deps: update V8 to 8.7.220

PR-URL: https://github.com/nodejs/node/pull/35700
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>

58 files changed, 397 insertions, 128 deletions

diff --git a/deps/v8/test/mjsunit/regress/regress-1034449.js b/deps/v8/test/mjsunit/regress/regress-1034449.js
index c4af2a4a60..6c22ecd099 100644
--- a/deps/v8/test/mjsunit/regress/regress-1034449.js
+++ b/deps/v8/test/mjsunit/regress/regress-1034449.js
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax --opt --no-always-opt
+// Flags: --no-stress-flush-bytecode
 
 function f(len) {
   return new Array(len);
diff --git a/deps/v8/test/mjsunit/regress/regress-10802.js b/deps/v8/test/mjsunit/regress/regress-10802.js
new file mode 100644
index 0000000000..2036def22a
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-10802.js
@@ -0,0 +1,12 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const arr = new Uint8Array([1, 2, 3]);
+
+function mapper(x) {
+  arr[1] = 182;
+  return x + 1;
+}
+
+assertArrayEquals([2, 3, 4], Uint16Array.from(arr, mapper));
diff --git a/deps/v8/test/mjsunit/regress/regress-1112155.js b/deps/v8/test/mjsunit/regress/regress-1112155.js
new file mode 100644
index 0000000000..ada3b847a7
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1112155.js
@@ -0,0 +1,32 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --dynamic-map-checks --allow-natives-syntax --opt --no-always-opt
+
+function f(v) {
+  return v.b;
+}
+var v = { a: 10, b: 10.23 };
+%PrepareFunctionForOptimization(f);
+f(v);
+%OptimizeFunctionOnNextCall(f);
+f(v);
+assertOptimized(f);
+v.b = {x: 20};
+assertEquals(f(v).x, 20);
+// Must deoptimize because of field-rep changes for field 'b'
+assertUnoptimized(f);
+
+function f0(v) {
+  return v.b;
+}
+var v0 = { b: 10.23 };
+%PrepareFunctionForOptimization(f0);
+f0(v0);
+// Transition the field to an Smi field.
+v0.b = {};
+v0.b = 0;
+%OptimizeFunctionOnNextCall(f0);
+f0(v0);
+assertEquals(f0(v0), 0);
diff --git a/deps/v8/test/mjsunit/regress/regress-1123379.js b/deps/v8/test/mjsunit/regress/regress-1123379.js
new file mode 100644
index 0000000000..43a155e0b6
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1123379.js
@@ -0,0 +1,16 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --noanalyze-environment-liveness --interrupt-budget=1000
+
+for (let __v_1 = 0; __v_1 < 5000; __v_1++) {
+  try {
+    [].reduce(function () {});
+  } catch (__v_2) {}
+}
+
+__v_5 = {
+  get: function () {
+  }
+};
diff --git a/deps/v8/test/mjsunit/regress/regress-1125871.js b/deps/v8/test/mjsunit/regress/regress-1125871.js
new file mode 100644
index 0000000000..b062961dd8
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1125871.js
@@ -0,0 +1,25 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --dynamic-map-checks --opt --no-always-opt
+
+function bar(obj) {
+  // Add two dummy loads to make sure obj.b is in the same slot index as obj.a
+  // in foo.
+  obj.y;
+  obj.x;
+  return obj.b
+}
+
+function foo(obj) {
+  bar(obj);
+  return obj.a;
+}
+
+var obj = { a: 10, b: 20};
+%PrepareFunctionForOptimization(foo);
+%EnsureFeedbackVectorForFunction(bar);
+foo(obj);
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(10, foo(obj));
diff --git a/deps/v8/test/mjsunit/regress/regress-1132111.js b/deps/v8/test/mjsunit/regress/regress-1132111.js
deleted file mode 100644
index 1dd1b58806..0000000000
--- a/deps/v8/test/mjsunit/regress/regress-1132111.js
+++ /dev/null
@@ -1,23 +0,0 @@
-// Copyright 2020 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Public function field with computed name
-eval(`
-  buggy = ((bug = new class { [0] = x => 1337.0; }) => bug);
-`);
-
-// Public method with computed name
-eval(`
-  buggy = ((bug = new class { [0](x) { return 1337.0}; }) => bug);
-`);
-
-// Private function field with computed name
-eval(`
-  buggy = ((bug = new class { #foo = x => 1337.0; }) => bug);
-`);
-
-// Private method with computed name
-eval(`
-  buggy = ((bug = new class { #foo(x) { return 1337.0; } }) => bug);
-`);
diff --git a/deps/v8/test/mjsunit/regress/regress-1143772.js b/deps/v8/test/mjsunit/regress/regress-1143772.js
new file mode 100644
index 0000000000..40bc494d45
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1143772.js
@@ -0,0 +1,71 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+(function() {
+    // Only run this test if doubles are transitioned in-place to tagged.
+    let x = {};
+    x.a = 0.1;
+    let y = {};
+    y.a = {};
+    if (!%HaveSameMap(x, y)) return;
+
+    // m1: {}
+    let m1 = {};
+
+    // m2: {a:d}
+    let m2 = {};
+    assertTrue(%HaveSameMap(m2, m1));
+    m2.a = 13.37;
+
+    // m3: {a:d, b:s}
+    let m3 = {};
+    m3.a = 13.37;
+    assertTrue(%HaveSameMap(m3, m2));
+    m3.b = 1;
+
+    // m4: {a:d, b:s, c:h}
+    let m4 = {};
+    m4.a = 13.37;
+    m4.b = 1;
+    assertTrue(%HaveSameMap(m4, m3));
+    m4.c = {};
+
+    // m4_2 == m4
+    let m4_2 = {};
+    m4_2.a = 13.37;
+    m4_2.b = 1;
+    m4_2.c = {};
+    assertTrue(%HaveSameMap(m4_2, m4));
+
+    // m5: {a:d, b:d}
+    let m5 = {};
+    m5.a = 13.37;
+    assertTrue(%HaveSameMap(m5, m2));
+    m5.b = 13.37;
+    assertFalse(%HaveSameMap(m5, m3));
+
+    // At this point, Map3 and Map4 are both deprecated. Map2 transitions to
+    // Map5. Map5 is the migration target for Map3.
+    assertFalse(%HaveSameMap(m5, m3));
+
+    // m6: {a:d, b:d, c:d}
+    let m6 = {};
+    m6.a = 13.37;
+    assertTrue(%HaveSameMap(m6, m2));
+    m6.b = 13.37;
+    assertTrue(%HaveSameMap(m6, m5));
+    m6.c = 13.37
+
+    // Make m7: {a:d, b:d, c:t}
+    let m7 = m4_2;
+    assertTrue(%HaveSameMap(m7, m4));
+    // Map4 is deprecated, so this property access triggers a Map migration.
+    // With in-place map updates and no double unboxing, this should end up
+    // migrating to Map6, and updating it in-place.
+    m7.c;
+    assertFalse(%HaveSameMap(m7, m4));
+    assertTrue(%HaveSameMap(m6, m7));
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-1156.js b/deps/v8/test/mjsunit/regress/regress-1156.js
deleted file mode 100644
index 344657816c..0000000000
--- a/deps/v8/test/mjsunit/regress/regress-1156.js
+++ /dev/null
@@ -1,49 +0,0 @@
-// Copyright 2011 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Flags: --allow-natives-syntax
-
-// Test that we do not crash we invoke builtins from optimized code that
-// is then deoptimized.
-
-function foo(a) {
-  delete a[1];
-  delete a[2];
-  delete a[3];
-  delete a[4];
-  delete a[5];
-  return void 0;
-}
-
-function call_and_deopt() {
-  var b = [1,2,3];
-  foo(b);
-  foo(b);
-  %DeoptimizeFunction(foo);
-}
-
-call_and_deopt();
diff --git a/deps/v8/test/mjsunit/regress/regress-356053.js b/deps/v8/test/mjsunit/regress/regress-356053.js
index 2695c48fd1..ea84973d8e 100644
--- a/deps/v8/test/mjsunit/regress/regress-356053.js
+++ b/deps/v8/test/mjsunit/regress/regress-356053.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --noconcurrent-recompilation --expose-gc --allow-natives-syntax
+// Flags: --expose-gc --allow-natives-syntax
 // Flags: --concurrent-recompilation --block-concurrent-recompilation
 
 gc();
diff --git a/deps/v8/test/mjsunit/regress/regress-411210.js b/deps/v8/test/mjsunit/regress/regress-411210.js
index 2dbc5ff70c..b977beb3c8 100644
--- a/deps/v8/test/mjsunit/regress/regress-411210.js
+++ b/deps/v8/test/mjsunit/regress/regress-411210.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --gc-interval=439 --random-seed=-423594851
+// Flags: --allow-natives-syntax --gc-interval=439
 
 var __v_3;
 function __f_2() {
diff --git a/deps/v8/test/mjsunit/regress/regress-487981.js b/deps/v8/test/mjsunit/regress/regress-487981.js
index f548944ba7..65266dcfa4 100644
--- a/deps/v8/test/mjsunit/regress/regress-487981.js
+++ b/deps/v8/test/mjsunit/regress/regress-487981.js
@@ -4,7 +4,7 @@
 
 // Flags:  --allow-natives-syntax --stress-compaction
 
-// To reliably reproduce the crash use --verify-heap --random-seed=-133185440
+// To reliably reproduce the crash use --verify-heap
 
 function __f_2(o) {
   return o.field.b.x;
diff --git a/deps/v8/test/mjsunit/regress/regress-6288.js b/deps/v8/test/mjsunit/regress/regress-6288.js
index 5f550c31c8..1df666f230 100644
--- a/deps/v8/test/mjsunit/regress/regress-6288.js
+++ b/deps/v8/test/mjsunit/regress/regress-6288.js
@@ -5,9 +5,9 @@
 // Environment Variables: LC_ALL=pt-BR.UTF8
 
 // The data files packaged with d8 currently have Brazillian Portuguese
-// DateTimeFormat but not Collation
+// DateTimeFormat and Collation
 
 if (this.Intl) {
-  assertEquals('pt', Intl.Collator().resolvedOptions().locale);
+  assertEquals('pt-BR', Intl.Collator().resolvedOptions().locale);
   assertEquals('pt-BR', Intl.DateTimeFormat().resolvedOptions().locale);
 }
diff --git a/deps/v8/test/mjsunit/regress/regress-740694.js b/deps/v8/test/mjsunit/regress/regress-740694.js
index 6f31fef0c7..dbe6db916c 100644
--- a/deps/v8/test/mjsunit/regress/regress-740694.js
+++ b/deps/v8/test/mjsunit/regress/regress-740694.js
@@ -18,5 +18,5 @@ var promise = __f_0();
 promise.then(assertUnreachable,
              err => { done = true; error = err });
 %PerformMicrotaskCheckpoint();
-assertTrue(error.startsWith('Error reading'));
+assertTrue(error.startsWith('d8: Error reading'));
 assertTrue(done);
diff --git a/deps/v8/test/mjsunit/regress/regress-8265.js b/deps/v8/test/mjsunit/regress/regress-8265.js
index ffe6191c9f..0be0926012 100644
--- a/deps/v8/test/mjsunit/regress/regress-8265.js
+++ b/deps/v8/test/mjsunit/regress/regress-8265.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --random-seed=1
-
 for (let i = 0; i < 54; ++i) Math.random();
 let sum = 0;
 for (let i = 0; i < 10; ++i)
diff --git a/deps/v8/test/mjsunit/regress/regress-863810.js b/deps/v8/test/mjsunit/regress/regress-863810.js
index 07c0599231..841909a207 100644
--- a/deps/v8/test/mjsunit/regress/regress-863810.js
+++ b/deps/v8/test/mjsunit/regress/regress-863810.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --no-liftoff --no-future --debug-code
+// Flags: --no-liftoff --debug-code
 
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
diff --git a/deps/v8/test/mjsunit/regress/regress-883059.js b/deps/v8/test/mjsunit/regress/regress-883059.js
index ed70feddb4..d7be11038b 100644
--- a/deps/v8/test/mjsunit/regress/regress-883059.js
+++ b/deps/v8/test/mjsunit/regress/regress-883059.js
@@ -2,6 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --random-seed=-1595876594 --disable-in-process-stack-traces  --no-lazy
+// Flags: --disable-in-process-stack-traces  --no-lazy
 
 var __v_47 = ({[__v_46]: __f_52}) => { var __v_46 = 'b'; return __f_52; };
diff --git a/deps/v8/test/mjsunit/regress/regress-9832.js b/deps/v8/test/mjsunit/regress/regress-9832.js
index 41a8c38f0d..eedd628718 100644
--- a/deps/v8/test/mjsunit/regress/regress-9832.js
+++ b/deps/v8/test/mjsunit/regress/regress-9832.js
@@ -15,7 +15,7 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
         kExprI32Add,
       ]).exportFunc();
   builder.addFunction("main", kSig_i_i)
-      .addLocals({except_count: 1})
+      .addLocals(kWasmExnRef, 1)
       .addBody([
         kExprTry, kWasmStmt,
           kExprLocalGet, 0,
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-1027025.js b/deps/v8/test/mjsunit/regress/regress-crbug-1027025.js
index ecf51b6ebd..40cb47565e 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-1027025.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-1027025.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --future --no-lazy-feedback-allocation
+// Flags: --no-lazy-feedback-allocation
 
 // This test ensures that KeyedAccessStoreMode gets computed correctly for cases when there are multiple Smi Handlers in the FeedbackNexus
 function __f_11(b) {
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-664506.js b/deps/v8/test/mjsunit/regress/regress-crbug-664506.js
index b0bf5e7591..44ae933027 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-664506.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-664506.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-gc --predictable --random-seed=-1109634722
+// Flags: --expose-gc --predictable
 
 gc();
 gc();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-882233-2.js b/deps/v8/test/mjsunit/regress/regress-crbug-882233-2.js
index b79ac2ab29..ae6396ea65 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-882233-2.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-882233-2.js
@@ -9,6 +9,7 @@
 function shift_array() {
   let array = [];
   Object.defineProperty(array, 'length', {writable : false});
+  out = array; // Prevent array's map from dying too early.
   return array.shift();
 }
 
@@ -23,6 +24,7 @@ assertOptimized(shift_array);
 function shift_object() {
   let object = { length: 0 };
   Object.defineProperty(object, 'length', {writable : false});
+  out = object; // Prevent object's map from dying too early.
   return object.shift();
 }
 
diff --git a/deps/v8/test/mjsunit/regress/regress-v8-9656.js b/deps/v8/test/mjsunit/regress/regress-v8-9656.js
index 98779b18f9..c28463572e 100644
--- a/deps/v8/test/mjsunit/regress/regress-v8-9656.js
+++ b/deps/v8/test/mjsunit/regress/regress-v8-9656.js
@@ -2,7 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --no-flush-bytecode
+// Flags: --no-stress-flush-bytecode
 // Files: test/mjsunit/code-coverage-utils.js
 
 %DebugToggleBlockCoverage(true);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-02256.js b/deps/v8/test/mjsunit/regress/wasm/regress-02256.js
index 63da0cc10b..aaf508f2bd 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-02256.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-02256.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
-// Flags: --random-seed=891196975 --expose-gc --allow-natives-syntax
+// Flags: --expose-gc --allow-natives-syntax
 // Flags: --gc-interval=207 --stress-compaction --validate-asm
 // Flags: --opt --no-always-opt
 //
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-02256b.js b/deps/v8/test/mjsunit/regress/wasm/regress-02256b.js
index 249e96dfef..a9619c5359 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-02256b.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-02256b.js
@@ -2,9 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
-// Flags: --random-seed=891196975 --expose-gc --allow-natives-syntax
-// Flags: --gc-interval=207 --stress-compaction --validate-asm
-// Flags: --opt --no-always-opt
+// Flags: --expose-gc --allow-natives-syntax --gc-interval=207
+// Flags: --stress-compaction --validate-asm --opt --no-always-opt
 //
 // /v8/test/mjsunit/wasm/grow-memory.js
 // /v8/test/mjsunit/regress/regress-540.js
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-02862.js b/deps/v8/test/mjsunit/regress/wasm/regress-02862.js
index 92ed1cd6c9..d6c5e07536 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-02862.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-02862.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --random-seed=1557792826 --expose-gc --invoke-weak-callbacks --omit-quit --gc-interval=469 --validate-asm
+// Flags:  --expose-gc --invoke-weak-callbacks --omit-quit --gc-interval=469 --validate-asm
 
 function nop() {}
 var __v_42 = {};
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1014798.js b/deps/v8/test/mjsunit/regress/wasm/regress-1014798.js
index 98f0314b99..cfc3d9d9c8 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-1014798.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1014798.js
@@ -6,9 +6,9 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
 
 const builder = new WasmModuleBuilder();
 builder.addFunction('main', kSig_i_iii)
-    .addLocals({f32_count: 4})
-    .addLocals({i64_count: 1})
-    .addLocals({f32_count: 2})
+    .addLocals(kWasmF32, 4)
+    .addLocals(kWasmI64, 1)
+    .addLocals(kWasmF32, 2)
     .addBodyWithEnd([
       kExprI64Const, 0,
       kExprLocalGet, 3,
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1026680.js b/deps/v8/test/mjsunit/regress/wasm/regress-1026680.js
index 5d2e4335c8..d2835a5006 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-1026680.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1026680.js
@@ -19,7 +19,7 @@ kExprEnd,   // @5
             ]);
   // Generate function 2 (out of 2).
   builder.addFunction(undefined, 1 /* sig */)
-    .addLocals({f32_count: 1}).addLocals({i32_count: 13})
+    .addLocals(kWasmF32, 1).addLocals(kWasmI32, 13)
     .addBodyWithEnd([
 // signature: v_v
 // body:
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1027410.js b/deps/v8/test/mjsunit/regress/wasm/regress-1027410.js
index dd9a2f40b8..b353b7a94a 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-1027410.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1027410.js
@@ -18,7 +18,7 @@ kExprEnd,   // @3
             ]);
   // Generate function 2 (out of 2).
   builder.addFunction(undefined, 1 /* sig */)
-    .addLocals({f64_count: 8})
+    .addLocals(kWasmF64, 8)
     .addBodyWithEnd([
 // signature: d_v
 // body:
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1054466.js b/deps/v8/test/mjsunit/regress/wasm/regress-1054466.js
index 41b8ee2335..2c35add9ad 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-1054466.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1054466.js
@@ -10,7 +10,7 @@ const builder = new WasmModuleBuilder();
 builder.addType(makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]));
 // Generate function 1 (out of 1).
 builder.addFunction(undefined, 0 /* sig */)
-  .addLocals({i32_count: 2}).addLocals({f32_count: 2})
+  .addLocals(kWasmI32, 2).addLocals(kWasmF32, 2)
   .addBodyWithEnd([
 // signature: i_iii
 // body:
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1070078.js b/deps/v8/test/mjsunit/regress/wasm/regress-1070078.js
index 8df2e35e65..5301c5747d 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-1070078.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1070078.js
@@ -23,12 +23,12 @@ builder.addFunction(undefined, 0 /* sig */).addBodyWithEnd([
   kSimdPrefix, kExprI8x16Splat,  // i8x16.splat
   kExprI32Const, 0x19,  // i32.const
   kSimdPrefix, kExprI8x16Splat,  // i8x16.splat
-  kSimdPrefix, kExprS8x16Shuffle,
+  kSimdPrefix, kExprI8x16Shuffle,
   0x00, 0x00, 0x17, 0x00, 0x04, 0x04, 0x04, 0x04,
-  0x04, 0x10, 0x01, 0x00, 0x04, 0x04, 0x04, 0x04,  // s8x16.shuffle
-  kSimdPrefix, kExprS8x16Shuffle,
+  0x04, 0x10, 0x01, 0x00, 0x04, 0x04, 0x04, 0x04,  // i8x16.shuffle
+  kSimdPrefix, kExprI8x16Shuffle,
   0x04, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00,
-  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  // s8x16.shuffle
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  // i8x16.shuffle
   kSimdPrefix, kExprI8x16LeU,  // i8x16.le_u
   kSimdPrefix, kExprV8x16AnyTrue,  // v8x16.any_true
   kExprMemoryGrow, 0x00,  // memory.grow
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1074586.js b/deps/v8/test/mjsunit/regress/wasm/regress-1074586.js
index ae25e3c261..eec0a46432 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-1074586.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1074586.js
@@ -12,7 +12,7 @@ builder.addGlobal(kWasmI32, 1);
 const sig = builder.addType(makeSig([kWasmI32, kWasmI64, kWasmI64, kWasmI64], [kWasmF32]));
 // Generate function 1 (out of 3).
 builder.addFunction(undefined, sig)
-  .addLocals({i32_count: 57}).addLocals({i64_count: 11})
+  .addLocals(kWasmI32, 57).addLocals(kWasmI64, 11)
   .addBodyWithEnd([
 // signature: f_illl
 // body:
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1075953.js b/deps/v8/test/mjsunit/regress/wasm/regress-1075953.js
index 12f8ba661a..413630d1b0 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-1075953.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1075953.js
@@ -11,7 +11,7 @@ builder.addMemory(1, 1, false, true);
 const sig = builder.addType(makeSig([], [kWasmI32]));
 
 builder.addFunction(undefined, sig)
-  .addLocals({i32_count: 1002}).addLocals({i64_count: 3})
+  .addLocals(kWasmI32, 1002).addLocals(kWasmI64, 3)
   .addBodyWithEnd([
 // signature: i_v
 // body:
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1079449.js b/deps/v8/test/mjsunit/regress/wasm/regress-1079449.js
index 65e964552d..c7e63244d1 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-1079449.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1079449.js
@@ -16,10 +16,10 @@ const sig = builder.addType(makeSig(
     [kWasmI64]));
 // Generate function 2 (out of 3).
 builder.addFunction(undefined, sig)
-    .addLocals({f32_count: 10})
-    .addLocals({i32_count: 4})
-    .addLocals({f64_count: 1})
-    .addLocals({i32_count: 15})
+    .addLocals(kWasmF32, 10)
+    .addLocals(kWasmI32, 4)
+    .addLocals(kWasmF64, 1)
+    .addLocals(kWasmI32, 15)
     .addBodyWithEnd([
       // signature: v_liliiiiiilll
       // body:
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-10831.js b/deps/v8/test/mjsunit/regress/wasm/regress-10831.js
new file mode 100644
index 0000000000..0f562ee87d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-10831.js
@@ -0,0 +1,47 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-simd --enable-sse3 --enable-ssse3 --enable-sse4-1
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+// This test is shrunk from a test case provided at https://crbug.com/v8/10831.
+// This exercises a aligned-load bug in ia32. Some SIMD operations were using
+// instructions that required aligned operands (like movaps and movapd), but we
+// don't have the right memory alignment yet, see https://crbug.com/v8/9198,
+// resulting in a SIGSEGV when running the generated code.
+const builder = new WasmModuleBuilder();
+builder.addType(makeSig([], [kWasmI32]));
+// Generate function 1 (out of 1).
+builder.addFunction(undefined, 0 /* sig */)
+  .addBodyWithEnd([
+// signature: i_v
+// body:
+kExprI32Const, 0xfc, 0xb6, 0xed, 0x02,  // i32.const
+kSimdPrefix, kExprI8x16Splat,  // i8x16.splat
+kExprI32Const, 0xfc, 0x00,  // i32.const
+kSimdPrefix, kExprI8x16Splat,  // i8x16.splat
+kSimdPrefix, kExprI64x2Sub, 0x01,  // i64x2.sub
+kExprI32Const, 0x00,  // i32.const
+kSimdPrefix, kExprI8x16Splat,  // i8x16.splat
+kExprI32Const, 0x81, 0x96, 0xf0, 0xe3, 0x07,  // i32.const
+kSimdPrefix, kExprI8x16Splat,  // i8x16.splat
+kSimdPrefix, kExprF64x2Max, 0x01,  // f64x2.max
+kSimdPrefix, kExprI64x2Sub, 0x01,  // i64x2.sub
+kExprI32Const, 0x00,  // i32.const
+kSimdPrefix, kExprI8x16Splat,  // i8x16.splat
+kExprI32Const, 0x00,  // i32.const
+kExprI32Const, 0x0b,  // i32.const
+kExprI32LtU,  // i32.lt_u
+kSimdPrefix, kExprI8x16ReplaceLane, 0x00,  // i8x16.replace_lane
+kExprI32Const, 0xfc, 0xf8, 0x01,  // i32.const
+kSimdPrefix, kExprI8x16Splat,  // i8x16.splat
+kSimdPrefix, kExprF64x2Max, 0x01,  // f64x2.max
+kSimdPrefix, kExprI16x8MaxS, 0x01,  // i16x8.max_s
+kSimdPrefix, kExprV8x16AllTrue,  // v8x16.all_true
+kExprEnd,  // end @70
+]);
+builder.addExport('main', 0);
+const instance = builder.instantiate();
+print(instance.exports.main());
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-10898.js b/deps/v8/test/mjsunit/regress/wasm/regress-10898.js
new file mode 100644
index 0000000000..61c8c72104
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-10898.js
@@ -0,0 +1,44 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-staging
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(1, 1, false, true);
+builder.addDataSegment(2, [0x12, 0x00, 0x1c]);
+builder.addDataSegment(17,
+    [0x00, 0x00, 0x96, 0x00, 0x00, 0x00, 0xc2, 0x00, 0xb33, 0x03, 0xf6, 0x0e]);
+builder.addDataSegment(41,
+    [0x00, 0xdb, 0xa6, 0xa6, 0x00, 0xe9, 0x1c, 0x06, 0xac]);
+builder.addDataSegment(57, [0x00, 0x00, 0x00, 0x00, 0xda, 0xc0, 0xbe]);
+builder.addType(makeSig([kWasmI32], [kWasmI32]));
+builder.addType(makeSig([kWasmF32], [kWasmF32]));
+builder.addType(makeSig([kWasmF64], [kWasmF64]));
+// Generate function 1 (out of 3).
+builder.addFunction(undefined, 0 /* sig */)
+  .addBodyWithEnd([
+// signature: i_i
+// body:
+kExprF32Const, 0x00, 0x00, 0x00, 0x00,  // f32.const
+kExprF32Const, 0x00, 0x00, 0x00, 0x00,  // f32.const
+kExprF32Le,  // f32.le
+kExprLocalTee, 0x00,  // local.tee
+kExprI32Const, 0xff, 0x00,  // i32.const
+kAtomicPrefix, kExprAtomicNotify, 0x02, 0x03,  // atomic.notify
+kExprI32LoadMem16S, 0x00, 0x02,  // i32.load16_s
+kExprIf, kWasmStmt,  // if @28
+  kExprLocalGet, 0x00,  // local.get
+  kExprReturn,  // return
+kExprElse,  // else @33
+  kExprUnreachable,  // unreachable
+  kExprEnd,  // end @35
+kExprUnreachable,  // unreachable
+kExprEnd,  // end @37
+]);
+builder.addExport('func_194', 0);
+let instance = builder.instantiate();
+
+assertEquals(1, instance.exports.func_194(0));
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1116019.js b/deps/v8/test/mjsunit/regress/wasm/regress-1116019.js
index e803e08f27..e37a6da8c9 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-1116019.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1116019.js
@@ -15,7 +15,7 @@ builder.addFunction(undefined, 0 /* sig */)
 // signature: i_v
 // body:
 kExprI32Const, 0x00,  // i32.const
-kSimdPrefix, kExprI16x8Load8x8U, 0x03, 0xff, 0xff, 0x3f,  // i16x8.load8x8_u
+kSimdPrefix, kExprS128Load8x8U, 0x03, 0xff, 0xff, 0x3f,  // i16x8.load8x8_u
 kSimdPrefix, kExprI16x8ExtractLaneS, 0,
 kExprEnd,  // end @371
 ]).exportAs('main');
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1125951.js b/deps/v8/test/mjsunit/regress/wasm/regress-1125951.js
new file mode 100644
index 0000000000..74d4c67ec3
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1125951.js
@@ -0,0 +1,20 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --liftoff --no-wasm-tier-up --print-code --wasm-staging
+// Flags: --experimental-wasm-threads
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function testPrintCode() {
+  let builder = new WasmModuleBuilder();
+  builder.addMemory(1, undefined, false);
+  builder
+      .addFunction('main', makeSig([kWasmI32, kWasmI32, kWasmF64], [kWasmI32]))
+      .addBody([
+        kExprLocalGet, 0, kExprLocalGet, 1, kExprI64UConvertI32, kExprLocalGet,
+        2, kExprI64SConvertF64, kAtomicPrefix, kExprI64AtomicWait, 0, 0
+      ]);
+  builder.instantiate();
+})();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1137608.js b/deps/v8/test/mjsunit/regress/wasm/regress-1137608.js
new file mode 100644
index 0000000000..5011dced2f
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1137608.js
@@ -0,0 +1,46 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --no-liftoff --experimental-wasm-return-call --experimental-wasm-threads
+
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function Regress1137608() {
+  print(arguments.callee.name);
+  let builder = new WasmModuleBuilder();
+  let sig0 = builder.addType(kSig_i_iii);
+  let sig1 = builder.addType(makeSig([kWasmF64, kWasmF64, kWasmI32,
+        kWasmI32, kWasmI32, kWasmF32, kWasmI32, kWasmF64, kWasmI32, kWasmF32,
+        kWasmI32, kWasmF32, kWasmI32, kWasmF64, kWasmI32], [kWasmI32]));
+  let main = builder.addFunction("main", sig0)
+      .addBody([
+        kExprI64Const, 0,
+        kExprF64UConvertI64,
+        kExprF64Const, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x00, 0x00,
+        kExprF64Const, 0x30, 0x30, 0x30, 0x00, 0x00, 0x00, 0x00, 0x00,
+        kExprF64Mul,
+        kExprI32Const, 0,
+        kExprF64Const, 0x30, 0x30, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        kExprF64StoreMem, 0x00, 0xb0, 0xe0, 0xc0, 0x81, 0x03,
+        kExprI32Const, 0,
+        kExprI32Const, 0,
+        kExprI32Const, 0,
+        kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+        kExprI32Const, 0,
+        kExprF64Const, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        kExprI32Const, 0,
+        kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+        kExprI32Const, 0,
+        kExprF32Const, 0x00, 0x00, 0x00, 0x00,
+        kExprI32Const, 0,
+        kExprF64Const, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        kExprI32Const, 0,
+        kExprI32Const, 2,
+        kExprReturnCallIndirect, sig1, kTableZero]).exportFunc();
+  builder.addFunction("f", sig1).addBody([kExprI32Const, 0]);
+  builder.addTable(kWasmAnyFunc, 4, 4);
+  builder.addMemory(16, 32, false, true);
+  let module = new WebAssembly.Module(builder.toBuffer());
+  let instance = new WebAssembly.Instance(module);
+})();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-1140549.js b/deps/v8/test/mjsunit/regress/wasm/regress-1140549.js
new file mode 100644
index 0000000000..65191e1962
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-1140549.js
@@ -0,0 +1,25 @@
+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-staging
+
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+const builder = new WasmModuleBuilder();
+builder.addMemory(16, 32, false, true);
+builder.addType(makeSig([], []));
+builder.addFunction(undefined, 0 /* sig */)
+  .addBodyWithEnd([
+// signature: v_v
+// body:
+kExprI32Const, 0x00,
+kExprI32Const, 0x00,
+kExprI32Const, 0x00,
+kAtomicPrefix, kExprI32AtomicCompareExchange8U, 0x00, 0xc3, 0x01,
+kExprDrop,
+kExprEnd,  // end @193
+]);
+builder.addExport('main', 0);
+const instance = builder.instantiate();
+print(instance.exports.main(1, 2, 3));
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-666741.js b/deps/v8/test/mjsunit/regress/wasm/regress-666741.js
index 0f9ae9a607..2fff1bec79 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-666741.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-666741.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
-// Flags: --random-seed=-1101427159 --enable-slow-asserts --expose-wasm
+// Flags: --enable-slow-asserts --expose-wasm
 
 (function __f_7() {
   assertThrows(() => new WebAssembly.Memory({initial: 79199}), RangeError);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7508.js b/deps/v8/test/mjsunit/regress/wasm/regress-7508.js
index 1c02060957..4b7af2a32c 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-7508.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-7508.js
@@ -5,7 +5,7 @@
 load('test/mjsunit/wasm/wasm-module-builder.js');
 
 const builder = new WasmModuleBuilder();
-builder.addFunction(undefined, kSig_v_v).addLocals({i64_count: 1}).addBody([
+builder.addFunction(undefined, kSig_v_v).addLocals(kWasmI64, 1).addBody([
   kExprI64Const, 0xeb,     0xd7, 0xaf, 0xdf,
   0xbe,          0xfd,     0xfa, 0xf5, 0x6b,  // i64.const
   kExprI32Const, 0,                           // i32.const
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7565.js b/deps/v8/test/mjsunit/regress/wasm/regress-7565.js
index 3b97fe8615..7b6e00a867 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-7565.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-7565.js
@@ -6,7 +6,7 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
 
 const builder = new WasmModuleBuilder();
 sig0 = makeSig([], [kWasmI32]);
-builder.addFunction(undefined, sig0).addLocals({i64_count: 1}).addBody([
+builder.addFunction(undefined, sig0).addLocals(kWasmI64, 1).addBody([
   kExprLoop, kWasmI32,                    // loop i32
   kExprF32Const, 0x00, 0x00, 0x00, 0x00,  // f32.const 0      --> f32:0
   kExprLocalGet, 0x00,                    // get_local 0      --> i64:0
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7579.js b/deps/v8/test/mjsunit/regress/wasm/regress-7579.js
index da774b00f1..bd0d2d7cd3 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-7579.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-7579.js
@@ -49,7 +49,7 @@ assertEquals(1, instance.exports.main());
 
 const builder2 = new WasmModuleBuilder();
 sig0 = makeSig([], [kWasmI32]);
-builder2.addFunction(undefined, sig0).addLocals({i64_count: 1}).addBody([
+builder2.addFunction(undefined, sig0).addLocals(kWasmI64, 1).addBody([
   kExprLoop, kWasmI32,     // loop i32
   kExprLocalGet, 0,        // get_local 3
   kExprF32SConvertI64,     // f32.sconvert/i64
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-763697.js b/deps/v8/test/mjsunit/regress/wasm/regress-763697.js
index 5f36d42c8d..f9da32a694 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-763697.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-763697.js
@@ -9,6 +9,6 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
 let builder = new WasmModuleBuilder();
     builder.addFunction("main", kSig_i_i)
       .addBody([kExprLocalGet, 0])
-      .addLocals({s128_count: 1});
+      .addLocals(kWasmS128, 1)
 
   assertFalse(WebAssembly.validate(builder.toBuffer()));
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-7785.js b/deps/v8/test/mjsunit/regress/wasm/regress-7785.js
index c387342f4d..f392ff3f3d 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-7785.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-7785.js
@@ -2,7 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --experimental-wasm-reftypes
+// The test needs --wasm-tier-up because we can't serialize and deserialize
+// Liftoff code.
+// Flags: --allow-natives-syntax --experimental-wasm-reftypes --wasm-tier-up
 
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-808848.js b/deps/v8/test/mjsunit/regress/wasm/regress-808848.js
index 21374e9cff..a911eba847 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-808848.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-808848.js
@@ -41,7 +41,7 @@ builder.addImport('mod', 'get', kSig_i_v);
 builder.addImport('mod', 'call', kSig_v_i);
 builder.
   addFunction('main', kSig_v_v).
-  addLocals({i32_count: kNumLocals}).
+  addLocals(kWasmI32, kNumLocals).
   addBody(body).
   exportAs('main');
 let m1_bytes = builder.toBuffer();
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-819869.js b/deps/v8/test/mjsunit/regress/wasm/regress-819869.js
index a32928ab0c..1682b1f173 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-819869.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-819869.js
@@ -6,6 +6,6 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
 
 var builder = new WasmModuleBuilder();
 builder.addFunction(undefined, kSig_i_i)
-    .addLocals({i32_count: 0xffffffff})
+    .addLocals(kWasmI32, 0xffffffff)
     .addBody([]);
 assertThrows(() => builder.instantiate(), WebAssembly.CompileError);
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-854050.js b/deps/v8/test/mjsunit/regress/wasm/regress-854050.js
index 7130595870..bf170c5d63 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-854050.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-854050.js
@@ -6,7 +6,7 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
 
 const builder = new WasmModuleBuilder();
 builder.addFunction(undefined, makeSig([kWasmI32, kWasmF32], []))
-    .addLocals({i32_count: 7})
+    .addLocals(kWasmI32, 7)
     .addBody([
       kExprLocalGet,    0,          // get_local
       kExprI32Const,    0,          // i32.const 0
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-864509.js b/deps/v8/test/mjsunit/regress/wasm/regress-864509.js
index b18c6619d4..3310eca69f 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-864509.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-864509.js
@@ -32,7 +32,7 @@ const gen_i32_code = [
   kExprI32Const, 1,  // i32.const 1
   kExprI32Add        // i32.add     --> 2nd param
 ];
-builder.addFunction(undefined, kSig_v_v).addLocals({i32_count: 1}).addBody([
+builder.addFunction(undefined, kSig_v_v).addLocals(kWasmI32, 1).addBody([
   // Generate six values on the stack, then six more to force the other six on
   // the stack.
   ...wasmI32Const(0),    // i32.const 0
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-9017.js b/deps/v8/test/mjsunit/regress/wasm/regress-9017.js
index 7a8930a146..4fb790ec73 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-9017.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-9017.js
@@ -16,7 +16,7 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
 var builder = new WasmModuleBuilder();
 
 var func_idx = builder.addFunction('helper', kSig_i_v)
-    .addLocals({i32_count: 1})
+    .addLocals(kWasmI32, 1)
     .addBody([
         kExprI32Const, 0x01,
     ]).index;
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-905815.js b/deps/v8/test/mjsunit/regress/wasm/regress-905815.js
index b49881f472..21f32180bd 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-905815.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-905815.js
@@ -13,7 +13,7 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
         kExprEnd,   // @1
     ]);
   builder.addFunction(undefined, 1 /* sig */)
-    .addLocals({i32_count: 65})
+    .addLocals(kWasmI32, 65)
     .addBodyWithEnd([
         kExprLoop, kWasmStmt,   // @3
         kSimdPrefix,
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-910824.js b/deps/v8/test/mjsunit/regress/wasm/regress-910824.js
index 6101f8ca81..6a2dac79e5 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-910824.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-910824.js
@@ -9,7 +9,7 @@ builder.addGlobal(kWasmI32, 1);
 builder.addGlobal(kWasmF32, 1);
 builder.addType(makeSig([kWasmI32, kWasmF32, kWasmF32, kWasmF64], [kWasmI32]));
 builder.addFunction(undefined, 0 /* sig */)
-  .addLocals({i32_count: 504})
+  .addLocals(kWasmI32, 504)
   .addBody([
 kExprGlobalGet, 0x00,
 kExprLocalSet, 0x04,
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-917588.js b/deps/v8/test/mjsunit/regress/wasm/regress-917588.js
index b07814415e..2e75cdfe9d 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-917588.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-917588.js
@@ -7,7 +7,7 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
 const builder = new WasmModuleBuilder();
 const sig = builder.addType(makeSig([], [kWasmF64]));
 builder.addFunction(undefined, sig)
-  .addLocals({f32_count: 5}).addLocals({f64_count: 3})
+  .addLocals(kWasmF32, 5).addLocals(kWasmF64, 3)
   .addBody([
 kExprBlock, kWasmF64,
   kExprF64Const, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0, 0x3f,
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-918284.js b/deps/v8/test/mjsunit/regress/wasm/regress-918284.js
index 16de9caabd..3eb631d381 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-918284.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-918284.js
@@ -6,7 +6,7 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
 
 const builder = new WasmModuleBuilder();
 builder.addFunction(undefined, kSig_i_i)
-  .addLocals({i32_count: 7})
+  .addLocals(kWasmI32, 7)
   .addBody([
     kExprI32Const, 0,
     kExprIf, kWasmI32,   // @11 i32
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-918917.js b/deps/v8/test/mjsunit/regress/wasm/regress-918917.js
index 3660244cda..8f9d38eacc 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-918917.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-918917.js
@@ -6,7 +6,7 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
 
 const builder = new WasmModuleBuilder();
 builder.addFunction(undefined, kSig_v_v)
-  .addLocals({i32_count: 1}).addLocals({f32_count: 1}).addLocals({f64_count: 1})
+  .addLocals(kWasmI32, 1).addLocals(kWasmF32, 1).addLocals(kWasmF64, 1)
   .addBody([
 kExprLocalGet, 1,
 kExprLocalGet, 2,
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-919308.js b/deps/v8/test/mjsunit/regress/wasm/regress-919308.js
index e2f0426702..8d498939a8 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-919308.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-919308.js
@@ -6,7 +6,7 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
 
 const builder = new WasmModuleBuilder();
 builder.addFunction(undefined, kSig_i_i)
-  .addLocals({i32_count: 5})
+  .addLocals(kWasmI32, 5)
   .addBody([
     kExprLocalGet, 0,    // --> 1
     kExprIf, kWasmI32,
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-922432.js b/deps/v8/test/mjsunit/regress/wasm/regress-922432.js
index d5aee0d332..26a004652a 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-922432.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-922432.js
@@ -9,7 +9,7 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
 (function TestTruncatedBrOnExnInLoop() {
   let builder = new WasmModuleBuilder();
   let fun = builder.addFunction(undefined, kSig_v_v)
-      .addLocals({except_count: 1})
+      .addLocals(kWasmExnRef, 1)
       .addBody([
         kExprLoop, kWasmStmt,
           kExprLocalGet, 0,
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-922670.js b/deps/v8/test/mjsunit/regress/wasm/regress-922670.js
index 96a17bebba..e9dd2159b9 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-922670.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-922670.js
@@ -7,7 +7,7 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
 const builder = new WasmModuleBuilder();
 const sig = builder.addType(makeSig([kWasmI32], []));
 builder.addFunction(undefined, sig)
-  .addLocals({i64_count: 1})
+  .addLocals(kWasmI64, 1)
   .addBody([
     kExprLoop, kWasmI32,
       kExprLocalGet, 1,
diff --git a/deps/v8/test/mjsunit/regress/wasm/regress-922933.js b/deps/v8/test/mjsunit/regress/wasm/regress-922933.js
index 6d0286d95a..aabe001392 100644
--- a/deps/v8/test/mjsunit/regress/wasm/regress-922933.js
+++ b/deps/v8/test/mjsunit/regress/wasm/regress-922933.js
@@ -7,7 +7,7 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
 const builder = new WasmModuleBuilder();
 const sig = builder.addType(makeSig([kWasmI64], [kWasmI64]));
 builder.addFunction(undefined, sig)
-  .addLocals({i32_count: 14}).addLocals({i64_count: 17}).addLocals({f32_count: 14})
+  .addLocals(kWasmI32, 14).addLocals(kWasmI64, 17).addLocals(kWasmF32, 14)
   .addBody([
     kExprBlock, kWasmStmt,
       kExprBr, 0x00,