BASELINE: Update Chromium to 100.0.4896.167

Change-Id: I98cbeb5d7543d966ffe04d8cefded0c493a11333
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

18 files changed, 121 insertions, 93 deletions

diff --git a/chromium/v8/src/interpreter/bytecode-array-builder.cc b/chromium/v8/src/interpreter/bytecode-array-builder.cc
index b71c8db77d1..eb2c4267358 100644
--- a/chromium/v8/src/interpreter/bytecode-array-builder.cc
+++ b/chromium/v8/src/interpreter/bytecode-array-builder.cc
@@ -69,11 +69,11 @@ Register BytecodeArrayBuilder::Parameter(int parameter_index) const {
   DCHECK_GE(parameter_index, 0);
   // The parameter indices are shifted by 1 (receiver is the
   // first entry).
-  return Register::FromParameterIndex(parameter_index + 1, parameter_count());
+  return Register::FromParameterIndex(parameter_index + 1);
 }
 
 Register BytecodeArrayBuilder::Receiver() const {
-  return Register::FromParameterIndex(0, parameter_count());
+  return Register::FromParameterIndex(0);
 }
 
 Register BytecodeArrayBuilder::Local(int index) const {
@@ -1576,7 +1576,7 @@ bool BytecodeArrayBuilder::RegisterIsValid(Register reg) const {
   if (reg.is_current_context() || reg.is_function_closure()) {
     return true;
   } else if (reg.is_parameter()) {
-    int parameter_index = reg.ToParameterIndex(parameter_count());
+    int parameter_index = reg.ToParameterIndex();
     return parameter_index >= 0 && parameter_index < parameter_count();
   } else if (reg.index() < fixed_register_count()) {
     return true;
diff --git a/chromium/v8/src/interpreter/bytecode-array-iterator.cc b/chromium/v8/src/interpreter/bytecode-array-iterator.cc
index ad8451d00d0..e6ae8b11eec 100644
--- a/chromium/v8/src/interpreter/bytecode-array-iterator.cc
+++ b/chromium/v8/src/interpreter/bytecode-array-iterator.cc
@@ -130,15 +130,14 @@ FeedbackSlot BytecodeArrayIterator::GetSlotOperand(int operand_index) const {
 }
 
 Register BytecodeArrayIterator::GetReceiver() const {
-  return Register::FromParameterIndex(0, bytecode_array()->parameter_count());
+  return Register::FromParameterIndex(0);
 }
 
 Register BytecodeArrayIterator::GetParameter(int parameter_index) const {
   DCHECK_GE(parameter_index, 0);
   // The parameter indices are shifted by 1 (receiver is the
   // first entry).
-  return Register::FromParameterIndex(parameter_index + 1,
-                                      bytecode_array()->parameter_count());
+  return Register::FromParameterIndex(parameter_index + 1);
 }
 
 Register BytecodeArrayIterator::GetRegisterOperand(int operand_index) const {
@@ -275,8 +274,7 @@ int BytecodeArrayIterator::GetAbsoluteOffset(int relative_offset) const {
 }
 
 std::ostream& BytecodeArrayIterator::PrintTo(std::ostream& os) const {
-  return BytecodeDecoder::Decode(os, cursor_ - prefix_size_,
-                                 bytecode_array()->parameter_count());
+  return BytecodeDecoder::Decode(os, cursor_ - prefix_size_);
 }
 
 void BytecodeArrayIterator::UpdatePointers() {
diff --git a/chromium/v8/src/interpreter/bytecode-array-random-iterator.cc b/chromium/v8/src/interpreter/bytecode-array-random-iterator.cc
index c73a0d2e9e6..5343edcc73e 100644
--- a/chromium/v8/src/interpreter/bytecode-array-random-iterator.cc
+++ b/chromium/v8/src/interpreter/bytecode-array-random-iterator.cc
@@ -20,7 +20,7 @@ BytecodeArrayRandomIterator::BytecodeArrayRandomIterator(
 void BytecodeArrayRandomIterator::Initialize() {
   // Run forwards through the bytecode array to determine the offset of each
   // bytecode.
-  while (current_offset() < bytecode_array()->length()) {
+  while (!done()) {
     offsets_.push_back(current_offset());
     Advance();
   }
diff --git a/chromium/v8/src/interpreter/bytecode-array-random-iterator.h b/chromium/v8/src/interpreter/bytecode-array-random-iterator.h
index 6f0ca2cfdd9..ce3014e6b67 100644
--- a/chromium/v8/src/interpreter/bytecode-array-random-iterator.h
+++ b/chromium/v8/src/interpreter/bytecode-array-random-iterator.h
@@ -49,7 +49,7 @@ class V8_EXPORT_PRIVATE BytecodeArrayRandomIterator final
 
   int current_index() const { return current_index_; }
 
-  size_t size() const { return offsets_.size(); }
+  int size() const { return static_cast<int>(offsets_.size()); }
 
   void GoToIndex(int index) {
     current_index_ = index;
@@ -60,8 +60,7 @@ class V8_EXPORT_PRIVATE BytecodeArrayRandomIterator final
     UpdateOffsetFromIndex();
   }
   void GoToEnd() {
-    DCHECK_LT(offsets_.size() - 1, static_cast<size_t>(INT_MAX));
-    current_index_ = static_cast<int>(offsets_.size() - 1);
+    current_index_ = size() - 1;
     UpdateOffsetFromIndex();
   }
 
diff --git a/chromium/v8/src/interpreter/bytecode-array-writer.cc b/chromium/v8/src/interpreter/bytecode-array-writer.cc
index b7da1272535..784514e3db3 100644
--- a/chromium/v8/src/interpreter/bytecode-array-writer.cc
+++ b/chromium/v8/src/interpreter/bytecode-array-writer.cc
@@ -238,6 +238,7 @@ void BytecodeArrayWriter::UpdateExitSeenInBlock(Bytecode bytecode) {
     case Bytecode::kReThrow:
     case Bytecode::kAbort:
     case Bytecode::kJump:
+    case Bytecode::kJumpLoop:
     case Bytecode::kJumpConstant:
     case Bytecode::kSuspendGenerator:
       exit_seen_in_block_ = true;
diff --git a/chromium/v8/src/interpreter/bytecode-decoder.cc b/chromium/v8/src/interpreter/bytecode-decoder.cc
index 1811e7874d0..f2959b83265 100644
--- a/chromium/v8/src/interpreter/bytecode-decoder.cc
+++ b/chromium/v8/src/interpreter/bytecode-decoder.cc
@@ -93,8 +93,7 @@ const char* NameForNativeContextIndex(uint32_t idx) {
 
 // static
 std::ostream& BytecodeDecoder::Decode(std::ostream& os,
-                                      const uint8_t* bytecode_start,
-                                      int parameter_count) {
+                                      const uint8_t* bytecode_start) {
   Bytecode bytecode = Bytecodes::FromByte(bytecode_start[0]);
   int prefix_offset = 0;
   OperandScale operand_scale = OperandScale::kSingle;
@@ -169,22 +168,22 @@ std::ostream& BytecodeDecoder::Decode(std::ostream& os,
       case interpreter::OperandType::kRegOut: {
         Register reg =
             DecodeRegisterOperand(operand_start, op_type, operand_scale);
-        os << reg.ToString(parameter_count);
+        os << reg.ToString();
         break;
       }
       case interpreter::OperandType::kRegOutTriple: {
         RegisterList reg_list =
             DecodeRegisterListOperand(operand_start, 3, op_type, operand_scale);
-        os << reg_list.first_register().ToString(parameter_count) << "-"
-           << reg_list.last_register().ToString(parameter_count);
+        os << reg_list.first_register().ToString() << "-"
+           << reg_list.last_register().ToString();
         break;
       }
       case interpreter::OperandType::kRegOutPair:
       case interpreter::OperandType::kRegPair: {
         RegisterList reg_list =
             DecodeRegisterListOperand(operand_start, 2, op_type, operand_scale);
-        os << reg_list.first_register().ToString(parameter_count) << "-"
-           << reg_list.last_register().ToString(parameter_count);
+        os << reg_list.first_register().ToString() << "-"
+           << reg_list.last_register().ToString();
         break;
       }
       case interpreter::OperandType::kRegOutList:
@@ -200,8 +199,8 @@ std::ostream& BytecodeDecoder::Decode(std::ostream& os,
             reg_count_operand, OperandType::kRegCount, operand_scale);
         RegisterList reg_list = DecodeRegisterListOperand(
             operand_start, count, op_type, operand_scale);
-        os << reg_list.first_register().ToString(parameter_count) << "-"
-           << reg_list.last_register().ToString(parameter_count);
+        os << reg_list.first_register().ToString() << "-"
+           << reg_list.last_register().ToString();
         i++;  // Skip kRegCount.
         break;
       }
diff --git a/chromium/v8/src/interpreter/bytecode-decoder.h b/chromium/v8/src/interpreter/bytecode-decoder.h
index 5be682b1f59..1bf93e092c7 100644
--- a/chromium/v8/src/interpreter/bytecode-decoder.h
+++ b/chromium/v8/src/interpreter/bytecode-decoder.h
@@ -39,8 +39,7 @@ class V8_EXPORT_PRIVATE BytecodeDecoder final {
                                         OperandScale operand_scale);
 
   // Decode a single bytecode and operands to |os|.
-  static std::ostream& Decode(std::ostream& os, const uint8_t* bytecode_start,
-                              int number_of_parameters);
+  static std::ostream& Decode(std::ostream& os, const uint8_t* bytecode_start);
 };
 
 }  // namespace interpreter
diff --git a/chromium/v8/src/interpreter/bytecode-generator.cc b/chromium/v8/src/interpreter/bytecode-generator.cc
index 4acf248c4da..d3859d93666 100644
--- a/chromium/v8/src/interpreter/bytecode-generator.cc
+++ b/chromium/v8/src/interpreter/bytecode-generator.cc
@@ -1451,7 +1451,9 @@ void BytecodeGenerator::GenerateBytecodeBody() {
   // The derived constructor case is handled in VisitCallSuper.
   if (IsBaseConstructor(function_kind())) {
     if (literal->class_scope_has_private_brand()) {
-      BuildPrivateBrandInitialization(builder()->Receiver());
+      ClassScope* scope = info()->scope()->outer_scope()->AsClassScope();
+      DCHECK_NOT_NULL(scope->brand());
+      BuildPrivateBrandInitialization(builder()->Receiver(), scope->brand());
     }
 
     if (literal->requires_instance_members_initializer()) {
@@ -2892,18 +2894,33 @@ void BytecodeGenerator::BuildInvalidPropertyAccess(MessageTemplate tmpl,
       .Throw();
 }
 
-void BytecodeGenerator::BuildPrivateBrandInitialization(Register receiver) {
-  Variable* brand = info()->scope()->outer_scope()->AsClassScope()->brand();
+void BytecodeGenerator::BuildPrivateBrandInitialization(Register receiver,
+                                                        Variable* brand) {
+  BuildVariableLoad(brand, HoleCheckMode::kElided);
   int depth = execution_context()->ContextChainDepth(brand->scope());
   ContextScope* class_context = execution_context()->Previous(depth);
-
-  BuildVariableLoad(brand, HoleCheckMode::kElided);
-  Register brand_reg = register_allocator()->NewRegister();
-  FeedbackSlot slot = feedback_spec()->AddKeyedDefineOwnICSlot();
-  builder()
-      ->StoreAccumulatorInRegister(brand_reg)
-      .LoadAccumulatorWithRegister(class_context->reg())
-      .DefineKeyedProperty(receiver, brand_reg, feedback_index(slot));
+  if (class_context) {
+    Register brand_reg = register_allocator()->NewRegister();
+    FeedbackSlot slot = feedback_spec()->AddKeyedDefineOwnICSlot();
+    builder()
+        ->StoreAccumulatorInRegister(brand_reg)
+        .LoadAccumulatorWithRegister(class_context->reg())
+        .DefineKeyedProperty(receiver, brand_reg, feedback_index(slot));
+  } else {
+    // We are in the slow case where super() is called from a nested
+    // arrow function or a eval(), so the class scope context isn't
+    // tracked in a context register in the stack, and we have to
+    // walk the context chain from the runtime to find it.
+    DCHECK_NE(info()->literal()->scope()->outer_scope(), brand->scope());
+    RegisterList brand_args = register_allocator()->NewRegisterList(4);
+    builder()
+        ->StoreAccumulatorInRegister(brand_args[1])
+        .MoveRegister(receiver, brand_args[0])
+        .MoveRegister(execution_context()->reg(), brand_args[2])
+        .LoadLiteral(Smi::FromInt(depth))
+        .StoreAccumulatorInRegister(brand_args[3])
+        .CallRuntime(Runtime::kAddPrivateBrand, brand_args);
+  }
 }
 
 void BytecodeGenerator::BuildInstanceMemberInitialization(Register constructor,
@@ -3627,12 +3644,10 @@ void BytecodeGenerator::BuildAsyncReturn(int source_position) {
   } else {
     DCHECK(IsAsyncFunction(info()->literal()->kind()) ||
            IsAsyncModule(info()->literal()->kind()));
-    RegisterList args = register_allocator()->NewRegisterList(3);
+    RegisterList args = register_allocator()->NewRegisterList(2);
     builder()
         ->MoveRegister(generator_object(), args[0])  // generator
         .StoreAccumulatorInRegister(args[1])         // value
-        .LoadBoolean(info()->literal()->CanSuspend())
-        .StoreAccumulatorInRegister(args[2])  // can_suspend
         .CallRuntime(Runtime::kInlineAsyncFunctionResolve, args);
   }
 
@@ -4171,17 +4186,19 @@ void BytecodeGenerator::BuildDestructuringArrayAssignment(
               ->LoadNamedProperty(next_result,
                                   ast_string_constants()->done_string(),
                                   feedback_index(next_done_load_slot))
-              .JumpIfTrue(ToBooleanMode::kConvertToBoolean, is_done.New())
-              .LoadNamedProperty(next_result,
-                                 ast_string_constants()->value_string(),
-                                 feedback_index(next_value_load_slot))
-              .StoreAccumulatorInRegister(next_result)
-              .LoadFalse()
-              .StoreAccumulatorInRegister(done)
-              .LoadAccumulatorWithRegister(next_result);
+              .JumpIfTrue(ToBooleanMode::kConvertToBoolean, is_done.New());
 
           // Only do the assignment if this is not a hole (i.e. 'elided').
           if (!target->IsTheHoleLiteral()) {
+            builder()
+                ->LoadNamedProperty(next_result,
+                                    ast_string_constants()->value_string(),
+                                    feedback_index(next_value_load_slot))
+                .StoreAccumulatorInRegister(next_result)
+                .LoadFalse()
+                .StoreAccumulatorInRegister(done)
+                .LoadAccumulatorWithRegister(next_result);
+
             // [<pattern> = <init>] = <value>
             //   becomes (roughly)
             // temp = <value>.next();
@@ -4202,6 +4219,7 @@ void BytecodeGenerator::BuildDestructuringArrayAssignment(
 
             BuildAssignment(lhs_data, op, lookup_hoisting_mode);
           } else {
+            builder()->LoadFalse().StoreAccumulatorInRegister(done);
             DCHECK_EQ(lhs_data.assign_type(), NON_PROPERTY);
             is_done.Bind(builder());
           }
@@ -5217,6 +5235,7 @@ void BytecodeGenerator::BuildPrivateBrandCheck(Property* property,
       builder()->CompareReference(object).JumpIfTrue(
           ToBooleanMode::kAlreadyBoolean, &return_check);
       const AstRawString* name = scope->class_variable()->raw_name();
+      RegisterAllocationScope register_scope(this);
       RegisterList args = register_allocator()->NewRegisterList(2);
       builder()
           ->LoadLiteral(
@@ -5634,8 +5653,25 @@ void BytecodeGenerator::VisitCallSuper(Call* expr) {
   Register instance = register_allocator()->NewRegister();
   builder()->StoreAccumulatorInRegister(instance);
 
-  if (info()->literal()->class_scope_has_private_brand()) {
-    BuildPrivateBrandInitialization(instance);
+  // The constructor scope always needs ScopeInfo, so we are certain that
+  // the first constructor scope found in the outer scope chain is the
+  // scope that we are looking for for this super() call.
+  // Note that this doesn't necessarily mean that the constructor needs
+  // a context, if it doesn't this would get handled specially in
+  // BuildPrivateBrandInitialization().
+  DeclarationScope* constructor_scope = info()->scope()->GetConstructorScope();
+
+  // We can rely on the class_scope_has_private_brand bit to tell if the
+  // constructor needs private brand initialization, and if that's
+  // the case we are certain that its outer class scope requires a context to
+  // keep the brand variable, so we can just get the brand variable
+  // from the outer scope.
+  if (constructor_scope->class_scope_has_private_brand()) {
+    DCHECK(constructor_scope->outer_scope()->is_class_scope());
+    ClassScope* class_scope = constructor_scope->outer_scope()->AsClassScope();
+    DCHECK_NOT_NULL(class_scope->brand());
+    Variable* brand = class_scope->brand();
+    BuildPrivateBrandInitialization(instance, brand);
   }
 
   // The derived constructor has the correct bit set always, so we
diff --git a/chromium/v8/src/interpreter/bytecode-generator.h b/chromium/v8/src/interpreter/bytecode-generator.h
index 1c11cbbb508..10dfd57c39d 100644
--- a/chromium/v8/src/interpreter/bytecode-generator.h
+++ b/chromium/v8/src/interpreter/bytecode-generator.h
@@ -333,7 +333,7 @@ class BytecodeGenerator final : public AstVisitor<BytecodeGenerator> {
   void VisitClassLiteral(ClassLiteral* expr, Register name);
   void VisitNewTargetVariable(Variable* variable);
   void VisitThisFunctionVariable(Variable* variable);
-  void BuildPrivateBrandInitialization(Register receiver);
+  void BuildPrivateBrandInitialization(Register receiver, Variable* brand);
   void BuildInstanceMemberInitialization(Register constructor,
                                          Register instance);
   void BuildGeneratorObjectVariableInitialization();
diff --git a/chromium/v8/src/interpreter/bytecode-register-optimizer.cc b/chromium/v8/src/interpreter/bytecode-register-optimizer.cc
index 3d9c9e1dac7..f8761081d5f 100644
--- a/chromium/v8/src/interpreter/bytecode-register-optimizer.cc
+++ b/chromium/v8/src/interpreter/bytecode-register-optimizer.cc
@@ -235,7 +235,7 @@ BytecodeRegisterOptimizer::BytecodeRegisterOptimizer(
   DCHECK_NE(parameter_count, 0);
   int first_slot_index = parameter_count - 1;
   register_info_table_offset_ =
-      -Register::FromParameterIndex(first_slot_index, parameter_count).index();
+      -Register::FromParameterIndex(first_slot_index).index();
 
   // Initialize register map for parameters, locals, and the
   // accumulator.
diff --git a/chromium/v8/src/interpreter/bytecode-register.cc b/chromium/v8/src/interpreter/bytecode-register.cc
index 5266f693d21..cb8fc81b701 100644
--- a/chromium/v8/src/interpreter/bytecode-register.cc
+++ b/chromium/v8/src/interpreter/bytecode-register.cc
@@ -37,15 +37,14 @@ static const int kArgumentCountRegisterIndex =
      InterpreterFrameConstants::kArgCOffset) /
     kSystemPointerSize;
 
-Register Register::FromParameterIndex(int index, int parameter_count) {
+Register Register::FromParameterIndex(int index) {
   DCHECK_GE(index, 0);
-  DCHECK_LT(index, parameter_count);
   int register_index = kFirstParamRegisterIndex - index;
   DCHECK_LT(register_index, 0);
   return Register(register_index);
 }
 
-int Register::ToParameterIndex(int parameter_count) const {
+int Register::ToParameterIndex() const {
   DCHECK(is_parameter());
   return kFirstParamRegisterIndex - index();
 }
@@ -120,13 +119,13 @@ bool Register::AreContiguous(Register reg1, Register reg2, Register reg3,
   return true;
 }
 
-std::string Register::ToString(int parameter_count) const {
+std::string Register::ToString() const {
   if (is_current_context()) {
     return std::string("<context>");
   } else if (is_function_closure()) {
     return std::string("<closure>");
   } else if (is_parameter()) {
-    int parameter_index = ToParameterIndex(parameter_count);
+    int parameter_index = ToParameterIndex();
     if (parameter_index == 0) {
       return std::string("<this>");
     } else {
diff --git a/chromium/v8/src/interpreter/bytecode-register.h b/chromium/v8/src/interpreter/bytecode-register.h
index 270b3a4a3db..7fd47b681c2 100644
--- a/chromium/v8/src/interpreter/bytecode-register.h
+++ b/chromium/v8/src/interpreter/bytecode-register.h
@@ -26,8 +26,8 @@ class V8_EXPORT_PRIVATE Register final {
   bool is_parameter() const { return index() < 0; }
   bool is_valid() const { return index_ != kInvalidIndex; }
 
-  static Register FromParameterIndex(int index, int parameter_count);
-  int ToParameterIndex(int parameter_count) const;
+  static Register FromParameterIndex(int index);
+  int ToParameterIndex() const;
 
   // Returns an invalid register.
   static Register invalid_value() { return Register(); }
@@ -65,7 +65,7 @@ class V8_EXPORT_PRIVATE Register final {
     return Register(kRegisterFileStartOffset - operand);
   }
 
-  static Register FromShortStar(Bytecode bytecode) {
+  static constexpr Register FromShortStar(Bytecode bytecode) {
     DCHECK(Bytecodes::IsShortStar(bytecode));
     return Register(static_cast<int>(Bytecode::kStar0) -
                     static_cast<int>(bytecode));
@@ -87,7 +87,7 @@ class V8_EXPORT_PRIVATE Register final {
                             Register reg4 = invalid_value(),
                             Register reg5 = invalid_value());
 
-  std::string ToString(int parameter_count) const;
+  std::string ToString() const;
 
   bool operator==(const Register& other) const {
     return index() == other.index();
diff --git a/chromium/v8/src/interpreter/bytecodes.h b/chromium/v8/src/interpreter/bytecodes.h
index f01f4f412ca..a40ddc5a84f 100644
--- a/chromium/v8/src/interpreter/bytecodes.h
+++ b/chromium/v8/src/interpreter/bytecodes.h
@@ -8,7 +8,6 @@
 #include <cstdint>
 #include <iosfwd>
 #include <string>
-#include <vector>
 
 #include "src/common/globals.h"
 #include "src/interpreter/bytecode-operands.h"
@@ -538,6 +537,10 @@ namespace interpreter {
   V(Return)                     \
   V(SuspendGenerator)
 
+#define UNCONDITIONAL_THROW_BYTECODE_LIST(V) \
+  V(Throw)                                   \
+  V(ReThrow)
+
 // Enumeration of interpreter bytecodes.
 enum class Bytecode : uint8_t {
 #define DECLARE_BYTECODE(Name, ...) k##Name,
@@ -802,6 +805,13 @@ class V8_EXPORT_PRIVATE Bytecodes final : public AllStatic {
 #undef OR_BYTECODE
   }
 
+  // Returns true if the bytecode unconditionally throws.
+  static constexpr bool UnconditionallyThrows(Bytecode bytecode) {
+#define OR_BYTECODE(NAME) || bytecode == Bytecode::k##NAME
+    return false UNCONDITIONAL_THROW_BYTECODE_LIST(OR_BYTECODE);
+#undef OR_BYTECODE
+  }
+
   // Returns the number of operands expected by |bytecode|.
   static int NumberOfOperands(Bytecode bytecode) {
     DCHECK_LE(bytecode, Bytecode::kLast);
diff --git a/chromium/v8/src/interpreter/interpreter-assembler.cc b/chromium/v8/src/interpreter/interpreter-assembler.cc
index fe635115f62..30a67ec3d30 100644
--- a/chromium/v8/src/interpreter/interpreter-assembler.cc
+++ b/chromium/v8/src/interpreter/interpreter-assembler.cc
@@ -713,20 +713,14 @@ void InterpreterAssembler::CallJSAndDispatch(
   DCHECK_EQ(Bytecodes::GetReceiverMode(bytecode_), receiver_mode);
 
   TNode<Word32T> args_count = args.reg_count();
-  const bool receiver_included =
-      receiver_mode != ConvertReceiverMode::kNullOrUndefined;
-  if (kJSArgcIncludesReceiver && !receiver_included) {
-    // Add receiver if we want to include it in argc and it isn't already.
+  if (receiver_mode == ConvertReceiverMode::kNullOrUndefined) {
+    // Add receiver. It is not included in args as it is implicit.
     args_count = Int32Add(args_count, Int32Constant(kJSArgcReceiverSlots));
-  } else if (!kJSArgcIncludesReceiver && receiver_included) {
-    // Subtract receiver if we don't want to include it, but it is included.
-    TNode<Int32T> receiver_count = Int32Constant(1);
-    args_count = Int32Sub(args_count, receiver_count);
   }
 
   Callable callable = CodeFactory::InterpreterPushArgsThenCall(
       isolate(), receiver_mode, InterpreterPushArgsMode::kOther);
-  TNode<Code> code_target = HeapConstant(callable.code());
+  TNode<CodeT> code_target = HeapConstant(callable.code());
 
   TailCallStubThenBytecodeDispatch(callable.descriptor(), code_target, context,
                                    args_count, args.base_reg_location(),
@@ -747,7 +741,7 @@ void InterpreterAssembler::CallJSAndDispatch(TNode<Object> function,
          bytecode_ == Bytecode::kInvokeIntrinsic);
   DCHECK_EQ(Bytecodes::GetReceiverMode(bytecode_), receiver_mode);
   Callable callable = CodeFactory::Call(isolate());
-  TNode<Code> code_target = HeapConstant(callable.code());
+  TNode<CodeT> code_target = HeapConstant(callable.code());
 
   arg_count = JSParameterCount(arg_count);
   if (receiver_mode == ConvertReceiverMode::kNullOrUndefined) {
@@ -792,13 +786,9 @@ void InterpreterAssembler::CallJSWithSpreadAndDispatch(
   Callable callable = CodeFactory::InterpreterPushArgsThenCall(
       isolate(), ConvertReceiverMode::kAny,
       InterpreterPushArgsMode::kWithFinalSpread);
-  TNode<Code> code_target = HeapConstant(callable.code());
+  TNode<CodeT> code_target = HeapConstant(callable.code());
 
   TNode<Word32T> args_count = args.reg_count();
-  if (!kJSArgcIncludesReceiver) {
-    TNode<Int32T> receiver_count = Int32Constant(1);
-    args_count = Int32Sub(args_count, receiver_count);
-  }
   TailCallStubThenBytecodeDispatch(callable.descriptor(), code_target, context,
                                    args_count, args.base_reg_location(),
                                    function);
@@ -981,7 +971,7 @@ TNode<T> InterpreterAssembler::CallRuntimeN(TNode<Uint32T> function_id,
   DCHECK(Bytecodes::MakesCallAlongCriticalPath(bytecode_));
   DCHECK(Bytecodes::IsCallRuntime(bytecode_));
   Callable callable = CodeFactory::InterpreterCEntry(isolate(), return_count);
-  TNode<Code> code_target = HeapConstant(callable.code());
+  TNode<CodeT> code_target = HeapConstant(callable.code());
 
   // Get the function entry from the function id.
   TNode<RawPtrT> function_table = ReinterpretCast<RawPtrT>(ExternalConstant(
@@ -1462,7 +1452,7 @@ TNode<FixedArray> InterpreterAssembler::ExportParametersAndRegisterFile(
     Label loop(this, &var_index), done_loop(this);
 
     TNode<IntPtrT> reg_base =
-        IntPtrConstant(Register::FromParameterIndex(0, 1).ToOperand() + 1);
+        IntPtrConstant(Register::FromParameterIndex(0).ToOperand() + 1);
 
     Goto(&loop);
     BIND(&loop);
diff --git a/chromium/v8/src/interpreter/interpreter-generator.h b/chromium/v8/src/interpreter/interpreter-generator.h
index 51d7acb785c..9d6a861d8c2 100644
--- a/chromium/v8/src/interpreter/interpreter-generator.h
+++ b/chromium/v8/src/interpreter/interpreter-generator.h
@@ -23,10 +23,6 @@ extern Handle<Code> GenerateBytecodeHandler(Isolate* isolate,
                                             Builtin builtin,
                                             const AssemblerOptions& options);
 
-extern Handle<Code> GenerateDeserializeLazyHandler(
-    Isolate* isolate, OperandScale operand_scale, Builtin builtin,
-    const AssemblerOptions& options);
-
 }  // namespace interpreter
 }  // namespace internal
 }  // namespace v8
diff --git a/chromium/v8/src/interpreter/interpreter-intrinsics.h b/chromium/v8/src/interpreter/interpreter-intrinsics.h
index 6b82d331549..77ef0c3ee42 100644
--- a/chromium/v8/src/interpreter/interpreter-intrinsics.h
+++ b/chromium/v8/src/interpreter/interpreter-intrinsics.h
@@ -17,8 +17,8 @@ namespace interpreter {
   V(AsyncFunctionAwaitCaught, async_function_await_caught, 2)       \
   V(AsyncFunctionAwaitUncaught, async_function_await_uncaught, 2)   \
   V(AsyncFunctionEnter, async_function_enter, 2)                    \
-  V(AsyncFunctionReject, async_function_reject, 3)                  \
-  V(AsyncFunctionResolve, async_function_resolve, 3)                \
+  V(AsyncFunctionReject, async_function_reject, 2)                  \
+  V(AsyncFunctionResolve, async_function_resolve, 2)                \
   V(AsyncGeneratorAwaitCaught, async_generator_await_caught, 2)     \
   V(AsyncGeneratorAwaitUncaught, async_generator_await_uncaught, 2) \
   V(AsyncGeneratorReject, async_generator_reject, 2)                \
diff --git a/chromium/v8/src/interpreter/interpreter.cc b/chromium/v8/src/interpreter/interpreter.cc
index 26fe890914c..b9ccae9a26e 100644
--- a/chromium/v8/src/interpreter/interpreter.cc
+++ b/chromium/v8/src/interpreter/interpreter.cc
@@ -115,14 +115,15 @@ Builtin BuiltinIndexFromBytecode(Bytecode bytecode,
 
 }  // namespace
 
-Code Interpreter::GetBytecodeHandler(Bytecode bytecode,
-                                     OperandScale operand_scale) {
+CodeT Interpreter::GetBytecodeHandler(Bytecode bytecode,
+                                      OperandScale operand_scale) {
   Builtin builtin = BuiltinIndexFromBytecode(bytecode, operand_scale);
   return isolate_->builtins()->code(builtin);
 }
 
 void Interpreter::SetBytecodeHandler(Bytecode bytecode,
-                                     OperandScale operand_scale, Code handler) {
+                                     OperandScale operand_scale,
+                                     CodeT handler) {
   DCHECK(handler.is_off_heap_trampoline());
   DCHECK(handler.kind() == CodeKind::BYTECODE_HANDLER);
   size_t index = GetDispatchTableIndex(bytecode, operand_scale);
@@ -257,8 +258,8 @@ InterpreterCompilationJob::Status InterpreterCompilationJob::FinalizeJobImpl(
 
 InterpreterCompilationJob::Status InterpreterCompilationJob::FinalizeJobImpl(
     Handle<SharedFunctionInfo> shared_info, LocalIsolate* isolate) {
-  RCS_SCOPE(parse_info()->runtime_call_stats(),
-            RuntimeCallCounterId::kCompileBackgroundIgnitionFinalization);
+  RCS_SCOPE(isolate, RuntimeCallCounterId::kCompileIgnitionFinalization,
+            RuntimeCallStats::kThreadSpecific);
   TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.compile"),
                "V8.CompileIgnitionFinalization");
   return DoFinalizeJobImpl(shared_info, isolate);
@@ -344,16 +345,16 @@ void Interpreter::Initialize() {
 
   // Set the interpreter entry trampoline entry point now that builtins are
   // initialized.
-  Handle<Code> code = BUILTIN_CODE(isolate_, InterpreterEntryTrampoline);
+  Handle<CodeT> code = BUILTIN_CODE(isolate_, InterpreterEntryTrampoline);
   DCHECK(builtins->is_initialized());
   DCHECK(code->is_off_heap_trampoline() ||
-         isolate_->heap()->IsImmovable(*code));
+         isolate_->heap()->IsImmovable(FromCodeT(*code)));
   interpreter_entry_trampoline_instruction_start_ = code->InstructionStart();
 
   // Initialize the dispatch table.
   ForEachBytecode([=](Bytecode bytecode, OperandScale operand_scale) {
     Builtin builtin = BuiltinIndexFromBytecode(bytecode, operand_scale);
-    Code handler = builtins->code(builtin);
+    CodeT handler = builtins->code(builtin);
     if (Bytecodes::BytecodeHasHandler(bytecode, operand_scale)) {
 #ifdef DEBUG
       std::string builtin_name(Builtins::name(builtin));
diff --git a/chromium/v8/src/interpreter/interpreter.h b/chromium/v8/src/interpreter/interpreter.h
index 2210f78ee37..82fc8a9deab 100644
--- a/chromium/v8/src/interpreter/interpreter.h
+++ b/chromium/v8/src/interpreter/interpreter.h
@@ -62,12 +62,12 @@ class Interpreter {
 
   // If the bytecode handler for |bytecode| and |operand_scale| has not yet
   // been loaded, deserialize it. Then return the handler.
-  V8_EXPORT_PRIVATE Code GetBytecodeHandler(Bytecode bytecode,
-                                            OperandScale operand_scale);
+  V8_EXPORT_PRIVATE CodeT GetBytecodeHandler(Bytecode bytecode,
+                                             OperandScale operand_scale);
 
   // Set the bytecode handler for |bytecode| and |operand_scale|.
   void SetBytecodeHandler(Bytecode bytecode, OperandScale operand_scale,
-                          Code handler);
+                          CodeT handler);
 
   // Disassembler support.
   V8_EXPORT_PRIVATE const char* LookupNameOfBytecodeHandler(const Code code);