) {
   auto it = std::find_if_not(str->rbegin(), str->rend(), absl::ascii_isspace);
   str->erase(static_cast<size_t>(str->rend() - it));
 }
@@ -270,13 +270,13 @@ inline void StripTrailingAsciiWhitespace(absl::Nonnull<std::string*> str) {
 }
 
 // Strips in place whitespace from both ends of the given string
-inline void StripAsciiWhitespace(absl::Nonnull<std::string*> str) {
+inline void StripAsciiWhitespace(std::string* absl_nonnull str) {
   StripTrailingAsciiWhitespace(str);
   StripLeadingAsciiWhitespace(str);
 }
 
 // Removes leading, trailing, and consecutive internal whitespace.
-void RemoveExtraAsciiWhitespace(absl::Nonnull<std::string*> str);
+void RemoveExtraAsciiWhitespace(std::string* absl_nonnull str);
 
 ABSL_NAMESPACE_END
 }  // namespace absl
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/charconv.cc b/deps/v8/third_party/abseil-cpp/absl/strings/charconv.cc
index 681eb93bbc2cc5..6f367739e9d805 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/charconv.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/charconv.cc
@@ -120,7 +120,7 @@ struct FloatTraits<double> {
   // Parsing a smaller N will produce something finite.
   static constexpr int kEiselLemireMaxExclusiveExp10 = 309;
 
-  static double MakeNan(absl::Nonnull<const char*> tagp) {
+  static double MakeNan(const char* absl_nonnull tagp) {
 #if ABSL_HAVE_BUILTIN(__builtin_nan)
     // Use __builtin_nan() if available since it has a fix for
     // https://bugs.llvm.org/show_bug.cgi?id=37778
@@ -193,7 +193,7 @@ struct FloatTraits<float> {
   static constexpr int kEiselLemireMinInclusiveExp10 = -46 - 18;
   static constexpr int kEiselLemireMaxExclusiveExp10 = 39;
 
-  static float MakeNan(absl::Nonnull<const char*> tagp) {
+  static float MakeNan(const char* absl_nonnull tagp) {
 #if ABSL_HAVE_BUILTIN(__builtin_nanf)
     // Use __builtin_nanf() if available since it has a fix for
     // https://bugs.llvm.org/show_bug.cgi?id=37778
@@ -345,7 +345,7 @@ int NormalizedShiftSize(int mantissa_width, int binary_exponent) {
 // `value` must be wider than the requested bit width.
 //
 // Returns the number of bits shifted.
-int TruncateToBitWidth(int bit_width, absl::Nonnull<uint128*> value) {
+int TruncateToBitWidth(int bit_width, uint128* absl_nonnull value) {
   const int current_bit_width = BitWidth(*value);
   const int shift = current_bit_width - bit_width;
   *value >>= shift;
@@ -357,7 +357,7 @@ int TruncateToBitWidth(int bit_width, absl::Nonnull<uint128*> value) {
 // the appropriate double, and returns true.
 template <typename FloatType>
 bool HandleEdgeCase(const strings_internal::ParsedFloat& input, bool negative,
-                    absl::Nonnull<FloatType*> value) {
+                    FloatType* absl_nonnull value) {
   if (input.type == strings_internal::FloatType::kNan) {
     // A bug in gcc would cause the compiler to optimize away the buffer we are
     // building below.  Declaring the buffer volatile avoids the issue, and has
@@ -403,8 +403,8 @@ bool HandleEdgeCase(const strings_internal::ParsedFloat& input, bool negative,
 // number is stored in *value.
 template <typename FloatType>
 void EncodeResult(const CalculatedFloat& calculated, bool negative,
-                  absl::Nonnull<absl::from_chars_result*> result,
-                  absl::Nonnull<FloatType*> value) {
+                  absl::from_chars_result* absl_nonnull result,
+                  FloatType* absl_nonnull value) {
   if (calculated.exponent == kOverflow) {
     result->ec = std::errc::result_out_of_range;
     *value = negative ? -std::numeric_limits<FloatType>::max()
@@ -450,7 +450,7 @@ void EncodeResult(const CalculatedFloat& calculated, bool negative,
 // Zero and negative values of `shift` are accepted, in which case the word is
 // shifted left, as necessary.
 uint64_t ShiftRightAndRound(uint128 value, int shift, bool input_exact,
-                            absl::Nonnull<bool*> output_exact) {
+                            bool* absl_nonnull output_exact) {
   if (shift <= 0) {
     *output_exact = input_exact;
     return static_cast<uint64_t>(value << -shift);
@@ -684,8 +684,7 @@ CalculatedFloat CalculateFromParsedDecimal(
 // this function returns false) is both fast and correct.
 template <typename FloatType>
 bool EiselLemire(const strings_internal::ParsedFloat& input, bool negative,
-                 absl::Nonnull<FloatType*> value,
-                 absl::Nonnull<std::errc*> ec) {
+                 FloatType* absl_nonnull value, std::errc* absl_nonnull ec) {
   uint64_t man = input.mantissa;
   int exp10 = input.exponent;
   if (exp10 < FloatTraits<FloatType>::kEiselLemireMinInclusiveExp10) {
@@ -858,9 +857,9 @@ bool EiselLemire(const strings_internal::ParsedFloat& input, bool negative,
 }
 
 template <typename FloatType>
-from_chars_result FromCharsImpl(absl::Nonnull<const char*> first,
-                                absl::Nonnull<const char*> last,
-                                FloatType& value, chars_format fmt_flags) {
+from_chars_result FromCharsImpl(const char* absl_nonnull first,
+                                const char* absl_nonnull last, FloatType& value,
+                                chars_format fmt_flags) {
   from_chars_result result;
   result.ptr = first;  // overwritten on successful parse
   result.ec = std::errc();
@@ -945,14 +944,14 @@ from_chars_result FromCharsImpl(absl::Nonnull<const char*> first,
 }
 }  // namespace
 
-from_chars_result from_chars(absl::Nonnull<const char*> first,
-                             absl::Nonnull<const char*> last, double& value,
+from_chars_result from_chars(const char* absl_nonnull first,
+                             const char* absl_nonnull last, double& value,
                              chars_format fmt) {
   return FromCharsImpl(first, last, value, fmt);
 }
 
-from_chars_result from_chars(absl::Nonnull<const char*> first,
-                             absl::Nonnull<const char*> last, float& value,
+from_chars_result from_chars(const char* absl_nonnull first,
+                             const char* absl_nonnull last, float& value,
                              chars_format fmt) {
   return FromCharsImpl(first, last, value, fmt);
 }
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/charconv.h b/deps/v8/third_party/abseil-cpp/absl/strings/charconv.h
index be250902ad6563..e5733f8c251d77 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/charconv.h
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/charconv.h
@@ -45,7 +45,7 @@ enum class chars_format {
 // characters that were successfully parsed.  If none was found, `ptr` is set
 // to the `first` argument to from_chars.
 struct from_chars_result {
-  absl::Nonnull<const char*> ptr;
+  const char* absl_nonnull ptr;
   std::errc ec;
 };
 
@@ -77,13 +77,13 @@ struct from_chars_result {
 // format that strtod() accepts, except that a "0x" prefix is NOT matched.
 // (In particular, in `hex` mode, the input "0xff" results in the largest
 // matching pattern "0".)
-absl::from_chars_result from_chars(absl::Nonnull<const char*> first,
-                                   absl::Nonnull<const char*> last,
+absl::from_chars_result from_chars(const char* absl_nonnull first,
+                                   const char* absl_nonnull last,
                                    double& value,  // NOLINT
                                    chars_format fmt = chars_format::general);
 
-absl::from_chars_result from_chars(absl::Nonnull<const char*> first,
-                                   absl::Nonnull<const char*> last,
+absl::from_chars_result from_chars(const char* absl_nonnull first,
+                                   const char* absl_nonnull last,
                                    float& value,  // NOLINT
                                    chars_format fmt = chars_format::general);
 
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/cord.cc b/deps/v8/third_party/abseil-cpp/absl/strings/cord.cc
index 287458a8c7ff05..e53f914dbbd760 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/cord.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/cord.cc
@@ -75,21 +75,19 @@ using ::absl::cord_internal::kMinFlatLength;
 using ::absl::cord_internal::kInlinedVectorSize;
 using ::absl::cord_internal::kMaxBytesToCopy;
 
-static void DumpNode(absl::Nonnull<CordRep*> nonnull_rep, bool include_data,
-                     absl::Nonnull<std::ostream*> os, int indent = 0);
-static bool VerifyNode(absl::Nonnull<CordRep*> root,
-                       absl::Nonnull<CordRep*> start_node);
+static void DumpNode(CordRep* absl_nonnull nonnull_rep, bool include_data,
+                     std::ostream* absl_nonnull os, int indent = 0);
+static bool VerifyNode(CordRep* absl_nonnull root,
+                       CordRep* absl_nonnull start_node);
 
-static inline absl::Nullable<CordRep*> VerifyTree(
-    absl::Nullable<CordRep*> node) {
+static inline CordRep* absl_nullable VerifyTree(CordRep* absl_nullable node) {
   assert(node == nullptr || VerifyNode(node, node));
   static_cast<void>(&VerifyNode);
   return node;
 }
 
-static absl::Nonnull<CordRepFlat*> CreateFlat(absl::Nonnull<const char*> data,
-                                              size_t length,
-                                              size_t alloc_hint) {
+static CordRepFlat* absl_nonnull CreateFlat(const char* absl_nonnull data,
+                                            size_t length, size_t alloc_hint) {
   CordRepFlat* flat = CordRepFlat::New(length + alloc_hint);
   flat->length = length;
   memcpy(flat->Data(), data, length);
@@ -98,8 +96,8 @@ static absl::Nonnull<CordRepFlat*> CreateFlat(absl::Nonnull<const char*> data,
 
 // Creates a new flat or Btree out of the specified array.
 // The returned node has a refcount of 1.
-static absl::Nonnull<CordRep*> NewBtree(absl::Nonnull<const char*> data,
-                                        size_t length, size_t alloc_hint) {
+static CordRep* absl_nonnull NewBtree(const char* absl_nonnull data,
+                                      size_t length, size_t alloc_hint) {
   if (length <= kMaxFlatLength) {
     return CreateFlat(data, length, alloc_hint);
   }
@@ -112,8 +110,8 @@ static absl::Nonnull<CordRep*> NewBtree(absl::Nonnull<const char*> data,
 
 // Create a new tree out of the specified array.
 // The returned node has a refcount of 1.
-static absl::Nullable<CordRep*> NewTree(absl::Nullable<const char*> data,
-                                        size_t length, size_t alloc_hint) {
+static CordRep* absl_nullable NewTree(const char* absl_nullable data,
+                                      size_t length, size_t alloc_hint) {
   if (length == 0) return nullptr;
   return NewBtree(data, length, alloc_hint);
 }
@@ -121,7 +119,7 @@ static absl::Nullable<CordRep*> NewTree(absl::Nullable<const char*> data,
 namespace cord_internal {
 
 void InitializeCordRepExternal(absl::string_view data,
-                               absl::Nonnull<CordRepExternal*> rep) {
+                               CordRepExternal* absl_nonnull rep) {
   assert(!data.empty());
   rep->length = data.size();
   rep->tag = EXTERNAL;
@@ -135,7 +133,7 @@ void InitializeCordRepExternal(absl::string_view data,
 // and not wasteful, we move the string into an external cord rep, preserving
 // the already allocated string contents.
 // Requires the provided string length to be larger than `kMaxInline`.
-static absl::Nonnull<CordRep*> CordRepFromString(std::string&& src) {
+static CordRep* absl_nonnull CordRepFromString(std::string&& src) {
   assert(src.length() > cord_internal::kMaxInline);
   if (
       // String is short: copy data to avoid external block overhead.
@@ -163,13 +161,12 @@ static absl::Nonnull<CordRep*> CordRepFromString(std::string&& src) {
 // --------------------------------------------------------------------
 // Cord::InlineRep functions
 
-inline void Cord::InlineRep::set_data(absl::Nonnull<const char*> data,
-                                      size_t n) {
+inline void Cord::InlineRep::set_data(const char* absl_nonnull data, size_t n) {
   static_assert(kMaxInline == 15, "set_data is hard-coded for a length of 15");
   data_.set_inline_data(data, n);
 }
 
-inline absl::Nonnull<char*> Cord::InlineRep::set_data(size_t n) {
+inline char* absl_nonnull Cord::InlineRep::set_data(size_t n) {
   assert(n <= kMaxInline);
   ResetToEmpty();
   set_inline_size(n);
@@ -193,13 +190,13 @@ inline void Cord::InlineRep::remove_prefix(size_t n) {
 
 // Returns `rep` converted into a CordRepBtree.
 // Directly returns `rep` if `rep` is already a CordRepBtree.
-static absl::Nonnull<CordRepBtree*> ForceBtree(CordRep* rep) {
+static CordRepBtree* absl_nonnull ForceBtree(CordRep* rep) {
   return rep->IsBtree()
              ? rep->btree()
              : CordRepBtree::Create(cord_internal::RemoveCrcNode(rep));
 }
 
-void Cord::InlineRep::AppendTreeToInlined(absl::Nonnull<CordRep*> tree,
+void Cord::InlineRep::AppendTreeToInlined(CordRep* absl_nonnull tree,
                                           MethodIdentifier method) {
   assert(!is_tree());
   if (!data_.is_empty()) {
@@ -209,7 +206,7 @@ void Cord::InlineRep::AppendTreeToInlined(absl::Nonnull<CordRep*> tree,
   EmplaceTree(tree, method);
 }
 
-void Cord::InlineRep::AppendTreeToTree(absl::Nonnull<CordRep*> tree,
+void Cord::InlineRep::AppendTreeToTree(CordRep* absl_nonnull tree,
                                        MethodIdentifier method) {
   assert(is_tree());
   const CordzUpdateScope scope(data_.cordz_info(), method);
@@ -217,7 +214,7 @@ void Cord::InlineRep::AppendTreeToTree(absl::Nonnull<CordRep*> tree,
   SetTree(tree, scope);
 }
 
-void Cord::InlineRep::AppendTree(absl::Nonnull<CordRep*> tree,
+void Cord::InlineRep::AppendTree(CordRep* absl_nonnull tree,
                                  MethodIdentifier method) {
   assert(tree != nullptr);
   assert(tree->length != 0);
@@ -229,7 +226,7 @@ void Cord::InlineRep::AppendTree(absl::Nonnull<CordRep*> tree,
   }
 }
 
-void Cord::InlineRep::PrependTreeToInlined(absl::Nonnull<CordRep*> tree,
+void Cord::InlineRep::PrependTreeToInlined(CordRep* absl_nonnull tree,
                                            MethodIdentifier method) {
   assert(!is_tree());
   if (!data_.is_empty()) {
@@ -239,7 +236,7 @@ void Cord::InlineRep::PrependTreeToInlined(absl::Nonnull<CordRep*> tree,
   EmplaceTree(tree, method);
 }
 
-void Cord::InlineRep::PrependTreeToTree(absl::Nonnull<CordRep*> tree,
+void Cord::InlineRep::PrependTreeToTree(CordRep* absl_nonnull tree,
                                         MethodIdentifier method) {
   assert(is_tree());
   const CordzUpdateScope scope(data_.cordz_info(), method);
@@ -247,7 +244,7 @@ void Cord::InlineRep::PrependTreeToTree(absl::Nonnull<CordRep*> tree,
   SetTree(tree, scope);
 }
 
-void Cord::InlineRep::PrependTree(absl::Nonnull<CordRep*> tree,
+void Cord::InlineRep::PrependTree(CordRep* absl_nonnull tree,
                                   MethodIdentifier method) {
   assert(tree != nullptr);
   assert(tree->length != 0);
@@ -263,9 +260,10 @@ void Cord::InlineRep::PrependTree(absl::Nonnull<CordRep*> tree,
 // suitable leaf is found, the function will update the length field for all
 // nodes to account for the size increase. The append region address will be
 // written to region and the actual size increase will be written to size.
-static inline bool PrepareAppendRegion(
-    absl::Nonnull<CordRep*> root, absl::Nonnull<absl::Nullable<char*>*> region,
-    absl::Nonnull<size_t*> size, size_t max_length) {
+static inline bool PrepareAppendRegion(CordRep* absl_nonnull root,
+                                       char* absl_nullable* absl_nonnull region,
+                                       size_t* absl_nonnull size,
+                                       size_t max_length) {
   if (root->IsBtree() && root->refcount.IsOne()) {
     Span<char> span = root->btree()->GetAppendBuffer(max_length);
     if (!span.empty()) {
@@ -468,11 +466,11 @@ void Cord::InlineRep::AppendArray(absl::string_view src,
   CommitTree(root, rep, scope, method);
 }
 
-inline absl::Nonnull<CordRep*> Cord::TakeRep() const& {
+inline CordRep* absl_nonnull Cord::TakeRep() const& {
   return CordRep::Ref(contents_.tree());
 }
 
-inline absl::Nonnull<CordRep*> Cord::TakeRep() && {
+inline CordRep* absl_nonnull Cord::TakeRep() && {
   CordRep* rep = contents_.tree();
   contents_.clear();
   return rep;
@@ -530,7 +528,7 @@ inline void Cord::AppendImpl(C&& src) {
   contents_.AppendTree(rep, CordzUpdateTracker::kAppendCord);
 }
 
-static CordRep::ExtractResult ExtractAppendBuffer(absl::Nonnull<CordRep*> rep,
+static CordRep::ExtractResult ExtractAppendBuffer(CordRep* absl_nonnull rep,
                                                   size_t min_capacity) {
   switch (rep->tag) {
     case cord_internal::BTREE:
@@ -777,9 +775,9 @@ int ClampResult(int memcmp_res) {
   return static_cast<int>(memcmp_res > 0) - static_cast<int>(memcmp_res < 0);
 }
 
-int CompareChunks(absl::Nonnull<absl::string_view*> lhs,
-                  absl::Nonnull<absl::string_view*> rhs,
-                  absl::Nonnull<size_t*> size_to_compare) {
+int CompareChunks(absl::string_view* absl_nonnull lhs,
+                  absl::string_view* absl_nonnull rhs,
+                  size_t* absl_nonnull size_to_compare) {
   size_t compared_size = std::min(lhs->size(), rhs->size());
   assert(*size_to_compare >= compared_size);
   *size_to_compare -= compared_size;
@@ -877,7 +875,7 @@ void Cord::SetExpectedChecksum(uint32_t crc) {
   SetCrcCordState(std::move(state));
 }
 
-absl::Nullable<const crc_internal::CrcCordState*> Cord::MaybeGetCrcCordState()
+const crc_internal::CrcCordState* absl_nullable Cord::MaybeGetCrcCordState()
     const {
   if (!contents_.is_tree() || !contents_.tree()->IsCrc()) {
     return nullptr;
@@ -895,8 +893,8 @@ absl::optional<uint32_t> Cord::ExpectedChecksum() const {
 
 inline int Cord::CompareSlowPath(absl::string_view rhs, size_t compared_size,
                                  size_t size_to_compare) const {
-  auto advance = [](absl::Nonnull<Cord::ChunkIterator*> it,
-                    absl::Nonnull<absl::string_view*> chunk) {
+  auto advance = [](Cord::ChunkIterator* absl_nonnull it,
+                    absl::string_view* absl_nonnull chunk) {
     if (!chunk->empty()) return true;
     ++*it;
     if (it->bytes_remaining_ == 0) return false;
@@ -926,8 +924,8 @@ inline int Cord::CompareSlowPath(absl::string_view rhs, size_t compared_size,
 
 inline int Cord::CompareSlowPath(const Cord& rhs, size_t compared_size,
                                  size_t size_to_compare) const {
-  auto advance = [](absl::Nonnull<Cord::ChunkIterator*> it,
-                    absl::Nonnull<absl::string_view*> chunk) {
+  auto advance = [](Cord::ChunkIterator* absl_nonnull it,
+                    absl::string_view* absl_nonnull chunk) {
     if (!chunk->empty()) return true;
     ++*it;
     if (it->bytes_remaining_ == 0) return false;
@@ -1051,7 +1049,7 @@ Cord::operator std::string() const {
   return s;
 }
 
-void CopyCordToString(const Cord& src, absl::Nonnull<std::string*> dst) {
+void CopyCordToString(const Cord& src, std::string* absl_nonnull dst) {
   if (!src.contents_.is_tree()) {
     src.contents_.CopyTo(dst);
   } else {
@@ -1060,7 +1058,7 @@ void CopyCordToString(const Cord& src, absl::Nonnull<std::string*> dst) {
   }
 }
 
-void AppendCordToString(const Cord& src, absl::Nonnull<std::string*> dst) {
+void AppendCordToString(const Cord& src, std::string* absl_nonnull dst) {
   const size_t cur_dst_size = dst->size();
   const size_t new_dst_size = cur_dst_size + src.size();
   absl::strings_internal::STLStringResizeUninitializedAmortized(dst,
@@ -1069,7 +1067,7 @@ void AppendCordToString(const Cord& src, absl::Nonnull<std::string*> dst) {
   src.CopyToArrayImpl(append_ptr);
 }
 
-void Cord::CopyToArraySlowPath(absl::Nonnull<char*> dst) const {
+void Cord::CopyToArraySlowPath(char* absl_nonnull dst) const {
   assert(contents_.is_tree());
   absl::string_view fragment;
   if (GetFlatAux(contents_.tree(), &fragment) && !fragment.empty()) {
@@ -1395,8 +1393,8 @@ absl::string_view Cord::FlattenSlowPath() {
   return absl::string_view(new_buffer, total_size);
 }
 
-/* static */ bool Cord::GetFlatAux(absl::Nonnull<CordRep*> rep,
-                                   absl::Nonnull<absl::string_view*> fragment) {
+/* static */ bool Cord::GetFlatAux(CordRep* absl_nonnull rep,
+                                   absl::string_view* absl_nonnull fragment) {
   assert(rep != nullptr);
   if (rep->length == 0) {
     *fragment = absl::string_view();
@@ -1430,7 +1428,7 @@ absl::string_view Cord::FlattenSlowPath() {
 }
 
 /* static */ void Cord::ForEachChunkAux(
-    absl::Nonnull<absl::cord_internal::CordRep*> rep,
+    absl::cord_internal::CordRep* absl_nonnull rep,
     absl::FunctionRef<void(absl::string_view)> callback) {
   assert(rep != nullptr);
   if (rep->length == 0) return;
@@ -1455,8 +1453,8 @@ absl::string_view Cord::FlattenSlowPath() {
   }
 }
 
-static void DumpNode(absl::Nonnull<CordRep*> nonnull_rep, bool include_data,
-                     absl::Nonnull<std::ostream*> os, int indent) {
+static void DumpNode(CordRep* absl_nonnull nonnull_rep, bool include_data,
+                     std::ostream* absl_nonnull os, int indent) {
   CordRep* rep = nonnull_rep;
   const int kIndentStep = 1;
   for (;;) {
@@ -1502,17 +1500,17 @@ static void DumpNode(absl::Nonnull<CordRep*> nonnull_rep, bool include_data,
   }
 }
 
-static std::string ReportError(absl::Nonnull<CordRep*> root,
-                               absl::Nonnull<CordRep*> node) {
+static std::string ReportError(CordRep* absl_nonnull root,
+                               CordRep* absl_nonnull node) {
   std::ostringstream buf;
   buf << "Error at node " << node << " in:";
   DumpNode(root, true, &buf);
   return buf.str();
 }
 
-static bool VerifyNode(absl::Nonnull<CordRep*> root,
-                       absl::Nonnull<CordRep*> start_node) {
-  absl::InlinedVector<absl::Nonnull<CordRep*>, 2> worklist;
+static bool VerifyNode(CordRep* absl_nonnull root,
+                       CordRep* absl_nonnull start_node) {
+  absl::InlinedVector<CordRep* absl_nonnull, 2> worklist;
   worklist.push_back(start_node);
   do {
     CordRep* node = worklist.back();
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/cord.h b/deps/v8/third_party/abseil-cpp/absl/strings/cord.h
index 1f8aafb587597c..7afa419a685c31 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/cord.h
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/cord.h
@@ -79,6 +79,7 @@
 #include "absl/base/optimization.h"
 #include "absl/crc/internal/crc_cord_state.h"
 #include "absl/functional/function_ref.h"
+#include "absl/hash/internal/weakly_mixed_integer.h"
 #include "absl/meta/type_traits.h"
 #include "absl/strings/cord_analysis.h"
 #include "absl/strings/cord_buffer.h"
@@ -102,8 +103,8 @@ class Cord;
 class CordTestPeer;
 template <typename Releaser>
 Cord MakeCordFromExternal(absl::string_view, Releaser&&);
-void CopyCordToString(const Cord& src, absl::Nonnull<std::string*> dst);
-void AppendCordToString(const Cord& src, absl::Nonnull<std::string*> dst);
+void CopyCordToString(const Cord& src, std::string* absl_nonnull dst);
+void AppendCordToString(const Cord& src, std::string* absl_nonnull dst);
 
 // Cord memory accounting modes
 enum class CordMemoryAccounting {
@@ -417,8 +418,7 @@ class Cord {
   // guarantee that pointers previously returned by `dst->data()` remain valid
   // even if `*dst` had enough capacity to hold `src`. If `*dst` is a new
   // object, prefer to simply use the conversion operator to `std::string`.
-  friend void CopyCordToString(const Cord& src,
-                               absl::Nonnull<std::string*> dst);
+  friend void CopyCordToString(const Cord& src, std::string* absl_nonnull dst);
 
   // AppendCordToString()
   //
@@ -430,7 +430,7 @@ class Cord {
   // `dst->data()`. If `*dst` is a new object, prefer to simply use the
   // conversion operator to `std::string`.
   friend void AppendCordToString(const Cord& src,
-                                 absl::Nonnull<std::string*> dst);
+                                 std::string* absl_nonnull dst);
 
   class CharIterator;
 
@@ -467,7 +467,7 @@ class Cord {
     using iterator_category = std::input_iterator_tag;
     using value_type = absl::string_view;
     using difference_type = ptrdiff_t;
-    using pointer = absl::Nonnull<const value_type*>;
+    using pointer = const value_type* absl_nonnull;
     using reference = value_type;
 
     ChunkIterator() = default;
@@ -488,13 +488,13 @@ class Cord {
     using CordRepBtreeReader = absl::cord_internal::CordRepBtreeReader;
 
     // Constructs a `begin()` iterator from `tree`.
-    explicit ChunkIterator(absl::Nonnull<cord_internal::CordRep*> tree);
+    explicit ChunkIterator(cord_internal::CordRep* absl_nonnull tree);
 
     // Constructs a `begin()` iterator from `cord`.
-    explicit ChunkIterator(absl::Nonnull<const Cord*> cord);
+    explicit ChunkIterator(const Cord* absl_nonnull cord);
 
     // Initializes this instance from a tree. Invoked by constructors.
-    void InitTree(absl::Nonnull<cord_internal::CordRep*> tree);
+    void InitTree(cord_internal::CordRep* absl_nonnull tree);
 
     // Removes `n` bytes from `current_chunk_`. Expects `n` to be smaller than
     // `current_chunk_.size()`.
@@ -512,7 +512,7 @@ class Cord {
     // The current leaf, or `nullptr` if the iterator points to short data.
     // If the current chunk is a substring node, current_leaf_ points to the
     // underlying flat or external node.
-    absl::Nullable<absl::cord_internal::CordRep*> current_leaf_ = nullptr;
+    absl::cord_internal::CordRep* absl_nullable current_leaf_ = nullptr;
     // The number of bytes left in the `Cord` over which we are iterating.
     size_t bytes_remaining_ = 0;
 
@@ -569,13 +569,13 @@ class Cord {
     using iterator = ChunkIterator;
     using const_iterator = ChunkIterator;
 
-    explicit ChunkRange(absl::Nonnull<const Cord*> cord) : cord_(cord) {}
+    explicit ChunkRange(const Cord* absl_nonnull cord) : cord_(cord) {}
 
     ChunkIterator begin() const;
     ChunkIterator end() const;
 
    private:
-    absl::Nonnull<const Cord*> cord_;
+    const Cord* absl_nonnull cord_;
   };
 
   // Cord::Chunks()
@@ -628,7 +628,7 @@ class Cord {
     using iterator_category = std::input_iterator_tag;
     using value_type = char;
     using difference_type = ptrdiff_t;
-    using pointer = absl::Nonnull<const char*>;
+    using pointer = const char* absl_nonnull;
     using reference = const char&;
 
     CharIterator() = default;
@@ -642,7 +642,7 @@ class Cord {
     friend Cord;
 
    private:
-    explicit CharIterator(absl::Nonnull<const Cord*> cord)
+    explicit CharIterator(const Cord* absl_nonnull cord)
         : chunk_iterator_(cord) {}
 
     ChunkIterator chunk_iterator_;
@@ -654,14 +654,14 @@ class Cord {
   // advanced as a separate `Cord`. `n_bytes` must be less than or equal to the
   // number of bytes within the Cord; otherwise, behavior is undefined. It is
   // valid to pass `char_end()` and `0`.
-  static Cord AdvanceAndRead(absl::Nonnull<CharIterator*> it, size_t n_bytes);
+  static Cord AdvanceAndRead(CharIterator* absl_nonnull it, size_t n_bytes);
 
   // Cord::Advance()
   //
   // Advances the `Cord::CharIterator` by `n_bytes`. `n_bytes` must be less than
   // or equal to the number of bytes remaining within the Cord; otherwise,
   // behavior is undefined. It is valid to pass `char_end()` and `0`.
-  static void Advance(absl::Nonnull<CharIterator*> it, size_t n_bytes);
+  static void Advance(CharIterator* absl_nonnull it, size_t n_bytes);
 
   // Cord::ChunkRemaining()
   //
@@ -670,6 +670,13 @@ class Cord {
   // `it` must be dereferenceable.
   static absl::string_view ChunkRemaining(const CharIterator& it);
 
+  // Cord::Distance()
+  //
+  // Returns the distance between `first` and `last`, as if
+  // `std::distance(first, last)` was called.
+  static ptrdiff_t Distance(const CharIterator& first,
+                            const CharIterator& last);
+
   // Cord::char_begin()
   //
   // Returns an iterator to the first character of the `Cord`.
@@ -710,13 +717,13 @@ class Cord {
     using iterator = CharIterator;
     using const_iterator = CharIterator;
 
-    explicit CharRange(absl::Nonnull<const Cord*> cord) : cord_(cord) {}
+    explicit CharRange(const Cord* absl_nonnull cord) : cord_(cord) {}
 
     CharIterator begin() const;
     CharIterator end() const;
 
    private:
-    absl::Nonnull<const Cord*> cord_;
+    const Cord* absl_nonnull cord_;
   };
 
   // Cord::Chars()
@@ -775,7 +782,7 @@ class Cord {
   CharIterator Find(const absl::Cord& needle) const;
 
   // Supports absl::Cord as a sink object for absl::Format().
-  friend void AbslFormatFlush(absl::Nonnull<absl::Cord*> cord,
+  friend void AbslFormatFlush(absl::Cord* absl_nonnull cord,
                               absl::string_view part) {
     cord->Append(part);
   }
@@ -878,7 +885,7 @@ class Cord {
   }
 #endif
 
-  friend absl::Nullable<const CordzInfo*> GetCordzInfoForTesting(
+  friend const CordzInfo* absl_nullable GetCordzInfoForTesting(
       const Cord& cord);
 
   // Calls the provided function once for each cord chunk, in order.  Unlike
@@ -907,21 +914,21 @@ class Cord {
     InlineRep& operator=(InlineRep&& src) noexcept;
 
     explicit constexpr InlineRep(absl::string_view sv,
-                                 absl::Nullable<CordRep*> rep);
+                                 CordRep* absl_nullable rep);
 
-    void Swap(absl::Nonnull<InlineRep*> rhs);
+    void Swap(InlineRep* absl_nonnull rhs);
     size_t size() const;
     // Returns nullptr if holding pointer
-    absl::Nullable<const char*> data() const;
+    const char* absl_nullable data() const;
     // Discards pointer, if any
-    void set_data(absl::Nonnull<const char*> data, size_t n);
-    absl::Nonnull<char*> set_data(size_t n);  // Write data to the result
+    void set_data(const char* absl_nonnull data, size_t n);
+    char* absl_nonnull set_data(size_t n);  // Write data to the result
     // Returns nullptr if holding bytes
-    absl::Nullable<absl::cord_internal::CordRep*> tree() const;
-    absl::Nonnull<absl::cord_internal::CordRep*> as_tree() const;
-    absl::Nonnull<const char*> as_chars() const;
+    absl::cord_internal::CordRep* absl_nullable tree() const;
+    absl::cord_internal::CordRep* absl_nonnull as_tree() const;
+    const char* absl_nonnull as_chars() const;
     // Returns non-null iff was holding a pointer
-    absl::Nullable<absl::cord_internal::CordRep*> clear();
+    absl::cord_internal::CordRep* absl_nullable clear();
     // Converts to pointer if necessary.
     void reduce_size(size_t n);    // REQUIRES: holding data
     void remove_prefix(size_t n);  // REQUIRES: holding data
@@ -930,58 +937,56 @@ class Cord {
 
     // Creates a CordRepFlat instance from the current inlined data with `extra'
     // bytes of desired additional capacity.
-    absl::Nonnull<CordRepFlat*> MakeFlatWithExtraCapacity(size_t extra);
+    CordRepFlat* absl_nonnull MakeFlatWithExtraCapacity(size_t extra);
 
     // Sets the tree value for this instance. `rep` must not be null.
     // Requires the current instance to hold a tree, and a lock to be held on
     // any CordzInfo referenced by this instance. The latter is enforced through
     // the CordzUpdateScope argument. If the current instance is sampled, then
     // the CordzInfo instance is updated to reference the new `rep` value.
-    void SetTree(absl::Nonnull<CordRep*> rep, const CordzUpdateScope& scope);
+    void SetTree(CordRep* absl_nonnull rep, const CordzUpdateScope& scope);
 
     // Identical to SetTree(), except that `rep` is allowed to be null, in
     // which case the current instance is reset to an empty value.
-    void SetTreeOrEmpty(absl::Nullable<CordRep*> rep,
+    void SetTreeOrEmpty(CordRep* absl_nullable rep,
                         const CordzUpdateScope& scope);
 
     // Sets the tree value for this instance, and randomly samples this cord.
     // This function disregards existing contents in `data_`, and should be
     // called when a Cord is 'promoted' from an 'uninitialized' or 'inlined'
     // value to a non-inlined (tree / ring) value.
-    void EmplaceTree(absl::Nonnull<CordRep*> rep, MethodIdentifier method);
+    void EmplaceTree(CordRep* absl_nonnull rep, MethodIdentifier method);
 
     // Identical to EmplaceTree, except that it copies the parent stack from
     // the provided `parent` data if the parent is sampled.
-    void EmplaceTree(absl::Nonnull<CordRep*> rep, const InlineData& parent,
+    void EmplaceTree(CordRep* absl_nonnull rep, const InlineData& parent,
                      MethodIdentifier method);
 
     // Commits the change of a newly created, or updated `rep` root value into
     // this cord. `old_rep` indicates the old (inlined or tree) value of the
     // cord, and determines if the commit invokes SetTree() or EmplaceTree().
-    void CommitTree(absl::Nullable<const CordRep*> old_rep,
-                    absl::Nonnull<CordRep*> rep, const CordzUpdateScope& scope,
+    void CommitTree(const CordRep* absl_nullable old_rep,
+                    CordRep* absl_nonnull rep, const CordzUpdateScope& scope,
                     MethodIdentifier method);
 
-    void AppendTreeToInlined(absl::Nonnull<CordRep*> tree,
+    void AppendTreeToInlined(CordRep* absl_nonnull tree,
                              MethodIdentifier method);
-    void AppendTreeToTree(absl::Nonnull<CordRep*> tree,
-                          MethodIdentifier method);
-    void AppendTree(absl::Nonnull<CordRep*> tree, MethodIdentifier method);
-    void PrependTreeToInlined(absl::Nonnull<CordRep*> tree,
+    void AppendTreeToTree(CordRep* absl_nonnull tree, MethodIdentifier method);
+    void AppendTree(CordRep* absl_nonnull tree, MethodIdentifier method);
+    void PrependTreeToInlined(CordRep* absl_nonnull tree,
                               MethodIdentifier method);
-    void PrependTreeToTree(absl::Nonnull<CordRep*> tree,
-                           MethodIdentifier method);
-    void PrependTree(absl::Nonnull<CordRep*> tree, MethodIdentifier method);
+    void PrependTreeToTree(CordRep* absl_nonnull tree, MethodIdentifier method);
+    void PrependTree(CordRep* absl_nonnull tree, MethodIdentifier method);
 
     bool IsSame(const InlineRep& other) const { return data_ == other.data_; }
 
     // Copies the inline contents into `dst`. Assumes the cord is not empty.
-    void CopyTo(absl::Nonnull<std::string*> dst) const {
+    void CopyTo(std::string* absl_nonnull dst) const {
       data_.CopyInlineToString(dst);
     }
 
     // Copies the inline contents into `dst`. Assumes the cord is not empty.
-    void CopyToArray(absl::Nonnull<char*> dst) const;
+    void CopyToArray(char* absl_nonnull dst) const;
 
     bool is_tree() const { return data_.is_tree(); }
 
@@ -994,12 +999,12 @@ class Cord {
     }
 
     // Returns the profiled CordzInfo, or nullptr if not sampled.
-    absl::Nullable<absl::cord_internal::CordzInfo*> cordz_info() const {
+    absl::cord_internal::CordzInfo* absl_nullable cordz_info() const {
       return data_.cordz_info();
     }
 
     // Sets the profiled CordzInfo.
-    void set_cordz_info(absl::Nonnull<cord_internal::CordzInfo*> cordz_info) {
+    void set_cordz_info(cord_internal::CordzInfo* absl_nonnull cordz_info) {
       assert(cordz_info != nullptr);
       data_.set_cordz_info(cordz_info);
     }
@@ -1031,19 +1036,19 @@ class Cord {
   InlineRep contents_;
 
   // Helper for GetFlat() and TryFlat().
-  static bool GetFlatAux(absl::Nonnull<absl::cord_internal::CordRep*> rep,
-                         absl::Nonnull<absl::string_view*> fragment);
+  static bool GetFlatAux(absl::cord_internal::CordRep* absl_nonnull rep,
+                         absl::string_view* absl_nonnull fragment);
 
   // Helper for ForEachChunk().
   static void ForEachChunkAux(
-      absl::Nonnull<absl::cord_internal::CordRep*> rep,
+      absl::cord_internal::CordRep* absl_nonnull rep,
       absl::FunctionRef<void(absl::string_view)> callback);
 
   // The destructor for non-empty Cords.
   void DestroyCordSlow();
 
   // Out-of-line implementation of slower parts of logic.
-  void CopyToArraySlowPath(absl::Nonnull<char*> dst) const;
+  void CopyToArraySlowPath(char* absl_nonnull dst) const;
   int CompareSlowPath(absl::string_view rhs, size_t compared_size,
                       size_t size_to_compare) const;
   int CompareSlowPath(const Cord& rhs, size_t compared_size,
@@ -1060,8 +1065,8 @@ class Cord {
 
   // Returns a new reference to contents_.tree(), or steals an existing
   // reference if called on an rvalue.
-  absl::Nonnull<absl::cord_internal::CordRep*> TakeRep() const&;
-  absl::Nonnull<absl::cord_internal::CordRep*> TakeRep() &&;
+  absl::cord_internal::CordRep* absl_nonnull TakeRep() const&;
+  absl::cord_internal::CordRep* absl_nonnull TakeRep() &&;
 
   // Helper for Append().
   template <typename C>
@@ -1093,17 +1098,17 @@ class Cord {
       hash_state = combiner.add_buffer(std::move(hash_state), chunk.data(),
                                        chunk.size());
     });
-    return H::combine(combiner.finalize(std::move(hash_state)), size());
+    return H::combine(combiner.finalize(std::move(hash_state)),
+                      hash_internal::WeaklyMixedInteger{size()});
   }
 
   friend class CrcCord;
   void SetCrcCordState(crc_internal::CrcCordState state);
-  absl::Nullable<const crc_internal::CrcCordState*> MaybeGetCrcCordState()
-      const;
+  const crc_internal::CrcCordState* absl_nullable MaybeGetCrcCordState() const;
 
   CharIterator FindImpl(CharIterator it, absl::string_view needle) const;
 
-  void CopyToArrayImpl(absl::Nonnull<char*> dst) const;
+  void CopyToArrayImpl(char* absl_nonnull dst) const;
 };
 
 ABSL_NAMESPACE_END
@@ -1123,14 +1128,14 @@ namespace cord_internal {
 // Does non-template-specific `CordRepExternal` initialization.
 // Requires `data` to be non-empty.
 void InitializeCordRepExternal(absl::string_view data,
-                               absl::Nonnull<CordRepExternal*> rep);
+                               CordRepExternal* absl_nonnull rep);
 
 // Creates a new `CordRep` that owns `data` and `releaser` and returns a pointer
 // to it. Requires `data` to be non-empty.
 template <typename Releaser>
 // NOLINTNEXTLINE - suppress clang-tidy raw pointer return.
-absl::Nonnull<CordRep*> NewExternalRep(absl::string_view data,
-                                       Releaser&& releaser) {
+CordRep* absl_nonnull NewExternalRep(absl::string_view data,
+                                     Releaser&& releaser) {
   assert(!data.empty());
   using ReleaserType = absl::decay_t<Releaser>;
   CordRepExternal* rep = new CordRepExternalImpl<ReleaserType>(
@@ -1142,7 +1147,7 @@ absl::Nonnull<CordRep*> NewExternalRep(absl::string_view data,
 // Overload for function reference types that dispatches using a function
 // pointer because there are no `alignof()` or `sizeof()` a function reference.
 // NOLINTNEXTLINE - suppress clang-tidy raw pointer return.
-inline absl::Nonnull<CordRep*> NewExternalRep(
+inline CordRep* absl_nonnull NewExternalRep(
     absl::string_view data, void (&releaser)(absl::string_view)) {
   return NewExternalRep(data, &releaser);
 }
@@ -1166,7 +1171,7 @@ Cord MakeCordFromExternal(absl::string_view data, Releaser&& releaser) {
 }
 
 constexpr Cord::InlineRep::InlineRep(absl::string_view sv,
-                                     absl::Nullable<CordRep*> rep)
+                                     CordRep* absl_nullable rep)
     : data_(sv, rep) {}
 
 inline Cord::InlineRep::InlineRep(const Cord::InlineRep& src)
@@ -1205,7 +1210,7 @@ inline Cord::InlineRep& Cord::InlineRep::operator=(
   return *this;
 }
 
-inline void Cord::InlineRep::Swap(absl::Nonnull<Cord::InlineRep*> rhs) {
+inline void Cord::InlineRep::Swap(Cord::InlineRep* absl_nonnull rhs) {
   if (rhs == this) {
     return;
   }
@@ -1213,22 +1218,22 @@ inline void Cord::InlineRep::Swap(absl::Nonnull<Cord::InlineRep*> rhs) {
   swap(data_, rhs->data_);
 }
 
-inline absl::Nullable<const char*> Cord::InlineRep::data() const {
+inline const char* absl_nullable Cord::InlineRep::data() const {
   return is_tree() ? nullptr : data_.as_chars();
 }
 
-inline absl::Nonnull<const char*> Cord::InlineRep::as_chars() const {
+inline const char* absl_nonnull Cord::InlineRep::as_chars() const {
   assert(!data_.is_tree());
   return data_.as_chars();
 }
 
-inline absl::Nonnull<absl::cord_internal::CordRep*> Cord::InlineRep::as_tree()
+inline absl::cord_internal::CordRep* absl_nonnull Cord::InlineRep::as_tree()
     const {
   assert(data_.is_tree());
   return data_.as_tree();
 }
 
-inline absl::Nullable<absl::cord_internal::CordRep*> Cord::InlineRep::tree()
+inline absl::cord_internal::CordRep* absl_nullable Cord::InlineRep::tree()
     const {
   if (is_tree()) {
     return as_tree();
@@ -1241,7 +1246,7 @@ inline size_t Cord::InlineRep::size() const {
   return is_tree() ? as_tree()->length : inline_size();
 }
 
-inline absl::Nonnull<cord_internal::CordRepFlat*>
+inline cord_internal::CordRepFlat* absl_nonnull
 Cord::InlineRep::MakeFlatWithExtraCapacity(size_t extra) {
   static_assert(cord_internal::kMinFlatLength >= sizeof(data_), "");
   size_t len = data_.inline_size();
@@ -1251,21 +1256,21 @@ Cord::InlineRep::MakeFlatWithExtraCapacity(size_t extra) {
   return result;
 }
 
-inline void Cord::InlineRep::EmplaceTree(absl::Nonnull<CordRep*> rep,
+inline void Cord::InlineRep::EmplaceTree(CordRep* absl_nonnull rep,
                                          MethodIdentifier method) {
   assert(rep);
   data_.make_tree(rep);
   CordzInfo::MaybeTrackCord(data_, method);
 }
 
-inline void Cord::InlineRep::EmplaceTree(absl::Nonnull<CordRep*> rep,
+inline void Cord::InlineRep::EmplaceTree(CordRep* absl_nonnull rep,
                                          const InlineData& parent,
                                          MethodIdentifier method) {
   data_.make_tree(rep);
   CordzInfo::MaybeTrackCord(data_, parent, method);
 }
 
-inline void Cord::InlineRep::SetTree(absl::Nonnull<CordRep*> rep,
+inline void Cord::InlineRep::SetTree(CordRep* absl_nonnull rep,
                                      const CordzUpdateScope& scope) {
   assert(rep);
   assert(data_.is_tree());
@@ -1273,7 +1278,7 @@ inline void Cord::InlineRep::SetTree(absl::Nonnull<CordRep*> rep,
   scope.SetCordRep(rep);
 }
 
-inline void Cord::InlineRep::SetTreeOrEmpty(absl::Nullable<CordRep*> rep,
+inline void Cord::InlineRep::SetTreeOrEmpty(CordRep* absl_nullable rep,
                                             const CordzUpdateScope& scope) {
   assert(data_.is_tree());
   if (rep) {
@@ -1284,8 +1289,8 @@ inline void Cord::InlineRep::SetTreeOrEmpty(absl::Nullable<CordRep*> rep,
   scope.SetCordRep(rep);
 }
 
-inline void Cord::InlineRep::CommitTree(absl::Nullable<const CordRep*> old_rep,
-                                        absl::Nonnull<CordRep*> rep,
+inline void Cord::InlineRep::CommitTree(const CordRep* absl_nullable old_rep,
+                                        CordRep* absl_nonnull rep,
                                         const CordzUpdateScope& scope,
                                         MethodIdentifier method) {
   if (old_rep) {
@@ -1295,7 +1300,7 @@ inline void Cord::InlineRep::CommitTree(absl::Nullable<const CordRep*> old_rep,
   }
 }
 
-inline absl::Nullable<absl::cord_internal::CordRep*> Cord::InlineRep::clear() {
+inline absl::cord_internal::CordRep* absl_nullable Cord::InlineRep::clear() {
   if (is_tree()) {
     CordzInfo::MaybeUntrackCord(cordz_info());
   }
@@ -1304,7 +1309,7 @@ inline absl::Nullable<absl::cord_internal::CordRep*> Cord::InlineRep::clear() {
   return result;
 }
 
-inline void Cord::InlineRep::CopyToArray(absl::Nonnull<char*> dst) const {
+inline void Cord::InlineRep::CopyToArray(char* absl_nonnull dst) const {
   assert(!is_tree());
   size_t n = inline_size();
   assert(n != 0);
@@ -1488,7 +1493,7 @@ inline bool Cord::StartsWith(absl::string_view rhs) const {
   return EqualsImpl(rhs, rhs_size);
 }
 
-inline void Cord::CopyToArrayImpl(absl::Nonnull<char*> dst) const {
+inline void Cord::CopyToArrayImpl(char* absl_nonnull dst) const {
   if (!contents_.is_tree()) {
     if (!empty()) contents_.CopyToArray(dst);
   } else {
@@ -1497,7 +1502,7 @@ inline void Cord::CopyToArrayImpl(absl::Nonnull<char*> dst) const {
 }
 
 inline void Cord::ChunkIterator::InitTree(
-    absl::Nonnull<cord_internal::CordRep*> tree) {
+    cord_internal::CordRep* absl_nonnull tree) {
   tree = cord_internal::SkipCrcNode(tree);
   if (tree->tag == cord_internal::BTREE) {
     current_chunk_ = btree_reader_.Init(tree->btree());
@@ -1508,12 +1513,12 @@ inline void Cord::ChunkIterator::InitTree(
 }
 
 inline Cord::ChunkIterator::ChunkIterator(
-    absl::Nonnull<cord_internal::CordRep*> tree) {
+    cord_internal::CordRep* absl_nonnull tree) {
   bytes_remaining_ = tree->length;
   InitTree(tree);
 }
 
-inline Cord::ChunkIterator::ChunkIterator(absl::Nonnull<const Cord*> cord) {
+inline Cord::ChunkIterator::ChunkIterator(const Cord* absl_nonnull cord) {
   if (CordRep* tree = cord->contents_.tree()) {
     bytes_remaining_ = tree->length;
     if (ABSL_PREDICT_TRUE(bytes_remaining_ != 0)) {
@@ -1649,13 +1654,13 @@ inline Cord::CharIterator::reference Cord::CharIterator::operator*() const {
   return *chunk_iterator_->data();
 }
 
-inline Cord Cord::AdvanceAndRead(absl::Nonnull<CharIterator*> it,
+inline Cord Cord::AdvanceAndRead(CharIterator* absl_nonnull it,
                                  size_t n_bytes) {
   assert(it != nullptr);
   return it->chunk_iterator_.AdvanceAndReadBytes(n_bytes);
 }
 
-inline void Cord::Advance(absl::Nonnull<CharIterator*> it, size_t n_bytes) {
+inline void Cord::Advance(CharIterator* absl_nonnull it, size_t n_bytes) {
   assert(it != nullptr);
   it->chunk_iterator_.AdvanceBytes(n_bytes);
 }
@@ -1664,6 +1669,12 @@ inline absl::string_view Cord::ChunkRemaining(const CharIterator& it) {
   return *it.chunk_iterator_;
 }
 
+inline ptrdiff_t Cord::Distance(const CharIterator& first,
+                                const CharIterator& last) {
+  return static_cast<ptrdiff_t>(first.chunk_iterator_.bytes_remaining_ -
+                                last.chunk_iterator_.bytes_remaining_);
+}
+
 inline Cord::CharIterator Cord::char_begin() const {
   return CharIterator(this);
 }
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/cord_analysis.cc b/deps/v8/third_party/abseil-cpp/absl/strings/cord_analysis.cc
index 19b0fa44364a99..dcbc826c6e694c 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/cord_analysis.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/cord_analysis.cc
@@ -39,15 +39,15 @@ enum class Mode { kFairShare, kTotal, kTotalMorePrecise };
 template <Mode mode>
 struct CordRepRef {
   // Instantiates a CordRepRef instance.
-  explicit CordRepRef(absl::Nonnull<const CordRep*> r) : rep(r) {}
+  explicit CordRepRef(const CordRep* absl_nonnull r) : rep(r) {}
 
   // Creates a child reference holding the provided child.
   // Overloaded to add cumulative reference count for kFairShare.
-  CordRepRef Child(absl::Nonnull<const CordRep*> child) const {
+  CordRepRef Child(const CordRep* absl_nonnull child) const {
     return CordRepRef(child);
   }
 
-  absl::Nonnull<const CordRep*> rep;
+  const CordRep* absl_nonnull rep;
 };
 
 // RawUsage holds the computed total number of bytes.
@@ -66,7 +66,7 @@ template <>
 struct RawUsage<Mode::kTotalMorePrecise> {
   size_t total = 0;
   // TODO(b/289250880): Replace this with a flat_hash_set.
-  std::unordered_set<absl::Nonnull<const CordRep*>> counted;
+  std::unordered_set<const CordRep* absl_nonnull> counted;
 
   void Add(size_t size, CordRepRef<Mode::kTotalMorePrecise> repref) {
     if (counted.insert(repref.rep).second) {
@@ -90,15 +90,15 @@ double MaybeDiv(double d, refcount_t refcount) {
 template <>
 struct CordRepRef<Mode::kFairShare> {
   // Creates a CordRepRef with the provided rep and top (parent) fraction.
-  explicit CordRepRef(absl::Nonnull<const CordRep*> r, double frac = 1.0)
+  explicit CordRepRef(const CordRep* absl_nonnull r, double frac = 1.0)
       : rep(r), fraction(MaybeDiv(frac, r->refcount.Get())) {}
 
   // Returns a CordRepRef with a fraction of `this->fraction / child.refcount`
-  CordRepRef Child(absl::Nonnull<const CordRep*> child) const {
+  CordRepRef Child(const CordRep* absl_nonnull child) const {
     return CordRepRef(child, fraction);
   }
 
-  absl::Nonnull<const CordRep*> rep;
+  const CordRep* absl_nonnull rep;
   double fraction;
 };
 
@@ -150,7 +150,7 @@ void AnalyzeBtree(CordRepRef<mode> rep, RawUsage<mode>& raw_usage) {
 }
 
 template <Mode mode>
-size_t GetEstimatedUsage(absl::Nonnull<const CordRep*> rep) {
+size_t GetEstimatedUsage(const CordRep* absl_nonnull rep) {
   // Zero initialized memory usage totals.
   RawUsage<mode> raw_usage;
 
@@ -179,15 +179,15 @@ size_t GetEstimatedUsage(absl::Nonnull<const CordRep*> rep) {
 
 }  // namespace
 
-size_t GetEstimatedMemoryUsage(absl::Nonnull<const CordRep*> rep) {
+size_t GetEstimatedMemoryUsage(const CordRep* absl_nonnull rep) {
   return GetEstimatedUsage<Mode::kTotal>(rep);
 }
 
-size_t GetEstimatedFairShareMemoryUsage(absl::Nonnull<const CordRep*> rep) {
+size_t GetEstimatedFairShareMemoryUsage(const CordRep* absl_nonnull rep) {
   return GetEstimatedUsage<Mode::kFairShare>(rep);
 }
 
-size_t GetMorePreciseMemoryUsage(absl::Nonnull<const CordRep*> rep) {
+size_t GetMorePreciseMemoryUsage(const CordRep* absl_nonnull rep) {
   return GetEstimatedUsage<Mode::kTotalMorePrecise>(rep);
 }
 
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/cord_analysis.h b/deps/v8/third_party/abseil-cpp/absl/strings/cord_analysis.h
index f8ce3489846fd3..db50f3a19ceee5 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/cord_analysis.h
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/cord_analysis.h
@@ -29,7 +29,7 @@ namespace cord_internal {
 // Returns the *approximate* number of bytes held in full or in part by this
 // Cord (which may not remain the same between invocations). Cords that share
 // memory could each be "charged" independently for the same shared memory.
-size_t GetEstimatedMemoryUsage(absl::Nonnull<const CordRep*> rep);
+size_t GetEstimatedMemoryUsage(const CordRep* absl_nonnull rep);
 
 // Returns the *approximate* number of bytes held in full or in part by this
 // Cord for the distinct memory held by this cord. This is similar to
@@ -47,13 +47,13 @@ size_t GetEstimatedMemoryUsage(absl::Nonnull<const CordRep*> rep);
 //
 // This is more expensive than `GetEstimatedMemoryUsage()` as it requires
 // deduplicating all memory references.
-size_t GetMorePreciseMemoryUsage(absl::Nonnull<const CordRep*> rep);
+size_t GetMorePreciseMemoryUsage(const CordRep* absl_nonnull rep);
 
 // Returns the *approximate* number of bytes held in full or in part by this
 // CordRep weighted by the sharing ratio of that data. For example, if some data
 // edge is shared by 4 different Cords, then each cord is attribute 1/4th of
 // the total memory usage as a 'fair share' of the total memory usage.
-size_t GetEstimatedFairShareMemoryUsage(absl::Nonnull<const CordRep*> rep);
+size_t GetEstimatedFairShareMemoryUsage(const CordRep* absl_nonnull rep);
 
 }  // namespace cord_internal
 ABSL_NAMESPACE_END
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/cord_test.cc b/deps/v8/third_party/abseil-cpp/absl/strings/cord_test.cc
index 993e58638f7902..55007bbcd80ad6 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/cord_test.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/cord_test.cc
@@ -2518,6 +2518,10 @@ static void VerifyCharIterator(const absl::Cord& cord) {
   absl::Cord::CharRange range = cord.Chars();
   EXPECT_EQ(range.begin() == range.end(), cord.empty());
   EXPECT_EQ(range.begin() != range.end(), !cord.empty());
+  EXPECT_EQ(absl::Cord::Distance(range.begin(), range.end()),
+            static_cast<ptrdiff_t>(cord.size()));
+  EXPECT_EQ(absl::Cord::Distance(range.end(), range.begin()),
+            -static_cast<ptrdiff_t>(cord.size()));
 
   size_t i = 0;
   absl::Cord::CharIterator pre_iter = cord.char_begin();
@@ -2548,19 +2552,29 @@ static void VerifyCharIterator(const absl::Cord& cord) {
     absl::Cord::CharIterator advance_iter = range.begin();
     absl::Cord::Advance(&advance_iter, i);
     EXPECT_EQ(pre_iter, advance_iter);
+    EXPECT_EQ(absl::Cord::Distance(range.begin(), advance_iter),
+              static_cast<ptrdiff_t>(i));
 
     advance_iter = range.begin();
     EXPECT_EQ(absl::Cord::AdvanceAndRead(&advance_iter, i), cord.Subcord(0, i));
     EXPECT_EQ(pre_iter, advance_iter);
+    EXPECT_EQ(absl::Cord::Distance(range.begin(), advance_iter),
+              static_cast<ptrdiff_t>(i));
 
     advance_iter = pre_iter;
     absl::Cord::Advance(&advance_iter, cord.size() - i);
     EXPECT_EQ(range.end(), advance_iter);
+    EXPECT_EQ(absl::Cord::Distance(range.begin(), advance_iter),
+              static_cast<ptrdiff_t>(cord.size()));
+    EXPECT_EQ(absl::Cord::Distance(advance_iter, range.end()), 0);
 
     advance_iter = pre_iter;
     EXPECT_EQ(absl::Cord::AdvanceAndRead(&advance_iter, cord.size() - i),
               cord.Subcord(i, cord.size() - i));
     EXPECT_EQ(range.end(), advance_iter);
+    EXPECT_EQ(absl::Cord::Distance(range.begin(), advance_iter),
+              static_cast<ptrdiff_t>(cord.size()));
+    EXPECT_EQ(absl::Cord::Distance(advance_iter, range.end()), 0);
 
     ++i;
     ++pre_iter;
@@ -2642,16 +2656,25 @@ TEST_P(CordTest, CharIteratorAdvanceAndRead) {
 
   MaybeHarden(cord);
 
+
   for (size_t chunk_size :
        {kChunkSize1, kChunkSize2, kChunkSize3, kChunkSize4}) {
     absl::Cord::CharIterator it = cord.char_begin();
+    size_t it_remaining = cord.size();
+    size_t it_advanced = 0;
     size_t offset = 0;
     while (offset < data.length()) {
+      EXPECT_EQ(absl::Cord::Distance(it, cord.char_end()), it_remaining);
+      EXPECT_EQ(absl::Cord::Distance(cord.char_begin(), it), it_advanced);
       const size_t n = std::min<size_t>(data.length() - offset, chunk_size);
       absl::Cord chunk = cord.AdvanceAndRead(&it, n);
       ASSERT_EQ(chunk.size(), n);
       ASSERT_EQ(chunk.Compare(data.substr(offset, n)), 0);
       offset += n;
+      it_remaining -= n;
+      it_advanced += n;
+      EXPECT_EQ(absl::Cord::Distance(it, cord.char_end()), it_remaining);
+      EXPECT_EQ(absl::Cord::Distance(cord.char_begin(), it), it_advanced);
     }
   }
 }
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/cordz_test_helpers.h b/deps/v8/third_party/abseil-cpp/absl/strings/cordz_test_helpers.h
index 619f13c27a43e8..98117099376631 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/cordz_test_helpers.h
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/cordz_test_helpers.h
@@ -34,7 +34,7 @@ namespace absl {
 ABSL_NAMESPACE_BEGIN
 
 // Returns the CordzInfo for the cord, or nullptr if the cord is not sampled.
-inline absl::Nullable<const cord_internal::CordzInfo*> GetCordzInfoForTesting(
+inline const cord_internal::CordzInfo* absl_nullable GetCordzInfoForTesting(
     const Cord& cord) {
   if (!cord.contents_.is_tree()) return nullptr;
   return cord.contents_.cordz_info();
@@ -42,7 +42,7 @@ inline absl::Nullable<const cord_internal::CordzInfo*> GetCordzInfoForTesting(
 
 // Returns true if the provided cordz_info is in the list of sampled cords.
 inline bool CordzInfoIsListed(
-    absl::Nonnull<const cord_internal::CordzInfo*> cordz_info,
+    const cord_internal::CordzInfo* absl_nonnull cordz_info,
     cord_internal::CordzSampleToken token = {}) {
   for (const cord_internal::CordzInfo& info : token) {
     if (cordz_info == &info) return true;
@@ -121,7 +121,7 @@ class CordzSamplingIntervalHelper {
 
 // Wrapper struct managing a small CordRep `rep`
 struct TestCordRep {
-  absl::Nonnull<cord_internal::CordRepFlat*> rep;
+  cord_internal::CordRepFlat* absl_nonnull rep;
 
   TestCordRep() {
     rep = cord_internal::CordRepFlat::New(100);
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/escaping.cc b/deps/v8/third_party/abseil-cpp/absl/strings/escaping.cc
index b70c5041ae99b7..e551c66312eb9b 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/escaping.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/escaping.cc
@@ -59,7 +59,7 @@ inline unsigned int hex_digit_to_int(char c) {
 }
 
 inline bool IsSurrogate(char32_t c, absl::string_view src,
-                        absl::Nullable<std::string*> error) {
+                        std::string* absl_nullable error) {
   if (c >= 0xD800 && c <= 0xDFFF) {
     if (error) {
       *error = absl::StrCat("invalid surrogate character (0xD800-DFFF): \\",
@@ -76,49 +76,49 @@ inline bool IsSurrogate(char32_t c, absl::string_view src,
 //
 //    Unescapes C escape sequences and is the reverse of CEscape().
 //
-//    If 'source' is valid, stores the unescaped string and its size in
-//    'dest' and 'dest_len' respectively, and returns true. Otherwise
-//    returns false and optionally stores the error description in
-//    'error'. Set 'error' to nullptr to disable error reporting.
+//    If `src` is valid, stores the unescaped string `dst`, and returns
+//    true. Otherwise returns false and optionally stores the error
+//    description in `error`. Set `error` to nullptr to disable error
+//    reporting.
 //
-//    'dest' should point to a buffer that is at least as big as 'source'.
-//    'source' and 'dest' may be the same.
-//
-//     NOTE: any changes to this function must also be reflected in the older
-//     UnescapeCEscapeSequences().
+//    `src` and `dst` may use the same underlying buffer.
 // ----------------------------------------------------------------------
-bool CUnescapeInternal(absl::string_view source, bool leave_nulls_escaped,
-                       absl::Nonnull<char*> dest,
-                       absl::Nonnull<ptrdiff_t*> dest_len,
-                       absl::Nullable<std::string*> error) {
-  char* d = dest;
-  const char* p = source.data();
-  const char* end = p + source.size();
-  const char* last_byte = end - 1;
-
-  // Small optimization for case where source = dest and there's no escaping
-  while (p == d && p < end && *p != '\\') p++, d++;
-
-  while (p < end) {
-    if (*p != '\\') {
-      *d++ = *p++;
+
+bool CUnescapeInternal(absl::string_view src, bool leave_nulls_escaped,
+                       std::string* absl_nonnull dst,
+                       std::string* absl_nullable error) {
+  strings_internal::STLStringResizeUninitialized(dst, src.size());
+
+  absl::string_view::size_type p = 0;  // Current src position.
+  std::string::size_type d = 0;        // Current dst position.
+
+  // When unescaping in-place, skip any prefix that does not have escaping.
+  if (src.data() == dst->data()) {
+    while (p < src.size() && src[p] != '\\') p++, d++;
+  }
+
+  while (p < src.size()) {
+    if (src[p] != '\\') {
+      (*dst)[d++] = src[p++];
     } else {
-      if (++p > last_byte) {  // skip past the '\\'
-        if (error) *error = "String cannot end with \\";
+      if (++p >= src.size()) {  // skip past the '\\'
+        if (error != nullptr) {
+          *error = "String cannot end with \\";
+        }
         return false;
       }
-      switch (*p) {
-        case 'a':  *d++ = '\a';  break;
-        case 'b':  *d++ = '\b';  break;
-        case 'f':  *d++ = '\f';  break;
-        case 'n':  *d++ = '\n';  break;
-        case 'r':  *d++ = '\r';  break;
-        case 't':  *d++ = '\t';  break;
-        case 'v':  *d++ = '\v';  break;
-        case '\\': *d++ = '\\';  break;
-        case '?':  *d++ = '\?';  break;    // \?  Who knew?
-        case '\'': *d++ = '\'';  break;
-        case '"':  *d++ = '\"';  break;
+      switch (src[p]) {
+        case 'a':  (*dst)[d++] = '\a';  break;
+        case 'b':  (*dst)[d++] = '\b';  break;
+        case 'f':  (*dst)[d++] = '\f';  break;
+        case 'n':  (*dst)[d++] = '\n';  break;
+        case 'r':  (*dst)[d++] = '\r';  break;
+        case 't':  (*dst)[d++] = '\t';  break;
+        case 'v':  (*dst)[d++] = '\v';  break;
+        case '\\': (*dst)[d++] = '\\';  break;
+        case '?':  (*dst)[d++] = '\?';  break;
+        case '\'': (*dst)[d++] = '\'';  break;
+        case '"':  (*dst)[d++] = '\"';  break;
         case '0':
         case '1':
         case '2':
@@ -128,188 +128,170 @@ bool CUnescapeInternal(absl::string_view source, bool leave_nulls_escaped,
         case '6':
         case '7': {
           // octal digit: 1 to 3 digits
-          const char* octal_start = p;
-          unsigned int ch = static_cast<unsigned int>(*p - '0');  // digit 1
-          if (p < last_byte && is_octal_digit(p[1]))
-            ch = ch * 8 + static_cast<unsigned int>(*++p - '0');  // digit 2
-          if (p < last_byte && is_octal_digit(p[1]))
-            ch = ch * 8 + static_cast<unsigned int>(*++p - '0');  // digit 3
+          auto octal_start = p;
+          unsigned int ch = static_cast<unsigned int>(src[p] - '0');  // digit 1
+          if (p + 1 < src.size() && is_octal_digit(src[p + 1]))
+            ch = ch * 8 + static_cast<unsigned int>(src[++p] - '0');  // digit 2
+          if (p + 1 < src.size() && is_octal_digit(src[p + 1]))
+            ch = ch * 8 + static_cast<unsigned int>(src[++p] - '0');  // digit 3
           if (ch > 0xff) {
-            if (error) {
-              *error = "Value of \\" +
-                       std::string(octal_start,
-                                   static_cast<size_t>(p + 1 - octal_start)) +
-                       " exceeds 0xff";
+            if (error != nullptr) {
+              *error =
+                  "Value of \\" +
+                  std::string(src.substr(octal_start, p + 1 - octal_start)) +
+                  " exceeds 0xff";
             }
             return false;
           }
           if ((ch == 0) && leave_nulls_escaped) {
             // Copy the escape sequence for the null character
-            const size_t octal_size = static_cast<size_t>(p + 1 - octal_start);
-            *d++ = '\\';
-            memmove(d, octal_start, octal_size);
-            d += octal_size;
+            (*dst)[d++] = '\\';
+            while (octal_start <= p) {
+              (*dst)[d++] = src[octal_start++];
+            }
             break;
           }
-          *d++ = static_cast<char>(ch);
+          (*dst)[d++] = static_cast<char>(ch);
           break;
         }
         case 'x':
         case 'X': {
-          if (p >= last_byte) {
-            if (error) *error = "String cannot end with \\x";
+          if (p + 1 >= src.size()) {
+            if (error != nullptr) {
+              *error = "String cannot end with \\x";
+            }
             return false;
-          } else if (!absl::ascii_isxdigit(static_cast<unsigned char>(p[1]))) {
-            if (error) *error = "\\x cannot be followed by a non-hex digit";
+          } else if (!absl::ascii_isxdigit(
+              static_cast<unsigned char>(src[p + 1]))) {
+            if (error != nullptr) {
+              *error = "\\x cannot be followed by a non-hex digit";
+            }
             return false;
           }
           unsigned int ch = 0;
-          const char* hex_start = p;
-          while (p < last_byte &&
-                 absl::ascii_isxdigit(static_cast<unsigned char>(p[1])))
+          auto hex_start = p;
+          while (p + 1 < src.size() &&
+                 absl::ascii_isxdigit(static_cast<unsigned char>(src[p + 1]))) {
             // Arbitrarily many hex digits
-            ch = (ch << 4) + hex_digit_to_int(*++p);
+            ch = (ch << 4) + hex_digit_to_int(src[++p]);
+          }
           if (ch > 0xFF) {
-            if (error) {
+            if (error != nullptr) {
               *error = "Value of \\" +
-                       std::string(hex_start,
-                                   static_cast<size_t>(p + 1 - hex_start)) +
+                       std::string(src.substr(hex_start, p + 1 - hex_start)) +
                        " exceeds 0xff";
             }
             return false;
           }
           if ((ch == 0) && leave_nulls_escaped) {
             // Copy the escape sequence for the null character
-            const size_t hex_size = static_cast<size_t>(p + 1 - hex_start);
-            *d++ = '\\';
-            memmove(d, hex_start, hex_size);
-            d += hex_size;
+            (*dst)[d++] = '\\';
+            while (hex_start <= p) {
+              (*dst)[d++] = src[hex_start++];
+            }
             break;
           }
-          *d++ = static_cast<char>(ch);
+          (*dst)[d++] = static_cast<char>(ch);
           break;
         }
         case 'u': {
           // \uhhhh => convert 4 hex digits to UTF-8
           char32_t rune = 0;
-          const char* hex_start = p;
-          if (p + 4 >= end) {
-            if (error) {
-              *error = "\\u must be followed by 4 hex digits: \\" +
-                       std::string(hex_start,
-                                   static_cast<size_t>(p + 1 - hex_start));
+          auto hex_start = p;
+          if (p + 4 >= src.size()) {
+            if (error != nullptr) {
+              *error = "\\u must be followed by 4 hex digits";
             }
             return false;
           }
           for (int i = 0; i < 4; ++i) {
             // Look one char ahead.
-            if (absl::ascii_isxdigit(static_cast<unsigned char>(p[1]))) {
-              rune = (rune << 4) + hex_digit_to_int(*++p);  // Advance p.
+            if (absl::ascii_isxdigit(static_cast<unsigned char>(src[p + 1]))) {
+              rune = (rune << 4) + hex_digit_to_int(src[++p]);
             } else {
-              if (error) {
+              if (error != nullptr) {
                 *error = "\\u must be followed by 4 hex digits: \\" +
-                         std::string(hex_start,
-                                     static_cast<size_t>(p + 1 - hex_start));
+                         std::string(src.substr(hex_start, p + 1 - hex_start));
               }
               return false;
             }
           }
           if ((rune == 0) && leave_nulls_escaped) {
             // Copy the escape sequence for the null character
-            *d++ = '\\';
-            memmove(d, hex_start, 5);  // u0000
-            d += 5;
+            (*dst)[d++] = '\\';
+            while (hex_start <= p) {
+              (*dst)[d++] = src[hex_start++];
+            }
             break;
           }
-          if (IsSurrogate(rune, absl::string_view(hex_start, 5), error)) {
+          if (IsSurrogate(rune, src.substr(hex_start, 5), error)) {
             return false;
           }
-          d += strings_internal::EncodeUTF8Char(d, rune);
+          d += strings_internal::EncodeUTF8Char(dst->data() + d, rune);
           break;
         }
         case 'U': {
           // \Uhhhhhhhh => convert 8 hex digits to UTF-8
           char32_t rune = 0;
-          const char* hex_start = p;
-          if (p + 8 >= end) {
-            if (error) {
-              *error = "\\U must be followed by 8 hex digits: \\" +
-                       std::string(hex_start,
-                                   static_cast<size_t>(p + 1 - hex_start));
+          auto hex_start = p;
+          if (p + 8 >= src.size()) {
+            if (error != nullptr) {
+              *error = "\\U must be followed by 8 hex digits";
             }
             return false;
           }
           for (int i = 0; i < 8; ++i) {
             // Look one char ahead.
-            if (absl::ascii_isxdigit(static_cast<unsigned char>(p[1]))) {
+            if (absl::ascii_isxdigit(static_cast<unsigned char>(src[p + 1]))) {
               // Don't change rune until we're sure this
               // is within the Unicode limit, but do advance p.
-              uint32_t newrune = (rune << 4) + hex_digit_to_int(*++p);
+              uint32_t newrune = (rune << 4) + hex_digit_to_int(src[++p]);
               if (newrune > 0x10FFFF) {
-                if (error) {
-                  *error = "Value of \\" +
-                           std::string(hex_start,
-                                       static_cast<size_t>(p + 1 - hex_start)) +
-                           " exceeds Unicode limit (0x10FFFF)";
+                if (error != nullptr) {
+                  *error =
+                      "Value of \\" +
+                      std::string(src.substr(hex_start, p + 1 - hex_start)) +
+                      " exceeds Unicode limit (0x10FFFF)";
                 }
                 return false;
               } else {
                 rune = newrune;
               }
             } else {
-              if (error) {
+              if (error != nullptr) {
                 *error = "\\U must be followed by 8 hex digits: \\" +
-                         std::string(hex_start,
-                                     static_cast<size_t>(p + 1 - hex_start));
+                         std::string(src.substr(hex_start, p + 1 - hex_start));
               }
               return false;
             }
           }
           if ((rune == 0) && leave_nulls_escaped) {
             // Copy the escape sequence for the null character
-            *d++ = '\\';
-            memmove(d, hex_start, 9);  // U00000000
-            d += 9;
+            (*dst)[d++] = '\\';
+            // U00000000
+            while (hex_start <= p) {
+              (*dst)[d++] = src[hex_start++];
+            }
             break;
           }
-          if (IsSurrogate(rune, absl::string_view(hex_start, 9), error)) {
+          if (IsSurrogate(rune, src.substr(hex_start, 9), error)) {
             return false;
           }
-          d += strings_internal::EncodeUTF8Char(d, rune);
+          d += strings_internal::EncodeUTF8Char(dst->data() + d, rune);
           break;
         }
         default: {
-          if (error) *error = std::string("Unknown escape sequence: \\") + *p;
+          if (error != nullptr) {
+            *error = std::string("Unknown escape sequence: \\") + src[p];
+          }
           return false;
         }
       }
-      p++;                                 // read past letter we escaped
+      p++;  // Read past letter we escaped.
     }
   }
-  *dest_len = d - dest;
-  return true;
-}
 
-// ----------------------------------------------------------------------
-// CUnescapeInternal()
-//
-//    Same as above but uses a std::string for output. 'source' and 'dest'
-//    may be the same.
-// ----------------------------------------------------------------------
-bool CUnescapeInternal(absl::string_view source, bool leave_nulls_escaped,
-                       absl::Nonnull<std::string*> dest,
-                       absl::Nullable<std::string*> error) {
-  strings_internal::STLStringResizeUninitialized(dest, source.size());
-
-  ptrdiff_t dest_size;
-  if (!CUnescapeInternal(source,
-                         leave_nulls_escaped,
-                         &(*dest)[0],
-                         &dest_size,
-                         error)) {
-    return false;
-  }
-  dest->erase(static_cast<size_t>(dest_size));
+  dst->erase(d);
   return true;
 }
 
@@ -450,7 +432,7 @@ inline size_t CEscapedLength(absl::string_view src) {
 }
 
 void CEscapeAndAppendInternal(absl::string_view src,
-                              absl::Nonnull<std::string*> dest) {
+                              std::string* absl_nonnull dest) {
   size_t escaped_len = CEscapedLength(src);
   if (escaped_len == src.size()) {
     dest->append(src.data(), src.size());
@@ -479,10 +461,10 @@ void CEscapeAndAppendInternal(absl::string_view src,
 
 // Reverses the mapping in Base64EscapeInternal; see that method's
 // documentation for details of the mapping.
-bool Base64UnescapeInternal(absl::Nullable<const char*> src_param, size_t szsrc,
-                            absl::Nullable<char*> dest, size_t szdest,
+bool Base64UnescapeInternal(const char* absl_nullable src_param, size_t szsrc,
+                            char* absl_nullable dest, size_t szdest,
                             const std::array<signed char, 256>& unbase64,
-                            absl::Nonnull<size_t*> len) {
+                            size_t* absl_nonnull len) {
   static const char kPad64Equals = '=';
   static const char kPad64Dot = '.';
 
@@ -818,8 +800,8 @@ constexpr std::array<signed char, 256> kUnWebSafeBase64 = {
 /* clang-format on */
 
 template <typename String>
-bool Base64UnescapeInternal(absl::Nullable<const char*> src, size_t slen,
-                            absl::Nonnull<String*> dest,
+bool Base64UnescapeInternal(const char* absl_nullable src, size_t slen,
+                            String* absl_nonnull dest,
                             const std::array<signed char, 256>& unbase64) {
   // Determine the size of the output string.  Base64 encodes every 3 bytes into
   // 4 characters.  Any leftover chars are added directly for good measure.
@@ -888,7 +870,7 @@ constexpr std::array<signed char, 256> kHexValueStrict = {
 // or a string.  This works because we use the [] operator to access
 // individual characters at a time.
 template <typename T>
-void HexStringToBytesInternal(absl::Nullable<const char*> from, T to,
+void HexStringToBytesInternal(const char* absl_nullable from, T to,
                               size_t num) {
   for (size_t i = 0; i < num; i++) {
     to[i] = static_cast<char>(kHexValueLenient[from[i * 2] & 0xFF] << 4) +
@@ -899,7 +881,7 @@ void HexStringToBytesInternal(absl::Nullable<const char*> from, T to,
 // This is a templated function so that T can be either a char* or a
 // std::string.
 template <typename T>
-void BytesToHexStringInternal(absl::Nullable<const unsigned char*> src, T dest,
+void BytesToHexStringInternal(const unsigned char* absl_nullable src, T dest,
                               size_t num) {
   auto dest_ptr = &dest[0];
   for (auto src_ptr = src; src_ptr != (src + num); ++src_ptr, dest_ptr += 2) {
@@ -915,8 +897,8 @@ void BytesToHexStringInternal(absl::Nullable<const unsigned char*> src, T dest,
 //
 // See CUnescapeInternal() for implementation details.
 // ----------------------------------------------------------------------
-bool CUnescape(absl::string_view source, absl::Nonnull<std::string*> dest,
-               absl::Nullable<std::string*> error) {
+bool CUnescape(absl::string_view source, std::string* absl_nonnull dest,
+               std::string* absl_nullable error) {
   return CUnescapeInternal(source, kUnescapeNulls, dest, error);
 }
 
@@ -938,23 +920,23 @@ std::string Utf8SafeCHexEscape(absl::string_view src) {
   return CEscapeInternal(src, true, true);
 }
 
-bool Base64Unescape(absl::string_view src, absl::Nonnull<std::string*> dest) {
+bool Base64Unescape(absl::string_view src, std::string* absl_nonnull dest) {
   return Base64UnescapeInternal(src.data(), src.size(), dest, kUnBase64);
 }
 
 bool WebSafeBase64Unescape(absl::string_view src,
-                           absl::Nonnull<std::string*> dest) {
+                           std::string* absl_nonnull dest) {
   return Base64UnescapeInternal(src.data(), src.size(), dest, kUnWebSafeBase64);
 }
 
-void Base64Escape(absl::string_view src, absl::Nonnull<std::string*> dest) {
+void Base64Escape(absl::string_view src, std::string* absl_nonnull dest) {
   strings_internal::Base64EscapeInternal(
       reinterpret_cast<const unsigned char*>(src.data()), src.size(), dest,
       true, strings_internal::kBase64Chars);
 }
 
 void WebSafeBase64Escape(absl::string_view src,
-                         absl::Nonnull<std::string*> dest) {
+                         std::string* absl_nonnull dest) {
   strings_internal::Base64EscapeInternal(
       reinterpret_cast<const unsigned char*>(src.data()), src.size(), dest,
       false, strings_internal::kWebSafeBase64Chars);
@@ -976,8 +958,7 @@ std::string WebSafeBase64Escape(absl::string_view src) {
   return dest;
 }
 
-bool HexStringToBytes(absl::string_view hex,
-                      absl::Nonnull<std::string*> bytes) {
+bool HexStringToBytes(absl::string_view hex, std::string* absl_nonnull bytes) {
   std::string output;
 
   size_t num_bytes = hex.size() / 2;
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/escaping.h b/deps/v8/third_party/abseil-cpp/absl/strings/escaping.h
index 08271d29ec6f7c..3aaf39ca83f02e 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/escaping.h
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/escaping.h
@@ -71,12 +71,12 @@ ABSL_NAMESPACE_BEGIN
 //     ...
 //   }
 //   EXPECT_EQ(unescaped_s, "foo\rbar\nbaz\t");
-bool CUnescape(absl::string_view source, absl::Nonnull<std::string*> dest,
-               absl::Nullable<std::string*> error);
+bool CUnescape(absl::string_view source, std::string* absl_nonnull dest,
+               std::string* absl_nullable error);
 
 // Overload of `CUnescape()` with no error reporting.
 inline bool CUnescape(absl::string_view source,
-                      absl::Nonnull<std::string*> dest) {
+                      std::string* absl_nonnull dest) {
   return CUnescape(source, dest, nullptr);
 }
 
@@ -126,7 +126,7 @@ std::string Utf8SafeCHexEscape(absl::string_view src);
 // Encodes a `src` string into a base64-encoded 'dest' string with padding
 // characters. This function conforms with RFC 4648 section 4 (base64) and RFC
 // 2045.
-void Base64Escape(absl::string_view src, absl::Nonnull<std::string*> dest);
+void Base64Escape(absl::string_view src, std::string* absl_nonnull dest);
 std::string Base64Escape(absl::string_view src);
 
 // WebSafeBase64Escape()
@@ -134,8 +134,7 @@ std::string Base64Escape(absl::string_view src);
 // Encodes a `src` string into a base64 string, like Base64Escape() does, but
 // outputs '-' instead of '+' and '_' instead of '/', and does not pad 'dest'.
 // This function conforms with RFC 4648 section 5 (base64url).
-void WebSafeBase64Escape(absl::string_view src,
-                         absl::Nonnull<std::string*> dest);
+void WebSafeBase64Escape(absl::string_view src, std::string* absl_nonnull dest);
 std::string WebSafeBase64Escape(absl::string_view src);
 
 // Base64Unescape()
@@ -145,7 +144,7 @@ std::string WebSafeBase64Escape(absl::string_view src);
 // `src` contains invalid characters, `dest` is cleared and returns `false`.
 // If padding is included (note that `Base64Escape()` does produce it), it must
 // be correct. In the padding, '=' and '.' are treated identically.
-bool Base64Unescape(absl::string_view src, absl::Nonnull<std::string*> dest);
+bool Base64Unescape(absl::string_view src, std::string* absl_nonnull dest);
 
 // WebSafeBase64Unescape()
 //
@@ -155,7 +154,7 @@ bool Base64Unescape(absl::string_view src, absl::Nonnull<std::string*> dest);
 // included (note that `WebSafeBase64Escape()` does not produce it), it must be
 // correct. In the padding, '=' and '.' are treated identically.
 bool WebSafeBase64Unescape(absl::string_view src,
-                           absl::Nonnull<std::string*> dest);
+                           std::string* absl_nonnull dest);
 
 // HexStringToBytes()
 //
@@ -164,7 +163,7 @@ bool WebSafeBase64Unescape(absl::string_view src,
 // function returns false and leaves `bytes` in an unspecified state. Returns
 // true on success.
 [[nodiscard]] bool HexStringToBytes(absl::string_view hex,
-                                    absl::Nonnull<std::string*> bytes);
+                                    std::string* absl_nonnull bytes);
 
 // HexStringToBytes()
 //
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/escaping_test.cc b/deps/v8/third_party/abseil-cpp/absl/strings/escaping_test.cc
index 25cb685bef590e..4786c882bf8eec 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/escaping_test.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/escaping_test.cc
@@ -169,15 +169,25 @@ TEST(Unescape, BasicFunction) {
     EXPECT_TRUE(absl::CUnescape(val.escaped, &out));
     EXPECT_EQ(out, val.unescaped);
   }
-  std::string bad[] = {"\\u1",         // too short
-                       "\\U1",         // too short
-                       "\\Uffffff",    // exceeds 0x10ffff (largest Unicode)
-                       "\\U00110000",  // exceeds 0x10ffff (largest Unicode)
-                       "\\uD835",      // surrogate character (D800-DFFF)
-                       "\\U0000DD04",  // surrogate character (D800-DFFF)
-                       "\\777",        // exceeds 0xff
-                       "\\xABCD"};     // exceeds 0xff
-  for (const std::string& e : bad) {
+  constexpr absl::string_view bad[] = {
+      "\\u1",         // too short
+      "\\U1",         // too short
+      "\\Uffffff",    // exceeds 0x10ffff (largest Unicode)
+      "\\U00110000",  // exceeds 0x10ffff (largest Unicode)
+      "\\uD835",      // surrogate character (D800-DFFF)
+      "\\U0000DD04",  // surrogate character (D800-DFFF)
+      "\\777",        // exceeds 0xff
+      "\\xABCD",      // exceeds 0xff
+      "endswith\\",   // ends with "\"
+      "endswith\\x",  // ends with "\x"
+      "endswith\\X",  // ends with "\X"
+      "\\x.2345678",  // non-hex follows "\x"
+      "\\X.2345678",  // non-hex follows "\X"
+      "\\u.2345678",  // non-hex follows "\U"
+      "\\U.2345678",  // non-hex follows "\U"
+      "\\.unknown",   // unknown escape sequence
+  };
+  for (const auto e : bad) {
     std::string error;
     std::string out;
     EXPECT_FALSE(absl::CUnescape(e, &out, &error));
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/internal/charconv_bigint_test.cc b/deps/v8/third_party/abseil-cpp/absl/strings/internal/charconv_bigint_test.cc
index a8b9945829e8db..7bbf16df121ce9 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/internal/charconv_bigint_test.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/internal/charconv_bigint_test.cc
@@ -176,7 +176,7 @@ TEST(BigUnsigned, MultiplyByBigUnsigned) {
 
 TEST(BigUnsigned, MultiplyByOverflow) {
   {
-    // Check that multiplcation overflow predictably truncates.
+    // Check that multiplication overflow predictably truncates.
 
     // A big int with all bits on.
     BigUnsigned<4> all_bits_on("340282366920938463463374607431768211455");
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/internal/cord_internal.h b/deps/v8/third_party/abseil-cpp/absl/strings/internal/cord_internal.h
index f2c0253dc8309f..b55b412c09194e 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/internal/cord_internal.h
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/internal/cord_internal.h
@@ -635,7 +635,7 @@ class InlineData {
     poison();
   }
 
-  void CopyInlineToString(absl::Nonnull<std::string*> dst) const {
+  void CopyInlineToString(std::string* absl_nonnull dst) const {
     assert(!is_tree());
     // As Cord can store only 15 bytes it is smaller than std::string's
     // small string optimization buffer size. Therefore we will always trigger
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/numbers.cc b/deps/v8/third_party/abseil-cpp/absl/strings/numbers.cc
index c7adaef5cf3564..a83fd2ca842d9e 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/numbers.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/numbers.cc
@@ -47,7 +47,7 @@
 namespace absl {
 ABSL_NAMESPACE_BEGIN
 
-bool SimpleAtof(absl::string_view str, absl::Nonnull<float*> out) {
+bool SimpleAtof(absl::string_view str, float* absl_nonnull out) {
   *out = 0.0;
   str = StripAsciiWhitespace(str);
   // std::from_chars doesn't accept an initial +, but SimpleAtof does, so if one
@@ -78,7 +78,7 @@ bool SimpleAtof(absl::string_view str, absl::Nonnull<float*> out) {
   return true;
 }
 
-bool SimpleAtod(absl::string_view str, absl::Nonnull<double*> out) {
+bool SimpleAtod(absl::string_view str, double* absl_nonnull out) {
   *out = 0.0;
   str = StripAsciiWhitespace(str);
   // std::from_chars doesn't accept an initial +, but SimpleAtod does, so if one
@@ -109,7 +109,7 @@ bool SimpleAtod(absl::string_view str, absl::Nonnull<double*> out) {
   return true;
 }
 
-bool SimpleAtob(absl::string_view str, absl::Nonnull<bool*> out) {
+bool SimpleAtob(absl::string_view str, bool* absl_nonnull out) {
   ABSL_RAW_CHECK(out != nullptr, "Output pointer must not be nullptr.");
   if (EqualsIgnoreCase(str, "true") || EqualsIgnoreCase(str, "t") ||
       EqualsIgnoreCase(str, "yes") || EqualsIgnoreCase(str, "y") ||
@@ -168,7 +168,7 @@ constexpr uint64_t kDivisionBy100Mul = 10486u;
 constexpr uint64_t kDivisionBy100Div = 1 << 20;
 
 // Encode functions write the ASCII output of input `n` to `out_str`.
-inline char* EncodeHundred(uint32_t n, absl::Nonnull<char*> out_str) {
+inline char* EncodeHundred(uint32_t n, char* absl_nonnull out_str) {
   int num_digits = static_cast<int>(n - 10) >> 8;
   uint32_t div10 = (n * kDivisionBy10Mul) / kDivisionBy10Div;
   uint32_t mod10 = n - 10u * div10;
@@ -178,7 +178,7 @@ inline char* EncodeHundred(uint32_t n, absl::Nonnull<char*> out_str) {
   return out_str + 2 + num_digits;
 }
 
-inline char* EncodeTenThousand(uint32_t n, absl::Nonnull<char*> out_str) {
+inline char* EncodeTenThousand(uint32_t n, char* absl_nonnull out_str) {
   // We split lower 2 digits and upper 2 digits of n into 2 byte consecutive
   // blocks. 123 ->  [\0\1][\0\23]. We divide by 10 both blocks
   // (it's 1 division + zeroing upper bits), and compute modulo 10 as well "in
@@ -234,8 +234,8 @@ inline uint64_t PrepareEightDigits(uint32_t i) {
   return tens;
 }
 
-inline ABSL_ATTRIBUTE_ALWAYS_INLINE absl::Nonnull<char*> EncodeFullU32(
-    uint32_t n, absl::Nonnull<char*> out_str) {
+inline ABSL_ATTRIBUTE_ALWAYS_INLINE char* absl_nonnull EncodeFullU32(
+    uint32_t n, char* absl_nonnull out_str) {
   if (n < 10) {
     *out_str = static_cast<char>('0' + n);
     return out_str + 1;
@@ -284,7 +284,7 @@ inline ABSL_ATTRIBUTE_ALWAYS_INLINE char* EncodeFullU64(uint64_t i,
 
 }  // namespace
 
-void numbers_internal::PutTwoDigits(uint32_t i, absl::Nonnull<char*> buf) {
+void numbers_internal::PutTwoDigits(uint32_t i, char* absl_nonnull buf) {
   assert(i < 100);
   uint32_t base = kTwoZeroBytes;
   uint32_t div10 = (i * kDivisionBy10Mul) / kDivisionBy10Div;
@@ -293,15 +293,15 @@ void numbers_internal::PutTwoDigits(uint32_t i, absl::Nonnull<char*> buf) {
   little_endian::Store16(buf, static_cast<uint16_t>(base));
 }
 
-absl::Nonnull<char*> numbers_internal::FastIntToBuffer(
-    uint32_t n, absl::Nonnull<char*> out_str) {
+char* absl_nonnull numbers_internal::FastIntToBuffer(
+    uint32_t n, char* absl_nonnull out_str) {
   out_str = EncodeFullU32(n, out_str);
   *out_str = '\0';
   return out_str;
 }
 
-absl::Nonnull<char*> numbers_internal::FastIntToBuffer(
-    int32_t i, absl::Nonnull<char*> buffer) {
+char* absl_nonnull numbers_internal::FastIntToBuffer(
+    int32_t i, char* absl_nonnull buffer) {
   uint32_t u = static_cast<uint32_t>(i);
   if (i < 0) {
     *buffer++ = '-';
@@ -315,15 +315,15 @@ absl::Nonnull<char*> numbers_internal::FastIntToBuffer(
   return buffer;
 }
 
-absl::Nonnull<char*> numbers_internal::FastIntToBuffer(
-    uint64_t i, absl::Nonnull<char*> buffer) {
+char* absl_nonnull numbers_internal::FastIntToBuffer(
+    uint64_t i, char* absl_nonnull buffer) {
   buffer = EncodeFullU64(i, buffer);
   *buffer = '\0';
   return buffer;
 }
 
-absl::Nonnull<char*> numbers_internal::FastIntToBuffer(
-    int64_t i, absl::Nonnull<char*> buffer) {
+char* absl_nonnull numbers_internal::FastIntToBuffer(
+    int64_t i, char* absl_nonnull buffer) {
   uint64_t u = static_cast<uint64_t>(i);
   if (i < 0) {
     *buffer++ = '-';
@@ -546,7 +546,7 @@ static ExpDigits SplitToSix(const double value) {
 // Helper function for fast formatting of floating-point.
 // The result is the same as "%g", a.k.a. "%.6g".
 size_t numbers_internal::SixDigitsToBuffer(double d,
-                                           absl::Nonnull<char*> const buffer) {
+                                           char* absl_nonnull const buffer) {
   static_assert(std::numeric_limits<float>::is_iec559,
                 "IEEE-754/IEC-559 support only");
 
@@ -694,9 +694,9 @@ static constexpr std::array<int8_t, 256> kAsciiToInt = {
 
 // Parse the sign and optional hex or oct prefix in text.
 inline bool safe_parse_sign_and_base(
-    absl::Nonnull<absl::string_view*> text /*inout*/,
-    absl::Nonnull<int*> base_ptr /*inout*/,
-    absl::Nonnull<bool*> negative_ptr /*output*/) {
+    absl::string_view* absl_nonnull text /*inout*/,
+    int* absl_nonnull base_ptr /*inout*/,
+    bool* absl_nonnull negative_ptr /*output*/) {
   if (text->data() == nullptr) {
     return false;
   }
@@ -981,7 +981,7 @@ ABSL_CONST_INIT const IntType LookupTables<IntType>::kVminOverBase[] =
 
 template <typename IntType>
 inline bool safe_parse_positive_int(absl::string_view text, int base,
-                                    absl::Nonnull<IntType*> value_p) {
+                                    IntType* absl_nonnull value_p) {
   IntType value = 0;
   const IntType vmax = std::numeric_limits<IntType>::max();
   assert(vmax > 0);
@@ -1018,7 +1018,7 @@ inline bool safe_parse_positive_int(absl::string_view text, int base,
 
 template <typename IntType>
 inline bool safe_parse_negative_int(absl::string_view text, int base,
-                                    absl::Nonnull<IntType*> value_p) {
+                                    IntType* absl_nonnull value_p) {
   IntType value = 0;
   const IntType vmin = std::numeric_limits<IntType>::min();
   assert(vmin < 0);
@@ -1063,7 +1063,7 @@ inline bool safe_parse_negative_int(absl::string_view text, int base,
 // http://pubs.opengroup.org/onlinepubs/9699919799/functions/strtol.html
 template <typename IntType>
 inline bool safe_int_internal(absl::string_view text,
-                              absl::Nonnull<IntType*> value_p, int base) {
+                              IntType* absl_nonnull value_p, int base) {
   *value_p = 0;
   bool negative;
   if (!safe_parse_sign_and_base(&text, &base, &negative)) {
@@ -1078,7 +1078,7 @@ inline bool safe_int_internal(absl::string_view text,
 
 template <typename IntType>
 inline bool safe_uint_internal(absl::string_view text,
-                               absl::Nonnull<IntType*> value_p, int base) {
+                               IntType* absl_nonnull value_p, int base) {
   *value_p = 0;
   bool negative;
   if (!safe_parse_sign_and_base(&text, &base, &negative) || negative) {
@@ -1112,52 +1112,52 @@ ABSL_CONST_INIT ABSL_DLL const char kHexTable[513] =
     "e0e1e2e3e4e5e6e7e8e9eaebecedeeef"
     "f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff";
 
-bool safe_strto8_base(absl::string_view text, absl::Nonnull<int8_t*> value,
+bool safe_strto8_base(absl::string_view text, int8_t* absl_nonnull value,
                       int base) {
   return safe_int_internal<int8_t>(text, value, base);
 }
 
-bool safe_strto16_base(absl::string_view text, absl::Nonnull<int16_t*> value,
+bool safe_strto16_base(absl::string_view text, int16_t* absl_nonnull value,
                        int base) {
   return safe_int_internal<int16_t>(text, value, base);
 }
 
-bool safe_strto32_base(absl::string_view text, absl::Nonnull<int32_t*> value,
+bool safe_strto32_base(absl::string_view text, int32_t* absl_nonnull value,
                        int base) {
   return safe_int_internal<int32_t>(text, value, base);
 }
 
-bool safe_strto64_base(absl::string_view text, absl::Nonnull<int64_t*> value,
+bool safe_strto64_base(absl::string_view text, int64_t* absl_nonnull value,
                        int base) {
   return safe_int_internal<int64_t>(text, value, base);
 }
 
-bool safe_strto128_base(absl::string_view text, absl::Nonnull<int128*> value,
+bool safe_strto128_base(absl::string_view text, int128* absl_nonnull value,
                         int base) {
   return safe_int_internal<absl::int128>(text, value, base);
 }
 
-bool safe_strtou8_base(absl::string_view text, absl::Nonnull<uint8_t*> value,
+bool safe_strtou8_base(absl::string_view text, uint8_t* absl_nonnull value,
                        int base) {
   return safe_uint_internal<uint8_t>(text, value, base);
 }
 
-bool safe_strtou16_base(absl::string_view text, absl::Nonnull<uint16_t*> value,
+bool safe_strtou16_base(absl::string_view text, uint16_t* absl_nonnull value,
                         int base) {
   return safe_uint_internal<uint16_t>(text, value, base);
 }
 
-bool safe_strtou32_base(absl::string_view text, absl::Nonnull<uint32_t*> value,
+bool safe_strtou32_base(absl::string_view text, uint32_t* absl_nonnull value,
                         int base) {
   return safe_uint_internal<uint32_t>(text, value, base);
 }
 
-bool safe_strtou64_base(absl::string_view text, absl::Nonnull<uint64_t*> value,
+bool safe_strtou64_base(absl::string_view text, uint64_t* absl_nonnull value,
                         int base) {
   return safe_uint_internal<uint64_t>(text, value, base);
 }
 
-bool safe_strtou128_base(absl::string_view text, absl::Nonnull<uint128*> value,
+bool safe_strtou128_base(absl::string_view text, uint128* absl_nonnull value,
                          int base) {
   return safe_uint_internal<absl::uint128>(text, value, base);
 }
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/numbers.h b/deps/v8/third_party/abseil-cpp/absl/strings/numbers.h
index 5f4b661fe59a1d..9c679746d37626 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/numbers.h
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/numbers.h
@@ -63,7 +63,7 @@ ABSL_NAMESPACE_BEGIN
 // state.
 template <typename int_type>
 [[nodiscard]] bool SimpleAtoi(absl::string_view str,
-                              absl::Nonnull<int_type*> out);
+                              int_type* absl_nonnull out);
 
 // SimpleAtof()
 //
@@ -74,7 +74,7 @@ template <typename int_type>
 // allowed formats for `str`, except SimpleAtof() is locale-independent and will
 // always use the "C" locale. If any errors are encountered, this function
 // returns `false`, leaving `out` in an unspecified state.
-[[nodiscard]] bool SimpleAtof(absl::string_view str, absl::Nonnull<float*> out);
+[[nodiscard]] bool SimpleAtof(absl::string_view str, float* absl_nonnull out);
 
 // SimpleAtod()
 //
@@ -85,8 +85,7 @@ template <typename int_type>
 // allowed formats for `str`, except SimpleAtod is locale-independent and will
 // always use the "C" locale. If any errors are encountered, this function
 // returns `false`, leaving `out` in an unspecified state.
-[[nodiscard]] bool SimpleAtod(absl::string_view str,
-                              absl::Nonnull<double*> out);
+[[nodiscard]] bool SimpleAtod(absl::string_view str, double* absl_nonnull out);
 
 // SimpleAtob()
 //
@@ -96,7 +95,7 @@ template <typename int_type>
 // are interpreted as boolean `false`: "false", "f", "no", "n", "0". If any
 // errors are encountered, this function returns `false`, leaving `out` in an
 // unspecified state.
-[[nodiscard]] bool SimpleAtob(absl::string_view str, absl::Nonnull<bool*> out);
+[[nodiscard]] bool SimpleAtob(absl::string_view str, bool* absl_nonnull out);
 
 // SimpleHexAtoi()
 //
@@ -110,13 +109,13 @@ template <typename int_type>
 // `false`, leaving `out` in an unspecified state.
 template <typename int_type>
 [[nodiscard]] bool SimpleHexAtoi(absl::string_view str,
-                                 absl::Nonnull<int_type*> out);
+                                 int_type* absl_nonnull out);
 
 // Overloads of SimpleHexAtoi() for 128 bit integers.
 [[nodiscard]] inline bool SimpleHexAtoi(absl::string_view str,
-                                        absl::Nonnull<absl::int128*> out);
+                                        absl::int128* absl_nonnull out);
 [[nodiscard]] inline bool SimpleHexAtoi(absl::string_view str,
-                                        absl::Nonnull<absl::uint128*> out);
+                                        absl::uint128* absl_nonnull out);
 
 ABSL_NAMESPACE_END
 }  // namespace absl
@@ -150,30 +149,30 @@ ABSL_DLL extern const char
 //   PutTwoDigits(42, buf);
 //   // buf[0] == '4'
 //   // buf[1] == '2'
-void PutTwoDigits(uint32_t i, absl::Nonnull<char*> buf);
+void PutTwoDigits(uint32_t i, char* absl_nonnull buf);
 
 // safe_strto?() functions for implementing SimpleAtoi()
 
-bool safe_strto8_base(absl::string_view text, absl::Nonnull<int8_t*> value,
+bool safe_strto8_base(absl::string_view text, int8_t* absl_nonnull value,
                       int base);
-bool safe_strto16_base(absl::string_view text, absl::Nonnull<int16_t*> value,
+bool safe_strto16_base(absl::string_view text, int16_t* absl_nonnull value,
                        int base);
-bool safe_strto32_base(absl::string_view text, absl::Nonnull<int32_t*> value,
+bool safe_strto32_base(absl::string_view text, int32_t* absl_nonnull value,
                        int base);
-bool safe_strto64_base(absl::string_view text, absl::Nonnull<int64_t*> value,
+bool safe_strto64_base(absl::string_view text, int64_t* absl_nonnull value,
                        int base);
 bool safe_strto128_base(absl::string_view text,
-                        absl::Nonnull<absl::int128*> value, int base);
-bool safe_strtou8_base(absl::string_view text, absl::Nonnull<uint8_t*> value,
+                        absl::int128* absl_nonnull value, int base);
+bool safe_strtou8_base(absl::string_view text, uint8_t* absl_nonnull value,
                        int base);
-bool safe_strtou16_base(absl::string_view text, absl::Nonnull<uint16_t*> value,
+bool safe_strtou16_base(absl::string_view text, uint16_t* absl_nonnull value,
                         int base);
-bool safe_strtou32_base(absl::string_view text, absl::Nonnull<uint32_t*> value,
+bool safe_strtou32_base(absl::string_view text, uint32_t* absl_nonnull value,
                         int base);
-bool safe_strtou64_base(absl::string_view text, absl::Nonnull<uint64_t*> value,
+bool safe_strtou64_base(absl::string_view text, uint64_t* absl_nonnull value,
                         int base);
 bool safe_strtou128_base(absl::string_view text,
-                         absl::Nonnull<absl::uint128*> value, int base);
+                         absl::uint128* absl_nonnull value, int base);
 
 static const int kFastToBufferSize = 32;
 static const int kSixDigitsToBufferSize = 16;
@@ -184,25 +183,25 @@ static const int kSixDigitsToBufferSize = 16;
 // outside the range 0.0001-999999 are output using scientific notation
 // (1.23456e+06). This routine is heavily optimized.
 // Required buffer size is `kSixDigitsToBufferSize`.
-size_t SixDigitsToBuffer(double d, absl::Nonnull<char*> buffer);
+size_t SixDigitsToBuffer(double d, char* absl_nonnull buffer);
 
 // WARNING: These functions may write more characters than necessary, because
 // they are intended for speed. All functions take an output buffer
 // as an argument and return a pointer to the last byte they wrote, which is the
 // terminating '\0'. At most `kFastToBufferSize` bytes are written.
-absl::Nonnull<char*> FastIntToBuffer(int32_t i, absl::Nonnull<char*> buffer)
+char* absl_nonnull FastIntToBuffer(int32_t i, char* absl_nonnull buffer)
     ABSL_INTERNAL_NEED_MIN_SIZE(buffer, kFastToBufferSize);
-absl::Nonnull<char*> FastIntToBuffer(uint32_t n, absl::Nonnull<char*> out_str)
+char* absl_nonnull FastIntToBuffer(uint32_t n, char* absl_nonnull out_str)
     ABSL_INTERNAL_NEED_MIN_SIZE(out_str, kFastToBufferSize);
-absl::Nonnull<char*> FastIntToBuffer(int64_t i, absl::Nonnull<char*> buffer)
+char* absl_nonnull FastIntToBuffer(int64_t i, char* absl_nonnull buffer)
     ABSL_INTERNAL_NEED_MIN_SIZE(buffer, kFastToBufferSize);
-absl::Nonnull<char*> FastIntToBuffer(uint64_t i, absl::Nonnull<char*> buffer)
+char* absl_nonnull FastIntToBuffer(uint64_t i, char* absl_nonnull buffer)
     ABSL_INTERNAL_NEED_MIN_SIZE(buffer, kFastToBufferSize);
 
 // For enums and integer types that are not an exact match for the types above,
 // use templates to call the appropriate one of the four overloads above.
 template <typename int_type>
-absl::Nonnull<char*> FastIntToBuffer(int_type i, absl::Nonnull<char*> buffer)
+char* absl_nonnull FastIntToBuffer(int_type i, char* absl_nonnull buffer)
     ABSL_INTERNAL_NEED_MIN_SIZE(buffer, kFastToBufferSize) {
   static_assert(sizeof(i) <= 64 / 8,
                 "FastIntToBuffer works only with 64-bit-or-less integers.");
@@ -228,7 +227,7 @@ absl::Nonnull<char*> FastIntToBuffer(int_type i, absl::Nonnull<char*> buffer)
 // with base different from 10 elsewhere in Abseil implementation).
 template <typename int_type>
 [[nodiscard]] bool safe_strtoi_base(absl::string_view s,
-                                    absl::Nonnull<int_type*> out, int base) {
+                                    int_type* absl_nonnull out, int base) {
   static_assert(sizeof(*out) == 1 || sizeof(*out) == 2 || sizeof(*out) == 4 ||
                     sizeof(*out) == 8,
                 "SimpleAtoi works only with 8, 16, 32, or 64-bit integers.");
@@ -284,7 +283,7 @@ template <typename int_type>
 // without the terminating null character. Thus `out` must be of length >= 16.
 // Returns the number of non-pad digits of the output (it can never be zero
 // since 0 has one digit).
-inline size_t FastHexToBufferZeroPad16(uint64_t val, absl::Nonnull<char*> out) {
+inline size_t FastHexToBufferZeroPad16(uint64_t val, char* absl_nonnull out) {
 #ifdef ABSL_INTERNAL_HAVE_SSSE3
   uint64_t be = absl::big_endian::FromHost64(val);
   const auto kNibbleMask = _mm_set1_epi8(0xf);
@@ -311,33 +310,33 @@ inline size_t FastHexToBufferZeroPad16(uint64_t val, absl::Nonnull<char*> out) {
 
 template <typename int_type>
 [[nodiscard]] bool SimpleAtoi(absl::string_view str,
-                              absl::Nonnull<int_type*> out) {
+                              int_type* absl_nonnull out) {
   return numbers_internal::safe_strtoi_base(str, out, 10);
 }
 
 [[nodiscard]] inline bool SimpleAtoi(absl::string_view str,
-                                     absl::Nonnull<absl::int128*> out) {
+                                     absl::int128* absl_nonnull out) {
   return numbers_internal::safe_strto128_base(str, out, 10);
 }
 
 [[nodiscard]] inline bool SimpleAtoi(absl::string_view str,
-                                     absl::Nonnull<absl::uint128*> out) {
+                                     absl::uint128* absl_nonnull out) {
   return numbers_internal::safe_strtou128_base(str, out, 10);
 }
 
 template <typename int_type>
 [[nodiscard]] bool SimpleHexAtoi(absl::string_view str,
-                                 absl::Nonnull<int_type*> out) {
+                                 int_type* absl_nonnull out) {
   return numbers_internal::safe_strtoi_base(str, out, 16);
 }
 
 [[nodiscard]] inline bool SimpleHexAtoi(absl::string_view str,
-                                        absl::Nonnull<absl::int128*> out) {
+                                        absl::int128* absl_nonnull out) {
   return numbers_internal::safe_strto128_base(str, out, 16);
 }
 
 [[nodiscard]] inline bool SimpleHexAtoi(absl::string_view str,
-                                        absl::Nonnull<absl::uint128*> out) {
+                                        absl::uint128* absl_nonnull out) {
   return numbers_internal::safe_strtou128_base(str, out, 16);
 }
 
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/str_cat.cc b/deps/v8/third_party/abseil-cpp/absl/strings/str_cat.cc
index c51c13732d22d7..1f3cfbffc110f1 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/str_cat.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/str_cat.cc
@@ -42,8 +42,7 @@ ABSL_NAMESPACE_BEGIN
 namespace {
 // Append is merely a version of memcpy that returns the address of the byte
 // after the area just overwritten.
-inline absl::Nonnull<char*> Append(absl::Nonnull<char*> out,
-                                   const AlphaNum& x) {
+inline char* absl_nonnull Append(char* absl_nonnull out, const AlphaNum& x) {
   // memcpy is allowed to overwrite arbitrary memory, so doing this after the
   // call would force an extra fetch of x.size().
   char* after = out + x.size();
@@ -159,7 +158,7 @@ std::string CatPieces(std::initializer_list<absl::string_view> pieces) {
   assert(((src).size() == 0) ||      \
          (uintptr_t((src).data() - (dest).data()) > uintptr_t((dest).size())))
 
-void AppendPieces(absl::Nonnull<std::string*> dest,
+void AppendPieces(std::string* absl_nonnull dest,
                   std::initializer_list<absl::string_view> pieces) {
   size_t old_size = dest->size();
   size_t to_append = 0;
@@ -183,7 +182,7 @@ void AppendPieces(absl::Nonnull<std::string*> dest,
 
 }  // namespace strings_internal
 
-void StrAppend(absl::Nonnull<std::string*> dest, const AlphaNum& a) {
+void StrAppend(std::string* absl_nonnull dest, const AlphaNum& a) {
   ASSERT_NO_OVERLAP(*dest, a);
   std::string::size_type old_size = dest->size();
   STLStringAppendUninitializedAmortized(dest, a.size());
@@ -193,7 +192,7 @@ void StrAppend(absl::Nonnull<std::string*> dest, const AlphaNum& a) {
   assert(out == begin + dest->size());
 }
 
-void StrAppend(absl::Nonnull<std::string*> dest, const AlphaNum& a,
+void StrAppend(std::string* absl_nonnull dest, const AlphaNum& a,
                const AlphaNum& b) {
   ASSERT_NO_OVERLAP(*dest, a);
   ASSERT_NO_OVERLAP(*dest, b);
@@ -206,7 +205,7 @@ void StrAppend(absl::Nonnull<std::string*> dest, const AlphaNum& a,
   assert(out == begin + dest->size());
 }
 
-void StrAppend(absl::Nonnull<std::string*> dest, const AlphaNum& a,
+void StrAppend(std::string* absl_nonnull dest, const AlphaNum& a,
                const AlphaNum& b, const AlphaNum& c) {
   ASSERT_NO_OVERLAP(*dest, a);
   ASSERT_NO_OVERLAP(*dest, b);
@@ -221,7 +220,7 @@ void StrAppend(absl::Nonnull<std::string*> dest, const AlphaNum& a,
   assert(out == begin + dest->size());
 }
 
-void StrAppend(absl::Nonnull<std::string*> dest, const AlphaNum& a,
+void StrAppend(std::string* absl_nonnull dest, const AlphaNum& a,
                const AlphaNum& b, const AlphaNum& c, const AlphaNum& d) {
   ASSERT_NO_OVERLAP(*dest, a);
   ASSERT_NO_OVERLAP(*dest, b);
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/str_cat.h b/deps/v8/third_party/abseil-cpp/absl/strings/str_cat.h
index 6a07797bd84d35..eafd8a3f0e9532 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/str_cat.h
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/str_cat.h
@@ -213,7 +213,7 @@ struct Hex {
                               !std::is_pointer<Int>::value>::type* = nullptr)
       : Hex(spec, static_cast<uint64_t>(v)) {}
   template <typename Pointee>
-  explicit Hex(absl::Nullable<Pointee*> v, PadSpec spec = absl::kNoPad)
+  explicit Hex(Pointee* absl_nullable v, PadSpec spec = absl::kNoPad)
       : Hex(spec, reinterpret_cast<uintptr_t>(v)) {}
 
   template <typename S>
@@ -359,7 +359,7 @@ class AlphaNum {
           ABSL_ATTRIBUTE_LIFETIME_BOUND)
       : piece_(&buf.data[0], buf.size) {}
 
-  AlphaNum(absl::Nullable<const char*> c_str  // NOLINT(runtime/explicit)
+  AlphaNum(const char* absl_nullable c_str  // NOLINT(runtime/explicit)
                ABSL_ATTRIBUTE_LIFETIME_BOUND)
       : piece_(NullSafeStringView(c_str)) {}
   AlphaNum(absl::string_view pc  // NOLINT(runtime/explicit)
@@ -392,7 +392,7 @@ class AlphaNum {
   AlphaNum& operator=(const AlphaNum&) = delete;
 
   absl::string_view::size_type size() const { return piece_.size(); }
-  absl::Nullable<const char*> data() const { return piece_.data(); }
+  const char* absl_nullable data() const { return piece_.data(); }
   absl::string_view Piece() const { return piece_; }
 
   // Match unscoped enums.  Use integral promotion so that a `char`-backed
@@ -462,7 +462,7 @@ namespace strings_internal {
 
 // Do not call directly - this is not part of the public API.
 std::string CatPieces(std::initializer_list<absl::string_view> pieces);
-void AppendPieces(absl::Nonnull<std::string*> dest,
+void AppendPieces(std::string* absl_nonnull dest,
                   std::initializer_list<absl::string_view> pieces);
 
 template <typename Integer>
@@ -592,18 +592,18 @@ template <typename... AV>
 //   absl::string_view p = s;
 //   StrAppend(&s, p);
 
-inline void StrAppend(absl::Nonnull<std::string*>) {}
-void StrAppend(absl::Nonnull<std::string*> dest, const AlphaNum& a);
-void StrAppend(absl::Nonnull<std::string*> dest, const AlphaNum& a,
+inline void StrAppend(std::string* absl_nonnull) {}
+void StrAppend(std::string* absl_nonnull dest, const AlphaNum& a);
+void StrAppend(std::string* absl_nonnull dest, const AlphaNum& a,
                const AlphaNum& b);
-void StrAppend(absl::Nonnull<std::string*> dest, const AlphaNum& a,
+void StrAppend(std::string* absl_nonnull dest, const AlphaNum& a,
                const AlphaNum& b, const AlphaNum& c);
-void StrAppend(absl::Nonnull<std::string*> dest, const AlphaNum& a,
+void StrAppend(std::string* absl_nonnull dest, const AlphaNum& a,
                const AlphaNum& b, const AlphaNum& c, const AlphaNum& d);
 
 // Support 5 or more arguments
 template <typename... AV>
-inline void StrAppend(absl::Nonnull<std::string*> dest, const AlphaNum& a,
+inline void StrAppend(std::string* absl_nonnull dest, const AlphaNum& a,
                       const AlphaNum& b, const AlphaNum& c, const AlphaNum& d,
                       const AlphaNum& e, const AV&... args) {
   strings_internal::AppendPieces(
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/str_format.h b/deps/v8/third_party/abseil-cpp/absl/strings/str_format.h
index fc3d3e92ea7cd2..ffa7f113be049b 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/str_format.h
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/str_format.h
@@ -112,7 +112,7 @@ class UntypedFormatSpec {
 
  protected:
   explicit UntypedFormatSpec(
-      absl::Nonnull<const str_format_internal::ParsedFormatBase*> pc)
+      const str_format_internal::ParsedFormatBase* absl_nonnull pc)
       : spec_(pc) {}
 
  private:
@@ -152,7 +152,7 @@ str_format_internal::StreamedWrapper<T> FormatStreamed(const T& v) {
 //   EXPECT_EQ(8, n);
 class FormatCountCapture {
  public:
-  explicit FormatCountCapture(absl::Nonnull<int*> p) : p_(p) {}
+  explicit FormatCountCapture(int* absl_nonnull p) : p_(p) {}
 
  private:
   // FormatCountCaptureHelper is used to define FormatConvertImpl() for this
@@ -161,8 +161,8 @@ class FormatCountCapture {
   // Unused() is here because of the false positive from -Wunused-private-field
   // p_ is used in the templated function of the friend FormatCountCaptureHelper
   // class.
-  absl::Nonnull<int*> Unused() { return p_; }
-  absl::Nonnull<int*> p_;
+  int* absl_nonnull Unused() { return p_; }
+  int* absl_nonnull p_;
 };
 
 // FormatSpec
@@ -377,7 +377,7 @@ template <typename... Args>
 //   std::string orig("For example PI is approximately ");
 //   std::cout << StrAppendFormat(&orig, "%12.6f", 3.14);
 template <typename... Args>
-std::string& StrAppendFormat(absl::Nonnull<std::string*> dst,
+std::string& StrAppendFormat(std::string* absl_nonnull dst,
                              const FormatSpec<Args...>& format,
                              const Args&... args) {
   return str_format_internal::AppendPack(
@@ -437,7 +437,7 @@ int PrintF(const FormatSpec<Args...>& format, const Args&... args) {
 //   Outputs: "The capital of Mongolia is Ulaanbaatar"
 //
 template <typename... Args>
-int FPrintF(absl::Nonnull<std::FILE*> output, const FormatSpec<Args...>& format,
+int FPrintF(std::FILE* absl_nonnull output, const FormatSpec<Args...>& format,
             const Args&... args) {
   return str_format_internal::FprintF(
       output, str_format_internal::UntypedFormatSpecImpl::Extract(format),
@@ -466,7 +466,7 @@ int FPrintF(absl::Nonnull<std::FILE*> output, const FormatSpec<Args...>& format,
 //   Post-condition: output == "The capital of Mongolia is Ulaanbaatar"
 //
 template <typename... Args>
-int SNPrintF(absl::Nonnull<char*> output, std::size_t size,
+int SNPrintF(char* absl_nonnull output, std::size_t size,
              const FormatSpec<Args...>& format, const Args&... args) {
   return str_format_internal::SnprintF(
       output, size, str_format_internal::UntypedFormatSpecImpl::Extract(format),
@@ -500,7 +500,7 @@ class FormatRawSink {
   template <typename T,
             typename = typename std::enable_if<std::is_constructible<
                 str_format_internal::FormatRawSinkImpl, T*>::value>::type>
-  FormatRawSink(absl::Nonnull<T*> raw)  // NOLINT
+  FormatRawSink(T* absl_nonnull raw)  // NOLINT
       : sink_(raw) {}
 
  private:
@@ -609,7 +609,7 @@ using FormatArg = str_format_internal::FormatArgImpl;
 //
 // Note that unlike with AbslFormatConvert(), AbslStringify() does not allow
 // customization of allowed conversion characters. AbslStringify() uses `%v` as
-// the underlying conversion specififer. Additionally, AbslStringify() supports
+// the underlying conversion specifier. Additionally, AbslStringify() supports
 // use with absl::StrCat while AbslFormatConvert() does not.
 //
 // Example:
@@ -857,16 +857,16 @@ class FormatSink {
   }
 
   // Support `absl::Format(&sink, format, args...)`.
-  friend void AbslFormatFlush(absl::Nonnull<FormatSink*> sink,
+  friend void AbslFormatFlush(FormatSink* absl_nonnull sink,
                               absl::string_view v) {
     sink->Append(v);
   }
 
  private:
   friend str_format_internal::FormatSinkImpl;
-  explicit FormatSink(absl::Nonnull<str_format_internal::FormatSinkImpl*> s)
+  explicit FormatSink(str_format_internal::FormatSinkImpl* absl_nonnull s)
       : sink_(s) {}
-  absl::Nonnull<str_format_internal::FormatSinkImpl*> sink_;
+  str_format_internal::FormatSinkImpl* absl_nonnull sink_;
 };
 
 // FormatConvertResult
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/str_replace.cc b/deps/v8/third_party/abseil-cpp/absl/strings/str_replace.cc
index a7ab52fed5a55b..377e30cfd738ba 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/str_replace.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/str_replace.cc
@@ -37,8 +37,8 @@ using FixedMapping =
 // occurred.
 int ApplySubstitutions(
     absl::string_view s,
-    absl::Nonnull<std::vector<strings_internal::ViableSubstitution>*> subs_ptr,
-    absl::Nonnull<std::string*> result_ptr) {
+    std::vector<strings_internal::ViableSubstitution>* absl_nonnull subs_ptr,
+    std::string* absl_nonnull result_ptr) {
   auto& subs = *subs_ptr;
   int substitutions = 0;
   size_t pos = 0;
@@ -83,7 +83,7 @@ std::string StrReplaceAll(absl::string_view s,
 }
 
 int StrReplaceAll(strings_internal::FixedMapping replacements,
-                  absl::Nonnull<std::string*> target) {
+                  std::string* absl_nonnull target) {
   return StrReplaceAll<strings_internal::FixedMapping>(replacements, target);
 }
 
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/str_replace.h b/deps/v8/third_party/abseil-cpp/absl/strings/str_replace.h
index d74feac0aa0ce3..91b920bcaaea8d 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/str_replace.h
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/str_replace.h
@@ -114,7 +114,7 @@ std::string StrReplaceAll(absl::string_view s,
 int StrReplaceAll(
     std::initializer_list<std::pair<absl::string_view, absl::string_view>>
         replacements,
-    absl::Nonnull<std::string*> target);
+    std::string* absl_nonnull target);
 
 // Overload of `StrReplaceAll()` to replace patterns within a given output
 // string *in place* with replacements provided within a container of key/value
@@ -130,7 +130,7 @@ int StrReplaceAll(
 //  EXPECT_EQ("if (ptr &lt; &amp;foo)", s);
 template <typename StrToStrMapping>
 int StrReplaceAll(const StrToStrMapping& replacements,
-                  absl::Nonnull<std::string*> target);
+                  std::string* absl_nonnull target);
 
 // Implementation details only, past this point.
 namespace strings_internal {
@@ -187,8 +187,8 @@ std::vector<ViableSubstitution> FindSubstitutions(
 }
 
 int ApplySubstitutions(absl::string_view s,
-                       absl::Nonnull<std::vector<ViableSubstitution>*> subs_ptr,
-                       absl::Nonnull<std::string*> result_ptr);
+                       std::vector<ViableSubstitution>* absl_nonnull subs_ptr,
+                       std::string* absl_nonnull result_ptr);
 
 }  // namespace strings_internal
 
@@ -204,7 +204,7 @@ std::string StrReplaceAll(absl::string_view s,
 
 template <typename StrToStrMapping>
 int StrReplaceAll(const StrToStrMapping& replacements,
-                  absl::Nonnull<std::string*> target) {
+                  std::string* absl_nonnull target) {
   auto subs = strings_internal::FindSubstitutions(*target, replacements);
   if (subs.empty()) return 0;
 
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/string_view.cc b/deps/v8/third_party/abseil-cpp/absl/strings/string_view.cc
index dc2951cfaafbbb..33bd1bbce383ac 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/string_view.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/string_view.cc
@@ -30,10 +30,10 @@ namespace {
 
 // This is significantly faster for case-sensitive matches with very
 // few possible matches.
-absl::Nullable<const char*> memmatch(absl::Nullable<const char*> phaystack,
-                                     size_t haylen,
-                                     absl::Nullable<const char*> pneedle,
-                                     size_t neelen) {
+const char* absl_nullable memmatch(const char* absl_nullable phaystack,
+                                   size_t haylen,
+                                   const char* absl_nullable pneedle,
+                                   size_t neelen) {
   if (0 == neelen) {
     return phaystack;  // even if haylen is 0
   }
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/string_view.h b/deps/v8/third_party/abseil-cpp/absl/strings/string_view.h
index b05c036b0cc006..9a1933b611b320 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/string_view.h
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/string_view.h
@@ -163,11 +163,11 @@ class ABSL_ATTRIBUTE_VIEW string_view {
  public:
   using traits_type = std::char_traits<char>;
   using value_type = char;
-  using pointer = absl::Nullable<char*>;
-  using const_pointer = absl::Nullable<const char*>;
+  using pointer = char* absl_nullable;
+  using const_pointer = const char* absl_nullable;
   using reference = char&;
   using const_reference = const char&;
-  using const_iterator = absl::Nullable<const char*>;
+  using const_iterator = const char* absl_nullable;
   using iterator = const_iterator;
   using const_reverse_iterator = std::reverse_iterator<const_iterator>;
   using reverse_iterator = const_reverse_iterator;
@@ -197,11 +197,11 @@ class ABSL_ATTRIBUTE_VIEW string_view {
   // instead (see below).
   // The length check is skipped since it is unnecessary and causes code bloat.
   constexpr string_view(  // NOLINT(runtime/explicit)
-      absl::Nonnull<const char*> str)
+      const char* absl_nonnull str)
       : ptr_(str), length_(str ? StrlenInternal(str) : 0) {}
 
   // Constructor of a `string_view` from a `const char*` and length.
-  constexpr string_view(absl::Nullable<const char*> data, size_type len)
+  constexpr string_view(const char* absl_nullable data, size_type len)
       : ptr_(data), length_(CheckLengthInternal(len)) {}
 
   constexpr string_view(const string_view&) noexcept = default;
@@ -430,21 +430,21 @@ class ABSL_ATTRIBUTE_VIEW string_view {
 
   // Overload of `string_view::compare()` for comparing a `string_view` and a
   // a different C-style string `s`.
-  constexpr int compare(absl::Nonnull<const char*> s) const {
+  constexpr int compare(const char* absl_nonnull s) const {
     return compare(string_view(s));
   }
 
   // Overload of `string_view::compare()` for comparing a substring of the
   // `string_view` and a different string C-style string `s`.
   constexpr int compare(size_type pos1, size_type count1,
-                        absl::Nonnull<const char*> s) const {
+                        const char* absl_nonnull s) const {
     return substr(pos1, count1).compare(string_view(s));
   }
 
   // Overload of `string_view::compare()` for comparing a substring of the
   // `string_view` and a substring of a different C-style string `s`.
   constexpr int compare(size_type pos1, size_type count1,
-                        absl::Nonnull<const char*> s, size_type count2) const {
+                        const char* absl_nonnull s, size_type count2) const {
     return substr(pos1, count1).compare(string_view(s, count2));
   }
 
@@ -463,14 +463,14 @@ class ABSL_ATTRIBUTE_VIEW string_view {
 
   // Overload of `string_view::find()` for finding a substring of a different
   // C-style string `s` within the `string_view`.
-  size_type find(absl::Nonnull<const char*> s, size_type pos,
+  size_type find(const char* absl_nonnull s, size_type pos,
                  size_type count) const {
     return find(string_view(s, count), pos);
   }
 
   // Overload of `string_view::find()` for finding a different C-style string
   // `s` within the `string_view`.
-  size_type find(absl::Nonnull<const char *> s, size_type pos = 0) const {
+  size_type find(const char* absl_nonnull s, size_type pos = 0) const {
     return find(string_view(s), pos);
   }
 
@@ -487,14 +487,14 @@ class ABSL_ATTRIBUTE_VIEW string_view {
 
   // Overload of `string_view::rfind()` for finding a substring of a different
   // C-style string `s` within the `string_view`.
-  size_type rfind(absl::Nonnull<const char*> s, size_type pos,
+  size_type rfind(const char* absl_nonnull s, size_type pos,
                   size_type count) const {
     return rfind(string_view(s, count), pos);
   }
 
   // Overload of `string_view::rfind()` for finding a different C-style string
   // `s` within the `string_view`.
-  size_type rfind(absl::Nonnull<const char*> s, size_type pos = npos) const {
+  size_type rfind(const char* absl_nonnull s, size_type pos = npos) const {
     return rfind(string_view(s), pos);
   }
 
@@ -513,15 +513,14 @@ class ABSL_ATTRIBUTE_VIEW string_view {
 
   // Overload of `string_view::find_first_of()` for finding a substring of a
   // different C-style string `s` within the `string_view`.
-  size_type find_first_of(absl::Nonnull<const char*> s, size_type pos,
+  size_type find_first_of(const char* absl_nonnull s, size_type pos,
                           size_type count) const {
     return find_first_of(string_view(s, count), pos);
   }
 
   // Overload of `string_view::find_first_of()` for finding a different C-style
   // string `s` within the `string_view`.
-  size_type find_first_of(absl::Nonnull<const char*> s,
-                          size_type pos = 0) const {
+  size_type find_first_of(const char* absl_nonnull s, size_type pos = 0) const {
     return find_first_of(string_view(s), pos);
   }
 
@@ -540,14 +539,14 @@ class ABSL_ATTRIBUTE_VIEW string_view {
 
   // Overload of `string_view::find_last_of()` for finding a substring of a
   // different C-style string `s` within the `string_view`.
-  size_type find_last_of(absl::Nonnull<const char*> s, size_type pos,
+  size_type find_last_of(const char* absl_nonnull s, size_type pos,
                          size_type count) const {
     return find_last_of(string_view(s, count), pos);
   }
 
   // Overload of `string_view::find_last_of()` for finding a different C-style
   // string `s` within the `string_view`.
-  size_type find_last_of(absl::Nonnull<const char*> s,
+  size_type find_last_of(const char* absl_nonnull s,
                          size_type pos = npos) const {
     return find_last_of(string_view(s), pos);
   }
@@ -565,14 +564,14 @@ class ABSL_ATTRIBUTE_VIEW string_view {
 
   // Overload of `string_view::find_first_not_of()` for finding a substring of a
   // different C-style string `s` within the `string_view`.
-  size_type find_first_not_of(absl::Nonnull<const char*> s, size_type pos,
+  size_type find_first_not_of(const char* absl_nonnull s, size_type pos,
                               size_type count) const {
     return find_first_not_of(string_view(s, count), pos);
   }
 
   // Overload of `string_view::find_first_not_of()` for finding a different
   // C-style string `s` within the `string_view`.
-  size_type find_first_not_of(absl::Nonnull<const char*> s,
+  size_type find_first_not_of(const char* absl_nonnull s,
                               size_type pos = 0) const {
     return find_first_not_of(string_view(s), pos);
   }
@@ -591,14 +590,14 @@ class ABSL_ATTRIBUTE_VIEW string_view {
 
   // Overload of `string_view::find_last_not_of()` for finding a substring of a
   // different C-style string `s` within the `string_view`.
-  size_type find_last_not_of(absl::Nonnull<const char*> s, size_type pos,
+  size_type find_last_not_of(const char* absl_nonnull s, size_type pos,
                              size_type count) const {
     return find_last_not_of(string_view(s, count), pos);
   }
 
   // Overload of `string_view::find_last_not_of()` for finding a different
   // C-style string `s` within the `string_view`.
-  size_type find_last_not_of(absl::Nonnull<const char*> s,
+  size_type find_last_not_of(const char* absl_nonnull s,
                              size_type pos = npos) const {
     return find_last_not_of(string_view(s), pos);
   }
@@ -659,7 +658,7 @@ class ABSL_ATTRIBUTE_VIEW string_view {
   // The constructor from std::string delegates to this constructor.
   // See the comment on that constructor for the rationale.
   struct SkipCheckLengthTag {};
-  string_view(absl::Nullable<const char*> data, size_type len,
+  string_view(const char* absl_nullable data, size_type len,
               SkipCheckLengthTag) noexcept
       : ptr_(data), length_(len) {}
 
@@ -671,7 +670,7 @@ class ABSL_ATTRIBUTE_VIEW string_view {
     return len;
   }
 
-  static constexpr size_type StrlenInternal(absl::Nonnull<const char*> str) {
+  static constexpr size_type StrlenInternal(const char* absl_nonnull str) {
 #if defined(_MSC_VER) && !defined(__clang__)
     // MSVC 2017+ can evaluate this at compile-time.
     const char* begin = str;
@@ -696,7 +695,7 @@ class ABSL_ATTRIBUTE_VIEW string_view {
                                : (compare_result < 0 ? -1 : 1);
   }
 
-  absl::Nullable<const char*> ptr_;
+  const char* absl_nullable ptr_;
   size_type length_;
 };
 
@@ -757,7 +756,7 @@ inline string_view ClippedSubstr(string_view s, size_t pos,
 // Creates an `absl::string_view` from a pointer `p` even if it's null-valued.
 // This function should be used where an `absl::string_view` can be created from
 // a possibly-null pointer.
-constexpr string_view NullSafeStringView(absl::Nullable<const char*> p) {
+constexpr string_view NullSafeStringView(const char* absl_nullable p) {
   return p ? string_view(p) : string_view();
 }
 
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/strip.h b/deps/v8/third_party/abseil-cpp/absl/strings/strip.h
index 2d5faf608101c9..55398ffe8891d4 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/strip.h
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/strip.h
@@ -45,7 +45,7 @@ ABSL_NAMESPACE_BEGIN
 //   absl::string_view input("abc");
 //   EXPECT_TRUE(absl::ConsumePrefix(&input, "a"));
 //   EXPECT_EQ(input, "bc");
-inline constexpr bool ConsumePrefix(absl::Nonnull<absl::string_view*> str,
+inline constexpr bool ConsumePrefix(absl::string_view* absl_nonnull str,
                                     absl::string_view expected) {
   if (!absl::StartsWith(*str, expected)) return false;
   str->remove_prefix(expected.size());
@@ -62,7 +62,7 @@ inline constexpr bool ConsumePrefix(absl::Nonnull<absl::string_view*> str,
 //   absl::string_view input("abcdef");
 //   EXPECT_TRUE(absl::ConsumeSuffix(&input, "def"));
 //   EXPECT_EQ(input, "abc");
-inline constexpr bool ConsumeSuffix(absl::Nonnull<absl::string_view*> str,
+inline constexpr bool ConsumeSuffix(absl::string_view* absl_nonnull str,
                                     absl::string_view expected) {
   if (!absl::EndsWith(*str, expected)) return false;
   str->remove_suffix(expected.size());
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/substitute.cc b/deps/v8/third_party/abseil-cpp/absl/strings/substitute.cc
index a71f565a1209c7..3c2ca5d2a88935 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/substitute.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/substitute.cc
@@ -35,9 +35,10 @@ namespace absl {
 ABSL_NAMESPACE_BEGIN
 namespace substitute_internal {
 
-void SubstituteAndAppendArray(
-    absl::Nonnull<std::string*> output, absl::string_view format,
-    absl::Nullable<const absl::string_view*> args_array, size_t num_args) {
+void SubstituteAndAppendArray(std::string* absl_nonnull output,
+                              absl::string_view format,
+                              const absl::string_view* absl_nullable args_array,
+                              size_t num_args) {
   // Determine total size needed.
   size_t size = 0;
   for (size_t i = 0; i < format.size(); i++) {
@@ -109,7 +110,7 @@ void SubstituteAndAppendArray(
   assert(target == output->data() + output->size());
 }
 
-Arg::Arg(absl::Nullable<const void*> value) {
+Arg::Arg(const void* absl_nullable value) {
   static_assert(sizeof(scratch_) >= sizeof(value) * 2 + 2,
                 "fix sizeof(scratch_)");
   if (value == nullptr) {
diff --git a/deps/v8/third_party/abseil-cpp/absl/strings/substitute.h b/deps/v8/third_party/abseil-cpp/absl/strings/substitute.h
index e9c4b6e828c13f..08f64e99164d8b 100644
--- a/deps/v8/third_party/abseil-cpp/absl/strings/substitute.h
+++ b/deps/v8/third_party/abseil-cpp/absl/strings/substitute.h
@@ -106,7 +106,7 @@ class Arg {
   // Overloads for string-y things
   //
   // Explicitly overload `const char*` so the compiler doesn't cast to `bool`.
-  Arg(absl::Nullable<const char*> value)  // NOLINT(google-explicit-constructor)
+  Arg(const char* absl_nullable value)  // NOLINT(google-explicit-constructor)
       : piece_(absl::NullSafeStringView(value)) {}
   template <typename Allocator>
   Arg(  // NOLINT
@@ -199,7 +199,7 @@ class Arg {
   // `void*` values, with the exception of `char*`, are printed as
   // "0x<hex value>". However, in the case of `nullptr`, "NULL" is printed.
   Arg(  // NOLINT(google-explicit-constructor)
-      absl::Nullable<const void*> value);
+      const void* absl_nullable value);
 
   // Normal enums are already handled by the integer formatters.
   // This overload matches only scoped enums.
@@ -222,12 +222,13 @@ class Arg {
 
 // Internal helper function. Don't call this from outside this implementation.
 // This interface may change without notice.
-void SubstituteAndAppendArray(
-    absl::Nonnull<std::string*> output, absl::string_view format,
-    absl::Nullable<const absl::string_view*> args_array, size_t num_args);
+void SubstituteAndAppendArray(std::string* absl_nonnull output,
+                              absl::string_view format,
+                              const absl::string_view* absl_nullable args_array,
+                              size_t num_args);
 
 #if defined(ABSL_BAD_CALL_IF)
-constexpr int CalculateOneBit(absl::Nonnull<const char*> format) {
+constexpr int CalculateOneBit(const char* absl_nonnull format) {
   // Returns:
   // * 2^N for '$N' when N is in [0-9]
   // * 0 for correct '$' escaping: '$$'.
@@ -236,11 +237,11 @@ constexpr int CalculateOneBit(absl::Nonnull<const char*> format) {
                                           : (1 << (*format - '0'));
 }
 
-constexpr const char* SkipNumber(absl::Nonnull<const char*> format) {
+constexpr const char* SkipNumber(const char* absl_nonnull format) {
   return !*format ? format : (format + 1);
 }
 
-constexpr int PlaceholderBitmask(absl::Nonnull<const char*> format) {
+constexpr int PlaceholderBitmask(const char* absl_nonnull format) {
   return !*format
              ? 0
              : *format != '$' ? PlaceholderBitmask(format + 1)
@@ -273,12 +274,12 @@ constexpr int PlaceholderBitmask(absl::Nonnull<const char*> format) {
 //    absl::SubstituteAndAppend(boilerplate, format, args...);
 //  }
 //
-inline void SubstituteAndAppend(absl::Nonnull<std::string*> output,
+inline void SubstituteAndAppend(std::string* absl_nonnull output,
                                 absl::string_view format) {
   substitute_internal::SubstituteAndAppendArray(output, format, nullptr, 0);
 }
 
-inline void SubstituteAndAppend(absl::Nonnull<std::string*> output,
+inline void SubstituteAndAppend(std::string* absl_nonnull output,
                                 absl::string_view format,
                                 const substitute_internal::Arg& a0) {
   const absl::string_view args[] = {a0.piece()};
@@ -286,7 +287,7 @@ inline void SubstituteAndAppend(absl::Nonnull<std::string*> output,
                                                 ABSL_ARRAYSIZE(args));
 }
 
-inline void SubstituteAndAppend(absl::Nonnull<std::string*> output,
+inline void SubstituteAndAppend(std::string* absl_nonnull output,
                                 absl::string_view format,
                                 const substitute_internal::Arg& a0,
                                 const substitute_internal::Arg& a1) {
@@ -295,7 +296,7 @@ inline void SubstituteAndAppend(absl::Nonnull<std::string*> output,
                                                 ABSL_ARRAYSIZE(args));
 }
 
-inline void SubstituteAndAppend(absl::Nonnull<std::string*> output,
+inline void SubstituteAndAppend(std::string* absl_nonnull output,
                                 absl::string_view format,
                                 const substitute_internal::Arg& a0,
                                 const substitute_internal::Arg& a1,
@@ -305,7 +306,7 @@ inline void SubstituteAndAppend(absl::Nonnull<std::string*> output,
                                                 ABSL_ARRAYSIZE(args));
 }
 
-inline void SubstituteAndAppend(absl::Nonnull<std::string*> output,
+inline void SubstituteAndAppend(std::string* absl_nonnull output,
                                 absl::string_view format,
                                 const substitute_internal::Arg& a0,
                                 const substitute_internal::Arg& a1,
@@ -317,7 +318,7 @@ inline void SubstituteAndAppend(absl::Nonnull<std::string*> output,
                                                 ABSL_ARRAYSIZE(args));
 }
 
-inline void SubstituteAndAppend(absl::Nonnull<std::string*> output,
+inline void SubstituteAndAppend(std::string* absl_nonnull output,
                                 absl::string_view format,
                                 const substitute_internal::Arg& a0,
                                 const substitute_internal::Arg& a1,
@@ -331,7 +332,7 @@ inline void SubstituteAndAppend(absl::Nonnull<std::string*> output,
 }
 
 inline void SubstituteAndAppend(
-    absl::Nonnull<std::string*> output, absl::string_view format,
+    std::string* absl_nonnull output, absl::string_view format,
     const substitute_internal::Arg& a0, const substitute_internal::Arg& a1,
     const substitute_internal::Arg& a2, const substitute_internal::Arg& a3,
     const substitute_internal::Arg& a4, const substitute_internal::Arg& a5) {
@@ -342,7 +343,7 @@ inline void SubstituteAndAppend(
 }
 
 inline void SubstituteAndAppend(
-    absl::Nonnull<std::string*> output, absl::string_view format,
+    std::string* absl_nonnull output, absl::string_view format,
     const substitute_internal::Arg& a0, const substitute_internal::Arg& a1,
     const substitute_internal::Arg& a2, const substitute_internal::Arg& a3,
     const substitute_internal::Arg& a4, const substitute_internal::Arg& a5,
@@ -355,7 +356,7 @@ inline void SubstituteAndAppend(
 }
 
 inline void SubstituteAndAppend(
-    absl::Nonnull<std::string*> output, absl::string_view format,
+    std::string* absl_nonnull output, absl::string_view format,
     const substitute_internal::Arg& a0, const substitute_internal::Arg& a1,
     const substitute_internal::Arg& a2, const substitute_internal::Arg& a3,
     const substitute_internal::Arg& a4, const substitute_internal::Arg& a5,
@@ -368,7 +369,7 @@ inline void SubstituteAndAppend(
 }
 
 inline void SubstituteAndAppend(
-    absl::Nonnull<std::string*> output, absl::string_view format,
+    std::string* absl_nonnull output, absl::string_view format,
     const substitute_internal::Arg& a0, const substitute_internal::Arg& a1,
     const substitute_internal::Arg& a2, const substitute_internal::Arg& a3,
     const substitute_internal::Arg& a4, const substitute_internal::Arg& a5,
@@ -382,7 +383,7 @@ inline void SubstituteAndAppend(
 }
 
 inline void SubstituteAndAppend(
-    absl::Nonnull<std::string*> output, absl::string_view format,
+    std::string* absl_nonnull output, absl::string_view format,
     const substitute_internal::Arg& a0, const substitute_internal::Arg& a1,
     const substitute_internal::Arg& a2, const substitute_internal::Arg& a3,
     const substitute_internal::Arg& a4, const substitute_internal::Arg& a5,
@@ -398,16 +399,16 @@ inline void SubstituteAndAppend(
 #if defined(ABSL_BAD_CALL_IF)
 // This body of functions catches cases where the number of placeholders
 // doesn't match the number of data arguments.
-void SubstituteAndAppend(absl::Nonnull<std::string*> output,
-                         absl::Nonnull<const char*> format)
+void SubstituteAndAppend(std::string* absl_nonnull output,
+                         const char* absl_nonnull format)
     ABSL_BAD_CALL_IF(
         substitute_internal::PlaceholderBitmask(format) != 0,
         "There were no substitution arguments "
         "but this format string either has a $[0-9] in it or contains "
         "an unescaped $ character (use $$ instead)");
 
-void SubstituteAndAppend(absl::Nonnull<std::string*> output,
-                         absl::Nonnull<const char*> format,
+void SubstituteAndAppend(std::string* absl_nonnull output,
+                         const char* absl_nonnull format,
                          const substitute_internal::Arg& a0)
     ABSL_BAD_CALL_IF(substitute_internal::PlaceholderBitmask(format) != 1,
                      "There was 1 substitution argument given, but "
@@ -415,8 +416,8 @@ void SubstituteAndAppend(absl::Nonnull<std::string*> output,
                      "one of $1-$9, or contains an unescaped $ character (use "
                      "$$ instead)");
 
-void SubstituteAndAppend(absl::Nonnull<std::string*> output,
-                         absl::Nonnull<const char*> format,
+void SubstituteAndAppend(std::string* absl_nonnull output,
+                         const char* absl_nonnull format,
                          const substitute_internal::Arg& a0,
                          const substitute_internal::Arg& a1)
     ABSL_BAD_CALL_IF(
@@ -425,8 +426,8 @@ void SubstituteAndAppend(absl::Nonnull<std::string*> output,
         "missing its $0/$1, contains one of $2-$9, or contains an "
         "unescaped $ character (use $$ instead)");
 
-void SubstituteAndAppend(absl::Nonnull<std::string*> output,
-                         absl::Nonnull<const char*> format,
+void SubstituteAndAppend(std::string* absl_nonnull output,
+                         const char* absl_nonnull format,
                          const substitute_internal::Arg& a0,
                          const substitute_internal::Arg& a1,
                          const substitute_internal::Arg& a2)
@@ -436,8 +437,8 @@ void SubstituteAndAppend(absl::Nonnull<std::string*> output,
         "this format string is missing its $0/$1/$2, contains one of "
         "$3-$9, or contains an unescaped $ character (use $$ instead)");
 
-void SubstituteAndAppend(absl::Nonnull<std::string*> output,
-                         absl::Nonnull<const char*> format,
+void SubstituteAndAppend(std::string* absl_nonnull output,
+                         const char* absl_nonnull format,
                          const substitute_internal::Arg& a0,
                          const substitute_internal::Arg& a1,
                          const substitute_internal::Arg& a2,
@@ -448,8 +449,8 @@ void SubstituteAndAppend(absl::Nonnull<std::string*> output,
         "this format string is missing its $0-$3, contains one of "
         "$4-$9, or contains an unescaped $ character (use $$ instead)");
 
-void SubstituteAndAppend(absl::Nonnull<std::string*> output,
-                         absl::Nonnull<const char*> format,
+void SubstituteAndAppend(std::string* absl_nonnull output,
+                         const char* absl_nonnull format,
                          const substitute_internal::Arg& a0,
                          const substitute_internal::Arg& a1,
                          const substitute_internal::Arg& a2,
@@ -462,7 +463,7 @@ void SubstituteAndAppend(absl::Nonnull<std::string*> output,
         "$5-$9, or contains an unescaped $ character (use $$ instead)");
 
 void SubstituteAndAppend(
-    absl::Nonnull<std::string*> output, absl::Nonnull<const char*> format,
+    std::string* absl_nonnull output, const char* absl_nonnull format,
     const substitute_internal::Arg& a0, const substitute_internal::Arg& a1,
     const substitute_internal::Arg& a2, const substitute_internal::Arg& a3,
     const substitute_internal::Arg& a4, const substitute_internal::Arg& a5)
@@ -473,7 +474,7 @@ void SubstituteAndAppend(
         "$6-$9, or contains an unescaped $ character (use $$ instead)");
 
 void SubstituteAndAppend(
-    absl::Nonnull<std::string*> output, absl::Nonnull<const char*> format,
+    std::string* absl_nonnull output, const char* absl_nonnull format,
     const substitute_internal::Arg& a0, const substitute_internal::Arg& a1,
     const substitute_internal::Arg& a2, const substitute_internal::Arg& a3,
     const substitute_internal::Arg& a4, const substitute_internal::Arg& a5,
@@ -485,7 +486,7 @@ void SubstituteAndAppend(
         "$7-$9, or contains an unescaped $ character (use $$ instead)");
 
 void SubstituteAndAppend(
-    absl::Nonnull<std::string*> output, absl::Nonnull<const char*> format,
+    std::string* absl_nonnull output, const char* absl_nonnull format,
     const substitute_internal::Arg& a0, const substitute_internal::Arg& a1,
     const substitute_internal::Arg& a2, const substitute_internal::Arg& a3,
     const substitute_internal::Arg& a4, const substitute_internal::Arg& a5,
@@ -497,7 +498,7 @@ void SubstituteAndAppend(
         "$8-$9, or contains an unescaped $ character (use $$ instead)");
 
 void SubstituteAndAppend(
-    absl::Nonnull<std::string*> output, absl::Nonnull<const char*> format,
+    std::string* absl_nonnull output, const char* absl_nonnull format,
     const substitute_internal::Arg& a0, const substitute_internal::Arg& a1,
     const substitute_internal::Arg& a2, const substitute_internal::Arg& a3,
     const substitute_internal::Arg& a4, const substitute_internal::Arg& a5,
@@ -510,7 +511,7 @@ void SubstituteAndAppend(
         "contains an unescaped $ character (use $$ instead)");
 
 void SubstituteAndAppend(
-    absl::Nonnull<std::string*> output, absl::Nonnull<const char*> format,
+    std::string* absl_nonnull output, const char* absl_nonnull format,
     const substitute_internal::Arg& a0, const substitute_internal::Arg& a1,
     const substitute_internal::Arg& a2, const substitute_internal::Arg& a3,
     const substitute_internal::Arg& a4, const substitute_internal::Arg& a5,
@@ -643,13 +644,13 @@ void SubstituteAndAppend(
 #if defined(ABSL_BAD_CALL_IF)
 // This body of functions catches cases where the number of placeholders
 // doesn't match the number of data arguments.
-std::string Substitute(absl::Nonnull<const char*> format)
+std::string Substitute(const char* absl_nonnull format)
     ABSL_BAD_CALL_IF(substitute_internal::PlaceholderBitmask(format) != 0,
                      "There were no substitution arguments "
                      "but this format string either has a $[0-9] in it or "
                      "contains an unescaped $ character (use $$ instead)");
 
-std::string Substitute(absl::Nonnull<const char*> format,
+std::string Substitute(const char* absl_nonnull format,
                        const substitute_internal::Arg& a0)
     ABSL_BAD_CALL_IF(
         substitute_internal::PlaceholderBitmask(format) != 1,
@@ -657,7 +658,7 @@ std::string Substitute(absl::Nonnull<const char*> format,
         "this format string is missing its $0, contains one of $1-$9, "
         "or contains an unescaped $ character (use $$ instead)");
 
-std::string Substitute(absl::Nonnull<const char*> format,
+std::string Substitute(const char* absl_nonnull format,
                        const substitute_internal::Arg& a0,
                        const substitute_internal::Arg& a1)
     ABSL_BAD_CALL_IF(
@@ -666,7 +667,7 @@ std::string Substitute(absl::Nonnull<const char*> format,
         "this format string is missing its $0/$1, contains one of "
         "$2-$9, or contains an unescaped $ character (use $$ instead)");
 
-std::string Substitute(absl::Nonnull<const char*> format,
+std::string Substitute(const char* absl_nonnull format,
                        const substitute_internal::Arg& a0,
                        const substitute_internal::Arg& a1,
                        const substitute_internal::Arg& a2)
@@ -676,7 +677,7 @@ std::string Substitute(absl::Nonnull<const char*> format,
         "this format string is missing its $0/$1/$2, contains one of "
         "$3-$9, or contains an unescaped $ character (use $$ instead)");
 
-std::string Substitute(absl::Nonnull<const char*> format,
+std::string Substitute(const char* absl_nonnull format,
                        const substitute_internal::Arg& a0,
                        const substitute_internal::Arg& a1,
                        const substitute_internal::Arg& a2,
@@ -687,7 +688,7 @@ std::string Substitute(absl::Nonnull<const char*> format,
         "this format string is missing its $0-$3, contains one of "
         "$4-$9, or contains an unescaped $ character (use $$ instead)");
 
-std::string Substitute(absl::Nonnull<const char*> format,
+std::string Substitute(const char* absl_nonnull format,
                        const substitute_internal::Arg& a0,
                        const substitute_internal::Arg& a1,
                        const substitute_internal::Arg& a2,
@@ -699,7 +700,7 @@ std::string Substitute(absl::Nonnull<const char*> format,
         "this format string is missing its $0-$4, contains one of "
         "$5-$9, or contains an unescaped $ character (use $$ instead)");
 
-std::string Substitute(absl::Nonnull<const char*> format,
+std::string Substitute(const char* absl_nonnull format,
                        const substitute_internal::Arg& a0,
                        const substitute_internal::Arg& a1,
                        const substitute_internal::Arg& a2,
@@ -713,7 +714,7 @@ std::string Substitute(absl::Nonnull<const char*> format,
         "$6-$9, or contains an unescaped $ character (use $$ instead)");
 
 std::string Substitute(
-    absl::Nonnull<const char*> format, const substitute_internal::Arg& a0,
+    const char* absl_nonnull format, const substitute_internal::Arg& a0,
     const substitute_internal::Arg& a1, const substitute_internal::Arg& a2,
     const substitute_internal::Arg& a3, const substitute_internal::Arg& a4,
     const substitute_internal::Arg& a5, const substitute_internal::Arg& a6)
@@ -724,7 +725,7 @@ std::string Substitute(
         "$7-$9, or contains an unescaped $ character (use $$ instead)");
 
 std::string Substitute(
-    absl::Nonnull<const char*> format, const substitute_internal::Arg& a0,
+    const char* absl_nonnull format, const substitute_internal::Arg& a0,
     const substitute_internal::Arg& a1, const substitute_internal::Arg& a2,
     const substitute_internal::Arg& a3, const substitute_internal::Arg& a4,
     const substitute_internal::Arg& a5, const substitute_internal::Arg& a6,
@@ -736,7 +737,7 @@ std::string Substitute(
         "$8-$9, or contains an unescaped $ character (use $$ instead)");
 
 std::string Substitute(
-    absl::Nonnull<const char*> format, const substitute_internal::Arg& a0,
+    const char* absl_nonnull format, const substitute_internal::Arg& a0,
     const substitute_internal::Arg& a1, const substitute_internal::Arg& a2,
     const substitute_internal::Arg& a3, const substitute_internal::Arg& a4,
     const substitute_internal::Arg& a5, const substitute_internal::Arg& a6,
@@ -748,7 +749,7 @@ std::string Substitute(
         "contains an unescaped $ character (use $$ instead)");
 
 std::string Substitute(
-    absl::Nonnull<const char*> format, const substitute_internal::Arg& a0,
+    const char* absl_nonnull format, const substitute_internal::Arg& a0,
     const substitute_internal::Arg& a1, const substitute_internal::Arg& a2,
     const substitute_internal::Arg& a3, const substitute_internal::Arg& a4,
     const substitute_internal::Arg& a5, const substitute_internal::Arg& a6,
diff --git a/deps/v8/third_party/abseil-cpp/absl/synchronization/mutex.h b/deps/v8/third_party/abseil-cpp/absl/synchronization/mutex.h
index 77422a0be91ed8..78b1c7a048aa33 100644
--- a/deps/v8/third_party/abseil-cpp/absl/synchronization/mutex.h
+++ b/deps/v8/third_party/abseil-cpp/absl/synchronization/mutex.h
@@ -450,7 +450,9 @@ class ABSL_LOCKABLE ABSL_ATTRIBUTE_WARN_UNUSED Mutex {
   // substantially reduce `Mutex` performance; it should be set only for
   // non-production runs.  Optimization options may also disable invariant
   // checks.
-  void EnableInvariantDebugging(void (*invariant)(void*), void* arg);
+  void EnableInvariantDebugging(
+      void (*absl_nullable invariant)(void* absl_nullability_unknown),
+      void* absl_nullability_unknown arg);
 
   // Mutex::EnableDebugLog()
   //
@@ -459,7 +461,7 @@ class ABSL_LOCKABLE ABSL_ATTRIBUTE_WARN_UNUSED Mutex {
   // call to `EnableInvariantDebugging()` or `EnableDebugLog()` has been made.
   //
   // Note: This method substantially reduces `Mutex` performance.
-  void EnableDebugLog(const char* name);
+  void EnableDebugLog(const char* absl_nullable name);
 
   // Deadlock detection
 
@@ -509,20 +511,23 @@ class ABSL_LOCKABLE ABSL_ATTRIBUTE_WARN_UNUSED Mutex {
 
   // Post()/Wait() versus associated PerThreadSem; in class for required
   // friendship with PerThreadSem.
-  static void IncrementSynchSem(Mutex* mu, base_internal::PerThreadSynch* w);
-  static bool DecrementSynchSem(Mutex* mu, base_internal::PerThreadSynch* w,
+  static void IncrementSynchSem(Mutex* absl_nonnull mu,
+                                base_internal::PerThreadSynch* absl_nonnull w);
+  static bool DecrementSynchSem(Mutex* absl_nonnull mu,
+                                base_internal::PerThreadSynch* absl_nonnull w,
                                 synchronization_internal::KernelTimeout t);
 
   // slow path acquire
-  void LockSlowLoop(SynchWaitParams* waitp, int flags);
+  void LockSlowLoop(SynchWaitParams* absl_nonnull waitp, int flags);
   // wrappers around LockSlowLoop()
-  bool LockSlowWithDeadline(MuHow how, const Condition* cond,
+  bool LockSlowWithDeadline(MuHow absl_nonnull how,
+                            const Condition* absl_nullable cond,
                             synchronization_internal::KernelTimeout t,
                             int flags);
-  void LockSlow(MuHow how, const Condition* cond,
+  void LockSlow(MuHow absl_nonnull how, const Condition* absl_nullable cond,
                 int flags) ABSL_ATTRIBUTE_COLD;
   // slow path release
-  void UnlockSlow(SynchWaitParams* waitp) ABSL_ATTRIBUTE_COLD;
+  void UnlockSlow(SynchWaitParams* absl_nullable waitp) ABSL_ATTRIBUTE_COLD;
   // TryLock slow path.
   bool TryLockSlow();
   // ReaderTryLock slow path.
@@ -533,20 +538,21 @@ class ABSL_LOCKABLE ABSL_ATTRIBUTE_WARN_UNUSED Mutex {
   bool LockWhenCommon(const Condition& cond,
                       synchronization_internal::KernelTimeout t, bool write);
   // Attempt to remove thread s from queue.
-  void TryRemove(base_internal::PerThreadSynch* s);
+  void TryRemove(base_internal::PerThreadSynch* absl_nonnull s);
   // Block a thread on mutex.
-  void Block(base_internal::PerThreadSynch* s);
+  void Block(base_internal::PerThreadSynch* absl_nonnull s);
   // Wake a thread; return successor.
-  base_internal::PerThreadSynch* Wakeup(base_internal::PerThreadSynch* w);
+  base_internal::PerThreadSynch* absl_nullable Wakeup(
+      base_internal::PerThreadSynch* absl_nonnull w);
   void Dtor();
 
   friend class CondVar;   // for access to Trans()/Fer().
-  void Trans(MuHow how);  // used for CondVar->Mutex transfer
-  void Fer(
-      base_internal::PerThreadSynch* w);  // used for CondVar->Mutex transfer
+  void Trans(MuHow absl_nonnull how);  // used for CondVar->Mutex transfer
+  void Fer(base_internal::PerThreadSynch* absl_nonnull
+           w);  // used for CondVar->Mutex transfer
 
   // Catch the error of writing Mutex when intending MutexLock.
-  explicit Mutex(const volatile Mutex* /*ignored*/) {}
+  explicit Mutex(const volatile Mutex* absl_nullable /*ignored*/) {}
 
   Mutex(const Mutex&) = delete;
   Mutex& operator=(const Mutex&) = delete;
@@ -640,12 +646,13 @@ class ABSL_SCOPED_LOCKABLE ReaderMutexLock {
 // releases a write (exclusive) lock on a `Mutex` via RAII.
 class ABSL_SCOPED_LOCKABLE WriterMutexLock {
  public:
-  explicit WriterMutexLock(Mutex* mu) ABSL_EXCLUSIVE_LOCK_FUNCTION(mu)
+  explicit WriterMutexLock(Mutex* absl_nonnull mu)
+      ABSL_EXCLUSIVE_LOCK_FUNCTION(mu)
       : mu_(mu) {
     mu->WriterLock();
   }
 
-  explicit WriterMutexLock(Mutex* mu, const Condition& cond)
+  explicit WriterMutexLock(Mutex* absl_nonnull mu, const Condition& cond)
       ABSL_EXCLUSIVE_LOCK_FUNCTION(mu)
       : mu_(mu) {
     mu->WriterLockWhen(cond);
@@ -659,7 +666,7 @@ class ABSL_SCOPED_LOCKABLE WriterMutexLock {
   ~WriterMutexLock() ABSL_UNLOCK_FUNCTION() { this->mu_->WriterUnlock(); }
 
  private:
-  Mutex* const mu_;
+  Mutex* absl_nonnull const mu_;
 };
 
 // -----------------------------------------------------------------------------
@@ -717,7 +724,8 @@ class ABSL_SCOPED_LOCKABLE WriterMutexLock {
 class Condition {
  public:
   // A Condition that returns the result of "(*func)(arg)"
-  Condition(bool (*func)(void*), void* arg);
+  Condition(bool (*absl_nonnull func)(void* absl_nullability_unknown),
+            void* absl_nullability_unknown arg);
 
   // Templated version for people who are averse to casts.
   //
@@ -729,7 +737,8 @@ class Condition {
   //
   // See class comment for performance advice.
   template <typename T>
-  Condition(bool (*func)(T*), T* arg);
+  Condition(bool (*absl_nonnull func)(T* absl_nullability_unknown),
+            T* absl_nullability_unknown arg);
 
   // Same as above, but allows for cases where `arg` comes from a pointer that
   // is convertible to the function parameter type `T*` but not an exact match.
@@ -743,8 +752,10 @@ class Condition {
   // a function template is passed as `func`. Also, the dummy `typename = void`
   // template parameter exists just to work around a MSVC mangling bug.
   template <typename T, typename = void>
-  Condition(bool (*func)(T*),
-            typename absl::internal::type_identity<T>::type* arg);
+  Condition(
+      bool (*absl_nonnull func)(T* absl_nullability_unknown),
+      typename absl::internal::type_identity<T>::type* absl_nullability_unknown
+      arg);
 
   // Templated version for invoking a method that returns a `bool`.
   //
@@ -755,16 +766,19 @@ class Condition {
   // methods to come from base classes. A simpler signature like
   // `Condition(T*, bool (T::*)())` does not suffice.
   template <typename T>
-  Condition(T* object,
-            bool (absl::internal::type_identity<T>::type::*method)());
+  Condition(
+      T* absl_nonnull object,
+      bool (absl::internal::type_identity<T>::type::* absl_nonnull method)());
 
   // Same as above, for const members
   template <typename T>
-  Condition(const T* object,
-            bool (absl::internal::type_identity<T>::type::*method)() const);
+  Condition(
+      const T* absl_nonnull object,
+      bool (absl::internal::type_identity<T>::type::* absl_nonnull method)()
+          const);
 
   // A Condition that returns the value of `*cond`
-  explicit Condition(const bool* cond);
+  explicit Condition(const bool* absl_nonnull cond);
 
   // Templated version for invoking a functor that returns a `bool`.
   // This approach accepts pointers to non-mutable lambdas, `std::function`,
@@ -793,7 +807,7 @@ class Condition {
   // `bool operator() const`.
   template <typename T, typename E = decltype(static_cast<bool (T::*)() const>(
                             &T::operator()))>
-  explicit Condition(const T* obj)
+  explicit Condition(const T* absl_nonnull obj)
       : Condition(obj, static_cast<bool (T::*)() const>(&T::operator())) {}
 
   // A Condition that always returns `true`.
@@ -819,7 +833,8 @@ class Condition {
   // Two `Condition` values are guaranteed equal if both their `func` and `arg`
   // components are the same. A null pointer is equivalent to a `true`
   // condition.
-  static bool GuaranteedEqual(const Condition* a, const Condition* b);
+  static bool GuaranteedEqual(const Condition* absl_nullable a,
+                              const Condition* absl_nullable b);
 
  private:
   // Sizing an allocation for a method pointer can be subtle. In the Itanium
@@ -844,17 +859,17 @@ class Condition {
 #endif
 
   // Function with which to evaluate callbacks and/or arguments.
-  bool (*eval_)(const Condition*) = nullptr;
+  bool (*absl_nullable eval_)(const Condition* absl_nonnull) = nullptr;
 
   // Either an argument for a function call or an object for a method call.
-  void* arg_ = nullptr;
+  void* absl_nullable arg_ = nullptr;
 
   // Various functions eval_ can point to:
-  static bool CallVoidPtrFunction(const Condition*);
+  static bool CallVoidPtrFunction(const Condition* absl_nonnull c);
   template <typename T>
-  static bool CastAndCallFunction(const Condition* c);
+  static bool CastAndCallFunction(const Condition* absl_nonnull c);
   template <typename T, typename ConditionMethodPtr>
-  static bool CastAndCallMethod(const Condition* c);
+  static bool CastAndCallMethod(const Condition* absl_nonnull c);
 
   // Helper methods for storing, validating, and reading callback arguments.
   template <typename T>
@@ -866,11 +881,11 @@ class Condition {
   }
 
   template <typename T>
-  inline void ReadCallback(T* callback) const {
+  inline void ReadCallback(T* absl_nonnull callback) const {
     std::memcpy(callback, callback_, sizeof(*callback));
   }
 
-  static bool AlwaysTrue(const Condition*) { return true; }
+  static bool AlwaysTrue(const Condition* absl_nullable) { return true; }
 
   // Used only to create kTrue.
   constexpr Condition() : eval_(AlwaysTrue), arg_(nullptr) {}
@@ -924,7 +939,7 @@ class CondVar {
   // spurious wakeup), then reacquires the `Mutex` and returns.
   //
   // Requires and ensures that the current thread holds the `Mutex`.
-  void Wait(Mutex* mu) {
+  void Wait(Mutex* absl_nonnull mu) {
     WaitCommon(mu, synchronization_internal::KernelTimeout::Never());
   }
 
@@ -941,7 +956,7 @@ class CondVar {
   // to return `true` or `false`.
   //
   // Requires and ensures that the current thread holds the `Mutex`.
-  bool WaitWithTimeout(Mutex* mu, absl::Duration timeout) {
+  bool WaitWithTimeout(Mutex* absl_nonnull mu, absl::Duration timeout) {
     return WaitCommon(mu, synchronization_internal::KernelTimeout(timeout));
   }
 
@@ -960,7 +975,7 @@ class CondVar {
   // to return `true` or `false`.
   //
   // Requires and ensures that the current thread holds the `Mutex`.
-  bool WaitWithDeadline(Mutex* mu, absl::Time deadline) {
+  bool WaitWithDeadline(Mutex* absl_nonnull mu, absl::Time deadline) {
     return WaitCommon(mu, synchronization_internal::KernelTimeout(deadline));
   }
 
@@ -979,11 +994,12 @@ class CondVar {
   // Causes all subsequent uses of this `CondVar` to be logged via
   // `ABSL_RAW_LOG(INFO)`. Log entries are tagged with `name` if `name != 0`.
   // Note: this method substantially reduces `CondVar` performance.
-  void EnableDebugLog(const char* name);
+  void EnableDebugLog(const char* absl_nullable name);
 
  private:
-  bool WaitCommon(Mutex* mutex, synchronization_internal::KernelTimeout t);
-  void Remove(base_internal::PerThreadSynch* s);
+  bool WaitCommon(Mutex* absl_nonnull mutex,
+                  synchronization_internal::KernelTimeout t);
+  void Remove(base_internal::PerThreadSynch* absl_nonnull s);
   std::atomic<intptr_t> cv_;  // Condition variable state.
   CondVar(const CondVar&) = delete;
   CondVar& operator=(const CondVar&) = delete;
@@ -999,14 +1015,15 @@ class CondVar {
 // MutexLockMaybe is like MutexLock, but is a no-op when mu is null.
 class ABSL_SCOPED_LOCKABLE MutexLockMaybe {
  public:
-  explicit MutexLockMaybe(Mutex* mu) ABSL_EXCLUSIVE_LOCK_FUNCTION(mu)
+  explicit MutexLockMaybe(Mutex* absl_nullable mu)
+      ABSL_EXCLUSIVE_LOCK_FUNCTION(mu)
       : mu_(mu) {
     if (this->mu_ != nullptr) {
       this->mu_->Lock();
     }
   }
 
-  explicit MutexLockMaybe(Mutex* mu, const Condition& cond)
+  explicit MutexLockMaybe(Mutex* absl_nullable mu, const Condition& cond)
       ABSL_EXCLUSIVE_LOCK_FUNCTION(mu)
       : mu_(mu) {
     if (this->mu_ != nullptr) {
@@ -1021,7 +1038,7 @@ class ABSL_SCOPED_LOCKABLE MutexLockMaybe {
   }
 
  private:
-  Mutex* const mu_;
+  Mutex* absl_nullable const mu_;
   MutexLockMaybe(const MutexLockMaybe&) = delete;
   MutexLockMaybe(MutexLockMaybe&&) = delete;
   MutexLockMaybe& operator=(const MutexLockMaybe&) = delete;
@@ -1034,12 +1051,13 @@ class ABSL_SCOPED_LOCKABLE MutexLockMaybe {
 // mutex before destruction. `Release()` may be called at most once.
 class ABSL_SCOPED_LOCKABLE ReleasableMutexLock {
  public:
-  explicit ReleasableMutexLock(Mutex* mu) ABSL_EXCLUSIVE_LOCK_FUNCTION(mu)
+  explicit ReleasableMutexLock(Mutex* absl_nonnull mu)
+      ABSL_EXCLUSIVE_LOCK_FUNCTION(mu)
       : mu_(mu) {
     this->mu_->Lock();
   }
 
-  explicit ReleasableMutexLock(Mutex* mu, const Condition& cond)
+  explicit ReleasableMutexLock(Mutex* absl_nonnull mu, const Condition& cond)
       ABSL_EXCLUSIVE_LOCK_FUNCTION(mu)
       : mu_(mu) {
     this->mu_->LockWhen(cond);
@@ -1054,7 +1072,7 @@ class ABSL_SCOPED_LOCKABLE ReleasableMutexLock {
   void Release() ABSL_UNLOCK_FUNCTION();
 
  private:
-  Mutex* mu_;
+  Mutex* absl_nonnull mu_;
   ReleasableMutexLock(const ReleasableMutexLock&) = delete;
   ReleasableMutexLock(ReleasableMutexLock&&) = delete;
   ReleasableMutexLock& operator=(const ReleasableMutexLock&) = delete;
@@ -1086,7 +1104,7 @@ inline CondVar::CondVar() : cv_(0) {}
 
 // static
 template <typename T, typename ConditionMethodPtr>
-bool Condition::CastAndCallMethod(const Condition* c) {
+bool Condition::CastAndCallMethod(const Condition* absl_nonnull c) {
   T* object = static_cast<T*>(c->arg_);
   ConditionMethodPtr condition_method_pointer;
   c->ReadCallback(&condition_method_pointer);
@@ -1095,7 +1113,7 @@ bool Condition::CastAndCallMethod(const Condition* c) {
 
 // static
 template <typename T>
-bool Condition::CastAndCallFunction(const Condition* c) {
+bool Condition::CastAndCallFunction(const Condition* absl_nonnull c) {
   bool (*function)(T*);
   c->ReadCallback(&function);
   T* argument = static_cast<T*>(c->arg_);
@@ -1103,7 +1121,9 @@ bool Condition::CastAndCallFunction(const Condition* c) {
 }
 
 template <typename T>
-inline Condition::Condition(bool (*func)(T*), T* arg)
+inline Condition::Condition(
+    bool (*absl_nonnull func)(T* absl_nullability_unknown),
+    T* absl_nullability_unknown arg)
     : eval_(&CastAndCallFunction<T>),
       arg_(const_cast<void*>(static_cast<const void*>(arg))) {
   static_assert(sizeof(&func) <= sizeof(callback_),
@@ -1113,13 +1133,16 @@ inline Condition::Condition(bool (*func)(T*), T* arg)
 
 template <typename T, typename>
 inline Condition::Condition(
-    bool (*func)(T*), typename absl::internal::type_identity<T>::type* arg)
+    bool (*absl_nonnull func)(T* absl_nullability_unknown),
+    typename absl::internal::type_identity<T>::type* absl_nullability_unknown
+    arg)
     // Just delegate to the overload above.
     : Condition(func, arg) {}
 
 template <typename T>
 inline Condition::Condition(
-    T* object, bool (absl::internal::type_identity<T>::type::*method)())
+    T* absl_nonnull object,
+    bool (absl::internal::type_identity<T>::type::* absl_nonnull method)())
     : eval_(&CastAndCallMethod<T, decltype(method)>), arg_(object) {
   static_assert(sizeof(&method) <= sizeof(callback_),
                 "An overlarge method pointer was passed to Condition.");
@@ -1128,8 +1151,9 @@ inline Condition::Condition(
 
 template <typename T>
 inline Condition::Condition(
-    const T* object,
-    bool (absl::internal::type_identity<T>::type::*method)() const)
+    const T* absl_nonnull object,
+    bool (absl::internal::type_identity<T>::type::* absl_nonnull method)()
+        const)
     : eval_(&CastAndCallMethod<const T, decltype(method)>),
       arg_(reinterpret_cast<void*>(const_cast<T*>(object))) {
   StoreCallback(method);
@@ -1147,7 +1171,7 @@ inline Condition::Condition(
 // binary; if this function is called a second time with a different function
 // pointer, the value is ignored (and will cause an assertion failure in debug
 // mode.)
-void RegisterMutexProfiler(void (*fn)(int64_t wait_cycles));
+void RegisterMutexProfiler(void (*absl_nonnull fn)(int64_t wait_cycles));
 
 // Register a hook for Mutex tracing.
 //
@@ -1161,8 +1185,9 @@ void RegisterMutexProfiler(void (*fn)(int64_t wait_cycles));
 //
 // This has the same ordering and single-use limitations as
 // RegisterMutexProfiler() above.
-void RegisterMutexTracer(void (*fn)(const char* msg, const void* obj,
-                                    int64_t wait_cycles));
+void RegisterMutexTracer(void (*absl_nonnull fn)(const char* absl_nonnull msg,
+                                                 const void* absl_nonnull obj,
+                                                 int64_t wait_cycles));
 
 // Register a hook for CondVar tracing.
 //
@@ -1176,7 +1201,8 @@ void RegisterMutexTracer(void (*fn)(const char* msg, const void* obj,
 //
 // This has the same ordering and single-use limitations as
 // RegisterMutexProfiler() above.
-void RegisterCondVarTracer(void (*fn)(const char* msg, const void* cv));
+void RegisterCondVarTracer(void (*absl_nonnull fn)(
+    const char* absl_nonnull msg, const void* absl_nonnull cv));
 
 // EnableMutexInvariantDebugging()
 //
diff --git a/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/include/cctz/time_zone.h b/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/include/cctz/time_zone.h
index b2b0cf6f511da8..5b232f51b83937 100644
--- a/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/include/cctz/time_zone.h
+++ b/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/include/cctz/time_zone.h
@@ -200,7 +200,7 @@ class time_zone {
   // version() and description() provide additional information about the
   // time zone. The content of each of the returned strings is unspecified,
   // however, when the IANA Time Zone Database is the underlying data source
-  // the version() string will be in the familar form (e.g, "2018e") or
+  // the version() string will be in the familiar form (e.g, "2018e") or
   // empty when unavailable.
   //
   // Note: These functions are for informational or testing purposes only.
diff --git a/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/src/cctz_benchmark.cc b/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/src/cctz_benchmark.cc
index 4a5ac1ba958e38..ba7e149662f8fc 100644
--- a/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/src/cctz_benchmark.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/src/cctz_benchmark.cc
@@ -199,6 +199,7 @@ const char* const kTimeZoneNames[] = {"Africa/Abidjan",
                                       "America/Ciudad_Juarez",
                                       "America/Coral_Harbour",
                                       "America/Costa_Rica",
+                                      "America/Coyhaique",
                                       "America/Creston",
                                       "America/Cuiaba",
                                       "America/Curacao",
@@ -215,7 +216,6 @@ const char* const kTimeZoneNames[] = {"Africa/Abidjan",
                                       "America/Fort_Nelson",
                                       "America/Fortaleza",
                                       "America/Glace_Bay",
-                                      "America/Godthab",
                                       "America/Goose_Bay",
                                       "America/Grand_Turk",
                                       "America/Grenada",
diff --git a/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/src/time_zone_lookup_test.cc b/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/src/time_zone_lookup_test.cc
index 22c0eb66031fb8..e1bea28ec6e039 100644
--- a/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/src/time_zone_lookup_test.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/src/time_zone_lookup_test.cc
@@ -134,6 +134,7 @@ const char* const kTimeZoneNames[] = {"Africa/Abidjan",
                                       "America/Ciudad_Juarez",
                                       "America/Coral_Harbour",
                                       "America/Costa_Rica",
+                                      "America/Coyhaique",
                                       "America/Creston",
                                       "America/Cuiaba",
                                       "America/Curacao",
@@ -150,7 +151,6 @@ const char* const kTimeZoneNames[] = {"Africa/Abidjan",
                                       "America/Fort_Nelson",
                                       "America/Fortaleza",
                                       "America/Glace_Bay",
-                                      "America/Godthab",
                                       "America/Goose_Bay",
                                       "America/Grand_Turk",
                                       "America/Grenada",
diff --git a/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/testdata/version b/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/testdata/version
index 0846b7f265fa58..ef468adcecf9e2 100644
--- a/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/testdata/version
+++ b/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/testdata/version
@@ -1 +1 @@
-2025a
+2025b
diff --git a/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/testdata/zoneinfo/America/Coyhaique b/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/testdata/zoneinfo/America/Coyhaique
new file mode 100644
index 00000000000000..26354e89460e7c
Binary files /dev/null and b/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/testdata/zoneinfo/America/Coyhaique differ
diff --git a/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/testdata/zoneinfo/Asia/Tehran b/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/testdata/zoneinfo/Asia/Tehran
index 824acb0426faaf..6fd31e075a2922 100644
Binary files a/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/testdata/zoneinfo/Asia/Tehran and b/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/testdata/zoneinfo/Asia/Tehran differ
diff --git a/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/testdata/zoneinfo/Iran b/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/testdata/zoneinfo/Iran
index 824acb0426faaf..6fd31e075a2922 100644
Binary files a/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/testdata/zoneinfo/Iran and b/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/testdata/zoneinfo/Iran differ
diff --git a/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/testdata/zoneinfo/zone1970.tab b/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/testdata/zoneinfo/zone1970.tab
index 5ded0565ebf317..36535bdf5cfbde 100644
--- a/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/testdata/zoneinfo/zone1970.tab
+++ b/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/testdata/zoneinfo/zone1970.tab
@@ -124,7 +124,8 @@ CH,DE,LI	+4723+00832	Europe/Zurich	Büsingen
 CI,BF,GH,GM,GN,IS,ML,MR,SH,SL,SN,TG	+0519-00402	Africa/Abidjan
 CK	-2114-15946	Pacific/Rarotonga
 CL	-3327-07040	America/Santiago	most of Chile
-CL	-5309-07055	America/Punta_Arenas	Region of Magallanes
+CL	-4534-07204	America/Coyhaique	Aysén Region
+CL	-5309-07055	America/Punta_Arenas	Magallanes Region
 CL	-2709-10926	Pacific/Easter	Easter Island
 CN	+3114+12128	Asia/Shanghai	Beijing Time
 CN	+4348+08735	Asia/Urumqi	Xinjiang Time
diff --git a/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/testdata/zoneinfo/zonenow.tab b/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/testdata/zoneinfo/zonenow.tab
index d2c1e48584f8f8..093f0a0cb7495b 100644
--- a/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/testdata/zoneinfo/zonenow.tab
+++ b/deps/v8/third_party/abseil-cpp/absl/time/internal/cctz/testdata/zoneinfo/zonenow.tab
@@ -104,7 +104,7 @@ XX	+4439-06336	America/Halifax	Atlantic ("AST/ADT") - Canada; Bermuda
 XX	+4734-05243	America/St_Johns	Newfoundland ("NST/NDT")
 #
 # -03
-XX	-2332-04637	America/Sao_Paulo	eastern South America
+XX	-2332-04637	America/Sao_Paulo	eastern and southern South America
 #
 # -03/-02 (North America DST)
 XX	+4703-05620	America/Miquelon	St Pierre & Miquelon
diff --git a/deps/v8/third_party/abseil-cpp/absl/types/BUILD.bazel b/deps/v8/third_party/abseil-cpp/absl/types/BUILD.bazel
index febc9e5fa26994..0668a2e7762fe6 100644
--- a/deps/v8/third_party/abseil-cpp/absl/types/BUILD.bazel
+++ b/deps/v8/third_party/abseil-cpp/absl/types/BUILD.bazel
@@ -64,6 +64,7 @@ cc_library(
         "//absl/base:core_headers",
         "//absl/base:nullability",
         "//absl/base:throw_delegate",
+        "//absl/hash:weakly_mixed_integer",
         "//absl/meta:type_traits",
     ],
 )
@@ -81,6 +82,7 @@ cc_test(
         "//absl/base:exception_testing",
         "//absl/container:fixed_array",
         "//absl/container:inlined_vector",
+        "//absl/hash",
         "//absl/hash:hash_testing",
         "//absl/meta:type_traits",
         "//absl/strings",
diff --git a/deps/v8/third_party/abseil-cpp/absl/types/BUILD.gn b/deps/v8/third_party/abseil-cpp/absl/types/BUILD.gn
index 48b25eab569931..bd139b80851c71 100644
--- a/deps/v8/third_party/abseil-cpp/absl/types/BUILD.gn
+++ b/deps/v8/third_party/abseil-cpp/absl/types/BUILD.gn
@@ -23,6 +23,7 @@ absl_source_set("span") {
     "//third_party/abseil-cpp/absl/base:core_headers",
     "//third_party/abseil-cpp/absl/base:nullability",
     "//third_party/abseil-cpp/absl/base:throw_delegate",
+    "//third_party/abseil-cpp/absl/hash:weakly_mixed_integer",
     "//third_party/abseil-cpp/absl/meta:type_traits",
   ]
 }
@@ -36,6 +37,7 @@ absl_test("span_test") {
     "//third_party/abseil-cpp/absl/base:exception_testing",
     "//third_party/abseil-cpp/absl/container:fixed_array",
     "//third_party/abseil-cpp/absl/container:inlined_vector",
+    "//third_party/abseil-cpp/absl/hash",
     "//third_party/abseil-cpp/absl/hash:hash_testing",
     "//third_party/abseil-cpp/absl/meta:type_traits",
     "//third_party/abseil-cpp/absl/strings",
@@ -69,7 +71,5 @@ absl_source_set("compare") {
 
 absl_test("variant_test") {
   sources = [ "variant_test.cc" ]
-  deps = [
-    ":variant",
-  ]
+  deps = [ ":variant" ]
 }
diff --git a/deps/v8/third_party/abseil-cpp/absl/types/CMakeLists.txt b/deps/v8/third_party/abseil-cpp/absl/types/CMakeLists.txt
index f48accf8b2e115..20a7e90e7eeb65 100644
--- a/deps/v8/third_party/abseil-cpp/absl/types/CMakeLists.txt
+++ b/deps/v8/third_party/abseil-cpp/absl/types/CMakeLists.txt
@@ -43,6 +43,7 @@ absl_cc_library(
     absl::nullability
     absl::throw_delegate
     absl::type_traits
+    absl::weakly_mixed_integer
   PUBLIC
 )
 
@@ -60,6 +61,7 @@ absl_cc_test(
     absl::core_headers
     absl::exception_testing
     absl::fixed_array
+    absl::hash
     absl::inlined_vector
     absl::hash_testing
     absl::strings
diff --git a/deps/v8/third_party/abseil-cpp/absl/types/span.h b/deps/v8/third_party/abseil-cpp/absl/types/span.h
index 33904a904bcaa5..444b2ae6944488 100644
--- a/deps/v8/third_party/abseil-cpp/absl/types/span.h
+++ b/deps/v8/third_party/abseil-cpp/absl/types/span.h
@@ -66,7 +66,8 @@
 #include "absl/base/macros.h"
 #include "absl/base/nullability.h"
 #include "absl/base/optimization.h"
-#include "absl/base/port.h"    // TODO(strel): remove this include
+#include "absl/base/port.h"  // TODO(strel): remove this include
+#include "absl/hash/internal/weakly_mixed_integer.h"
 #include "absl/meta/type_traits.h"
 #include "absl/types/internal/span.h"
 
@@ -498,7 +499,7 @@ class ABSL_ATTRIBUTE_VIEW Span {
   template <typename H>
   friend H AbslHashValue(H h, Span v) {
     return H::combine(H::combine_contiguous(std::move(h), v.data(), v.size()),
-                      v.size());
+                      hash_internal::WeaklyMixedInteger{v.size()});
   }
 
  private:
@@ -724,12 +725,12 @@ ABSL_INTERNAL_CONSTEXPR_SINCE_CXX20 bool operator>=(Span<T> a, const U& b) {
 //   }
 //
 template <int&... ExplicitArgumentBarrier, typename T>
-constexpr Span<T> MakeSpan(absl::Nullable<T*> ptr, size_t size) noexcept {
+constexpr Span<T> MakeSpan(T* absl_nullable ptr, size_t size) noexcept {
   return Span<T>(ptr, size);
 }
 
 template <int&... ExplicitArgumentBarrier, typename T>
-Span<T> MakeSpan(absl::Nullable<T*> begin, absl::Nullable<T*> end) noexcept {
+Span<T> MakeSpan(T* absl_nullable begin, T* absl_nullable end) noexcept {
   ABSL_HARDENING_ASSERT(begin <= end);
   return Span<T>(begin, static_cast<size_t>(end - begin));
 }
@@ -770,14 +771,14 @@ constexpr Span<T> MakeSpan(T (&array)[N]) noexcept {
 //   ProcessInts(absl::MakeConstSpan(std::vector<int>{ 0, 0, 0 }));
 //
 template <int&... ExplicitArgumentBarrier, typename T>
-constexpr Span<const T> MakeConstSpan(absl::Nullable<T*> ptr,
+constexpr Span<const T> MakeConstSpan(T* absl_nullable ptr,
                                       size_t size) noexcept {
   return Span<const T>(ptr, size);
 }
 
 template <int&... ExplicitArgumentBarrier, typename T>
-Span<const T> MakeConstSpan(absl::Nullable<T*> begin,
-                            absl::Nullable<T*> end) noexcept {
+Span<const T> MakeConstSpan(T* absl_nullable begin,
+                            T* absl_nullable end) noexcept {
   ABSL_HARDENING_ASSERT(begin <= end);
   return Span<const T>(begin, end - begin);
 }
diff --git a/deps/v8/third_party/abseil-cpp/absl/types/span_test.cc b/deps/v8/third_party/abseil-cpp/absl/types/span_test.cc
index a1a207f4726143..6700b81f0dcf30 100644
--- a/deps/v8/third_party/abseil-cpp/absl/types/span_test.cc
+++ b/deps/v8/third_party/abseil-cpp/absl/types/span_test.cc
@@ -30,6 +30,7 @@
 #include "absl/base/options.h"
 #include "absl/container/fixed_array.h"
 #include "absl/container/inlined_vector.h"
+#include "absl/hash/hash.h"
 #include "absl/hash/hash_testing.h"
 #include "absl/meta/type_traits.h"
 #include "absl/strings/str_cat.h"
@@ -885,4 +886,16 @@ TEST(Span, Hash) {
        T(array + 1, 2), T(array + 2, 2)}));
 }
 
+// std::vector is implicitly convertible to absl::Span.
+// There are real life cases where clients rely on this consistency in order to
+// implement heterogeneous lookup.
+TEST(Span, HashConsistentWithVectorLike) {
+  EXPECT_EQ(absl::HashOf(absl::Span<const int>({1, 2, 3})),
+            absl::HashOf(std::vector<int>{1, 2, 3}));
+  EXPECT_EQ(absl::HashOf(absl::Span<const int>({1, 2, 3})),
+            absl::HashOf(absl::InlinedVector<int, 2>{1, 2, 3}));
+  EXPECT_EQ(absl::HashOf(absl::Span<const int>({1, 2, 3})),
+            absl::HashOf(absl::FixedArray<int>{1, 2, 3}));
+}
+
 }  // namespace
diff --git a/deps/v8/third_party/abseil-cpp/patches/0004-undeprecate-nullability-types.patch b/deps/v8/third_party/abseil-cpp/patches/0004-undeprecate-nullability-types.patch
new file mode 100644
index 00000000000000..29da7d46313f9f
--- /dev/null
+++ b/deps/v8/third_party/abseil-cpp/patches/0004-undeprecate-nullability-types.patch
@@ -0,0 +1,33 @@
+TODO: crbug.com/412943761 - Remove when all libraries migrate to attribute-like nullability annotations.
+---
+diff --git a/third_party/abseil-cpp/absl/base/internal/nullability_deprecated.h b/third_party/abseil-cpp/absl/base/internal/nullability_deprecated.h
+index 1174a96eaa3e0..b6405f1d9b269 100644
+--- a/third_party/abseil-cpp/absl/base/internal/nullability_deprecated.h
++++ b/third_party/abseil-cpp/absl/base/internal/nullability_deprecated.h
+@@ -77,7 +77,7 @@ using NullabilityUnknownImpl
+ // Is equivalent to:
+ // int* absl_nonnull foo;
+ template <typename T>
+-using Nonnull [[deprecated("Use `absl_nonnull`.")]] =
++using Nonnull =
+     nullability_internal::NonnullImpl<T>;
+ 
+ // absl::Nullable, analogous to absl_nullable
+@@ -87,7 +87,7 @@ using Nonnull [[deprecated("Use `absl_nonnull`.")]] =
+ // Is equivalent to:
+ // int* absl_nullable foo;
+ template <typename T>
+-using Nullable [[deprecated("Use `absl_nullable`.")]] =
++using Nullable =
+     nullability_internal::NullableImpl<T>;
+ 
+ // absl::NullabilityUnknown, analogous to absl_nullability_unknown
+@@ -97,7 +97,7 @@ using Nullable [[deprecated("Use `absl_nullable`.")]] =
+ // Is equivalent to:
+ // int* absl_nullability_unknown foo;
+ template <typename T>
+-using NullabilityUnknown [[deprecated("Use `absl_nullability_unknown`.")]] =
++using NullabilityUnknown =
+     nullability_internal::NullabilityUnknownImpl<T>;
+ 
+ ABSL_NAMESPACE_END
diff --git a/deps/v8/third_party/abseil-cpp/roll_abseil.py b/deps/v8/third_party/abseil-cpp/roll_abseil.py
index c13151b10fe446..3d797584efc243 100755
--- a/deps/v8/third_party/abseil-cpp/roll_abseil.py
+++ b/deps/v8/third_party/abseil-cpp/roll_abseil.py
@@ -3,6 +3,7 @@
 """Script to do the first step of Abseil roll into chromium.
 """
 
+import argparse
 import logging
 import os
 import re
@@ -12,14 +13,15 @@
 
 ABSL_URI = 'https://github.com/abseil/abseil-cpp.git'
 
-def _PullAbseil(abseil_dir):
+def _PullAbseil(abseil_dir, revision):
   logging.info('Updating abseil...')
-  subprocess.check_call(['git', 'clone', ABSL_URI],
-                        cwd=abseil_dir)
+  args = ['git', 'clone', ABSL_URI]
+  if revision:
+    args.extend(['--revision', revision])
+  subprocess.check_call(args, cwd=abseil_dir)
 
 def _SyncChromium(chromium_dir):
   logging.info('Updating chromium...')
-  subprocess.check_call(['git', 'checkout', 'main'], cwd=chromium_dir)
   subprocess.check_call(['git', 'pull', '--rebase'], cwd=chromium_dir)
   subprocess.check_call(['gclient', 'sync'], cwd=chromium_dir)
 
@@ -78,7 +80,7 @@ def _PatchAbseil(abseil_in_chromium_dir):
   os.remove(os.path.join(abseil_in_chromium_dir, 'absl', 'base', 'internal', 'dynamic_annotations.h'))
 
 
-def _Commit(chromium_dir, hash_diff):
+def _Commit(chromium_dir, hash_diff, should_upload):
   logging.info('Commit...')
   desc="""Roll abseil_revision {0}
 
@@ -89,40 +91,60 @@ def _Commit(chromium_dir, hash_diff):
 Bug: None""".format(hash_diff)
 
   subprocess.check_call(['git', 'add', 'third_party/abseil-cpp'], cwd=chromium_dir)
+  proc = subprocess.run(['git', 'diff', '--staged', '--quiet', 'third_party/abseil-cpp'], cwd=chromium_dir)
+  if proc.returncode == 0:
+    logging.info('Abseil is up-to-date, nothing to commit!')
+    return
+
   subprocess.check_call(['git', 'commit', '-m', desc], cwd=chromium_dir)
 
-  logging.info('Upload...')
-  subprocess.check_call(['git', 'cl', 'upload', '-m', desc, '--bypass-hooks'], cwd=chromium_dir)
+  if should_upload:
+    logging.info('Upload...')
+    subprocess.check_call(['git', 'cl', 'upload', '-m', desc, '--bypass-hooks'], cwd=chromium_dir)
+
+  logging.info("Next step is manual: Fix BUILD.gn files to match BUILD.bazel changes.")
+  logging.info("After that run generate_def_files.py. ")
 
 
-def _Roll():
+def _Roll(should_branch, should_pull, should_upload, revision):
   chromium_dir = os.getcwd()
   abseil_in_chromium_dir = os.path.join(chromium_dir, 'third_party', 'abseil-cpp')
-  _SyncChromium(chromium_dir)
+  if should_branch:
+    branch_name = datetime.today().strftime('rolling-absl-%Y%m%d')
+    logging.info('Creating branch ' + branch_name + ' for the roll...')
+    subprocess.check_call(['git', 'new-branch', branch_name], cwd=chromium_dir)
 
-  branch_name = datetime.today().strftime('rolling-absl-%Y%m%d')
-  logging.info('Creating branch ' + branch_name + ' for the roll...')
-  subprocess.check_call(['git', 'checkout', '-b', branch_name], cwd=chromium_dir)
+  if should_pull:
+    _SyncChromium(chromium_dir)
 
   with tempfile.TemporaryDirectory() as abseil_root:
-    _PullAbseil(abseil_root)
+    _PullAbseil(abseil_root, revision)
     abseil_dir = os.path.join(abseil_root, 'abseil-cpp')
     _UpdateAbseilInChromium(abseil_dir, chromium_dir)
     hash_diff = _UpdateChromiumReadme(os.path.join(abseil_in_chromium_dir, 'README.chromium'),
                                       abseil_dir)
 
   _PatchAbseil(abseil_in_chromium_dir)
-  _Commit(chromium_dir, hash_diff)
+  _Commit(chromium_dir, hash_diff, should_upload)
 
 
 if __name__ == '__main__':
   logging.getLogger().setLevel(logging.INFO)
 
-  if os.getcwd().endswith('src') and os.path.exists('chrome/browser'):
-    _Roll()
+  parser = argparse.ArgumentParser()
+  parser.add_argument('--no-branch', action='store_true',
+                      help='Skip creating a new branch, use the current one.')
+  parser.add_argument('--no-pull', action='store_true',
+                      help='Skip pulling the latest Chromium revision.')
+  parser.add_argument('--no-upload', action='store_true',
+                      help='Skip uploading the change.')
+  parser.add_argument('--revision', default=None,
+                      help='Revision to roll to. The default is the latest.')
+  args = parser.parse_args()
 
-    logging.info("Next step is manual: Fix BUILD.gn files to match BUILD.bazel changes.")
-    logging.info("After that run generate_def_files.py. ")
+  if os.getcwd().endswith('src') and os.path.exists('chrome/browser'):
+    _Roll(not args.no_branch, not args.no_pull, not args.no_upload,
+          args.revision)
   else:
     logging.error('Run this script from a chromium/src/ directory.')
 
diff --git a/deps/v8/third_party/abseil-cpp/symbols_arm64_dbg.def b/deps/v8/third_party/abseil-cpp/symbols_arm64_dbg.def
index 89278127c503f3..e6ad881919cb91 100644
--- a/deps/v8/third_party/abseil-cpp/symbols_arm64_dbg.def
+++ b/deps/v8/third_party/abseil-cpp/symbols_arm64_dbg.def
@@ -491,19 +491,19 @@ EXPORTS
     ??$FastIntToBuffer@J@numbers_internal@absl@@YAPEADJPEAD@Z
     ??$FastIntToBuffer@K@numbers_internal@absl@@YAPEADKPEAD@Z
     ??$FastIntToBuffer@_W@numbers_internal@absl@@YAPEAD_WPEAD@Z
-    ??$FastTypeId@F@base_internal@absl@@YAPEBXXZ
-    ??$FastTypeId@G@base_internal@absl@@YAPEBXXZ
-    ??$FastTypeId@H@base_internal@absl@@YAPEBXXZ
-    ??$FastTypeId@I@base_internal@absl@@YAPEBXXZ
-    ??$FastTypeId@J@base_internal@absl@@YAPEBXXZ
-    ??$FastTypeId@K@base_internal@absl@@YAPEBXXZ
-    ??$FastTypeId@M@base_internal@absl@@YAPEBXXZ
-    ??$FastTypeId@N@base_internal@absl@@YAPEBXXZ
-    ??$FastTypeId@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@base_internal@absl@@YAPEBXXZ
-    ??$FastTypeId@V?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@@base_internal@absl@@YAPEBXXZ
-    ??$FastTypeId@_J@base_internal@absl@@YAPEBXXZ
-    ??$FastTypeId@_K@base_internal@absl@@YAPEBXXZ
-    ??$FastTypeId@_N@base_internal@absl@@YAPEBXXZ
+    ??$FastTypeId@F@absl@@YAPEBXXZ
+    ??$FastTypeId@G@absl@@YAPEBXXZ
+    ??$FastTypeId@H@absl@@YAPEBXXZ
+    ??$FastTypeId@I@absl@@YAPEBXXZ
+    ??$FastTypeId@J@absl@@YAPEBXXZ
+    ??$FastTypeId@K@absl@@YAPEBXXZ
+    ??$FastTypeId@M@absl@@YAPEBXXZ
+    ??$FastTypeId@N@absl@@YAPEBXXZ
+    ??$FastTypeId@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@absl@@YAPEBXXZ
+    ??$FastTypeId@V?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@@absl@@YAPEBXXZ
+    ??$FastTypeId@_J@absl@@YAPEBXXZ
+    ??$FastTypeId@_K@absl@@YAPEBXXZ
+    ??$FastTypeId@_N@absl@@YAPEBXXZ
     ??$FindSubstitutions@V?$initializer_list@U?$pair@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V123@@__Cr@std@@@std@@@strings_internal@absl@@YA?AV?$vector@UViableSubstitution@strings_internal@absl@@V?$allocator@UViableSubstitution@strings_internal@absl@@@__Cr@std@@@__Cr@std@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@34@AEBV?$initializer_list@U?$pair@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V123@@__Cr@std@@@4@@Z
     ??$FlagOps@V?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@@flags_internal@absl@@YAPEAXW4FlagOp@01@PEBXPEAX2@Z
     ??$Flush@V?$basic_ostream@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@FormatRawSinkImpl@str_format_internal@absl@@CAXPEAXV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
@@ -540,11 +540,11 @@ EXPORTS
     ??$GetDataImpl@V?$Span@I@absl@@@span_internal@absl@@YAPEAIAEAV?$Span@I@1@D@Z
     ??$GetDataImpl@V?$vector@PEAVLogSink@absl@@V?$allocator@PEAVLogSink@absl@@@__Cr@std@@@__Cr@std@@@span_internal@absl@@YAPEAPEAVLogSink@1@AEAV?$vector@PEAVLogSink@absl@@V?$allocator@PEAVLogSink@absl@@@__Cr@std@@@__Cr@std@@D@Z
     ??$GetFlag@V?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@@absl@@YA?AV?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@AEBV?$Flag@V?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@@flags_internal@0@@Z
-    ??$GrowFullSooTableToNextCapacity@$00$00@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
-    ??$GrowFullSooTableToNextCapacity@$03$00@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
-    ??$GrowFullSooTableToNextCapacity@$07$00@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
-    ??$GrowFullSooTableToNextCapacity@$0A@$0A@@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
-    ??$GrowFullSooTableToNextCapacity@$0BA@$00@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$00$00@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$03$00@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$07$00@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$0A@$0A@@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$0BA@$00@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
     ??$HashOf@$S$$ZV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@H@absl@@YA_KAEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@AEBH@Z
     ??$HashOf@$S$$Z_K@absl@@YA_KAEB_K@Z
     ??$HidePtr@$$CBX@base_internal@absl@@YA_KPEBX@Z
@@ -569,6 +569,7 @@ EXPORTS
     ??$IntegerToString@K@strings_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@K@Z
     ??$IntegerToString@_J@strings_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@_J@Z
     ??$IntegerToString@_K@strings_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@_K@Z
+    ??$Invoke@VMixingHashState@hash_internal@absl@@@WeaklyMixedIntegerProbe@HashSelect@hash_internal@absl@@SA?AVMixingHashState@23@V423@UWeaklyMixedInteger@23@@Z
     ??$Invoke@VMixingHashState@hash_internal@absl@@H@UniquelyRepresentedProbe@HashSelect@hash_internal@absl@@SA?AVMixingHashState@23@V423@AEBH@Z
     ??$Invoke@VMixingHashState@hash_internal@absl@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@HashValueProbe@HashSelect@hash_internal@absl@@SA?AVMixingHashState@23@V423@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
     ??$Invoke@VMixingHashState@hash_internal@absl@@V?$tuple@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@AEBH@__Cr@std@@@HashValueProbe@HashSelect@hash_internal@absl@@SA?AVMixingHashState@23@V423@AEBV?$tuple@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@AEBH@__Cr@std@@@Z
@@ -778,7 +779,8 @@ EXPORTS
     ??$ToIntVal@_K@FormatArgImpl@str_format_internal@absl@@CAHAEB_K@Z
     ??$ToIntVal@_N@FormatArgImpl@str_format_internal@absl@@CAHAEB_N@Z
     ??$TrailingZeros@_K@container_internal@absl@@YAI_K@Z
-    ??$TransferRelocatable@$0BI@@container_internal@absl@@YAXPEAX00_K@Z
+    ??$TransferNRelocatable@$0BI@@container_internal@absl@@YAXPEAX00_K@Z
+    ??$TryFindNewIndexWithoutProbing@X@container_internal@absl@@YA_K_K00PEAW4ctrl_t@01@0@Z
     ??$TypeErasedApplyToSlotFn@UStringHash@container_internal@absl@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@container_internal@absl@@YA_KPEBXPEAX@Z
     ??$UnhidePtr@X@base_internal@absl@@YAPEAX_K@Z
     ??$Unparse@V?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@@flags_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@AEBV?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@34@@Z
@@ -1289,6 +1291,7 @@ EXPORTS
     ??$call_once@A6AXXZ$$V@absl@@YAXAEAVonce_flag@0@A6AXXZ@Z
     ??$call_once@P8FlagImpl@flags_internal@absl@@EAAXXZPEAV123@@absl@@YAXAEAVonce_flag@0@$$QEAP8FlagImpl@flags_internal@0@EAAXXZ$$QEAPEAV230@@Z
     ??$combine@H$$V@?$HashStateBase@VMixingHashState@hash_internal@absl@@@hash_internal@absl@@SA?AVMixingHashState@12@V312@AEBH@Z
+    ??$combine@UWeaklyMixedInteger@hash_internal@absl@@$$V@?$HashStateBase@VMixingHashState@hash_internal@absl@@@hash_internal@absl@@SA?AVMixingHashState@12@V312@AEBUWeaklyMixedInteger@12@@Z
     ??$combine@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@$$V@?$HashStateBase@VMixingHashState@hash_internal@absl@@@hash_internal@absl@@SA?AVMixingHashState@12@V312@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
     ??$combine@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@H@?$HashStateBase@VMixingHashState@hash_internal@absl@@@hash_internal@absl@@SA?AVMixingHashState@12@V312@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@AEBH@Z
     ??$combine@V?$tuple@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@AEBH@__Cr@std@@$$V@?$HashStateBase@VMixingHashState@hash_internal@absl@@@hash_internal@absl@@SA?AVMixingHashState@12@V312@AEBV?$tuple@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@AEBH@__Cr@std@@@Z
@@ -1461,7 +1464,6 @@ EXPORTS
     ??$find@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@?$__hash_table@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@V?$__unordered_map_hasher@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@23@U?$hash@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@U?$equal_to@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@V?$__unordered_map_equal@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@23@U?$equal_to@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@U?$hash@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@V?$allocator@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@@23@@__Cr@std@@QEAA?AV?$__hash_iterator@PEAU?$__hash_node@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@PEAX@__Cr@std@@@12@AEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@12@@Z
     ??$find@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@QEAA?AViterator@012@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
     ??$find@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@QEBA?AVconst_iterator@012@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
-    ??$find_first_non_full@X@container_internal@absl@@YA?AUFindInfo@01@AEBVCommonFields@01@_K@Z
     ??$find_non_soo@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEAA?AViterator@012@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@_K@Z
     ??$find_or_prepare_insert@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@IEAA?AU?$pair@Viterator@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@_N@__Cr@std@@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@45@@Z
     ??$find_or_prepare_insert_non_soo@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEAA?AU?$pair@Viterator@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@_N@__Cr@std@@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@45@@Z
@@ -1481,6 +1483,7 @@ EXPORTS
     ??$get@$00@?$CompressedTuple@V?$allocator@VFormatArgImpl@str_format_internal@absl@@@__Cr@std@@_K@container_internal@absl@@QEGAAAEA_KXZ
     ??$get@$00@?$CompressedTuple@V?$allocator@VFormatArgImpl@str_format_internal@absl@@@__Cr@std@@_K@container_internal@absl@@QEGBAAEB_KXZ
     ??$get@$00@?$CompressedTuple@VCommonFields@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@D@__Cr@std@@@container_internal@absl@@QEGAAAEAUStringHash@12@XZ
+    ??$get@$00@?$CompressedTuple@VCommonFields@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@D@__Cr@std@@@container_internal@absl@@QEGBAAEBUStringHash@12@XZ
     ??$get@$00@?$CompressedTuple@_KV?$allocator@D@__Cr@std@@@container_internal@absl@@QEGAAAEAV?$allocator@D@__Cr@std@@XZ
     ??$get@$00AEAPEAVCommandLineFlag@absl@@AEA_N@__Cr@std@@YAAEA_NAEAV?$tuple@AEAPEAVCommandLineFlag@absl@@AEA_N@01@@Z
     ??$get@$00PEAVCommandLineFlag@absl@@_N@__Cr@std@@YAAEA_NAEAV?$tuple@PEAVCommandLineFlag@absl@@_N@01@@Z
@@ -1510,6 +1513,7 @@ EXPORTS
     ??$hash_range_or_bytes@VMixingHashState@hash_internal@absl@@D@hash_internal@absl@@YA?AVMixingHashState@01@V201@PEBD_K@Z
     ??$hash_tuple@VMixingHashState@hash_internal@absl@@V?$tuple@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@AEBH@__Cr@std@@$0A@$00@hash_internal@absl@@YA?AVMixingHashState@01@V201@AEBV?$tuple@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@AEBH@__Cr@std@@U?$integer_sequence@_K$0A@$00@45@@Z
     ??$hash_tuple@VMixingHashState@hash_internal@absl@@V?$tuple@AEB_K@__Cr@std@@$0A@@hash_internal@absl@@YA?AVMixingHashState@01@V201@AEBV?$tuple@AEB_K@__Cr@std@@U?$integer_sequence@_K$0A@@45@@Z
+    ??$hash_weakly_mixed_integer@VMixingHashState@hash_internal@absl@@@hash_internal@absl@@YA?AVMixingHashState@01@V201@UWeaklyMixedInteger@01@@Z
     ??$insert@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@$0A@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@QEAA?AU?$pair@Viterator@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@_N@__Cr@std@@$$QEAU?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@45@@Z
     ??$insert@V?$__wrap_iter@PEAUraw_view@?1???R?$ConvertToContainer@V?$vector@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V?$allocator@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@23@@__Cr@std@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@23@$0A@@?$Splitter@VByChar@absl@@UAllowEmpty@2@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@strings_internal@absl@@QEBA?AV?$vector@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V?$allocator@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@23@@__Cr@std@@AEBV345@@Z@@__Cr@std@@$0A@@?$vector@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V?$allocator@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@23@@__Cr@std@@QEAA?AV?$__wrap_iter@PEAV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@12@V?$__wrap_iter@PEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@12@V?$__wrap_iter@PEAUraw_view@?1???R?$ConvertToContainer@V?$vector@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V?$allocator@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@23@@__Cr@std@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@23@$0A@@?$Splitter@VByChar@absl@@UAllowEmpty@2@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@strings_internal@absl@@QEBA?AV?$vector@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V?$allocator@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@23@@__Cr@std@@AEBV345@@Z@@12@1@Z
     ??$invoke@P8FlagImpl@flags_internal@absl@@EAAXXZPEAV123@@__Cr@std@@YAX$$QEAP8FlagImpl@flags_internal@absl@@EAAXXZ$$QEAPEAV234@@Z
@@ -1672,6 +1676,9 @@ EXPORTS
     ??0?$IteratorValueAdapter@V?$allocator@UPayload@status_internal@absl@@@__Cr@std@@V?$move_iterator@PEAUPayload@status_internal@absl@@@23@@inlined_vector_internal@absl@@QEAA@AEBV?$move_iterator@PEAUPayload@status_internal@absl@@@__Cr@std@@@Z
     ??0?$IteratorValueAdapter@V?$allocator@VFormatArgImpl@str_format_internal@absl@@@__Cr@std@@PEBVFormatArgImpl@str_format_internal@absl@@@inlined_vector_internal@absl@@QEAA@AEBQEBVFormatArgImpl@str_format_internal@2@@Z
     ??0?$NonIterableBitMask@_K$07$02@container_internal@absl@@QEAA@_K@Z
+    ??0?$ProbedItemImpl@I$0CA@@container_internal@absl@@QEAA@E_K0@Z
+    ??0?$ProbedItemImpl@_K$0EA@@container_internal@absl@@QEAA@E_K0@Z
+    ??0?$ProbedItemImpl@_K$0HK@@container_internal@absl@@QEAA@E_K0@Z
     ??0?$Sample@UHashtablezInfo@container_internal@absl@@@profiling_internal@absl@@QEAA@XZ
     ??0?$SampleRecorder@UHashtablezInfo@container_internal@absl@@@profiling_internal@absl@@QEAA@XZ
     ??0?$Span@$$CBD@absl@@QEAA@PEBD_K@Z
@@ -2621,7 +2628,6 @@ EXPORTS
     ??R<lambda_1>@?0??back@?$InlinedVector@PEAUCordRep@cord_internal@absl@@$01V?$allocator@PEAUCordRep@cord_internal@absl@@@__Cr@std@@@absl@@QEAAAEAPEAUCordRep@cord_internal@3@XZ@QEBA?A?<auto>@@XZ
     ??R<lambda_1>@?0??destroy@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEAAXPEAT?$map_slot_type@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@34@@Z@QEBA?A?<auto>@@XZ
     ??R<lambda_1>@?0??erase@?$InlinedVector@UPayload@status_internal@absl@@$00V?$allocator@UPayload@status_internal@absl@@@__Cr@std@@@absl@@QEAAPEAUPayload@status_internal@3@PEBU453@@Z@QEBA?A?<auto>@@XZ
-    ??R<lambda_1>@?0??find_new_positions_and_transfer_slots_fn@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@CA_KAEAVCommonFields@34@PEAW4ctrl_t@34@PEAX_K@Z@QEBA?A?<auto>@@PEAT?$map_slot_type@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@34@@Z
     ??R<lambda_1>@?0??inline_size@Rep@InlineData@cord_internal@absl@@QEBA_KXZ@QEBA?A?<auto>@@XZ
     ??R<lambda_1>@?0??pop_back@?$InlinedVector@PEAUCordRep@cord_internal@absl@@$01V?$allocator@PEAUCordRep@cord_internal@absl@@@__Cr@std@@@absl@@QEAAXXZ@QEBA?A?<auto>@@XZ
     ??R<lambda_1>@?0??remove_prefix@?$Span@$$CBD@absl@@QEAAX_K@Z@QEBA?A?<auto>@@XZ
@@ -2793,6 +2799,7 @@ EXPORTS
     ?AdvanceBytesBtree@ChunkIterator@Cord@absl@@AEAAX_K@Z
     ?AlignBegin@CordRepBtree@cord_internal@absl@@AEAAXXZ
     ?AlignEnd@CordRepBtree@cord_internal@absl@@AEAAXXZ
+    ?AlignUpTo@container_internal@absl@@YA_K_K0@Z
     ?Alloc@LowLevelAlloc@base_internal@absl@@SAPEAX_K@Z
     ?Alloc@flags_internal@absl@@YAPEAXP6APEAXW4FlagOp@12@PEBXPEAX2@Z@Z
     ?AllocWithArena@LowLevelAlloc@base_internal@absl@@SAPEAX_KPEAUArena@123@@Z
@@ -2846,6 +2853,7 @@ EXPORTS
     ?AsciiStrToUpper@ascii_internal@absl@@YAXPEADPEBD_K@Z
     ?AssertHeld@CordzInfo@cord_internal@absl@@QEAAXXZ
     ?AssertHeld@Mutex@absl@@QEBAXXZ
+    ?AssertHeld@SpinLock@base_internal@absl@@QEBAXXZ
     ?AssertInSooMode@CommonFields@container_internal@absl@@AEBAXXZ
     ?AssertIsFull@container_internal@absl@@YAXPEBW4ctrl_t@12@EPEBEPEBD@Z
     ?AssertIsValidForComparison@container_internal@absl@@YAXPEBW4ctrl_t@12@EPEBE@Z
@@ -2948,6 +2956,7 @@ EXPORTS
     ?Contains@Cord@absl@@QEBA_NV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
     ?Contains@str_format_internal@absl@@YA_NW4FormatConversionCharSet@2@D@Z
     ?Contains@str_format_internal@absl@@YA_NW4FormatConversionCharSet@2@W4FormatConversionChar@2@@Z
+    ?ControlOffset@container_internal@absl@@YA_K_N@Z
     ?ControlWord@base_internal@absl@@YAPEAU?$atomic@I@__Cr@std@@PEAVonce_flag@2@@Z
     ?ConvertBoolArg@str_format_internal@absl@@YA_N_NPEAVFormatSinkImpl@12@@Z
     ?ConvertDateTime@absl@@YA?AUTimeConversion@1@_JHHHHHVTimeZone@1@@Z
@@ -3177,6 +3186,7 @@ EXPORTS
     ?FindPath@GraphCycles@synchronization_internal@absl@@QEBAHUGraphId@23@0HQEAU423@@Z
     ?FiveToTheNth@?$BigUnsigned@$03@strings_internal@absl@@SA?AV123@H@Z
     ?FiveToTheNth@?$BigUnsigned@$0FE@@strings_internal@absl@@SA?AV123@H@Z
+    ?FixUpStack@internal_stacktrace@absl@@YAXPEAPEAXPEA_KPEAH_KAEA_K@Z
     ?FixedOffsetFromName@cctz@time_internal@absl@@YA_NAEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEAV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@56@@Z
     ?FixedOffsetToAbbr@cctz@time_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@AEBV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@56@@Z
     ?FixedOffsetToName@cctz@time_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@AEBV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@56@@Z
@@ -3316,6 +3326,7 @@ EXPORTS
     ?GetFlagsHelpMatchSubstr@flags_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@XZ
     ?GetFlagsHelpMode@flags_internal@absl@@YA?AW4HelpMode@12@XZ
     ?GetFlatAux@Cord@absl@@CA_NPEAUCordRep@cord_internal@2@PEAV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
+    ?GetGrowthInfoFromControl@container_internal@absl@@YAAEAVGrowthInfo@12@PEAW4ctrl_t@12@@Z
     ?GetGrowthLeft@GrowthInfo@container_internal@absl@@QEBA_KXZ
     ?GetHashtablezMaxSamples@container_internal@absl@@YA_KXZ
     ?GetHashtablezSampleParameter@container_internal@absl@@YAHXZ
@@ -3384,9 +3395,7 @@ EXPORTS
     ?GetYearDay@absl@@YAHV?$civil_time@Usecond_tag@time_internal@absl@@@detail@cctz@time_internal@1@@Z
     ?GlobalHashtablezSampler@container_internal@absl@@YAAEAV?$SampleRecorder@UHashtablezInfo@container_internal@absl@@@profiling_internal@2@XZ
     ?GlobalRegistry@FlagRegistry@flags_internal@absl@@SAAEAV123@XZ
-    ?GrowEmptySooTableToNextCapacityForceSampling@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@@Z
     ?GrowFullSooTableToNextCapacityForceSampling@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@@Z
-    ?GrowthToLowerboundCapacity@container_internal@absl@@YA_K_K@Z
     ?GuaranteedEqual@Condition@absl@@SA_NPEBV12@0@Z
     ?Guard@?$NullGuard@C@log_internal@absl@@SAAEBCAEBC@Z
     ?Guard@?$NullGuard@D@log_internal@absl@@SAAEBDAEBD@Z
@@ -3429,7 +3438,6 @@ EXPORTS
     ?HexStringToBytes@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@34@@Z
     ?HexStringToBytes@absl@@YA_NV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@34@@Z
     ?HideMask@base_internal@absl@@YA_KXZ
-    ?HighestBitSet@?$NonIterableBitMask@_K$07$02@container_internal@absl@@QEBAIXZ
     ?IDivDuration@absl@@YA_JVDuration@1@0PEAV21@@Z
     ?In@Time@absl@@QEBA?AUBreakdown@12@VTimeZone@2@@Z
     ?InMillisecondsFromNow@KernelTimeout@synchronization_internal@absl@@QEBAKXZ
@@ -3498,6 +3506,7 @@ EXPORTS
     ?IsFlat@CordRepBtree@cord_internal@absl@@QEBA_N_K0PEAV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
     ?IsFull@container_internal@absl@@YA_NW4ctrl_t@12@@Z
     ?IsHashtablezEnabled@container_internal@absl@@YA_NXZ
+    ?IsHeld@SpinLock@base_internal@absl@@QEBA_NXZ
     ?IsImmortal@RefcountAndFlags@cord_internal@absl@@QEBA_NXZ
     ?IsInfiniteDuration@time_internal@absl@@YA_NVDuration@2@@Z
     ?IsInitialized@log_internal@absl@@YA_NXZ
@@ -3601,6 +3610,7 @@ EXPORTS
     ?MaskEmpty@GroupAArch64Impl@container_internal@absl@@QEBA@XZ
     ?MaskEmptyOrDeleted@GroupPortableImpl@container_internal@absl@@QEBA@XZ
     ?MaskFull@GroupPortableImpl@container_internal@absl@@QEBA@XZ
+    ?MaskNonFull@GroupAArch64Impl@container_internal@absl@@QEBA@XZ
     ?Match@GroupAArch64Impl@container_internal@absl@@QEBA@E@Z
     ?MatchesConversions@ParsedFormatBase@str_format_internal@absl@@AEBA_N_NV?$initializer_list@W4FormatConversionCharSet@absl@@@std@@@Z
     ?MaxFlatLength@CordTestAccess@strings_internal@absl@@SA_KXZ
@@ -3656,7 +3666,7 @@ EXPORTS
     ?NextCapacity@container_internal@absl@@YA_K_K@Z
     ?NextGeneration@container_internal@absl@@YAEE@Z
     ?NextRandom@ExponentialBiased@profiling_internal@absl@@SA_K_K@Z
-    ?NextSeedBaseNumber@container_internal@absl@@YA_KXZ
+    ?NextSeed@container_internal@absl@@YAGXZ
     ?NextTransition@Impl@time_zone@cctz@time_internal@absl@@QEBA_NAEBV?$time_point@Vsystem_clock@chrono@__Cr@std@@V?$duration@_JV?$ratio@$00$00@__Cr@std@@@234@@chrono@__Cr@std@@PEAUcivil_transition@2345@@Z
     ?NextTransition@TimeZone@absl@@QEBA_NVTime@2@PEAUCivilTransition@12@@Z
     ?NextTransition@TimeZoneInfo@cctz@time_internal@absl@@UEBA_NAEBV?$time_point@Vsystem_clock@chrono@__Cr@std@@V?$duration@_JV?$ratio@$00$00@__Cr@std@@@234@@chrono@__Cr@std@@PEAUcivil_transition@time_zone@234@@Z
@@ -3731,7 +3741,6 @@ EXPORTS
     ?Post@StdcppWaiter@synchronization_internal@absl@@QEAAXXZ
     ?Post@Win32Waiter@synchronization_internal@absl@@QEAAXXZ
     ?PrepareForSampling@HashtablezInfo@container_internal@absl@@QEAAX_J_K11G@Z
-    ?PrepareInsertAfterSoo@container_internal@absl@@YA_K_K0AEAVCommonFields@12@@Z
     ?PrepareInsertCommon@container_internal@absl@@YAXAEAVCommonFields@12@@Z
     ?PrepareInsertNonSoo@container_internal@absl@@YA_KAEAVCommonFields@12@AEBUPolicyFunctions@12@_KUFindInfo@12@@Z
     ?PrepareToDie@LogMessage@log_internal@absl@@AEAAXXZ
@@ -3751,6 +3760,7 @@ EXPORTS
     ?PrevTransition@TimeZone@absl@@QEBA_NVTime@2@PEAUCivilTransition@12@@Z
     ?PrevTransition@TimeZoneInfo@cctz@time_internal@absl@@UEBA_NAEBV?$time_point@Vsystem_clock@chrono@__Cr@std@@V?$duration@_JV?$ratio@$00$00@__Cr@std@@@234@@chrono@__Cr@std@@PEAUcivil_transition@time_zone@234@@Z
     ?PrevTransition@TimeZoneLibC@cctz@time_internal@absl@@UEBA_NAEBV?$time_point@Vsystem_clock@chrono@__Cr@std@@V?$duration@_JV?$ratio@$00$00@__Cr@std@@@234@@chrono@__Cr@std@@PEAUcivil_transition@time_zone@234@@Z
+    ?PreviousCapacity@container_internal@absl@@YA_K_K@Z
     ?Print@Streamable@str_format_internal@absl@@QEBAAEAV?$basic_ostream@DU?$char_traits@D@__Cr@std@@@__Cr@std@@AEAV456@@Z
     ?ProgramInvocationName@flags_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@XZ
     ?ProgramUsageMessage@absl@@YA?AV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@XZ
@@ -3842,13 +3852,11 @@ EXPORTS
     ?RepToPointer@Status@absl@@CAPEBVStatusRep@status_internal@2@_K@Z
     ?ReportUnrecognizedFlags@absl@@YAXAEBV?$vector@UUnrecognizedFlag@absl@@V?$allocator@UUnrecognizedFlag@absl@@@__Cr@std@@@__Cr@std@@@Z
     ?ReportUsageError@flags_internal@absl@@YAXV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@_N@Z
-    ?ReserveAllocatedTable@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@_K@Z
     ?ReserveEmptyNonAllocatedTableToFitBucketCount@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@_K@Z
-    ?ReserveEmptyNonAllocatedTableToFitNewSize@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@_K@Z
+    ?ReserveTableToFitNewSize@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@_K@Z
     ?Reset@?$AllocationTransaction@V?$allocator@PEAUCordRep@cord_internal@absl@@@__Cr@std@@@inlined_vector_internal@absl@@AEAAXXZ
     ?Reset@?$AllocationTransaction@V?$allocator@PEAVLogSink@absl@@@__Cr@std@@@inlined_vector_internal@absl@@AEAAXXZ
     ?Reset@?$AllocationTransaction@V?$allocator@UPayload@status_internal@absl@@@__Cr@std@@@inlined_vector_internal@absl@@AEAAXXZ
-    ?ResetCtrl@container_internal@absl@@YAXAEAVCommonFields@12@_K@Z
     ?ResetToBuiltinUTC@TimeZoneInfo@cctz@time_internal@absl@@AEAA_NAEBV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@__Cr@std@@@Z
     ?ResetToEmpty@InlineRep@Cord@absl@@AEAAXXZ
     ?Resize@?$ResizeUninitializedTraits@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@X@strings_internal@absl@@SAXPEAV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@_K@Z
@@ -3951,7 +3959,7 @@ EXPORTS
     ?ShiftLeft@?$BigUnsigned@$03@strings_internal@absl@@QEAAXH@Z
     ?ShiftLeft@?$BigUnsigned@$0FE@@strings_internal@absl@@QEAAXH@Z
     ?ShortProgramInvocationName@flags_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@XZ
-    ?ShouldInsertBackwardsForDebug@container_internal@absl@@YA_N_K0VPerTableSeed@12@@Z
+    ?ShouldFixUpStack@internal_stacktrace@absl@@YA_NXZ
     ?ShouldLog@LogEveryNSecState@log_internal@absl@@QEAA_NN@Z
     ?ShouldLog@LogEveryNState@log_internal@absl@@QEAA_NH@Z
     ?ShouldLog@LogEveryPow2State@log_internal@absl@@QEAA_NXZ
@@ -3978,6 +3986,7 @@ EXPORTS
     ?SingleArgStrCat@strings_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@_J@Z
     ?SingleArgStrCat@strings_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@_K@Z
     ?SixDigitsToBuffer@numbers_internal@absl@@YA_KNPEAD@Z
+    ?SizeToCapacity@container_internal@absl@@YA_K_K@Z
     ?Sizeof@flags_internal@absl@@YA_KP6APEAXW4FlagOp@12@PEBXPEAX2@Z@Z
     ?SizeofCordRepExternal@CordTestAccess@strings_internal@absl@@SA_KXZ
     ?SizeofCordRepSubstring@CordTestAccess@strings_internal@absl@@SA_KXZ
@@ -4769,6 +4778,7 @@ EXPORTS
     ?combine@?$HashStateBase@VMixingHashState@hash_internal@absl@@@hash_internal@absl@@SA?AVMixingHashState@23@V423@@Z
     ?combine_contiguous@MixingHashState@hash_internal@absl@@SA?AV123@V123@PEBE_K@Z
     ?combine_raw@MixingHashState@hash_internal@absl@@CA?AV123@V123@_K@Z
+    ?combine_weakly_mixed_integer@MixingHashState@hash_internal@absl@@CA?AV123@V123@UWeaklyMixedInteger@23@@Z
     ?common@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEAAAEAVCommonFields@23@XZ
     ?common@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEBAAEBVCommonFields@23@XZ
     ?compare_exchange_strong@?$__atomic_base@PEAVTimeZone@absl@@$0A@@__Cr@std@@QEAA_NAEAPEAVTimeZone@absl@@PEAV45@W4memory_order@23@2@Z
@@ -4958,8 +4968,7 @@ EXPORTS
     ?external@CordRep@cord_internal@absl@@QEBAPEBUCordRepExternal@23@XZ
     ?fetch_add_end@CordRepBtree@cord_internal@absl@@AEAA_K_K@Z
     ?find@?$unordered_map@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@U?$hash@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@U?$equal_to@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@@23@@__Cr@std@@QEAA?AV?$__hash_map_iterator@V?$__hash_iterator@PEAU?$__hash_node@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@PEAX@__Cr@std@@@__Cr@std@@@23@AEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@23@@Z
-    ?find_first_non_full_outofline@container_internal@absl@@YA?AUFindInfo@12@AEBVCommonFields@12@_K@Z
-    ?find_new_positions_and_transfer_slots_fn@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@CA_KAEAVCommonFields@23@PEAW4ctrl_t@23@PEAX_K@Z
+    ?find_first_non_full@container_internal@absl@@YA?AUFindInfo@12@AEBVCommonFields@12@_K@Z
     ?fits_in_soo@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEBA_N_K@Z
     ?fixed_time_zone@cctz@time_internal@absl@@YA?AVtime_zone@123@AEBV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@__Cr@std@@@Z
     ?flat@CordRep@cord_internal@absl@@QEAAPEAUCordRepFlat@23@XZ
@@ -4990,6 +4999,7 @@ EXPORTS
     ?get@?$Storage@PEAUPayload@status_internal@absl@@$00$0A@@internal_compressed_tuple@container_internal@absl@@QEGAAAEAPEAUPayload@status_internal@4@XZ
     ?get@?$Storage@UStringEq@container_internal@absl@@$01$00@internal_compressed_tuple@container_internal@absl@@QEGAAAEAUStringEq@34@XZ
     ?get@?$Storage@UStringHash@container_internal@absl@@$00$00@internal_compressed_tuple@container_internal@absl@@QEGAAAEAUStringHash@34@XZ
+    ?get@?$Storage@UStringHash@container_internal@absl@@$00$00@internal_compressed_tuple@container_internal@absl@@QEGBAAEBUStringHash@34@XZ
     ?get@?$Storage@V?$allocator@D@__Cr@std@@$00$00@internal_compressed_tuple@container_internal@absl@@QEGAAAEAV?$allocator@D@__Cr@std@@XZ
     ?get@?$Storage@V?$allocator@D@__Cr@std@@$02$00@internal_compressed_tuple@container_internal@absl@@QEGAAAEAV?$allocator@D@__Cr@std@@XZ
     ?get@?$Storage@V?$allocator@PEAUCordRep@cord_internal@absl@@@__Cr@std@@$0A@$00@internal_compressed_tuple@container_internal@absl@@QEGAAAEAV?$allocator@PEAUCordRep@cord_internal@absl@@@__Cr@std@@XZ
@@ -5057,7 +5067,9 @@ EXPORTS
     ?has_zero_flag@FormatConversionSpecImpl@str_format_internal@absl@@QEBA_NXZ
     ?hash_function@?$__hash_table@PEBUCordRep@cord_internal@absl@@U?$hash@PEBUCordRep@cord_internal@absl@@@__Cr@std@@U?$equal_to@PEBUCordRep@cord_internal@absl@@@56@V?$allocator@PEBUCordRep@cord_internal@absl@@@56@@__Cr@std@@QEAAAEAU?$hash@PEBUCordRep@cord_internal@absl@@@23@XZ
     ?hash_function@?$__hash_table@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@V?$__unordered_map_hasher@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@23@U?$hash@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@U?$equal_to@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@V?$__unordered_map_equal@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@23@U?$equal_to@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@U?$hash@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@V?$allocator@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@@23@@__Cr@std@@QEAAAEAV?$__unordered_map_hasher@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@23@U?$hash@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@U?$equal_to@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@XZ
+    ?hash_of@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEBA_KPEAT?$map_slot_type@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@23@@Z
     ?hash_ref@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEAAAEAUStringHash@23@XZ
+    ?hash_ref@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEBAAEBUStringHash@23@XZ
     ?height@CordRepBtree@cord_internal@absl@@QEBAHXZ
     ?hour@?$civil_time@Uhour_tag@detail@cctz@time_internal@absl@@@detail@cctz@time_internal@absl@@QEBAHXZ
     ?hour@?$civil_time@Usecond_tag@detail@cctz@time_internal@absl@@@detail@cctz@time_internal@absl@@QEBAHXZ
@@ -5087,7 +5099,6 @@ EXPORTS
     ?is_relative_timeout@KernelTimeout@synchronization_internal@absl@@QEBA_NXZ
     ?is_short@Rep@CordBuffer@absl@@QEBA_NXZ
     ?is_single_group@container_internal@absl@@YA_N_K@Z
-    ?is_small@container_internal@absl@@YA_N_K@Z
     ?is_snapshot@CordzHandle@cord_internal@absl@@QEBA_NXZ
     ?is_soo@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEBA_NXZ
     ?is_tree@InlineData@cord_internal@absl@@QEBA_NXZ
@@ -5187,7 +5198,8 @@ EXPORTS
     ?prev_transition@time_zone@cctz@time_internal@absl@@QEBA_NAEBV?$time_point@Vsystem_clock@chrono@__Cr@std@@V?$duration@_JV?$ratio@$00$00@__Cr@std@@@234@@chrono@__Cr@std@@PEAUcivil_transition@1234@@Z
     ?prev_weekday@detail@cctz@time_internal@absl@@YA?AV?$civil_time@Uday_tag@detail@cctz@time_internal@absl@@@1234@V51234@W4weekday@1234@@Z
     ?probe@container_internal@absl@@YA?AV?$probe_seq@$07@12@AEBVCommonFields@12@_K@Z
-    ?probe@container_internal@absl@@YA?AV?$probe_seq@$07@12@VPerTableSeed@12@_K_K@Z
+    ?probe@container_internal@absl@@YA?AV?$probe_seq@$07@12@VPerTableSeed@12@_K1@Z
+    ?probe@container_internal@absl@@YA?AV?$probe_seq@$07@12@_K0@Z
     ?push_back@?$InlinedVector@PEAUCordRep@cord_internal@absl@@$01V?$allocator@PEAUCordRep@cord_internal@absl@@@__Cr@std@@@absl@@QEAAXAEBQEAUCordRep@cord_internal@2@@Z
     ?push_back@?$InlinedVector@PEAVLogSink@absl@@$0BA@V?$allocator@PEAVLogSink@absl@@@__Cr@std@@@absl@@QEAAXAEBQEAVLogSink@2@@Z
     ?push_back@?$InlinedVector@UPayload@status_internal@absl@@$00V?$allocator@UPayload@status_internal@absl@@@__Cr@std@@@absl@@QEAAX$$QEAUPayload@status_internal@2@@Z
@@ -5254,7 +5266,6 @@ EXPORTS
     ?reset_reserved_growth@CommonFieldsGenerationInfoDisabled@container_internal@absl@@QEAAX_K0@Z
     ?resize@?$vector@UTransition@cctz@time_internal@absl@@V?$allocator@UTransition@cctz@time_internal@absl@@@__Cr@std@@@__Cr@std@@QEAAX_K@Z
     ?resize@?$vector@UTransitionType@cctz@time_internal@absl@@V?$allocator@UTransitionType@cctz@time_internal@absl@@@__Cr@std@@@__Cr@std@@QEAAX_K@Z
-    ?resize_full_soo_table_to_next_capacity@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEAAXXZ
     ?safe_strto128_base@numbers_internal@absl@@YA_NV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVint128@2@H@Z
     ?safe_strto16_base@numbers_internal@absl@@YA_NV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAFH@Z
     ?safe_strto32_base@numbers_internal@absl@@YA_NV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAHH@Z
@@ -5413,6 +5424,7 @@ EXPORTS
     ?to_slot@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@CAPEAT?$map_slot_type@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@23@PEAX@Z
     ?total_written@BufferRawSink@str_format_internal@absl@@QEBA_KXZ
     ?transfer@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEAAXPEAT?$map_slot_type@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@23@0@Z
+    ?transfer_unprobed_elements_to_next_capacity_fn@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@CAXAEAVCommonFields@23@PEBW4ctrl_t@23@PEAX2P6AX2E_K3@Z@Z
     ?tree@InlineRep@Cord@absl@@QEBAPEAUCordRep@cord_internal@3@XZ
     ?tree@Rep@InlineData@cord_internal@absl@@QEBAPEAUCordRep@34@XZ
     ?type@ProtoField@log_internal@absl@@QEBA?AW4WireType@23@XZ
diff --git a/deps/v8/third_party/abseil-cpp/symbols_arm64_rel.def b/deps/v8/third_party/abseil-cpp/symbols_arm64_rel.def
index d1e4c945c13851..bf5ea2820ff881 100644
--- a/deps/v8/third_party/abseil-cpp/symbols_arm64_rel.def
+++ b/deps/v8/third_party/abseil-cpp/symbols_arm64_rel.def
@@ -98,11 +98,11 @@ EXPORTS
     ??$GenericCompare@HV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@absl@@YAHAEBVCord@0@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@_K@Z
     ??$GenericCompare@HVCord@absl@@@absl@@YAHAEBVCord@0@0_K@Z
     ??$GenericCompare@_NVCord@absl@@@absl@@YA_NAEBVCord@0@0_K@Z
-    ??$GrowFullSooTableToNextCapacity@$00$00@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
-    ??$GrowFullSooTableToNextCapacity@$03$00@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
-    ??$GrowFullSooTableToNextCapacity@$07$00@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
-    ??$GrowFullSooTableToNextCapacity@$0A@$0A@@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
-    ??$GrowFullSooTableToNextCapacity@$0BA@$00@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$00$00@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$03$00@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$07$00@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$0A@$0A@@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$0BA@$00@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
     ??$JoinAlgorithm@V?$__wrap_iter@PEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@__Cr@std@@X@strings_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$__wrap_iter@PEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@34@0V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@34@UNoFormatter@01@@Z
     ??$MakeCheckOpString@AEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@AEBV123@@log_internal@absl@@YAPEBDAEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@0PEBD@Z
     ??$MakeCheckOpString@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@AEBV123@@log_internal@absl@@YAPEBDAEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@0PEBD@Z
@@ -141,7 +141,8 @@ EXPORTS
     ??$StrCat@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@$$BY0LD@D@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@AEBVAlphaNum@0@0000AEBV123@AEAY0LD@$$CBD@Z
     ??$StrCat@_K@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@_K@Z
     ??$StrReplaceAll@V?$initializer_list@U?$pair@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V123@@__Cr@std@@@std@@@absl@@YAHAEBV?$initializer_list@U?$pair@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V123@@__Cr@std@@@std@@PEAV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@2@@Z
-    ??$TransferRelocatable@$0BI@@container_internal@absl@@YAXPEAX00_K@Z
+    ??$TransferNRelocatable@$0BI@@container_internal@absl@@YAXPEAX00_K@Z
+    ??$TryFindNewIndexWithoutProbing@X@container_internal@absl@@YA_K_K00PEAW4ctrl_t@01@0@Z
     ??$TypeErasedApplyToSlotFn@UStringHash@container_internal@absl@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@container_internal@absl@@YA_KPEBXPEAX@Z
     ??$UnparseFloatingPointVal@M@flags_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@M@Z
     ??$UnparseFloatingPointVal@N@flags_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@N@Z
@@ -188,7 +189,6 @@ EXPORTS
     ??$emplace_front@PEAPEBVImpl@time_zone@cctz@time_internal@absl@@@?$__split_buffer@PEAPEBVImpl@time_zone@cctz@time_internal@absl@@V?$allocator@PEAPEBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@@__Cr@std@@QEAAX$$QEAPEAPEBVImpl@time_zone@cctz@time_internal@absl@@@Z
     ??$emplace_front@PEAUPrefixCrc@CrcCordState@crc_internal@absl@@@?$__split_buffer@PEAUPrefixCrc@CrcCordState@crc_internal@absl@@V?$allocator@PEAUPrefixCrc@CrcCordState@crc_internal@absl@@@__Cr@std@@@__Cr@std@@QEAAX$$QEAPEAUPrefixCrc@CrcCordState@crc_internal@absl@@@Z
     ??$find@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@?$__hash_table@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@V?$__unordered_map_hasher@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@23@U?$hash@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@U?$equal_to@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@V?$__unordered_map_equal@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@23@U?$equal_to@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@U?$hash@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@V?$allocator@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@@23@@__Cr@std@@QEAA?AV?$__hash_iterator@PEAU?$__hash_node@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@PEAX@__Cr@std@@@12@AEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@12@@Z
-    ??$find_first_non_full@X@container_internal@absl@@YA?AUFindInfo@01@AEBVCommonFields@01@_K@Z
     ??0?$BigUnsigned@$03@strings_internal@absl@@QEAA@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
     ??0?$BigUnsigned@$03@strings_internal@absl@@QEAA@XZ
     ??0?$BigUnsigned@$03@strings_internal@absl@@QEAA@_K@Z
@@ -626,6 +626,7 @@ EXPORTS
     ?FindPath@GraphCycles@synchronization_internal@absl@@QEBAHUGraphId@23@0HQEAU423@@Z
     ?FiveToTheNth@?$BigUnsigned@$03@strings_internal@absl@@SA?AV123@H@Z
     ?FiveToTheNth@?$BigUnsigned@$0FE@@strings_internal@absl@@SA?AV123@H@Z
+    ?FixUpStack@internal_stacktrace@absl@@YAXPEAPEAXPEA_KPEAH_KAEA_K@Z
     ?FixedOffsetFromName@cctz@time_internal@absl@@YA_NAEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEAV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@56@@Z
     ?FixedOffsetToAbbr@cctz@time_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@AEBV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@56@@Z
     ?FixedOffsetToName@cctz@time_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@AEBV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@56@@Z
@@ -745,7 +746,6 @@ EXPORTS
     ?GetWord@?$BigUnsigned@$0FE@@strings_internal@absl@@QEBAIH@Z
     ?GlobalHashtablezSampler@container_internal@absl@@YAAEAV?$SampleRecorder@UHashtablezInfo@container_internal@absl@@@profiling_internal@2@XZ
     ?GlobalRegistry@FlagRegistry@flags_internal@absl@@SAAEAV123@XZ
-    ?GrowEmptySooTableToNextCapacityForceSampling@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@@Z
     ?GrowFullSooTableToNextCapacityForceSampling@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@@Z
     ?GuaranteedEqual@Condition@absl@@SA_NPEBV12@0@Z
     ?HandleInvalidStatusCtorArg@Helper@internal_statusor@absl@@SAXPEAVStatus@3@@Z
@@ -935,7 +935,6 @@ EXPORTS
     ?Post@StdcppWaiter@synchronization_internal@absl@@QEAAXXZ
     ?Post@Win32Waiter@synchronization_internal@absl@@QEAAXXZ
     ?PrepareForSampling@HashtablezInfo@container_internal@absl@@QEAAX_J_K11G@Z
-    ?PrepareInsertAfterSoo@container_internal@absl@@YA_K_K0AEAVCommonFields@12@@Z
     ?PrepareInsertNonSoo@container_internal@absl@@YA_KAEAVCommonFields@12@AEBUPolicyFunctions@12@_KUFindInfo@12@@Z
     ?PrepareToDie@LogMessage@log_internal@absl@@AEAAXXZ
     ?PrepareToModify@Status@absl@@CAPEAVStatusRep@status_internal@2@_K@Z
@@ -1014,9 +1013,8 @@ EXPORTS
     ?RemoveSuffix@CordRepBtree@cord_internal@absl@@SAPEAUCordRep@23@PEAV123@_K@Z
     ?ReportUnrecognizedFlags@absl@@YAXAEBV?$vector@UUnrecognizedFlag@absl@@V?$allocator@UUnrecognizedFlag@absl@@@__Cr@std@@@__Cr@std@@@Z
     ?ReportUsageError@flags_internal@absl@@YAXV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@_N@Z
-    ?ReserveAllocatedTable@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@_K@Z
     ?ReserveEmptyNonAllocatedTableToFitBucketCount@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@_K@Z
-    ?ReserveEmptyNonAllocatedTableToFitNewSize@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@_K@Z
+    ?ReserveTableToFitNewSize@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@_K@Z
     ?ResetToBuiltinUTC@TimeZoneInfo@cctz@time_internal@absl@@AEAA_NAEBV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@__Cr@std@@@Z
     ?ResizeAllocatedTableWithSeedChange@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@_K@Z
     ?ResourceExhaustedError@absl@@YA?AVStatus@1@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
@@ -1072,7 +1070,7 @@ EXPORTS
     ?ShiftLeft@?$BigUnsigned@$03@strings_internal@absl@@QEAAXH@Z
     ?ShiftLeft@?$BigUnsigned@$0FE@@strings_internal@absl@@QEAAXH@Z
     ?ShortProgramInvocationName@flags_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@XZ
-    ?ShouldInsertBackwardsForDebug@container_internal@absl@@YA_N_K0VPerTableSeed@12@@Z
+    ?ShouldFixUpStack@internal_stacktrace@absl@@YA_NXZ
     ?ShouldLog@LogEveryNSecState@log_internal@absl@@QEAA_NN@Z
     ?ShouldLog@LogEveryNState@log_internal@absl@@QEAA_NH@Z
     ?ShouldLog@LogEveryPow2State@log_internal@absl@@QEAA_NXZ
@@ -1301,8 +1299,7 @@ EXPORTS
     ?destroy@?$__tree@U?$__value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$vector@PEBVCommandLineFlag@absl@@V?$allocator@PEBVCommandLineFlag@absl@@@__Cr@std@@@23@@__Cr@std@@V?$__map_value_compare@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$vector@PEBVCommandLineFlag@absl@@V?$allocator@PEBVCommandLineFlag@absl@@@__Cr@std@@@23@@23@U?$less@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@V?$allocator@U?$__value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$vector@PEBVCommandLineFlag@absl@@V?$allocator@PEBVCommandLineFlag@absl@@@__Cr@std@@@23@@__Cr@std@@@23@@__Cr@std@@AEAAXPEAV?$__tree_node@U?$__value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$vector@PEBVCommandLineFlag@absl@@V?$allocator@PEBVCommandLineFlag@absl@@@__Cr@std@@@23@@__Cr@std@@PEAX@23@@Z
     ?effective_impl@time_zone@cctz@time_internal@absl@@AEBAAEBVImpl@1234@XZ
     ?engines@?1??CrcAndCopy@CrcMemcpy@crc_internal@absl@@SA?AVcrc32c_t@4@PEIAXPEIBX_KV54@_N@Z@4UArchSpecificEngines@234@B
-    ?find_first_non_full_outofline@container_internal@absl@@YA?AUFindInfo@12@AEBVCommonFields@12@_K@Z
-    ?find_new_positions_and_transfer_slots_fn@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@CA_KAEAVCommonFields@23@PEAW4ctrl_t@23@PEAX_K@Z
+    ?find_first_non_full@container_internal@absl@@YA?AUFindInfo@12@AEBVCommonFields@12@_K@Z
     ?fixed_time_zone@cctz@time_internal@absl@@YA?AVtime_zone@123@AEBV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@__Cr@std@@@Z
     ?format@detail@cctz@time_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@AEBV567@AEBV?$time_point@Vsystem_clock@chrono@__Cr@std@@V?$duration@_JV?$ratio@$00$00@__Cr@std@@@234@@chrono@67@AEBV?$duration@_JV?$ratio@$00$0DINHOKEMGIAAA@@__Cr@std@@@967@AEBVtime_zone@234@@Z
     ?from_chars@absl@@YA?AUfrom_chars_result@1@PEBD0AEAMW4chars_format@1@@Z
@@ -1349,6 +1346,7 @@ EXPORTS
     ?size@Cord@absl@@QEBA_KXZ
     ?status@BadStatusOrAccess@absl@@QEBAAEBVStatus@2@XZ
     ?stream@OstreamView@LogMessage@log_internal@absl@@QEAAAEAV?$basic_ostream@DU?$char_traits@D@__Cr@std@@@__Cr@std@@XZ
+    ?transfer_unprobed_elements_to_next_capacity_fn@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@CAXAEAVCommonFields@23@PEBW4ctrl_t@23@PEAX2P6AX2E_K3@Z@Z
     ?utc_time_zone@cctz@time_internal@absl@@YA?AVtime_zone@123@XZ
     ?version@time_zone@cctz@time_internal@absl@@QEBA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@XZ
     ?what@BadStatusOrAccess@absl@@UEBAPEBDXZ
diff --git a/deps/v8/third_party/abseil-cpp/symbols_x64_dbg.def b/deps/v8/third_party/abseil-cpp/symbols_x64_dbg.def
index aa4c03949adf00..671dcf3ffb874e 100644
--- a/deps/v8/third_party/abseil-cpp/symbols_x64_dbg.def
+++ b/deps/v8/third_party/abseil-cpp/symbols_x64_dbg.def
@@ -491,19 +491,19 @@ EXPORTS
     ??$FastIntToBuffer@J@numbers_internal@absl@@YAPEADJPEAD@Z
     ??$FastIntToBuffer@K@numbers_internal@absl@@YAPEADKPEAD@Z
     ??$FastIntToBuffer@_W@numbers_internal@absl@@YAPEAD_WPEAD@Z
-    ??$FastTypeId@F@base_internal@absl@@YAPEBXXZ
-    ??$FastTypeId@G@base_internal@absl@@YAPEBXXZ
-    ??$FastTypeId@H@base_internal@absl@@YAPEBXXZ
-    ??$FastTypeId@I@base_internal@absl@@YAPEBXXZ
-    ??$FastTypeId@J@base_internal@absl@@YAPEBXXZ
-    ??$FastTypeId@K@base_internal@absl@@YAPEBXXZ
-    ??$FastTypeId@M@base_internal@absl@@YAPEBXXZ
-    ??$FastTypeId@N@base_internal@absl@@YAPEBXXZ
-    ??$FastTypeId@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@base_internal@absl@@YAPEBXXZ
-    ??$FastTypeId@V?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@@base_internal@absl@@YAPEBXXZ
-    ??$FastTypeId@_J@base_internal@absl@@YAPEBXXZ
-    ??$FastTypeId@_K@base_internal@absl@@YAPEBXXZ
-    ??$FastTypeId@_N@base_internal@absl@@YAPEBXXZ
+    ??$FastTypeId@F@absl@@YAPEBXXZ
+    ??$FastTypeId@G@absl@@YAPEBXXZ
+    ??$FastTypeId@H@absl@@YAPEBXXZ
+    ??$FastTypeId@I@absl@@YAPEBXXZ
+    ??$FastTypeId@J@absl@@YAPEBXXZ
+    ??$FastTypeId@K@absl@@YAPEBXXZ
+    ??$FastTypeId@M@absl@@YAPEBXXZ
+    ??$FastTypeId@N@absl@@YAPEBXXZ
+    ??$FastTypeId@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@absl@@YAPEBXXZ
+    ??$FastTypeId@V?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@@absl@@YAPEBXXZ
+    ??$FastTypeId@_J@absl@@YAPEBXXZ
+    ??$FastTypeId@_K@absl@@YAPEBXXZ
+    ??$FastTypeId@_N@absl@@YAPEBXXZ
     ??$FindSubstitutions@V?$initializer_list@U?$pair@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V123@@__Cr@std@@@std@@@strings_internal@absl@@YA?AV?$vector@UViableSubstitution@strings_internal@absl@@V?$allocator@UViableSubstitution@strings_internal@absl@@@__Cr@std@@@__Cr@std@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@34@AEBV?$initializer_list@U?$pair@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V123@@__Cr@std@@@4@@Z
     ??$FlagOps@V?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@@flags_internal@absl@@YAPEAXW4FlagOp@01@PEBXPEAX2@Z
     ??$Flush@V?$basic_ostream@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@FormatRawSinkImpl@str_format_internal@absl@@CAXPEAXV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
@@ -540,11 +540,11 @@ EXPORTS
     ??$GetDataImpl@V?$Span@I@absl@@@span_internal@absl@@YAPEAIAEAV?$Span@I@1@D@Z
     ??$GetDataImpl@V?$vector@PEAVLogSink@absl@@V?$allocator@PEAVLogSink@absl@@@__Cr@std@@@__Cr@std@@@span_internal@absl@@YAPEAPEAVLogSink@1@AEAV?$vector@PEAVLogSink@absl@@V?$allocator@PEAVLogSink@absl@@@__Cr@std@@@__Cr@std@@D@Z
     ??$GetFlag@V?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@@absl@@YA?AV?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@AEBV?$Flag@V?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@@flags_internal@0@@Z
-    ??$GrowFullSooTableToNextCapacity@$00$00@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
-    ??$GrowFullSooTableToNextCapacity@$03$00@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
-    ??$GrowFullSooTableToNextCapacity@$07$00@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
-    ??$GrowFullSooTableToNextCapacity@$0A@$0A@@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
-    ??$GrowFullSooTableToNextCapacity@$0BA@$00@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$00$00@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$03$00@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$07$00@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$0A@$0A@@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$0BA@$00@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
     ??$HashOf@$S$$ZV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@H@absl@@YA_KAEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@AEBH@Z
     ??$HashOf@$S$$Z_K@absl@@YA_KAEB_K@Z
     ??$HidePtr@$$CBX@base_internal@absl@@YA_KPEBX@Z
@@ -569,6 +569,7 @@ EXPORTS
     ??$IntegerToString@K@strings_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@K@Z
     ??$IntegerToString@_J@strings_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@_J@Z
     ??$IntegerToString@_K@strings_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@_K@Z
+    ??$Invoke@VMixingHashState@hash_internal@absl@@@WeaklyMixedIntegerProbe@HashSelect@hash_internal@absl@@SA?AVMixingHashState@23@V423@UWeaklyMixedInteger@23@@Z
     ??$Invoke@VMixingHashState@hash_internal@absl@@H@UniquelyRepresentedProbe@HashSelect@hash_internal@absl@@SA?AVMixingHashState@23@V423@AEBH@Z
     ??$Invoke@VMixingHashState@hash_internal@absl@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@HashValueProbe@HashSelect@hash_internal@absl@@SA?AVMixingHashState@23@V423@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
     ??$Invoke@VMixingHashState@hash_internal@absl@@V?$tuple@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@AEBH@__Cr@std@@@HashValueProbe@HashSelect@hash_internal@absl@@SA?AVMixingHashState@23@V423@AEBV?$tuple@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@AEBH@__Cr@std@@@Z
@@ -779,7 +780,8 @@ EXPORTS
     ??$TrailingZeros@G@container_internal@absl@@YAIG@Z
     ??$TrailingZeros@I@container_internal@absl@@YAII@Z
     ??$TrailingZeros@_K@container_internal@absl@@YAI_K@Z
-    ??$TransferRelocatable@$0BI@@container_internal@absl@@YAXPEAX00_K@Z
+    ??$TransferNRelocatable@$0BI@@container_internal@absl@@YAXPEAX00_K@Z
+    ??$TryFindNewIndexWithoutProbing@X@container_internal@absl@@YA_K_K00PEAW4ctrl_t@01@0@Z
     ??$TypeErasedApplyToSlotFn@UStringHash@container_internal@absl@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@container_internal@absl@@YA_KPEBXPEAX@Z
     ??$UnhidePtr@X@base_internal@absl@@YAPEAX_K@Z
     ??$Unparse@V?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@@flags_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@AEBV?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@34@@Z
@@ -1290,6 +1292,7 @@ EXPORTS
     ??$call_once@A6AXXZ$$V@absl@@YAXAEAVonce_flag@0@A6AXXZ@Z
     ??$call_once@P8FlagImpl@flags_internal@absl@@EAAXXZPEAV123@@absl@@YAXAEAVonce_flag@0@$$QEAP8FlagImpl@flags_internal@0@EAAXXZ$$QEAPEAV230@@Z
     ??$combine@H$$V@?$HashStateBase@VMixingHashState@hash_internal@absl@@@hash_internal@absl@@SA?AVMixingHashState@12@V312@AEBH@Z
+    ??$combine@UWeaklyMixedInteger@hash_internal@absl@@$$V@?$HashStateBase@VMixingHashState@hash_internal@absl@@@hash_internal@absl@@SA?AVMixingHashState@12@V312@AEBUWeaklyMixedInteger@12@@Z
     ??$combine@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@$$V@?$HashStateBase@VMixingHashState@hash_internal@absl@@@hash_internal@absl@@SA?AVMixingHashState@12@V312@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
     ??$combine@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@H@?$HashStateBase@VMixingHashState@hash_internal@absl@@@hash_internal@absl@@SA?AVMixingHashState@12@V312@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@AEBH@Z
     ??$combine@V?$tuple@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@AEBH@__Cr@std@@$$V@?$HashStateBase@VMixingHashState@hash_internal@absl@@@hash_internal@absl@@SA?AVMixingHashState@12@V312@AEBV?$tuple@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@AEBH@__Cr@std@@@Z
@@ -1462,7 +1465,6 @@ EXPORTS
     ??$find@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@?$__hash_table@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@V?$__unordered_map_hasher@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@23@U?$hash@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@U?$equal_to@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@V?$__unordered_map_equal@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@23@U?$equal_to@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@U?$hash@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@V?$allocator@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@@23@@__Cr@std@@QEAA?AV?$__hash_iterator@PEAU?$__hash_node@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@PEAX@__Cr@std@@@12@AEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@12@@Z
     ??$find@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@QEAA?AViterator@012@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
     ??$find@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@QEBA?AVconst_iterator@012@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
-    ??$find_first_non_full@X@container_internal@absl@@YA?AUFindInfo@01@AEBVCommonFields@01@_K@Z
     ??$find_non_soo@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEAA?AViterator@012@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@_K@Z
     ??$find_or_prepare_insert@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@IEAA?AU?$pair@Viterator@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@_N@__Cr@std@@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@45@@Z
     ??$find_or_prepare_insert_non_soo@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEAA?AU?$pair@Viterator@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@_N@__Cr@std@@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@45@@Z
@@ -1482,6 +1484,7 @@ EXPORTS
     ??$get@$00@?$CompressedTuple@V?$allocator@VFormatArgImpl@str_format_internal@absl@@@__Cr@std@@_K@container_internal@absl@@QEGAAAEA_KXZ
     ??$get@$00@?$CompressedTuple@V?$allocator@VFormatArgImpl@str_format_internal@absl@@@__Cr@std@@_K@container_internal@absl@@QEGBAAEB_KXZ
     ??$get@$00@?$CompressedTuple@VCommonFields@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@D@__Cr@std@@@container_internal@absl@@QEGAAAEAUStringHash@12@XZ
+    ??$get@$00@?$CompressedTuple@VCommonFields@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@D@__Cr@std@@@container_internal@absl@@QEGBAAEBUStringHash@12@XZ
     ??$get@$00@?$CompressedTuple@_KV?$allocator@D@__Cr@std@@@container_internal@absl@@QEGAAAEAV?$allocator@D@__Cr@std@@XZ
     ??$get@$00AEAPEAVCommandLineFlag@absl@@AEA_N@__Cr@std@@YAAEA_NAEAV?$tuple@AEAPEAVCommandLineFlag@absl@@AEA_N@01@@Z
     ??$get@$00PEAVCommandLineFlag@absl@@_N@__Cr@std@@YAAEA_NAEAV?$tuple@PEAVCommandLineFlag@absl@@_N@01@@Z
@@ -1511,6 +1514,7 @@ EXPORTS
     ??$hash_range_or_bytes@VMixingHashState@hash_internal@absl@@D@hash_internal@absl@@YA?AVMixingHashState@01@V201@PEBD_K@Z
     ??$hash_tuple@VMixingHashState@hash_internal@absl@@V?$tuple@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@AEBH@__Cr@std@@$0A@$00@hash_internal@absl@@YA?AVMixingHashState@01@V201@AEBV?$tuple@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@AEBH@__Cr@std@@U?$integer_sequence@_K$0A@$00@45@@Z
     ??$hash_tuple@VMixingHashState@hash_internal@absl@@V?$tuple@AEB_K@__Cr@std@@$0A@@hash_internal@absl@@YA?AVMixingHashState@01@V201@AEBV?$tuple@AEB_K@__Cr@std@@U?$integer_sequence@_K$0A@@45@@Z
+    ??$hash_weakly_mixed_integer@VMixingHashState@hash_internal@absl@@@hash_internal@absl@@YA?AVMixingHashState@01@V201@UWeaklyMixedInteger@01@@Z
     ??$insert@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@$0A@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@QEAA?AU?$pair@Viterator@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@_N@__Cr@std@@$$QEAU?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@45@@Z
     ??$insert@V?$__wrap_iter@PEAUraw_view@?1???R?$ConvertToContainer@V?$vector@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V?$allocator@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@23@@__Cr@std@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@23@$0A@@?$Splitter@VByChar@absl@@UAllowEmpty@2@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@strings_internal@absl@@QEBA?AV?$vector@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V?$allocator@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@23@@__Cr@std@@AEBV345@@Z@@__Cr@std@@$0A@@?$vector@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V?$allocator@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@23@@__Cr@std@@QEAA?AV?$__wrap_iter@PEAV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@12@V?$__wrap_iter@PEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@12@V?$__wrap_iter@PEAUraw_view@?1???R?$ConvertToContainer@V?$vector@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V?$allocator@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@23@@__Cr@std@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@23@$0A@@?$Splitter@VByChar@absl@@UAllowEmpty@2@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@strings_internal@absl@@QEBA?AV?$vector@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V?$allocator@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@23@@__Cr@std@@AEBV345@@Z@@12@1@Z
     ??$invoke@P8FlagImpl@flags_internal@absl@@EAAXXZPEAV123@@__Cr@std@@YAX$$QEAP8FlagImpl@flags_internal@absl@@EAAXXZ$$QEAPEAV234@@Z
@@ -1674,6 +1678,9 @@ EXPORTS
     ??0?$IteratorValueAdapter@V?$allocator@VFormatArgImpl@str_format_internal@absl@@@__Cr@std@@PEBVFormatArgImpl@str_format_internal@absl@@@inlined_vector_internal@absl@@QEAA@AEBQEBVFormatArgImpl@str_format_internal@2@@Z
     ??0?$NonIterableBitMask@G$0BA@$0A@@container_internal@absl@@QEAA@G@Z
     ??0?$NonIterableBitMask@_K$07$02@container_internal@absl@@QEAA@_K@Z
+    ??0?$ProbedItemImpl@I$0CA@@container_internal@absl@@QEAA@E_K0@Z
+    ??0?$ProbedItemImpl@_K$0EA@@container_internal@absl@@QEAA@E_K0@Z
+    ??0?$ProbedItemImpl@_K$0HK@@container_internal@absl@@QEAA@E_K0@Z
     ??0?$Sample@UHashtablezInfo@container_internal@absl@@@profiling_internal@absl@@QEAA@XZ
     ??0?$SampleRecorder@UHashtablezInfo@container_internal@absl@@@profiling_internal@absl@@QEAA@XZ
     ??0?$Span@$$CBD@absl@@QEAA@PEBD_K@Z
@@ -2623,7 +2630,6 @@ EXPORTS
     ??R<lambda_1>@?0??back@?$InlinedVector@PEAUCordRep@cord_internal@absl@@$01V?$allocator@PEAUCordRep@cord_internal@absl@@@__Cr@std@@@absl@@QEAAAEAPEAUCordRep@cord_internal@3@XZ@QEBA?A?<auto>@@XZ
     ??R<lambda_1>@?0??destroy@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEAAXPEAT?$map_slot_type@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@34@@Z@QEBA?A?<auto>@@XZ
     ??R<lambda_1>@?0??erase@?$InlinedVector@UPayload@status_internal@absl@@$00V?$allocator@UPayload@status_internal@absl@@@__Cr@std@@@absl@@QEAAPEAUPayload@status_internal@3@PEBU453@@Z@QEBA?A?<auto>@@XZ
-    ??R<lambda_1>@?0??find_new_positions_and_transfer_slots_fn@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@CA_KAEAVCommonFields@34@PEAW4ctrl_t@34@PEAX_K@Z@QEBA?A?<auto>@@PEAT?$map_slot_type@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@34@@Z
     ??R<lambda_1>@?0??inline_size@Rep@InlineData@cord_internal@absl@@QEBA_KXZ@QEBA?A?<auto>@@XZ
     ??R<lambda_1>@?0??pop_back@?$InlinedVector@PEAUCordRep@cord_internal@absl@@$01V?$allocator@PEAUCordRep@cord_internal@absl@@@__Cr@std@@@absl@@QEAAXXZ@QEBA?A?<auto>@@XZ
     ??R<lambda_1>@?0??remove_prefix@?$Span@$$CBD@absl@@QEAAX_K@Z@QEBA?A?<auto>@@XZ
@@ -2795,6 +2801,7 @@ EXPORTS
     ?AdvanceBytesBtree@ChunkIterator@Cord@absl@@AEAAX_K@Z
     ?AlignBegin@CordRepBtree@cord_internal@absl@@AEAAXXZ
     ?AlignEnd@CordRepBtree@cord_internal@absl@@AEAAXXZ
+    ?AlignUpTo@container_internal@absl@@YA_K_K0@Z
     ?Alloc@LowLevelAlloc@base_internal@absl@@SAPEAX_K@Z
     ?Alloc@flags_internal@absl@@YAPEAXP6APEAXW4FlagOp@12@PEBXPEAX2@Z@Z
     ?AllocWithArena@LowLevelAlloc@base_internal@absl@@SAPEAX_KPEAUArena@123@@Z
@@ -2848,6 +2855,7 @@ EXPORTS
     ?AsciiStrToUpper@ascii_internal@absl@@YAXPEADPEBD_K@Z
     ?AssertHeld@CordzInfo@cord_internal@absl@@QEAAXXZ
     ?AssertHeld@Mutex@absl@@QEBAXXZ
+    ?AssertHeld@SpinLock@base_internal@absl@@QEBAXXZ
     ?AssertInSooMode@CommonFields@container_internal@absl@@AEBAXXZ
     ?AssertIsFull@container_internal@absl@@YAXPEBW4ctrl_t@12@EPEBEPEBD@Z
     ?AssertIsValidForComparison@container_internal@absl@@YAXPEBW4ctrl_t@12@EPEBE@Z
@@ -2950,6 +2958,7 @@ EXPORTS
     ?Contains@Cord@absl@@QEBA_NV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
     ?Contains@str_format_internal@absl@@YA_NW4FormatConversionCharSet@2@D@Z
     ?Contains@str_format_internal@absl@@YA_NW4FormatConversionCharSet@2@W4FormatConversionChar@2@@Z
+    ?ControlOffset@container_internal@absl@@YA_K_N@Z
     ?ControlWord@base_internal@absl@@YAPEAU?$atomic@I@__Cr@std@@PEAVonce_flag@2@@Z
     ?ConvertBoolArg@str_format_internal@absl@@YA_N_NPEAVFormatSinkImpl@12@@Z
     ?ConvertDateTime@absl@@YA?AUTimeConversion@1@_JHHHHHVTimeZone@1@@Z
@@ -3179,6 +3188,7 @@ EXPORTS
     ?FindPath@GraphCycles@synchronization_internal@absl@@QEBAHUGraphId@23@0HQEAU423@@Z
     ?FiveToTheNth@?$BigUnsigned@$03@strings_internal@absl@@SA?AV123@H@Z
     ?FiveToTheNth@?$BigUnsigned@$0FE@@strings_internal@absl@@SA?AV123@H@Z
+    ?FixUpStack@internal_stacktrace@absl@@YAXPEAPEAXPEA_KPEAH_KAEA_K@Z
     ?FixedOffsetFromName@cctz@time_internal@absl@@YA_NAEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEAV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@56@@Z
     ?FixedOffsetToAbbr@cctz@time_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@AEBV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@56@@Z
     ?FixedOffsetToName@cctz@time_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@AEBV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@56@@Z
@@ -3318,6 +3328,7 @@ EXPORTS
     ?GetFlagsHelpMatchSubstr@flags_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@XZ
     ?GetFlagsHelpMode@flags_internal@absl@@YA?AW4HelpMode@12@XZ
     ?GetFlatAux@Cord@absl@@CA_NPEAUCordRep@cord_internal@2@PEAV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
+    ?GetGrowthInfoFromControl@container_internal@absl@@YAAEAVGrowthInfo@12@PEAW4ctrl_t@12@@Z
     ?GetGrowthLeft@GrowthInfo@container_internal@absl@@QEBA_KXZ
     ?GetHashtablezMaxSamples@container_internal@absl@@YA_KXZ
     ?GetHashtablezSampleParameter@container_internal@absl@@YAHXZ
@@ -3386,9 +3397,7 @@ EXPORTS
     ?GetYearDay@absl@@YAHV?$civil_time@Usecond_tag@time_internal@absl@@@detail@cctz@time_internal@1@@Z
     ?GlobalHashtablezSampler@container_internal@absl@@YAAEAV?$SampleRecorder@UHashtablezInfo@container_internal@absl@@@profiling_internal@2@XZ
     ?GlobalRegistry@FlagRegistry@flags_internal@absl@@SAAEAV123@XZ
-    ?GrowEmptySooTableToNextCapacityForceSampling@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@@Z
     ?GrowFullSooTableToNextCapacityForceSampling@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@@Z
-    ?GrowthToLowerboundCapacity@container_internal@absl@@YA_K_K@Z
     ?GuaranteedEqual@Condition@absl@@SA_NPEBV12@0@Z
     ?Guard@?$NullGuard@C@log_internal@absl@@SAAEBCAEBC@Z
     ?Guard@?$NullGuard@D@log_internal@absl@@SAAEBDAEBD@Z
@@ -3431,7 +3440,6 @@ EXPORTS
     ?HexStringToBytes@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@34@@Z
     ?HexStringToBytes@absl@@YA_NV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@34@@Z
     ?HideMask@base_internal@absl@@YA_KXZ
-    ?HighestBitSet@?$NonIterableBitMask@G$0BA@$0A@@container_internal@absl@@QEBAIXZ
     ?IDivDuration@absl@@YA_JVDuration@1@0PEAV21@@Z
     ?In@Time@absl@@QEBA?AUBreakdown@12@VTimeZone@2@@Z
     ?InMillisecondsFromNow@KernelTimeout@synchronization_internal@absl@@QEBAKXZ
@@ -3500,6 +3508,7 @@ EXPORTS
     ?IsFlat@CordRepBtree@cord_internal@absl@@QEBA_N_K0PEAV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
     ?IsFull@container_internal@absl@@YA_NW4ctrl_t@12@@Z
     ?IsHashtablezEnabled@container_internal@absl@@YA_NXZ
+    ?IsHeld@SpinLock@base_internal@absl@@QEBA_NXZ
     ?IsImmortal@RefcountAndFlags@cord_internal@absl@@QEBA_NXZ
     ?IsInfiniteDuration@time_internal@absl@@YA_NVDuration@2@@Z
     ?IsInitialized@log_internal@absl@@YA_NXZ
@@ -3605,6 +3614,7 @@ EXPORTS
     ?MaskEmptyOrDeleted@GroupSse2Impl@container_internal@absl@@QEBA?AV?$NonIterableBitMask@G$0BA@$0A@@23@XZ
     ?MaskFull@GroupPortableImpl@container_internal@absl@@QEBA@XZ
     ?MaskFull@GroupSse2Impl@container_internal@absl@@QEBA?AV?$BitMask@G$0BA@$0A@$0A@@23@XZ
+    ?MaskNonFull@GroupSse2Impl@container_internal@absl@@QEBA@XZ
     ?Match@GroupSse2Impl@container_internal@absl@@QEBA?AV?$BitMask@G$0BA@$0A@$0A@@23@E@Z
     ?MatchesConversions@ParsedFormatBase@str_format_internal@absl@@AEBA_N_NV?$initializer_list@W4FormatConversionCharSet@absl@@@std@@@Z
     ?MaxFlatLength@CordTestAccess@strings_internal@absl@@SA_KXZ
@@ -3660,7 +3670,7 @@ EXPORTS
     ?NextCapacity@container_internal@absl@@YA_K_K@Z
     ?NextGeneration@container_internal@absl@@YAEE@Z
     ?NextRandom@ExponentialBiased@profiling_internal@absl@@SA_K_K@Z
-    ?NextSeedBaseNumber@container_internal@absl@@YA_KXZ
+    ?NextSeed@container_internal@absl@@YAGXZ
     ?NextTransition@Impl@time_zone@cctz@time_internal@absl@@QEBA_NAEBV?$time_point@Vsystem_clock@chrono@__Cr@std@@V?$duration@_JV?$ratio@$00$00@__Cr@std@@@234@@chrono@__Cr@std@@PEAUcivil_transition@2345@@Z
     ?NextTransition@TimeZone@absl@@QEBA_NVTime@2@PEAUCivilTransition@12@@Z
     ?NextTransition@TimeZoneInfo@cctz@time_internal@absl@@UEBA_NAEBV?$time_point@Vsystem_clock@chrono@__Cr@std@@V?$duration@_JV?$ratio@$00$00@__Cr@std@@@234@@chrono@__Cr@std@@PEAUcivil_transition@time_zone@234@@Z
@@ -3735,7 +3745,6 @@ EXPORTS
     ?Post@StdcppWaiter@synchronization_internal@absl@@QEAAXXZ
     ?Post@Win32Waiter@synchronization_internal@absl@@QEAAXXZ
     ?PrepareForSampling@HashtablezInfo@container_internal@absl@@QEAAX_J_K11G@Z
-    ?PrepareInsertAfterSoo@container_internal@absl@@YA_K_K0AEAVCommonFields@12@@Z
     ?PrepareInsertCommon@container_internal@absl@@YAXAEAVCommonFields@12@@Z
     ?PrepareInsertNonSoo@container_internal@absl@@YA_KAEAVCommonFields@12@AEBUPolicyFunctions@12@_KUFindInfo@12@@Z
     ?PrepareToDie@LogMessage@log_internal@absl@@AEAAXXZ
@@ -3755,6 +3764,7 @@ EXPORTS
     ?PrevTransition@TimeZone@absl@@QEBA_NVTime@2@PEAUCivilTransition@12@@Z
     ?PrevTransition@TimeZoneInfo@cctz@time_internal@absl@@UEBA_NAEBV?$time_point@Vsystem_clock@chrono@__Cr@std@@V?$duration@_JV?$ratio@$00$00@__Cr@std@@@234@@chrono@__Cr@std@@PEAUcivil_transition@time_zone@234@@Z
     ?PrevTransition@TimeZoneLibC@cctz@time_internal@absl@@UEBA_NAEBV?$time_point@Vsystem_clock@chrono@__Cr@std@@V?$duration@_JV?$ratio@$00$00@__Cr@std@@@234@@chrono@__Cr@std@@PEAUcivil_transition@time_zone@234@@Z
+    ?PreviousCapacity@container_internal@absl@@YA_K_K@Z
     ?Print@Streamable@str_format_internal@absl@@QEBAAEAV?$basic_ostream@DU?$char_traits@D@__Cr@std@@@__Cr@std@@AEAV456@@Z
     ?ProgramInvocationName@flags_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@XZ
     ?ProgramUsageMessage@absl@@YA?AV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@XZ
@@ -3846,13 +3856,11 @@ EXPORTS
     ?RepToPointer@Status@absl@@CAPEBVStatusRep@status_internal@2@_K@Z
     ?ReportUnrecognizedFlags@absl@@YAXAEBV?$vector@UUnrecognizedFlag@absl@@V?$allocator@UUnrecognizedFlag@absl@@@__Cr@std@@@__Cr@std@@@Z
     ?ReportUsageError@flags_internal@absl@@YAXV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@_N@Z
-    ?ReserveAllocatedTable@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@_K@Z
     ?ReserveEmptyNonAllocatedTableToFitBucketCount@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@_K@Z
-    ?ReserveEmptyNonAllocatedTableToFitNewSize@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@_K@Z
+    ?ReserveTableToFitNewSize@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@_K@Z
     ?Reset@?$AllocationTransaction@V?$allocator@PEAUCordRep@cord_internal@absl@@@__Cr@std@@@inlined_vector_internal@absl@@AEAAXXZ
     ?Reset@?$AllocationTransaction@V?$allocator@PEAVLogSink@absl@@@__Cr@std@@@inlined_vector_internal@absl@@AEAAXXZ
     ?Reset@?$AllocationTransaction@V?$allocator@UPayload@status_internal@absl@@@__Cr@std@@@inlined_vector_internal@absl@@AEAAXXZ
-    ?ResetCtrl@container_internal@absl@@YAXAEAVCommonFields@12@_K@Z
     ?ResetToBuiltinUTC@TimeZoneInfo@cctz@time_internal@absl@@AEAA_NAEBV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@__Cr@std@@@Z
     ?ResetToEmpty@InlineRep@Cord@absl@@AEAAXXZ
     ?Resize@?$ResizeUninitializedTraits@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@X@strings_internal@absl@@SAXPEAV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@_K@Z
@@ -3955,7 +3963,7 @@ EXPORTS
     ?ShiftLeft@?$BigUnsigned@$03@strings_internal@absl@@QEAAXH@Z
     ?ShiftLeft@?$BigUnsigned@$0FE@@strings_internal@absl@@QEAAXH@Z
     ?ShortProgramInvocationName@flags_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@XZ
-    ?ShouldInsertBackwardsForDebug@container_internal@absl@@YA_N_K0VPerTableSeed@12@@Z
+    ?ShouldFixUpStack@internal_stacktrace@absl@@YA_NXZ
     ?ShouldLog@LogEveryNSecState@log_internal@absl@@QEAA_NN@Z
     ?ShouldLog@LogEveryNState@log_internal@absl@@QEAA_NH@Z
     ?ShouldLog@LogEveryPow2State@log_internal@absl@@QEAA_NXZ
@@ -3982,6 +3990,7 @@ EXPORTS
     ?SingleArgStrCat@strings_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@_J@Z
     ?SingleArgStrCat@strings_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@_K@Z
     ?SixDigitsToBuffer@numbers_internal@absl@@YA_KNPEAD@Z
+    ?SizeToCapacity@container_internal@absl@@YA_K_K@Z
     ?Sizeof@flags_internal@absl@@YA_KP6APEAXW4FlagOp@12@PEBXPEAX2@Z@Z
     ?SizeofCordRepExternal@CordTestAccess@strings_internal@absl@@SA_KXZ
     ?SizeofCordRepSubstring@CordTestAccess@strings_internal@absl@@SA_KXZ
@@ -4774,6 +4783,7 @@ EXPORTS
     ?combine@?$HashStateBase@VMixingHashState@hash_internal@absl@@@hash_internal@absl@@SA?AVMixingHashState@23@V423@@Z
     ?combine_contiguous@MixingHashState@hash_internal@absl@@SA?AV123@V123@PEBE_K@Z
     ?combine_raw@MixingHashState@hash_internal@absl@@CA?AV123@V123@_K@Z
+    ?combine_weakly_mixed_integer@MixingHashState@hash_internal@absl@@CA?AV123@V123@UWeaklyMixedInteger@23@@Z
     ?common@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEAAAEAVCommonFields@23@XZ
     ?common@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEBAAEBVCommonFields@23@XZ
     ?compare_exchange_strong@?$__atomic_base@PEAVTimeZone@absl@@$0A@@__Cr@std@@QEAA_NAEAPEAVTimeZone@absl@@PEAV45@W4memory_order@23@2@Z
@@ -4963,8 +4973,7 @@ EXPORTS
     ?external@CordRep@cord_internal@absl@@QEBAPEBUCordRepExternal@23@XZ
     ?fetch_add_end@CordRepBtree@cord_internal@absl@@AEAA_K_K@Z
     ?find@?$unordered_map@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@U?$hash@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@U?$equal_to@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@@23@@__Cr@std@@QEAA?AV?$__hash_map_iterator@V?$__hash_iterator@PEAU?$__hash_node@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@PEAX@__Cr@std@@@__Cr@std@@@23@AEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@23@@Z
-    ?find_first_non_full_outofline@container_internal@absl@@YA?AUFindInfo@12@AEBVCommonFields@12@_K@Z
-    ?find_new_positions_and_transfer_slots_fn@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@CA_KAEAVCommonFields@23@PEAW4ctrl_t@23@PEAX_K@Z
+    ?find_first_non_full@container_internal@absl@@YA?AUFindInfo@12@AEBVCommonFields@12@_K@Z
     ?fits_in_soo@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEBA_N_K@Z
     ?fixed_time_zone@cctz@time_internal@absl@@YA?AVtime_zone@123@AEBV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@__Cr@std@@@Z
     ?flat@CordRep@cord_internal@absl@@QEAAPEAUCordRepFlat@23@XZ
@@ -4995,6 +5004,7 @@ EXPORTS
     ?get@?$Storage@PEAUPayload@status_internal@absl@@$00$0A@@internal_compressed_tuple@container_internal@absl@@QEGAAAEAPEAUPayload@status_internal@4@XZ
     ?get@?$Storage@UStringEq@container_internal@absl@@$01$00@internal_compressed_tuple@container_internal@absl@@QEGAAAEAUStringEq@34@XZ
     ?get@?$Storage@UStringHash@container_internal@absl@@$00$00@internal_compressed_tuple@container_internal@absl@@QEGAAAEAUStringHash@34@XZ
+    ?get@?$Storage@UStringHash@container_internal@absl@@$00$00@internal_compressed_tuple@container_internal@absl@@QEGBAAEBUStringHash@34@XZ
     ?get@?$Storage@V?$allocator@D@__Cr@std@@$00$00@internal_compressed_tuple@container_internal@absl@@QEGAAAEAV?$allocator@D@__Cr@std@@XZ
     ?get@?$Storage@V?$allocator@D@__Cr@std@@$02$00@internal_compressed_tuple@container_internal@absl@@QEGAAAEAV?$allocator@D@__Cr@std@@XZ
     ?get@?$Storage@V?$allocator@PEAUCordRep@cord_internal@absl@@@__Cr@std@@$0A@$00@internal_compressed_tuple@container_internal@absl@@QEGAAAEAV?$allocator@PEAUCordRep@cord_internal@absl@@@__Cr@std@@XZ
@@ -5062,7 +5072,9 @@ EXPORTS
     ?has_zero_flag@FormatConversionSpecImpl@str_format_internal@absl@@QEBA_NXZ
     ?hash_function@?$__hash_table@PEBUCordRep@cord_internal@absl@@U?$hash@PEBUCordRep@cord_internal@absl@@@__Cr@std@@U?$equal_to@PEBUCordRep@cord_internal@absl@@@56@V?$allocator@PEBUCordRep@cord_internal@absl@@@56@@__Cr@std@@QEAAAEAU?$hash@PEBUCordRep@cord_internal@absl@@@23@XZ
     ?hash_function@?$__hash_table@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@V?$__unordered_map_hasher@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@23@U?$hash@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@U?$equal_to@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@V?$__unordered_map_equal@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@23@U?$equal_to@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@U?$hash@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@V?$allocator@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@@23@@__Cr@std@@QEAAAEAV?$__unordered_map_hasher@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@23@U?$hash@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@U?$equal_to@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@XZ
+    ?hash_of@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEBA_KPEAT?$map_slot_type@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@23@@Z
     ?hash_ref@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEAAAEAUStringHash@23@XZ
+    ?hash_ref@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEBAAEBUStringHash@23@XZ
     ?height@CordRepBtree@cord_internal@absl@@QEBAHXZ
     ?hour@?$civil_time@Uhour_tag@detail@cctz@time_internal@absl@@@detail@cctz@time_internal@absl@@QEBAHXZ
     ?hour@?$civil_time@Usecond_tag@detail@cctz@time_internal@absl@@@detail@cctz@time_internal@absl@@QEBAHXZ
@@ -5092,7 +5104,6 @@ EXPORTS
     ?is_relative_timeout@KernelTimeout@synchronization_internal@absl@@QEBA_NXZ
     ?is_short@Rep@CordBuffer@absl@@QEBA_NXZ
     ?is_single_group@container_internal@absl@@YA_N_K@Z
-    ?is_small@container_internal@absl@@YA_N_K@Z
     ?is_snapshot@CordzHandle@cord_internal@absl@@QEBA_NXZ
     ?is_soo@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEBA_NXZ
     ?is_tree@InlineData@cord_internal@absl@@QEBA_NXZ
@@ -5192,7 +5203,8 @@ EXPORTS
     ?prev_transition@time_zone@cctz@time_internal@absl@@QEBA_NAEBV?$time_point@Vsystem_clock@chrono@__Cr@std@@V?$duration@_JV?$ratio@$00$00@__Cr@std@@@234@@chrono@__Cr@std@@PEAUcivil_transition@1234@@Z
     ?prev_weekday@detail@cctz@time_internal@absl@@YA?AV?$civil_time@Uday_tag@detail@cctz@time_internal@absl@@@1234@V51234@W4weekday@1234@@Z
     ?probe@container_internal@absl@@YA?AV?$probe_seq@$0BA@@12@AEBVCommonFields@12@_K@Z
-    ?probe@container_internal@absl@@YA?AV?$probe_seq@$0BA@@12@VPerTableSeed@12@_K_K@Z
+    ?probe@container_internal@absl@@YA?AV?$probe_seq@$0BA@@12@VPerTableSeed@12@_K1@Z
+    ?probe@container_internal@absl@@YA?AV?$probe_seq@$0BA@@12@_K0@Z
     ?push_back@?$InlinedVector@PEAUCordRep@cord_internal@absl@@$01V?$allocator@PEAUCordRep@cord_internal@absl@@@__Cr@std@@@absl@@QEAAXAEBQEAUCordRep@cord_internal@2@@Z
     ?push_back@?$InlinedVector@PEAVLogSink@absl@@$0BA@V?$allocator@PEAVLogSink@absl@@@__Cr@std@@@absl@@QEAAXAEBQEAVLogSink@2@@Z
     ?push_back@?$InlinedVector@UPayload@status_internal@absl@@$00V?$allocator@UPayload@status_internal@absl@@@__Cr@std@@@absl@@QEAAX$$QEAUPayload@status_internal@2@@Z
@@ -5259,7 +5271,6 @@ EXPORTS
     ?reset_reserved_growth@CommonFieldsGenerationInfoDisabled@container_internal@absl@@QEAAX_K0@Z
     ?resize@?$vector@UTransition@cctz@time_internal@absl@@V?$allocator@UTransition@cctz@time_internal@absl@@@__Cr@std@@@__Cr@std@@QEAAX_K@Z
     ?resize@?$vector@UTransitionType@cctz@time_internal@absl@@V?$allocator@UTransitionType@cctz@time_internal@absl@@@__Cr@std@@@__Cr@std@@QEAAX_K@Z
-    ?resize_full_soo_table_to_next_capacity@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEAAXXZ
     ?safe_strto128_base@numbers_internal@absl@@YA_NV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVint128@2@H@Z
     ?safe_strto16_base@numbers_internal@absl@@YA_NV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAFH@Z
     ?safe_strto32_base@numbers_internal@absl@@YA_NV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAHH@Z
@@ -5418,6 +5429,7 @@ EXPORTS
     ?to_slot@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@CAPEAT?$map_slot_type@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@23@PEAX@Z
     ?total_written@BufferRawSink@str_format_internal@absl@@QEBA_KXZ
     ?transfer@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEAAXPEAT?$map_slot_type@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@23@0@Z
+    ?transfer_unprobed_elements_to_next_capacity_fn@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@CAXAEAVCommonFields@23@PEBW4ctrl_t@23@PEAX2P6AX2E_K3@Z@Z
     ?tree@InlineRep@Cord@absl@@QEBAPEAUCordRep@cord_internal@3@XZ
     ?tree@Rep@InlineData@cord_internal@absl@@QEBAPEAUCordRep@34@XZ
     ?type@ProtoField@log_internal@absl@@QEBA?AW4WireType@23@XZ
diff --git a/deps/v8/third_party/abseil-cpp/symbols_x64_rel.def b/deps/v8/third_party/abseil-cpp/symbols_x64_rel.def
index a26925fe173c18..ace092166f548c 100644
--- a/deps/v8/third_party/abseil-cpp/symbols_x64_rel.def
+++ b/deps/v8/third_party/abseil-cpp/symbols_x64_rel.def
@@ -98,11 +98,11 @@ EXPORTS
     ??$GenericCompare@HV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@absl@@YAHAEBVCord@0@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@_K@Z
     ??$GenericCompare@HVCord@absl@@@absl@@YAHAEBVCord@0@0_K@Z
     ??$GenericCompare@_NVCord@absl@@@absl@@YA_NAEBVCord@0@0_K@Z
-    ??$GrowFullSooTableToNextCapacity@$00$00@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
-    ??$GrowFullSooTableToNextCapacity@$03$00@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
-    ??$GrowFullSooTableToNextCapacity@$07$00@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
-    ??$GrowFullSooTableToNextCapacity@$0A@$0A@@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
-    ??$GrowFullSooTableToNextCapacity@$0BA@$00@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$00$00@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$03$00@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$07$00@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$0A@$0A@@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$0BA@$00@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
     ??$JoinAlgorithm@V?$__wrap_iter@PEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@__Cr@std@@X@strings_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$__wrap_iter@PEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@34@0V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@34@UNoFormatter@01@@Z
     ??$MakeCheckOpString@AEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@AEBV123@@log_internal@absl@@YAPEBDAEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@0PEBD@Z
     ??$MakeCheckOpString@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@AEBV123@@log_internal@absl@@YAPEBDAEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@0PEBD@Z
@@ -142,7 +142,8 @@ EXPORTS
     ??$StrCat@_K@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@_K@Z
     ??$StrReplaceAll@V?$initializer_list@U?$pair@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V123@@__Cr@std@@@std@@@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@23@AEBV?$initializer_list@U?$pair@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V123@@__Cr@std@@@3@@Z
     ??$StrReplaceAll@V?$initializer_list@U?$pair@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V123@@__Cr@std@@@std@@@absl@@YAHAEBV?$initializer_list@U?$pair@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V123@@__Cr@std@@@std@@PEAV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@2@@Z
-    ??$TransferRelocatable@$0BI@@container_internal@absl@@YAXPEAX00_K@Z
+    ??$TransferNRelocatable@$0BI@@container_internal@absl@@YAXPEAX00_K@Z
+    ??$TryFindNewIndexWithoutProbing@X@container_internal@absl@@YA_K_K00PEAW4ctrl_t@01@0@Z
     ??$TypeErasedApplyToSlotFn@UStringHash@container_internal@absl@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@container_internal@absl@@YA_KPEBXPEAX@Z
     ??$UnparseFloatingPointVal@M@flags_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@M@Z
     ??$UnparseFloatingPointVal@N@flags_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@N@Z
@@ -190,7 +191,6 @@ EXPORTS
     ??$emplace_front@PEAUPrefixCrc@CrcCordState@crc_internal@absl@@@?$__split_buffer@PEAUPrefixCrc@CrcCordState@crc_internal@absl@@V?$allocator@PEAUPrefixCrc@CrcCordState@crc_internal@absl@@@__Cr@std@@@__Cr@std@@QEAAX$$QEAPEAUPrefixCrc@CrcCordState@crc_internal@absl@@@Z
     ??$find@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@?$__hash_table@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@V?$__unordered_map_hasher@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@23@U?$hash@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@U?$equal_to@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@V?$__unordered_map_equal@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@23@U?$equal_to@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@U?$hash@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@V?$allocator@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@@23@@__Cr@std@@QEAA?AV?$__hash_iterator@PEAU?$__hash_node@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@PEAX@__Cr@std@@@12@AEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@12@@Z
     ??$find@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@QEAA?AViterator@012@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
-    ??$find_first_non_full@X@container_internal@absl@@YA?AUFindInfo@01@AEBVCommonFields@01@_K@Z
     ??$find_or_prepare_insert_non_soo@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEAA?AU?$pair@Viterator@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@_N@__Cr@std@@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@45@@Z
     ??0?$BigUnsigned@$03@strings_internal@absl@@QEAA@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
     ??0?$BigUnsigned@$03@strings_internal@absl@@QEAA@XZ
@@ -628,6 +628,7 @@ EXPORTS
     ?FindPath@GraphCycles@synchronization_internal@absl@@QEBAHUGraphId@23@0HQEAU423@@Z
     ?FiveToTheNth@?$BigUnsigned@$03@strings_internal@absl@@SA?AV123@H@Z
     ?FiveToTheNth@?$BigUnsigned@$0FE@@strings_internal@absl@@SA?AV123@H@Z
+    ?FixUpStack@internal_stacktrace@absl@@YAXPEAPEAXPEA_KPEAH_KAEA_K@Z
     ?FixedOffsetFromName@cctz@time_internal@absl@@YA_NAEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEAV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@56@@Z
     ?FixedOffsetToAbbr@cctz@time_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@AEBV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@56@@Z
     ?FixedOffsetToName@cctz@time_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@AEBV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@56@@Z
@@ -747,7 +748,6 @@ EXPORTS
     ?GetWord@?$BigUnsigned@$0FE@@strings_internal@absl@@QEBAIH@Z
     ?GlobalHashtablezSampler@container_internal@absl@@YAAEAV?$SampleRecorder@UHashtablezInfo@container_internal@absl@@@profiling_internal@2@XZ
     ?GlobalRegistry@FlagRegistry@flags_internal@absl@@SAAEAV123@XZ
-    ?GrowEmptySooTableToNextCapacityForceSampling@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@@Z
     ?GrowFullSooTableToNextCapacityForceSampling@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@@Z
     ?GuaranteedEqual@Condition@absl@@SA_NPEBV12@0@Z
     ?HandleInvalidStatusCtorArg@Helper@internal_statusor@absl@@SAXPEAVStatus@3@@Z
@@ -937,7 +937,6 @@ EXPORTS
     ?Post@StdcppWaiter@synchronization_internal@absl@@QEAAXXZ
     ?Post@Win32Waiter@synchronization_internal@absl@@QEAAXXZ
     ?PrepareForSampling@HashtablezInfo@container_internal@absl@@QEAAX_J_K11G@Z
-    ?PrepareInsertAfterSoo@container_internal@absl@@YA_K_K0AEAVCommonFields@12@@Z
     ?PrepareInsertNonSoo@container_internal@absl@@YA_KAEAVCommonFields@12@AEBUPolicyFunctions@12@_KUFindInfo@12@@Z
     ?PrepareToDie@LogMessage@log_internal@absl@@AEAAXXZ
     ?PrepareToModify@Status@absl@@CAPEAVStatusRep@status_internal@2@_K@Z
@@ -1016,9 +1015,8 @@ EXPORTS
     ?RemoveSuffix@CordRepBtree@cord_internal@absl@@SAPEAUCordRep@23@PEAV123@_K@Z
     ?ReportUnrecognizedFlags@absl@@YAXAEBV?$vector@UUnrecognizedFlag@absl@@V?$allocator@UUnrecognizedFlag@absl@@@__Cr@std@@@__Cr@std@@@Z
     ?ReportUsageError@flags_internal@absl@@YAXV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@_N@Z
-    ?ReserveAllocatedTable@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@_K@Z
     ?ReserveEmptyNonAllocatedTableToFitBucketCount@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@_K@Z
-    ?ReserveEmptyNonAllocatedTableToFitNewSize@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@_K@Z
+    ?ReserveTableToFitNewSize@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@_K@Z
     ?ResetToBuiltinUTC@TimeZoneInfo@cctz@time_internal@absl@@AEAA_NAEBV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@__Cr@std@@@Z
     ?ResizeAllocatedTableWithSeedChange@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@_K@Z
     ?ResourceExhaustedError@absl@@YA?AVStatus@1@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
@@ -1074,7 +1072,7 @@ EXPORTS
     ?ShiftLeft@?$BigUnsigned@$03@strings_internal@absl@@QEAAXH@Z
     ?ShiftLeft@?$BigUnsigned@$0FE@@strings_internal@absl@@QEAAXH@Z
     ?ShortProgramInvocationName@flags_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@XZ
-    ?ShouldInsertBackwardsForDebug@container_internal@absl@@YA_N_K0VPerTableSeed@12@@Z
+    ?ShouldFixUpStack@internal_stacktrace@absl@@YA_NXZ
     ?ShouldLog@LogEveryNSecState@log_internal@absl@@QEAA_NN@Z
     ?ShouldLog@LogEveryNState@log_internal@absl@@QEAA_NH@Z
     ?ShouldLog@LogEveryPow2State@log_internal@absl@@QEAA_NXZ
@@ -1303,8 +1301,7 @@ EXPORTS
     ?destroy@?$__tree@U?$__value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$vector@PEBVCommandLineFlag@absl@@V?$allocator@PEBVCommandLineFlag@absl@@@__Cr@std@@@23@@__Cr@std@@V?$__map_value_compare@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$vector@PEBVCommandLineFlag@absl@@V?$allocator@PEBVCommandLineFlag@absl@@@__Cr@std@@@23@@23@U?$less@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@V?$allocator@U?$__value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$vector@PEBVCommandLineFlag@absl@@V?$allocator@PEBVCommandLineFlag@absl@@@__Cr@std@@@23@@__Cr@std@@@23@@__Cr@std@@AEAAXPEAV?$__tree_node@U?$__value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$vector@PEBVCommandLineFlag@absl@@V?$allocator@PEBVCommandLineFlag@absl@@@__Cr@std@@@23@@__Cr@std@@PEAX@23@@Z
     ?effective_impl@time_zone@cctz@time_internal@absl@@AEBAAEBVImpl@1234@XZ
     ?engines@?1??CrcAndCopy@CrcMemcpy@crc_internal@absl@@SA?AVcrc32c_t@4@PEIAXPEIBX_KV54@_N@Z@4UArchSpecificEngines@234@B
-    ?find_first_non_full_outofline@container_internal@absl@@YA?AUFindInfo@12@AEBVCommonFields@12@_K@Z
-    ?find_new_positions_and_transfer_slots_fn@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@CA_KAEAVCommonFields@23@PEAW4ctrl_t@23@PEAX_K@Z
+    ?find_first_non_full@container_internal@absl@@YA?AUFindInfo@12@AEBVCommonFields@12@_K@Z
     ?fixed_time_zone@cctz@time_internal@absl@@YA?AVtime_zone@123@AEBV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@__Cr@std@@@Z
     ?format@detail@cctz@time_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@AEBV567@AEBV?$time_point@Vsystem_clock@chrono@__Cr@std@@V?$duration@_JV?$ratio@$00$00@__Cr@std@@@234@@chrono@67@AEBV?$duration@_JV?$ratio@$00$0DINHOKEMGIAAA@@__Cr@std@@@967@AEBVtime_zone@234@@Z
     ?from_chars@absl@@YA?AUfrom_chars_result@1@PEBD0AEAMW4chars_format@1@@Z
@@ -1350,6 +1347,7 @@ EXPORTS
     ?size@Cord@absl@@QEBA_KXZ
     ?status@BadStatusOrAccess@absl@@QEBAAEBVStatus@2@XZ
     ?stream@OstreamView@LogMessage@log_internal@absl@@QEAAAEAV?$basic_ostream@DU?$char_traits@D@__Cr@std@@@__Cr@std@@XZ
+    ?transfer_unprobed_elements_to_next_capacity_fn@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@CAXAEAVCommonFields@23@PEBW4ctrl_t@23@PEAX2P6AX2E_K3@Z@Z
     ?utc_time_zone@cctz@time_internal@absl@@YA?AVtime_zone@123@XZ
     ?version@time_zone@cctz@time_internal@absl@@QEBA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@XZ
     ?what@BadStatusOrAccess@absl@@UEBAPEBDXZ
diff --git a/deps/v8/third_party/abseil-cpp/symbols_x64_rel_asan.def b/deps/v8/third_party/abseil-cpp/symbols_x64_rel_asan.def
index 989e1de242f56b..8de1ab72835218 100644
--- a/deps/v8/third_party/abseil-cpp/symbols_x64_rel_asan.def
+++ b/deps/v8/third_party/abseil-cpp/symbols_x64_rel_asan.def
@@ -104,11 +104,11 @@ EXPORTS
     ??$GenericCompare@HVCord@absl@@@absl@@YAHAEBVCord@0@0_K@Z
     ??$GenericCompare@_NV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@absl@@YA_NAEBVCord@0@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@_K@Z
     ??$GenericCompare@_NVCord@absl@@@absl@@YA_NAEBVCord@0@0_K@Z
-    ??$GrowFullSooTableToNextCapacity@$00$00@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
-    ??$GrowFullSooTableToNextCapacity@$03$00@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
-    ??$GrowFullSooTableToNextCapacity@$07$00@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
-    ??$GrowFullSooTableToNextCapacity@$0A@$0A@@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
-    ??$GrowFullSooTableToNextCapacity@$0BA@$00@container_internal@absl@@YAXAEAVCommonFields@01@AEBUPolicyFunctions@01@_K@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$00$00@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$03$00@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$07$00@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$0A@$0A@@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$0BA@$00@container_internal@absl@@YA_KAEAVCommonFields@01@AEBUPolicyFunctions@01@_KW4ctrl_t@01@@Z
     ??$IntegerToString@H@strings_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@H@Z
     ??$IntegerToString@I@strings_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@I@Z
     ??$IntegerToString@J@strings_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@J@Z
@@ -148,7 +148,8 @@ EXPORTS
     ??$StrCat@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@$$BY0BO@DV123@@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@AEBVAlphaNum@0@0000AEBV123@AEAY0BO@$$CBD1@Z
     ??$StrCat@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@$$BY0LD@D@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@AEBVAlphaNum@0@0000AEBV123@AEAY0LD@$$CBD@Z
     ??$StrReplaceAll@V?$initializer_list@U?$pair@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V123@@__Cr@std@@@std@@@absl@@YAHAEBV?$initializer_list@U?$pair@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V123@@__Cr@std@@@std@@PEAV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@2@@Z
-    ??$TransferRelocatable@$0BI@@container_internal@absl@@YAXPEAX00_K@Z
+    ??$TransferNRelocatable@$0BI@@container_internal@absl@@YAXPEAX00_K@Z
+    ??$TryFindNewIndexWithoutProbing@X@container_internal@absl@@YA_K_K00PEAW4ctrl_t@01@0@Z
     ??$TypeErasedApplyToSlotFn@UStringHash@container_internal@absl@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@container_internal@absl@@YA_KPEBXPEAX@Z
     ??$UnparseFloatingPointVal@M@flags_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@M@Z
     ??$UnparseFloatingPointVal@N@flags_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@N@Z
@@ -199,7 +200,6 @@ EXPORTS
     ??$emplace_front@PEAPEBVImpl@time_zone@cctz@time_internal@absl@@@?$__split_buffer@PEAPEBVImpl@time_zone@cctz@time_internal@absl@@V?$allocator@PEAPEBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@@__Cr@std@@QEAAX$$QEAPEAPEBVImpl@time_zone@cctz@time_internal@absl@@@Z
     ??$emplace_front@PEAUPrefixCrc@CrcCordState@crc_internal@absl@@@?$__split_buffer@PEAUPrefixCrc@CrcCordState@crc_internal@absl@@V?$allocator@PEAUPrefixCrc@CrcCordState@crc_internal@absl@@@__Cr@std@@@__Cr@std@@QEAAX$$QEAPEAUPrefixCrc@CrcCordState@crc_internal@absl@@@Z
     ??$find@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@QEAA?AViterator@012@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
-    ??$find_first_non_full@X@container_internal@absl@@YA?AUFindInfo@01@AEBVCommonFields@01@_K@Z
     ??$find_non_soo@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEAA?AViterator@012@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@_K@Z
     ??$find_or_prepare_insert_non_soo@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AEAA?AU?$pair@Viterator@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@_N@__Cr@std@@AEBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@45@@Z
     ??0?$BigUnsigned@$03@strings_internal@absl@@QEAA@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
@@ -658,6 +658,7 @@ EXPORTS
     ?FindPath@GraphCycles@synchronization_internal@absl@@QEBAHUGraphId@23@0HQEAU423@@Z
     ?FiveToTheNth@?$BigUnsigned@$03@strings_internal@absl@@SA?AV123@H@Z
     ?FiveToTheNth@?$BigUnsigned@$0FE@@strings_internal@absl@@SA?AV123@H@Z
+    ?FixUpStack@internal_stacktrace@absl@@YAXPEAPEAXPEA_KPEAH_KAEA_K@Z
     ?FixedOffsetFromName@cctz@time_internal@absl@@YA_NAEBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PEAV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@56@@Z
     ?FixedOffsetToAbbr@cctz@time_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@AEBV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@56@@Z
     ?FixedOffsetToName@cctz@time_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@AEBV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@56@@Z
@@ -777,7 +778,6 @@ EXPORTS
     ?GetWord@?$BigUnsigned@$0FE@@strings_internal@absl@@QEBAIH@Z
     ?GlobalHashtablezSampler@container_internal@absl@@YAAEAV?$SampleRecorder@UHashtablezInfo@container_internal@absl@@@profiling_internal@2@XZ
     ?GlobalRegistry@FlagRegistry@flags_internal@absl@@SAAEAV123@XZ
-    ?GrowEmptySooTableToNextCapacityForceSampling@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@@Z
     ?GrowFullSooTableToNextCapacityForceSampling@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@@Z
     ?GuaranteedEqual@Condition@absl@@SA_NPEBV12@0@Z
     ?HandleInvalidStatusCtorArg@Helper@internal_statusor@absl@@SAXPEAVStatus@3@@Z
@@ -969,7 +969,6 @@ EXPORTS
     ?Post@StdcppWaiter@synchronization_internal@absl@@QEAAXXZ
     ?Post@Win32Waiter@synchronization_internal@absl@@QEAAXXZ
     ?PrepareForSampling@HashtablezInfo@container_internal@absl@@QEAAX_J_K11G@Z
-    ?PrepareInsertAfterSoo@container_internal@absl@@YA_K_K0AEAVCommonFields@12@@Z
     ?PrepareInsertCommon@container_internal@absl@@YAXAEAVCommonFields@12@@Z
     ?PrepareInsertNonSoo@container_internal@absl@@YA_KAEAVCommonFields@12@AEBUPolicyFunctions@12@_KUFindInfo@12@@Z
     ?PrepareToDie@LogMessage@log_internal@absl@@AEAAXXZ
@@ -1049,9 +1048,8 @@ EXPORTS
     ?RemoveSuffix@CordRepBtree@cord_internal@absl@@SAPEAUCordRep@23@PEAV123@_K@Z
     ?ReportUnrecognizedFlags@absl@@YAXAEBV?$vector@UUnrecognizedFlag@absl@@V?$allocator@UUnrecognizedFlag@absl@@@__Cr@std@@@__Cr@std@@@Z
     ?ReportUsageError@flags_internal@absl@@YAXV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@_N@Z
-    ?ReserveAllocatedTable@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@_K@Z
     ?ReserveEmptyNonAllocatedTableToFitBucketCount@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@_K@Z
-    ?ReserveEmptyNonAllocatedTableToFitNewSize@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@_K@Z
+    ?ReserveTableToFitNewSize@container_internal@absl@@YAXAEAVCommonFields@12@AEBUPolicyFunctions@12@_K@Z
     ?ResetToBuiltinUTC@TimeZoneInfo@cctz@time_internal@absl@@AEAA_NAEBV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@__Cr@std@@@Z
     ?ResetToEmpty@InlineRep@Cord@absl@@AEAAXXZ
     ?Resize@?$ResizeUninitializedTraits@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@X@strings_internal@absl@@SAXPEAV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@_K@Z
@@ -1111,7 +1109,7 @@ EXPORTS
     ?ShiftLeft@?$BigUnsigned@$03@strings_internal@absl@@QEAAXH@Z
     ?ShiftLeft@?$BigUnsigned@$0FE@@strings_internal@absl@@QEAAXH@Z
     ?ShortProgramInvocationName@flags_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@XZ
-    ?ShouldInsertBackwardsForDebug@container_internal@absl@@YA_N_K0VPerTableSeed@12@@Z
+    ?ShouldFixUpStack@internal_stacktrace@absl@@YA_NXZ
     ?ShouldLog@LogEveryNSecState@log_internal@absl@@QEAA_NN@Z
     ?ShouldLog@LogEveryNState@log_internal@absl@@QEAA_NH@Z
     ?ShouldLog@LogEveryPow2State@log_internal@absl@@QEAA_NXZ
@@ -1324,6 +1322,7 @@ EXPORTS
     ?__append@?$vector@UTransition@cctz@time_internal@absl@@V?$allocator@UTransition@cctz@time_internal@absl@@@__Cr@std@@@__Cr@std@@AEAAX_K@Z
     ?__append@?$vector@UTransitionType@cctz@time_internal@absl@@V?$allocator@UTransitionType@cctz@time_internal@absl@@@__Cr@std@@@__Cr@std@@AEAAX_K@Z
     ?__erase_to_end@?$deque@UPrefixCrc@CrcCordState@crc_internal@absl@@V?$allocator@UPrefixCrc@CrcCordState@crc_internal@absl@@@__Cr@std@@@__Cr@std@@AEAAXV?$__deque_iterator@UPrefixCrc@CrcCordState@crc_internal@absl@@PEBU1234@AEBU1234@PEBQEBU1234@_J$0A@@23@@Z
+    ?__maybe_remove_back_spare@?$deque@UPrefixCrc@CrcCordState@crc_internal@absl@@V?$allocator@UPrefixCrc@CrcCordState@crc_internal@absl@@@__Cr@std@@@__Cr@std@@AEAA_N_N@Z
     ?__move_range@?$vector@UTransition@cctz@time_internal@absl@@V?$allocator@UTransition@cctz@time_internal@absl@@@__Cr@std@@@__Cr@std@@AEAAXPEAUTransition@cctz@time_internal@absl@@00@Z
     ?__move_range@?$vector@UTransitionType@cctz@time_internal@absl@@V?$allocator@UTransitionType@cctz@time_internal@absl@@@__Cr@std@@@__Cr@std@@AEAAXPEAUTransitionType@cctz@time_internal@absl@@00@Z
     ?__swap_out_circular_buffer@?$vector@UUnrecognizedFlag@absl@@V?$allocator@UUnrecognizedFlag@absl@@@__Cr@std@@@__Cr@std@@AEAAXAEAU?$__split_buffer@UUnrecognizedFlag@absl@@AEAV?$allocator@UUnrecognizedFlag@absl@@@__Cr@std@@@23@@Z
@@ -1348,8 +1347,7 @@ EXPORTS
     ?effective_impl@time_zone@cctz@time_internal@absl@@AEBAAEBVImpl@1234@XZ
     ?end@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@QEAA?AViterator@123@XZ
     ?engines@?1??CrcAndCopy@CrcMemcpy@crc_internal@absl@@SA?AVcrc32c_t@4@PEIAXPEIBX_KV54@_N@Z@4UArchSpecificEngines@234@B
-    ?find_first_non_full_outofline@container_internal@absl@@YA?AUFindInfo@12@AEBVCommonFields@12@_K@Z
-    ?find_new_positions_and_transfer_slots_fn@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@CA_KAEAVCommonFields@23@PEAW4ctrl_t@23@PEAX_K@Z
+    ?find_first_non_full@container_internal@absl@@YA?AUFindInfo@12@AEBVCommonFields@12@_K@Z
     ?fixed_time_zone@cctz@time_internal@absl@@YA?AVtime_zone@123@AEBV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@__Cr@std@@@Z
     ?format@detail@cctz@time_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@AEBV567@AEBV?$time_point@Vsystem_clock@chrono@__Cr@std@@V?$duration@_JV?$ratio@$00$00@__Cr@std@@@234@@chrono@67@AEBV?$duration@_JV?$ratio@$00$0DINHOKEMGIAAA@@__Cr@std@@@967@AEBVtime_zone@234@@Z
     ?from_chars@absl@@YA?AUfrom_chars_result@1@PEBD0AEAMW4chars_format@1@@Z
@@ -1403,6 +1401,7 @@ EXPORTS
     ?status@BadStatusOrAccess@absl@@QEBAAEBVStatus@2@XZ
     ?stream@OstreamView@LogMessage@log_internal@absl@@QEAAAEAV?$basic_ostream@DU?$char_traits@D@__Cr@std@@@__Cr@std@@XZ
     ?tag@Rep@InlineData@cord_internal@absl@@QEBACXZ
+    ?transfer_unprobed_elements_to_next_capacity_fn@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PEAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@CAXAEAVCommonFields@23@PEBW4ctrl_t@23@PEAX2P6AX2E_K3@Z@Z
     ?utc_time_zone@cctz@time_internal@absl@@YA?AVtime_zone@123@XZ
     ?version@time_zone@cctz@time_internal@absl@@QEBA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@XZ
     ?what@BadStatusOrAccess@absl@@UEBAPEBDXZ
diff --git a/deps/v8/third_party/abseil-cpp/symbols_x86_dbg.def b/deps/v8/third_party/abseil-cpp/symbols_x86_dbg.def
index 523a3757155250..f09c4f7af3a35a 100644
--- a/deps/v8/third_party/abseil-cpp/symbols_x86_dbg.def
+++ b/deps/v8/third_party/abseil-cpp/symbols_x86_dbg.def
@@ -491,19 +491,19 @@ EXPORTS
     ??$FastIntToBuffer@J@numbers_internal@absl@@YAPADJPAD@Z
     ??$FastIntToBuffer@K@numbers_internal@absl@@YAPADKPAD@Z
     ??$FastIntToBuffer@_W@numbers_internal@absl@@YAPAD_WPAD@Z
-    ??$FastTypeId@F@base_internal@absl@@YAPBXXZ
-    ??$FastTypeId@G@base_internal@absl@@YAPBXXZ
-    ??$FastTypeId@H@base_internal@absl@@YAPBXXZ
-    ??$FastTypeId@I@base_internal@absl@@YAPBXXZ
-    ??$FastTypeId@J@base_internal@absl@@YAPBXXZ
-    ??$FastTypeId@K@base_internal@absl@@YAPBXXZ
-    ??$FastTypeId@M@base_internal@absl@@YAPBXXZ
-    ??$FastTypeId@N@base_internal@absl@@YAPBXXZ
-    ??$FastTypeId@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@base_internal@absl@@YAPBXXZ
-    ??$FastTypeId@V?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@@base_internal@absl@@YAPBXXZ
-    ??$FastTypeId@_J@base_internal@absl@@YAPBXXZ
-    ??$FastTypeId@_K@base_internal@absl@@YAPBXXZ
-    ??$FastTypeId@_N@base_internal@absl@@YAPBXXZ
+    ??$FastTypeId@F@absl@@YAPBXXZ
+    ??$FastTypeId@G@absl@@YAPBXXZ
+    ??$FastTypeId@H@absl@@YAPBXXZ
+    ??$FastTypeId@I@absl@@YAPBXXZ
+    ??$FastTypeId@J@absl@@YAPBXXZ
+    ??$FastTypeId@K@absl@@YAPBXXZ
+    ??$FastTypeId@M@absl@@YAPBXXZ
+    ??$FastTypeId@N@absl@@YAPBXXZ
+    ??$FastTypeId@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@absl@@YAPBXXZ
+    ??$FastTypeId@V?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@@absl@@YAPBXXZ
+    ??$FastTypeId@_J@absl@@YAPBXXZ
+    ??$FastTypeId@_K@absl@@YAPBXXZ
+    ??$FastTypeId@_N@absl@@YAPBXXZ
     ??$FindSubstitutions@V?$initializer_list@U?$pair@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V123@@__Cr@std@@@std@@@strings_internal@absl@@YA?AV?$vector@UViableSubstitution@strings_internal@absl@@V?$allocator@UViableSubstitution@strings_internal@absl@@@__Cr@std@@@__Cr@std@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@34@ABV?$initializer_list@U?$pair@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V123@@__Cr@std@@@4@@Z
     ??$FlagOps@V?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@@flags_internal@absl@@YAPAXW4FlagOp@01@PBXPAX2@Z
     ??$Flush@V?$basic_ostream@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@FormatRawSinkImpl@str_format_internal@absl@@CAXPAXV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
@@ -540,10 +540,10 @@ EXPORTS
     ??$GetDataImpl@V?$Span@I@absl@@@span_internal@absl@@YAPAIAAV?$Span@I@1@D@Z
     ??$GetDataImpl@V?$vector@PAVLogSink@absl@@V?$allocator@PAVLogSink@absl@@@__Cr@std@@@__Cr@std@@@span_internal@absl@@YAPAPAVLogSink@1@AAV?$vector@PAVLogSink@absl@@V?$allocator@PAVLogSink@absl@@@__Cr@std@@@__Cr@std@@D@Z
     ??$GetFlag@V?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@@absl@@YA?AV?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@ABV?$Flag@V?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@@flags_internal@0@@Z
-    ??$GrowFullSooTableToNextCapacity@$00$00@container_internal@absl@@YAXAAVCommonFields@01@ABUPolicyFunctions@01@I@Z
-    ??$GrowFullSooTableToNextCapacity@$03$00@container_internal@absl@@YAXAAVCommonFields@01@ABUPolicyFunctions@01@I@Z
-    ??$GrowFullSooTableToNextCapacity@$07$00@container_internal@absl@@YAXAAVCommonFields@01@ABUPolicyFunctions@01@I@Z
-    ??$GrowFullSooTableToNextCapacity@$0A@$0A@@container_internal@absl@@YAXAAVCommonFields@01@ABUPolicyFunctions@01@I@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$00$00@container_internal@absl@@YAIAAVCommonFields@01@ABUPolicyFunctions@01@IW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$03$00@container_internal@absl@@YAIAAVCommonFields@01@ABUPolicyFunctions@01@IW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$07$00@container_internal@absl@@YAIAAVCommonFields@01@ABUPolicyFunctions@01@IW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$0A@$0A@@container_internal@absl@@YAIAAVCommonFields@01@ABUPolicyFunctions@01@IW4ctrl_t@01@@Z
     ??$HashOf@$S$$ZI@absl@@YAIABI@Z
     ??$HashOf@$S$$ZV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@H@absl@@YAIABV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@ABH@Z
     ??$HidePtr@$$CBX@base_internal@absl@@YAIPBX@Z
@@ -568,6 +568,7 @@ EXPORTS
     ??$IntegerToString@K@strings_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@K@Z
     ??$IntegerToString@_J@strings_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@_J@Z
     ??$IntegerToString@_K@strings_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@_K@Z
+    ??$Invoke@VMixingHashState@hash_internal@absl@@@WeaklyMixedIntegerProbe@HashSelect@hash_internal@absl@@SA?AVMixingHashState@23@V423@UWeaklyMixedInteger@23@@Z
     ??$Invoke@VMixingHashState@hash_internal@absl@@H@UniquelyRepresentedProbe@HashSelect@hash_internal@absl@@SA?AVMixingHashState@23@V423@ABH@Z
     ??$Invoke@VMixingHashState@hash_internal@absl@@I@UniquelyRepresentedProbe@HashSelect@hash_internal@absl@@SA?AVMixingHashState@23@V423@ABI@Z
     ??$Invoke@VMixingHashState@hash_internal@absl@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@HashValueProbe@HashSelect@hash_internal@absl@@SA?AVMixingHashState@23@V423@ABV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
@@ -777,7 +778,8 @@ EXPORTS
     ??$TrailingZeros@G@container_internal@absl@@YAIG@Z
     ??$TrailingZeros@I@container_internal@absl@@YAII@Z
     ??$TrailingZeros@_K@container_internal@absl@@YAI_K@Z
-    ??$TransferRelocatable@$0M@@container_internal@absl@@YAXPAX00I@Z
+    ??$TransferNRelocatable@$0M@@container_internal@absl@@YAXPAX00I@Z
+    ??$TryFindNewIndexWithoutProbing@X@container_internal@absl@@YAIIIIPAW4ctrl_t@01@I@Z
     ??$TypeErasedApplyToSlotFn@UStringHash@container_internal@absl@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@container_internal@absl@@YAIPBXPAX@Z
     ??$UnhidePtr@X@base_internal@absl@@YAPAXI@Z
     ??$Unparse@V?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@__Cr@std@@@flags_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@ABV?$vector@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@@34@@Z
@@ -1289,6 +1291,7 @@ EXPORTS
     ??$call_once@P8FlagImpl@flags_internal@absl@@AEXXZPAV123@@absl@@YAXAAVonce_flag@0@$$QAP8FlagImpl@flags_internal@0@AEXXZ$$QAPAV230@@Z
     ??$combine@H$$V@?$HashStateBase@VMixingHashState@hash_internal@absl@@@hash_internal@absl@@SA?AVMixingHashState@12@V312@ABH@Z
     ??$combine@I$$V@?$HashStateBase@VMixingHashState@hash_internal@absl@@@hash_internal@absl@@SA?AVMixingHashState@12@V312@ABI@Z
+    ??$combine@UWeaklyMixedInteger@hash_internal@absl@@$$V@?$HashStateBase@VMixingHashState@hash_internal@absl@@@hash_internal@absl@@SA?AVMixingHashState@12@V312@ABUWeaklyMixedInteger@12@@Z
     ??$combine@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@$$V@?$HashStateBase@VMixingHashState@hash_internal@absl@@@hash_internal@absl@@SA?AVMixingHashState@12@V312@ABV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
     ??$combine@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@H@?$HashStateBase@VMixingHashState@hash_internal@absl@@@hash_internal@absl@@SA?AVMixingHashState@12@V312@ABV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@ABH@Z
     ??$combine@V?$tuple@ABI@__Cr@std@@$$V@?$HashStateBase@VMixingHashState@hash_internal@absl@@@hash_internal@absl@@SA?AVMixingHashState@12@V312@ABV?$tuple@ABI@__Cr@std@@@Z
@@ -1460,7 +1463,6 @@ EXPORTS
     ??$find@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@?$__hash_table@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@V?$__unordered_map_hasher@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PBVImpl@time_zone@cctz@time_internal@absl@@@23@U?$hash@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@U?$equal_to@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@V?$__unordered_map_equal@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PBVImpl@time_zone@cctz@time_internal@absl@@@23@U?$equal_to@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@U?$hash@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@V?$allocator@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@@23@@__Cr@std@@QAE?AV?$__hash_iterator@PAU?$__hash_node@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@PAX@__Cr@std@@@12@ABV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@12@@Z
     ??$find@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@QAE?AViterator@012@ABV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
     ??$find@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@QBE?AVconst_iterator@012@ABV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
-    ??$find_first_non_full@X@container_internal@absl@@YA?AUFindInfo@01@ABVCommonFields@01@I@Z
     ??$find_non_soo@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AAE?AViterator@012@ABV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@I@Z
     ??$find_or_prepare_insert@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@IAE?AU?$pair@Viterator@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@_N@__Cr@std@@ABV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@45@@Z
     ??$find_or_prepare_insert_non_soo@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AAE?AU?$pair@Viterator@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@_N@__Cr@std@@ABV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@45@@Z
@@ -1481,6 +1483,7 @@ EXPORTS
     ??$get@$00@?$CompressedTuple@V?$allocator@VFormatArgImpl@str_format_internal@absl@@@__Cr@std@@I@container_internal@absl@@QGAEAAIXZ
     ??$get@$00@?$CompressedTuple@V?$allocator@VFormatArgImpl@str_format_internal@absl@@@__Cr@std@@I@container_internal@absl@@QGBEABIXZ
     ??$get@$00@?$CompressedTuple@VCommonFields@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@D@__Cr@std@@@container_internal@absl@@QGAEAAUStringHash@12@XZ
+    ??$get@$00@?$CompressedTuple@VCommonFields@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@D@__Cr@std@@@container_internal@absl@@QGBEABUStringHash@12@XZ
     ??$get@$00AAPAVCommandLineFlag@absl@@AA_N@__Cr@std@@YAAA_NAAV?$tuple@AAPAVCommandLineFlag@absl@@AA_N@01@@Z
     ??$get@$00PAVCommandLineFlag@absl@@_N@__Cr@std@@YAAA_NAAV?$tuple@PAVCommandLineFlag@absl@@_N@01@@Z
     ??$get@$01@?$CompressedTuple@VCommonFields@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@D@__Cr@std@@@container_internal@absl@@QGAEAAUStringEq@12@XZ
@@ -1509,6 +1512,7 @@ EXPORTS
     ??$hash_range_or_bytes@VMixingHashState@hash_internal@absl@@D@hash_internal@absl@@YA?AVMixingHashState@01@V201@PBDI@Z
     ??$hash_tuple@VMixingHashState@hash_internal@absl@@V?$tuple@ABI@__Cr@std@@$0A@@hash_internal@absl@@YA?AVMixingHashState@01@V201@ABV?$tuple@ABI@__Cr@std@@U?$integer_sequence@I$0A@@45@@Z
     ??$hash_tuple@VMixingHashState@hash_internal@absl@@V?$tuple@ABV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@ABH@__Cr@std@@$0A@$00@hash_internal@absl@@YA?AVMixingHashState@01@V201@ABV?$tuple@ABV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@ABH@__Cr@std@@U?$integer_sequence@I$0A@$00@45@@Z
+    ??$hash_weakly_mixed_integer@VMixingHashState@hash_internal@absl@@@hash_internal@absl@@YA?AVMixingHashState@01@V201@UWeaklyMixedInteger@01@@Z
     ??$insert@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@$0A@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@QAE?AU?$pair@Viterator@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@_N@__Cr@std@@$$QAU?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@45@@Z
     ??$insert@V?$__wrap_iter@PAUraw_view@?1???R?$ConvertToContainer@V?$vector@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V?$allocator@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@23@@__Cr@std@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@23@$0A@@?$Splitter@VByChar@absl@@UAllowEmpty@2@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@strings_internal@absl@@QBE?AV?$vector@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V?$allocator@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@23@@__Cr@std@@ABV345@@Z@@__Cr@std@@$0A@@?$vector@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V?$allocator@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@23@@__Cr@std@@QAE?AV?$__wrap_iter@PAV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@12@V?$__wrap_iter@PBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@12@V?$__wrap_iter@PAUraw_view@?1???R?$ConvertToContainer@V?$vector@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V?$allocator@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@23@@__Cr@std@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@23@$0A@@?$Splitter@VByChar@absl@@UAllowEmpty@2@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@strings_internal@absl@@QBE?AV?$vector@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V?$allocator@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@23@@__Cr@std@@ABV345@@Z@@12@1@Z
     ??$invoke@P8FlagImpl@flags_internal@absl@@AEXXZPAV123@@__Cr@std@@YAX$$QAP8FlagImpl@flags_internal@absl@@AEXXZ$$QAPAV234@@Z
@@ -1672,6 +1676,9 @@ EXPORTS
     ??0?$IteratorValueAdapter@V?$allocator@VFormatArgImpl@str_format_internal@absl@@@__Cr@std@@PBVFormatArgImpl@str_format_internal@absl@@@inlined_vector_internal@absl@@QAE@ABQBVFormatArgImpl@str_format_internal@2@@Z
     ??0?$NonIterableBitMask@G$0BA@$0A@@container_internal@absl@@QAE@G@Z
     ??0?$NonIterableBitMask@_K$07$02@container_internal@absl@@QAE@_K@Z
+    ??0?$ProbedItemImpl@I$0CA@@container_internal@absl@@QAE@EII@Z
+    ??0?$ProbedItemImpl@_K$0EA@@container_internal@absl@@QAE@EII@Z
+    ??0?$ProbedItemImpl@_K$0HK@@container_internal@absl@@QAE@EII@Z
     ??0?$Sample@UHashtablezInfo@container_internal@absl@@@profiling_internal@absl@@QAE@XZ
     ??0?$SampleRecorder@UHashtablezInfo@container_internal@absl@@@profiling_internal@absl@@QAE@XZ
     ??0?$Span@$$CBD@absl@@QAE@PBDI@Z
@@ -2621,7 +2628,6 @@ EXPORTS
     ??R<lambda_1>@?0??back@?$InlinedVector@PAUCordRep@cord_internal@absl@@$01V?$allocator@PAUCordRep@cord_internal@absl@@@__Cr@std@@@absl@@QAEAAPAUCordRep@cord_internal@3@XZ@QBE?A?<auto>@@XZ
     ??R<lambda_1>@?0??destroy@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AAEXPAT?$map_slot_type@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@34@@Z@QBE?A?<auto>@@XZ
     ??R<lambda_1>@?0??erase@?$InlinedVector@UPayload@status_internal@absl@@$00V?$allocator@UPayload@status_internal@absl@@@__Cr@std@@@absl@@QAEPAUPayload@status_internal@3@PBU453@@Z@QBE?A?<auto>@@XZ
-    ??R<lambda_1>@?0??find_new_positions_and_transfer_slots_fn@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@CAIAAVCommonFields@34@PAW4ctrl_t@34@PAXI@Z@QBE?A?<auto>@@PAT?$map_slot_type@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@34@@Z
     ??R<lambda_1>@?0??inline_size@Rep@InlineData@cord_internal@absl@@QBEIXZ@QBE?A?<auto>@@XZ
     ??R<lambda_1>@?0??pop_back@?$InlinedVector@PAUCordRep@cord_internal@absl@@$01V?$allocator@PAUCordRep@cord_internal@absl@@@__Cr@std@@@absl@@QAEXXZ@QBE?A?<auto>@@XZ
     ??R<lambda_1>@?0??remove_prefix@?$Span@$$CBD@absl@@QAEXI@Z@QBE?A?<auto>@@XZ
@@ -2793,6 +2799,7 @@ EXPORTS
     ?AdvanceBytesBtree@ChunkIterator@Cord@absl@@AAEXI@Z
     ?AlignBegin@CordRepBtree@cord_internal@absl@@AAEXXZ
     ?AlignEnd@CordRepBtree@cord_internal@absl@@AAEXXZ
+    ?AlignUpTo@container_internal@absl@@YAIII@Z
     ?Alloc@LowLevelAlloc@base_internal@absl@@SAPAXI@Z
     ?Alloc@flags_internal@absl@@YAPAXP6APAXW4FlagOp@12@PBXPAX2@Z@Z
     ?AllocWithArena@LowLevelAlloc@base_internal@absl@@SAPAXIPAUArena@123@@Z
@@ -2846,6 +2853,7 @@ EXPORTS
     ?AsciiStrToUpper@ascii_internal@absl@@YAXPADPBDI@Z
     ?AssertHeld@CordzInfo@cord_internal@absl@@QAEXXZ
     ?AssertHeld@Mutex@absl@@QBEXXZ
+    ?AssertHeld@SpinLock@base_internal@absl@@QBEXXZ
     ?AssertInSooMode@CommonFields@container_internal@absl@@ABEXXZ
     ?AssertIsFull@container_internal@absl@@YAXPBW4ctrl_t@12@EPBEPBD@Z
     ?AssertIsValidForComparison@container_internal@absl@@YAXPBW4ctrl_t@12@EPBE@Z
@@ -2948,6 +2956,7 @@ EXPORTS
     ?Contains@Cord@absl@@QBE_NV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
     ?Contains@str_format_internal@absl@@YA_NW4FormatConversionCharSet@2@D@Z
     ?Contains@str_format_internal@absl@@YA_NW4FormatConversionCharSet@2@W4FormatConversionChar@2@@Z
+    ?ControlOffset@container_internal@absl@@YAI_N@Z
     ?ControlWord@base_internal@absl@@YAPAU?$atomic@I@__Cr@std@@PAVonce_flag@2@@Z
     ?ConvertBoolArg@str_format_internal@absl@@YA_N_NPAVFormatSinkImpl@12@@Z
     ?ConvertDateTime@absl@@YA?AUTimeConversion@1@_JHHHHHVTimeZone@1@@Z
@@ -3177,6 +3186,7 @@ EXPORTS
     ?FindPath@GraphCycles@synchronization_internal@absl@@QBEHUGraphId@23@0HQAU423@@Z
     ?FiveToTheNth@?$BigUnsigned@$03@strings_internal@absl@@SA?AV123@H@Z
     ?FiveToTheNth@?$BigUnsigned@$0FE@@strings_internal@absl@@SA?AV123@H@Z
+    ?FixUpStack@internal_stacktrace@absl@@YAXPAPAXPAIPAHIAAI@Z
     ?FixedOffsetFromName@cctz@time_internal@absl@@YA_NABV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PAV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@56@@Z
     ?FixedOffsetToAbbr@cctz@time_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@ABV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@56@@Z
     ?FixedOffsetToName@cctz@time_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@ABV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@56@@Z
@@ -3316,6 +3326,7 @@ EXPORTS
     ?GetFlagsHelpMatchSubstr@flags_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@XZ
     ?GetFlagsHelpMode@flags_internal@absl@@YA?AW4HelpMode@12@XZ
     ?GetFlatAux@Cord@absl@@CA_NPAUCordRep@cord_internal@2@PAV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
+    ?GetGrowthInfoFromControl@container_internal@absl@@YAAAVGrowthInfo@12@PAW4ctrl_t@12@@Z
     ?GetGrowthLeft@GrowthInfo@container_internal@absl@@QBEIXZ
     ?GetHashtablezMaxSamples@container_internal@absl@@YAIXZ
     ?GetHashtablezSampleParameter@container_internal@absl@@YAHXZ
@@ -3384,9 +3395,7 @@ EXPORTS
     ?GetYearDay@absl@@YAHV?$civil_time@Usecond_tag@time_internal@absl@@@detail@cctz@time_internal@1@@Z
     ?GlobalHashtablezSampler@container_internal@absl@@YAAAV?$SampleRecorder@UHashtablezInfo@container_internal@absl@@@profiling_internal@2@XZ
     ?GlobalRegistry@FlagRegistry@flags_internal@absl@@SAAAV123@XZ
-    ?GrowEmptySooTableToNextCapacityForceSampling@container_internal@absl@@YAXAAVCommonFields@12@ABUPolicyFunctions@12@@Z
     ?GrowFullSooTableToNextCapacityForceSampling@container_internal@absl@@YAXAAVCommonFields@12@ABUPolicyFunctions@12@@Z
-    ?GrowthToLowerboundCapacity@container_internal@absl@@YAII@Z
     ?GuaranteedEqual@Condition@absl@@SA_NPBV12@0@Z
     ?Guard@?$NullGuard@C@log_internal@absl@@SAABCABC@Z
     ?Guard@?$NullGuard@D@log_internal@absl@@SAABDABD@Z
@@ -3429,7 +3438,6 @@ EXPORTS
     ?HexStringToBytes@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@34@@Z
     ?HexStringToBytes@absl@@YA_NV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@34@@Z
     ?HideMask@base_internal@absl@@YAIXZ
-    ?HighestBitSet@?$NonIterableBitMask@G$0BA@$0A@@container_internal@absl@@QBEIXZ
     ?IDivDuration@absl@@YA_JVDuration@1@0PAV21@@Z
     ?In@Time@absl@@QBE?AUBreakdown@12@VTimeZone@2@@Z
     ?InMillisecondsFromNow@KernelTimeout@synchronization_internal@absl@@QBEKXZ
@@ -3498,6 +3506,7 @@ EXPORTS
     ?IsFlat@CordRepBtree@cord_internal@absl@@QBE_NPAV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
     ?IsFull@container_internal@absl@@YA_NW4ctrl_t@12@@Z
     ?IsHashtablezEnabled@container_internal@absl@@YA_NXZ
+    ?IsHeld@SpinLock@base_internal@absl@@QBE_NXZ
     ?IsImmortal@RefcountAndFlags@cord_internal@absl@@QBE_NXZ
     ?IsInfiniteDuration@time_internal@absl@@YA_NVDuration@2@@Z
     ?IsInitialized@log_internal@absl@@YA_NXZ
@@ -3603,6 +3612,7 @@ EXPORTS
     ?MaskEmptyOrDeleted@GroupSse2Impl@container_internal@absl@@QBE?AV?$NonIterableBitMask@G$0BA@$0A@@23@XZ
     ?MaskFull@GroupPortableImpl@container_internal@absl@@QBE@XZ
     ?MaskFull@GroupSse2Impl@container_internal@absl@@QBE?AV?$BitMask@G$0BA@$0A@$0A@@23@XZ
+    ?MaskNonFull@GroupSse2Impl@container_internal@absl@@QBE@XZ
     ?Match@GroupSse2Impl@container_internal@absl@@QBE?AV?$BitMask@G$0BA@$0A@$0A@@23@E@Z
     ?MatchesConversions@ParsedFormatBase@str_format_internal@absl@@ABE_N_NV?$initializer_list@W4FormatConversionCharSet@absl@@@std@@@Z
     ?MaxFlatLength@CordTestAccess@strings_internal@absl@@SAIXZ
@@ -3658,7 +3668,7 @@ EXPORTS
     ?NextCapacity@container_internal@absl@@YAII@Z
     ?NextGeneration@container_internal@absl@@YAEE@Z
     ?NextRandom@ExponentialBiased@profiling_internal@absl@@SA_K_K@Z
-    ?NextSeedBaseNumber@container_internal@absl@@YAIXZ
+    ?NextSeed@container_internal@absl@@YAGXZ
     ?NextTransition@Impl@time_zone@cctz@time_internal@absl@@QBE_NABV?$time_point@Vsystem_clock@chrono@__Cr@std@@V?$duration@_JV?$ratio@$00$00@__Cr@std@@@234@@chrono@__Cr@std@@PAUcivil_transition@2345@@Z
     ?NextTransition@TimeZone@absl@@QBE_NVTime@2@PAUCivilTransition@12@@Z
     ?NextTransition@TimeZoneInfo@cctz@time_internal@absl@@UBE_NABV?$time_point@Vsystem_clock@chrono@__Cr@std@@V?$duration@_JV?$ratio@$00$00@__Cr@std@@@234@@chrono@__Cr@std@@PAUcivil_transition@time_zone@234@@Z
@@ -3733,7 +3743,6 @@ EXPORTS
     ?Post@StdcppWaiter@synchronization_internal@absl@@QAEXXZ
     ?Post@Win32Waiter@synchronization_internal@absl@@QAEXXZ
     ?PrepareForSampling@HashtablezInfo@container_internal@absl@@QAEX_JIIIG@Z
-    ?PrepareInsertAfterSoo@container_internal@absl@@YAIIIAAVCommonFields@12@@Z
     ?PrepareInsertCommon@container_internal@absl@@YAXAAVCommonFields@12@@Z
     ?PrepareInsertNonSoo@container_internal@absl@@YAIAAVCommonFields@12@ABUPolicyFunctions@12@IUFindInfo@12@@Z
     ?PrepareToDie@LogMessage@log_internal@absl@@AAEXXZ
@@ -3753,6 +3762,7 @@ EXPORTS
     ?PrevTransition@TimeZone@absl@@QBE_NVTime@2@PAUCivilTransition@12@@Z
     ?PrevTransition@TimeZoneInfo@cctz@time_internal@absl@@UBE_NABV?$time_point@Vsystem_clock@chrono@__Cr@std@@V?$duration@_JV?$ratio@$00$00@__Cr@std@@@234@@chrono@__Cr@std@@PAUcivil_transition@time_zone@234@@Z
     ?PrevTransition@TimeZoneLibC@cctz@time_internal@absl@@UBE_NABV?$time_point@Vsystem_clock@chrono@__Cr@std@@V?$duration@_JV?$ratio@$00$00@__Cr@std@@@234@@chrono@__Cr@std@@PAUcivil_transition@time_zone@234@@Z
+    ?PreviousCapacity@container_internal@absl@@YAII@Z
     ?Print@Streamable@str_format_internal@absl@@QBEAAV?$basic_ostream@DU?$char_traits@D@__Cr@std@@@__Cr@std@@AAV456@@Z
     ?ProgramInvocationName@flags_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@XZ
     ?ProgramUsageMessage@absl@@YA?AV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@XZ
@@ -3844,13 +3854,11 @@ EXPORTS
     ?RepToPointer@Status@absl@@CAPBVStatusRep@status_internal@2@I@Z
     ?ReportUnrecognizedFlags@absl@@YAXABV?$vector@UUnrecognizedFlag@absl@@V?$allocator@UUnrecognizedFlag@absl@@@__Cr@std@@@__Cr@std@@@Z
     ?ReportUsageError@flags_internal@absl@@YAXV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@_N@Z
-    ?ReserveAllocatedTable@container_internal@absl@@YAXAAVCommonFields@12@ABUPolicyFunctions@12@I@Z
     ?ReserveEmptyNonAllocatedTableToFitBucketCount@container_internal@absl@@YAXAAVCommonFields@12@ABUPolicyFunctions@12@I@Z
-    ?ReserveEmptyNonAllocatedTableToFitNewSize@container_internal@absl@@YAXAAVCommonFields@12@ABUPolicyFunctions@12@I@Z
+    ?ReserveTableToFitNewSize@container_internal@absl@@YAXAAVCommonFields@12@ABUPolicyFunctions@12@I@Z
     ?Reset@?$AllocationTransaction@V?$allocator@PAUCordRep@cord_internal@absl@@@__Cr@std@@@inlined_vector_internal@absl@@AAEXXZ
     ?Reset@?$AllocationTransaction@V?$allocator@PAVLogSink@absl@@@__Cr@std@@@inlined_vector_internal@absl@@AAEXXZ
     ?Reset@?$AllocationTransaction@V?$allocator@UPayload@status_internal@absl@@@__Cr@std@@@inlined_vector_internal@absl@@AAEXXZ
-    ?ResetCtrl@container_internal@absl@@YAXAAVCommonFields@12@I@Z
     ?ResetToBuiltinUTC@TimeZoneInfo@cctz@time_internal@absl@@AAE_NABV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@__Cr@std@@@Z
     ?ResetToEmpty@InlineRep@Cord@absl@@AAEXXZ
     ?Resize@?$ResizeUninitializedTraits@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@X@strings_internal@absl@@SAXPAV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@I@Z
@@ -3953,7 +3961,7 @@ EXPORTS
     ?ShiftLeft@?$BigUnsigned@$03@strings_internal@absl@@QAEXH@Z
     ?ShiftLeft@?$BigUnsigned@$0FE@@strings_internal@absl@@QAEXH@Z
     ?ShortProgramInvocationName@flags_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@XZ
-    ?ShouldInsertBackwardsForDebug@container_internal@absl@@YA_NIIVPerTableSeed@12@@Z
+    ?ShouldFixUpStack@internal_stacktrace@absl@@YA_NXZ
     ?ShouldLog@LogEveryNSecState@log_internal@absl@@QAE_NN@Z
     ?ShouldLog@LogEveryNState@log_internal@absl@@QAE_NH@Z
     ?ShouldLog@LogEveryPow2State@log_internal@absl@@QAE_NXZ
@@ -3980,6 +3988,7 @@ EXPORTS
     ?SingleArgStrCat@strings_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@_J@Z
     ?SingleArgStrCat@strings_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@_K@Z
     ?SixDigitsToBuffer@numbers_internal@absl@@YAINPAD@Z
+    ?SizeToCapacity@container_internal@absl@@YAII@Z
     ?Sizeof@flags_internal@absl@@YAIP6APAXW4FlagOp@12@PBXPAX2@Z@Z
     ?SizeofCordRepExternal@CordTestAccess@strings_internal@absl@@SAIXZ
     ?SizeofCordRepSubstring@CordTestAccess@strings_internal@absl@@SAIXZ
@@ -4772,6 +4781,7 @@ EXPORTS
     ?combine@?$HashStateBase@VMixingHashState@hash_internal@absl@@@hash_internal@absl@@SA?AVMixingHashState@23@V423@@Z
     ?combine_contiguous@MixingHashState@hash_internal@absl@@SA?AV123@V123@PBEI@Z
     ?combine_raw@MixingHashState@hash_internal@absl@@CA?AV123@V123@_K@Z
+    ?combine_weakly_mixed_integer@MixingHashState@hash_internal@absl@@CA?AV123@V123@UWeaklyMixedInteger@23@@Z
     ?common@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AAEAAVCommonFields@23@XZ
     ?common@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@ABEABVCommonFields@23@XZ
     ?compare_exchange_strong@?$__atomic_base@PAVTimeZone@absl@@$0A@@__Cr@std@@QAE_NAAPAVTimeZone@absl@@PAV45@W4memory_order@23@2@Z
@@ -4961,8 +4971,7 @@ EXPORTS
     ?external@CordRep@cord_internal@absl@@QBEPBUCordRepExternal@23@XZ
     ?fetch_add_end@CordRepBtree@cord_internal@absl@@AAEII@Z
     ?find@?$unordered_map@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PBVImpl@time_zone@cctz@time_internal@absl@@U?$hash@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@U?$equal_to@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@@23@@__Cr@std@@QAE?AV?$__hash_map_iterator@V?$__hash_iterator@PAU?$__hash_node@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@PAX@__Cr@std@@@__Cr@std@@@23@ABV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@23@@Z
-    ?find_first_non_full_outofline@container_internal@absl@@YA?AUFindInfo@12@ABVCommonFields@12@I@Z
-    ?find_new_positions_and_transfer_slots_fn@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@CAIAAVCommonFields@23@PAW4ctrl_t@23@PAXI@Z
+    ?find_first_non_full@container_internal@absl@@YA?AUFindInfo@12@ABVCommonFields@12@I@Z
     ?fits_in_soo@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@ABE_NI@Z
     ?fixed_time_zone@cctz@time_internal@absl@@YA?AVtime_zone@123@ABV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@__Cr@std@@@Z
     ?flat@CordRep@cord_internal@absl@@QAEPAUCordRepFlat@23@XZ
@@ -4996,6 +5005,7 @@ EXPORTS
     ?get@?$Storage@PAUPayload@status_internal@absl@@$00$0A@@internal_compressed_tuple@container_internal@absl@@QGAEAAPAUPayload@status_internal@4@XZ
     ?get@?$Storage@UStringEq@container_internal@absl@@$01$00@internal_compressed_tuple@container_internal@absl@@QGAEAAUStringEq@34@XZ
     ?get@?$Storage@UStringHash@container_internal@absl@@$00$00@internal_compressed_tuple@container_internal@absl@@QGAEAAUStringHash@34@XZ
+    ?get@?$Storage@UStringHash@container_internal@absl@@$00$00@internal_compressed_tuple@container_internal@absl@@QGBEABUStringHash@34@XZ
     ?get@?$Storage@V?$allocator@D@__Cr@std@@$00$00@internal_compressed_tuple@container_internal@absl@@QGAEAAV?$allocator@D@__Cr@std@@XZ
     ?get@?$Storage@V?$allocator@D@__Cr@std@@$02$00@internal_compressed_tuple@container_internal@absl@@QGAEAAV?$allocator@D@__Cr@std@@XZ
     ?get@?$Storage@V?$allocator@PAUCordRep@cord_internal@absl@@@__Cr@std@@$0A@$00@internal_compressed_tuple@container_internal@absl@@QGAEAAV?$allocator@PAUCordRep@cord_internal@absl@@@__Cr@std@@XZ
@@ -5060,7 +5070,9 @@ EXPORTS
     ?has_zero_flag@FormatConversionSpecImpl@str_format_internal@absl@@QBE_NXZ
     ?hash_function@?$__hash_table@PBUCordRep@cord_internal@absl@@U?$hash@PBUCordRep@cord_internal@absl@@@__Cr@std@@U?$equal_to@PBUCordRep@cord_internal@absl@@@56@V?$allocator@PBUCordRep@cord_internal@absl@@@56@@__Cr@std@@QAEAAU?$hash@PBUCordRep@cord_internal@absl@@@23@XZ
     ?hash_function@?$__hash_table@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@V?$__unordered_map_hasher@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PBVImpl@time_zone@cctz@time_internal@absl@@@23@U?$hash@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@U?$equal_to@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@V?$__unordered_map_equal@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PBVImpl@time_zone@cctz@time_internal@absl@@@23@U?$equal_to@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@U?$hash@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@V?$allocator@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@@23@@__Cr@std@@QAEAAV?$__unordered_map_hasher@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PBVImpl@time_zone@cctz@time_internal@absl@@@23@U?$hash@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@U?$equal_to@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@XZ
+    ?hash_of@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@ABEIPAT?$map_slot_type@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@23@@Z
     ?hash_ref@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AAEAAUStringHash@23@XZ
+    ?hash_ref@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@ABEABUStringHash@23@XZ
     ?height@CordRepBtree@cord_internal@absl@@QBEHXZ
     ?hour@?$civil_time@Uhour_tag@detail@cctz@time_internal@absl@@@detail@cctz@time_internal@absl@@QBEHXZ
     ?hour@?$civil_time@Usecond_tag@detail@cctz@time_internal@absl@@@detail@cctz@time_internal@absl@@QBEHXZ
@@ -5090,7 +5102,6 @@ EXPORTS
     ?is_relative_timeout@KernelTimeout@synchronization_internal@absl@@QBE_NXZ
     ?is_short@Rep@CordBuffer@absl@@QBE_NXZ
     ?is_single_group@container_internal@absl@@YA_NI@Z
-    ?is_small@container_internal@absl@@YA_NI@Z
     ?is_snapshot@CordzHandle@cord_internal@absl@@QBE_NXZ
     ?is_soo@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@ABE_NXZ
     ?is_tree@InlineData@cord_internal@absl@@QBE_NXZ
@@ -5190,6 +5201,7 @@ EXPORTS
     ?prev_transition@time_zone@cctz@time_internal@absl@@QBE_NABV?$time_point@Vsystem_clock@chrono@__Cr@std@@V?$duration@_JV?$ratio@$00$00@__Cr@std@@@234@@chrono@__Cr@std@@PAUcivil_transition@1234@@Z
     ?prev_weekday@detail@cctz@time_internal@absl@@YA?AV?$civil_time@Uday_tag@detail@cctz@time_internal@absl@@@1234@V51234@W4weekday@1234@@Z
     ?probe@container_internal@absl@@YA?AV?$probe_seq@$0BA@@12@ABVCommonFields@12@I@Z
+    ?probe@container_internal@absl@@YA?AV?$probe_seq@$0BA@@12@II@Z
     ?probe@container_internal@absl@@YA?AV?$probe_seq@$0BA@@12@VPerTableSeed@12@II@Z
     ?push_back@?$InlinedVector@PAUCordRep@cord_internal@absl@@$01V?$allocator@PAUCordRep@cord_internal@absl@@@__Cr@std@@@absl@@QAEXABQAUCordRep@cord_internal@2@@Z
     ?push_back@?$InlinedVector@PAVLogSink@absl@@$0BA@V?$allocator@PAVLogSink@absl@@@__Cr@std@@@absl@@QAEXABQAVLogSink@2@@Z
@@ -5257,7 +5269,6 @@ EXPORTS
     ?reset_reserved_growth@CommonFieldsGenerationInfoDisabled@container_internal@absl@@QAEXII@Z
     ?resize@?$vector@UTransition@cctz@time_internal@absl@@V?$allocator@UTransition@cctz@time_internal@absl@@@__Cr@std@@@__Cr@std@@QAEXI@Z
     ?resize@?$vector@UTransitionType@cctz@time_internal@absl@@V?$allocator@UTransitionType@cctz@time_internal@absl@@@__Cr@std@@@__Cr@std@@QAEXI@Z
-    ?resize_full_soo_table_to_next_capacity@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AAEXXZ
     ?safe_strto128_base@numbers_internal@absl@@YA_NV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVint128@2@H@Z
     ?safe_strto16_base@numbers_internal@absl@@YA_NV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAFH@Z
     ?safe_strto32_base@numbers_internal@absl@@YA_NV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAHH@Z
@@ -5416,6 +5427,7 @@ EXPORTS
     ?to_slot@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@CAPAT?$map_slot_type@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@23@PAX@Z
     ?total_written@BufferRawSink@str_format_internal@absl@@QBEIXZ
     ?transfer@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AAEXPAT?$map_slot_type@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@23@0@Z
+    ?transfer_unprobed_elements_to_next_capacity_fn@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@CAXAAVCommonFields@23@PBW4ctrl_t@23@PAX2P6AX2EII@Z@Z
     ?tree@InlineRep@Cord@absl@@QBEPAUCordRep@cord_internal@3@XZ
     ?tree@Rep@InlineData@cord_internal@absl@@QBEPAUCordRep@34@XZ
     ?type@ProtoField@log_internal@absl@@QBE?AW4WireType@23@XZ
diff --git a/deps/v8/third_party/abseil-cpp/symbols_x86_rel.def b/deps/v8/third_party/abseil-cpp/symbols_x86_rel.def
index 5c5c36eadb99d6..8b38fe013e628f 100644
--- a/deps/v8/third_party/abseil-cpp/symbols_x86_rel.def
+++ b/deps/v8/third_party/abseil-cpp/symbols_x86_rel.def
@@ -62,6 +62,7 @@ EXPORTS
     ??$CopyToEncodedBufferWithStructuredProtoField@$00@LogMessage@log_internal@absl@@AAEXUStructuredProtoField@12@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
     ??$CopyToEncodedBufferWithStructuredProtoField@$0A@@LogMessage@log_internal@absl@@AAEXUStructuredProtoField@12@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
     ??$DeallocateBackingArray@$03V?$allocator@D@__Cr@std@@@container_internal@absl@@YAXPAXIPAW4ctrl_t@01@II_N@Z
+    ??$DecomposePair@UHashElement@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AAU?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@container_internal@absl@@YAI$$QAUHashElement@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@01@AAU?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@Z
     ??$Dispatch@C@FormatArgImpl@str_format_internal@absl@@CA_NTData@012@VFormatConversionSpecImpl@12@PAX@Z
     ??$Dispatch@D@FormatArgImpl@str_format_internal@absl@@CA_NTData@012@VFormatConversionSpecImpl@12@PAX@Z
     ??$Dispatch@E@FormatArgImpl@str_format_internal@absl@@CA_NTData@012@VFormatConversionSpecImpl@12@PAX@Z
@@ -98,10 +99,10 @@ EXPORTS
     ??$GenericCompare@HV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@absl@@YAHABVCord@0@ABV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@I@Z
     ??$GenericCompare@HVCord@absl@@@absl@@YAHABVCord@0@0I@Z
     ??$GenericCompare@_NVCord@absl@@@absl@@YA_NABVCord@0@0I@Z
-    ??$GrowFullSooTableToNextCapacity@$00$00@container_internal@absl@@YAXAAVCommonFields@01@ABUPolicyFunctions@01@I@Z
-    ??$GrowFullSooTableToNextCapacity@$03$00@container_internal@absl@@YAXAAVCommonFields@01@ABUPolicyFunctions@01@I@Z
-    ??$GrowFullSooTableToNextCapacity@$07$00@container_internal@absl@@YAXAAVCommonFields@01@ABUPolicyFunctions@01@I@Z
-    ??$GrowFullSooTableToNextCapacity@$0A@$0A@@container_internal@absl@@YAXAAVCommonFields@01@ABUPolicyFunctions@01@I@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$00$00@container_internal@absl@@YAIAAVCommonFields@01@ABUPolicyFunctions@01@IW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$03$00@container_internal@absl@@YAIAAVCommonFields@01@ABUPolicyFunctions@01@IW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$07$00@container_internal@absl@@YAIAAVCommonFields@01@ABUPolicyFunctions@01@IW4ctrl_t@01@@Z
+    ??$GrowSooTableToNextCapacityAndPrepareInsert@$0A@$0A@@container_internal@absl@@YAIAAVCommonFields@01@ABUPolicyFunctions@01@IW4ctrl_t@01@@Z
     ??$IntegerToString@H@strings_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@H@Z
     ??$IntegerToString@I@strings_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@I@Z
     ??$IntegerToString@J@strings_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@J@Z
@@ -148,7 +149,8 @@ EXPORTS
     ??$StrReplaceAll@V?$initializer_list@U?$pair@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V123@@__Cr@std@@@std@@@absl@@YAHABV?$initializer_list@U?$pair@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V123@@__Cr@std@@@std@@PAV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@2@@Z
     ??$StrSplit@VByAnyChar@absl@@@absl@@YA?AV?$Splitter@VByAnyChar@absl@@UAllowEmpty@2@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@strings_internal@0@VConvertibleToStringView@20@VByAnyChar@0@@Z
     ??$StrSplit@VByAnyChar@absl@@USkipEmpty@2@@absl@@YA?AV?$Splitter@VByAnyChar@absl@@USkipEmpty@2@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@strings_internal@0@VConvertibleToStringView@20@VByAnyChar@0@USkipEmpty@0@@Z
-    ??$TransferRelocatable@$0M@@container_internal@absl@@YAXPAX00I@Z
+    ??$TransferNRelocatable@$0M@@container_internal@absl@@YAXPAX00I@Z
+    ??$TryFindNewIndexWithoutProbing@X@container_internal@absl@@YAIIIIPAW4ctrl_t@01@I@Z
     ??$TypeErasedApplyToSlotFn@UStringHash@container_internal@absl@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@container_internal@absl@@YAIPBXPAX@Z
     ??$UnparseFloatingPointVal@M@flags_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@M@Z
     ??$UnparseFloatingPointVal@N@flags_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@N@Z
@@ -170,8 +172,6 @@ EXPORTS
     ??$__emplace_unique_key_args@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@ABUpiecewise_construct_t@23@V?$tuple@ABV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@V?$tuple@$$V@23@@?$__tree@U?$__value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$vector@PBVCommandLineFlag@absl@@V?$allocator@PBVCommandLineFlag@absl@@@__Cr@std@@@23@@__Cr@std@@V?$__map_value_compare@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$vector@PBVCommandLineFlag@absl@@V?$allocator@PBVCommandLineFlag@absl@@@__Cr@std@@@23@@23@U?$less@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@V?$allocator@U?$__value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$vector@PBVCommandLineFlag@absl@@V?$allocator@PBVCommandLineFlag@absl@@@__Cr@std@@@23@@__Cr@std@@@23@@__Cr@std@@QAE?AU?$pair@V?$__tree_iterator@U?$__value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$vector@PBVCommandLineFlag@absl@@V?$allocator@PBVCommandLineFlag@absl@@@__Cr@std@@@23@@__Cr@std@@PAV?$__tree_node@U?$__value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$vector@PBVCommandLineFlag@absl@@V?$allocator@PBVCommandLineFlag@absl@@@__Cr@std@@@23@@__Cr@std@@PAX@23@H@__Cr@std@@_N@12@ABV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@12@ABUpiecewise_construct_t@12@$$QAV?$tuple@ABV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@12@$$QAV?$tuple@$$V@12@@Z
     ??$__for_each_segment@V?$__deque_iterator@UPrefixCrc@CrcCordState@crc_internal@absl@@PBU1234@ABU1234@PBQBU1234@H$0A@@__Cr@std@@U?$_CopySegment@V?$__deque_iterator@UPrefixCrc@CrcCordState@crc_internal@absl@@PBU1234@ABU1234@PBQBU1234@H$0A@@__Cr@std@@V?$__deque_iterator@UPrefixCrc@CrcCordState@crc_internal@absl@@PAU1234@AAU1234@PAPAU1234@H$0A@@23@@__copy_impl@23@@__Cr@std@@YAXV?$__deque_iterator@UPrefixCrc@CrcCordState@crc_internal@absl@@PBU1234@ABU1234@PBQBU1234@H$0A@@01@0U?$_CopySegment@V?$__deque_iterator@UPrefixCrc@CrcCordState@crc_internal@absl@@PBU1234@ABU1234@PBQBU1234@H$0A@@__Cr@std@@V?$__deque_iterator@UPrefixCrc@CrcCordState@crc_internal@absl@@PAU1234@AAU1234@PAPAU1234@H$0A@@23@@__copy_impl@01@@Z
     ??$__insert_with_size@V?$__wrap_iter@PAUraw_view@?1???R?$ConvertToContainer@V?$vector@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V?$allocator@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@23@@__Cr@std@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@23@$0A@@?$Splitter@VByChar@absl@@UAllowEmpty@2@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@strings_internal@absl@@QBE?AV?$vector@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V?$allocator@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@23@@__Cr@std@@ABV345@@Z@@__Cr@std@@V123@@?$vector@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V?$allocator@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@23@@__Cr@std@@AAE?AV?$__wrap_iter@PAV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@12@V?$__wrap_iter@PBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@12@V?$__wrap_iter@PAUraw_view@?1???R?$ConvertToContainer@V?$vector@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V?$allocator@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@23@@__Cr@std@@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@23@$0A@@?$Splitter@VByChar@absl@@UAllowEmpty@2@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@strings_internal@absl@@QBE?AV?$vector@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@V?$allocator@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@23@@__Cr@std@@ABV345@@Z@@12@1H@Z
-    ??$combine@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@$$V@?$HashStateBase@VMixingHashState@hash_internal@absl@@@hash_internal@absl@@SA?AVMixingHashState@12@V312@ABV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
-    ??$combine@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@H@?$HashStateBase@VMixingHashState@hash_internal@absl@@@hash_internal@absl@@SA?AVMixingHashState@12@V312@ABV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@ABH@Z
     ??$emplace@$$V@?$vector@UTransition@cctz@time_internal@absl@@V?$allocator@UTransition@cctz@time_internal@absl@@@__Cr@std@@@__Cr@std@@QAE?AV?$__wrap_iter@PAUTransition@cctz@time_internal@absl@@@12@V?$__wrap_iter@PBUTransition@cctz@time_internal@absl@@@12@@Z
     ??$emplace@$$V@?$vector@UTransitionType@cctz@time_internal@absl@@V?$allocator@UTransitionType@cctz@time_internal@absl@@@__Cr@std@@@__Cr@std@@QAE?AV?$__wrap_iter@PAUTransitionType@cctz@time_internal@absl@@@12@V?$__wrap_iter@PBUTransitionType@cctz@time_internal@absl@@@12@@Z
     ??$emplace_back@$$V@?$__split_buffer@UTransition@cctz@time_internal@absl@@AAV?$allocator@UTransition@cctz@time_internal@absl@@@__Cr@std@@@__Cr@std@@QAEXXZ
@@ -198,7 +198,6 @@ EXPORTS
     ??$emplace_front@PAUPrefixCrc@CrcCordState@crc_internal@absl@@@?$__split_buffer@PAUPrefixCrc@CrcCordState@crc_internal@absl@@V?$allocator@PAUPrefixCrc@CrcCordState@crc_internal@absl@@@__Cr@std@@@__Cr@std@@QAEX$$QAPAUPrefixCrc@CrcCordState@crc_internal@absl@@@Z
     ??$find@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@?$__hash_table@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@V?$__unordered_map_hasher@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PBVImpl@time_zone@cctz@time_internal@absl@@@23@U?$hash@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@U?$equal_to@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@V?$__unordered_map_equal@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PBVImpl@time_zone@cctz@time_internal@absl@@@23@U?$equal_to@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@U?$hash@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@V?$allocator@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@@23@@__Cr@std@@QAE?AV?$__hash_iterator@PAU?$__hash_node@U?$__hash_value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PBVImpl@time_zone@cctz@time_internal@absl@@@__Cr@std@@PAX@__Cr@std@@@12@ABV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@12@@Z
     ??$find@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@QAE?AViterator@012@ABV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
-    ??$find_first_non_full@X@container_internal@absl@@YA?AUFindInfo@01@ABVCommonFields@01@I@Z
     ??$find_or_prepare_insert_non_soo@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@AAE?AU?$pair@Viterator@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@_N@__Cr@std@@ABV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@45@@Z
     ??0?$BigUnsigned@$03@strings_internal@absl@@QAE@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
     ??0?$BigUnsigned@$03@strings_internal@absl@@QAE@XZ
@@ -634,6 +633,7 @@ EXPORTS
     ?FindPath@GraphCycles@synchronization_internal@absl@@QBEHUGraphId@23@0HQAU423@@Z
     ?FiveToTheNth@?$BigUnsigned@$03@strings_internal@absl@@SA?AV123@H@Z
     ?FiveToTheNth@?$BigUnsigned@$0FE@@strings_internal@absl@@SA?AV123@H@Z
+    ?FixUpStack@internal_stacktrace@absl@@YAXPAPAXPAIPAHIAAI@Z
     ?FixedOffsetFromName@cctz@time_internal@absl@@YA_NABV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@PAV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@56@@Z
     ?FixedOffsetToAbbr@cctz@time_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@ABV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@56@@Z
     ?FixedOffsetToName@cctz@time_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@ABV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@56@@Z
@@ -753,7 +753,6 @@ EXPORTS
     ?GetWord@?$BigUnsigned@$0FE@@strings_internal@absl@@QBEIH@Z
     ?GlobalHashtablezSampler@container_internal@absl@@YAAAV?$SampleRecorder@UHashtablezInfo@container_internal@absl@@@profiling_internal@2@XZ
     ?GlobalRegistry@FlagRegistry@flags_internal@absl@@SAAAV123@XZ
-    ?GrowEmptySooTableToNextCapacityForceSampling@container_internal@absl@@YAXAAVCommonFields@12@ABUPolicyFunctions@12@@Z
     ?GrowFullSooTableToNextCapacityForceSampling@container_internal@absl@@YAXAAVCommonFields@12@ABUPolicyFunctions@12@@Z
     ?GuaranteedEqual@Condition@absl@@SA_NPBV12@0@Z
     ?HandleInvalidStatusCtorArg@Helper@internal_statusor@absl@@SAXPAVStatus@3@@Z
@@ -944,7 +943,6 @@ EXPORTS
     ?Post@StdcppWaiter@synchronization_internal@absl@@QAEXXZ
     ?Post@Win32Waiter@synchronization_internal@absl@@QAEXXZ
     ?PrepareForSampling@HashtablezInfo@container_internal@absl@@QAEX_JIIIG@Z
-    ?PrepareInsertAfterSoo@container_internal@absl@@YAIIIAAVCommonFields@12@@Z
     ?PrepareInsertNonSoo@container_internal@absl@@YAIAAVCommonFields@12@ABUPolicyFunctions@12@IUFindInfo@12@@Z
     ?PrepareToDie@LogMessage@log_internal@absl@@AAEXXZ
     ?PrepareToModify@Status@absl@@CAPAVStatusRep@status_internal@2@I@Z
@@ -1023,9 +1021,8 @@ EXPORTS
     ?RemoveSuffix@CordRepBtree@cord_internal@absl@@SAPAUCordRep@23@PAV123@I@Z
     ?ReportUnrecognizedFlags@absl@@YAXABV?$vector@UUnrecognizedFlag@absl@@V?$allocator@UUnrecognizedFlag@absl@@@__Cr@std@@@__Cr@std@@@Z
     ?ReportUsageError@flags_internal@absl@@YAXV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@_N@Z
-    ?ReserveAllocatedTable@container_internal@absl@@YAXAAVCommonFields@12@ABUPolicyFunctions@12@I@Z
     ?ReserveEmptyNonAllocatedTableToFitBucketCount@container_internal@absl@@YAXAAVCommonFields@12@ABUPolicyFunctions@12@I@Z
-    ?ReserveEmptyNonAllocatedTableToFitNewSize@container_internal@absl@@YAXAAVCommonFields@12@ABUPolicyFunctions@12@I@Z
+    ?ReserveTableToFitNewSize@container_internal@absl@@YAXAAVCommonFields@12@ABUPolicyFunctions@12@I@Z
     ?ResetToBuiltinUTC@TimeZoneInfo@cctz@time_internal@absl@@AAE_NABV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@__Cr@std@@@Z
     ?ResizeAllocatedTableWithSeedChange@container_internal@absl@@YAXAAVCommonFields@12@ABUPolicyFunctions@12@I@Z
     ?ResourceExhaustedError@absl@@YA?AVStatus@1@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@@Z
@@ -1082,7 +1079,7 @@ EXPORTS
     ?ShiftLeft@?$BigUnsigned@$03@strings_internal@absl@@QAEXH@Z
     ?ShiftLeft@?$BigUnsigned@$0FE@@strings_internal@absl@@QAEXH@Z
     ?ShortProgramInvocationName@flags_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@XZ
-    ?ShouldInsertBackwardsForDebug@container_internal@absl@@YA_NIIVPerTableSeed@12@@Z
+    ?ShouldFixUpStack@internal_stacktrace@absl@@YA_NXZ
     ?ShouldLog@LogEveryNSecState@log_internal@absl@@QAE_NN@Z
     ?ShouldLog@LogEveryNState@log_internal@absl@@QAE_NH@Z
     ?ShouldLog@LogEveryPow2State@log_internal@absl@@QAE_NXZ
@@ -1311,8 +1308,7 @@ EXPORTS
     ?destroy@?$__tree@U?$__value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$vector@PBVCommandLineFlag@absl@@V?$allocator@PBVCommandLineFlag@absl@@@__Cr@std@@@23@@__Cr@std@@V?$__map_value_compare@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@U?$__value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$vector@PBVCommandLineFlag@absl@@V?$allocator@PBVCommandLineFlag@absl@@@__Cr@std@@@23@@23@U?$less@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@@23@$00@23@V?$allocator@U?$__value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$vector@PBVCommandLineFlag@absl@@V?$allocator@PBVCommandLineFlag@absl@@@__Cr@std@@@23@@__Cr@std@@@23@@__Cr@std@@AAEXPAV?$__tree_node@U?$__value_type@V?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@V?$vector@PBVCommandLineFlag@absl@@V?$allocator@PBVCommandLineFlag@absl@@@__Cr@std@@@23@@__Cr@std@@PAX@23@@Z
     ?effective_impl@time_zone@cctz@time_internal@absl@@ABEABVImpl@1234@XZ
     ?engines@?1??CrcAndCopy@CrcMemcpy@crc_internal@absl@@SA?AVcrc32c_t@4@PIAXPIBXIV54@_N@Z@4UArchSpecificEngines@234@B
-    ?find_first_non_full_outofline@container_internal@absl@@YA?AUFindInfo@12@ABVCommonFields@12@I@Z
-    ?find_new_positions_and_transfer_slots_fn@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@CAIAAVCommonFields@23@PAW4ctrl_t@23@PAXI@Z
+    ?find_first_non_full@container_internal@absl@@YA?AUFindInfo@12@ABVCommonFields@12@I@Z
     ?fixed_time_zone@cctz@time_internal@absl@@YA?AVtime_zone@123@ABV?$duration@_JV?$ratio@$00$00@__Cr@std@@@chrono@__Cr@std@@@Z
     ?format@detail@cctz@time_internal@absl@@YA?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@ABV567@ABV?$time_point@Vsystem_clock@chrono@__Cr@std@@V?$duration@_JV?$ratio@$00$00@__Cr@std@@@234@@chrono@67@ABV?$duration@_JV?$ratio@$00$0DINHOKEMGIAAA@@__Cr@std@@@967@ABVtime_zone@234@@Z
     ?from_chars@absl@@YA?AUfrom_chars_result@1@PBD0AAMW4chars_format@1@@Z
@@ -1357,6 +1353,7 @@ EXPORTS
     ?size@Cord@absl@@QBEIXZ
     ?status@BadStatusOrAccess@absl@@QBEABVStatus@2@XZ
     ?stream@OstreamView@LogMessage@log_internal@absl@@QAEAAV?$basic_ostream@DU?$char_traits@D@__Cr@std@@@__Cr@std@@XZ
+    ?transfer_unprobed_elements_to_next_capacity_fn@?$raw_hash_set@U?$FlatHashMapPolicy@V?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@container_internal@absl@@UStringHash@23@UStringEq@23@V?$allocator@U?$pair@$$CBV?$basic_string_view@DU?$char_traits@D@__Cr@std@@@__Cr@std@@PAVCommandLineFlag@absl@@@__Cr@std@@@__Cr@std@@@container_internal@absl@@CAXAAVCommonFields@23@PBW4ctrl_t@23@PAX2P6AX2EII@Z@Z
     ?utc_time_zone@cctz@time_internal@absl@@YA?AVtime_zone@123@XZ
     ?version@time_zone@cctz@time_internal@absl@@QBE?AV?$basic_string@DU?$char_traits@D@__Cr@std@@V?$allocator@D@23@@__Cr@std@@XZ
     ?what@BadStatusOrAccess@absl@@UBEPBDXZ
diff --git a/deps/v8/third_party/simdutf/BUILD.gn b/deps/v8/third_party/simdutf/BUILD.gn
index d88fe7e43ac2a8..5fbce38841f04d 100644
--- a/deps/v8/third_party/simdutf/BUILD.gn
+++ b/deps/v8/third_party/simdutf/BUILD.gn
@@ -13,6 +13,10 @@ source_set("simdutf") {
     "-Wno-unused-const-variable",
     "-Wno-unused-function",
   ]
+  if (is_win) {
+    # Supress dllexports when included in chrome.exe.
+    defines = [ "SIMDUTF_DLLIMPORTEXPORT=" ]
+  }
   configs -= [ "//build/config/compiler:chromium_code" ]
   configs += [ "//build/config/compiler:no_chromium_code" ]
   if (!is_debug) {
diff --git a/deps/v8/third_party/zlib/BUILD.gn b/deps/v8/third_party/zlib/BUILD.gn
index 378bd0df75ca22..2a898d2a60cfa2 100644
--- a/deps/v8/third_party/zlib/BUILD.gn
+++ b/deps/v8/third_party/zlib/BUILD.gn
@@ -70,7 +70,7 @@ source_set("zlib_common_headers") {
 use_arm_neon_optimizations = false
 if ((current_cpu == "arm" || current_cpu == "arm64") &&
     !(is_win && !is_clang)) {
-  # TODO(richard.townsend@arm.com): Optimizations temporarily disabled for
+  # TODO(ritownsend@google.com): Optimizations temporarily disabled for
   # Windows on Arm MSVC builds, see http://crbug.com/v8/10012.
   if (arm_use_neon) {
     use_arm_neon_optimizations = true
diff --git a/deps/v8/third_party/zlib/CMakeLists.txt b/deps/v8/third_party/zlib/CMakeLists.txt
index ebf9cd41248655..b085ab8d7cab7a 100644
--- a/deps/v8/third_party/zlib/CMakeLists.txt
+++ b/deps/v8/third_party/zlib/CMakeLists.txt
@@ -3,7 +3,7 @@ set(CMAKE_ALLOW_LOOSE_LOOP_CONSTRUCTS ON)
 
 project(zlib C)
 
-set(VERSION "1.3.0.1")
+set(VERSION "1.3.1")
 
 set(INSTALL_BIN_DIR "${CMAKE_INSTALL_PREFIX}/bin" CACHE PATH "Installation directory for executables")
 set(INSTALL_LIB_DIR "${CMAKE_INSTALL_PREFIX}/lib" CACHE PATH "Installation directory for libraries")
@@ -267,7 +267,9 @@ if(MINGW)
 endif(MINGW)
 
 add_library(zlib SHARED ${ZLIB_SRCS} ${ZLIB_DLL_SRCS} ${ZLIB_PUBLIC_HDRS} ${ZLIB_PRIVATE_HDRS})
+target_include_directories(zlib PUBLIC ${CMAKE_CURRENT_BINARY_DIR} ${CMAKE_CURRENT_SOURCE_DIR})
 add_library(zlibstatic STATIC ${ZLIB_SRCS} ${ZLIB_PUBLIC_HDRS} ${ZLIB_PRIVATE_HDRS})
+target_include_directories(zlibstatic PUBLIC ${CMAKE_CURRENT_BINARY_DIR} ${CMAKE_CURRENT_SOURCE_DIR})
 set_target_properties(zlib PROPERTIES DEFINE_SYMBOL ZLIB_DLL)
 set_target_properties(zlib PROPERTIES SOVERSION 1)
 
diff --git a/deps/v8/third_party/zlib/README.chromium b/deps/v8/third_party/zlib/README.chromium
index 92c5bfd1af200e..1f7c7460451113 100644
--- a/deps/v8/third_party/zlib/README.chromium
+++ b/deps/v8/third_party/zlib/README.chromium
@@ -1,9 +1,9 @@
 Name: zlib
 Short Name: zlib
 URL: http://zlib.net/
-Version: 1.3.0.1
-Revision: ac8f12c97d1afd9bafa9c710f827d40a407d3266
-CPEPrefix: cpe:/a:zlib:zlib:1.3.0.1
+Version: 1.3.1
+Revision: 51b7f2abdade71cd9bb0e7a373ef2610ec6f9daf
+CPEPrefix: cpe:/a:zlib:zlib:1.3.1
 Security Critical: yes
 Shipped: yes
 License: Zlib
@@ -21,14 +21,17 @@ also implements the zlib (RFC 1950) and gzip (RFC 1952) wrapper formats.
 Local Modifications:
  - Only source code from the zlib distribution used to build the zlib and
    minizip libraries are present. Many other files have been omitted. Only *.c
-   and *.h files from the upstream root directory and contrib/minizip were
-   imported.
+   and *.h files from the upstream root directory, contrib/minizip and
+   examples/zpipe.c were imported.
+ - The files named '*simd*' are original x86/Arm/RISC-V specific optimizations.
  - The contents of the google directory are original Chromium-specific
    additions.
+ - The contents of the 'contrib' of directory are either Chromium-specific
+   additions or heavily patched zlib files (e.g. inffast_chunk*).
  - Added chromeconf.h
  - Plus the changes in 'patches' folder.
  - Code in contrib/ other than contrib/minizip was added to match zlib's
    contributor layout.
- - In sync with 1.2.13 official release
+ - In sync with 1.3.1 official release
  - ZIP reader modified to allow for progress callbacks during extraction.
  - ZIP reader modified to add detection of AES encrypted content.
diff --git a/deps/v8/third_party/zlib/deflate.c b/deps/v8/third_party/zlib/deflate.c
index 8a5281c2b6cd8d..1d4c68844c3b80 100644
--- a/deps/v8/third_party/zlib/deflate.c
+++ b/deps/v8/third_party/zlib/deflate.c
@@ -1,5 +1,5 @@
 /* deflate.c -- compress data using the deflation algorithm
- * Copyright (C) 1995-2023 Jean-loup Gailly and Mark Adler
+ * Copyright (C) 1995-2024 Jean-loup Gailly and Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -69,7 +69,7 @@
 #endif
 
 const char deflate_copyright[] =
-   " deflate 1.3.0.1 Copyright 1995-2023 Jean-loup Gailly and Mark Adler ";
+   " deflate 1.3.1 Copyright 1995-2024 Jean-loup Gailly and Mark Adler ";
 /*
   If you use the zlib library in a product, an acknowledgment is welcome
   in the documentation of your product. If for some reason you cannot
@@ -485,14 +485,7 @@ int ZEXPORT deflateInit2_(z_streamp strm, int level, int method,
     s->window = (Bytef *) ZALLOC(strm,
                                  s->w_size + WINDOW_PADDING,
                                  2*sizeof(Byte));
-    /* Avoid use of unitialized values in the window, see crbug.com/1137613 and
-     * crbug.com/1144420 */
-    zmemzero(s->window, (s->w_size + WINDOW_PADDING) * (2 * sizeof(Byte)));
     s->prev   = (Posf *)  ZALLOC(strm, s->w_size, sizeof(Pos));
-    /* Avoid use of uninitialized value, see:
-     * https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11360
-     */
-    zmemzero(s->prev, s->w_size * sizeof(Pos));
     s->head   = (Posf *)  ZALLOC(strm, s->hash_size, sizeof(Pos));
 
     s->high_water = 0;      /* nothing written to s->window yet */
@@ -551,6 +544,13 @@ int ZEXPORT deflateInit2_(z_streamp strm, int level, int method,
         deflateEnd (strm);
         return Z_MEM_ERROR;
     }
+    /* Avoid use of unitialized values in the window, see crbug.com/1137613 and
+     * crbug.com/1144420 */
+    zmemzero(s->window, (s->w_size + WINDOW_PADDING) * (2 * sizeof(Byte)));
+    /* Avoid use of uninitialized value, see:
+     * https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11360
+     */
+    zmemzero(s->prev, s->w_size * sizeof(Pos));
 #ifdef LIT_MEM
     s->d_buf = (ushf *)(s->pending_buf + (s->lit_bufsize << 1));
     s->l_buf = s->pending_buf + (s->lit_bufsize << 2);
@@ -1663,13 +1663,21 @@ local uInt longest_match(deflate_state *s, IPos cur_match) {
  */
 local void check_match(deflate_state *s, IPos start, IPos match, int length) {
     /* check that the match is indeed a match */
-    if (zmemcmp(s->window + match,
-                s->window + start, length) != EQUAL) {
-        fprintf(stderr, " start %u, match %u, length %d\n",
-                start, match, length);
+    Bytef *back = s->window + (int)match, *here = s->window + start;
+    IPos len = length;
+    if (match == (IPos)-1) {
+        /* match starts one byte before the current window -- just compare the
+           subsequent length-1 bytes */
+        back++;
+        here++;
+        len--;
+    }
+    if (zmemcmp(back, here, len) != EQUAL) {
+        fprintf(stderr, " start %u, match %d, length %d\n",
+                start, (int)match, length);
         do {
-            fprintf(stderr, "%c%c", s->window[match++], s->window[start++]);
-        } while (--length != 0);
+            fprintf(stderr, "(%02x %02x)", *back++, *here++);
+        } while (--len != 0);
         z_error("invalid match");
     }
     if (z_verbose > 1) {
diff --git a/deps/v8/third_party/zlib/deflate.h b/deps/v8/third_party/zlib/deflate.h
index 099d35943192bf..2d5eaabaab6d3e 100644
--- a/deps/v8/third_party/zlib/deflate.h
+++ b/deps/v8/third_party/zlib/deflate.h
@@ -1,5 +1,5 @@
 /* deflate.h -- internal compression state
- * Copyright (C) 1995-2018 Jean-loup Gailly
+ * Copyright (C) 1995-2024 Jean-loup Gailly
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
diff --git a/deps/v8/third_party/zlib/gzguts.h b/deps/v8/third_party/zlib/gzguts.h
index f9375047e8c58f..eba72085bb756b 100644
--- a/deps/v8/third_party/zlib/gzguts.h
+++ b/deps/v8/third_party/zlib/gzguts.h
@@ -1,5 +1,5 @@
 /* gzguts.h -- zlib internal header definitions for gz* operations
- * Copyright (C) 2004-2019 Mark Adler
+ * Copyright (C) 2004-2024 Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -210,9 +210,5 @@ char ZLIB_INTERNAL *gz_strwinerror(DWORD error);
 /* GT_OFF(x), where x is an unsigned value, is true if x > maximum z_off64_t
    value -- needed when comparing unsigned to z_off64_t, which is signed
    (possible z_off64_t types off_t, off64_t, and long are all signed) */
-#ifdef INT_MAX
-#  define GT_OFF(x) (sizeof(int) == sizeof(z_off64_t) && (x) > INT_MAX)
-#else
 unsigned ZLIB_INTERNAL gz_intmax(void);
-#  define GT_OFF(x) (sizeof(int) == sizeof(z_off64_t) && (x) > gz_intmax())
-#endif
+#define GT_OFF(x) (sizeof(int) == sizeof(z_off64_t) && (x) > gz_intmax())
diff --git a/deps/v8/third_party/zlib/gzlib.c b/deps/v8/third_party/zlib/gzlib.c
index 0d3ebf8d297e57..7136395f89a953 100644
--- a/deps/v8/third_party/zlib/gzlib.c
+++ b/deps/v8/third_party/zlib/gzlib.c
@@ -1,5 +1,5 @@
 /* gzlib.c -- zlib functions common to reading and writing gzip files
- * Copyright (C) 2004-2019 Mark Adler
+ * Copyright (C) 2004-2024 Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -566,20 +566,20 @@ void ZLIB_INTERNAL gz_error(gz_statep state, int err, const char *msg) {
 #endif
 }
 
-#ifndef INT_MAX
 /* portably return maximum value for an int (when limits.h presumed not
    available) -- we need to do this to cover cases where 2's complement not
    used, since C standard permits 1's complement and sign-bit representations,
    otherwise we could just use ((unsigned)-1) >> 1 */
 unsigned ZLIB_INTERNAL gz_intmax(void) {
-    unsigned p, q;
-
-    p = 1;
+#ifdef INT_MAX
+    return INT_MAX;
+#else
+    unsigned p = 1, q;
     do {
         q = p;
         p <<= 1;
         p++;
     } while (p > q);
     return q >> 1;
-}
 #endif
+}
diff --git a/deps/v8/third_party/zlib/inftrees.c b/deps/v8/third_party/zlib/inftrees.c
index 73d5a776987ce1..98cfe164458c40 100644
--- a/deps/v8/third_party/zlib/inftrees.c
+++ b/deps/v8/third_party/zlib/inftrees.c
@@ -1,5 +1,5 @@
 /* inftrees.c -- generate Huffman trees for efficient decoding
- * Copyright (C) 1995-2023 Mark Adler
+ * Copyright (C) 1995-2024 Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -9,7 +9,7 @@
 #define MAXBITS 15
 
 const char inflate_copyright[] =
-   " inflate 1.3.0.1 Copyright 1995-2023 Mark Adler ";
+   " inflate 1.3.1 Copyright 1995-2024 Mark Adler ";
 /*
   If you use the zlib library in a product, an acknowledgment is welcome
   in the documentation of your product. If for some reason you cannot
@@ -57,7 +57,7 @@ int ZLIB_INTERNAL inflate_table(codetype type, unsigned short FAR *lens,
         35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258, 0, 0};
     static const unsigned short lext[31] = { /* Length codes 257..285 extra */
         16, 16, 16, 16, 16, 16, 16, 16, 17, 17, 17, 17, 18, 18, 18, 18,
-        19, 19, 19, 19, 20, 20, 20, 20, 21, 21, 21, 21, 16, 70, 200};
+        19, 19, 19, 19, 20, 20, 20, 20, 21, 21, 21, 21, 16, 203, 77};
     static const unsigned short dbase[32] = { /* Distance codes 0..29 base */
         1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193,
         257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145,
diff --git a/deps/v8/third_party/zlib/inftrees.h b/deps/v8/third_party/zlib/inftrees.h
index f11f29c0761c15..6e7f0fa2a8afde 100644
--- a/deps/v8/third_party/zlib/inftrees.h
+++ b/deps/v8/third_party/zlib/inftrees.h
@@ -41,7 +41,7 @@ typedef struct {
    examples/enough.c found in the zlib distribution.  The arguments to that
    program are the number of symbols, the initial root table size, and the
    maximum bit length of a code.  "enough 286 10 15" for literal/length codes
-   returns returns 1332, and "enough 30 9 15" for distance codes returns 592.
+   returns 1332, and "enough 30 9 15" for distance codes returns 592.
    The initial root table size (10 or 9) is found in the fifth argument of the
    inflate_table() calls in inflate.c and infback.c.  If the root table size is
    changed, then these maximum sizes would be need to be recalculated and
diff --git a/deps/v8/third_party/zlib/patches/0017-deflate-move-zmemzero-after-null-check.patch b/deps/v8/third_party/zlib/patches/0017-deflate-move-zmemzero-after-null-check.patch
new file mode 100644
index 00000000000000..ac8ade53621ae0
--- /dev/null
+++ b/deps/v8/third_party/zlib/patches/0017-deflate-move-zmemzero-after-null-check.patch
@@ -0,0 +1,49 @@
+From 93f86001b67609106c658fe0908a9b7931245b8a Mon Sep 17 00:00:00 2001
+From: pedro martelletto <martelletto@google.com>
+Date: Thu, 3 Apr 2025 16:46:42 +0000
+Subject: [PATCH] [zlib] Deflate: move zmemzero after NULL check
+
+ZALLOC() might fail, in which case dereferencing the returned pointer
+results in undefined behaviour. N.B. These conditions are not reachable
+from Chromium, as Chromium will abort rather than return nullptr from
+malloc. Found by libfido2's fuzz harness.
+---
+ third_party/zlib/deflate.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/third_party/zlib/deflate.c b/third_party/zlib/deflate.c
+index 8a5281c2b6cd8..49496bb3b0561 100644
+--- a/third_party/zlib/deflate.c
++++ b/third_party/zlib/deflate.c
+@@ -485,14 +485,7 @@ int ZEXPORT deflateInit2_(z_streamp strm, int level, int method,
+     s->window = (Bytef *) ZALLOC(strm,
+                                  s->w_size + WINDOW_PADDING,
+                                  2*sizeof(Byte));
+-    /* Avoid use of unitialized values in the window, see crbug.com/1137613 and
+-     * crbug.com/1144420 */
+-    zmemzero(s->window, (s->w_size + WINDOW_PADDING) * (2 * sizeof(Byte)));
+     s->prev   = (Posf *)  ZALLOC(strm, s->w_size, sizeof(Pos));
+-    /* Avoid use of uninitialized value, see:
+-     * https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11360
+-     */
+-    zmemzero(s->prev, s->w_size * sizeof(Pos));
+     s->head   = (Posf *)  ZALLOC(strm, s->hash_size, sizeof(Pos));
+ 
+     s->high_water = 0;      /* nothing written to s->window yet */
+@@ -551,6 +544,13 @@ int ZEXPORT deflateInit2_(z_streamp strm, int level, int method,
+         deflateEnd (strm);
+         return Z_MEM_ERROR;
+     }
++    /* Avoid use of unitialized values in the window, see crbug.com/1137613 and
++     * crbug.com/1144420 */
++    zmemzero(s->window, (s->w_size + WINDOW_PADDING) * (2 * sizeof(Byte)));
++    /* Avoid use of uninitialized value, see:
++     * https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11360
++     */
++    zmemzero(s->prev, s->w_size * sizeof(Pos));
+ #ifdef LIT_MEM
+     s->d_buf = (ushf *)(s->pending_buf + (s->lit_bufsize << 1));
+     s->l_buf = s->pending_buf + (s->lit_bufsize << 2);
+-- 
+2.49.0.504.g3bcea36a83-goog
+
diff --git a/deps/v8/third_party/zlib/test/minigzip.c b/deps/v8/third_party/zlib/test/minigzip.c
index c72356dbccf255..134e10e6c3e947 100644
--- a/deps/v8/third_party/zlib/test/minigzip.c
+++ b/deps/v8/third_party/zlib/test/minigzip.c
@@ -303,7 +303,7 @@ static void error(const char *msg) {
 #ifdef USE_MMAP /* MMAP version, Miguel Albrecht <malbrech@eso.org> */
 
 /* Try compressing the input file at once using mmap. Return Z_OK if
- * if success, Z_ERRNO otherwise.
+ * success, Z_ERRNO otherwise.
  */
 static int gz_compress_mmap(FILE *in, gzFile out) {
     int len;
diff --git a/deps/v8/third_party/zlib/trees.c b/deps/v8/third_party/zlib/trees.c
index 38135273c9c3bc..62286af9c4379a 100644
--- a/deps/v8/third_party/zlib/trees.c
+++ b/deps/v8/third_party/zlib/trees.c
@@ -1,5 +1,5 @@
 /* trees.c -- output deflated data using Huffman coding
- * Copyright (C) 1995-2021 Jean-loup Gailly
+ * Copyright (C) 1995-2024 Jean-loup Gailly
  * detect_data_type() function provided freely by Cosmin Truta, 2006
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
diff --git a/deps/v8/third_party/zlib/zconf.h b/deps/v8/third_party/zlib/zconf.h
index 55fe101da64834..b76ded42473670 100644
--- a/deps/v8/third_party/zlib/zconf.h
+++ b/deps/v8/third_party/zlib/zconf.h
@@ -1,5 +1,5 @@
 /* zconf.h -- configuration of the zlib compression library
- * Copyright (C) 1995-2016 Jean-loup Gailly, Mark Adler
+ * Copyright (C) 1995-2024 Jean-loup Gailly, Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -312,14 +312,6 @@
 #  endif
 #endif
 
-#ifndef Z_ARG /* function prototypes for stdarg */
-#  if defined(STDC) || defined(Z_HAVE_STDARG_H)
-#    define Z_ARG(args)  args
-#  else
-#    define Z_ARG(args)  ()
-#  endif
-#endif
-
 /* The following definitions for FAR are needed only for MSDOS mixed
  * model programming (small or medium model with some far allocations).
  * This was tested only with MSC; for other MSDOS compilers you may have
diff --git a/deps/v8/third_party/zlib/zconf.h.cmakein b/deps/v8/third_party/zlib/zconf.h.cmakein
index 310c43928a299f..0abe3bc9d8fa4e 100644
--- a/deps/v8/third_party/zlib/zconf.h.cmakein
+++ b/deps/v8/third_party/zlib/zconf.h.cmakein
@@ -1,5 +1,5 @@
 /* zconf.h -- configuration of the zlib compression library
- * Copyright (C) 1995-2016 Jean-loup Gailly, Mark Adler
+ * Copyright (C) 1995-2024 Jean-loup Gailly, Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -302,14 +302,6 @@
 #  endif
 #endif
 
-#ifndef Z_ARG /* function prototypes for stdarg */
-#  if defined(STDC) || defined(Z_HAVE_STDARG_H)
-#    define Z_ARG(args)  args
-#  else
-#    define Z_ARG(args)  ()
-#  endif
-#endif
-
 /* The following definitions for FAR are needed only for MSDOS mixed
  * model programming (small or medium model with some far allocations).
  * This was tested only with MSC; for other MSDOS compilers you may have
diff --git a/deps/v8/third_party/zlib/zconf.h.in b/deps/v8/third_party/zlib/zconf.h.in
index fb76ffe312ae45..62adc8d8431f2f 100644
--- a/deps/v8/third_party/zlib/zconf.h.in
+++ b/deps/v8/third_party/zlib/zconf.h.in
@@ -1,5 +1,5 @@
 /* zconf.h -- configuration of the zlib compression library
- * Copyright (C) 1995-2016 Jean-loup Gailly, Mark Adler
+ * Copyright (C) 1995-2024 Jean-loup Gailly, Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -300,14 +300,6 @@
 #  endif
 #endif
 
-#ifndef Z_ARG /* function prototypes for stdarg */
-#  if defined(STDC) || defined(Z_HAVE_STDARG_H)
-#    define Z_ARG(args)  args
-#  else
-#    define Z_ARG(args)  ()
-#  endif
-#endif
-
 /* The following definitions for FAR are needed only for MSDOS mixed
  * model programming (small or medium model with some far allocations).
  * This was tested only with MSC; for other MSDOS compilers you may have
diff --git a/deps/v8/third_party/zlib/zlib.3 b/deps/v8/third_party/zlib/zlib.3
index adc5b7f03e8c95..c716020ea9c420 100644
--- a/deps/v8/third_party/zlib/zlib.3
+++ b/deps/v8/third_party/zlib/zlib.3
@@ -1,4 +1,4 @@
-.TH ZLIB 3 "xx Aug 2023"
+.TH ZLIB 3 "22 Jan 2024"
 .SH NAME
 zlib \- compression/decompression library
 .SH SYNOPSIS
@@ -105,9 +105,9 @@ before asking for help.
 Send questions and/or comments to zlib@gzip.org,
 or (for the Windows DLL version) to Gilles Vollant (info@winimage.com).
 .SH AUTHORS AND LICENSE
-Version 1.2.3.0.1
+Version 1.3.1
 .LP
-Copyright (C) 1995-2022 Jean-loup Gailly and Mark Adler
+Copyright (C) 1995-2024 Jean-loup Gailly and Mark Adler
 .LP
 This software is provided 'as-is', without any express or implied
 warranty.  In no event will the authors be held liable for any damages
diff --git a/deps/v8/third_party/zlib/zlib.h b/deps/v8/third_party/zlib/zlib.h
index f1b149b93e4346..8b2f6c1db99a5e 100644
--- a/deps/v8/third_party/zlib/zlib.h
+++ b/deps/v8/third_party/zlib/zlib.h
@@ -1,7 +1,7 @@
 /* zlib.h -- interface of the 'zlib' general purpose compression library
-  version 1.3.0.1, August xxth, 2023
+  version 1.3.1, January 22nd, 2024
 
-  Copyright (C) 1995-2023 Jean-loup Gailly and Mark Adler
+  Copyright (C) 1995-2024 Jean-loup Gailly and Mark Adler
 
   This software is provided 'as-is', without any express or implied
   warranty.  In no event will the authors be held liable for any damages
@@ -37,12 +37,12 @@
 extern "C" {
 #endif
 
-#define ZLIB_VERSION "1.3.0.1-motley"
-#define ZLIB_VERNUM 0x1301
+#define ZLIB_VERSION "1.3.1"
+#define ZLIB_VERNUM 0x1310
 #define ZLIB_VER_MAJOR 1
 #define ZLIB_VER_MINOR 3
-#define ZLIB_VER_REVISION 0
-#define ZLIB_VER_SUBREVISION 1
+#define ZLIB_VER_REVISION 1
+#define ZLIB_VER_SUBREVISION 0
 
 /*
     The 'zlib' compression library provides in-memory compression and
@@ -935,10 +935,10 @@ ZEXTERN int ZEXPORT inflateSync(z_streamp strm);
      inflateSync returns Z_OK if a possible full flush point has been found,
    Z_BUF_ERROR if no more input was provided, Z_DATA_ERROR if no flush point
    has been found, or Z_STREAM_ERROR if the stream structure was inconsistent.
-   In the success case, the application may save the current current value of
-   total_in which indicates where valid compressed data was found.  In the
-   error case, the application may repeatedly call inflateSync, providing more
-   input each time, until success or end of the input data.
+   In the success case, the application may save the current value of total_in
+   which indicates where valid compressed data was found.  In the error case,
+   the application may repeatedly call inflateSync, providing more input each
+   time, until success or end of the input data.
 */
 
 ZEXTERN int ZEXPORT inflateCopy(z_streamp dest,
@@ -1757,14 +1757,14 @@ ZEXTERN uLong ZEXPORT crc32_combine(uLong crc1, uLong crc2, z_off_t len2);
    seq1 and seq2 with lengths len1 and len2, CRC-32 check values were
    calculated for each, crc1 and crc2.  crc32_combine() returns the CRC-32
    check value of seq1 and seq2 concatenated, requiring only crc1, crc2, and
-   len2.
+   len2. len2 must be non-negative.
 */
 
 /*
 ZEXTERN uLong ZEXPORT crc32_combine_gen(z_off_t len2);
 
      Return the operator corresponding to length len2, to be used with
-   crc32_combine_op().
+   crc32_combine_op(). len2 must be non-negative.
 */
 
 ZEXTERN uLong ZEXPORT crc32_combine_op(uLong crc1, uLong crc2, uLong op);
diff --git a/deps/v8/third_party/zlib/zutil.h b/deps/v8/third_party/zlib/zutil.h
index 2e2f57665bba81..045a35a4f55522 100644
--- a/deps/v8/third_party/zlib/zutil.h
+++ b/deps/v8/third_party/zlib/zutil.h
@@ -1,5 +1,5 @@
 /* zutil.h -- internal interface and configuration of the compression library
- * Copyright (C) 1995-2022 Jean-loup Gailly, Mark Adler
+ * Copyright (C) 1995-2024 Jean-loup Gailly, Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -71,7 +71,7 @@ typedef unsigned long  ulg;
 extern z_const char * const z_errmsg[10]; /* indexed by 2-zlib_error */
 /* (size given to avoid silly warnings with Visual C++) */
 
-#define ERR_MSG(err) z_errmsg[Z_NEED_DICT-(err)]
+#define ERR_MSG(err) z_errmsg[(err) < -6 || (err) > 2 ? 9 : 2 - (err)]
 
 #define ERR_RETURN(strm,err) \
   return (strm->msg = ERR_MSG(err), (err))
diff --git a/deps/v8/tools/.vpython3 b/deps/v8/tools/.vpython3
index ee4fd938259518..af03dc73568483 100644
--- a/deps/v8/tools/.vpython3
+++ b/deps/v8/tools/.vpython3
@@ -22,7 +22,7 @@
 # Read more about `vpython` and how to modify this file here:
 #   https://chromium.googlesource.com/infra/infra/+/main/doc/users/vpython.md
 
-python_version: "3.8"
+python_version: "3.11"
 
 # The default set of platforms vpython checks does not yet include mac-arm64.
 # Setting `verify_pep425_tag` to the list of platforms we explicitly must support
@@ -47,7 +47,7 @@ wheel: <
 
 wheel: <
   name: "infra/python/wheels/coverage/${vpython_platform}"
-  version: "version:5.5.chromium.3"
+  version: "version:7.3.1"
 >
 
 wheel: <
@@ -77,7 +77,7 @@ wheel: <
 
 wheel: <
   name: "infra/python/wheels/numpy/${vpython_platform}"
-  version: "version:1.2x.supported.1"
+  version: "version:1.23.5.chromium.4"
 >
 
 wheel: <
@@ -127,6 +127,6 @@ wheel: <
 >
 
 wheel: <
-  name: "infra/python/wheels/pyfakefs-py2_py3"
-  version: "version:3.7.2"
+  name: "infra/python/wheels/pyfakefs-py3"
+  version: "version:5.7.3"
 >
diff --git a/deps/v8/tools/callstats.html b/deps/v8/tools/callstats.html
index d0526898557448..d6cba1e84b4d13 100644
--- a/deps/v8/tools/callstats.html
+++ b/deps/v8/tools/callstats.html
@@ -1937,6 +1937,8 @@
         this.groups = [
           this.total,
           Group.groups.get('ic').entry(),
+          Group.groups.get('optimize-maglev-background').entry(),
+          Group.groups.get('optimize-maglev').entry(),
           Group.groups.get('optimize-background').entry(),
           Group.groups.get('optimize').entry(),
           Group.groups.get('compile-background').entry(),
@@ -2265,6 +2267,10 @@
     }
     Group.add('total', new Group('Total', /.*Total.*/, '#BBB', true, false));
     Group.add('ic', new Group('IC', /(.*IC_.*)|IC/, "#3366CC"));
+    Group.add('optimize-maglev-background', new Group('Optimize-Maglev-Background',
+      /.*Optimize(d?-?)(Background|Concurrent).*Maglev.*/, "#962c02"));
+    Group.add('optimize-maglev', new Group('Optimize-Maglev',
+      /.*Maglev.*/, "#fc4f26"));
     Group.add('optimize-background', new Group('Optimize-Background',
       /.*Optimize(d?-?)(Background|Concurrent).*/, "#702000"));
     Group.add('optimize', new Group('Optimize',
diff --git a/deps/v8/tools/callstats.py b/deps/v8/tools/callstats.py
index d6e8ba024c9c23..fb2750c54ad75a 100755
--- a/deps/v8/tools/callstats.py
+++ b/deps/v8/tools/callstats.py
@@ -369,21 +369,25 @@ def read_stats(path, domain, args):
   groups = [];
   if args.aggregate:
     groups = [
-        ('Group-IC', re.compile(".*IC_.*")),
-        ('Group-OptimizeBackground', re.compile(".*OptimizeBackground.*")),
+        ('Group-IC', re.compile(r".*IC_.*")),
+        ('Group-OptimizeMaglevBackground',
+         re.compile(r".*Optimize(Background|Concurrent).*Maglev.*")),
+        ('Group-OptimizeMaglev', re.compile(r".*Maglev.*")),
+        ('Group-OptimizeBackground',
+         re.compile(r".*Optimize(Background|Concurrent).*")),
         ('Group-Optimize',
-         re.compile("StackGuard|.*Optimize.*|.*Deoptimize.*|Recompile.*")),
-        ('Group-CompileBackground', re.compile("(.*CompileBackground.*)")),
-        ('Group-Compile', re.compile("(^Compile.*)|(.*_Compile.*)")),
-        ('Group-ParseBackground', re.compile(".*ParseBackground.*")),
-        ('Group-Parse', re.compile(".*Parse.*")),
-        ('Group-Callback', re.compile(".*Callback.*")),
-        ('Group-API', re.compile(".*API.*")),
-        ('Group-GC-Custom', re.compile("GC_Custom_.*")),
-        ('Group-GC-Background', re.compile("GC_.*BACKGROUND.*")),
-        ('Group-GC', re.compile("GC_.*|AllocateInTargetSpace")),
-        ('Group-JavaScript', re.compile("JS_Execution")),
-        ('Group-Runtime', re.compile(".*"))
+         re.compile(r"StackGuard|.*Optimize.*|.*Deoptimize.*|Recompile.*")),
+        ('Group-CompileBackground', re.compile(r"(.*CompileBackground.*)")),
+        ('Group-Compile', re.compile(r"(^Compile.*)|(.*_Compile.*)")),
+        ('Group-ParseBackground', re.compile(r".*ParseBackground.*")),
+        ('Group-Parse', re.compile(r".*Parse.*")),
+        ('Group-Callback', re.compile(r".*Callback.*")),
+        ('Group-API', re.compile(r".*API.*")),
+        ('Group-GC-Custom', re.compile(r"GC_Custom_.*")),
+        ('Group-GC-Background', re.compile(r"GC_.*BACKGROUND.*")),
+        ('Group-GC', re.compile(r"GC_.*|AllocateInTargetSpace")),
+        ('Group-JavaScript', re.compile(r"JS_Execution")),
+        ('Group-Runtime', re.compile(r".*"))
     ]
   with open(path, "rt") as f:
     # Process the whole file and sum repeating entries.
diff --git a/deps/v8/tools/callstats_groups.py b/deps/v8/tools/callstats_groups.py
index 8afe9c4f526caa..468a48043f3f79 100644
--- a/deps/v8/tools/callstats_groups.py
+++ b/deps/v8/tools/callstats_groups.py
@@ -5,20 +5,23 @@
 import re
 
 RUNTIME_CALL_STATS_GROUPS = [
-    ('Group-IC', re.compile(".*IC_.*")),
-    ('Group-OptimizeBackground', re.compile(".*OptimizeBackground.*")),
+    ('Group-IC', re.compile(r".*IC_.*")),
+    ('Group-OptimizeMaglevBackground',
+     re.compile(r".*Optimize(Background|Concurrent).*Maglev.*")),
+    ('Group-OptimizeMaglev', re.compile(r".*Maglev.*")),
+    ('Group-OptimizeBackground', re.compile(r".*OptimizeBackground.*")),
     ('Group-Optimize',
-     re.compile("StackGuard|.*Optimize.*|.*Deoptimize.*|Recompile.*")),
-    ('Group-CompileBackground', re.compile("(.*CompileBackground.*)")),
-    ('Group-Compile', re.compile("(^Compile.*)|(.*_Compile.*)")),
-    ('Group-ParseBackground', re.compile(".*ParseBackground.*")),
-    ('Group-Parse', re.compile(".*Parse.*")),
-    ('Group-Network-Data', re.compile(".*GetMoreDataCallback.*")),
-    ('Group-Callback', re.compile(".*(Callback)|(Blink \+\+).*")),
-    ('Group-API', re.compile(".*API.*")),
-    ('Group-GC-Custom', re.compile("GC_Custom_.*")),
-    ('Group-GC-Background', re.compile("GC_.*BACKGROUND.*")),
-    ('Group-GC', re.compile("GC_.*|AllocateInTargetSpace")),
-    ('Group-JavaScript', re.compile("JS_Execution")),
-    ('Group-Runtime', re.compile(".*"))
+     re.compile(r"StackGuard|.*Optimize.*|.*Deoptimize.*|Recompile.*")),
+    ('Group-CompileBackground', re.compile(r"(.*CompileBackground.*)")),
+    ('Group-Compile', re.compile(r"(^Compile.*)|(.*_Compile.*)")),
+    ('Group-ParseBackground', re.compile(r".*ParseBackground.*")),
+    ('Group-Parse', re.compile(r".*Parse.*")),
+    ('Group-Network-Data', re.compile(r".*GetMoreDataCallback.*")),
+    ('Group-Callback', re.compile(r".*(Callback)|(Blink \+\+).*")),
+    ('Group-API', re.compile(r".*API.*")),
+    ('Group-GC-Custom', re.compile(r"GC_Custom_.*")),
+    ('Group-GC-Background', re.compile(r"GC_.*BACKGROUND.*")),
+    ('Group-GC', re.compile(r"GC_.*|AllocateInTargetSpace")),
+    ('Group-JavaScript', re.compile(r"JS_Execution")),
+    ('Group-Runtime', re.compile(r".*"))
 ]
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/README.md b/deps/v8/tools/clusterfuzz/js_fuzzer/README.md
index b99168054bae84..d00858ba7abdf7 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/README.md
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/README.md
@@ -22,7 +22,8 @@ Then run:
 
 ```bash
 $ mkdir db
-$ node build_db.js -i /path/to/web_tests -o db chakra v8 spidermonkey WebKit/JSTests
+$ node build_db.js -i /path/to/web_tests -o db chakra v8 spidermonkey WebKit/JSTests fuzzilli
+$ node validate_db.js -i db -o db/index.json
 ```
 
 This may take a while. Optionally test the fuzzing DB with:
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/corpus.js b/deps/v8/tools/clusterfuzz/js_fuzzer/corpus.js
index 2a997cfeb14df2..6bfe8e8a0d997b 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/corpus.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/corpus.js
@@ -183,6 +183,9 @@ class FuzzilliCorpus extends Corpus {
 
     // We require a V8 corpus side-by-side to cross-load resources.
     this.v8Corpus = v8Corpus;
+    if (!this.v8Corpus) {
+      this.v8Corpus = create(inputDir, 'v8');
+    }
     assert(this.v8Corpus);
   }
 
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/db.js b/deps/v8/tools/clusterfuzz/js_fuzzer/db.js
index b19a54ce43e515..d6280c7cc03b89 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/db.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/db.js
@@ -6,6 +6,7 @@
  * @fileoverview Mutation Db.
  */
 
+const assert = require('assert');
 const crypto = require('crypto');
 const fs = require('fs');
 const fsPath = require('path');
@@ -23,6 +24,8 @@ const sourceHelpers = require('./source_helpers.js');
 // where it can be inserted.
 const CHOOSE_SUPER_PROB = 0.2;
 
+const MAX_SNIPPET_SIZE = 64;
+
 const globalIdentifiers = new Set(Object.keys(globals.builtin));
 const propertyNames = new Set([
     // Parsed from https://github.com/tc39/ecma262/blob/master/spec.html
@@ -213,17 +216,22 @@ const propertyNames = new Set([
 const MAX_DEPENDENCIES = 2;
 
 class Expression {
-  constructor(type, source, isStatement, originalPath,
-              dependencies, needsSuper) {
+  constructor(type, source, originalPath, dependencies) {
     this.type = type;
     this.source = source;
-    this.isStatement = isStatement;
-    this.originalPath = originalPath;
+    this.path = originalPath;
     this.dependencies = dependencies;
-    this.needsSuper = needsSuper;
   }
 }
 
+function loadExpression(baseDir, record) {
+  const path = fsPath.join(baseDir, record.path);
+  const expression = JSON.parse(fs.readFileSync(path), 'utf-8');
+  expression.needsTryCatch = record.tc;
+  expression.needsSuper = record.super;
+  return expression;
+}
+
 function dedupKey(expression) {
   if (!expression.dependencies) {
     return expression.source;
@@ -267,15 +275,16 @@ function isValid(expression) {
   return true;
 }
 
+function writeIndexFile(path, index) {
+  index.sort((a, b) => a.path.localeCompare(b.path));
+  fs.writeFileSync(path, JSON.stringify(index, null, 2));
+}
+
 class MutateDbWriter {
   constructor(outputDir) {
     this.seen = new Set();
     this.outputDir = fsPath.resolve(outputDir);
-    this.index = {
-      statements: [],
-      superStatements: [],
-      all: [],
-    };
+    this.index = [];
   }
 
   process(source) {
@@ -416,20 +425,26 @@ class MutateDbWriter {
 
         // Make the template.
         let generated = babelGenerator(path.node, { concise: true }).code;
+        assert(path.parentPath.isExpressionStatement());
         let expression = new Expression(
             path.node.type,
             generated,
-            path.parentPath.isExpressionStatement(),
             source.relPath,
-            path.node.__idDependencies,
-            Boolean(path.node.__needsSuper));
+            path.node.__idDependencies);
 
         // Try to de-dupe similar expressions.
-        let key = dedupKey(expression);
+        const sha1sum = crypto.createHash('sha1');
+        sha1sum.update(dedupKey(expression));
+        const key = sha1sum.digest('hex').substring(0, 8);
         if (self.seen.has(key)) {
           return;
         }
 
+        // Ignore large samples.
+        if (expression.source.length > MAX_SNIPPET_SIZE) {
+          return;
+        }
+
         // Test results.
         if (!isValid(expression)) {
           return;
@@ -441,62 +456,58 @@ class MutateDbWriter {
           fs.mkdirSync(dirPath);
         }
 
-        let sha1sum = crypto.createHash('sha1');
-        sha1sum.update(key);
-
-        let filePath = fsPath.join(dirPath, sha1sum.digest('hex') + '.json');
+        const filePath = fsPath.join(dirPath, key + '.json');
         fs.writeFileSync(filePath, JSON.stringify(expression));
 
-        let relPath = fsPath.relative(self.outputDir, filePath);
+        const relPath = fsPath.relative(self.outputDir, filePath);
 
         // Update index.
         self.seen.add(key);
-        self.index.all.push(relPath);
-
-        if (expression.needsSuper) {
-          self.index.superStatements.push(relPath);
-        } else {
-          self.index.statements.push(relPath);
-        }
+        self.index.push(
+            {path: relPath, super: Boolean(path.node.__needsSuper)});
       }
     });
   }
 
   writeIndex() {
-    this.index.all.sort();
-    this.index.statements.sort();
-    this.index.superStatements.sort();
-
-    fs.writeFileSync(
-        fsPath.join(this.outputDir, 'index.json'),
-        JSON.stringify(this.index));
+    writeIndexFile(fsPath.join(this.outputDir, 'index.json'), this.index);
   }
 }
 
 class MutateDb {
   constructor(outputDir) {
     this.outputDir = fsPath.resolve(outputDir);
-    this.index = JSON.parse(
+    const index = JSON.parse(
         fs.readFileSync(fsPath.join(outputDir, 'index.json'), 'utf-8'));
+    this.statements = [];
+    this.superStatements = [];
+    this.all = [];
+    for (const expression of index) {
+      if (expression.super) {
+        this.superStatements.push(expression);
+      } else {
+        this.statements.push(expression);
+      }
+      this.all.push(expression);
+    }
   }
 
   getRandomStatement({canHaveSuper=false} = {}) {
     let choices;
     if (canHaveSuper) {
       choices = random.choose(CHOOSE_SUPER_PROB) ?
-          this.index.superStatements : this.index.all;
+          this.superStatements : this.all;
     } else {
-      choices = this.index.statements;
+      choices = this.statements;
     }
 
-    let path = fsPath.join(
-        this.outputDir, choices[random.randInt(0, choices.length - 1)]);
-    return JSON.parse(fs.readFileSync(path), 'utf-8');
+    const record = choices[random.randInt(0, choices.length - 1)];
+    return loadExpression(this.outputDir, record);
   }
 
   *iterateStatements() {
-    for (const exp of this.index.all) {
-      const path = fsPath.join(this.outputDir, exp);
+    for (const exp of this.all) {
+      const path = fsPath.join(this.outputDir, exp.path);
       yield JSON.parse(fs.readFileSync(path), 'utf-8');
     }
   }
@@ -505,4 +516,6 @@ class MutateDb {
 module.exports = {
   MutateDb: MutateDb,
   MutateDbWriter: MutateDbWriter,
+  loadExpression: loadExpression,
+  writeIndexFile: writeIndexFile,
 }
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/differential_script_mutator.js b/deps/v8/tools/clusterfuzz/js_fuzzer/differential_script_mutator.js
index af65163dcb6af8..0ce7d94f86392f 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/differential_script_mutator.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/differential_script_mutator.js
@@ -95,9 +95,8 @@ class DifferentialScriptMutator extends ScriptMutator {
   }
 
   get runnerClass() {
-    // Choose a setup with the Fuzzilli corpus in 1 of 3.
+    // Choose a setup with the Fuzzilli corpus in 1 of 2.
     return random.single([
-        runner.RandomCorpusRunner,
         runner.RandomCorpusRunner,
         runner.RandomCorpusRunnerWithFuzzilli,
     ]);
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/mutators/common.js b/deps/v8/tools/clusterfuzz/js_fuzzer/mutators/common.js
index 220c17285f1a09..41e92bed7d0a88 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/mutators/common.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/mutators/common.js
@@ -116,6 +116,11 @@ function _unwrapExpressionStatement(value) {
   return value;
 }
 
+function isConst(path, name) {
+  const binding = path.scope.getBinding(name);
+  return binding && binding.kind === 'const';
+}
+
 function isVariableIdentifier(name) {
   return /__v_[0-9]+/.test(name);
 }
@@ -463,6 +468,7 @@ module.exports = {
   availableFunctionNames: availableFunctionNames,
   randomFunction: randomFunction,
   randomVariable: randomVariable,
+  isConst: isConst,
   isInForLoopCondition: isInForLoopCondition,
   isInWhileLoop: isInWhileLoop,
   isInfiniteLoop: isInfiniteLoop,
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/mutators/crossover_mutator.js b/deps/v8/tools/clusterfuzz/js_fuzzer/mutators/crossover_mutator.js
index ed82d31eafe2bc..36a9eb79e21023 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/mutators/crossover_mutator.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/mutators/crossover_mutator.js
@@ -23,9 +23,6 @@ const BABYLON_RELAXED_SUPER_OPTIONS = Object.assign(
     {}, sourceHelpers.BABYLON_OPTIONS);
 BABYLON_RELAXED_SUPER_OPTIONS['allowSuperOutsideMethod'] = true;
 
-// Drop desired try-catch wrapping only with a small probability.
-const WRAP_TC_IF_NEEDED_PROB = 0.8;
-
 /**
  * Check if a snippet containing `super` can be inserted at `path`
  * without creating a syntax error.
@@ -59,28 +56,6 @@ function validateSuper(path, source) {
          (!call || surroundingMethod.node.kind == 'constructor');
 }
 
-/**
- * Checks if the expression contains a member expression with an identifier.
- *
- * These get extra try-catch wrapping as such accesses are often wrong out of
- * context. The try-catch mutator doesn't always wrap all expressions.
- */
-function needsTryCatch(source) {
-  const ast = babylon.parse(source, BABYLON_RELAXED_SUPER_OPTIONS);
-
-  // TODO(389069288): We could precalculate this and store it in the DB
-  // together with the snippets.
-  let member = false;
-  babelTraverse(ast, {
-    MemberExpression(path) {
-      if (babelTypes.isIdentifier(path.node.property)) {
-        member = true;
-      }
-    },
-  });
-  return member;
-}
-
 class CrossOverMutator extends mutator.Mutator {
   constructor(settings, db) {
     super(settings);
@@ -129,8 +104,7 @@ class CrossOverMutator extends mutator.Mutator {
       return undefined;
     }
 
-    if (random.choose(WRAP_TC_IF_NEEDED_PROB) &&
-        needsTryCatch(expression.source)) {
+    if (expression.needsTryCatch) {
       toInsert = tryCatch.wrapTryCatch(toInsert);
     }
 
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/mutators/try_catch.js b/deps/v8/tools/clusterfuzz/js_fuzzer/mutators/try_catch.js
index 44bc68c7376caf..968d870964f9be 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/mutators/try_catch.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/mutators/try_catch.js
@@ -27,8 +27,14 @@ const IGNORE_DEFAULT_PROB = 0.03;
 // We don't support 'using' and 'async using'. We wrap var with try-catch.
 const WRAPPABLE_DECL_KINDS = new Set(['let', 'const']);
 
-// This function is defined in resources/fuzz_library.js.
-const WRAP_FUN = babelTemplate('__wrapTC(() => ID)');
+// This function is defined in resources/fuzz_library.js. The first version
+// returns a permissive dummy on errors by default. The second version returns
+// undefined.
+const WRAP_FUN_PERMISSIVE = babelTemplate('__wrapTC(() => ID)');
+const WRAP_FUN = babelTemplate('__wrapTC(() => ID, false)');
+
+// Probability to use the permissive wrapper above.
+const PERMISSIVE_WRAPPER_PROB = 0.9;
 
 function isFunction(node) {
   return (babelTypes.isArrowFunctionExpression(node) ||
@@ -97,14 +103,20 @@ function skipReplaceVariableDeclarator(path) {
 
 function replaceVariableDeclarator(path) {
   let wrapped;
+  let wrap_fun;
+  if (random.choose(module.exports.PERMISSIVE_WRAPPER_PROB)) {
+    wrap_fun = WRAP_FUN_PERMISSIVE;
+  } else {
+    wrap_fun = WRAP_FUN;
+  }
   if (babelTypes.isAwaitExpression(path.node.init)) {
-    // The await can't remain in the inner arrow function of WRAP_FUN,
+    // The await can't remain in the inner arrow function of wrap_fun,
     // we pull it outside of the wrapper instead. E.g.
     // "await x" becomes "await __wrapTC(() => x)".
     wrapped = babelTypes.AwaitExpression(
-        WRAP_FUN({ID: path.node.init.argument}).expression);
+        wrap_fun({ID: path.node.init.argument}).expression);
   } else {
-    wrapped = WRAP_FUN({ID: path.node.init}).expression;
+    wrapped = wrap_fun({ID: path.node.init}).expression;
   }
   path.replaceWith(babelTypes.variableDeclarator(path.node.id, wrapped));
   path.skip();
@@ -264,6 +276,7 @@ module.exports = {
   DEFAULT_SKIP_PROB: DEFAULT_SKIP_PROB,
   DEFAULT_TOPLEVEL_PROB: DEFAULT_TOPLEVEL_PROB,
   IGNORE_DEFAULT_PROB: IGNORE_DEFAULT_PROB,
+  PERMISSIVE_WRAPPER_PROB: PERMISSIVE_WRAPPER_PROB,
   AddTryCatchMutator: AddTryCatchMutator,
   wrapTryCatch: wrapTryCatch,
 }
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/mutators/variable_mutator.js b/deps/v8/tools/clusterfuzz/js_fuzzer/mutators/variable_mutator.js
index 32e82c92f7cc8b..738d32fbf2d891 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/mutators/variable_mutator.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/mutators/variable_mutator.js
@@ -81,11 +81,22 @@ class VariableMutator extends mutator.Mutator {
 
         const newName = randVar.name;
 
-        // Don't assign to loop variables.
+        // Check changes to LHS of assignments.
         if (babelTypes.isAssignmentExpression(path.parent) &&
-            path.parent.left == path.node &&
-            thisMutator.context.loopVariables.has(newName) &&
-            random.choose(module.exports.SKIP_LOOP_VAR_PROB)) {
+            path.parent.left == path.node) {
+          // Don't assign to loop variables.
+          if (thisMutator.context.loopVariables.has(newName) &&
+              random.choose(module.exports.SKIP_LOOP_VAR_PROB)) {
+            return;
+          }
+          // Don't assign to const variables.
+          if (common.isConst(path, newName)) {
+            return;
+          }
+        }
+
+        // No-op.
+        if (path.node.name == newName) {
           return;
         }
 
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/resources/cross_over_template_2.js b/deps/v8/tools/clusterfuzz/js_fuzzer/resources/cross_over_template_class_constructor.js
similarity index 88%
rename from deps/v8/tools/clusterfuzz/js_fuzzer/resources/cross_over_template_2.js
rename to deps/v8/tools/clusterfuzz/js_fuzzer/resources/cross_over_template_class_constructor.js
index 8ff6357a57f166..08eddac463b587 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/resources/cross_over_template_2.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/resources/cross_over_template_class_constructor.js
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-let a = 0;
-let b = 0;
+let __v_0 = {};
+let __v_1 = {};
 
 class A {
 
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/resources/cross_over_template_3.js b/deps/v8/tools/clusterfuzz/js_fuzzer/resources/cross_over_template_class_method.js
similarity index 88%
rename from deps/v8/tools/clusterfuzz/js_fuzzer/resources/cross_over_template_3.js
rename to deps/v8/tools/clusterfuzz/js_fuzzer/resources/cross_over_template_class_method.js
index a54a67f9c81290..738df836883701 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/resources/cross_over_template_3.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/resources/cross_over_template_class_method.js
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-let a = 0;
-let b = 0;
+let __v_0 = {};
+let __v_1 = {};
 
 class A {
   foo() {}
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/resources/cross_over_template_1.js b/deps/v8/tools/clusterfuzz/js_fuzzer/resources/cross_over_template_sloppy.js
similarity index 85%
rename from deps/v8/tools/clusterfuzz/js_fuzzer/resources/cross_over_template_1.js
rename to deps/v8/tools/clusterfuzz/js_fuzzer/resources/cross_over_template_sloppy.js
index 5b9ee274f29f55..81693f67c7a8f1 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/resources/cross_over_template_1.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/resources/cross_over_template_sloppy.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-let a = 0;
-let b = 0;
+let __v_0 = {};
+let __v_1 = {};
 
 console.log(42);
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/verify_db/expected_code_2.js b/deps/v8/tools/clusterfuzz/js_fuzzer/resources/cross_over_template_strict.js
similarity index 59%
rename from deps/v8/tools/clusterfuzz/js_fuzzer/test_data/verify_db/expected_code_2.js
rename to deps/v8/tools/clusterfuzz/js_fuzzer/resources/cross_over_template_strict.js
index a23aaf202651a8..e377b93af174d8 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/verify_db/expected_code_2.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/resources/cross_over_template_strict.js
@@ -2,9 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Original: resources/cross_over_template_1.js
-let __v_0 = 0;
-let __v_1 = 0;
+'use strict';
+
+let __v_0 = {};
+let __v_1 = {};
+
 console.log(42);
-/* CrossOverMutator: Crossover from bar */
-foo();
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/resources/fuzz_library.js b/deps/v8/tools/clusterfuzz/js_fuzzer/resources/fuzz_library.js
index 5df6c9ac17b449..9c78672d3fa5f4 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/resources/fuzz_library.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/resources/fuzz_library.js
@@ -126,11 +126,28 @@ let __callGC;
   };
 })();
 
+let __dummy;
+(function() {
+  const handler = {
+    get: function(x, prop) {
+      if (prop == Symbol.toPrimitive) {
+        return function() { return undefined; };
+      }
+      return __dummy;
+    },
+  };
+  __dummy = new Proxy(function() { return __dummy; }, handler);
+  Object.freeze(__dummy);
+})();
 
-function __wrapTC(f) {
+function __wrapTC(f, permissive=true) {
   try {
     return f();
-  } catch (e) {}
+  } catch (e) {
+    if (permissive) {
+      return __dummy;
+    }
+  }
 }
 
 // Neuter common test functions.
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/resources/spidermonkey_stubs.js b/deps/v8/tools/clusterfuzz/js_fuzzer/resources/spidermonkey_stubs.js
index 497b69ae3650d9..871c1d1e3e4839 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/resources/spidermonkey_stubs.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/resources/spidermonkey_stubs.js
@@ -5,3 +5,9 @@
 // Required to make a spidermonkey dependency more permissive:
 // spidermonkey/test/expected/import/files/local/smTempBranch/shell.js
 var document = {all: undefined};
+
+try {
+  drainJobQueue;
+} catch(e) {
+  this.drainJobQueue = this.nop;
+}
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/run.js b/deps/v8/tools/clusterfuzz/js_fuzzer/run.js
index be27076270b0c5..381e08823a9789 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/run.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/run.js
@@ -23,7 +23,6 @@ const sourceHelpers = require('./source_helpers.js');
 
 // Base implementations for default or differential fuzzing.
 const SCRIPT_MUTATORS = {
-  db: scriptMutator.CrossScriptMutator,
   default: scriptMutator.ScriptMutator,
   foozzie: differentialScriptMutator.DifferentialScriptMutator,
   foozzie_fuzzilli: differentialScriptMutator.FuzzilliDifferentialScriptMutator,
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/runner.js b/deps/v8/tools/clusterfuzz/js_fuzzer/runner.js
index 0849d2d279cd42..cff82310f4f519 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/runner.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/runner.js
@@ -192,43 +192,7 @@ class RandomFuzzilliNoCrashCorpusRunner extends Runner {
   }
 }
 
-/**
- * Runner that enumerates a fixture case combined with a snippet from the DB
- * for validation.
- */
-class FixtureRunner extends Runner {
-  constructor(inputDir, engine, numFiles) {
-    // This runner ignores the usual inputs and always iterates over all
-    // snippets from the DB.
-    super();
-    this.dbPath = path.join(process.cwd(), 'db');
-  }
-
-  *inputGen() {
-    const mutateDb = new db.MutateDb(this.dbPath);
-    for (const expression of mutateDb.iterateStatements()) {
-      let templates;
-      if (expression.needsSuper) {
-        // One template for an insertion in a constructor and one in a method.
-        templates = ['cross_over_template_2.js', 'cross_over_template_3.js'];
-      } else {
-        templates = ['cross_over_template_1.js'];
-      }
-
-      for (const tmplName of templates) {
-        const tmpl = sourceHelpers.loadSource(
-          sourceHelpers.BASE_CORPUS, path.join('resources', tmplName));
-        // We glue the expression to the source. It's otherwise rather hard to
-        // pass this through into the mutation phases.
-        tmpl.__expression = expression;
-        yield [tmpl];
-      }
-    }
-  }
-}
-
 module.exports = {
-  FixtureRunner: FixtureRunner,
   RandomCorpusRunner: RandomCorpusRunner,
   RandomCorpusRunnerWithFuzzilli: RandomCorpusRunnerWithFuzzilli,
   RandomFuzzilliNoCrashCorpusRunner: RandomFuzzilliNoCrashCorpusRunner,
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/script_mutator.js b/deps/v8/tools/clusterfuzz/js_fuzzer/script_mutator.js
index d6d1943d67e0e1..1cac2900b074a8 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/script_mutator.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/script_mutator.js
@@ -48,7 +48,7 @@ function defaultSettings() {
     DIFF_FUZZ_EXTRA_PRINT: 0.1,
     DIFF_FUZZ_TRACK_CAUGHT: 0.4,
     MUTATE_ARRAYS: 0.1,
-    MUTATE_CROSSOVER_INSERT: 0.05,
+    MUTATE_CROSSOVER_INSERT: 0.1,
     MUTATE_EXPRESSIONS: 0.1,
     MUTATE_FUNCTION_CALLS: 0.1,
     MUTATE_NUMBERS: 0.05,
@@ -106,9 +106,7 @@ class ScriptMutator {
    * different corpora.
    */
   get runnerClass() {
-    // Choose a setup with the Fuzzilli corpus with a 50% chance.
-    return random.single(
-        [runner.RandomCorpusRunner, runner.RandomCorpusRunnerWithFuzzilli]);
+    return runner.RandomCorpusRunnerWithFuzzilli;
   }
 
   _addMjsunitIfNeeded(dependencies, input) {
@@ -373,53 +371,9 @@ class WasmScriptMutator extends ScriptMutator {
   }
 }
 
-/**
- * Script mutator that only inserts one cross-over expression from the DB to
- * validate.
- */
-class CrossScriptMutator extends ScriptMutator {
-
-  // We don't do any mutations except a deterministic insertion of one
-  // snippet into a predefined place in a template.
-  mutate(source, context) {
-    // The __expression was pinned to the expression in the FixtureRunner.
-    assert(source.__expression);
-    const crossover = this.crossover;
-    let done = false;
-    babelTraverse(source.ast, {
-      ExpressionStatement(path) {
-        if (done || !path.node.expression ||
-            !babelTypes.isCallExpression(path.node.expression)) {
-          return;
-        }
-        // Avoid infinite loops if there's an expression statement in the
-        // inserted expression.
-        done = true;
-        path.insertAfter(crossover.createInsertion(path, source.__expression));
-      }
-    });
-  }
-
-  // This mutator has only one input to which the __expression was pinned.
-  concatInputs(inputs) {
-    assert(inputs.length == 1);
-    return inputs[0];
-  }
-
-  // No dependencies needed for simple snippet evaluation.
-  resolveDependencies() {
-    return [];
-  }
-
-  get runnerClass() {
-    return runner.FixtureRunner;
-  }
-}
-
 module.exports = {
   analyzeContext: analyzeContext,
   defaultSettings: defaultSettings,
-  CrossScriptMutator: CrossScriptMutator,
   ScriptMutator: ScriptMutator,
   WasmScriptMutator: WasmScriptMutator,
 };
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test/helpers.js b/deps/v8/tools/clusterfuzz/js_fuzzer/test/helpers.js
index 2511ad50405c5a..8e4709128bcd6b 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test/helpers.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test/helpers.js
@@ -107,11 +107,24 @@ function assertExpectedResult(expectedPath, result) {
   assert.strictEqual(expected.join('\n'), result.trim());
 }
 
+function assertFile(expectedPath, actualPath) {
+  const actual = fs.readFileSync(actualPath, 'utf-8');
+  const absPath = path.join(BASE_DIR, expectedPath);
+  if (process.env.GENERATE) {
+    fs.writeFileSync(absPath, actual);
+    return;
+  }
+
+  const expected = fs.readFileSync(absPath, 'utf-8');
+  assert.strictEqual(expected, actual);
+}
+
 module.exports = {
   BASE_DIR: BASE_DIR,
   DB_DIR: DB_DIR,
   FUZZILLI_TEST_CORPUS: FUZZILLI_TEST_CORPUS,
   TEST_CORPUS: TEST_CORPUS,
+  assertFile: assertFile,
   assertExpectedPath: assertExpectedPath,
   assertExpectedResult: assertExpectedResult,
   cycleProbabilitiesFun: cycleProbabilitiesFun,
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test/test_db.js b/deps/v8/tools/clusterfuzz/js_fuzzer/test/test_db.js
index 2f38691680d48f..772dc547c2155e 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test/test_db.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test/test_db.js
@@ -22,6 +22,12 @@ function buildDb(inputDir, corpusName, outputDir) {
       {stdio: ['pipe']});
 }
 
+function validateDb(inputDir, outputIndex) {
+  execSync(
+      `node validate_db.js -i ${inputDir} -o ${outputIndex}`,
+      {stdio: ['pipe']});
+}
+
 describe('DB tests', () => {
   // Test feeds an expression that does not apply.
   it('omits erroneous expressions', () => {
@@ -29,8 +35,7 @@ describe('DB tests', () => {
     buildDb('test_data/db', 'this', outPath);
     const indexFile = path.join(outPath, 'index.json');
     const indexJSON = JSON.parse(fs.readFileSync(indexFile), 'utf-8');
-    assert.deepEqual(
-        indexJSON, {"statements": [], "superStatements": [], "all": []});
+    assert.deepEqual(indexJSON, []);
   });
 
   // End to end test with various extracted and not extracted examples.
@@ -39,4 +44,15 @@ describe('DB tests', () => {
     buildDb('test_data/db', 'e2e', outPath);
     helpers.assertExpectedPath('db/e2e_expected', outPath);
   });
+
+  // End to end test creating a db with error-prone snippets. The validation
+  // enhances the index by marking or pruning.
+  it('validate db e2e', () => {
+    const outPath = tempy.directory();
+    buildDb('test_data/db', 'validate', outPath);
+    helpers.assertExpectedPath('db/validate_expected', outPath);
+    const validated = path.join(outPath, 'updated_index.json');
+    validateDb(path.join(helpers.BASE_DIR, 'db/validate_expected'), validated);
+    helpers.assertFile('db/validate_index_expected.json', validated);
+  });
 });
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test/test_regressions.js b/deps/v8/tools/clusterfuzz/js_fuzzer/test/test_regressions.js
index 6d9fc968b3c971..8b0fab39978a7d 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test/test_regressions.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test/test_regressions.js
@@ -448,16 +448,17 @@ describe('Regression tests', () => {
     helpers.assertExpectedResult('regress/yield/expected.js', mutated);
   });
 
-  it('iterates snippets', () => {
-    const mutator = new scriptMutator.CrossScriptMutator(
+  it('does not assign to const variables', () => {
+    sandbox.stub(sourceHelpers, 'loadResource').callsFake(() => {
+      return helpers.loadTestData('differential_fuzz/fake_resource.js');
+    });
+    this.settings['MUTATE_VARIABLES'] = 1.0;
+
+    const source = helpers.loadTestData('regress/const_var/input.js');
+    const mutator = new scriptMutator.ScriptMutator(
         this.settings, 'test_data/regress/empty_db');
-    const testRunner = new mutator.runnerClass();
-    testRunner.dbPath = 'test_data/regress/super/super_call_db';
-    for (const [i, inputs] of testRunner.enumerateInputs()) {
-      const mutated = mutator.mutateMultiple(inputs);
-      helpers.assertExpectedResult(
-          `verify_db/expected_code_${i}.js`, mutated.code);
-    }
+    const mutated = mutator.mutateMultiple([source]).code;
+    helpers.assertExpectedResult('regress/const_var/expected.js', mutated);
   });
 });
 
@@ -473,13 +474,11 @@ describe('DB tests', () => {
     const source = helpers.loadTestData('regress/db/input/input.js');
     mutateDb.process(source);
     mutateDb.writeIndex();
-    const expressionFile = path.join(
-        tmpOut,
-        'CallExpression/113f18444843b9cbf6778f4ac8b6f7cf585b280b.json');
+    const expressionFile = path.join(tmpOut, 'CallExpression/113f1844.json');
     const content = fs.readFileSync(expressionFile, 'utf-8');
     assert.deepEqual(
         '{"type":"CallExpression","source":"Object.assign(VAR_0, VAR_1)",' +
-        '"isStatement":true,"originalPath":"regress/db/input/input.js",' +
-        '"dependencies":["VAR_0","VAR_1"],"needsSuper":false}', content);
+        '"path":"regress/db/input/input.js","dependencies":["VAR_0","VAR_1"]}',
+        content);
   });
 });
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test/test_try_catch.js b/deps/v8/tools/clusterfuzz/js_fuzzer/test/test_try_catch.js
index 5185467cd74f4c..287924fbd988b3 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test/test_try_catch.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test/test_try_catch.js
@@ -84,6 +84,13 @@ describe('Try catch', () => {
     testTryCatch(source, 'try_catch_alternate_expected.js');
   });
 
+  // Uses permissive try-catch wrapper.
+  it('wraps with permissive try-catch', () => {
+    helpers.deterministicRandom(sandbox);
+    sandbox.stub(tryCatch, 'PERMISSIVE_WRAPPER_PROB').value(1.0);
+    testTryCatch(loadSource(), 'try_catch_permissive_expected.js');
+  });
+
   // General distribution with pseudo-random execution.
   it('distributes', () => {
     helpers.deterministicRandom(sandbox);
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/CallExpression/1876a21a.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/CallExpression/1876a21a.json
new file mode 100644
index 00000000000000..b66ee4489d151a
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/CallExpression/1876a21a.json
@@ -0,0 +1 @@
+{"type":"CallExpression","source":"Array.from(VAR_0)","path":"e2e/input1.js","dependencies":["VAR_0"]}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/CallExpression/1876a21afb7224a48ec53aa4436f4d93349c5fa0.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/CallExpression/1876a21afb7224a48ec53aa4436f4d93349c5fa0.json
deleted file mode 100644
index 41570aeb7b91d3..00000000000000
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/CallExpression/1876a21afb7224a48ec53aa4436f4d93349c5fa0.json
+++ /dev/null
@@ -1 +0,0 @@
-{"type":"CallExpression","source":"Array.from(VAR_0)","isStatement":true,"originalPath":"e2e/input1.js","dependencies":["VAR_0"],"needsSuper":false}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/CallExpression/76c7c68f.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/CallExpression/76c7c68f.json
new file mode 100644
index 00000000000000..c3672c1d8526df
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/CallExpression/76c7c68f.json
@@ -0,0 +1 @@
+{"type":"CallExpression","source":"super(VAR_4 + 1)","path":"e2e/input1.js","dependencies":["VAR_4"]}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/CallExpression/76c7c68f689d7eb9fd7e9d42e98d92a3bd11d4f3.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/CallExpression/76c7c68f689d7eb9fd7e9d42e98d92a3bd11d4f3.json
deleted file mode 100644
index 61c1aeb500ead1..00000000000000
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/CallExpression/76c7c68f689d7eb9fd7e9d42e98d92a3bd11d4f3.json
+++ /dev/null
@@ -1 +0,0 @@
-{"type":"CallExpression","source":"super(VAR_4 + 1)","isStatement":true,"originalPath":"e2e/input1.js","dependencies":["VAR_4"],"needsSuper":true}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/CallExpression/877c27d1.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/CallExpression/877c27d1.json
new file mode 100644
index 00000000000000..17ebeca6a50b0e
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/CallExpression/877c27d1.json
@@ -0,0 +1 @@
+{"type":"CallExpression","source":"Object.assign(VAR_0, [])","path":"e2e/input1.js","dependencies":["VAR_0"]}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/CallExpression/877c27d1e4a8e5a959a7c12bbd6d08d6ba5e8b28.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/CallExpression/877c27d1e4a8e5a959a7c12bbd6d08d6ba5e8b28.json
deleted file mode 100644
index 65ee3b6c994744..00000000000000
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/CallExpression/877c27d1e4a8e5a959a7c12bbd6d08d6ba5e8b28.json
+++ /dev/null
@@ -1 +0,0 @@
-{"type":"CallExpression","source":"Object.assign(VAR_0, [])","isStatement":true,"originalPath":"e2e/input1.js","dependencies":["VAR_0"],"needsSuper":false}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/CallExpression/9a863bde.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/CallExpression/9a863bde.json
new file mode 100644
index 00000000000000..330ff034369a9a
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/CallExpression/9a863bde.json
@@ -0,0 +1 @@
+{"type":"CallExpression","source":"super.valueOf()","path":"e2e/input1.js"}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/CallExpression/9a863bdec092babc502181f10470c11643c66aa9.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/CallExpression/9a863bdec092babc502181f10470c11643c66aa9.json
deleted file mode 100644
index 581417be81a6a2..00000000000000
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/CallExpression/9a863bdec092babc502181f10470c11643c66aa9.json
+++ /dev/null
@@ -1 +0,0 @@
-{"type":"CallExpression","source":"super.valueOf()","isStatement":true,"originalPath":"e2e/input1.js","needsSuper":true}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/ClassExpression/32369494.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/ClassExpression/32369494.json
new file mode 100644
index 00000000000000..99f03895f81a34
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/ClassExpression/32369494.json
@@ -0,0 +1 @@
+{"type":"ClassExpression","source":"class VAR_6 extends VAR_6 {}","path":"e2e/input1.js","dependencies":["VAR_6","VAR_6"]}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/ClassExpression/32369494369ef66a7074b32fd6b27c588860b571.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/ClassExpression/32369494369ef66a7074b32fd6b27c588860b571.json
deleted file mode 100644
index 83c5b472d89177..00000000000000
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/ClassExpression/32369494369ef66a7074b32fd6b27c588860b571.json
+++ /dev/null
@@ -1 +0,0 @@
-{"type":"ClassExpression","source":"class VAR_6 extends VAR_6 {}","isStatement":true,"originalPath":"e2e/input1.js","dependencies":["VAR_6","VAR_6"],"needsSuper":false}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/LogicalExpression/c5813b84.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/LogicalExpression/c5813b84.json
new file mode 100644
index 00000000000000..49a9c8f36a4aae
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/LogicalExpression/c5813b84.json
@@ -0,0 +1 @@
+{"type":"LogicalExpression","source":"true || false","path":"e2e/input2.js"}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/LogicalExpression/c5813b84d032ce3d569c58e7aabbc013bc17c487.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/LogicalExpression/c5813b84d032ce3d569c58e7aabbc013bc17c487.json
deleted file mode 100644
index dcb8348ccc168c..00000000000000
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/LogicalExpression/c5813b84d032ce3d569c58e7aabbc013bc17c487.json
+++ /dev/null
@@ -1 +0,0 @@
-{"type":"LogicalExpression","source":"true || false","isStatement":true,"originalPath":"e2e/input2.js","needsSuper":false}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/LogicalExpression/cc45a134.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/LogicalExpression/cc45a134.json
new file mode 100644
index 00000000000000..944fcd01e58f8e
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/LogicalExpression/cc45a134.json
@@ -0,0 +1 @@
+{"type":"LogicalExpression","source":"VAR_1 && VAR_2()","path":"e2e/input1.js","dependencies":["VAR_1","VAR_2"]}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/LogicalExpression/cc45a134bf1ed0009f03b8931dc2157b53b97de1.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/LogicalExpression/cc45a134bf1ed0009f03b8931dc2157b53b97de1.json
deleted file mode 100644
index b94c9bf53b5d7e..00000000000000
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/LogicalExpression/cc45a134bf1ed0009f03b8931dc2157b53b97de1.json
+++ /dev/null
@@ -1 +0,0 @@
-{"type":"LogicalExpression","source":"VAR_1 && VAR_2()","isStatement":true,"originalPath":"e2e/input1.js","dependencies":["VAR_1","VAR_2"],"needsSuper":false}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/NewExpression/0001aa36.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/NewExpression/0001aa36.json
new file mode 100644
index 00000000000000..c223c613a8745c
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/NewExpression/0001aa36.json
@@ -0,0 +1 @@
+{"type":"NewExpression","source":"new Set([...VAR_0])","path":"e2e/input1.js","dependencies":["VAR_0"]}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/NewExpression/0001aa3649d75f272d662a385e028a4d4f24a712.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/NewExpression/0001aa3649d75f272d662a385e028a4d4f24a712.json
deleted file mode 100644
index a804c3a24ab3ce..00000000000000
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/NewExpression/0001aa3649d75f272d662a385e028a4d4f24a712.json
+++ /dev/null
@@ -1 +0,0 @@
-{"type":"NewExpression","source":"new Set([...VAR_0])","isStatement":true,"originalPath":"e2e/input1.js","dependencies":["VAR_0"],"needsSuper":false}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/SequenceExpression/92059b51.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/SequenceExpression/92059b51.json
new file mode 100644
index 00000000000000..ca5688c482df0f
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/SequenceExpression/92059b51.json
@@ -0,0 +1 @@
+{"type":"SequenceExpression","source":"VAR_1, VAR_2","path":"e2e/input1.js","dependencies":["VAR_1","VAR_2"]}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/SequenceExpression/92059b515fdaaf897409c544d19fec01b7c677f5.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/SequenceExpression/92059b515fdaaf897409c544d19fec01b7c677f5.json
deleted file mode 100644
index bba6f092525aef..00000000000000
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/SequenceExpression/92059b515fdaaf897409c544d19fec01b7c677f5.json
+++ /dev/null
@@ -1 +0,0 @@
-{"type":"SequenceExpression","source":"VAR_1, VAR_2","isStatement":true,"originalPath":"e2e/input1.js","dependencies":["VAR_1","VAR_2"],"needsSuper":false}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/TaggedTemplateExpression/93c7959b.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/TaggedTemplateExpression/93c7959b.json
new file mode 100644
index 00000000000000..a7906c42d76b5f
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/TaggedTemplateExpression/93c7959b.json
@@ -0,0 +1 @@
+{"type":"TaggedTemplateExpression","source":"VAR_3``","path":"e2e/input1.js","dependencies":["VAR_3"]}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/TaggedTemplateExpression/93c7959bebf4148eab01ad9187a3390f6b127e23.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/TaggedTemplateExpression/93c7959bebf4148eab01ad9187a3390f6b127e23.json
deleted file mode 100644
index 8e0ba118f3cf1f..00000000000000
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/TaggedTemplateExpression/93c7959bebf4148eab01ad9187a3390f6b127e23.json
+++ /dev/null
@@ -1 +0,0 @@
-{"type":"TaggedTemplateExpression","source":"VAR_3``","isStatement":true,"originalPath":"e2e/input1.js","dependencies":["VAR_3"],"needsSuper":false}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/ThisExpression/c2543fff.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/ThisExpression/c2543fff.json
new file mode 100644
index 00000000000000..c677625cb986ab
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/ThisExpression/c2543fff.json
@@ -0,0 +1 @@
+{"type":"ThisExpression","source":"this","path":"e2e/input1.js"}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/ThisExpression/c2543fff3bfa6f144c2f06a7de6cd10c0b650cae.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/ThisExpression/c2543fff3bfa6f144c2f06a7de6cd10c0b650cae.json
deleted file mode 100644
index 3d4f8b6034f6e4..00000000000000
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/ThisExpression/c2543fff3bfa6f144c2f06a7de6cd10c0b650cae.json
+++ /dev/null
@@ -1 +0,0 @@
-{"type":"ThisExpression","source":"this","isStatement":true,"originalPath":"e2e/input1.js","needsSuper":false}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/UnaryExpression/3b59bddf.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/UnaryExpression/3b59bddf.json
new file mode 100644
index 00000000000000..265e5acd5be72f
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/UnaryExpression/3b59bddf.json
@@ -0,0 +1 @@
+{"type":"UnaryExpression","source":"delete NaN","path":"e2e/input1.js"}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/UnaryExpression/3b59bddfed6319031112411ec0633c4e423ae460.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/UnaryExpression/3b59bddfed6319031112411ec0633c4e423ae460.json
deleted file mode 100644
index 9531e9ab408692..00000000000000
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/UnaryExpression/3b59bddfed6319031112411ec0633c4e423ae460.json
+++ /dev/null
@@ -1 +0,0 @@
-{"type":"UnaryExpression","source":"delete NaN","isStatement":true,"originalPath":"e2e/input1.js","needsSuper":false}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/UpdateExpression/62f29665.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/UpdateExpression/62f29665.json
new file mode 100644
index 00000000000000..4a6224f67931a7
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/UpdateExpression/62f29665.json
@@ -0,0 +1 @@
+{"type":"UpdateExpression","source":"--super[VAR_1]","path":"e2e/input1.js","dependencies":["VAR_1"]}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/UpdateExpression/62f296654616254793e9c1948c12a2951e711156.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/UpdateExpression/62f296654616254793e9c1948c12a2951e711156.json
deleted file mode 100644
index 8e85e178a8161e..00000000000000
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/UpdateExpression/62f296654616254793e9c1948c12a2951e711156.json
+++ /dev/null
@@ -1 +0,0 @@
-{"type":"UpdateExpression","source":"--super[VAR_1]","isStatement":true,"originalPath":"e2e/input1.js","dependencies":["VAR_1"],"needsSuper":true}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/UpdateExpression/9822c139.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/UpdateExpression/9822c139.json
new file mode 100644
index 00000000000000..8d6ddb45c6e2bd
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/UpdateExpression/9822c139.json
@@ -0,0 +1 @@
+{"type":"UpdateExpression","source":"VAR_0[5]++","path":"e2e/input1.js","dependencies":["VAR_0"]}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/UpdateExpression/9822c139a3406842de5446673fdd2613c4e6ca00.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/UpdateExpression/9822c139a3406842de5446673fdd2613c4e6ca00.json
deleted file mode 100644
index 9e8593782bea13..00000000000000
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/UpdateExpression/9822c139a3406842de5446673fdd2613c4e6ca00.json
+++ /dev/null
@@ -1 +0,0 @@
-{"type":"UpdateExpression","source":"VAR_0[5]++","isStatement":true,"originalPath":"e2e/input1.js","dependencies":["VAR_0"],"needsSuper":false}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/index.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/index.json
index 38b88afafcb206..bb6fe2265ee165 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/index.json
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/e2e_expected/index.json
@@ -1 +1,58 @@
-{"statements":["CallExpression/1876a21afb7224a48ec53aa4436f4d93349c5fa0.json","CallExpression/877c27d1e4a8e5a959a7c12bbd6d08d6ba5e8b28.json","ClassExpression/32369494369ef66a7074b32fd6b27c588860b571.json","LogicalExpression/c5813b84d032ce3d569c58e7aabbc013bc17c487.json","LogicalExpression/cc45a134bf1ed0009f03b8931dc2157b53b97de1.json","NewExpression/0001aa3649d75f272d662a385e028a4d4f24a712.json","SequenceExpression/92059b515fdaaf897409c544d19fec01b7c677f5.json","TaggedTemplateExpression/93c7959bebf4148eab01ad9187a3390f6b127e23.json","ThisExpression/c2543fff3bfa6f144c2f06a7de6cd10c0b650cae.json","UnaryExpression/3b59bddfed6319031112411ec0633c4e423ae460.json","UpdateExpression/9822c139a3406842de5446673fdd2613c4e6ca00.json"],"superStatements":["CallExpression/76c7c68f689d7eb9fd7e9d42e98d92a3bd11d4f3.json","CallExpression/9a863bdec092babc502181f10470c11643c66aa9.json","UpdateExpression/62f296654616254793e9c1948c12a2951e711156.json"],"all":["CallExpression/1876a21afb7224a48ec53aa4436f4d93349c5fa0.json","CallExpression/76c7c68f689d7eb9fd7e9d42e98d92a3bd11d4f3.json","CallExpression/877c27d1e4a8e5a959a7c12bbd6d08d6ba5e8b28.json","CallExpression/9a863bdec092babc502181f10470c11643c66aa9.json","ClassExpression/32369494369ef66a7074b32fd6b27c588860b571.json","LogicalExpression/c5813b84d032ce3d569c58e7aabbc013bc17c487.json","LogicalExpression/cc45a134bf1ed0009f03b8931dc2157b53b97de1.json","NewExpression/0001aa3649d75f272d662a385e028a4d4f24a712.json","SequenceExpression/92059b515fdaaf897409c544d19fec01b7c677f5.json","TaggedTemplateExpression/93c7959bebf4148eab01ad9187a3390f6b127e23.json","ThisExpression/c2543fff3bfa6f144c2f06a7de6cd10c0b650cae.json","UnaryExpression/3b59bddfed6319031112411ec0633c4e423ae460.json","UpdateExpression/62f296654616254793e9c1948c12a2951e711156.json","UpdateExpression/9822c139a3406842de5446673fdd2613c4e6ca00.json"]}
\ No newline at end of file
+[
+  {
+    "path": "CallExpression/1876a21a.json",
+    "super": false
+  },
+  {
+    "path": "CallExpression/76c7c68f.json",
+    "super": true
+  },
+  {
+    "path": "CallExpression/877c27d1.json",
+    "super": false
+  },
+  {
+    "path": "CallExpression/9a863bde.json",
+    "super": true
+  },
+  {
+    "path": "ClassExpression/32369494.json",
+    "super": false
+  },
+  {
+    "path": "LogicalExpression/c5813b84.json",
+    "super": false
+  },
+  {
+    "path": "LogicalExpression/cc45a134.json",
+    "super": false
+  },
+  {
+    "path": "NewExpression/0001aa36.json",
+    "super": false
+  },
+  {
+    "path": "SequenceExpression/92059b51.json",
+    "super": false
+  },
+  {
+    "path": "TaggedTemplateExpression/93c7959b.json",
+    "super": false
+  },
+  {
+    "path": "ThisExpression/c2543fff.json",
+    "super": false
+  },
+  {
+    "path": "UnaryExpression/3b59bddf.json",
+    "super": false
+  },
+  {
+    "path": "UpdateExpression/62f29665.json",
+    "super": true
+  },
+  {
+    "path": "UpdateExpression/9822c139.json",
+    "super": false
+  }
+]
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate/input.js b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate/input.js
new file mode 100644
index 00000000000000..0a23ef1cea6e4a
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate/input.js
@@ -0,0 +1,25 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let v1 = 0;
+
+// This code creates some error-free snippets.
+class A {}
+
+class B extends A {
+  constructor(param) {
+    super([]);
+  }
+
+  foo() {
+    super.valueOf();
+  }
+}
+
+Math.floor(v1);
+
+// This code creates error-prone snippets
+/a/.search(v1);
+v1.setUint16(8, 0xabcd)
+delete v1;
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate_expected/CallExpression/0a096256.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate_expected/CallExpression/0a096256.json
new file mode 100644
index 00000000000000..e57fdd567fa38a
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate_expected/CallExpression/0a096256.json
@@ -0,0 +1 @@
+{"type":"CallExpression","source":"Math.floor(VAR_0)","path":"validate/input.js","dependencies":["VAR_0"]}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate_expected/CallExpression/8eee3ad0.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate_expected/CallExpression/8eee3ad0.json
new file mode 100644
index 00000000000000..6212721a7338c3
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate_expected/CallExpression/8eee3ad0.json
@@ -0,0 +1 @@
+{"type":"CallExpression","source":"super([])","path":"validate/input.js"}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate_expected/CallExpression/9a863bde.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate_expected/CallExpression/9a863bde.json
new file mode 100644
index 00000000000000..e3ab1530d46568
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate_expected/CallExpression/9a863bde.json
@@ -0,0 +1 @@
+{"type":"CallExpression","source":"super.valueOf()","path":"validate/input.js"}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate_expected/CallExpression/d4095491.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate_expected/CallExpression/d4095491.json
new file mode 100644
index 00000000000000..7edd8633ab2d56
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate_expected/CallExpression/d4095491.json
@@ -0,0 +1 @@
+{"type":"CallExpression","source":"/a/.search(VAR_0)","path":"validate/input.js","dependencies":["VAR_0"]}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate_expected/CallExpression/d453f081.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate_expected/CallExpression/d453f081.json
new file mode 100644
index 00000000000000..f7e6d064355b0d
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate_expected/CallExpression/d453f081.json
@@ -0,0 +1 @@
+{"type":"CallExpression","source":"VAR_0.setUint16(8, 0xabcd)","path":"validate/input.js","dependencies":["VAR_0"]}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate_expected/UnaryExpression/b5a90209.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate_expected/UnaryExpression/b5a90209.json
new file mode 100644
index 00000000000000..ba737ad09cf07e
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate_expected/UnaryExpression/b5a90209.json
@@ -0,0 +1 @@
+{"type":"UnaryExpression","source":"delete VAR_0","path":"validate/input.js","dependencies":["VAR_0"]}
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate_expected/index.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate_expected/index.json
new file mode 100644
index 00000000000000..0690ec4b4778f1
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate_expected/index.json
@@ -0,0 +1,26 @@
+[
+  {
+    "path": "CallExpression/0a096256.json",
+    "super": false
+  },
+  {
+    "path": "CallExpression/8eee3ad0.json",
+    "super": true
+  },
+  {
+    "path": "CallExpression/9a863bde.json",
+    "super": true
+  },
+  {
+    "path": "CallExpression/d4095491.json",
+    "super": false
+  },
+  {
+    "path": "CallExpression/d453f081.json",
+    "super": false
+  },
+  {
+    "path": "UnaryExpression/b5a90209.json",
+    "super": false
+  }
+]
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate_index_expected.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate_index_expected.json
new file mode 100644
index 00000000000000..ae6298105752e3
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/db/validate_index_expected.json
@@ -0,0 +1,24 @@
+[
+  {
+    "path": "CallExpression/0a096256.json",
+    "super": false
+  },
+  {
+    "path": "CallExpression/8eee3ad0.json",
+    "super": true
+  },
+  {
+    "path": "CallExpression/9a863bde.json",
+    "super": true
+  },
+  {
+    "path": "CallExpression/d4095491.json",
+    "super": false,
+    "tc": true
+  },
+  {
+    "path": "CallExpression/d453f081.json",
+    "super": false,
+    "tc": true
+  }
+]
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/fake_db/index.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/fake_db/index.json
index 0967ef424bce67..fe51488c7066f6 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/fake_db/index.json
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/fake_db/index.json
@@ -1 +1 @@
-{}
+[]
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/loop_mutations_expected.js b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/loop_mutations_expected.js
index 9fb471a461bae9..3d3752f90b7538 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/loop_mutations_expected.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/loop_mutations_expected.js
@@ -13,15 +13,15 @@ print("I'm a resource.");
 let __v_0 = 0;
 let __v_1 = 0;
 for (const __v_7 = 0; __v_7 < 10000; __v_7++) {
-  console.log(/* VariableMutator: Replaced __v_7 with __v_7 */__v_7);
+  console.log(__v_7);
   console.log(/* VariableMutator: Replaced __v_1 with __v_7 */__v_7);
-  __v_1 = /* VariableMutator: Replaced __v_7 with __v_7 */__v_7;
-  __v_1 = /* VariableMutator: Replaced __v_7 with __v_7 */__v_7;
-  __v_1 = /* VariableMutator: Replaced __v_7 with __v_7 */__v_7;
+  __v_1 = __v_7;
+  __v_1 = __v_7;
+  __v_1 = __v_7;
   __v_7 = __v_1;
   __v_7 = __v_1;
   __v_7 = __v_1;
-  /* VariableMutator: Replaced __v_5 with __v_7 */__v_7(/* VariableMutator: Replaced __v_7 with __v_7 */__v_7);
+  /* VariableMutator: Replaced __v_5 with __v_7 */__v_7(__v_7);
 }
 let __v_2 = 0;
 while (true) {
@@ -42,7 +42,7 @@ do {
 } while (/* VariableMutator: Replaced __v_5 with __v_4 */__v_4);
 const __v_6 = 10;
 for (const __v_8 = __v_6; __v_8 > 0; __v_8--) {
-  console.log(/* VariableMutator: Replaced __v_8 with __v_8 */__v_8);
+  console.log(__v_8);
   console.log(/* VariableMutator: Replaced __v_6 with __v_8 */__v_8);
   if (strange) {
     __v_8 = __v_6;
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/const_var/expected.js b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/const_var/expected.js
new file mode 100644
index 00000000000000..f3637acb6296e5
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/const_var/expected.js
@@ -0,0 +1,47 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Original: differential_fuzz/fake_resource.js
+print("I'm a resource.");
+
+// Original: differential_fuzz/fake_resource.js
+print("I'm a resource.");
+
+// Original: regress/const_var/input.js
+const __v_0 = 0;
+const __v_1 = 0;
+const __v_2 = 0;
+const __v_3 = 0;
+let __v_4 = 0;
+let __v_5 = 0;
+try {
+  __v_5 = /* VariableMutator: Replaced __v_0 with __v_4 */__v_4;
+} catch (e) {}
+try {
+  __v_5 = /* VariableMutator: Replaced __v_1 with __v_0 */__v_0;
+} catch (e) {}
+try {
+  /* VariableMutator: Replaced __v_5 with __v_4 */__v_4 = /* VariableMutator: Replaced __v_2 with __v_3 */__v_3;
+} catch (e) {}
+try {
+  /* VariableMutator: Replaced __v_5 with __v_4 */__v_4 = /* VariableMutator: Replaced __v_3 with __v_2 */__v_2;
+} catch (e) {}
+try {
+  /* VariableMutator: Replaced __v_5 with __v_4 */__v_4 = /* VariableMutator: Replaced __v_4 with __v_3 */__v_3;
+} catch (e) {}
+try {
+  __v_4 = __v_0;
+} catch (e) {}
+try {
+  __v_4 = /* VariableMutator: Replaced __v_1 with __v_3 */__v_3;
+} catch (e) {}
+try {
+  /* VariableMutator: Replaced __v_4 with __v_5 */__v_5 = /* VariableMutator: Replaced __v_2 with __v_4 */__v_4;
+} catch (e) {}
+try {
+  __v_4 = /* VariableMutator: Replaced __v_3 with __v_0 */__v_0;
+} catch (e) {}
+try {
+  __v_4 = /* VariableMutator: Replaced __v_5 with __v_2 */__v_2;
+} catch (e) {}
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/const_var/input.js b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/const_var/input.js
new file mode 100644
index 00000000000000..730541316e4839
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/const_var/input.js
@@ -0,0 +1,21 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const a = 0;
+const b = 0;
+const c = 0;
+const d = 0;
+let e = 0;
+let f = 0;
+
+f = a;
+f = b;
+f = c;
+f = d;
+f = e;
+e = a;
+e = b;
+e = c;
+e = d;
+e = f;
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/duplicates/duplicates_db/index.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/duplicates/duplicates_db/index.json
index 9c75ecdb3efcd2..362d1c3f928698 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/duplicates/duplicates_db/index.json
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/duplicates/duplicates_db/index.json
@@ -1,9 +1,3 @@
-{
-    "statements": [
-      "ArrowFunctionExpression/a1.json"
-    ],
-    "superStatements": [],
-    "all": [
-      "ArrowFunctionExpression/a1.json"
-    ]
-}
\ No newline at end of file
+[
+  {"path": "ArrowFunctionExpression/a1.json", "super": false}
+]
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/duplicates/duplicates_expected.js b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/duplicates/duplicates_expected.js
index 98963ab0decf28..aaf1b148d277b8 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/duplicates/duplicates_expected.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/duplicates/duplicates_expected.js
@@ -10,13 +10,13 @@ console.log(42);
 async (...__v_1) => {
   const __v_2 = 0;
 };
+console.log(42);
 /* CrossOverMutator: Crossover from foo */
-async (...__v_1) => {
-  const __v_2 = 0;
+async (...__v_2) => {
+  const __v_1 = 0;
 };
 console.log(42);
 /* CrossOverMutator: Crossover from foo */
 async (...__v_2) => {
   const __v_1 = 0;
 };
-console.log(42);
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/empty_db/index.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/empty_db/index.json
index 0967ef424bce67..fe51488c7066f6 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/empty_db/index.json
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/empty_db/index.json
@@ -1 +1 @@
-{}
+[]
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/super/super_call_db/index.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/super/super_call_db/index.json
index 8b8f6181a0d007..87f424dc2bd551 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/super/super_call_db/index.json
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/super/super_call_db/index.json
@@ -1,12 +1,4 @@
-{
-    "statements": [
-      "CallExpression/a2.json"
-    ],
-    "superStatements": [
-      "CallExpression/a1.json"
-    ],
-    "all": [
-      "CallExpression/a1.json",
-      "CallExpression/a2.json"
-    ]
-}
\ No newline at end of file
+[
+  {"path": "CallExpression/a1.json", "super": true},
+  {"path": "CallExpression/a2.json", "super": false}
+]
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/super/super_member_db/index.json b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/super/super_member_db/index.json
index 8b8f6181a0d007..00baf043581fe6 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/super/super_member_db/index.json
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/regress/super/super_member_db/index.json
@@ -1,12 +1,4 @@
-{
-    "statements": [
-      "CallExpression/a2.json"
-    ],
-    "superStatements": [
-      "CallExpression/a1.json"
-    ],
-    "all": [
-      "CallExpression/a1.json",
-      "CallExpression/a2.json"
-    ]
-}
\ No newline at end of file
+[
+  {"path": "CallExpression/a1.json", "super": true, "tc": true},
+  {"path": "CallExpression/a2.json", "super": false}
+]
\ No newline at end of file
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/spidermonkey/test/load_expected.js b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/spidermonkey/test/load_expected.js
index 208dccc092455b..746491b53cdd03 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/spidermonkey/test/load_expected.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/spidermonkey/test/load_expected.js
@@ -6,6 +6,11 @@
 var document = {
   all: undefined
 };
+try {
+  drainJobQueue;
+} catch (e) {
+  this.drainJobQueue = this.nop;
+}
 
 // Original: spidermonkey/shell.js
 console.log('/shell.js');
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/try_catch_expected.js b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/try_catch_expected.js
index 8dade4aab9eb13..e93e4e1a92f534 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/try_catch_expected.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/try_catch_expected.js
@@ -77,20 +77,20 @@ try {
     } catch (e) {}
   }
 } catch (e) {}
-let module = __wrapTC(() => new WebAssembly.Module(builder.toBuffer()));
-const complex1 = __wrapTC(() => [1, 2, 3]);
-const complex2 = __wrapTC(() => boom());
+let module = __wrapTC(() => new WebAssembly.Module(builder.toBuffer()), false);
+const complex1 = __wrapTC(() => [1, 2, 3], false);
+const complex2 = __wrapTC(() => boom(), false);
 let complex3 = __wrapTC(() => function () {
-  let complex4 = __wrapTC(() => [1, 2, 3]);
+  let complex4 = __wrapTC(() => [1, 2, 3], false);
   return 2;
-}());
+}(), false);
 try {
   if (true) {
-    let complex5 = __wrapTC(() => new Map());
+    let complex5 = __wrapTC(() => new Map(), false);
   }
 } catch (e) {}
 async function foo(a) {
-  let val = await __wrapTC(() => a);
+  let val = await __wrapTC(() => a, false);
 }
 try {
   1;
@@ -123,4 +123,4 @@ function foo() {
 let {
   a: x,
   b: y
-} = __wrapTC(() => foo());
+} = __wrapTC(() => foo(), false);
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/try_catch_permissive_expected.js b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/try_catch_permissive_expected.js
new file mode 100644
index 00000000000000..9ddbb35b3c95d9
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/try_catch_permissive_expected.js
@@ -0,0 +1,112 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Original: try_catch.js
+function blah() {
+  try {
+    var a = 10;
+    console.log(a);
+  } catch (e) {}
+  try {
+    label: for (var i = 0; i < 100; i++) {
+      var b = 0;
+      while (b < 10) {
+        console.log(b);
+        b += 2;
+        continue label;
+      }
+    }
+  } catch (e) {}
+  return 1;
+}
+try {
+  blah();
+} catch (e) {}
+try {
+  blah();
+} catch (e) {}
+try {
+  (function () {
+    try {
+      1;
+    } catch (e) {}
+    try {
+      1;
+    } catch (e) {}
+  })();
+} catch (e) {}
+try {
+  if (true) {
+    try {
+      2;
+    } catch (e) {}
+    try {
+      2;
+    } catch (e) {}
+  } else {
+    try {
+      3;
+    } catch (e) {}
+    try {
+      3;
+    } catch (e) {}
+  }
+} catch (e) {}
+let a = 0;
+try {
+  switch (a) {
+    case 1:
+      try {
+        1;
+      } catch (e) {}
+  }
+} catch (e) {}
+try {
+  with (Math) {
+    cos(PI);
+  }
+} catch (e) {}
+let module = __wrapTC(() => new WebAssembly.Module(builder.toBuffer()));
+const complex1 = __wrapTC(() => [1, 2, 3]);
+const complex2 = __wrapTC(() => boom());
+let complex3 = __wrapTC(() => function () {
+  let complex4 = [1, 2, 3];
+  return 2;
+}());
+try {
+  if (true) {
+    let complex5 = __wrapTC(() => new Map());
+  }
+} catch (e) {}
+async function foo(a) {
+  let val = await __wrapTC(() => a);
+}
+try {
+  1;
+} catch (e) {
+  try {
+    2;
+  } catch (e) {}
+}
+try {
+  call(() => {
+    1;
+    2;
+  });
+} catch (e) {}
+function foo() {
+  let a = 0;
+  let b = 1;
+  try {
+    boom();
+  } catch (e) {}
+  return {
+    a: a,
+    b: b
+  };
+}
+let {
+  a: x,
+  b: y
+} = __wrapTC(() => foo());
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/try_catch_toplevel_expected.js b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/try_catch_toplevel_expected.js
index 30ccf8d28e334b..5902f68d23b3ca 100644
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/try_catch_toplevel_expected.js
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/try_catch_toplevel_expected.js
@@ -53,13 +53,13 @@ try {
     cos(PI);
   }
 } catch (e) {}
-let module = __wrapTC(() => new WebAssembly.Module(builder.toBuffer()));
-const complex1 = __wrapTC(() => [1, 2, 3]);
-const complex2 = __wrapTC(() => boom());
+let module = __wrapTC(() => new WebAssembly.Module(builder.toBuffer()), false);
+const complex1 = __wrapTC(() => [1, 2, 3], false);
+const complex2 = __wrapTC(() => boom(), false);
 let complex3 = __wrapTC(() => function () {
   let complex4 = [1, 2, 3];
   return 2;
-}());
+}(), false);
 try {
   if (true) {
     let complex5 = new Map();
@@ -99,4 +99,4 @@ function foo() {
 let {
   a: x,
   b: y
-} = __wrapTC(() => foo());
+} = __wrapTC(() => foo(), false);
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/verify_db/expected_code_0.js b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/verify_db/expected_code_0.js
deleted file mode 100644
index 71f750a3b07753..00000000000000
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/verify_db/expected_code_0.js
+++ /dev/null
@@ -1,15 +0,0 @@
-// Copyright 2025 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Original: resources/cross_over_template_2.js
-let __v_0 = 0;
-let __v_1 = 0;
-class __c_0 {}
-class __c_1 extends __c_0 {
-  constructor() {
-    console.log(42);
-    /* CrossOverMutator: Crossover from foo */
-    super();
-  }
-}
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/verify_db/expected_code_1.js b/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/verify_db/expected_code_1.js
deleted file mode 100644
index 81b38049293cea..00000000000000
--- a/deps/v8/tools/clusterfuzz/js_fuzzer/test_data/verify_db/expected_code_1.js
+++ /dev/null
@@ -1,15 +0,0 @@
-// Copyright 2025 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Original: resources/cross_over_template_3.js
-let __v_0 = 0;
-let __v_1 = 0;
-class __c_0 {
-  foo() {}
-}
-class __c_1 extends __c_0 {
-  foo() {
-    console.log(42);
-  }
-}
diff --git a/deps/v8/tools/clusterfuzz/js_fuzzer/validate_db.js b/deps/v8/tools/clusterfuzz/js_fuzzer/validate_db.js
new file mode 100644
index 00000000000000..781e0e33d327c9
--- /dev/null
+++ b/deps/v8/tools/clusterfuzz/js_fuzzer/validate_db.js
@@ -0,0 +1,126 @@
+// Copyright 2025 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/**
+ * @fileoverview Validate all the snippets in the DB by executing them with
+ * a test file. The new, validated index can replace the existing one with
+ * hardened assumptions.
+ */
+
+const fs = require('fs');
+const fsPath = require('path');
+const program = require('commander');
+const tempfile = require('tempfile');
+
+const { execSync } = require("child_process");
+
+const babelTraverse = require('@babel/traverse').default;
+const babelTypes = require('@babel/types');
+
+const corpus = require('./corpus.js');
+const db = require('./db.js');
+const sourceHelpers = require('./source_helpers.js');
+
+const { CrossOverMutator } = require('./mutators/crossover_mutator.js');
+
+/**
+ * Return templates to test the expression on.
+ */
+function templates(expression) {
+  if (expression.needsSuper) {
+    return [
+      'cross_over_template_class_constructor.js',
+      'cross_over_template_class_method.js',
+    ];
+  } else {
+    return [
+      'cross_over_template_sloppy.js',
+      'cross_over_template_strict.js',
+    ];
+  }
+}
+
+/**
+ * Execute code and return the error message on failure or undefined on
+ * success.
+ */
+function execute(code) {
+  const output_file = tempfile('.js');
+  fs.writeFileSync(output_file, code);
+  try {
+    execSync("node " + output_file, {stdio: ['pipe']});
+    return undefined;
+  } catch(e) {
+    return e.message;
+  }
+}
+
+/**
+ * Insert an expression into a template, generate and execute the resulting
+ * code. Return the error message on failure or undefined on success.
+ */
+function validate(crossover, tmplName, expression) {
+  const tmpl = sourceHelpers.loadSource(
+    sourceHelpers.BASE_CORPUS, fsPath.join('resources', tmplName));
+  try {
+    let done = false;
+    babelTraverse(tmpl.ast, {
+      ExpressionStatement(path) {
+        if (done || !path.node.expression ||
+            !babelTypes.isCallExpression(path.node.expression)) {
+          return;
+        }
+        // Avoid infinite loops if there's an expression statement in the
+        // inserted expression.
+        done = true;
+        path.insertAfter(crossover.createInsertion(path, expression));
+      }
+    });
+  } catch (e) {
+    console.log(`Could not validate expression: ${expression.source}`);
+    return 'SyntaxError';
+  }
+  return execute(sourceHelpers.generateCode(tmpl, []));
+}
+
+function main() {
+  program
+    .version('0.0.1')
+    .option('-i, --input_dir <path>', 'DB directory.')
+    .option('-o, --output_index <path>', 'path to new index.')
+    .parse(process.argv);
+
+  if (!program.input_dir || !program.output_index) {
+    console.log('Need to specify DB dir and output index.');
+    return;
+  }
+
+  const mutateDb = new db.MutateDb(program.input_dir);
+  const crossover = new CrossOverMutator(undefined, mutateDb);
+
+  result = [];
+  for (const record of mutateDb.all) {
+    const expression = db.loadExpression(program.input_dir, record);
+
+    let errors = false;
+    let syntaxErrors = false;
+    for (const tmplName of templates(expression)) {
+      const error = validate(crossover, tmplName, expression);
+      errors |= Boolean(error);
+      syntaxErrors |= Boolean(error?.includes("SyntaxError"))
+    }
+    // Discard records causing syntax errors.
+    if (syntaxErrors) {
+      continue;
+    }
+    // Mark records that will require try-catch wrapping.
+    if (errors) {
+      record["tc"] = true;
+    }
+    result.push(record);
+  }
+  db.writeIndexFile(program.output_index, result);
+}
+
+main();
diff --git a/deps/v8/tools/debug_helper/debug-helper-internal.cc b/deps/v8/tools/debug_helper/debug-helper-internal.cc
index 65098d13f0f8b3..edbbbc098266e8 100644
--- a/deps/v8/tools/debug_helper/debug-helper-internal.cc
+++ b/deps/v8/tools/debug_helper/debug-helper-internal.cc
@@ -33,7 +33,7 @@ uintptr_t EnsureDecompressed(uintptr_t address,
   // TODO(v8:11880): ExternalCodeCompressionScheme might be needed here for
   // decompressing Code pointers from external code space.
   return i::V8HeapCompressionScheme::DecompressTagged(
-      any_uncompressed_ptr, static_cast<i::Tagged_t>(address));
+      static_cast<i::Tagged_t>(address));
 }
 
 d::PropertyKind GetArrayKind(d::MemoryAccessResult mem_result) {
diff --git a/deps/v8/tools/debug_helper/gen-heap-constants.py b/deps/v8/tools/debug_helper/gen-heap-constants.py
index 38fd4a1745d5dd..1938f5d5824af3 100644
--- a/deps/v8/tools/debug_helper/gen-heap-constants.py
+++ b/deps/v8/tools/debug_helper/gen-heap-constants.py
@@ -73,7 +73,7 @@ def iterate_maps(target_space, camel_space_name):
       out = out + '  if (heap_addresses->' + space_name + '_first_page == 0) {\n'
       out = out + '    heap_addresses->' + space_name + \
           '_first_page = i::V8HeapCompressionScheme::DecompressTagged(' + \
-          'any_uncompressed_ptr, ' + str(offset) + ');\n'
+          str(offset) + ');\n'
       out = out + '  }\n'
 out = out + '}\n'
 
diff --git a/deps/v8/tools/dev/gm.py b/deps/v8/tools/dev/gm.py
index 57483c1347d49b..7419062559059c 100755
--- a/deps/v8/tools/dev/gm.py
+++ b/deps/v8/tools/dev/gm.py
@@ -80,8 +80,9 @@
 DEFAULT_TARGETS = ["d8"]
 # Tests that run-tests.py would run by default that can be run with
 # BUILD_TARGETS_TESTS.
-DEFAULT_TESTS = ["cctest", "debugger", "intl", "message", "mjsunit",
-                 "unittests"]
+DEFAULT_TESTS = [
+    "cctest", "debugger", "filecheck", "intl", "message", "mjsunit", "unittests"
+]
 # These can be suffixed to any <arch>.<mode> combo, or used standalone,
 # or used as global modifiers (affecting all <arch>.<mode> combos).
 ACTIONS = {
@@ -131,6 +132,7 @@
     "bigint": "bigint_shell",
     "cctest": "cctest",
     "debugger": "d8",
+    "filecheck": "d8",
     "fuzzer": "v8_fuzzers",
     "inspector": "inspector-test",
     "intl": "d8",
diff --git a/deps/v8/tools/dev/update-compile-commands.py b/deps/v8/tools/dev/update-compile-commands.py
index 9860dd7f813a6c..86e42fd66f9b24 100755
--- a/deps/v8/tools/dev/update-compile-commands.py
+++ b/deps/v8/tools/dev/update-compile-commands.py
@@ -25,8 +25,8 @@
 GM_CHECK = os.path.join(GM_PATH, 'gm.py')
 def CheckRelativeImport(path):
   if not os.path.exists(path):
-    print(f"Error: Please run this script from the root of a V8 checkout. "
-          "{path} must be a valid relative path.")
+    print("Error: Please run this script from the root of a V8 checkout. "
+          f"{path} must be a valid relative path.")
     sys.exit(1)
 CheckRelativeImport(PYLIB_CHECK)
 CheckRelativeImport(GM_CHECK)
diff --git a/deps/v8/tools/gdbinit b/deps/v8/tools/gdbinit
index a839eff8127e92..806b20accd18d3 100644
--- a/deps/v8/tools/gdbinit
+++ b/deps/v8/tools/gdbinit
@@ -14,6 +14,8 @@ end
 # Print content of V8 handles.
 python
 import gdb
+import gdb.printing
+import gdb.types
 
 class PrintV8HandleCommand(gdb.Command):
   """Print content of a V8 object, accessed through a handle."""
@@ -94,9 +96,25 @@ PrintV8LocalCommand()
 PrintV8InternalHandleCommand()
 end
 
-alias jlh = print-v8-local
-alias jl = print-v8-local
-alias jh = print-v8-internal-handle
+python
+class TryAliasCommand(gdb.Command):
+  """Create an alias, but don't error if it already exists."""
+
+  def __init__ (self):
+    super (TryAliasCommand, self).__init__ ("try-alias", gdb.COMMAND_FILES)
+
+  def invoke (self, arg, from_tty):
+    try:
+      gdb.execute('alias ' + arg)
+    except:
+      pass
+
+TryAliasCommand()
+end
+
+try-alias jlh = print-v8-local
+try-alias jl = print-v8-local
+try-alias jh = print-v8-internal-handle
 
 # Print Code objects containing given PC.
 define jco
@@ -361,7 +379,7 @@ import subprocess
 import sys
 
 compile_dirs = set()
-
+src_dir = None
 
 def get_current_debug_file_directories():
   dir = gdb.execute("show debug-file-directory", to_string=True)
@@ -380,6 +398,40 @@ def add_debug_file_directory(dir):
       "set debug-file-directory %s" % ":".join(current_dirs), to_string=True)
 
 
+def load_libcxx_pretty_printers(src_dir):
+  libcxx_pretty_printers = os.path.join(src_dir, 'third_party', 'libc++', 'src',
+                                        'utils', 'gdb', 'libcxx')
+  if not os.path.isdir(libcxx_pretty_printers):
+    return
+  sys.path.insert(1, libcxx_pretty_printers)
+  from printers import register_libcxx_printer_loader
+  register_libcxx_printer_loader()
+
+
+def set_src_dir(compile_dir):
+  global src_dir
+  git = subprocess.Popen(
+      ['git', '-C', compile_dir, 'rev-parse', '--show-toplevel'],
+      stdout=subprocess.PIPE,
+      stderr=subprocess.PIPE)
+  src_dir, _ = git.communicate()
+  if git.returncode:
+    return
+  if isinstance(src_dir, str):
+    src_dir = src_dir.rstrip()
+  else:
+    src_dir = src_dir.decode('utf-8').rstrip()
+
+  # If there's no LICENSE.v8 file in the repo root, we got the wrong git repo.
+  # The most common way to have this happen is to be in a git checkout of
+  # another project that vendors chromium in its own third_party directory. In
+  # that case, try falling back to the current working directory.
+  if not os.path.isfile(os.path.join(src_dir, 'LICENSE.v8')):
+    src_dir = os.path.abspath(os.getcwd())
+
+  load_libcxx_pretty_printers(src_dir)
+
+
 def newobj_handler(event):
   global compile_dirs
   compile_dir = os.path.dirname(event.new_objfile.filename)
@@ -396,6 +448,10 @@ def newobj_handler(event):
   # https://sourceware.org/gdb/onlinedocs/gdb/Separate-Debug-Files.html
   # https://crbug.com/603286#c35
   add_debug_file_directory(compile_dir)
+  
+  global src_dir
+  if not src_dir:
+    set_src_dir(compile_dir)
 
 # Event hook for newly loaded objfiles.
 # https://sourceware.org/gdb/onlinedocs/gdb/Events-In-Python.html
@@ -455,6 +511,7 @@ def cppgc_pretty_printers(val):
 
 
 gdb.pretty_printers.append(cppgc_pretty_printers)
+
 class TaggedPrintCommand(gdb.Command):
     """
     The equivalent of the print command that deals with tagged objects
@@ -515,4 +572,164 @@ class TaggedPrintCommand(gdb.Command):
 
 TaggedPrintCommand()
 
+
+static_roots_cache = None
+def GetStaticRoot(ptr):
+  global static_roots_cache
+  if static_roots_cache is None:
+    static_roots_cache = {}
+    try:
+      for field in gdb.lookup_type("v8::internal::StaticReadOnlyRoot").fields():
+        value = gdb.parse_and_eval("v8::internal::StaticReadOnlyRoot::"+field.name)
+        if int(value) in static_roots_cache:
+          static_roots_cache[int(value)] += "," + field.name
+        else:
+          static_roots_cache[int(value)] = field.name
+    except Exception as e:
+      print("Warning, couldn't find static roots: ", e)
+  ptr = ptr & 0xFFFFFFFF
+  return static_roots_cache.get(ptr, None)
+
+
+def InterpretTaggedPointer(pointer):
+  if (pointer & 0x1) == 0:
+    return f"Smi: {pointer >> 1}"
+  
+  static_root = GetStaticRoot(pointer)
+  if static_root is not None:
+    return f"{static_root}"
+
+  return None
+
+
+def OptimizedOutToNone(val):
+  if val is None:
+    return None
+  if val.is_optimized_out:
+    return None
+  return val
+
+
+class TaggedPrinter(object):
+  """Print Tagged<Foo> types."""
+
+  def __init__(self, val, pointee_type):
+    self.val = OptimizedOutToNone(val)
+    self.pointee_type = pointee_type.lstrip('v8::internal::')
+    self.ptr = self.val["ptr_"] if self.val is not None else None
+
+  def to_string(self):
+    if self.ptr is None:
+      return f"Tagged<{self.pointee_type}>{{<optimized out>}}"
+    pointer = int(self.ptr)
+    fmt = f"Tagged<{self.pointee_type}>{{0x{pointer:02x}}}"
+    if (label := InterpretTaggedPointer(pointer)) is not None:
+      fmt += f" ({label})"          
+    return fmt
+
+
+def tagged_pretty_printers(val):
+  # The member type might have been obscured by typedefs and template
+  # arguments. Fallback to using the underlying type.
+  real_type = val.type.strip_typedefs()
+  typename = real_type.name or real_type.tag or str(real_type)
+  regex = re.compile("^v8::internal::Tagged<(.*)>$")
+  match = regex.match(typename)
+  if match is not None:
+    return TaggedPrinter(val, pointee_type=match.group(1))
+
+  return None
+
+
+gdb.pretty_printers.append(tagged_pretty_printers)
+
+
+class HandlePrinter(object):
+  """Print Handle<Foo> types."""
+
+  def __init__(self, val, pointee_type):
+    self.val = OptimizedOutToNone(val)
+    self.pointee_type = pointee_type.lstrip('v8::internal::')
+    self.location = OptimizedOutToNone(self.val["location_"] if self.val is not None else None)
+    self.ptr = self.location.dereference() if self.location is not None else None
+
+  def to_string(self):
+    if self.location is None:
+      return f"Handle<{self.pointee_type}>{{<optimized out>}}"
+    location = int(self.location)
+    fmt = f"Handle<{self.pointee_type}>{{0x{location:02x}}}: "
+    if self.ptr is None:
+      fmt += f"<optimized out>"
+    else:
+      pointer = None
+      try:
+        pointer = int(self.ptr)
+      except Exception as e:
+        fmt += f"[{e}]"
+      else:
+        fmt += f"0x{pointer:02x}"
+        if (label := InterpretTaggedPointer(pointer)) is not None:
+          fmt += f" ({label})"
+          
+    return fmt
+
+
+def handle_pretty_printers(val):
+  # The member type might have been obscured by typedefs and template
+  # arguments. Fallback to using the underlying type.
+  real_type = val.type.strip_typedefs()
+  typename = real_type.name or real_type.tag or str(real_type)
+  regex = re.compile("^v8::internal::(?:Indirect)?Handle<(.*)>$")
+  match = regex.match(typename)
+  if match is not None:
+    return HandlePrinter(val, pointee_type=match.group(1))
+
+  return None
+
+
+gdb.pretty_printers.append(handle_pretty_printers)
+
+
+class DirectHandlePrinter(object):
+  """Print DirectHandle<Foo> types."""
+
+  def __init__(self, val, pointee_type):
+    self.val = val
+    self.pointee_type = pointee_type.lstrip('v8::internal::')
+    self.inner = None
+    if gdb.types.has_field(self.val.type, "handle_"):
+      self.inner = HandlePrinter(val['handle_'], pointee_type)
+    elif gdb.types.has_field(self.val.type, "obj_"):
+      self.inner = TaggedPrinter(val['obj_'], pointee_type)
+    else:
+      print("Warning: No recognised DirectHandle field")
+
+  def to_string(self):
+    if self.inner is not None:
+      return self.inner.to_string()
+
+
+def direct_handle_pretty_printers(val):
+  # The member type might have been obscured by typedefs and template
+  # arguments. Fallback to using the underlying type.
+  real_type = val.type.strip_typedefs()
+  typename = real_type.name or real_type.tag or str(real_type)
+  regex = re.compile("^v8::internal::DirectHandle<(.*)>$")
+  match = regex.match(typename)
+  if match is not None:
+    if gdb.types.has_field(real_type, "handle_"):
+      handle = None
+      if not val.is_optimized_out:
+        handle = val['handle_']
+      return HandlePrinter(handle, match.group(1))
+    elif gdb.types.has_field(real_type, "obj_"):
+      obj = None
+      if not val.is_optimized_out:
+        obj = val['obj_']
+      return TaggedPrinter(obj, match.group(1))
+
+  return None
+
+gdb.pretty_printers.append(direct_handle_pretty_printers)
+
 end
diff --git a/deps/v8/tools/profiling/linux-perf-d8.py b/deps/v8/tools/profiling/linux-perf-d8.py
index b53f62ad28d8e7..6b5fdb62d26957 100755
--- a/deps/v8/tools/profiling/linux-perf-d8.py
+++ b/deps/v8/tools/profiling/linux-perf-d8.py
@@ -151,39 +151,11 @@ def main():
       parser.error("--timeout should be a positive number")
 
     # ==========================================================================
-    def make_path_absolute(maybe_path, is_d8_js_argument=False):
-      if maybe_path.startswith("-"):
-        return maybe_path
-      path = Path(maybe_path)
-      if not path.exists():
-        return maybe_path
-      if is_d8_js_argument:
-        # Be slightly more strict with JS arguments as they might accidentally
-        # point to files that exist (e.h. JetStream workloads).
-        if "/" not in maybe_path:
-          return maybe_path
-      return str(path.absolute())
-
-    def make_args_paths_absolute(args):
-      args_absolute_paths = []
-      is_d8_js_argument = False
-      for arg in args:
-        if arg == "--":
-          is_d8_js_argument = True
-        args_absolute_paths.append(make_path_absolute(arg, is_d8_js_argument))
-      return args_absolute_paths
-
-    # Preprocess args if we change CWD to get cleaner output
-    if options.perf_data_dir != Path.cwd():
-      args = make_args_paths_absolute(args)
 
-    # ==========================================================================
-    old_cwd = Path.cwd()
-    os.chdir(options.perf_data_dir)
-
-    # ==========================================================================
-
-    cmd = [str(d8_bin), "--perf-prof"]
+    cmd = [
+        str(d8_bin), "--perf-prof", "--perf-prof-path",
+        options.perf_data_dir.as_posix()
+    ]
 
     if not options.no_interpreted_frames_native_stack:
       cmd += ["--interpreted-frames-native-stack"]
@@ -216,7 +188,7 @@ def make_args_paths_absolute(args):
     log("D8 CMD: ", shlex.join(cmd))
 
     datetime_str = datetime.now().strftime("%Y-%m-%d_%H%M%S")
-    perf_data_file = Path.cwd() / f"d8_{datetime_str}.perf.data"
+    perf_data_file = options.perf_data_dir / f"d8_{datetime_str}.perf.data"
     perf_cmd = [
         "perf", "record", f"--call-graph={options.call_graph}",
         f"--clockid={options.clockid}", f"--output={perf_data_file}"
diff --git a/deps/v8/tools/testrunner/base_runner.py b/deps/v8/tools/testrunner/base_runner.py
index d0b829af7f48b0..60005b48766a1a 100644
--- a/deps/v8/tools/testrunner/base_runner.py
+++ b/deps/v8/tools/testrunner/base_runner.py
@@ -36,57 +36,58 @@
 # The mapping from names used here to GN targets (which must stay in sync)
 # is defined in infra/mb/gn_isolate_map.pyl.
 TEST_MAP = {
-  # This needs to stay in sync with group("v8_bot_default") in test/BUILD.gn.
-  "bot_default": [
-    "debugger",
-    "mjsunit",
-    "cctest",
-    "wasm-spec-tests",
-    "inspector",
-    "webkit",
-    "mkgrokdump",
-    "wasm-js",
-    "fuzzer",
-    "message",
-    "intl",
-    "unittests",
-    "wasm-api-tests",
-  ],
-  # This needs to stay in sync with group("v8_default") in test/BUILD.gn.
-  "default": [
-    "debugger",
-    "mjsunit",
-    "cctest",
-    "wasm-spec-tests",
-    "inspector",
-    "mkgrokdump",
-    "wasm-js",
-    "fuzzer",
-    "message",
-    "intl",
-    "unittests",
-    "wasm-api-tests",
-  ],
-  # This needs to stay in sync with group("v8_d8_default") in test/BUILD.gn.
-  "d8_default": [
-    "debugger",
-    "mjsunit",
-    "webkit",
-    "message",
-    "intl",
-  ],
-  # This needs to stay in sync with "v8_optimize_for_size" in test/BUILD.gn.
-  "optimize_for_size": [
-    "debugger",
-    "mjsunit",
-    "cctest",
-    "inspector",
-    "webkit",
-    "intl",
-  ],
-  "unittests": [
-    "unittests",
-  ],
+    # This needs to stay in sync with group("v8_bot_default") in test/BUILD.gn.
+    "bot_default": [
+        "debugger",
+        "mjsunit",
+        "cctest",
+        "wasm-spec-tests",
+        "inspector",
+        "webkit",
+        "mkgrokdump",
+        "wasm-js",
+        "fuzzer",
+        "message",
+        "intl",
+        "unittests",
+        "wasm-api-tests",
+        "filecheck",
+    ],
+    # This needs to stay in sync with group("v8_default") in test/BUILD.gn.
+    "default": [
+        "debugger",
+        "mjsunit",
+        "cctest",
+        "wasm-spec-tests",
+        "inspector",
+        "mkgrokdump",
+        "wasm-js",
+        "fuzzer",
+        "message",
+        "intl",
+        "unittests",
+        "wasm-api-tests",
+        "filecheck",
+    ],
+    # This needs to stay in sync with group("v8_d8_default") in test/BUILD.gn.
+    "d8_default": [
+        "debugger",
+        "mjsunit",
+        "webkit",
+        "message",
+        "intl",
+        "filecheck",
+    ],
+    # This needs to stay in sync with "v8_optimize_for_size" in test/BUILD.gn.
+    "optimize_for_size": [
+        "debugger",
+        "mjsunit",
+        "cctest",
+        "inspector",
+        "webkit",
+        "intl",
+    ],
+    "unittests": ["unittests",],
 }
 
 DEFAULT_FLAGS = {
diff --git a/deps/v8/tools/testrunner/local/variants.py b/deps/v8/tools/testrunner/local/variants.py
index 952835f6a3edcd..589ea4c71ea7b9 100644
--- a/deps/v8/tools/testrunner/local/variants.py
+++ b/deps/v8/tools/testrunner/local/variants.py
@@ -142,7 +142,8 @@
             "--regexp-tier-up",
             "--no-regexp-interpret-all",
             "--interpreted-frames-native-stack",
-            "--script-context-mutable-heap-number",
+            "--additive-safe-int-feedback",
+            "--script-context-cells",
         ],
     "nooptimization": [
         "--turbofan",
@@ -156,8 +157,8 @@
         "--validate-asm",
         "--track-field-types",
         "--stress-concurrent-inlining",
-        "--script-context-mutable-heap-number",
-        "--experimental-wasm-shared",
+        "--additive-safe-int-feedback",
+        "--script-context-cells",
     ],
     "slow_path": ["--no-force-slow-path"],
     "stress_concurrent_allocation": [
diff --git a/deps/v8/tools/testrunner/outproc/filecheck.py b/deps/v8/tools/testrunner/outproc/filecheck.py
new file mode 100644
index 00000000000000..f6454edff21d7f
--- /dev/null
+++ b/deps/v8/tools/testrunner/outproc/filecheck.py
@@ -0,0 +1,33 @@
+# Copyright 2025 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+from . import base
+
+import platform
+import subprocess
+
+
+class FileCheckOutProc(base.OutProc):
+  """Processor for FileCheck-based expectations."""
+
+  def __init__(self, expected_outcomes, js_file):
+    super(FileCheckOutProc, self).__init__(expected_outcomes)
+    self._js_file = js_file
+
+  def _is_failure_output(self, output):
+    cmd = ["vpython3", "-m", "filecheck", str(self._js_file)]
+    # Note that we encode the input again because on Windows providing
+    # > input=output.stdout, encoding="ascii", text=True
+    # creates some issues with the filecheck CHECK-NEXT directive (maybe
+    # something goes wrong in terms of new lines)...
+    res = subprocess.run(
+        cmd,
+        input=output.stdout.encode("ascii"),
+        capture_output=True,
+        shell=platform.system() == 'Windows')
+    if res.returncode != 0 and "FileCheck failed" not in output.stderr:
+      # FileCheck failed, add error to stderr (even though technically not
+      # correct) to report it back in the various UIs of testrunners.
+      output.stderr += "\nFileCheck failed:\n" + res.stderr.decode()
+    return res.returncode != 0
diff --git a/deps/v8/tools/tracing/proto-converter/.gitignore b/deps/v8/tools/tracing/proto-converter/.gitignore
deleted file mode 100644
index b7f03ffd3240ed..00000000000000
--- a/deps/v8/tools/tracing/proto-converter/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-proto-to-json.js
\ No newline at end of file
diff --git a/deps/v8/tools/tracing/proto-converter/.nvmrc b/deps/v8/tools/tracing/proto-converter/.nvmrc
deleted file mode 100644
index a7b32add2f83ed..00000000000000
--- a/deps/v8/tools/tracing/proto-converter/.nvmrc
+++ /dev/null
@@ -1 +0,0 @@
-v11.9.0
diff --git a/deps/v8/tools/tracing/proto-converter/package-lock.json b/deps/v8/tools/tracing/proto-converter/package-lock.json
deleted file mode 100644
index 52e52b318fd24f..00000000000000
--- a/deps/v8/tools/tracing/proto-converter/package-lock.json
+++ /dev/null
@@ -1,123 +0,0 @@
-{
-  "requires": true,
-  "lockfileVersion": 1,
-  "dependencies": {
-    "@protobufjs/aspromise": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/aspromise/-/aspromise-1.1.2.tgz",
-      "integrity": "sha1-m4sMxmPWaafY9vXQiToU00jzD78=",
-      "dev": true
-    },
-    "@protobufjs/base64": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/base64/-/base64-1.1.2.tgz",
-      "integrity": "sha512-AZkcAA5vnN/v4PDqKyMR5lx7hZttPDgClv83E//FMNhR2TMcLUhfRUBHCmSl0oi9zMgDDqRUJkSxO3wm85+XLg==",
-      "dev": true
-    },
-    "@protobufjs/codegen": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/@protobufjs/codegen/-/codegen-2.0.4.tgz",
-      "integrity": "sha512-YyFaikqM5sH0ziFZCN3xDC7zeGaB/d0IUb9CATugHWbd1FRFwWwt4ld4OYMPWu5a3Xe01mGAULCdqhMlPl29Jg==",
-      "dev": true
-    },
-    "@protobufjs/eventemitter": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/eventemitter/-/eventemitter-1.1.0.tgz",
-      "integrity": "sha1-NVy8mLr61ZePntCV85diHx0Ga3A=",
-      "dev": true
-    },
-    "@protobufjs/fetch": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/fetch/-/fetch-1.1.0.tgz",
-      "integrity": "sha1-upn7WYYUr2VwDBYZ/wbUVLDYTEU=",
-      "dev": true,
-      "requires": {
-        "@protobufjs/aspromise": "^1.1.1",
-        "@protobufjs/inquire": "^1.1.0"
-      }
-    },
-    "@protobufjs/float": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/float/-/float-1.0.2.tgz",
-      "integrity": "sha1-Xp4avctz/Ap8uLKR33jIy9l7h9E=",
-      "dev": true
-    },
-    "@protobufjs/inquire": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/inquire/-/inquire-1.1.0.tgz",
-      "integrity": "sha1-/yAOPnzyQp4tyvwRQIKOjMY48Ik=",
-      "dev": true
-    },
-    "@protobufjs/path": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/path/-/path-1.1.2.tgz",
-      "integrity": "sha1-bMKyDFya1q0NzP0hynZz2Nf79o0=",
-      "dev": true
-    },
-    "@protobufjs/pool": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/pool/-/pool-1.1.0.tgz",
-      "integrity": "sha1-Cf0V8tbTq/qbZbw2ZQbWrXhG/1Q=",
-      "dev": true
-    },
-    "@protobufjs/utf8": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/utf8/-/utf8-1.1.0.tgz",
-      "integrity": "sha1-p3c2C1s5oaLlEG+OhY8v0tBgxXA=",
-      "dev": true
-    },
-    "@types/long": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@types/long/-/long-4.0.0.tgz",
-      "integrity": "sha512-1w52Nyx4Gq47uuu0EVcsHBxZFJgurQ+rTKS3qMHxR1GY2T8c2AJYd6vZoZ9q1rupaDjU0yT+Jc2XTyXkjeMA+Q==",
-      "dev": true
-    },
-    "@types/node": {
-      "version": "11.11.4",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-11.11.4.tgz",
-      "integrity": "sha512-02tIL+QIi/RW4E5xILdoAMjeJ9kYq5t5S2vciUdFPXv/ikFTb0zK8q9vXkg4+WAJuYXGiVT1H28AkD2C+IkXVw==",
-      "dev": true
-    },
-    "long": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/long/-/long-4.0.0.tgz",
-      "integrity": "sha512-XsP+KhQif4bjX1kbuSiySJFNAehNxgLb6hPRGJ9QsUr8ajHkuXGdrHmFUTUUXhDwVX2R5bY4JNZEwbUiMhV+MA==",
-      "dev": true
-    },
-    "protobufjs": {
-      "version": "6.8.8",
-      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-6.8.8.tgz",
-      "integrity": "sha512-AAmHtD5pXgZfi7GMpllpO3q1Xw1OYldr+dMUlAnffGTAhqkg72WdmSY71uKBF/JuyiKs8psYbtKrhi0ASCD8qw==",
-      "dev": true,
-      "requires": {
-        "@protobufjs/aspromise": "^1.1.2",
-        "@protobufjs/base64": "^1.1.2",
-        "@protobufjs/codegen": "^2.0.4",
-        "@protobufjs/eventemitter": "^1.1.0",
-        "@protobufjs/fetch": "^1.1.0",
-        "@protobufjs/float": "^1.0.2",
-        "@protobufjs/inquire": "^1.1.0",
-        "@protobufjs/path": "^1.1.2",
-        "@protobufjs/pool": "^1.1.0",
-        "@protobufjs/utf8": "^1.1.0",
-        "@types/long": "^4.0.0",
-        "@types/node": "^10.1.0",
-        "long": "^4.0.0"
-      },
-      "dependencies": {
-        "@types/node": {
-          "version": "10.14.1",
-          "resolved": "https://registry.npmjs.org/@types/node/-/node-10.14.1.tgz",
-          "integrity": "sha512-Rymt08vh1GaW4vYB6QP61/5m/CFLGnFZP++bJpWbiNxceNa6RBipDmb413jvtSf/R1gg5a/jQVl2jY4XVRscEA==",
-          "dev": true
-        }
-      }
-    },
-    "typescript": {
-      "version": "3.3.4000",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-3.3.4000.tgz",
-      "integrity": "sha512-jjOcCZvpkl2+z7JFn0yBOoLQyLoIkNZAs/fYJkUG6VKy6zLPHJGfQJYFHzibB6GJaF/8QrcECtlQ5cpvRHSMEA==",
-      "dev": true
-    }
-  }
-}
diff --git a/deps/v8/tools/tracing/proto-converter/package.json b/deps/v8/tools/tracing/proto-converter/package.json
deleted file mode 100644
index 41401a11aad20a..00000000000000
--- a/deps/v8/tools/tracing/proto-converter/package.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "private": true,
-  "scripts": {
-    "build": "tsc proto-to-json.ts"
-  },
-  "devDependencies": {
-    "@types/node": "^11.11.4",
-    "protobufjs": "^6.8.8",
-    "typescript": "^3.3.4000"
-  }
-}
diff --git a/deps/v8/tools/tracing/proto-converter/proto-to-json.ts b/deps/v8/tools/tracing/proto-converter/proto-to-json.ts
deleted file mode 100644
index 385ff865eea311..00000000000000
--- a/deps/v8/tools/tracing/proto-converter/proto-to-json.ts
+++ /dev/null
@@ -1,129 +0,0 @@
-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-import * as fs from 'fs';
-import * as path from 'path';
-import { Root } from 'protobufjs';
-
-// Requirements: node 10.4.0+, npm
-
-// Setup:
-// (nvm is optional, you can also just install node manually)
-// $ nvm use
-// $ npm install
-// $ npm run build
-
-// Usage: node proto-to-json.js path_to_trace.proto input_file output_file
-
-// Converts a binary proto file to a 'Trace Event Format' compatible .json file
-// that can be used with chrome://tracing. Documentation of this format:
-// https://docs.google.com/document/d/1CvAClvFfyA5R-PhYUmn5OOQtYMH4h6I0nSsKchNAySU
-
-// Attempts to reproduce the logic of the JSONTraceWriter in V8 in terms of the
-// JSON fields it will include/exclude based on the data present in the trace
-// event.
-
-// Convert a string representing an int or uint (64 bit) to a Number or throw
-// if the value won't fit.
-function parseIntOrThrow(int: string) {
-  if (BigInt(int) > Number.MAX_SAFE_INTEGER) {
-    throw new Error("Loss of int precision");
-  }
-  return Number(int);
-}
-
-function uint64AsHexString(val : string) : string {
-  return "0x" + BigInt(val).toString(16);
-}
-
-function parseArgValue(arg: any) : any {
-  if (arg.jsonValue) {
-    return JSON.parse(arg.jsonValue);
-  }
-  if (typeof arg.stringValue !== 'undefined') {
-    return arg.stringValue;
-  }
-  if (typeof arg.uintValue !== 'undefined') {
-    return parseIntOrThrow(arg.uintValue);
-  }
-  if (typeof arg.intValue !== 'undefined') {
-    return parseIntOrThrow(arg.intValue);
-  }
-  if (typeof arg.boolValue !== 'undefined') {
-    return arg.boolValue;
-  }
-  if (typeof arg.doubleValue !== 'undefined') {
-    // Handle [-]Infinity and NaN which protobufjs outputs as strings here.
-    return typeof arg.doubleValue === 'string' ?
-        arg.doubleValue : Number(arg.doubleValue);
-  }
-  if (typeof arg.pointerValue !== 'undefined') {
-    return uint64AsHexString(arg.pointerValue);
-  }
-}
-
-// These come from
-// https://cs.chromium.org/chromium/src/base/trace_event/common/trace_event_common.h
-const TRACE_EVENT_FLAG_HAS_ID: number = 1 << 1;
-const TRACE_EVENT_FLAG_FLOW_IN: number = 1 << 8;
-const TRACE_EVENT_FLAG_FLOW_OUT: number = 1 << 9;
-
-async function main() {
-  const root = new Root();
-  const { resolvePath } = root;
-  const numDirectoriesToStrip = 2;
-  let initialOrigin: string|null;
-  root.resolvePath = (origin, target) => {
-    if (!origin) {
-      initialOrigin = target;
-      for (let i = 0; i <= numDirectoriesToStrip; i++) {
-        initialOrigin = path.dirname(initialOrigin);
-      }
-      return resolvePath(origin, target);
-    }
-    return path.resolve(initialOrigin!, target);
-  };
-  const traceProto = await root.load(process.argv[2]);
-  const Trace = traceProto.lookupType("Trace");
-  const payload = await fs.promises.readFile(process.argv[3]);
-  const msg = Trace.decode(payload).toJSON();
-  const output = {
-    traceEvents: msg.packet
-      .filter((packet: any) => !!packet.chromeEvents)
-      .map((packet: any) => packet.chromeEvents.traceEvents)
-      .map((traceEvents: any) => traceEvents.map((e: any) => {
-
-        const bind_id = (e.flags & (TRACE_EVENT_FLAG_FLOW_IN |
-          TRACE_EVENT_FLAG_FLOW_OUT)) ? e.bindId : undefined;
-        const scope = (e.flags & TRACE_EVENT_FLAG_HAS_ID) && e.scope ?
-            e.scope : undefined;
-
-        return {
-          pid: e.processId,
-          tid: e.threadId,
-          ts: parseIntOrThrow(e.timestamp),
-          tts: parseIntOrThrow(e.threadTimestamp),
-          ph: String.fromCodePoint(e.phase),
-          cat: e.categoryGroupName,
-          name: e.name,
-          dur: parseIntOrThrow(e.duration),
-          tdur: parseIntOrThrow(e.threadDuration),
-          bind_id: bind_id,
-          flow_in: e.flags & TRACE_EVENT_FLAG_FLOW_IN ? true : undefined,
-          flow_out: e.flags & TRACE_EVENT_FLAG_FLOW_OUT ? true : undefined,
-          scope: scope,
-          id: (e.flags & TRACE_EVENT_FLAG_HAS_ID) ?
-              uint64AsHexString(e.id) : undefined,
-          args: (e.args || []).reduce((js_args: any, proto_arg: any) => {
-            js_args[proto_arg.name] = parseArgValue(proto_arg);
-            return js_args;
-          }, {})
-        };
-      }))
-      .flat()
-  };
-  await fs.promises.writeFile(process.argv[4], JSON.stringify(output, null, 2));
-}
-
-main().catch(console.error);
diff --git a/deps/v8/tools/tracing/proto-converter/tsconfig.json b/deps/v8/tools/tracing/proto-converter/tsconfig.json
deleted file mode 100644
index defc4ef82ab6ae..00000000000000
--- a/deps/v8/tools/tracing/proto-converter/tsconfig.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2018",
-    "module": "commonjs",
-    "lib": ["es6","dom"],
-    "outDir": "lib",
-    "rootDir": "src",
-    "strict": true,
-    "esModuleInterop": true,
-    "resolveJsonModule": true
-  }
-}
diff --git a/deps/v8/tools/wasm/mjsunit-module-disassembler-impl.h b/deps/v8/tools/wasm/mjsunit-module-disassembler-impl.h
index e2bac0b48797a2..57343108c3a0a4 100644
--- a/deps/v8/tools/wasm/mjsunit-module-disassembler-impl.h
+++ b/deps/v8/tools/wasm/mjsunit-module-disassembler-impl.h
@@ -842,9 +842,11 @@ class MjsunitImmediatesPrinter {
 
   void ValueType(ValueType type) {
     if (owner_->current_opcode_ == kExprBrOnCast ||
-        owner_->current_opcode_ == kExprBrOnCastFail) {
+        owner_->current_opcode_ == kExprBrOnCastFail ||
+        owner_->current_opcode_ == kExprBrOnCastDesc ||
+        owner_->current_opcode_ == kExprBrOnCastDescFail) {
       // We somewhat incorrectly use the {ValueType} callback rather than
-      // {HeapType()} for br_on_cast[_fail], because that's convenient
+      // {HeapType()} for br_on_cast[_desc][_fail], because that's convenient
       // for disassembling to the text format. For module builder output,
       // fix that hack here, by dispatching back to {HeapType()}.
       return HeapType(type.heap_type());
@@ -913,6 +915,36 @@ class MjsunitImmediatesPrinter {
     owner_->indentation_.decrease();
   }
 
+  void EffectHandlerTable(EffectHandlerTableImmediate& imm) {
+    const uint8_t* pc = imm.table;
+    owner_->indentation_.increase();
+    owner_->indentation_.increase();
+
+    for (uint32_t i = 0; i < imm.table_count; i++) {
+      out_ << "\n" << owner_->indentation_;
+
+      uint8_t kind = owner_->read_u8<ValidationTag>(pc);
+      pc += 1;
+      if (kind == kOnSuspend) {
+        out_ << "kOnSuspend, ";
+        auto [tag, taglength] = owner_->read_u32v<ValidationTag>(pc);
+        pc += taglength;
+        names()->PrintTagReferenceLeb(out_, tag);
+        out_ << ", ";
+        auto [target, label_length] = owner_->read_u32v<ValidationTag>(pc);
+        pc += label_length;
+        out_ << target << ",";
+      } else {
+        out_ << "kOnSwitch, ";
+        auto [tag, length] = owner_->read_u32v<ValidationTag>(pc);
+        names()->PrintTagReferenceLeb(out_, tag);
+        out_ << ", ";
+      }
+    }
+    owner_->indentation_.decrease();
+    owner_->indentation_.decrease();
+  }
+
   void CallIndirect(CallIndirectImmediate& imm) {
     PrintSignature(imm.sig_imm.index);
     TableIndex(imm.table_imm);
diff --git a/deps/v8/tools/wasm/module-inspector.cc b/deps/v8/tools/wasm/module-inspector.cc
index f4c01982aadac7..70c8bcce50c4ee 100644
--- a/deps/v8/tools/wasm/module-inspector.cc
+++ b/deps/v8/tools/wasm/module-inspector.cc
@@ -254,7 +254,8 @@ class ExtendedFunctionDis : public FunctionBodyDisassembler {
       auto [count, count_length] = read_u32v<ValidationTag>(pc_);
       auto [type, type_length] =
           value_type_reader::read_value_type<ValidationTag>(
-              this, pc_ + count_length, WasmEnabledFeatures::All());
+              this, pc_ + count_length, WasmEnabledFeatures::All(),
+              this->detected_);
       value_type_reader::Populate(&type, module_);
       PrintHexBytes(out, count_length + type_length, pc_, 4);
       out << " // " << count << (count != 1 ? " locals" : " local")
diff --git a/doc/abi_version_registry.json b/doc/abi_version_registry.json
index 5fabd9f9270464..ecd7fff2fe23fa 100644
--- a/doc/abi_version_registry.json
+++ b/doc/abi_version_registry.json
@@ -1,5 +1,6 @@
 {
   "NODE_MODULE_VERSION": [
+    { "modules": 138,"runtime": "node",     "variant": "v8_13.7",              "versions": "25.0.0-pre" },
     { "modules": 137,"runtime": "node",     "variant": "v8_13.6",              "versions": "24.0.0" },
     { "modules": 136,"runtime": "electron", "variant": "electron",             "versions": "37" },
     { "modules": 135,"runtime": "electron", "variant": "electron",             "versions": "36" },
diff --git a/src/node_version.h b/src/node_version.h
index d4bb4e1fc7ea30..4ac5b128879860 100644
--- a/src/node_version.h
+++ b/src/node_version.h
@@ -95,7 +95,7 @@
 #if defined(NODE_EMBEDDER_MODULE_VERSION)
 #define NODE_MODULE_VERSION NODE_EMBEDDER_MODULE_VERSION
 #else
-#define NODE_MODULE_VERSION 137
+#define NODE_MODULE_VERSION 138
 #endif
 
 // The NAPI_VERSION supported by the runtime. This is the inclusive range of
diff --git a/tools/v8_gypfiles/features.gypi b/tools/v8_gypfiles/features.gypi
index 0214bec80dd4d1..384d7453ec8434 100644
--- a/tools/v8_gypfiles/features.gypi
+++ b/tools/v8_gypfiles/features.gypi
@@ -209,12 +209,6 @@
     # Enable map packing & unpacking (sets -dV8_MAP_PACKING).
     'v8_enable_map_packing%': 0,
 
-    # Scan the call stack conservatively during garbage collection.
-    'v8_enable_conservative_stack_scanning%': 0,
-
-    # Use direct pointers in local handles.
-    'v8_enable_direct_local%': 0,
-
     # Controls the threshold for on-heap/off-heap Typed Arrays.
     'v8_typed_array_max_size_in_heap%': 64,
 
@@ -462,12 +456,6 @@
       ['tsan==1', {
         'defines': ['V8_IS_TSAN',],
       }],
-      ['v8_enable_conservative_stack_scanning==1', {
-        'defines': ['V8_ENABLE_CONSERVATIVE_STACK_SCANNING',],
-      }],
-      ['v8_enable_direct_local==1', {
-        'defines': ['V8_ENABLE_DIRECT_LOCAL',],
-      }],
       ['v8_enable_regexp_interpreter_threaded_dispatch==1', {
         'defines': ['V8_ENABLE_REGEXP_INTERPRETER_THREADED_DISPATCH',],
       }],
diff --git a/tools/v8_gypfiles/v8.gyp b/tools/v8_gypfiles/v8.gyp
index 8e3f015dff14e1..8260aff4da4310 100644
--- a/tools/v8_gypfiles/v8.gyp
+++ b/tools/v8_gypfiles/v8.gyp
@@ -496,6 +496,7 @@
             'v8_initializers',
             'v8_libplatform',
             'abseil.gyp:abseil',
+            'fp16',
           ]
         }, {
           'dependencies': [
@@ -509,6 +510,7 @@
             'v8_initializers',
             'v8_libplatform',
             'abseil.gyp:abseil',
+            'fp16',
           ]
         }],
         ['OS=="win" and clang==1', {
@@ -532,9 +534,6 @@
             },
           ],
         }],
-        ['OS in "aix os400"', {
-          'dependencies': ['fp16'],
-        }],
       ],
     },  # v8_snapshot
     {