diff --git a/BUILD.gn b/BUILD.gn
index f8a0507c92c..e5d780da89e 100644
--- a/BUILD.gn
+++ b/BUILD.gn
@@ -8,7 +8,6 @@ import("//build/config/coverage/coverage.gni")
 import("//build/config/dcheck_always_on.gni")
 import("//build/config/host_byteorder.gni")
 import("//build/config/mips.gni")
-import("//build/config/riscv.gni")
 import("//build/config/sanitizers/sanitizers.gni")
 import("//build_overrides/build.gni")
 import("//third_party/icu/config.gni")
@@ -1387,7 +1386,7 @@ config("toolchain") {
   visibility = [ "./*" ]
 
   defines = []
-  cflags = []
+  cflags = [ "-D_SILENCE_CXX20_OLD_SHARED_PTR_ATOMIC_SUPPORT_DEPRECATION_WARNING", "-DV8_TLS_USED_IN_LIBRARY", "-Wno-cast-function-type-mismatch", "-Wno-deprecated-this-capture" ]
   ldflags = []
 
   if (v8_current_cpu == "arm") {
diff --git a/gni/v8.gni b/gni/v8.gni
index 4efb4d6d865..3f1dc0ba6c3 100644
--- a/gni/v8.gni
+++ b/gni/v8.gni
@@ -4,6 +4,7 @@
 
 import("//build/config/chrome_build.gni")
 import("//build/config/compiler/pgo/pgo.gni")
+import("//build/config/dcheck_always_on.gni")
 import("//build/config/gclient_args.gni")
 import("//build/config/ios/config.gni")
 import("//build/config/ios/ios_sdk_overrides.gni")
@@ -135,7 +136,7 @@ declare_args() {
   cppgc_enable_slow_api_checks = false
 
   # Enable object names in cppgc for profiling purposes.
-  cppgc_enable_object_names = is_chrome_for_testing
+  cppgc_enable_object_names = false
 
   # Enable young generation in cppgc.
   cppgc_enable_young_generation = false
diff --git a/include/libplatform/libplatform.h b/include/libplatform/libplatform.h
index 6a34f432410..88a81ab4c40 100644
--- a/include/libplatform/libplatform.h
+++ b/include/libplatform/libplatform.h
@@ -49,6 +49,8 @@ V8_PLATFORM_EXPORT std::unique_ptr<v8::Platform> NewDefaultPlatform(
     std::unique_ptr<v8::TracingController> tracing_controller = {},
     PriorityMode priority_mode = PriorityMode::kDontApply);
 
+V8_PLATFORM_EXPORT std::unique_ptr<v8::PageAllocator> NewDefaultPageAllocator();
+
 /**
  * The same as NewDefaultPlatform but disables the worker thread pool.
  * It must be used with the --single-threaded V8 flag.
diff --git a/include/v8-initialization.h b/include/v8-initialization.h
index 46a21a02cbc..ccfe020f76c 100644
--- a/include/v8-initialization.h
+++ b/include/v8-initialization.h
@@ -159,6 +159,7 @@ class V8_EXPORT V8 {
    * of the data file has to be provided.
    */
   static bool InitializeICU(const char* icu_data_file = nullptr);
+  static bool InitializeICU(const char* icu_data_ptr, size_t size);
 
   /**
    * Initialize the ICU library bundled with V8. The embedder should only
diff --git a/include/v8-template.h b/include/v8-template.h
index 93b94285726..7a65b26b61e 100644
--- a/include/v8-template.h
+++ b/include/v8-template.h
@@ -1017,6 +1017,9 @@ class V8_EXPORT ObjectTemplate : public Template {
    */
   void SetImmutableProto();
 
+  bool IsHostDelegate() const;
+  void SetHostDelegate();
+
   /**
    * Support for TC39 "dynamic code brand checks" proposal.
    *
diff --git a/include/v8config.h b/include/v8config.h
index 9d58e85db29..ff3e75eed20 100644
--- a/include/v8config.h
+++ b/include/v8config.h
@@ -582,7 +582,7 @@ path. Add it with -I<path> to the command line
 // Use like:
 //   V8_NOINLINE V8_PRESERVE_MOST void UnlikelyMethod();
 #if V8_HAS_ATTRIBUTE_PRESERVE_MOST
-# define V8_PRESERVE_MOST __attribute__((preserve_most))
+# define V8_PRESERVE_MOST /* DISABLED */
 #else
 # define V8_PRESERVE_MOST /* NOT SUPPORTED */
 #endif
diff --git a/src/api/api-natives.cc b/src/api/api-natives.cc
index 7ed64a2671c..92c1609805b 100644
--- a/src/api/api-natives.cc
+++ b/src/api/api-natives.cc
@@ -346,6 +346,9 @@ MaybeHandle<JSObject> InstantiateObject(Isolate* isolate,
   if (info->immutable_proto()) {
     JSObject::SetImmutableProto(isolate, object);
   }
+  else if (info->host_delegate()) {
+    JSObject::SetHostDelegate(isolate, object);
+  }
   if (!is_prototype) {
     // Keep prototypes in slow-mode. Let them be lazily turned fast later on.
     // TODO(dcarney): is this necessary?
diff --git a/src/api/api.cc b/src/api/api.cc
index c0ff2001df7..496ef07f76d 100644
--- a/src/api/api.cc
+++ b/src/api/api.cc
@@ -1911,6 +1911,17 @@ void ObjectTemplate::SetImmutableProto() {
   self->set_immutable_proto(true);
 }
 
+bool ObjectTemplate::IsHostDelegate() const {
+  return Utils::OpenDirectHandle(this)->host_delegate();
+}
+
+void ObjectTemplate::SetHostDelegate() {
+  auto self = Utils::OpenDirectHandle(this);
+  i::Isolate* isolate = self->GetIsolate();
+  ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
+  self->set_host_delegate(true);
+}
+
 bool ObjectTemplate::IsCodeLike() const {
   return Utils::OpenDirectHandle(this)->code_like();
 }
@@ -6742,6 +6753,10 @@ bool v8::V8::InitializeICU(const char* icu_data_file) {
   return i::InitializeICU(icu_data_file);
 }
 
+bool v8::V8::InitializeICU(const char* icu_data_ptr, size_t size) {
+  return i::InitializeICU(icu_data_ptr, size);
+}
+
 bool v8::V8::InitializeICUDefaultLocation(const char* exec_path,
                                           const char* icu_data_file) {
   return i::InitializeICUDefaultLocation(exec_path, icu_data_file);
diff --git a/src/base/build_config.h b/src/base/build_config.h
index 207f46b057d..e58513be2d1 100644
--- a/src/base/build_config.h
+++ b/src/base/build_config.h
@@ -44,7 +44,7 @@
 #endif
 
 #if defined(V8_OS_LINUX) && defined(V8_HOST_ARCH_X64)
-#define V8_HAS_PKU_JIT_WRITE_PROTECT 1
+#define V8_HAS_PKU_JIT_WRITE_PROTECT 0
 #else
 #define V8_HAS_PKU_JIT_WRITE_PROTECT 0
 #endif
diff --git a/src/base/platform/platform.h b/src/base/platform/platform.h
index a7b57d9fc80..da849f2f796 100644
--- a/src/base/platform/platform.h
+++ b/src/base/platform/platform.h
@@ -53,6 +53,8 @@
 #include <sanitizer/asan_interface.h>
 #endif  // V8_USE_ADDRESS_SANITIZER
 
+#define V8_NO_FAST_TLS
+
 #ifndef V8_NO_FAST_TLS
 #if V8_CC_MSVC && V8_HOST_ARCH_IA32
 // __readfsdword is supposed to be declared in intrin.h but it is missing from
diff --git a/src/codegen/code-stub-assembler.cc b/src/codegen/code-stub-assembler.cc
index 20c3bbe060f..a3ba312acd5 100644
--- a/src/codegen/code-stub-assembler.cc
+++ b/src/codegen/code-stub-assembler.cc
@@ -2321,6 +2321,10 @@ TNode<Uint32T> CodeStubAssembler::LoadMapBitField3(TNode<Map> map) {
   return LoadObjectField<Uint32T>(map, Map::kBitField3Offset);
 }
 
+TNode<Uint32T> CodeStubAssembler::LoadMapHostBitField(TNode<Map> map) {
+  return LoadObjectField<Uint32T>(map, Map::kHostBitFieldOffset);
+}
+
 TNode<Uint16T> CodeStubAssembler::LoadMapInstanceType(TNode<Map> map) {
   return LoadObjectField<Uint16T>(map, Map::kInstanceTypeOffset);
 }
@@ -15912,6 +15916,11 @@ TNode<String> CodeStubAssembler::Typeof(
 
   GotoIf(InstanceTypeEqual(instance_type, ODDBALL_TYPE), &if_oddball);
 
+  Label resume_default(this);
+  GotoIfNot(Word32And(LoadMapBitField(map), Int32Constant(Map::Bits1::HasNamedInterceptorBit::kMask)), &resume_default);
+  Branch(Word32And(LoadMapHostBitField(map), Int32Constant(Map::HostBits::IsHostDelegateBit::kMask)), &return_function, &return_object);
+  BIND(&resume_default);
+
   TNode<Int32T> callable_or_undetectable_mask =
       Word32And(LoadMapBitField(map),
                 Int32Constant(Map::Bits1::IsCallableBit::kMask |
diff --git a/src/codegen/code-stub-assembler.h b/src/codegen/code-stub-assembler.h
index 6281b6aa2a3..62392f6bb23 100644
--- a/src/codegen/code-stub-assembler.h
+++ b/src/codegen/code-stub-assembler.h
@@ -1345,6 +1345,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<Int32T> LoadMapBitField2(TNode<Map> map);
   // Load bit field 3 of a map.
   TNode<Uint32T> LoadMapBitField3(TNode<Map> map);
+  // Load host bit field of a map.
+  TNode<Uint32T> LoadMapHostBitField(TNode<Map> map);
   // Load the instance type of a map.
   TNode<Uint16T> LoadMapInstanceType(TNode<Map> map);
   // Load the ElementsKind of a map.
diff --git a/src/diagnostics/unwinding-info-win64.cc b/src/diagnostics/unwinding-info-win64.cc
index 1312609e5b6..2fc14899e1c 100644
--- a/src/diagnostics/unwinding-info-win64.cc
+++ b/src/diagnostics/unwinding-info-win64.cc
@@ -464,6 +464,14 @@ void InitUnwindingRecord(Record* record, size_t code_size_in_bytes) {
 namespace {
 
 V8_DECLARE_ONCE(load_ntdll_unwinding_functions_once);
+
+#if defined(V8_OS_WIN_X64)
+static decltype(
+    &::RtlAddFunctionTable) add_function_table_func = nullptr;
+static decltype(
+    &::RtlDeleteFunctionTable) delete_function_table_func = nullptr;
+#endif  // V8_OS_WIN_X64
+
 static decltype(
     &::RtlAddGrowableFunctionTable) add_growable_function_table_func = nullptr;
 static decltype(
@@ -471,6 +479,19 @@ static decltype(
     nullptr;
 
 void LoadNtdllUnwindingFunctionsOnce() {
+
+#if defined(V8_OS_WIN_X64)
+  HMODULE kernel32_module =
+	LoadLibraryEx(L"kernel32.dll", nullptr, LOAD_LIBRARY_SEARCH_SYSTEM32);
+  DCHECK_NOT_NULL(kernel32_module);
+  add_function_table_func =
+	reinterpret_cast<decltype(&::RtlAddFunctionTable)>(
+		::GetProcAddress(kernel32_module, "RtlAddFunctionTable"));
+  delete_function_table_func =
+	reinterpret_cast<decltype(&::RtlDeleteFunctionTable)>(
+		::GetProcAddress(kernel32_module, "RtlDeleteFunctionTable"));
+#endif  // V8_OS_WIN_X64
+
   // Load functions from the ntdll.dll module.
   HMODULE ntdll_module =
       LoadLibraryEx(L"ntdll.dll", nullptr, LOAD_LIBRARY_SEARCH_SYSTEM32);
@@ -493,6 +514,21 @@ void LoadNtdllUnwindingFunctions() {
                  &LoadNtdllUnwindingFunctionsOnce);
 }
 
+#if defined(V8_OS_WIN_X64)
+BOOLEAN AddFunctionTable(PRUNTIME_FUNCTION FunctionTable,
+                         DWORD EntryCount,
+                         DWORD64 BaseAddress) {
+  LoadNtdllUnwindingFunctions();
+  DCHECK_NOT_NULL(add_function_table_func);
+  return add_function_table_func(FunctionTable, EntryCount, BaseAddress);
+}
+BOOLEAN DeleteFunctionTable(PRUNTIME_FUNCTION FunctionTable) {
+  LoadNtdllUnwindingFunctions();
+  DCHECK_NOT_NULL(delete_function_table_func);
+  return delete_function_table_func(FunctionTable);
+}
+#endif  // V8_OS_WIN_X64
+
 bool AddGrowableFunctionTable(PVOID* DynamicTable,
                               PRUNTIME_FUNCTION FunctionTable, DWORD EntryCount,
                               DWORD MaximumEntryCount, ULONG_PTR RangeBase,
@@ -544,7 +580,7 @@ void RegisterNonABICompliantCodeRange(void* start, size_t size_in_bytes) {
       ExceptionHandlerRecord* record = new (start) ExceptionHandlerRecord();
       InitUnwindingRecord(record, size_in_bytes);
 
-      CHECK(::RtlAddFunctionTable(record->runtime_function,
+      CHECK(AddFunctionTable(record->runtime_function,
                                   kDefaultRuntimeFunctionCount,
                                   reinterpret_cast<DWORD64>(start)));
 
@@ -582,7 +618,7 @@ void UnregisterNonABICompliantCodeRange(void* start) {
     if (unhandled_exception_callback_g) {
       ExceptionHandlerRecord* record =
           reinterpret_cast<ExceptionHandlerRecord*>(start);
-      CHECK(::RtlDeleteFunctionTable(record->runtime_function));
+      CHECK(DeleteFunctionTable(record->runtime_function));
 
       // Unprotect reserved page.
       DWORD old_protect;
diff --git a/src/execution/isolate-inl.h b/src/execution/isolate-inl.h
index 04eaa77fa56..15cd2cab05e 100644
--- a/src/execution/isolate-inl.h
+++ b/src/execution/isolate-inl.h
@@ -32,7 +32,6 @@ Isolate::CurrentPerIsolateThreadData() {
 // static
 V8_INLINE Isolate* Isolate::Current() {
   Isolate* isolate = TryGetCurrent();
-  DCHECK_NOT_NULL(isolate);
   return isolate;
 }
 
diff --git a/src/execution/stack-guard.cc b/src/execution/stack-guard.cc
index 4bfd56d287b..7725d3cc4ba 100644
--- a/src/execution/stack-guard.cc
+++ b/src/execution/stack-guard.cc
@@ -240,6 +240,9 @@ void StackGuard::ThreadLocal::Initialize(Isolate* isolate,
   const uintptr_t kLimitSize = v8_flags.stack_size * KB;
   DCHECK_GT(GetCurrentStackPosition(), kLimitSize);
   uintptr_t limit = GetCurrentStackPosition() - kLimitSize;
+  if (GetCurrentStackPosition() < kLimitSize) {
+    limit = 0;
+  }
   real_jslimit_ = SimulatorStack::JsLimitFromCLimit(isolate, limit);
   set_jslimit(SimulatorStack::JsLimitFromCLimit(isolate, limit));
 #ifdef USE_SIMULATOR
@@ -388,6 +391,8 @@ Tagged<Object> StackGuard::HandleInterrupts(InterruptLevel level) {
 
   isolate_->counters()->stack_interrupts()->Increment();
 
+  if (isolate_->has_exception()) return ReadOnlyRoots(isolate_).exception();
+
   return ReadOnlyRoots(isolate_).undefined_value();
 }
 
diff --git a/src/heap/factory.cc b/src/heap/factory.cc
index 22f4131b3a8..6c044f258d7 100644
--- a/src/heap/factory.cc
+++ b/src/heap/factory.cc
@@ -2317,6 +2317,7 @@ Tagged<Map> Factory::InitializeMap(Tagged<Map> map, InstanceType type,
       Map::Bits3::ConstructionCounterBits::encode(Map::kNoSlackTracking) |
       Map::Bits3::IsExtensibleBit::encode(true);
   map->set_bit_field3(bit_field3);
+  map->set_host_bit_field(0);
   map->set_instance_type(type);
   map->init_prototype_and_constructor_or_back_pointer(roots);
   map->set_instance_size(instance_size);
diff --git a/src/heap/setup-heap-internal.cc b/src/heap/setup-heap-internal.cc
index 5f7bce594f9..5b1d79bc2ca 100644
--- a/src/heap/setup-heap-internal.cc
+++ b/src/heap/setup-heap-internal.cc
@@ -295,6 +295,7 @@ void InitializePartialMap(Isolate* isolate, Tagged<Map> map,
       Map::Bits3::OwnsDescriptorsBit::encode(true) |
       Map::Bits3::ConstructionCounterBits::encode(Map::kNoSlackTracking);
   map->set_bit_field3(bit_field3);
+  map->set_host_bit_field(0);
   DCHECK(!map->is_in_retained_map_list());
   map->clear_padding();
   map->set_elements_kind(TERMINAL_FAST_ELEMENTS_KIND);
diff --git a/src/init/icu_util.cc b/src/init/icu_util.cc
index 67d349557c6..cfb7fcefbaf 100644
--- a/src/init/icu_util.cc
+++ b/src/init/icu_util.cc
@@ -11,6 +11,7 @@
 #if defined(V8_INTL_SUPPORT)
 #include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
 
 #include "src/base/build_config.h"
 #include "src/base/file-utils.h"
@@ -98,6 +99,26 @@ bool InitializeICU(const char* icu_data_file) {
 #endif
 }
 
+bool InitializeICU(const char* icu_data_ptr, size_t size) {
+#if !defined(V8_INTL_SUPPORT)
+  return true;
+#else
+#if ICU_UTIL_DATA_IMPL == ICU_UTIL_DATA_STATIC
+  return true;
+#elif ICU_UTIL_DATA_IMPL == ICU_UTIL_DATA_FILE
+  if (!icu_data_ptr) return false;
+  if (g_icu_data_ptr) return true;
+  g_icu_data_ptr = new char[size];
+  memcpy(g_icu_data_ptr, icu_data_ptr, size);
+  atexit(free_icu_data_ptr);
+  UErrorCode err = U_ZERO_ERROR;
+  udata_setCommonData(reinterpret_cast<void*>(g_icu_data_ptr), &err);
+  udata_setFileAccess(UDATA_ONLY_PACKAGES, &err);
+  return err == U_ZERO_ERROR;
+#endif
+#endif
+}
+
 #undef ICU_UTIL_DATA_FILE
 #undef ICU_UTIL_DATA_STATIC
 
diff --git a/src/init/icu_util.h b/src/init/icu_util.h
index e127e75f10f..b0e4bd2d68e 100644
--- a/src/init/icu_util.h
+++ b/src/init/icu_util.h
@@ -5,6 +5,8 @@
 #ifndef V8_INIT_ICU_UTIL_H_
 #define V8_INIT_ICU_UTIL_H_
 
+#include <stddef.h>
+
 namespace v8 {
 
 namespace internal {
@@ -12,6 +14,7 @@ namespace internal {
 // Call this function to load ICU's data tables for the current process.  This
 // function should be called before ICU is used.
 bool InitializeICU(const char* icu_data_file);
+bool InitializeICU(const char* icu_data_ptr, size_t size);
 
 // Like above, but using the default icudt[lb].dat location if icu_data_file is
 // not specified.
diff --git a/src/init/v8.cc b/src/init/v8.cc
index 7444ab59bdb..75ef7ddf3a0 100644
--- a/src/init/v8.cc
+++ b/src/init/v8.cc
@@ -102,7 +102,6 @@ V8_DECLARE_ONCE(init_snapshot_once);
 // static
 void V8::InitializePlatform(v8::Platform* platform) {
   AdvanceStartupState(V8StartupState::kPlatformInitializing);
-  CHECK(!platform_);
   CHECK_NOT_NULL(platform);
   platform_ = platform;
   v8::base::SetPrintStackTrace(platform_->GetStackTracePrinter());
diff --git a/src/interpreter/bytecode-generator.cc b/src/interpreter/bytecode-generator.cc
index f44c172d0a5..1ac05072687 100644
--- a/src/interpreter/bytecode-generator.cc
+++ b/src/interpreter/bytecode-generator.cc
@@ -7383,10 +7383,13 @@ static bool IsCharU(const AstRawString* str) {
   return str->length() == 1 && str->FirstCharacter() == 'u';
 }
 
+static bool disable_literal_compare_typeof_detection = true;
+
 static bool IsLiteralCompareTypeof(CompareOperation* expr,
                                    Expression** sub_expr,
                                    TestTypeOfFlags::LiteralFlag* flag,
                                    const AstStringConstants* ast_constants) {
+  if (disable_literal_compare_typeof_detection) return false;
   if (IsTypeof(expr->left()) && expr->right()->IsStringLiteral()) {
     Literal* right_lit = expr->right()->AsLiteral();
 
diff --git a/src/libplatform/default-platform.cc b/src/libplatform/default-platform.cc
index 82853866cce..885cfe4563a 100644
--- a/src/libplatform/default-platform.cc
+++ b/src/libplatform/default-platform.cc
@@ -57,6 +57,10 @@ std::unique_ptr<v8::Platform> NewDefaultPlatform(
   return platform;
 }
 
+std::unique_ptr<v8::PageAllocator> NewDefaultPageAllocator() {
+  return std::make_unique<v8::base::PageAllocator>();
+}
+
 std::unique_ptr<v8::Platform> NewSingleThreadedDefaultPlatform(
     IdleTaskSupport idle_task_support,
     InProcessStackDumping in_process_stack_dumping,
diff --git a/src/objects/bigint.cc b/src/objects/bigint.cc
index cb7e1cdb406..642ac254ae5 100644
--- a/src/objects/bigint.cc
+++ b/src/objects/bigint.cc
@@ -1366,7 +1366,7 @@ MaybeHandle<BigInt> BigInt::FromWords64(Isolate* isolate, int sign_bit,
   static_assert(kDigitBits == 64 || kDigitBits == 32);
   uint32_t length = (64 / kDigitBits) * words64_count;
   DCHECK_GT(length, 0);
-  if (kDigitBits == 32 && words[words64_count - 1] <= (1ULL << 32)) length--;
+  if (kDigitBits == 32 && words[words64_count - 1] < (1ULL << 32)) length--;
 
   Handle<MutableBigInt> result;
   if (!MutableBigInt::New(isolate, length).ToHandle(&result)) return {};
diff --git a/src/objects/js-objects.cc b/src/objects/js-objects.cc
index 0e5c2ed4b65..d069bcc4864 100644
--- a/src/objects/js-objects.cc
+++ b/src/objects/js-objects.cc
@@ -5324,6 +5324,14 @@ void JSObject::SetImmutableProto(Isolate* isolate,
   object->set_map(isolate, *new_map, kReleaseStore);
 }
 
+void JSObject::SetHostDelegate(Isolate* isolate,
+                               DirectHandle<JSObject> object) {
+  DirectHandle<Map> map(object->map(), isolate);
+  if (map->is_host_delegate()) return;
+  DirectHandle<Map> new_map = Map::TransitionToHostDelegate(isolate, map);
+  object->set_map(isolate, *new_map, kReleaseStore);
+}
+
 void JSObject::EnsureCanContainElements(DirectHandle<JSObject> object,
                                         JavaScriptArguments* args,
                                         uint32_t arg_count,
diff --git a/src/objects/js-objects.h b/src/objects/js-objects.h
index df09d807219..84351759afe 100644
--- a/src/objects/js-objects.h
+++ b/src/objects/js-objects.h
@@ -818,6 +818,9 @@ class JSObject : public TorqueGeneratedJSObject<JSObject, JSReceiver> {
   static void SetImmutableProto(Isolate* isolate,
                                 DirectHandle<JSObject> object);
 
+  static void SetHostDelegate(Isolate* isolate,
+                                DirectHandle<JSObject> object);
+
   // Initializes the body starting at |start_offset|. It is responsibility of
   // the caller to initialize object header. Fill the pre-allocated fields with
   // undefined_value and the rest with filler_map.
diff --git a/src/objects/map-inl.h b/src/objects/map-inl.h
index 0ae0d5f1119..9d358b9be2f 100644
--- a/src/objects/map-inl.h
+++ b/src/objects/map-inl.h
@@ -134,6 +134,9 @@ BIT_FIELD_ACCESSORS(Map, bit_field3, may_have_interesting_properties,
 BIT_FIELD_ACCESSORS(Map, relaxed_bit_field3, construction_counter,
                     Map::Bits3::ConstructionCounterBits)
 
+// |host_bit_field| fields.
+BIT_FIELD_ACCESSORS(Map, host_bit_field, is_host_delegate, Map::HostBits::IsHostDelegateBit)
+
 DEF_GETTER(Map, GetNamedInterceptor, Tagged<InterceptorInfo>) {
   DCHECK(has_named_interceptor());
   Tagged<FunctionTemplateInfo> info = GetFunctionTemplateInfo(cage_base);
diff --git a/src/objects/map.cc b/src/objects/map.cc
index 81a3b16e853..43c7a8d3930 100644
--- a/src/objects/map.cc
+++ b/src/objects/map.cc
@@ -1283,6 +1283,7 @@ Handle<Map> Map::RawCopy(Isolate* isolate, DirectHandle<Map> src_handle,
     }
     // Same as bit_field comment above.
     raw->set_bit_field3(new_bit_field3);
+    raw->set_host_bit_field(src->host_bit_field());
     raw->clear_padding();
   }
   DirectHandle<JSPrototype> prototype(src_handle->prototype(), isolate);
@@ -1428,6 +1429,13 @@ Handle<Map> Map::TransitionToImmutableProto(Isolate* isolate,
   return new_map;
 }
 
+Handle<Map> Map::TransitionToHostDelegate(Isolate* isolate,
+                                          DirectHandle<Map> map) {
+  Handle<Map> new_map = Map::Copy(isolate, map, "HostDelegate");
+  new_map->set_is_host_delegate(true);
+  return new_map;
+}
+
 namespace {
 void EnsureInitialMap(Isolate* isolate, DirectHandle<Map> map) {
 #ifdef DEBUG
diff --git a/src/objects/map.h b/src/objects/map.h
index f169d8772a8..707fb181f34 100644
--- a/src/objects/map.h
+++ b/src/objects/map.h
@@ -349,6 +349,11 @@ class Map : public TorqueGeneratedMap<Map, HeapObject> {
   static_assert(kSlackTrackingCounterStart <=
                 Bits3::ConstructionCounterBits::kMax);
 
+  // Bit positions for |host_bits|.
+  struct HostBits {
+    DEFINE_TORQUE_GENERATED_MAP_HOST_BIT_FIELDS()
+  };
+
   // Inobject slack tracking is the way to reclaim unused inobject space.
   //
   // The instance size is initially determined by adding some slack to
@@ -729,6 +734,8 @@ class Map : public TorqueGeneratedMap<Map, HeapObject> {
 
   DECL_BOOLEAN_ACCESSORS(is_immutable_proto)
 
+  DECL_BOOLEAN_ACCESSORS(is_host_delegate)
+
   // This counter is used for in-object slack tracking.
   // The in-object slack tracking is considered enabled when the counter is
   // non zero. The counter only has a valid count for initial maps. For
@@ -926,6 +933,9 @@ class Map : public TorqueGeneratedMap<Map, HeapObject> {
   static Handle<Map> TransitionToImmutableProto(Isolate* isolate,
                                                 DirectHandle<Map> map);
 
+  static Handle<Map> TransitionToHostDelegate(Isolate* isolate,
+                                              DirectHandle<Map> map);
+
   static_assert(kInstanceTypeOffset == Internals::kMapInstanceTypeOffset);
 
   class BodyDescriptor;
diff --git a/src/objects/map.tq b/src/objects/map.tq
index e6982895020..ccc3e1ce90b 100644
--- a/src/objects/map.tq
+++ b/src/objects/map.tq
@@ -34,6 +34,10 @@ bitfield struct MapBitFields3 extends uint32 {
   construction_counter: int32: 3 bit;
 }
 
+bitfield struct MapHostBitFields extends uint32 {
+  is_host_delegate: bool: 1 bit;
+}
+
 extern class Map extends HeapObject {
   macro PrototypeInfo(): PrototypeInfo labels HasNoPrototypeInfo {
     typeswitch (this.transitions_or_prototype_info) {
@@ -65,8 +69,8 @@ extern class Map extends HeapObject {
   bit_field2: MapBitFields2;
   bit_field3: MapBitFields3;
 
-  @if(TAGGED_SIZE_8_BYTES) optional_padding: uint32;
-  @ifnot(TAGGED_SIZE_8_BYTES) optional_padding: void;
+  host_bit_field: MapHostBitFields;
+  optional_padding: void;
 
   prototype: JSReceiver|Null;
   constructor_or_back_pointer_or_native_context: Object;
diff --git a/src/objects/objects.cc b/src/objects/objects.cc
index c2c5886e578..0d7303040cc 100644
--- a/src/objects/objects.cc
+++ b/src/objects/objects.cc
@@ -1007,7 +1007,12 @@ Handle<String> Object::TypeOf(Isolate* isolate, DirectHandle<Object> object) {
   if (IsString(*object)) return isolate->factory()->string_string();
   if (IsSymbol(*object)) return isolate->factory()->symbol_string();
   if (IsBigInt(*object)) return isolate->factory()->bigint_string();
-  if (IsCallable(*object)) return isolate->factory()->function_string();
+  if (IsJSObject(*object)) {
+    DirectHandle<JSObject> obj = Cast<JSObject>(object);
+    if (obj->HasNamedInterceptor()) {
+      return obj->map()->is_host_delegate() ? isolate->factory()->function_string() : isolate->factory()->object_string();
+    }
+  }  if (IsCallable(*object)) return isolate->factory()->function_string();
   return isolate->factory()->object_string();
 }
 
diff --git a/src/objects/templates-inl.h b/src/objects/templates-inl.h
index 062e5077625..e24a229e30e 100644
--- a/src/objects/templates-inl.h
+++ b/src/objects/templates-inl.h
@@ -277,6 +277,14 @@ void ObjectTemplateInfo::set_code_like(bool is_code_like) {
   return set_data(IsCodeKindBit::update(data(), is_code_like));
 }
 
+bool ObjectTemplateInfo::host_delegate() const {
+  return IsHostDelegateBit::decode(data());
+}
+
+void ObjectTemplateInfo::set_host_delegate(bool value) {
+  return set_data(IsHostDelegateBit::update(data(), value));
+}
+
 bool FunctionTemplateInfo::IsTemplateFor(Tagged<JSObject> object) const {
   return IsTemplateFor(object->map());
 }
diff --git a/src/objects/templates.h b/src/objects/templates.h
index 7048661ce5e..4898cd9137f 100644
--- a/src/objects/templates.h
+++ b/src/objects/templates.h
@@ -290,6 +290,7 @@ class ObjectTemplateInfo
   DECL_INT_ACCESSORS(embedder_field_count)
   DECL_BOOLEAN_ACCESSORS(immutable_proto)
   DECL_BOOLEAN_ACCESSORS(code_like)
+  DECL_BOOLEAN_ACCESSORS(host_delegate)
 
   // Starting from given object template's constructor walk up the inheritance
   // chain till a function template that has an instance template is found.
diff --git a/src/objects/templates.tq b/src/objects/templates.tq
index 7ebc6c58a50..7dd0377f52a 100644
--- a/src/objects/templates.tq
+++ b/src/objects/templates.tq
@@ -98,7 +98,8 @@ extern class FunctionTemplateInfo extends TemplateInfo {
 bitfield struct ObjectTemplateInfoFlags extends uint31 {
   is_immutable_prototype: bool: 1 bit;
   is_code_kind: bool: 1 bit;
-  embedder_field_count: int32: 28 bit;
+  is_host_delegate: bool: 1 bit;
+  embedder_field_count: int32: 27 bit;
 }
 
 @generateUniqueMap
