deps: patch V8 to 8.1.307.26

Refs: https://github.com/v8/v8/compare/8.1.307.20...8.1.307.26

PR-URL: https://github.com/nodejs/node/pull/32521
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

23 files changed, 358 insertions, 98 deletions

diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h
index c2969d817c..4fd23ab095 100644
--- a/deps/v8/include/v8-version.h
+++ b/deps/v8/include/v8-version.h
@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 8
 #define V8_MINOR_VERSION 1
 #define V8_BUILD_NUMBER 307
-#define V8_PATCH_LEVEL 20
+#define V8_PATCH_LEVEL 26
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
diff --git a/deps/v8/infra/mb/mb_config.pyl b/deps/v8/infra/mb/mb_config.pyl
index 95723ea079..8677333c2f 100644
--- a/deps/v8/infra/mb/mb_config.pyl
+++ b/deps/v8/infra/mb/mb_config.pyl
@@ -164,24 +164,34 @@
       'V8 Linux - s390x - sim': 'release_simulate_s390x',
     },
     'client.v8.branches': {
+      'V8 Linux - previous branch': 'release_x86',
+      'V8 Linux - previous branch - debug': 'debug_x86',
       'V8 Linux - beta branch': 'release_x86',
       'V8 Linux - beta branch - debug': 'debug_x86',
       'V8 Linux - stable branch': 'release_x86',
       'V8 Linux - stable branch - debug': 'debug_x86',
+      'V8 Linux64 - previous branch': 'release_x64',
+      'V8 Linux64 - previous branch - debug': 'debug_x64',
       'V8 Linux64 - beta branch': 'release_x64',
       'V8 Linux64 - beta branch - debug': 'debug_x64',
       'V8 Linux64 - stable branch': 'release_x64',
       'V8 Linux64 - stable branch - debug': 'debug_x64',
+      'V8 arm - sim - previous branch': 'release_simulate_arm',
+      'V8 arm - sim - previous branch - debug': 'debug_simulate_arm',
       'V8 arm - sim - beta branch': 'release_simulate_arm',
       'V8 arm - sim - beta branch - debug': 'debug_simulate_arm',
       'V8 arm - sim - stable branch': 'release_simulate_arm',
       'V8 arm - sim - stable branch - debug': 'debug_simulate_arm',
+      'V8 mips64el - sim - previous branch': 'release_simulate_mips64el',
       'V8 mips64el - sim - beta branch': 'release_simulate_mips64el',
       'V8 mips64el - sim - stable branch': 'release_simulate_mips64el',
+      'V8 mipsel - sim - previous branch': 'release_simulate_mipsel',
       'V8 mipsel - sim - beta branch': 'release_simulate_mipsel',
       'V8 mipsel - sim - stable branch': 'release_simulate_mipsel',
+      'V8 ppc64 - sim - previous branch': 'release_simulate_ppc64',
       'V8 ppc64 - sim - beta branch': 'release_simulate_ppc64',
       'V8 ppc64 - sim - stable branch': 'release_simulate_ppc64',
+      'V8 s390x - sim - previous branch': 'release_simulate_s390x',
       'V8 s390x - sim - beta branch': 'release_simulate_s390x',
       'V8 s390x - sim - stable branch': 'release_simulate_s390x',
     },
diff --git a/deps/v8/infra/testing/builders.pyl b/deps/v8/infra/testing/builders.pyl
index 0e4ac9d875..b26f1a1f08 100644
--- a/deps/v8/infra/testing/builders.pyl
+++ b/deps/v8/infra/testing/builders.pyl
@@ -1686,6 +1686,26 @@
       {'name': 'v8testing', 'shards': 3},
     ],
   },
+  'V8 Linux - previous branch': {
+    'swarming_dimensions': {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'mozilla'},
+      {'name': 'test262', 'variant': 'default'},
+      {'name': 'v8testing'},
+    ],
+  },
+  'V8 Linux - previous branch - debug': {
+    'swarming_dimensions': {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'mozilla'},
+      {'name': 'test262', 'variant': 'default'},
+      {'name': 'v8testing', 'shards': 3},
+    ],
+  },
   'V8 Linux64 - beta branch': {
     'swarming_dimensions': {
       'os': 'Ubuntu-16.04',
@@ -1726,6 +1746,26 @@
       {'name': 'v8testing', 'shards': 3},
     ],
   },
+  'V8 Linux64 - previous branch': {
+    'swarming_dimensions': {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'mozilla'},
+      {'name': 'test262', 'variant': 'default'},
+      {'name': 'v8testing'},
+    ],
+  },
+  'V8 Linux64 - previous branch - debug': {
+    'swarming_dimensions': {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'mozilla'},
+      {'name': 'test262', 'variant': 'default'},
+      {'name': 'v8testing', 'shards': 3},
+    ],
+  },
   'V8 arm - sim - beta branch': {
     'swarming_dimensions': {
       'os': 'Ubuntu-16.04',
@@ -1766,6 +1806,26 @@
       {'name': 'v8testing', 'shards': 10},
     ],
   },
+  'V8 arm - sim - previous branch': {
+    'swarming_dimensions': {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'mozilla'},
+      {'name': 'test262', 'variant': 'default'},
+      {'name': 'v8testing', 'shards': 4},
+    ],
+  },
+  'V8 arm - sim - previous branch - debug': {
+    'swarming_dimensions': {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'mozilla', 'shards': 2},
+      {'name': 'test262', 'variant': 'default', 'shards': 2},
+      {'name': 'v8testing', 'shards': 10},
+    ],
+  },
   'V8 mips64el - sim - beta branch': {
     'swarming_dimensions': {
       'os': 'Ubuntu-16.04',
@@ -1782,6 +1842,14 @@
       {'name': 'unittests'},
     ],
   },
+  'V8 mips64el - sim - previous branch': {
+    'swarming_dimensions': {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'unittests'},
+    ],
+  },
   'V8 mipsel - sim - beta branch': {
     'swarming_dimensions': {
       'os': 'Ubuntu-16.04',
@@ -1798,6 +1866,14 @@
       {'name': 'v8testing', 'shards': 4},
     ],
   },
+  'V8 mipsel - sim - previous branch': {
+    'swarming_dimensions': {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'v8testing', 'shards': 4},
+    ],
+  },
   'V8 ppc64 - sim - beta branch': {
     'swarming_dimensions': {
       'os': 'Ubuntu-16.04',
@@ -1814,6 +1890,14 @@
       {'name': 'unittests'},
     ],
   },
+  'V8 ppc64 - sim - previous branch': {
+    'swarming_dimensions': {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'unittests'},
+    ],
+  },
   'V8 s390x - sim - beta branch': {
     'swarming_dimensions': {
       'os': 'Ubuntu-16.04',
@@ -1830,4 +1914,12 @@
       {'name': 'unittests'},
     ],
   },
+  'V8 s390x - sim - previous branch': {
+    'swarming_dimensions': {
+      'os': 'Ubuntu-16.04',
+    },
+    'tests': [
+      {'name': 'unittests'},
+    ],
+  },
 }
diff --git a/deps/v8/src/builtins/builtins-intl.cc b/deps/v8/src/builtins/builtins-intl.cc
index afa7ef2d30..3b624af91b 100644
--- a/deps/v8/src/builtins/builtins-intl.cc
+++ b/deps/v8/src/builtins/builtins-intl.cc
@@ -265,13 +265,11 @@ Object LegacyFormatConstructor(BuiltinArguments args, Isolate* isolate,
 
   // [[Construct]]
   Handle<JSFunction> target = args.target();
-
   Handle<Object> locales = args.atOrUndefined(isolate, 1);
   Handle<Object> options = args.atOrUndefined(isolate, 2);
 
   // 2. Let format be ? OrdinaryCreateFromConstructor(newTarget,
   // "%<T>Prototype%", ...).
-
   Handle<Map> map;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, map, JSFunction::GetDerivedMap(isolate, target, new_target));
@@ -281,45 +279,42 @@ Object LegacyFormatConstructor(BuiltinArguments args, Isolate* isolate,
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, format, T::New(isolate, map, locales, options, method));
   // 4. Let this be the this value.
-  Handle<Object> receiver = args.receiver();
-
-  // 5. If NewTarget is undefined and ? InstanceofOperator(this, %<T>%)
-  // is true, then
-  //
-  // Look up the intrinsic value that has been stored on the context.
-  // Call the instanceof function
-  Handle<Object> is_instance_of_obj;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, is_instance_of_obj,
-      Object::InstanceOf(isolate, receiver, constructor));
-
-  // Get the boolean value of the result
-  bool is_instance_of = is_instance_of_obj->BooleanValue(isolate);
-
-  if (args.new_target()->IsUndefined(isolate) && is_instance_of) {
-    if (!receiver->IsJSReceiver()) {
-      THROW_NEW_ERROR_RETURN_FAILURE(
-          isolate,
-          NewTypeError(MessageTemplate::kIncompatibleMethodReceiver,
-                       isolate->factory()->NewStringFromAsciiChecked(method),
-                       receiver));
+  if (args.new_target()->IsUndefined(isolate)) {
+    Handle<Object> receiver = args.receiver();
+
+    // 5. If NewTarget is undefined and ? InstanceofOperator(this, %<T>%)
+    // is true, then Look up the intrinsic value that has been stored on
+    // the context.
+    Handle<Object> is_instance_of_obj;
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+        isolate, is_instance_of_obj,
+        Object::InstanceOf(isolate, receiver, constructor));
+
+    if (is_instance_of_obj->BooleanValue(isolate)) {
+      if (!receiver->IsJSReceiver()) {
+        THROW_NEW_ERROR_RETURN_FAILURE(
+            isolate,
+            NewTypeError(MessageTemplate::kIncompatibleMethodReceiver,
+                         isolate->factory()->NewStringFromAsciiChecked(method),
+                         receiver));
+      }
+      Handle<JSReceiver> rec = Handle<JSReceiver>::cast(receiver);
+      // a. Perform ? DefinePropertyOrThrow(this,
+      // %Intl%.[[FallbackSymbol]], PropertyDescriptor{ [[Value]]: format,
+      // [[Writable]]: false, [[Enumerable]]: false, [[Configurable]]: false }).
+      PropertyDescriptor desc;
+      desc.set_value(format);
+      desc.set_writable(false);
+      desc.set_enumerable(false);
+      desc.set_configurable(false);
+      Maybe<bool> success = JSReceiver::DefineOwnProperty(
+          isolate, rec, isolate->factory()->intl_fallback_symbol(), &desc,
+          Just(kThrowOnError));
+      MAYBE_RETURN(success, ReadOnlyRoots(isolate).exception());
+      CHECK(success.FromJust());
+      // b. b. Return this.
+      return *receiver;
     }
-    Handle<JSReceiver> rec = Handle<JSReceiver>::cast(receiver);
-    // a. Perform ? DefinePropertyOrThrow(this,
-    // %Intl%.[[FallbackSymbol]], PropertyDescriptor{ [[Value]]: format,
-    // [[Writable]]: false, [[Enumerable]]: false, [[Configurable]]: false }).
-    PropertyDescriptor desc;
-    desc.set_value(format);
-    desc.set_writable(false);
-    desc.set_enumerable(false);
-    desc.set_configurable(false);
-    Maybe<bool> success = JSReceiver::DefineOwnProperty(
-        isolate, rec, isolate->factory()->intl_fallback_symbol(), &desc,
-        Just(kThrowOnError));
-    MAYBE_RETURN(success, ReadOnlyRoots(isolate).exception());
-    CHECK(success.FromJust());
-    // b. b. Return this.
-    return *receiver;
   }
   // 6. Return format.
   return *format;
diff --git a/deps/v8/src/compiler/simd-scalar-lowering.cc b/deps/v8/src/compiler/simd-scalar-lowering.cc
index 9d13bbfa98..b5e0410d50 100644
--- a/deps/v8/src/compiler/simd-scalar-lowering.cc
+++ b/deps/v8/src/compiler/simd-scalar-lowering.cc
@@ -909,29 +909,36 @@ void SimdScalarLowering::LowerNode(Node* node) {
     }
     case IrOpcode::kParameter: {
       DCHECK_EQ(1, node->InputCount());
+      int param_count = static_cast<int>(signature()->parameter_count());
       // Only exchange the node if the parameter count actually changed. We do
-      // not even have to do the default lowering because the the start node,
+      // not even have to do the default lowering because the start node,
       // the only input of a parameter node, only changes if the parameter count
       // changes.
-      if (GetParameterCountAfterLowering() !=
-          static_cast<int>(signature()->parameter_count())) {
+      if (GetParameterCountAfterLowering() != param_count) {
         int old_index = ParameterIndexOf(node->op());
+        // Parameter index 0 is the instance parameter, we will use old_index to
+        // index into the function signature, so we need to decrease it by 1.
+        --old_index;
         int new_index =
             GetParameterIndexAfterLoweringSimd128(signature(), old_index);
-        if (old_index == new_index) {
-          NodeProperties::ChangeOp(node, common()->Parameter(new_index));
+        // Similarly, the index into function signature needs to account for the
+        // instance parameter, so increase it by 1.
+        ++new_index;
+        NodeProperties::ChangeOp(node, common()->Parameter(new_index));
 
+        if (old_index < 0) {
+          break;
+        }
+
+        DCHECK(old_index < param_count);
+
+        if (signature()->GetParam(old_index) ==
+            MachineRepresentation::kSimd128) {
           Node* new_node[kNumLanes32];
-          for (int i = 0; i < kNumLanes32; ++i) {
-            new_node[i] = nullptr;
-          }
           new_node[0] = node;
-          if (signature()->GetParam(old_index) ==
-              MachineRepresentation::kSimd128) {
-            for (int i = 1; i < kNumLanes32; ++i) {
-              new_node[i] = graph()->NewNode(common()->Parameter(new_index + i),
-                                             graph()->start());
-            }
+          for (int i = 1; i < kNumLanes32; ++i) {
+            new_node[i] = graph()->NewNode(common()->Parameter(new_index + i),
+                                           graph()->start());
           }
           ReplaceNode(node, new_node, kNumLanes32);
         }
diff --git a/deps/v8/src/compiler/wasm-compiler.cc b/deps/v8/src/compiler/wasm-compiler.cc
index 55cb950cff..db1731f388 100644
--- a/deps/v8/src/compiler/wasm-compiler.cc
+++ b/deps/v8/src/compiler/wasm-compiler.cc
@@ -6932,6 +6932,11 @@ wasm::WasmCompilationResult ExecuteTurbofanWasmCompilation(
     call_descriptor = GetI32WasmCallDescriptor(&zone, call_descriptor);
   }
 
+  if (ContainsSimd(func_body.sig) &&
+      (!CpuFeatures::SupportsWasmSimd128() || env->lower_simd)) {
+    call_descriptor = GetI32WasmCallDescriptorForSimd(&zone, call_descriptor);
+  }
+
   Pipeline::GenerateCodeForWasmFunction(
       &info, wasm_engine, mcgraph, call_descriptor, source_positions,
       node_origins, func_body, env->module, func_index);
diff --git a/deps/v8/src/objects/objects.cc b/deps/v8/src/objects/objects.cc
index cf1a3dcc20..9b53019297 100644
--- a/deps/v8/src/objects/objects.cc
+++ b/deps/v8/src/objects/objects.cc
@@ -7220,10 +7220,9 @@ int BaseNameDictionary<Derived, Shape>::NextEnumerationIndex(
   // Check whether the next enumeration index is valid.
   if (!PropertyDetails::IsValidIndex(index)) {
     // If not, we generate new indices for the properties.
-    int length = dictionary->NumberOfElements();
-
     Handle<FixedArray> iteration_order = IterationIndices(isolate, dictionary);
-    DCHECK_EQ(length, iteration_order->length());
+    int length = iteration_order->length();
+    DCHECK_LE(length, dictionary->NumberOfElements());
 
     // Iterate over the dictionary using the enumeration order and update
     // the dictionary with new enumeration indices.
@@ -7467,8 +7466,8 @@ void BaseNameDictionary<Derived, Shape>::CopyEnumKeysTo(
 template <typename Derived, typename Shape>
 Handle<FixedArray> BaseNameDictionary<Derived, Shape>::IterationIndices(
     Isolate* isolate, Handle<Derived> dictionary) {
-  int length = dictionary->NumberOfElements();
-  Handle<FixedArray> array = isolate->factory()->NewFixedArray(length);
+  Handle<FixedArray> array =
+      isolate->factory()->NewFixedArray(dictionary->NumberOfElements());
   ReadOnlyRoots roots(isolate);
   int array_size = 0;
   {
@@ -7480,7 +7479,13 @@ Handle<FixedArray> BaseNameDictionary<Derived, Shape>::IterationIndices(
       array->set(array_size++, Smi::FromInt(i.as_int()));
     }
 
-    DCHECK_EQ(array_size, length);
+    // The global dictionary doesn't track its deletion count, so we may iterate
+    // fewer entries than the count of elements claimed by the dictionary.
+    if (std::is_same<Derived, GlobalDictionary>::value) {
+      DCHECK_LE(array_size, dictionary->NumberOfElements());
+    } else {
+      DCHECK_EQ(array_size, dictionary->NumberOfElements());
+    }
 
     EnumIndexComparator<Derived> cmp(raw_dictionary);
     // Use AtomicSlot wrapper to ensure that std::sort uses atomic load and
diff --git a/deps/v8/src/parsing/parser.cc b/deps/v8/src/parsing/parser.cc
index 029caf2524..21beff8790 100644
--- a/deps/v8/src/parsing/parser.cc
+++ b/deps/v8/src/parsing/parser.cc
@@ -505,7 +505,6 @@ FunctionLiteral* Parser::ParseProgram(Isolate* isolate, Handle<Script> script,
                         Scope::DeserializationMode::kIncludingVariables);
 
   scanner_.Initialize();
-  scanner_.SkipHashBang();
   FunctionLiteral* result = DoParseProgram(isolate, info);
   MaybeResetCharacterStream(info, result);
   MaybeProcessSourceRanges(info, result, stack_limit_);
diff --git a/deps/v8/src/parsing/preparser.cc b/deps/v8/src/parsing/preparser.cc
index 5ed443f45e..464e8e7b17 100644
--- a/deps/v8/src/parsing/preparser.cc
+++ b/deps/v8/src/parsing/preparser.cc
@@ -75,10 +75,6 @@ PreParser::PreParseResult PreParser::PreParseProgram() {
   scope->set_is_being_lazily_parsed(true);
 #endif
 
-  // Note: We should only skip the hashbang in non-Eval scripts
-  // (currently, Eval is not handled by the PreParser).
-  scanner()->SkipHashBang();
-
   // ModuleDeclarationInstantiation for Source Text Module Records creates a
   // new Module Environment Record whose outer lexical environment record is
   // the global scope.
diff --git a/deps/v8/src/parsing/scanner-inl.h b/deps/v8/src/parsing/scanner-inl.h
index ff75997ad6..fc5194f263 100644
--- a/deps/v8/src/parsing/scanner-inl.h
+++ b/deps/v8/src/parsing/scanner-inl.h
@@ -506,6 +506,10 @@ V8_INLINE Token::Value Scanner::ScanSingleToken() {
           return ScanTemplateSpan();
 
         case Token::PRIVATE_NAME:
+          if (source_pos() == 0 && Peek() == '!') {
+            token = SkipSingleLineComment();
+            continue;
+          }
           return ScanPrivateName();
 
         case Token::WHITESPACE:
diff --git a/deps/v8/src/parsing/scanner.cc b/deps/v8/src/parsing/scanner.cc
index 70d278556c..5d5fbdbab6 100644
--- a/deps/v8/src/parsing/scanner.cc
+++ b/deps/v8/src/parsing/scanner.cc
@@ -314,13 +314,6 @@ Token::Value Scanner::SkipMultiLineComment() {
   return Token::ILLEGAL;
 }
 
-void Scanner::SkipHashBang() {
-  if (c0_ == '#' && Peek() == '!' && source_pos() == 0) {
-    SkipSingleLineComment();
-    Scan();
-  }
-}
-
 Token::Value Scanner::ScanHtmlComment() {
   // Check for <!-- comments.
   DCHECK_EQ(c0_, '!');
diff --git a/deps/v8/src/parsing/scanner.h b/deps/v8/src/parsing/scanner.h
index 4b858a33b6..2e953f6e6a 100644
--- a/deps/v8/src/parsing/scanner.h
+++ b/deps/v8/src/parsing/scanner.h
@@ -422,9 +422,6 @@ class V8_EXPORT_PRIVATE Scanner {
 
   const Utf16CharacterStream* stream() const { return source_; }
 
-  // If the next characters in the stream are "#!", the line is skipped.
-  void SkipHashBang();
-
  private:
   // Scoped helper for saving & restoring scanner error state.
   // This is used for tagged template literals, in which normally forbidden
diff --git a/deps/v8/src/wasm/baseline/liftoff-compiler.cc b/deps/v8/src/wasm/baseline/liftoff-compiler.cc
index 37d7c7ba67..f396b76244 100644
--- a/deps/v8/src/wasm/baseline/liftoff-compiler.cc
+++ b/deps/v8/src/wasm/baseline/liftoff-compiler.cc
@@ -357,6 +357,11 @@ class LiftoffCompiler {
   bool CheckSupportedType(FullDecoder* decoder,
                           Vector<const ValueType> supported_types,
                           ValueType type, const char* context) {
+    // Special case for kWasm128 which requires specific hardware support.
+    if (type == kWasmS128 && (!CpuFeatures::SupportsWasmSimd128())) {
+      unsupported(decoder, kSimd, "simd");
+      return false;
+    }
     // Check supported types.
     for (ValueType supported : supported_types) {
       if (type == supported) return true;
@@ -2198,6 +2203,9 @@ class LiftoffCompiler {
 
   void SimdOp(FullDecoder* decoder, WasmOpcode opcode, Vector<Value> args,
               Value* result) {
+    if (!CpuFeatures::SupportsWasmSimd128()) {
+      return unsupported(decoder, kSimd, "simd");
+    }
     switch (opcode) {
       case wasm::kExprF32x4Splat:
         EmitUnOp<kWasmF32, kWasmS128>(
diff --git a/deps/v8/test/cctest/wasm/test-run-wasm-simd-liftoff.cc b/deps/v8/test/cctest/wasm/test-run-wasm-simd-liftoff.cc
index 33e5ee3ce8..24a5978950 100644
--- a/deps/v8/test/cctest/wasm/test-run-wasm-simd-liftoff.cc
+++ b/deps/v8/test/cctest/wasm/test-run-wasm-simd-liftoff.cc
@@ -32,7 +32,6 @@ WASM_SIMD_LIFTOFF_TEST(S128Local) {
   byte temp1 = r.AllocateLocal(kWasmS128);
   BUILD(r, WASM_SET_LOCAL(temp1, WASM_GET_LOCAL(temp1)), WASM_ONE);
   CHECK_EQ(1, r.Call());
-  r.CheckUsedExecutionTier(ExecutionTier::kLiftoff);
 }
 
 WASM_SIMD_LIFTOFF_TEST(S128Global) {
@@ -47,7 +46,6 @@ WASM_SIMD_LIFTOFF_TEST(S128Global) {
     WriteLittleEndianValue<int32_t>(&g0[i], expected);
   }
   r.Call();
-  r.CheckUsedExecutionTier(ExecutionTier::kLiftoff);
   for (int i = 0; i < 4; i++) {
     int32_t actual = ReadLittleEndianValue<int32_t>(&g1[i]);
     CHECK_EQ(actual, expected);
@@ -70,7 +68,6 @@ WASM_SIMD_LIFTOFF_TEST(S128Param) {
         WASM_CALL_FUNCTION(simd_func.function_index(), WASM_GET_LOCAL(temp1)));
 
   CHECK_EQ(1, r.Call());
-  r.CheckUsedExecutionTier(ExecutionTier::kLiftoff);
 }
 
 WASM_SIMD_LIFTOFF_TEST(S128Return) {
@@ -85,7 +82,6 @@ WASM_SIMD_LIFTOFF_TEST(S128Return) {
         WASM_ONE);
 
   CHECK_EQ(1, r.Call());
-  r.CheckUsedExecutionTier(ExecutionTier::kLiftoff);
 }
 
 #undef WASM_SIMD_LIFTOFF_TEST
diff --git a/deps/v8/test/message/fail/hashbang-incomplete-string.js b/deps/v8/test/message/fail/hashbang-incomplete-string.js
new file mode 100644
index 0000000000..b3aab937db
--- /dev/null
+++ b/deps/v8/test/message/fail/hashbang-incomplete-string.js
@@ -0,0 +1,12 @@
+#!/usr/bin/env d8
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+//
+
+const x = 'valid code';
+
+'incomplete string
+
+const y = 'even more valid code!';
diff --git a/deps/v8/test/message/fail/hashbang-incomplete-string.out b/deps/v8/test/message/fail/hashbang-incomplete-string.out
new file mode 100644
index 0000000000..db85fe06a6
--- /dev/null
+++ b/deps/v8/test/message/fail/hashbang-incomplete-string.out
@@ -0,0 +1,5 @@
+*%(basename)s:10: SyntaxError: Invalid or unexpected token
+'incomplete string
+^^^^^^^^^^^^^^^^^^
+
+SyntaxError: Invalid or unexpected token
diff --git a/deps/v8/test/message/wasm-trace-memory-liftoff.js b/deps/v8/test/message/wasm-trace-memory-liftoff.js
index b50d33dbe8..05c30a219e 100644
--- a/deps/v8/test/message/wasm-trace-memory-liftoff.js
+++ b/deps/v8/test/message/wasm-trace-memory-liftoff.js
@@ -4,7 +4,8 @@
 
 // Flags: --no-stress-opt --trace-wasm-memory --liftoff --no-future
 // Flags: --no-wasm-tier-up --experimental-wasm-simd
+// Flags: --enable-sse3 --enable-sse4-1
 
-// liftoff does not support simd128, so the s128 load and store traces are in
-// the turbofan tier and not liftoff
+// Force enable sse3 and sse4-1, since that will determine which execution tier
+// we use, and thus the expected output message will differ.
 load("test/message/wasm-trace-memory.js");
diff --git a/deps/v8/test/mjsunit/mjsunit.status b/deps/v8/test/mjsunit/mjsunit.status
index a5bae5476d..c44d07be9b 100644
--- a/deps/v8/test/mjsunit/mjsunit.status
+++ b/deps/v8/test/mjsunit/mjsunit.status
@@ -401,6 +401,9 @@
   'tzoffset-transition-moscow': [SKIP],
   'tzoffset-transition-new-york': [SKIP],
   'tzoffset-seoul': [SKIP],
+
+  # noi18n is required for Intl
+  'regress/regress-crbug-1052647': [SKIP],
 }],  # 'no_i18n'
 
 ##############################################################################
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1052647.js b/deps/v8/test/mjsunit/regress/regress-crbug-1052647.js
new file mode 100644
index 0000000000..9a4694a176
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1052647.js
@@ -0,0 +1,12 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let useArgs = undefined;
+function f(arg) {
+    useArgs = 'result' + arguments[0] + arg;
+}
+
+Intl.NumberFormat.__proto__ = { [Symbol.hasInstance]: f };
+
+new Intl.NumberFormat();
diff --git a/deps/v8/test/mjsunit/wasm/simd-call.js b/deps/v8/test/mjsunit/wasm/simd-call.js
new file mode 100644
index 0000000000..0359832553
--- /dev/null
+++ b/deps/v8/test/mjsunit/wasm/simd-call.js
@@ -0,0 +1,66 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-simd
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+// Tests function calls containing s128 parameters. It also checks that
+// lowering of simd calls are correct, so we create 2 functions with s128
+// arguments: function 2 has a single s128 parameter, function 3 has a i32 then
+// s128, to ensure that the arguments in different indices are correctly lowered.
+(function TestSimd128Params() {
+  const builder = new WasmModuleBuilder();
+  builder.addImportedMemory('m', 'imported_mem', 1, 2);
+
+  builder
+    .addFunction("main", makeSig([], []))
+    .addBodyWithEnd([
+      kExprI32Const, 0,
+      kSimdPrefix, kExprS128LoadMem, 0, 0,
+      kExprCallFunction, 0x01,
+      kExprEnd,
+    ]);
+
+  // Writes s128 argument to memory starting byte 16.
+  builder
+    .addFunction("function2", makeSig([kWasmS128], []))
+    .addBodyWithEnd([
+      kExprI32Const, 16,
+      kExprLocalGet, 0,
+      kSimdPrefix, kExprS128StoreMem, 0, 0,
+      kExprI32Const, 9, // This constant doesn't matter.
+      kExprLocalGet, 0,
+      kExprCallFunction, 0x02,
+      kExprEnd,
+    ]);
+
+  // Writes s128 argument to memory starting byte 32.
+  builder
+    .addFunction("function3", makeSig([kWasmI32, kWasmS128], []))
+    .addBodyWithEnd([
+      kExprI32Const, 32,
+      kExprLocalGet, 1,
+      kSimdPrefix, kExprS128StoreMem, 0, 0,
+      kExprEnd,
+    ]);
+
+  builder.addExport('main', 0);
+  var memory = new WebAssembly.Memory({initial:1, maximum:2});
+  const instance = builder.instantiate({m: {imported_mem: memory}});
+
+  const arr = new Uint8Array(memory.buffer);
+  // Fill the initial memory with some values, this is read by main and passed
+  // as arguments to function2, and then to function3.
+  for (let i = 0; i < 16; i++) {
+    arr[i] = i * 2;
+  }
+
+  instance.exports.main();
+
+  for (let i = 0; i < 16; i++) {
+    assertEquals(arr[i], arr[i+16]);
+    assertEquals(arr[i], arr[i+32]);
+  }
+})();
diff --git a/deps/v8/test/unittests/BUILD.gn b/deps/v8/test/unittests/BUILD.gn
index 37c2bdae02..ab407c2fe6 100644
--- a/deps/v8/test/unittests/BUILD.gn
+++ b/deps/v8/test/unittests/BUILD.gn
@@ -211,6 +211,7 @@ v8_source_set("unittests_sources") {
     "parser/preparser-unittest.cc",
     "profiler/strings-storage-unittest.cc",
     "regress/regress-crbug-1041240-unittest.cc",
+    "regress/regress-crbug-1056054-unittest.cc",
     "regress/regress-crbug-938251-unittest.cc",
     "run-all-unittests.cc",
     "strings/char-predicates-unittest.cc",
diff --git a/deps/v8/test/unittests/regress/regress-crbug-1056054-unittest.cc b/deps/v8/test/unittests/regress/regress-crbug-1056054-unittest.cc
new file mode 100644
index 0000000000..4478e9f94d
--- /dev/null
+++ b/deps/v8/test/unittests/regress/regress-crbug-1056054-unittest.cc
@@ -0,0 +1,26 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/execution/isolate.h"
+#include "src/heap/factory.h"
+#include "test/unittests/test-utils.h"
+
+namespace v8 {
+namespace internal {
+
+using EnumIndexOverflowTest = TestWithNativeContextAndZone;
+
+TEST_F(EnumIndexOverflowTest, GlobalObject) {
+  Handle<GlobalDictionary> dictionary(
+      isolate()->global_object()->global_dictionary(), isolate());
+  dictionary->set_next_enumeration_index(
+      PropertyDetails::DictionaryStorageField::kMax);
+  Handle<Object> value(Smi::FromInt(static_cast<int>(42)), isolate());
+  Handle<Name> name = factory()->InternalizeUtf8String("eeeee");
+  JSObject::AddProperty(isolate(), isolate()->global_object(), name, value,
+                        NONE);
+}
+
+}  // namespace internal
+}  // namespace v8
diff --git a/deps/v8/tools/gen-postmortem-metadata.py b/deps/v8/tools/gen-postmortem-metadata.py
index c1c312db5b..4f9e142054 100644
--- a/deps/v8/tools/gen-postmortem-metadata.py
+++ b/deps/v8/tools/gen-postmortem-metadata.py
@@ -382,9 +382,11 @@ def load_objects_from_file(objfilename, checktypes):
         objfile = io.open(objfilename, 'r', encoding='utf-8');
         in_insttype = False;
         in_torque_insttype = False
+        in_torque_fulldef = False
 
         typestr = '';
         torque_typestr = ''
+        torque_fulldefstr = ''
         uncommented_file = ''
 
         #
@@ -402,6 +404,10 @@ def load_objects_from_file(objfilename, checktypes):
                         in_torque_insttype = True
                         continue
 
+                if (line.startswith('#define TORQUE_INSTANCE_CHECKERS_SINGLE_FULLY_DEFINED')):
+                        in_torque_fulldef = True
+                        continue
+
                 if (in_insttype and line.startswith('};')):
                         in_insttype = False;
                         continue;
@@ -410,6 +416,10 @@ def load_objects_from_file(objfilename, checktypes):
                           in_torque_insttype = False
                           continue
 
+                if (in_torque_fulldef and (not line or line.isspace())):
+                          in_torque_fulldef = False
+                          continue
+
                 line = re.sub('//.*', '', line.strip());
 
                 if (in_insttype):
@@ -420,6 +430,10 @@ def load_objects_from_file(objfilename, checktypes):
                         torque_typestr += line
                         continue
 
+                if (in_torque_fulldef):
+                        torque_fulldefstr += line
+                        continue
+
                 uncommented_file += '\n' + line
 
         for match in re.finditer(r'\nclass(?:\s+V8_EXPORT(?:_PRIVATE)?)?'
@@ -450,7 +464,18 @@ def load_objects_from_file(objfilename, checktypes):
         entries = torque_typestr.split('\\')
         for entry in entries:
                 types[re.sub(r' *V\(|\) *', '', entry)] = True
-
+        entries = torque_fulldefstr.split('\\')
+        for entry in entries:
+                entry = entry.strip()
+                if not entry:
+                    continue
+                idx = entry.find('(');
+                rest = entry[idx + 1: len(entry) - 1];
+                args = re.split('\s*,\s*', rest);
+                typename = args[0]
+                typeconst = args[1]
+                types[typeconst] = True
+                typeclasses[typeconst] = typename
         #
         # Infer class names for each type based on a systematic transformation.
         # For example, "JS_FUNCTION_TYPE" becomes "JSFunction".  We find the
@@ -553,25 +578,24 @@ def parse_field(call):
 
         consts = [];
 
-        if (kind == 'ACCESSORS' or kind == 'ACCESSORS2' or
-            kind == 'ACCESSORS_GCSAFE'):
-                klass = args[0];
-                field = args[1];
+        klass = args[0];
+        field = args[1];
+        dtype = None
+        offset = None
+        if kind.startswith('WEAK_ACCESSORS'):
+                dtype = 'weak'
+                offset = args[2];
+        elif not (kind.startswith('SMI_ACCESSORS') or kind.startswith('ACCESSORS_TO_SMI')):
                 dtype = args[2].replace('<', '_').replace('>', '_')
                 offset = args[3];
+        else:
+                offset = args[2];
+                dtype = 'SMI'
 
-                return ({
-                    'name': 'class_%s__%s__%s' % (klass, field, dtype),
-                    'value': '%s::%s' % (klass, offset)
-                });
-
-        assert(kind == 'SMI_ACCESSORS' or kind == 'ACCESSORS_TO_SMI');
-        klass = args[0];
-        field = args[1];
-        offset = args[2];
 
+        assert(offset is not None and dtype is not None);
         return ({
-            'name': 'class_%s__%s__%s' % (klass, field, 'SMI'),
+            'name': 'class_%s__%s__%s' % (klass, field, dtype),
             'value': '%s::%s' % (klass, offset)
         });
 
@@ -598,7 +622,10 @@ def load_fields_from_file(filename):
         # call parse_field() to pick apart the invocation.
         #
         prefixes = [ 'ACCESSORS', 'ACCESSORS2', 'ACCESSORS_GCSAFE',
-                     'SMI_ACCESSORS', 'ACCESSORS_TO_SMI' ];
+                     'SMI_ACCESSORS', 'ACCESSORS_TO_SMI',
+                     'SYNCHRONIZED_ACCESSORS', 'WEAK_ACCESSORS' ];
+        prefixes += ([ prefix + "_CHECKED" for prefix in prefixes ] +
+                     [ prefix + "_CHECKED2" for prefix in prefixes ])
         current = '';
         opens = 0;