BASELINE: Update Chromium to 85.0.4183.14085-based

Change-Id: Iaa42f4680837c57725b1344f108c0196741f6057
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

1 files changed, 35 insertions, 0 deletions

diff --git a/chromium/v8/src/builtins/internal.tq b/chromium/v8/src/builtins/internal.tq
new file mode 100644
index 00000000000..9e7e4240ba2
--- /dev/null
+++ b/chromium/v8/src/builtins/internal.tq
@@ -0,0 +1,35 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+namespace internal {
+
+namespace runtime {
+extern runtime GetTemplateObject(implicit context: Context)(
+    TemplateObjectDescription, SharedFunctionInfo, Smi): JSAny;
+}
+
+builtin GetTemplateObject(
+    context: Context, shared: SharedFunctionInfo,
+    description: TemplateObjectDescription, slot: uintptr,
+    maybeFeedbackVector: FeedbackVector|Undefined): JSArray {
+  // TODO(jgruber): Consider merging with the GetTemplateObject bytecode
+  // handler; the current advantage of the split implementation is that the
+  // bytecode can skip most work if feedback exists.
+
+  try {
+    const vector =
+        Cast<FeedbackVector>(maybeFeedbackVector) otherwise CallRuntime;
+    return Cast<JSArray>(ic::LoadFeedbackVectorSlot(vector, slot))
+        otherwise CallRuntime;
+  } label CallRuntime deferred {
+    const result = UnsafeCast<JSArray>(runtime::GetTemplateObject(
+        description, shared, Convert<Smi>(Signed(slot))));
+    const vector =
+        Cast<FeedbackVector>(maybeFeedbackVector) otherwise return result;
+    ic::StoreFeedbackVectorSlot(vector, slot, result);
+    return result;
+  }
+}
+
+}  // namespace internal