1 files changed, 90 insertions, 299 deletions

diff --git a/deps/v8/src/objects-inl.h b/deps/v8/src/objects-inl.h
index e0a9a8becf6..05b2b9653fd 100644
--- a/deps/v8/src/objects-inl.h
+++ b/deps/v8/src/objects-inl.h
@@ -29,9 +29,11 @@
 #include "src/keys.h"
 #include "src/layout-descriptor-inl.h"
 #include "src/lookup-cache-inl.h"
-#include "src/lookup.h"
+#include "src/lookup-inl.h"
+#include "src/maybe-handles-inl.h"
 #include "src/objects/bigint.h"
 #include "src/objects/descriptor-array.h"
+#include "src/objects/js-proxy-inl.h"
 #include "src/objects/literal-objects.h"
 #include "src/objects/maybe-object-inl.h"
 #include "src/objects/regexp-match-info.h"
@@ -40,7 +42,7 @@
 #include "src/objects/templates.h"
 #include "src/property-details.h"
 #include "src/property.h"
-#include "src/prototype.h"
+#include "src/prototype-inl.h"
 #include "src/roots-inl.h"
 #include "src/transitions-inl.h"
 #include "src/v8memory.h"
@@ -71,100 +73,58 @@ int PropertyDetails::field_width_in_words() const {
   return representation().IsDouble() ? kDoubleSize / kPointerSize : 1;
 }
 
+namespace InstanceTypeChecker {
+
+// Define type checkers for classes with single instance type.
+INSTANCE_TYPE_CHECKERS_SINGLE(INSTANCE_TYPE_CHECKER);
+
+#define TYPED_ARRAY_INSTANCE_TYPE_CHECKER(Type, type, TYPE, ctype) \
+  INSTANCE_TYPE_CHECKER(Fixed##Type##Array, FIXED_##TYPE##_ARRAY_TYPE)
+TYPED_ARRAYS(TYPED_ARRAY_INSTANCE_TYPE_CHECKER)
+#undef TYPED_ARRAY_INSTANCE_TYPE_CHECKER
+
+#define STRUCT_INSTANCE_TYPE_CHECKER(NAME, Name, name) \
+  INSTANCE_TYPE_CHECKER(Name, NAME##_TYPE)
+STRUCT_LIST(STRUCT_INSTANCE_TYPE_CHECKER)
+#undef STRUCT_INSTANCE_TYPE_CHECKER
+
+// Define type checkers for classes with ranges of instance types.
+#define INSTANCE_TYPE_CHECKER_RANGE(type, first_instance_type, \
+                                    last_instance_type)        \
+  V8_INLINE bool Is##type(InstanceType instance_type) {        \
+    return instance_type >= first_instance_type &&             \
+           instance_type <= last_instance_type;                \
+  }
+INSTANCE_TYPE_CHECKERS_RANGE(INSTANCE_TYPE_CHECKER_RANGE);
+#undef INSTANCE_TYPE_CHECKER_RANGE
+
+V8_INLINE bool IsFixedArrayBase(InstanceType instance_type) {
+  return IsFixedArray(instance_type) || IsFixedDoubleArray(instance_type) ||
+         IsFixedTypedArrayBase(instance_type);
+}
+
+V8_INLINE bool IsHeapObject(InstanceType instance_type) { return true; }
+
+V8_INLINE bool IsInternalizedString(InstanceType instance_type) {
+  STATIC_ASSERT(kNotInternalizedTag != 0);
+  return (instance_type & (kIsNotStringMask | kIsNotInternalizedMask)) ==
+         (kStringTag | kInternalizedTag);
+}
+
+V8_INLINE bool IsJSObject(InstanceType instance_type) {
+  STATIC_ASSERT(LAST_TYPE == LAST_JS_OBJECT_TYPE);
+  return instance_type >= FIRST_JS_OBJECT_TYPE;
+}
+
+}  // namespace InstanceTypeChecker
+
 // TODO(v8:7786): For instance types that have a single map instance on the
 // roots, and when that map is a embedded in the binary, compare against the map
 // pointer rather than looking up the instance type.
-TYPE_CHECKER(AllocationSite, ALLOCATION_SITE_TYPE)
-TYPE_CHECKER(BigInt, BIGINT_TYPE)
-TYPE_CHECKER(ObjectBoilerplateDescription, OBJECT_BOILERPLATE_DESCRIPTION_TYPE)
-TYPE_CHECKER(BreakPoint, TUPLE2_TYPE)
-TYPE_CHECKER(BreakPointInfo, TUPLE2_TYPE)
-TYPE_CHECKER(ByteArray, BYTE_ARRAY_TYPE)
-TYPE_CHECKER(BytecodeArray, BYTECODE_ARRAY_TYPE)
-TYPE_CHECKER(CallHandlerInfo, CALL_HANDLER_INFO_TYPE)
-TYPE_CHECKER(Cell, CELL_TYPE)
-TYPE_CHECKER(Code, CODE_TYPE)
-TYPE_CHECKER(CodeDataContainer, CODE_DATA_CONTAINER_TYPE)
-TYPE_CHECKER(CoverageInfo, FIXED_ARRAY_TYPE)
-TYPE_CHECKER(DescriptorArray, DESCRIPTOR_ARRAY_TYPE)
-TYPE_CHECKER(EphemeronHashTable, EPHEMERON_HASH_TABLE_TYPE)
-TYPE_CHECKER(FeedbackCell, FEEDBACK_CELL_TYPE)
-TYPE_CHECKER(FeedbackMetadata, FEEDBACK_METADATA_TYPE)
-TYPE_CHECKER(FeedbackVector, FEEDBACK_VECTOR_TYPE)
-TYPE_CHECKER(FixedArrayExact, FIXED_ARRAY_TYPE)
-TYPE_CHECKER(FixedArrayOfWeakCells, FIXED_ARRAY_TYPE)
-TYPE_CHECKER(FixedDoubleArray, FIXED_DOUBLE_ARRAY_TYPE)
-TYPE_CHECKER(Foreign, FOREIGN_TYPE)
-TYPE_CHECKER(FreeSpace, FREE_SPACE_TYPE)
-TYPE_CHECKER(GlobalDictionary, GLOBAL_DICTIONARY_TYPE)
-TYPE_CHECKER(HeapNumber, HEAP_NUMBER_TYPE)
-TYPE_CHECKER(JSArgumentsObject, JS_ARGUMENTS_TYPE)
-TYPE_CHECKER(JSArray, JS_ARRAY_TYPE)
-TYPE_CHECKER(JSArrayBuffer, JS_ARRAY_BUFFER_TYPE)
-TYPE_CHECKER(JSArrayIterator, JS_ARRAY_ITERATOR_TYPE)
-TYPE_CHECKER(JSAsyncFromSyncIterator, JS_ASYNC_FROM_SYNC_ITERATOR_TYPE)
-TYPE_CHECKER(JSAsyncGeneratorObject, JS_ASYNC_GENERATOR_OBJECT_TYPE)
-TYPE_CHECKER(JSBoundFunction, JS_BOUND_FUNCTION_TYPE)
-TYPE_CHECKER(JSContextExtensionObject, JS_CONTEXT_EXTENSION_OBJECT_TYPE)
-TYPE_CHECKER(JSDataView, JS_DATA_VIEW_TYPE)
-TYPE_CHECKER(JSDate, JS_DATE_TYPE)
-TYPE_CHECKER(JSError, JS_ERROR_TYPE)
-TYPE_CHECKER(JSFunction, JS_FUNCTION_TYPE)
-TYPE_CHECKER(JSGlobalObject, JS_GLOBAL_OBJECT_TYPE)
-TYPE_CHECKER(JSMap, JS_MAP_TYPE)
-TYPE_CHECKER(JSMessageObject, JS_MESSAGE_OBJECT_TYPE)
-TYPE_CHECKER(JSModuleNamespace, JS_MODULE_NAMESPACE_TYPE)
-TYPE_CHECKER(JSPromise, JS_PROMISE_TYPE)
-TYPE_CHECKER(JSRegExp, JS_REGEXP_TYPE)
-TYPE_CHECKER(JSRegExpStringIterator, JS_REGEXP_STRING_ITERATOR_TYPE)
-TYPE_CHECKER(JSSet, JS_SET_TYPE)
-TYPE_CHECKER(JSStringIterator, JS_STRING_ITERATOR_TYPE)
-TYPE_CHECKER(JSTypedArray, JS_TYPED_ARRAY_TYPE)
-TYPE_CHECKER(JSValue, JS_VALUE_TYPE)
-TYPE_CHECKER(JSWeakMap, JS_WEAK_MAP_TYPE)
-TYPE_CHECKER(JSWeakSet, JS_WEAK_SET_TYPE)
-TYPE_CHECKER(Map, MAP_TYPE)
-TYPE_CHECKER(MutableHeapNumber, MUTABLE_HEAP_NUMBER_TYPE)
-TYPE_CHECKER(NameDictionary, NAME_DICTIONARY_TYPE)
-TYPE_CHECKER(NativeContext, NATIVE_CONTEXT_TYPE)
-TYPE_CHECKER(NumberDictionary, NUMBER_DICTIONARY_TYPE)
-TYPE_CHECKER(Oddball, ODDBALL_TYPE)
-TYPE_CHECKER(OrderedHashMap, ORDERED_HASH_MAP_TYPE)
-TYPE_CHECKER(OrderedHashSet, ORDERED_HASH_SET_TYPE)
-TYPE_CHECKER(PreParsedScopeData, PRE_PARSED_SCOPE_DATA_TYPE)
-TYPE_CHECKER(PropertyArray, PROPERTY_ARRAY_TYPE)
-TYPE_CHECKER(PropertyCell, PROPERTY_CELL_TYPE)
-TYPE_CHECKER(PropertyDescriptorObject, FIXED_ARRAY_TYPE)
-TYPE_CHECKER(ScopeInfo, SCOPE_INFO_TYPE)
-TYPE_CHECKER(ScriptContextTable, SCRIPT_CONTEXT_TABLE_TYPE)
-TYPE_CHECKER(SharedFunctionInfo, SHARED_FUNCTION_INFO_TYPE)
-TYPE_CHECKER(SimpleNumberDictionary, SIMPLE_NUMBER_DICTIONARY_TYPE)
-TYPE_CHECKER(SmallOrderedHashMap, SMALL_ORDERED_HASH_MAP_TYPE)
-TYPE_CHECKER(SmallOrderedHashSet, SMALL_ORDERED_HASH_SET_TYPE)
-TYPE_CHECKER(SourcePositionTableWithFrameCache, TUPLE2_TYPE)
-TYPE_CHECKER(StringTable, STRING_TABLE_TYPE)
-TYPE_CHECKER(Symbol, SYMBOL_TYPE)
-TYPE_CHECKER(TemplateObjectDescription, TUPLE2_TYPE)
-TYPE_CHECKER(TransitionArray, TRANSITION_ARRAY_TYPE)
-TYPE_CHECKER(UncompiledDataWithoutPreParsedScope,
-             UNCOMPILED_DATA_WITHOUT_PRE_PARSED_SCOPE_TYPE)
-TYPE_CHECKER(UncompiledDataWithPreParsedScope,
-             UNCOMPILED_DATA_WITH_PRE_PARSED_SCOPE_TYPE)
-TYPE_CHECKER(WasmGlobalObject, WASM_GLOBAL_TYPE)
-TYPE_CHECKER(WasmInstanceObject, WASM_INSTANCE_TYPE)
-TYPE_CHECKER(WasmMemoryObject, WASM_MEMORY_TYPE)
-TYPE_CHECKER(WasmModuleObject, WASM_MODULE_TYPE)
-TYPE_CHECKER(WasmTableObject, WASM_TABLE_TYPE)
-TYPE_CHECKER(WeakArrayList, WEAK_ARRAY_LIST_TYPE)
-TYPE_CHECKER(WeakCell, WEAK_CELL_TYPE)
-
-#ifdef V8_INTL_SUPPORT
-TYPE_CHECKER(JSLocale, JS_INTL_LOCALE_TYPE)
-TYPE_CHECKER(JSRelativeTimeFormat, JS_INTL_RELATIVE_TIME_FORMAT_TYPE)
-#endif  // V8_INTL_SUPPORT
-
-#define TYPED_ARRAY_TYPE_CHECKER(Type, type, TYPE, ctype, size) \
-  TYPE_CHECKER(Fixed##Type##Array, FIXED_##TYPE##_ARRAY_TYPE)
+INSTANCE_TYPE_CHECKERS(TYPE_CHECKER);
+
+#define TYPED_ARRAY_TYPE_CHECKER(Type, type, TYPE, ctype) \
+  TYPE_CHECKER(Fixed##Type##Array)
 TYPED_ARRAYS(TYPED_ARRAY_TYPE_CHECKER)
 #undef TYPED_ARRAY_TYPE_CHECKER
 
@@ -173,22 +133,6 @@ bool HeapObject::IsUncompiledData() const {
          IsUncompiledDataWithPreParsedScope();
 }
 
-bool HeapObject::IsFixedArrayBase() const {
-  return IsFixedArray() || IsFixedDoubleArray() || IsFixedTypedArrayBase();
-}
-
-bool HeapObject::IsFixedArray() const {
-  InstanceType instance_type = map()->instance_type();
-  return instance_type >= FIRST_FIXED_ARRAY_TYPE &&
-         instance_type <= LAST_FIXED_ARRAY_TYPE;
-}
-
-bool HeapObject::IsWeakFixedArray() const {
-  InstanceType instance_type = map()->instance_type();
-  return instance_type >= FIRST_WEAK_FIXED_ARRAY_TYPE &&
-         instance_type <= LAST_WEAK_FIXED_ARRAY_TYPE;
-}
-
 bool HeapObject::IsSloppyArgumentsElements() const {
   return IsFixedArrayExact();
 }
@@ -202,6 +146,10 @@ bool HeapObject::IsJSGeneratorObject() const {
          IsJSAsyncGeneratorObject();
 }
 
+bool HeapObject::IsDataHandler() const {
+  return IsLoadHandler() || IsStoreHandler();
+}
+
 bool HeapObject::IsClassBoilerplate() const { return IsFixedArrayExact(); }
 
 bool HeapObject::IsExternal(Isolate* isolate) const {
@@ -259,14 +207,6 @@ bool HeapObject::IsNullOrUndefined() const {
   return IsNullOrUndefined(GetReadOnlyRoots());
 }
 
-bool HeapObject::IsString() const {
-  return map()->instance_type() < FIRST_NONSTRING_TYPE;
-}
-
-bool HeapObject::IsName() const {
-  return map()->instance_type() <= LAST_NAME_TYPE;
-}
-
 bool HeapObject::IsUniqueName() const {
   return IsInternalizedString() || IsSymbol();
 }
@@ -288,13 +228,6 @@ bool HeapObject::IsTemplateInfo() const {
   return IsObjectTemplateInfo() || IsFunctionTemplateInfo();
 }
 
-bool HeapObject::IsInternalizedString() const {
-  uint32_t type = map()->instance_type();
-  STATIC_ASSERT(kNotInternalizedTag != 0);
-  return (type & (kIsNotStringMask | kIsNotInternalizedMask)) ==
-      (kStringTag | kInternalizedTag);
-}
-
 bool HeapObject::IsConsString() const {
   if (!IsString()) return false;
   return StringShape(String::cast(this)).IsCons();
@@ -353,51 +286,19 @@ bool HeapObject::IsFiller() const {
   return instance_type == FREE_SPACE_TYPE || instance_type == FILLER_TYPE;
 }
 
-bool HeapObject::IsFixedTypedArrayBase() const {
-  InstanceType instance_type = map()->instance_type();
-  return (instance_type >= FIRST_FIXED_TYPED_ARRAY_TYPE &&
-          instance_type <= LAST_FIXED_TYPED_ARRAY_TYPE);
-}
-
 bool HeapObject::IsJSReceiver() const {
   STATIC_ASSERT(LAST_JS_RECEIVER_TYPE == LAST_TYPE);
   return map()->instance_type() >= FIRST_JS_RECEIVER_TYPE;
 }
 
-bool HeapObject::IsJSObject() const {
-  STATIC_ASSERT(LAST_JS_OBJECT_TYPE == LAST_TYPE);
-  return map()->IsJSObjectMap();
-}
-
 bool HeapObject::IsJSProxy() const { return map()->IsJSProxyMap(); }
 
-bool HeapObject::IsJSMapIterator() const {
-  InstanceType instance_type = map()->instance_type();
-  STATIC_ASSERT(JS_MAP_KEY_ITERATOR_TYPE + 1 == JS_MAP_KEY_VALUE_ITERATOR_TYPE);
-  STATIC_ASSERT(JS_MAP_KEY_VALUE_ITERATOR_TYPE + 1 ==
-                JS_MAP_VALUE_ITERATOR_TYPE);
-  return (instance_type >= JS_MAP_KEY_ITERATOR_TYPE &&
-          instance_type <= JS_MAP_VALUE_ITERATOR_TYPE);
-}
-
-bool HeapObject::IsJSSetIterator() const {
-  InstanceType instance_type = map()->instance_type();
-  return (instance_type == JS_SET_VALUE_ITERATOR_TYPE ||
-          instance_type == JS_SET_KEY_VALUE_ITERATOR_TYPE);
-}
-
 bool HeapObject::IsJSWeakCollection() const {
   return IsJSWeakMap() || IsJSWeakSet();
 }
 
 bool HeapObject::IsJSCollection() const { return IsJSMap() || IsJSSet(); }
 
-bool HeapObject::IsMicrotask() const {
-  InstanceType instance_type = map()->instance_type();
-  return (instance_type >= FIRST_MICROTASK_TYPE &&
-          instance_type <= LAST_MICROTASK_TYPE);
-}
-
 bool HeapObject::IsPromiseReactionJobTask() const {
   return IsPromiseFulfillReactionJobTask() || IsPromiseRejectReactionJobTask();
 }
@@ -446,23 +347,12 @@ bool HeapObject::IsTemplateList() const {
 }
 
 bool HeapObject::IsDependentCode() const {
-  if (!IsFixedArrayExact()) return false;
-  // There's actually no way to see the difference between a fixed array and
-  // a dependent codes array.
+  if (!IsWeakFixedArray()) return false;
+  // There's actually no way to see the difference between a weak fixed array
+  // and a dependent codes array.
   return true;
 }
 
-bool HeapObject::IsContext() const {
-  int instance_type = map()->instance_type();
-  return instance_type >= FIRST_CONTEXT_TYPE &&
-         instance_type <= LAST_CONTEXT_TYPE;
-}
-
-template <>
-inline bool Is<JSFunction>(Object* obj) {
-  return obj->IsJSFunction();
-}
-
 bool HeapObject::IsAbstractCode() const {
   return IsBytecodeArray() || IsCode();
 }
@@ -500,18 +390,6 @@ bool HeapObject::IsJSArrayBufferView() const {
   return IsJSDataView() || IsJSTypedArray();
 }
 
-bool HeapObject::IsHashTable() const {
-  int instance_type = map()->instance_type();
-  return instance_type >= FIRST_HASH_TABLE_TYPE &&
-         instance_type <= LAST_HASH_TABLE_TYPE;
-}
-
-bool HeapObject::IsDictionary() const {
-  int instance_type = map()->instance_type();
-  return instance_type >= FIRST_DICTIONARY_TYPE &&
-         instance_type <= LAST_DICTIONARY_TYPE;
-}
-
 bool HeapObject::IsStringSet() const { return IsHashTable(); }
 
 bool HeapObject::IsObjectHashSet() const { return IsHashTable(); }
@@ -543,12 +421,6 @@ Maybe<bool> Object::IsArray(Handle<Object> object) {
   return JSProxy::IsArray(Handle<JSProxy>::cast(object));
 }
 
-bool HeapObject::IsJSGlobalProxy() const {
-  bool result = map()->instance_type() == JS_GLOBAL_PROXY_TYPE;
-  DCHECK(!result || map()->is_access_check_needed());
-  return result;
-}
-
 bool HeapObject::IsUndetectable() const { return map()->is_undetectable(); }
 
 bool HeapObject::IsAccessCheckNeeded() const {
@@ -576,9 +448,7 @@ bool HeapObject::IsStruct() const {
   bool Object::Is##Name() const {                                \
     return IsHeapObject() && HeapObject::cast(this)->Is##Name(); \
   }                                                              \
-  bool HeapObject::Is##Name() const {                            \
-    return map()->instance_type() == NAME##_TYPE;                \
-  }
+  TYPE_CHECKER(Name)
 STRUCT_LIST(MAKE_STRUCT_PREDICATE)
 #undef MAKE_STRUCT_PREDICATE
 
@@ -609,6 +479,7 @@ CAST_ACCESSOR(BigInt)
 CAST_ACCESSOR(ObjectBoilerplateDescription)
 CAST_ACCESSOR(Cell)
 CAST_ACCESSOR(ArrayBoilerplateDescription)
+CAST_ACCESSOR(DataHandler)
 CAST_ACCESSOR(DescriptorArray)
 CAST_ACCESSOR(EphemeronHashTable)
 CAST_ACCESSOR(EnumCache)
@@ -617,17 +488,14 @@ CAST_ACCESSOR(Foreign)
 CAST_ACCESSOR(GlobalDictionary)
 CAST_ACCESSOR(HeapObject)
 CAST_ACCESSOR(JSAsyncFromSyncIterator)
-CAST_ACCESSOR(JSAsyncGeneratorObject)
 CAST_ACCESSOR(JSBoundFunction)
 CAST_ACCESSOR(JSDataView)
 CAST_ACCESSOR(JSDate)
 CAST_ACCESSOR(JSFunction)
-CAST_ACCESSOR(JSGeneratorObject)
 CAST_ACCESSOR(JSGlobalObject)
 CAST_ACCESSOR(JSGlobalProxy)
 CAST_ACCESSOR(JSMessageObject)
 CAST_ACCESSOR(JSObject)
-CAST_ACCESSOR(JSProxy)
 CAST_ACCESSOR(JSReceiver)
 CAST_ACCESSOR(JSStringIterator)
 CAST_ACCESSOR(JSValue)
@@ -659,7 +527,6 @@ CAST_ACCESSOR(Struct)
 CAST_ACCESSOR(TemplateObjectDescription)
 CAST_ACCESSOR(Tuple2)
 CAST_ACCESSOR(Tuple3)
-CAST_ACCESSOR(WeakCell)
 
 bool Object::HasValidElements() {
   // Dictionary is covered under FixedArray.
@@ -1001,19 +868,6 @@ ReadOnlyRoots HeapObject::GetReadOnlyRoots() const {
   return ReadOnlyRoots(MemoryChunk::FromHeapObject(this)->heap());
 }
 
-Heap* HeapObject::GetHeap() const {
-  Heap* heap = MemoryChunk::FromAddress(
-                   reinterpret_cast<Address>(const_cast<HeapObject*>(this)))
-                   ->heap();
-  SLOW_DCHECK(heap != nullptr);
-  return heap;
-}
-
-
-Isolate* HeapObject::GetIsolate() const {
-  return GetHeap()->isolate();
-}
-
 Heap* NeverReadOnlySpaceObject::GetHeap() const {
   MemoryChunk* chunk =
       MemoryChunk::FromAddress(reinterpret_cast<Address>(this));
@@ -1043,8 +897,7 @@ void HeapObject::set_map(Map* value) {
   if (value != nullptr) {
     // TODO(1600) We are passing nullptr as a slot because maps can never be on
     // evacuation candidate.
-    Heap::FromWritableHeapObject(this)->incremental_marking()->RecordWrite(
-        this, nullptr, value);
+    MarkingBarrier(this, nullptr, value);
   }
 }
 
@@ -1063,8 +916,7 @@ void HeapObject::synchronized_set_map(Map* value) {
   if (value != nullptr) {
     // TODO(1600) We are passing nullptr as a slot because maps can never be on
     // evacuation candidate.
-    Heap::FromWritableHeapObject(this)->incremental_marking()->RecordWrite(
-        this, nullptr, value);
+    MarkingBarrier(this, nullptr, value);
   }
 }
 
@@ -1085,8 +937,7 @@ void HeapObject::set_map_after_allocation(Map* value, WriteBarrierMode mode) {
     DCHECK_NOT_NULL(value);
     // TODO(1600) We are passing nullptr as a slot because maps can never be on
     // evacuation candidate.
-    Heap::FromWritableHeapObject(this)->incremental_marking()->RecordWrite(
-        this, nullptr, value);
+    MarkingBarrier(this, nullptr, value);
   }
 }
 
@@ -1162,7 +1013,7 @@ void AllocationSite::Initialize() {
   set_pretenure_data(0);
   set_pretenure_create_count(0);
   set_dependent_code(
-      DependentCode::cast(GetReadOnlyRoots().empty_fixed_array()),
+      DependentCode::cast(GetReadOnlyRoots().empty_weak_fixed_array()),
       SKIP_WRITE_BARRIER);
 }
 
@@ -1402,7 +1253,7 @@ void JSObject::SetMapAndElements(Handle<JSObject> object,
 
 void JSObject::set_elements(FixedArrayBase* value, WriteBarrierMode mode) {
   WRITE_FIELD(this, kElementsOffset, value);
-  CONDITIONAL_WRITE_BARRIER(GetHeap(), this, kElementsOffset, value, mode);
+  CONDITIONAL_WRITE_BARRIER(this, kElementsOffset, value, mode);
 }
 
 
@@ -1465,34 +1316,6 @@ void PropertyCell::set_property_details(PropertyDetails details) {
   set_property_details_raw(details.AsSmi());
 }
 
-
-Object* WeakCell::value() const { return READ_FIELD(this, kValueOffset); }
-
-
-void WeakCell::clear() {
-  // Either the garbage collector is clearing the cell or we are simply
-  // initializing the root empty weak cell.
-  DCHECK(Heap::FromWritableHeapObject(this)->gc_state() == Heap::MARK_COMPACT ||
-         this == GetReadOnlyRoots().empty_weak_cell());
-  WRITE_FIELD(this, kValueOffset, Smi::kZero);
-}
-
-
-void WeakCell::initialize(HeapObject* val) {
-  WRITE_FIELD(this, kValueOffset, val);
-  // We just have to execute the generational barrier here because we never
-  // mark through a weak cell and collect evacuation candidates when we process
-  // all weak cells.
-  Heap* heap = Heap::FromWritableHeapObject(this);
-  WriteBarrierMode mode =
-      heap->incremental_marking()->marking_state()->IsBlack(this)
-          ? UPDATE_WRITE_BARRIER
-          : UPDATE_WEAK_WRITE_BARRIER;
-  CONDITIONAL_WRITE_BARRIER(heap, this, kValueOffset, val, mode);
-}
-
-bool WeakCell::cleared() const { return value() == Smi::kZero; }
-
 int JSObject::GetHeaderSize() const { return GetHeaderSize(map()); }
 
 int JSObject::GetHeaderSize(const Map* map) {
@@ -1560,7 +1383,7 @@ void JSObject::SetEmbedderField(int index, Object* value) {
   // to adjust the index here.
   int offset = GetHeaderSize() + (kPointerSize * index);
   WRITE_FIELD(this, offset, value);
-  WRITE_BARRIER(GetHeap(), this, offset, value);
+  WRITE_BARRIER(this, offset, value);
 }
 
 void JSObject::SetEmbedderField(int index, Smi* value) {
@@ -1605,7 +1428,7 @@ void JSObject::RawFastPropertyAtPut(FieldIndex index, Object* value) {
   if (index.is_inobject()) {
     int offset = index.offset();
     WRITE_FIELD(this, offset, value);
-    WRITE_BARRIER(GetHeap(), this, offset, value);
+    WRITE_BARRIER(this, offset, value);
   } else {
     property_array()->set(index.outobject_array_index(), value);
   }
@@ -1681,7 +1504,7 @@ Object* JSObject::InObjectPropertyAtPut(int index,
   // Adjust for the number of properties stored in the object.
   int offset = GetInObjectPropertyOffset(index);
   WRITE_FIELD(this, offset, value);
-  CONDITIONAL_WRITE_BARRIER(GetHeap(), this, offset, value, mode);
+  CONDITIONAL_WRITE_BARRIER(this, offset, value, mode);
   return value;
 }
 
@@ -1748,7 +1571,7 @@ void PropertyArray::set(int index, Object* value) {
   DCHECK_LT(index, this->length());
   int offset = kHeaderSize + index * kPointerSize;
   RELAXED_WRITE_FIELD(this, offset, value);
-  WRITE_BARRIER(Heap::FromWritableHeapObject(this), this, offset, value);
+  WRITE_BARRIER(this, offset, value);
 }
 
 int RegExpMatchInfo::NumberOfCaptureRegisters() {
@@ -1847,8 +1670,7 @@ void PropertyArray::set(int index, Object* value, WriteBarrierMode mode) {
   DCHECK_LT(index, this->length());
   int offset = kHeaderSize + index * kPointerSize;
   RELAXED_WRITE_FIELD(this, offset, value);
-  CONDITIONAL_WRITE_BARRIER(Heap::FromWritableHeapObject(this), this, offset,
-                            value, mode);
+  CONDITIONAL_WRITE_BARRIER(this, offset, value, mode);
 }
 
 Object** PropertyArray::data_start() {
@@ -2210,7 +2032,6 @@ DEFINE_DEOPT_ELEMENT_ACCESSORS(LiteralArray, FixedArray)
 DEFINE_DEOPT_ELEMENT_ACCESSORS(OsrBytecodeOffset, Smi)
 DEFINE_DEOPT_ELEMENT_ACCESSORS(OsrPcOffset, Smi)
 DEFINE_DEOPT_ELEMENT_ACCESSORS(OptimizationId, Smi)
-DEFINE_DEOPT_ELEMENT_ACCESSORS(WeakCellCache, Object)
 DEFINE_DEOPT_ELEMENT_ACCESSORS(InliningPositions, PodArray<InliningPosition>)
 
 DEFINE_DEOPT_ENTRY_ACCESSORS(BytecodeOffsetRaw, Smi)
@@ -2261,8 +2082,7 @@ FreeSpace* FreeSpace::next() {
          (!Heap::FromWritableHeapObject(this)->deserialization_complete() &&
           map() == nullptr));
   DCHECK_LE(kNextOffset + kPointerSize, relaxed_read_size());
-  return reinterpret_cast<FreeSpace*>(
-      Memory::Address_at(address() + kNextOffset));
+  return reinterpret_cast<FreeSpace*>(Memory<Address>(address() + kNextOffset));
 }
 
 
@@ -2535,8 +2355,7 @@ Code* JSFunction::code() { return Code::cast(READ_FIELD(this, kCodeOffset)); }
 void JSFunction::set_code(Code* value) {
   DCHECK(!Heap::InNewSpace(value));
   WRITE_FIELD(this, kCodeOffset, value);
-  GetHeap()->incremental_marking()->RecordWrite(
-      this, HeapObject::RawField(this, kCodeOffset), value);
+  MarkingBarrier(this, HeapObject::RawField(this, kCodeOffset), value);
 }
 
 
@@ -2577,10 +2396,7 @@ bool JSFunction::has_context() const {
   return READ_FIELD(this, kContextOffset)->IsContext();
 }
 
-JSObject* JSFunction::global_proxy() {
-  return context()->global_proxy();
-}
-
+JSGlobalProxy* JSFunction::global_proxy() { return context()->global_proxy(); }
 
 Context* JSFunction::native_context() { return context()->native_context(); }
 
@@ -2588,7 +2404,7 @@ Context* JSFunction::native_context() { return context()->native_context(); }
 void JSFunction::set_context(Object* value) {
   DCHECK(value->IsUndefined() || value->IsContext());
   WRITE_FIELD(this, kContextOffset, value);
-  WRITE_BARRIER(GetHeap(), this, kContextOffset, value);
+  WRITE_BARRIER(this, kContextOffset, value);
 }
 
 ACCESSORS_CHECKED(JSFunction, prototype_or_initial_map, Object,
@@ -2619,11 +2435,19 @@ bool JSFunction::has_prototype() {
   return map()->has_non_instance_prototype() || has_instance_prototype();
 }
 
+bool JSFunction::has_prototype_property() {
+  return (has_prototype_slot() && IsConstructor()) ||
+         IsGeneratorFunction(shared()->kind());
+}
+
+bool JSFunction::PrototypeRequiresRuntimeLookup() {
+  return !has_prototype_property() || map()->has_non_instance_prototype();
+}
 
 Object* JSFunction::instance_prototype() {
   DCHECK(has_instance_prototype());
   if (has_initial_map()) return initial_map()->prototype();
-  // When there is no initial map and the prototype is a JSObject, the
+  // When there is no initial map and the prototype is a JSReceiver, the
   // initial map field is used for the prototype field.
   return prototype_or_initial_map();
 }
@@ -2631,7 +2455,7 @@ Object* JSFunction::instance_prototype() {
 
 Object* JSFunction::prototype() {
   DCHECK(has_prototype());
-  // If the function's prototype property has been set to a non-JSObject
+  // If the function's prototype property has been set to a non-JSReceiver
   // value, that value is stored in the constructor field of the map.
   if (map()->has_non_instance_prototype()) {
     Object* prototype = map()->GetConstructor();
@@ -2648,11 +2472,6 @@ bool JSFunction::is_compiled() {
   return code()->builtin_index() != Builtins::kCompileLazy;
 }
 
-ACCESSORS(JSProxy, target, Object, kTargetOffset)
-ACCESSORS(JSProxy, handler, Object, kHandlerOffset)
-
-bool JSProxy::IsRevoked() const { return !handler()->IsJSReceiver(); }
-
 // static
 bool Foreign::IsNormalized(Object* value) {
   if (value == Smi::kZero) return true;
@@ -2672,36 +2491,9 @@ void SmallOrderedHashTable<Derived>::SetDataEntry(int entry, int relative_index,
                                                   Object* value) {
   Address entry_offset = GetDataEntryOffset(entry, relative_index);
   RELAXED_WRITE_FIELD(this, entry_offset, value);
-  WRITE_BARRIER(Heap::FromWritableHeapObject(this), this,
-                static_cast<int>(entry_offset), value);
-}
-
-ACCESSORS(JSGeneratorObject, function, JSFunction, kFunctionOffset)
-ACCESSORS(JSGeneratorObject, context, Context, kContextOffset)
-ACCESSORS(JSGeneratorObject, receiver, Object, kReceiverOffset)
-ACCESSORS(JSGeneratorObject, input_or_debug_pos, Object, kInputOrDebugPosOffset)
-SMI_ACCESSORS(JSGeneratorObject, resume_mode, kResumeModeOffset)
-SMI_ACCESSORS(JSGeneratorObject, continuation, kContinuationOffset)
-ACCESSORS(JSGeneratorObject, parameters_and_registers, FixedArray,
-          kParametersAndRegistersOffset)
-
-bool JSGeneratorObject::is_suspended() const {
-  DCHECK_LT(kGeneratorExecuting, 0);
-  DCHECK_LT(kGeneratorClosed, 0);
-  return continuation() >= 0;
+  WRITE_BARRIER(this, static_cast<int>(entry_offset), value);
 }
 
-bool JSGeneratorObject::is_closed() const {
-  return continuation() == kGeneratorClosed;
-}
-
-bool JSGeneratorObject::is_executing() const {
-  return continuation() == kGeneratorExecuting;
-}
-
-ACCESSORS(JSAsyncGeneratorObject, queue, HeapObject, kQueueOffset)
-SMI_ACCESSORS(JSAsyncGeneratorObject, is_awaiting, kIsAwaitingOffset)
-
 ACCESSORS(JSValue, value, Object, kValueOffset)
 
 
@@ -2724,7 +2516,7 @@ SMI_ACCESSORS(JSMessageObject, start_position, kStartPositionOffset)
 SMI_ACCESSORS(JSMessageObject, end_position, kEndPositionOffset)
 SMI_ACCESSORS(JSMessageObject, error_level, kErrorLevelOffset)
 
-ElementsKind JSObject::GetElementsKind() {
+ElementsKind JSObject::GetElementsKind() const {
   ElementsKind kind = map()->elements_kind();
 #if VERIFY_HEAP && DEBUG
   FixedArrayBase* fixed_array =
@@ -2816,7 +2608,7 @@ bool JSObject::HasFixedTypedArrayElements() {
   return map()->has_fixed_typed_array_elements();
 }
 
-#define FIXED_TYPED_ELEMENTS_CHECK(Type, type, TYPE, ctype, size)      \
+#define FIXED_TYPED_ELEMENTS_CHECK(Type, type, TYPE, ctype)            \
   bool JSObject::HasFixed##Type##Elements() {                          \
     HeapObject* array = elements();                                    \
     DCHECK_NOT_NULL(array);                                            \
@@ -3319,8 +3111,7 @@ Object* Object::GetHash() {
   return receiver->GetIdentityHash(isolate);
 }
 
-Handle<Object> ObjectHashTableShape::AsHandle(Isolate* isolate,
-                                              Handle<Object> key) {
+Handle<Object> ObjectHashTableShape::AsHandle(Handle<Object> key) {
   return key;
 }