[runtime] Use range check for Names that can update protectors

Instead of doing multiple separate checks with branches, turn the
name check into a single range check.

This means that the symbols and strings for properties than can
invalidate protectors need to be allocated consecutively in memory.

Change-Id: Id3a2003534bab5ecf83393a60167f779d636fc4b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3695360
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81185}

src/codegen/code-stub-assembler.cc

@@ -10613,15 +10613,12 @@ void CodeStubAssembler::CombineFeedback(TVariable<Smi>* existing_feedback,
 void CodeStubAssembler::CheckForAssociatedProtector(TNode<Name> name,
                                                     Label* if_protector) {
   // This list must be kept in sync with LookupIterator::UpdateProtector!
-  // TODO(jkummerow): Would it be faster to have a bit in Symbol::flags()?
-  GotoIf(TaggedEqual(name, ConstructorStringConstant()), if_protector);
-  GotoIf(TaggedEqual(name, IteratorSymbolConstant()), if_protector);
-  GotoIf(TaggedEqual(name, NextStringConstant()), if_protector);
-  GotoIf(TaggedEqual(name, SpeciesSymbolConstant()), if_protector);
-  GotoIf(TaggedEqual(name, IsConcatSpreadableSymbolConstant()), if_protector);
-  GotoIf(TaggedEqual(name, ResolveStringConstant()), if_protector);
-  GotoIf(TaggedEqual(name, ThenStringConstant()), if_protector);
-  // Fall through if no case matched.
+  auto first_ptr = Unsigned(
+      BitcastTaggedToWord(LoadRoot(RootIndex::kFirstNameForProtector)));
+  auto last_ptr =
+      Unsigned(BitcastTaggedToWord(LoadRoot(RootIndex::kLastNameForProtector)));
+  auto name_ptr = Unsigned(BitcastTaggedToWord(name));
+  GotoIf(IsInRange(name_ptr, first_ptr, last_ptr), if_protector);
 }
 
 TNode<Map> CodeStubAssembler::LoadReceiverMap(TNode<Object> receiver) {

src/codegen/code-stub-assembler.h

@@ -1004,6 +1004,13 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                                  Int32Constant(higher_limit - lower_limit));
   }
 
+  TNode<BoolT> IsInRange(TNode<UintPtrT> value, TNode<UintPtrT> lower_limit,
+                         TNode<UintPtrT> higher_limit) {
+    CSA_DCHECK(this, UintPtrLessThanOrEqual(lower_limit, higher_limit));
+    return UintPtrLessThanOrEqual(UintPtrSub(value, lower_limit),
+                                  UintPtrSub(higher_limit, lower_limit));
+  }
+
   TNode<BoolT> IsInRange(TNode<WordT> value, intptr_t lower_limit,
                          intptr_t higher_limit) {
     DCHECK_LE(lower_limit, higher_limit);

src/heap/setup-heap-internal.cc

@@ -767,27 +767,65 @@ void Heap::CreateInitialObjects() {
 
   {
     HandleScope handle_scope(isolate());
-#define SYMBOL_INIT(_, name, description)                                \
+#define PUBLIC_SYMBOL_INIT(_, name, description)                         \
   Handle<Symbol> name = factory->NewSymbol(AllocationType::kReadOnly);   \
   Handle<String> name##d = factory->InternalizeUtf8String(#description); \
   name->set_description(*name##d);                                       \
   roots_table()[RootIndex::k##name] = name->ptr();
-    PUBLIC_SYMBOL_LIST_GENERATOR(SYMBOL_INIT, /* not used */)
-#undef SYMBOL_INIT
 
-#define SYMBOL_INIT(_, name, description)                                \
+    PUBLIC_SYMBOL_LIST_GENERATOR(PUBLIC_SYMBOL_INIT, /* not used */)
+
+#define WELL_KNOWN_SYMBOL_INIT(_, name, description)                     \
   Handle<Symbol> name = factory->NewSymbol(AllocationType::kReadOnly);   \
   Handle<String> name##d = factory->InternalizeUtf8String(#description); \
   name->set_is_well_known_symbol(true);                                  \
   name->set_description(*name##d);                                       \
   roots_table()[RootIndex::k##name] = name->ptr();
-    WELL_KNOWN_SYMBOL_LIST_GENERATOR(SYMBOL_INIT, /* not used */)
-#undef SYMBOL_INIT
+
+    WELL_KNOWN_SYMBOL_LIST_GENERATOR(WELL_KNOWN_SYMBOL_INIT, /* not used */)
 
     // Mark "Interesting Symbols" appropriately.
     to_string_tag_symbol->set_is_interesting_symbol(true);
   }
 
+  {
+    // All Names that can cause protector invalidation have to be allocated
+    // consecutively to allow for fast checks
+
+    // Allocate the symbols's internal strings first, so we don't get
+    // interleaved string allocations for the symbols later.
+#define ALLOCATE_SYMBOL_STRING(_, name, description) \
+  Handle<String> name##symbol_string =               \
+      factory->InternalizeUtf8String(#description);  \
+  USE(name##symbol_string);
+
+    SYMBOL_FOR_PROTECTOR_LIST_GENERATOR(ALLOCATE_SYMBOL_STRING,
+                                        /* not used */)
+    WELL_KNOWN_SYMBOL_FOR_PROTECTOR_LIST_GENERATOR(ALLOCATE_SYMBOL_STRING,
+                                                   /* not used */)
+#undef ALLOCATE_SYMBOL_STRING
+
+#define INTERNALIZED_STRING_INIT(_, name, description)               \
+  Handle<String> name = factory->InternalizeUtf8String(description); \
+  roots_table()[RootIndex::k##name] = name->ptr();
+
+    INTERNALIZED_STRING_FOR_PROTECTOR_LIST_GENERATOR(INTERNALIZED_STRING_INIT,
+                                                     /* not used */)
+    SYMBOL_FOR_PROTECTOR_LIST_GENERATOR(PUBLIC_SYMBOL_INIT,
+                                        /* not used */)
+    WELL_KNOWN_SYMBOL_FOR_PROTECTOR_LIST_GENERATOR(WELL_KNOWN_SYMBOL_INIT,
+                                                   /* not used */)
+
+#ifdef DEBUG
+    roots.VerifyNameForProtectors();
+#endif
+    roots.VerifyNameForProtectorsPages();
+
+#undef INTERNALIZED_STRING_INIT
+#undef PUBLIC_SYMBOL_INIT
+#undef WELL_KNOWN_SYMBOL_INIT
+  }
+
   Handle<NameDictionary> empty_property_dictionary = NameDictionary::New(
       isolate(), 1, AllocationType::kReadOnly, USE_CUSTOM_MINIMUM_CAPACITY);
   DCHECK(!empty_property_dictionary->HasSufficientCapacityToAdd(1));

src/init/heap-symbols.h

@@ -186,7 +186,6 @@
   V(_, console_string, "console")                                     \
   V(_, constrain_string, "constrain")                                 \
   V(_, construct_string, "construct")                                 \
-  V(_, constructor_string, "constructor")                             \
   V(_, current_string, "current")                                     \
   V(_, Date_string, "Date")                                           \
   V(_, date_to_string, "[object Date]")                               \
@@ -324,7 +323,6 @@
   V(_, narrow_string, "narrow")                                       \
   V(_, native_string, "native")                                       \
   V(_, new_target_string, ".new.target")                              \
-  V(_, next_string, "next")                                           \
   V(_, NFC_string, "NFC")                                             \
   V(_, NFD_string, "NFD")                                             \
   V(_, NFKC_string, "NFKC")                                           \
@@ -369,7 +367,6 @@
   V(_, relativeTo_string, "relativeTo")                               \
   V(_, resizable_string, "resizable")                                 \
   V(_, ResizableArrayBuffer_string, "ResizableArrayBuffer")           \
-  V(_, resolve_string, "resolve")                                     \
   V(_, return_string, "return")                                       \
   V(_, revoke_string, "revoke")                                       \
   V(_, roundingIncrement_string, "roundingIncrement")                 \
@@ -398,12 +395,13 @@
   V(_, String_string, "String")                                       \
   V(_, string_string, "string")                                       \
   V(_, string_to_string, "[object String]")                           \
+  V(_, Symbol_iterator_string, "Symbol.iterator")                     \
   V(_, symbol_species_string, "[Symbol.species]")                     \
+  V(_, Symbol_species_string, "Symbol.species")                       \
   V(_, Symbol_string, "Symbol")                                       \
   V(_, symbol_string, "symbol")                                       \
   V(_, SyntaxError_string, "SyntaxError")                             \
   V(_, target_string, "target")                                       \
-  V(_, then_string, "then")                                           \
   V(_, this_function_string, ".this_function")                        \
   V(_, this_string, "this")                                           \
   V(_, throw_string, "throw")                                         \
@@ -478,13 +476,11 @@
 
 #define PUBLIC_SYMBOL_LIST_GENERATOR(V, _)                \
   V(_, async_iterator_symbol, Symbol.asyncIterator)       \
-  V(_, iterator_symbol, Symbol.iterator)                  \
   V(_, intl_fallback_symbol, IntlLegacyConstructedSymbol) \
   V(_, match_all_symbol, Symbol.matchAll)                 \
   V(_, match_symbol, Symbol.match)                        \
   V(_, replace_symbol, Symbol.replace)                    \
   V(_, search_symbol, Symbol.search)                      \
-  V(_, species_symbol, Symbol.species)                    \
   V(_, split_symbol, Symbol.split)                        \
   V(_, to_primitive_symbol, Symbol.toPrimitive)           \
   V(_, unscopables_symbol, Symbol.unscopables)
@@ -493,11 +489,28 @@
 // them to produce an undefined value when a load results in a failed access
 // check. Because this behaviour is not specified properly as of yet, it only
 // applies to a subset of spec-defined Well-Known Symbols.
-#define WELL_KNOWN_SYMBOL_LIST_GENERATOR(V, _)                 \
-  V(_, has_instance_symbol, Symbol.hasInstance)                \
-  V(_, is_concat_spreadable_symbol, Symbol.isConcatSpreadable) \
+#define WELL_KNOWN_SYMBOL_LIST_GENERATOR(V, _)  \
+  V(_, has_instance_symbol, Symbol.hasInstance) \
   V(_, to_string_tag_symbol, Symbol.toStringTag)
 
+// Custom list of Names that can cause protector invalidations.
+// These Names have to be allocated consecutively for fast checks,
+#define INTERNALIZED_STRING_FOR_PROTECTOR_LIST_GENERATOR(V, _) \
+  V(_, constructor_string, "constructor")                      \
+  V(_, next_string, "next")                                    \
+  V(_, resolve_string, "resolve")                              \
+  V(_, then_string, "then")
+
+// Note that the descriptioon string should be part of the internalized
+// string roots to make sure we don't accidentally end up allocating the
+// description in between the symbols during deserialization.
+#define SYMBOL_FOR_PROTECTOR_LIST_GENERATOR(V, _) \
+  V(_, iterator_symbol, Symbol.iterator)          \
+  V(_, species_symbol, Symbol.species)
+
+#define WELL_KNOWN_SYMBOL_FOR_PROTECTOR_LIST_GENERATOR(V, _) \
+  V(_, is_concat_spreadable_symbol, Symbol.isConcatSpreadable)
+
 #define INCREMENTAL_SCOPES(F)                                      \
   /* MC_INCREMENTAL is the top-level incremental marking scope. */ \
   F(MC_INCREMENTAL)                                                \

src/objects/lookup-inl.h

@@ -223,14 +223,23 @@ bool LookupIterator::IsCacheableTransition() {
 void LookupIterator::UpdateProtector(Isolate* isolate, Handle<Object> receiver,
                                      Handle<Name> name) {
   RCS_SCOPE(isolate, RuntimeCallCounterId::kUpdateProtector);
+  DCHECK(name->IsInternalizedString() || name->IsSymbol());
 
-  // This list must be kept in sync with
+  // This check must be kept in sync with
   // CodeStubAssembler::CheckForAssociatedProtector!
   ReadOnlyRoots roots(isolate);
-  if (*name == roots.is_concat_spreadable_symbol() ||
+  bool maybe_protector = roots.IsNameForProtector(*name);
+
+#if DEBUG
+  bool debug_maybe_protector =
       *name == roots.constructor_string() || *name == roots.next_string() ||
-      *name == roots.species_symbol() || *name == roots.iterator_symbol() ||
-      *name == roots.resolve_string() || *name == roots.then_string()) {
+      *name == roots.resolve_string() || *name == roots.then_string() ||
+      *name == roots.is_concat_spreadable_symbol() ||
+      *name == roots.iterator_symbol() || *name == roots.species_symbol();
+  DCHECK_EQ(maybe_protector, debug_maybe_protector);
+#endif  // DEBUG
+
+  if (maybe_protector) {
     InternalUpdateProtector(isolate, receiver, name);
   }
 }

src/roots/roots-inl.h

@@ -96,6 +96,26 @@ Address* ReadOnlyRoots::GetLocation(RootIndex root_index) const {
   return &read_only_roots_[index];
 }
 
+Address ReadOnlyRoots::first_name_for_protector() const {
+  return at(RootIndex::kFirstNameForProtector);
+}
+
+Address ReadOnlyRoots::last_name_for_protector() const {
+  return at(RootIndex::kLastNameForProtector);
+}
+
+bool ReadOnlyRoots::IsNameForProtector(HeapObject object) const {
+  return base::IsInRange(object.ptr(), first_name_for_protector(),
+                         last_name_for_protector());
+}
+
+void ReadOnlyRoots::VerifyNameForProtectorsPages() const {
+  // The symbols and strings that can cause protector invalidation should
+  // reside on the same page so we can do a fast range check.
+  CHECK_EQ(Page::FromAddress(first_name_for_protector()),
+           Page::FromAddress(last_name_for_protector()));
+}
+
 Address ReadOnlyRoots::at(RootIndex root_index) const {
   return *GetLocation(root_index);
 }

src/roots/roots.cc

@@ -29,6 +29,23 @@ void ReadOnlyRoots::Iterate(RootVisitor* visitor) {
 }
 
 #ifdef DEBUG
+void ReadOnlyRoots::VerifyNameForProtectors() {
+  DisallowGarbageCollection no_gc;
+  Name prev;
+  for (RootIndex root_index = RootIndex::kFirstNameForProtector;
+       root_index <= RootIndex::kLastNameForProtector; ++root_index) {
+    Name current = Name::cast(Object(at(root_index)));
+    DCHECK(IsNameForProtector(current));
+    if (root_index != RootIndex::kFirstNameForProtector) {
+      // Make sure the objects are adjacent in memory.
+      CHECK_LT(prev.address(), current.address());
+      Address computed_address = prev.address() + prev.Size();
+      CHECK_EQ(computed_address, current.address());
+    }
+    prev = current;
+  }
+}
+
 #define ROOT_TYPE_CHECK(Type, name, CamelName)   \
   bool ReadOnlyRoots::CheckType_##name() const { \
     return unchecked_##name().Is##Type();        \

src/roots/roots.h

@@ -360,6 +360,13 @@ class Symbol;
 #define WELL_KNOWN_SYMBOL_ROOT_LIST(V) \
   WELL_KNOWN_SYMBOL_LIST_GENERATOR(SYMBOL_ROOT_LIST_ADAPTER, V)
 
+// Produces (Na,e, name, CamelCase) entries
+#define NAME_FOR_PROTECTOR_ROOT_LIST(V)                            \
+  INTERNALIZED_STRING_FOR_PROTECTOR_LIST_GENERATOR(                \
+      INTERNALIZED_STRING_LIST_ADAPTER, V)                         \
+  SYMBOL_FOR_PROTECTOR_LIST_GENERATOR(SYMBOL_ROOT_LIST_ADAPTER, V) \
+  WELL_KNOWN_SYMBOL_FOR_PROTECTOR_LIST_GENERATOR(SYMBOL_ROOT_LIST_ADAPTER, V)
+
 // Adapts one ACCESSOR_INFO_LIST_GENERATOR entry to the ROOT_LIST-compatible
 // entry
 #define ACCESSOR_INFO_ROOT_LIST_ADAPTER(V, name, CamelName, ...) \
@@ -378,6 +385,7 @@ class Symbol;
   STRUCT_MAPS_LIST(V)              \
   TORQUE_DEFINED_MAP_ROOT_LIST(V)  \
   ALLOCATION_SITE_MAPS_LIST(V)     \
+  NAME_FOR_PROTECTOR_ROOT_LIST(V)  \
   DATA_HANDLER_MAPS_LIST(V)
 
 #define MUTABLE_ROOT_LIST(V)                \
@@ -392,6 +400,7 @@ class Symbol;
 // Declare all the root indices.  This defines the root list order.
 // clang-format off
 enum class RootIndex : uint16_t {
+#define COUNT_ROOT(...) +1
 #define DECL(type, name, CamelName) k##CamelName,
   ROOT_LIST(DECL)
 #undef DECL
@@ -402,21 +411,23 @@ enum class RootIndex : uint16_t {
   kFirstRoot = 0,
   kLastRoot = kRootListLength - 1,
 
-#define ROOT(...) +1
-  kReadOnlyRootsCount = 0 READ_ONLY_ROOT_LIST(ROOT),
+  kReadOnlyRootsCount = 0 READ_ONLY_ROOT_LIST(COUNT_ROOT),
   kImmortalImmovableRootsCount =
-      kReadOnlyRootsCount STRONG_MUTABLE_IMMOVABLE_ROOT_LIST(ROOT),
-#undef ROOT
+      kReadOnlyRootsCount STRONG_MUTABLE_IMMOVABLE_ROOT_LIST(COUNT_ROOT),
+
   kFirstReadOnlyRoot = kFirstRoot,
   kLastReadOnlyRoot = kFirstReadOnlyRoot + kReadOnlyRootsCount - 1,
 
+  // Use for fast protector update checks
+  kFirstNameForProtector = kconstructor_string,
+  kNameForProtectorCount = 0 NAME_FOR_PROTECTOR_ROOT_LIST(COUNT_ROOT),
+  kLastNameForProtector = kFirstNameForProtector + kNameForProtectorCount - 1,
+
   // The strong roots visited by the garbage collector (not including read-only
   // roots).
-#define ROOT(...) +1
   kMutableRootsCount = 0
-      STRONG_MUTABLE_IMMOVABLE_ROOT_LIST(ROOT)
-      STRONG_MUTABLE_MOVABLE_ROOT_LIST(ROOT),
-#undef ROOT
+      STRONG_MUTABLE_IMMOVABLE_ROOT_LIST(COUNT_ROOT)
+      STRONG_MUTABLE_MOVABLE_ROOT_LIST(COUNT_ROOT),
   kFirstStrongRoot = kLastReadOnlyRoot + 1,
   kLastStrongRoot = kFirstStrongRoot + kMutableRootsCount - 1,
 
@@ -431,9 +442,18 @@ enum class RootIndex : uint16_t {
 
   kFirstSmiRoot = kLastStrongRoot + 1,
   kLastSmiRoot = kLastRoot
+#undef COUNT_ROOT
 };
 // clang-format on
 
+static_assert(RootIndex::kFirstNameForProtector <=
+              RootIndex::kLastNameForProtector);
+#define FOR_PROTECTOR_CHECK(type, name, CamelName)                             \
+  static_assert(RootIndex::kFirstNameForProtector <= RootIndex::k##CamelName); \
+  static_assert(RootIndex::k##CamelName <= RootIndex::kLastNameForProtector);
+NAME_FOR_PROTECTOR_ROOT_LIST(FOR_PROTECTOR_CHECK)
+#undef FOR_PROTECTOR_CHECK
+
 // Represents a storage of V8 heap roots.
 class RootsTable {
  public:
@@ -573,6 +593,12 @@ class ReadOnlyRoots {
   READ_ONLY_ROOT_LIST(ROOT_ACCESSOR)
 #undef ROOT_ACCESSOR
 
+  V8_INLINE bool IsNameForProtector(HeapObject object) const;
+  V8_INLINE void VerifyNameForProtectorsPages() const;
+#ifdef DEBUG
+  void VerifyNameForProtectors();
+#endif
+
   // Get the address of a given read-only root index, without type checks.
   V8_INLINE Address at(RootIndex root_index) const;
 
@@ -582,6 +608,8 @@ class ReadOnlyRoots {
   void Iterate(RootVisitor* visitor);
 
  private:
+  V8_INLINE Address first_name_for_protector() const;
+  V8_INLINE Address last_name_for_protector() const;
 #ifdef DEBUG
 #define ROOT_TYPE_CHECK(Type, name, CamelName) \
   V8_EXPORT_PRIVATE bool CheckType_##name() const;

src/snapshot/read-only-deserializer.cc

@@ -47,6 +47,10 @@ void ReadOnlyDeserializer::DeserializeIntoIsolate() {
     }
     DeserializeDeferredObjects();
     CheckNoArrayBufferBackingStores();
+#ifdef DEBUG
+    roots.VerifyNameForProtectors();
+#endif
+    roots.VerifyNameForProtectorsPages();
   }
 
   if (should_rehash()) {

tools/v8heapconst.py

@@ -380,70 +380,70 @@ KNOWN_MAPS = {
     ("read_only_space", 0x033b1): (131, "BasicBlockCountersMarkerMap"),
     ("read_only_space", 0x033f5): (147, "ArrayBoilerplateDescriptionMap"),
     ("read_only_space", 0x034f5): (160, "InterceptorInfoMap"),
-    ("read_only_space", 0x05fc5): (132, "PromiseFulfillReactionJobTaskMap"),
-    ("read_only_space", 0x05fed): (133, "PromiseRejectReactionJobTaskMap"),
-    ("read_only_space", 0x06015): (134, "CallableTaskMap"),
-    ("read_only_space", 0x0603d): (135, "CallbackTaskMap"),
-    ("read_only_space", 0x06065): (136, "PromiseResolveThenableJobTaskMap"),
-    ("read_only_space", 0x0608d): (139, "FunctionTemplateInfoMap"),
-    ("read_only_space", 0x060b5): (140, "ObjectTemplateInfoMap"),
-    ("read_only_space", 0x060dd): (141, "AccessCheckInfoMap"),
-    ("read_only_space", 0x06105): (142, "AccessorInfoMap"),
-    ("read_only_space", 0x0612d): (143, "AccessorPairMap"),
-    ("read_only_space", 0x06155): (144, "AliasedArgumentsEntryMap"),
-    ("read_only_space", 0x0617d): (145, "AllocationMementoMap"),
-    ("read_only_space", 0x061a5): (148, "AsmWasmDataMap"),
-    ("read_only_space", 0x061cd): (149, "AsyncGeneratorRequestMap"),
-    ("read_only_space", 0x061f5): (150, "BreakPointMap"),
-    ("read_only_space", 0x0621d): (151, "BreakPointInfoMap"),
-    ("read_only_space", 0x06245): (152, "CachedTemplateObjectMap"),
-    ("read_only_space", 0x0626d): (153, "CallSiteInfoMap"),
-    ("read_only_space", 0x06295): (154, "ClassPositionsMap"),
-    ("read_only_space", 0x062bd): (155, "DebugInfoMap"),
-    ("read_only_space", 0x062e5): (157, "ErrorStackDataMap"),
-    ("read_only_space", 0x0630d): (159, "FunctionTemplateRareDataMap"),
-    ("read_only_space", 0x06335): (161, "InterpreterDataMap"),
-    ("read_only_space", 0x0635d): (162, "ModuleRequestMap"),
-    ("read_only_space", 0x06385): (163, "PromiseCapabilityMap"),
-    ("read_only_space", 0x063ad): (164, "PromiseOnStackMap"),
-    ("read_only_space", 0x063d5): (165, "PromiseReactionMap"),
-    ("read_only_space", 0x063fd): (166, "PropertyDescriptorObjectMap"),
-    ("read_only_space", 0x06425): (167, "PrototypeInfoMap"),
-    ("read_only_space", 0x0644d): (168, "RegExpBoilerplateDescriptionMap"),
-    ("read_only_space", 0x06475): (169, "ScriptMap"),
-    ("read_only_space", 0x0649d): (170, "ScriptOrModuleMap"),
-    ("read_only_space", 0x064c5): (171, "SourceTextModuleInfoEntryMap"),
-    ("read_only_space", 0x064ed): (172, "StackFrameInfoMap"),
-    ("read_only_space", 0x06515): (173, "TemplateObjectDescriptionMap"),
-    ("read_only_space", 0x0653d): (174, "Tuple2Map"),
-    ("read_only_space", 0x06565): (175, "WasmContinuationObjectMap"),
-    ("read_only_space", 0x0658d): (176, "WasmExceptionTagMap"),
-    ("read_only_space", 0x065b5): (177, "WasmIndirectFunctionTableMap"),
-    ("read_only_space", 0x065dd): (197, "SloppyArgumentsElementsMap"),
-    ("read_only_space", 0x06605): (233, "DescriptorArrayMap"),
-    ("read_only_space", 0x0662d): (219, "UncompiledDataWithoutPreparseDataMap"),
-    ("read_only_space", 0x06655): (217, "UncompiledDataWithPreparseDataMap"),
-    ("read_only_space", 0x0667d): (220, "UncompiledDataWithoutPreparseDataWithJobMap"),
-    ("read_only_space", 0x066a5): (218, "UncompiledDataWithPreparseDataAndJobMap"),
-    ("read_only_space", 0x066cd): (252, "OnHeapBasicBlockProfilerDataMap"),
-    ("read_only_space", 0x066f5): (198, "TurbofanBitsetTypeMap"),
-    ("read_only_space", 0x0671d): (202, "TurbofanUnionTypeMap"),
-    ("read_only_space", 0x06745): (201, "TurbofanRangeTypeMap"),
-    ("read_only_space", 0x0676d): (199, "TurbofanHeapConstantTypeMap"),
-    ("read_only_space", 0x06795): (200, "TurbofanOtherNumberConstantTypeMap"),
-    ("read_only_space", 0x067bd): (248, "InternalClassMap"),
-    ("read_only_space", 0x067e5): (259, "SmiPairMap"),
-    ("read_only_space", 0x0680d): (258, "SmiBoxMap"),
-    ("read_only_space", 0x06835): (225, "ExportedSubClassBaseMap"),
-    ("read_only_space", 0x0685d): (226, "ExportedSubClassMap"),
-    ("read_only_space", 0x06885): (231, "AbstractInternalClassSubclass1Map"),
-    ("read_only_space", 0x068ad): (232, "AbstractInternalClassSubclass2Map"),
-    ("read_only_space", 0x068d5): (196, "InternalClassWithSmiElementsMap"),
-    ("read_only_space", 0x068fd): (249, "InternalClassWithStructElementsMap"),
-    ("read_only_space", 0x06925): (227, "ExportedSubClass2Map"),
-    ("read_only_space", 0x0694d): (260, "SortStateMap"),
-    ("read_only_space", 0x06975): (146, "AllocationSiteWithWeakNextMap"),
-    ("read_only_space", 0x0699d): (146, "AllocationSiteWithoutWeakNextMap"),
+    ("read_only_space", 0x05f21): (132, "PromiseFulfillReactionJobTaskMap"),
+    ("read_only_space", 0x05f49): (133, "PromiseRejectReactionJobTaskMap"),
+    ("read_only_space", 0x05f71): (134, "CallableTaskMap"),
+    ("read_only_space", 0x05f99): (135, "CallbackTaskMap"),
+    ("read_only_space", 0x05fc1): (136, "PromiseResolveThenableJobTaskMap"),
+    ("read_only_space", 0x05fe9): (139, "FunctionTemplateInfoMap"),
+    ("read_only_space", 0x06011): (140, "ObjectTemplateInfoMap"),
+    ("read_only_space", 0x06039): (141, "AccessCheckInfoMap"),
+    ("read_only_space", 0x06061): (142, "AccessorInfoMap"),
+    ("read_only_space", 0x06089): (143, "AccessorPairMap"),
+    ("read_only_space", 0x060b1): (144, "AliasedArgumentsEntryMap"),
+    ("read_only_space", 0x060d9): (145, "AllocationMementoMap"),
+    ("read_only_space", 0x06101): (148, "AsmWasmDataMap"),
+    ("read_only_space", 0x06129): (149, "AsyncGeneratorRequestMap"),
+    ("read_only_space", 0x06151): (150, "BreakPointMap"),
+    ("read_only_space", 0x06179): (151, "BreakPointInfoMap"),
+    ("read_only_space", 0x061a1): (152, "CachedTemplateObjectMap"),
+    ("read_only_space", 0x061c9): (153, "CallSiteInfoMap"),
+    ("read_only_space", 0x061f1): (154, "ClassPositionsMap"),
+    ("read_only_space", 0x06219): (155, "DebugInfoMap"),
+    ("read_only_space", 0x06241): (157, "ErrorStackDataMap"),
+    ("read_only_space", 0x06269): (159, "FunctionTemplateRareDataMap"),
+    ("read_only_space", 0x06291): (161, "InterpreterDataMap"),
+    ("read_only_space", 0x062b9): (162, "ModuleRequestMap"),
+    ("read_only_space", 0x062e1): (163, "PromiseCapabilityMap"),
+    ("read_only_space", 0x06309): (164, "PromiseOnStackMap"),
+    ("read_only_space", 0x06331): (165, "PromiseReactionMap"),
+    ("read_only_space", 0x06359): (166, "PropertyDescriptorObjectMap"),
+    ("read_only_space", 0x06381): (167, "PrototypeInfoMap"),
+    ("read_only_space", 0x063a9): (168, "RegExpBoilerplateDescriptionMap"),
+    ("read_only_space", 0x063d1): (169, "ScriptMap"),
+    ("read_only_space", 0x063f9): (170, "ScriptOrModuleMap"),
+    ("read_only_space", 0x06421): (171, "SourceTextModuleInfoEntryMap"),
+    ("read_only_space", 0x06449): (172, "StackFrameInfoMap"),
+    ("read_only_space", 0x06471): (173, "TemplateObjectDescriptionMap"),
+    ("read_only_space", 0x06499): (174, "Tuple2Map"),
+    ("read_only_space", 0x064c1): (175, "WasmContinuationObjectMap"),
+    ("read_only_space", 0x064e9): (176, "WasmExceptionTagMap"),
+    ("read_only_space", 0x06511): (177, "WasmIndirectFunctionTableMap"),
+    ("read_only_space", 0x06539): (197, "SloppyArgumentsElementsMap"),
+    ("read_only_space", 0x06561): (233, "DescriptorArrayMap"),
+    ("read_only_space", 0x06589): (219, "UncompiledDataWithoutPreparseDataMap"),
+    ("read_only_space", 0x065b1): (217, "UncompiledDataWithPreparseDataMap"),
+    ("read_only_space", 0x065d9): (220, "UncompiledDataWithoutPreparseDataWithJobMap"),
+    ("read_only_space", 0x06601): (218, "UncompiledDataWithPreparseDataAndJobMap"),
+    ("read_only_space", 0x06629): (252, "OnHeapBasicBlockProfilerDataMap"),
+    ("read_only_space", 0x06651): (198, "TurbofanBitsetTypeMap"),
+    ("read_only_space", 0x06679): (202, "TurbofanUnionTypeMap"),
+    ("read_only_space", 0x066a1): (201, "TurbofanRangeTypeMap"),
+    ("read_only_space", 0x066c9): (199, "TurbofanHeapConstantTypeMap"),
+    ("read_only_space", 0x066f1): (200, "TurbofanOtherNumberConstantTypeMap"),
+    ("read_only_space", 0x06719): (248, "InternalClassMap"),
+    ("read_only_space", 0x06741): (259, "SmiPairMap"),
+    ("read_only_space", 0x06769): (258, "SmiBoxMap"),
+    ("read_only_space", 0x06791): (225, "ExportedSubClassBaseMap"),
+    ("read_only_space", 0x067b9): (226, "ExportedSubClassMap"),
+    ("read_only_space", 0x067e1): (231, "AbstractInternalClassSubclass1Map"),
+    ("read_only_space", 0x06809): (232, "AbstractInternalClassSubclass2Map"),
+    ("read_only_space", 0x06831): (196, "InternalClassWithSmiElementsMap"),
+    ("read_only_space", 0x06859): (249, "InternalClassWithStructElementsMap"),
+    ("read_only_space", 0x06881): (227, "ExportedSubClass2Map"),
+    ("read_only_space", 0x068a9): (260, "SortStateMap"),
+    ("read_only_space", 0x068d1): (146, "AllocationSiteWithWeakNextMap"),
+    ("read_only_space", 0x068f9): (146, "AllocationSiteWithoutWeakNextMap"),
     ("read_only_space", 0x069c5): (137, "LoadHandler1Map"),
     ("read_only_space", 0x069ed): (137, "LoadHandler2Map"),
     ("read_only_space", 0x06a15): (137, "LoadHandler3Map"),