1 files changed, 29 insertions, 25 deletions

diff --git a/chromium/v8/src/objects/elements.cc b/chromium/v8/src/objects/elements.cc
index d0c680d287d..7994c12ec1a 100644
--- a/chromium/v8/src/objects/elements.cc
+++ b/chromium/v8/src/objects/elements.cc
@@ -22,6 +22,8 @@
 #include "src/objects/slots-atomic-inl.h"
 #include "src/objects/slots.h"
 #include "src/utils/utils.h"
+#include "torque-generated/exported-class-definitions-tq-inl.h"
+#include "torque-generated/exported-class-definitions-tq.h"
 
 // Each concrete ElementsAccessor can handle exactly one ElementsKind,
 // several abstract ElementsAccessor classes are used to allow sharing
@@ -443,6 +445,8 @@ void CopyDictionaryToDoubleElements(Isolate* isolate, FixedArrayBase from_base,
 
 void SortIndices(Isolate* isolate, Handle<FixedArray> indices,
                  uint32_t sort_size) {
+  if (sort_size == 0) return;
+
   // Use AtomicSlot wrapper to ensure that std::sort uses atomic load and
   // store operations that are safe for concurrent marking.
   AtomicSlot start(indices->GetFirstElementAddress());
@@ -3882,11 +3886,11 @@ class SloppyArgumentsElementsAccessor
                                 InternalIndex entry) {
     Handle<SloppyArgumentsElements> elements(
         SloppyArgumentsElements::cast(parameters), isolate);
-    uint32_t length = elements->parameter_map_length();
+    uint32_t length = elements->length();
     if (entry.as_uint32() < length) {
       // Read context mapped entry.
       DisallowHeapAllocation no_gc;
-      Object probe = elements->get_mapped_entry(entry.as_uint32());
+      Object probe = elements->mapped_entries(entry.as_uint32());
       DCHECK(!probe.IsTheHole(isolate));
       Context context = elements->context();
       int context_entry = Smi::ToInt(probe);
@@ -3918,13 +3922,13 @@ class SloppyArgumentsElementsAccessor
   static inline void SetImpl(FixedArrayBase store, InternalIndex entry,
                              Object value) {
     SloppyArgumentsElements elements = SloppyArgumentsElements::cast(store);
-    uint32_t length = elements.parameter_map_length();
+    uint32_t length = elements.length();
     if (entry.as_uint32() < length) {
       // Store context mapped entry.
       DisallowHeapAllocation no_gc;
-      Object probe = elements.get_mapped_entry(entry.as_uint32());
+      Object probe = elements.mapped_entries(entry.as_uint32());
       DCHECK(!probe.IsTheHole());
-      Context context = elements.context();
+      Context context = Context::cast(elements.context());
       int context_entry = Smi::ToInt(probe);
       DCHECK(!context.get(context_entry).IsTheHole());
       context.set(context_entry, value);
@@ -3935,7 +3939,7 @@ class SloppyArgumentsElementsAccessor
           ArgumentsAccessor::GetRaw(arguments, entry.adjust_down(length));
       if (current.IsAliasedArgumentsEntry()) {
         AliasedArgumentsEntry alias = AliasedArgumentsEntry::cast(current);
-        Context context = elements.context();
+        Context context = Context::cast(elements.context());
         int context_entry = alias.aliased_context_slot();
         DCHECK(!context.get(context_entry).IsTheHole());
         context.set(context_entry, value);
@@ -3955,7 +3959,7 @@ class SloppyArgumentsElementsAccessor
   static uint32_t GetCapacityImpl(JSObject holder, FixedArrayBase store) {
     SloppyArgumentsElements elements = SloppyArgumentsElements::cast(store);
     FixedArray arguments = elements.arguments();
-    return elements.parameter_map_length() +
+    return elements.length() +
            ArgumentsAccessor::GetCapacityImpl(holder, arguments);
   }
 
@@ -3967,7 +3971,7 @@ class SloppyArgumentsElementsAccessor
     size_t max_entries =
         ArgumentsAccessor::GetMaxNumberOfEntries(holder, arguments);
     DCHECK_LE(max_entries, std::numeric_limits<uint32_t>::max());
-    return elements.parameter_map_length() + static_cast<uint32_t>(max_entries);
+    return elements.length() + static_cast<uint32_t>(max_entries);
   }
 
   static uint32_t NumberOfElementsImpl(JSObject receiver,
@@ -3977,7 +3981,7 @@ class SloppyArgumentsElementsAccessor
         SloppyArgumentsElements::cast(backing_store);
     FixedArrayBase arguments = elements.arguments();
     uint32_t nof_elements = 0;
-    uint32_t length = elements.parameter_map_length();
+    uint32_t length = elements.length();
     for (uint32_t index = 0; index < length; index++) {
       if (HasParameterMapArg(isolate, elements, index)) nof_elements++;
     }
@@ -4004,7 +4008,7 @@ class SloppyArgumentsElementsAccessor
                            InternalIndex entry) {
     SloppyArgumentsElements elements =
         SloppyArgumentsElements::cast(parameters);
-    uint32_t length = elements.parameter_map_length();
+    uint32_t length = elements.length();
     if (entry.raw_value() < length) {
       return HasParameterMapArg(isolate, elements, entry.raw_value());
     }
@@ -4035,13 +4039,13 @@ class SloppyArgumentsElementsAccessor
     if (entry.is_not_found()) return entry;
     // Arguments entries could overlap with the dictionary entries, hence offset
     // them by the number of context mapped entries.
-    return entry.adjust_up(elements.parameter_map_length());
+    return entry.adjust_up(elements.length());
   }
 
   static PropertyDetails GetDetailsImpl(JSObject holder, InternalIndex entry) {
     SloppyArgumentsElements elements =
         SloppyArgumentsElements::cast(holder.elements());
-    uint32_t length = elements.parameter_map_length();
+    uint32_t length = elements.length();
     if (entry.as_uint32() < length) {
       return PropertyDetails(kData, NONE, PropertyCellType::kNoCell);
     }
@@ -4053,16 +4057,16 @@ class SloppyArgumentsElementsAccessor
   static bool HasParameterMapArg(Isolate* isolate,
                                  SloppyArgumentsElements elements,
                                  size_t index) {
-    uint32_t length = elements.parameter_map_length();
+    uint32_t length = elements.length();
     if (index >= length) return false;
-    return !elements.get_mapped_entry(static_cast<uint32_t>(index))
+    return !elements.mapped_entries(static_cast<uint32_t>(index))
                 .IsTheHole(isolate);
   }
 
   static void DeleteImpl(Handle<JSObject> obj, InternalIndex entry) {
     Handle<SloppyArgumentsElements> elements(
         SloppyArgumentsElements::cast(obj->elements()), obj->GetIsolate());
-    uint32_t length = elements->parameter_map_length();
+    uint32_t length = elements->length();
     InternalIndex delete_or_entry = entry;
     if (entry.as_uint32() < length) {
       delete_or_entry = InternalIndex::NotFound();
@@ -4071,8 +4075,8 @@ class SloppyArgumentsElementsAccessor
     // SloppyDeleteImpl allocates a new dictionary elements store. For making
     // heap verification happy we postpone clearing out the mapped entry.
     if (entry.as_uint32() < length) {
-      elements->set_mapped_entry(entry.as_uint32(),
-                                 obj->GetReadOnlyRoots().the_hole_value());
+      elements->set_mapped_entries(entry.as_uint32(),
+                                   obj->GetReadOnlyRoots().the_hole_value());
     }
   }
 
@@ -4107,10 +4111,10 @@ class SloppyArgumentsElementsAccessor
       uint32_t insertion_index = 0) {
     Handle<SloppyArgumentsElements> elements =
         Handle<SloppyArgumentsElements>::cast(backing_store);
-    uint32_t length = elements->parameter_map_length();
+    uint32_t length = elements->length();
 
     for (uint32_t i = 0; i < length; ++i) {
-      if (elements->get_mapped_entry(i).IsTheHole(isolate)) continue;
+      if (elements->mapped_entries(i).IsTheHole(isolate)) continue;
       if (convert == GetKeysConversion::kConvertToString) {
         Handle<String> index_string = isolate->factory()->Uint32ToString(i);
         list->set(insertion_index, *index_string);
@@ -4238,7 +4242,7 @@ class SlowSloppyArgumentsElementsAccessor
     Isolate* isolate = obj->GetIsolate();
     Handle<NumberDictionary> dict(NumberDictionary::cast(elements->arguments()),
                                   isolate);
-    uint32_t length = elements->parameter_map_length();
+    uint32_t length = elements->length();
     dict =
         NumberDictionary::DeleteEntry(isolate, dict, entry.adjust_down(length));
     elements->set_arguments(*dict);
@@ -4271,9 +4275,9 @@ class SlowSloppyArgumentsElementsAccessor
     Isolate* isolate = object->GetIsolate();
     Handle<SloppyArgumentsElements> elements =
         Handle<SloppyArgumentsElements>::cast(store);
-    uint32_t length = elements->parameter_map_length();
+    uint32_t length = elements->length();
     if (entry.as_uint32() < length) {
-      Object probe = elements->get_mapped_entry(entry.as_uint32());
+      Object probe = elements->mapped_entries(entry.as_uint32());
       DCHECK(!probe.IsTheHole(isolate));
       Context context = elements->context();
       int context_entry = Smi::ToInt(probe);
@@ -4281,8 +4285,8 @@ class SlowSloppyArgumentsElementsAccessor
       context.set(context_entry, *value);
 
       // Redefining attributes of an aliased element destroys fast aliasing.
-      elements->set_mapped_entry(entry.as_uint32(),
-                                 ReadOnlyRoots(isolate).the_hole_value());
+      elements->set_mapped_entries(entry.as_uint32(),
+                                   ReadOnlyRoots(isolate).the_hole_value());
       // For elements that are still writable we re-establish slow aliasing.
       if ((attributes & READ_ONLY) == 0) {
         value = isolate->factory()->NewAliasedArgumentsEntry(context_entry);
@@ -4339,7 +4343,7 @@ class FastSloppyArgumentsElementsAccessor
     // kMaxUInt32 indicates that a context mapped element got deleted. In this
     // case we only normalize the elements (aka. migrate to SLOW_SLOPPY).
     if (entry->is_not_found()) return dictionary;
-    uint32_t length = elements->parameter_map_length();
+    uint32_t length = elements->length();
     if (entry->as_uint32() >= length) {
       *entry =
           dictionary