[heap] Split old-to-new remembered set

Split OLD_TO_NEW remembered set and add OLD_TO_NEW_SWEEPING. The
OLD_TO_NEW remembered set is moved to OLD_TO_NEW_SWEEPING during
mark-compact. OLD_TO_NEW_SWEEPING is then modified by the sweeper.
Before using the page again, OLD_TO_NEW and OLD_TO_NEW_SWEEPING are
merged again.

This means only the main thread modifies OLD_TO_NEW, the sweeper only
removes entries from OLD_TO_NEW_SWEEPING. We can use this property
to make accesses non-atomic in a subsequent CL.

Bug: v8:9454
Change-Id: I9057cf85818d647775ae4c7beec4c8ccf73e18f7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1771783Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63807}

src/heap/heap.cc

@@ -4115,6 +4115,17 @@ void CollectSlots(MemoryChunk* chunk, Address start, Address end,
         return KEEP_SLOT;
       },
       SlotSet::PREFREE_EMPTY_BUCKETS);
+  if (direction == OLD_TO_NEW) {
+    RememberedSetSweeping::Iterate(
+        chunk,
+        [start, end, untyped](MaybeObjectSlot slot) {
+          if (start <= slot.address() && slot.address() < end) {
+            untyped->insert(slot.address());
+          }
+          return KEEP_SLOT;
+        },
+        SlotSet::PREFREE_EMPTY_BUCKETS);
+  }
   RememberedSet<direction>::IterateTyped(
       chunk, [=](SlotType type, Address slot) {
         if (start <= slot && slot < end) {
@@ -5547,8 +5558,10 @@ void Heap::ClearRecordedSlot(HeapObject object, ObjectSlot slot) {
   Page* page = Page::FromAddress(slot.address());
   if (!page->InYoungGeneration()) {
     DCHECK_EQ(page->owner_identity(), OLD_SPACE);
+
     store_buffer()->MoveAllEntriesToRememberedSet();
     RememberedSet<OLD_TO_NEW>::Remove(page, slot.address());
+    RememberedSetSweeping::Remove(page, slot.address());
   }
 #endif
 }
@@ -5561,8 +5574,9 @@ void Heap::VerifyClearedSlot(HeapObject object, ObjectSlot slot) {
   Page* page = Page::FromAddress(slot.address());
   DCHECK_EQ(page->owner_identity(), OLD_SPACE);
   store_buffer()->MoveAllEntriesToRememberedSet();
-  CHECK(!RememberedSet<OLD_TO_NEW>::Contains(page, slot.address()));
-  // Old to old slots are filtered with invalidated slots.
+  // Slots are filtered with invalidated slots.
+  CHECK_IMPLIES(RememberedSet<OLD_TO_NEW>::Contains(page, slot.address()),
+                page->RegisteredObjectWithInvalidatedSlots<OLD_TO_NEW>(object));
   CHECK_IMPLIES(RememberedSet<OLD_TO_OLD>::Contains(page, slot.address()),
                 page->RegisteredObjectWithInvalidatedSlots<OLD_TO_OLD>(object));
 #endif
@@ -5575,9 +5589,12 @@ void Heap::ClearRecordedSlotRange(Address start, Address end) {
   DCHECK(!page->IsLargePage());
   if (!page->InYoungGeneration()) {
     DCHECK_EQ(page->owner_identity(), OLD_SPACE);
+
     store_buffer()->MoveAllEntriesToRememberedSet();
     RememberedSet<OLD_TO_NEW>::RemoveRange(page, start, end,
                                            SlotSet::KEEP_EMPTY_BUCKETS);
+    RememberedSetSweeping::RemoveRange(page, start, end,
+                                       SlotSet::KEEP_EMPTY_BUCKETS);
   }
 #endif
 }

src/heap/heap.h

@@ -855,7 +855,6 @@ class Heap {
   static Address store_buffer_overflow_function_address();
 
   void MoveStoreBufferEntriesToRememberedSet();
-
   void ClearRecordedSlot(HeapObject object, ObjectSlot slot);
   void ClearRecordedSlotRange(Address start, Address end);
 

src/heap/mark-compact.cc

@@ -3421,6 +3421,17 @@ class RememberedSetUpdatingItem : public UpdatingItem {
           SlotSet::PREFREE_EMPTY_BUCKETS);
     }
 
+    if (chunk_->sweeping_slot_set<AccessMode::NON_ATOMIC>()) {
+      InvalidatedSlotsFilter filter = InvalidatedSlotsFilter::OldToNew(chunk_);
+      RememberedSetSweeping::Iterate(
+          chunk_,
+          [this, &filter](MaybeObjectSlot slot) {
+            CHECK(filter.IsValid(slot.address()));
+            return CheckAndUpdateOldToNewSlot(slot);
+          },
+          SlotSet::PREFREE_EMPTY_BUCKETS);
+    }
+
     if (chunk_->invalidated_slots<OLD_TO_NEW>() != nullptr) {
       // The invalidated slots are not needed after old-to-new slots were
       // processed.
@@ -3437,6 +3448,7 @@ class RememberedSetUpdatingItem : public UpdatingItem {
             return UpdateSlot<AccessMode::NON_ATOMIC>(slot);
           },
           SlotSet::PREFREE_EMPTY_BUCKETS);
+      chunk_->ReleaseSlotSet<OLD_TO_OLD>();
     }
     if ((updating_mode_ == RememberedSetUpdatingMode::ALL) &&
         chunk_->invalidated_slots<OLD_TO_OLD>() != nullptr) {
@@ -3556,15 +3568,18 @@ int MarkCompactCollectorBase::CollectRememberedSetUpdatingItems(
     const bool contains_old_to_new_slots =
         chunk->slot_set<OLD_TO_NEW>() != nullptr ||
         chunk->typed_slot_set<OLD_TO_NEW>() != nullptr;
+    const bool contains_old_to_new_sweeping_slots =
+        chunk->sweeping_slot_set() != nullptr;
     const bool contains_old_to_old_invalidated_slots =
         chunk->invalidated_slots<OLD_TO_OLD>() != nullptr;
     const bool contains_old_to_new_invalidated_slots =
         chunk->invalidated_slots<OLD_TO_NEW>() != nullptr;
-    if (!contains_old_to_new_slots && !contains_old_to_old_slots &&
-        !contains_old_to_old_invalidated_slots &&
+    if (!contains_old_to_new_slots && !contains_old_to_new_sweeping_slots &&
+        !contains_old_to_old_slots && !contains_old_to_old_invalidated_slots &&
         !contains_old_to_new_invalidated_slots)
       continue;
     if (mode == RememberedSetUpdatingMode::ALL || contains_old_to_new_slots ||
+        contains_old_to_new_sweeping_slots ||
         contains_old_to_old_invalidated_slots ||
         contains_old_to_new_invalidated_slots) {
       job->AddItem(CreateRememberedSetUpdatingItem(chunk, mode));
@@ -4651,6 +4666,14 @@ class PageMarkingItem : public MarkingItem {
           return CheckAndMarkObject(task, slot);
         },
         SlotSet::PREFREE_EMPTY_BUCKETS);
+    filter = InvalidatedSlotsFilter::OldToNew(chunk_);
+    RememberedSetSweeping::Iterate(
+        chunk_,
+        [this, task, &filter](MaybeObjectSlot slot) {
+          if (!filter.IsValid(slot.address())) return REMOVE_SLOT;
+          return CheckAndMarkObject(task, slot);
+        },
+        SlotSet::PREFREE_EMPTY_BUCKETS);
   }
 
   void MarkTypedPointers(YoungGenerationMarkingTask* task) {

src/heap/remembered-set.h

@@ -18,54 +18,38 @@ namespace internal {
 
 enum RememberedSetIterationMode { SYNCHRONIZED, NON_SYNCHRONIZED };
 
-// TODO(ulan): Investigate performance of de-templatizing this class.
-template <RememberedSetType type>
-class RememberedSet : public AllStatic {
+class RememberedSetOperations {
  public:
   // Given a page and a slot in that page, this function adds the slot to the
   // remembered set.
-  template <AccessMode access_mode = AccessMode::ATOMIC>
-  static void Insert(MemoryChunk* chunk, Address slot_addr) {
+  template <AccessMode access_mode>
+  static void Insert(SlotSet* slot_set, MemoryChunk* chunk, Address slot_addr) {
     DCHECK(chunk->Contains(slot_addr));
-    SlotSet* slot_set = chunk->slot_set<type, access_mode>();
-    if (slot_set == nullptr) {
-      slot_set = chunk->AllocateSlotSet<type>();
-    }
     uintptr_t offset = slot_addr - chunk->address();
     slot_set[offset / Page::kPageSize].Insert<access_mode>(offset %
                                                            Page::kPageSize);
   }
 
-  // Given a page and a slot in that page, this function returns true if
-  // the remembered set contains the slot.
-  static bool Contains(MemoryChunk* chunk, Address slot_addr) {
-    DCHECK(chunk->Contains(slot_addr));
-    SlotSet* slot_set = chunk->slot_set<type>();
-    if (slot_set == nullptr) {
-      return false;
+  template <typename Callback>
+  static void Iterate(SlotSet* slots, MemoryChunk* chunk, Callback callback,
+                      SlotSet::EmptyBucketMode mode) {
+    if (slots != nullptr) {
+      size_t pages = (chunk->size() + Page::kPageSize - 1) / Page::kPageSize;
+      for (size_t page = 0; page < pages; page++) {
+        slots[page].Iterate(callback, mode);
+      }
     }
-    uintptr_t offset = slot_addr - chunk->address();
-    return slot_set[offset / Page::kPageSize].Contains(offset %
-                                                       Page::kPageSize);
   }
 
-  // Given a page and a slot in that page, this function removes the slot from
-  // the remembered set.
-  // If the slot was never added, then the function does nothing.
-  static void Remove(MemoryChunk* chunk, Address slot_addr) {
-    DCHECK(chunk->Contains(slot_addr));
-    SlotSet* slot_set = chunk->slot_set<type>();
+  static void Remove(SlotSet* slot_set, MemoryChunk* chunk, Address slot_addr) {
     if (slot_set != nullptr) {
       uintptr_t offset = slot_addr - chunk->address();
       slot_set[offset / Page::kPageSize].Remove(offset % Page::kPageSize);
     }
   }
 
-  // Given a page and a range of slots in that page, this function removes the
-  // slots from the remembered set.
-  static void RemoveRange(MemoryChunk* chunk, Address start, Address end,
-                          SlotSet::EmptyBucketMode mode) {
-    SlotSet* slot_set = chunk->slot_set<type>();
+  static void RemoveRange(SlotSet* slot_set, MemoryChunk* chunk, Address start,
+                          Address end, SlotSet::EmptyBucketMode mode) {
     if (slot_set != nullptr) {
       uintptr_t start_offset = start - chunk->address();
       uintptr_t end_offset = end - chunk->address();
@@ -101,6 +85,53 @@ class RememberedSet : public AllStatic {
       }
     }
   }
+};
+
+// TODO(ulan): Investigate performance of de-templatizing this class.
+template <RememberedSetType type>
+class RememberedSet : public AllStatic {
+ public:
+  // Given a page and a slot in that page, this function adds the slot to the
+  // remembered set.
+  template <AccessMode access_mode = AccessMode::ATOMIC>
+  static void Insert(MemoryChunk* chunk, Address slot_addr) {
+    DCHECK(chunk->Contains(slot_addr));
+    SlotSet* slot_set = chunk->slot_set<type, access_mode>();
+    if (slot_set == nullptr) {
+      slot_set = chunk->AllocateSlotSet<type>();
+    }
+    RememberedSetOperations::Insert<access_mode>(slot_set, chunk, slot_addr);
+  }
+
+  // Given a page and a slot in that page, this function returns true if
+  // the remembered set contains the slot.
+  static bool Contains(MemoryChunk* chunk, Address slot_addr) {
+    DCHECK(chunk->Contains(slot_addr));
+    SlotSet* slot_set = chunk->slot_set<type>();
+    if (slot_set == nullptr) {
+      return false;
+    }
+    uintptr_t offset = slot_addr - chunk->address();
+    return slot_set[offset / Page::kPageSize].Contains(offset %
+                                                       Page::kPageSize);
+  }
+
+  // Given a page and a slot in that page, this function removes the slot from
+  // the remembered set.
+  // If the slot was never added, then the function does nothing.
+  static void Remove(MemoryChunk* chunk, Address slot_addr) {
+    DCHECK(chunk->Contains(slot_addr));
+    SlotSet* slot_set = chunk->slot_set<type>();
+    RememberedSetOperations::Remove(slot_set, chunk, slot_addr);
+  }
+
+  // Given a page and a range of slots in that page, this function removes the
+  // slots from the remembered set.
+  static void RemoveRange(MemoryChunk* chunk, Address start, Address end,
+                          SlotSet::EmptyBucketMode mode) {
+    SlotSet* slot_set = chunk->slot_set<type>();
+    RememberedSetOperations::RemoveRange(slot_set, chunk, start, end, mode);
+  }
 
   // Iterates and filters the remembered set with the given callback.
   // The callback should take (Address slot) and return SlotCallbackResult.
@@ -122,8 +153,11 @@ class RememberedSet : public AllStatic {
     MemoryChunk* chunk;
     while ((chunk = it.next()) != nullptr) {
       SlotSet* slots = chunk->slot_set<type>();
+      SlotSet* sweeping_slots =
+          type == OLD_TO_NEW ? chunk->sweeping_slot_set() : nullptr;
       TypedSlotSet* typed_slots = chunk->typed_slot_set<type>();
-      if (slots != nullptr || typed_slots != nullptr ||
+      if (slots != nullptr || sweeping_slots != nullptr ||
+          typed_slots != nullptr ||
           chunk->invalidated_slots<type>() != nullptr) {
         callback(chunk);
       }
@@ -140,18 +174,7 @@ class RememberedSet : public AllStatic {
   static void Iterate(MemoryChunk* chunk, Callback callback,
                       SlotSet::EmptyBucketMode mode) {
     SlotSet* slots = chunk->slot_set<type>();
-    if (slots != nullptr) {
-      size_t pages = (chunk->size() + Page::kPageSize - 1) / Page::kPageSize;
-      int new_count = 0;
-      for (size_t page = 0; page < pages; page++) {
-        new_count += slots[page].Iterate(callback, mode);
-      }
-      // Only old-to-old slot sets are released eagerly. Old-new-slot sets are
-      // released by the sweeper threads.
-      if (type == OLD_TO_OLD && new_count == 0) {
-        chunk->ReleaseSlotSet<OLD_TO_OLD>();
-      }
-    }
+    RememberedSetOperations::Iterate(slots, chunk, callback, mode);
   }
 
   static int NumberOfPreFreedEmptyBuckets(MemoryChunk* chunk) {
@@ -349,6 +372,46 @@ class UpdateTypedSlotHelper {
   }
 };
 
+class RememberedSetSweeping {
+ public:
+  template <AccessMode access_mode = AccessMode::ATOMIC>
+  static void Insert(MemoryChunk* chunk, Address slot_addr) {
+    DCHECK(chunk->Contains(slot_addr));
+    SlotSet* slot_set = chunk->sweeping_slot_set<access_mode>();
+    if (slot_set == nullptr) {
+      slot_set = chunk->AllocateSweepingSlotSet();
+    }
+    RememberedSetOperations::Insert<access_mode>(slot_set, chunk, slot_addr);
+  }
+
+  static void Remove(MemoryChunk* chunk, Address slot_addr) {
+    DCHECK(chunk->Contains(slot_addr));
+    SlotSet* slot_set = chunk->sweeping_slot_set<AccessMode::ATOMIC>();
+    RememberedSetOperations::Remove(slot_set, chunk, slot_addr);
+  }
+
+  // Given a page and a range of slots in that page, this function removes the
+  // slots from the remembered set.
+  static void RemoveRange(MemoryChunk* chunk, Address start, Address end,
+                          SlotSet::EmptyBucketMode mode) {
+    SlotSet* slot_set = chunk->sweeping_slot_set();
+    RememberedSetOperations::RemoveRange(slot_set, chunk, start, end, mode);
+  }
+
+  // Iterates and filters the remembered set in the given memory chunk with
+  // the given callback. The callback should take (Address slot) and return
+  // SlotCallbackResult.
+  //
+  // Notice that |mode| can only be of FREE* or PREFREE* if there are no other
+  // threads concurrently inserting slots.
+  template <typename Callback>
+  static void Iterate(MemoryChunk* chunk, Callback callback,
+                      SlotSet::EmptyBucketMode mode) {
+    SlotSet* slots = chunk->sweeping_slot_set();
+    RememberedSetOperations::Iterate(slots, chunk, callback, mode);
+  }
+};
+
 inline SlotType SlotTypeForRelocInfoMode(RelocInfo::Mode rmode) {
   if (RelocInfo::IsCodeTargetMode(rmode)) {
     return CODE_TARGET_SLOT;

src/heap/scavenger.cc

@@ -153,8 +153,15 @@ class IterateAndScavengePromotedObjectsVisitor final : public ObjectVisitor {
 
       if (result == KEEP_SLOT) {
         SLOW_DCHECK(target.IsHeapObject());
-        RememberedSet<OLD_TO_NEW>::Insert(MemoryChunk::FromHeapObject(host),
-                                          slot.address());
+        MemoryChunk* chunk = MemoryChunk::FromHeapObject(host);
+
+        // Sweeper is stopped during scavenge, so we can directly
+        // insert into its remembered set here.
+        if (chunk->sweeping_slot_set()) {
+          RememberedSetSweeping::Insert(chunk, slot.address());
+        } else {
+          RememberedSet<OLD_TO_NEW>::Insert(chunk, slot.address());
+        }
       }
       SLOW_DCHECK(!MarkCompactCollector::IsOnEvacuationCandidate(
           HeapObject::cast(target)));
@@ -239,8 +246,10 @@ void ScavengerCollector::CollectGarbage() {
     // access to the slots of a page and can completely avoid any locks on
     // the page itself.
     Sweeper::FilterSweepingPagesScope filter_scope(sweeper, pause_scope);
-    filter_scope.FilterOldSpaceSweepingPages(
-        [](Page* page) { return !page->ContainsSlots<OLD_TO_NEW>(); });
+    filter_scope.FilterOldSpaceSweepingPages([](Page* page) {
+      return !page->ContainsSlots<OLD_TO_NEW>() && !page->sweeping_slot_set();
+    });
+
     RememberedSet<OLD_TO_NEW>::IterateMemoryChunks(
         heap_, [&job](MemoryChunk* chunk) {
           job.AddItem(new PageScavengingItem(chunk));
@@ -440,6 +449,14 @@ void Scavenger::ScavengePage(MemoryChunk* page) {
         return CheckAndScavengeObject(heap_, slot);
       },
       SlotSet::KEEP_EMPTY_BUCKETS);
+  filter = InvalidatedSlotsFilter::OldToNew(page);
+  RememberedSetSweeping::Iterate(
+      page,
+      [this, &filter](MaybeObjectSlot slot) {
+        CHECK(filter.IsValid(slot.address()));
+        return CheckAndScavengeObject(heap_, slot);
+      },
+      SlotSet::KEEP_EMPTY_BUCKETS);
 
   if (page->invalidated_slots<OLD_TO_NEW>() != nullptr) {
     // The invalidated slots are not needed after old-to-new slots were

src/heap/spaces.cc

@@ -18,6 +18,7 @@
 #include "src/heap/gc-tracer.h"
 #include "src/heap/heap-controller.h"
 #include "src/heap/incremental-marking-inl.h"
+#include "src/heap/invalidated-slots-inl.h"
 #include "src/heap/mark-compact.h"
 #include "src/heap/read-only-heap.h"
 #include "src/heap/remembered-set.h"
@@ -698,6 +699,7 @@ MemoryChunk* MemoryChunk::Initialize(Heap* heap, Address base, size_t size,
   chunk->InitializeReservedMemory();
   base::AsAtomicPointer::Release_Store(&chunk->slot_set_[OLD_TO_NEW], nullptr);
   base::AsAtomicPointer::Release_Store(&chunk->slot_set_[OLD_TO_OLD], nullptr);
+  base::AsAtomicPointer::Release_Store(&chunk->sweeping_slot_set_, nullptr);
   base::AsAtomicPointer::Release_Store(&chunk->typed_slot_set_[OLD_TO_NEW],
                                        nullptr);
   base::AsAtomicPointer::Release_Store(&chunk->typed_slot_set_[OLD_TO_OLD],
@@ -855,6 +857,33 @@ Page* Page::ConvertNewToOld(Page* old_page) {
   return new_page;
 }
 
+void Page::MoveOldToNewRememberedSetForSweeping() {
+  CHECK_NULL(sweeping_slot_set_);
+  sweeping_slot_set_ = slot_set_[OLD_TO_NEW];
+  slot_set_[OLD_TO_NEW] = nullptr;
+}
+
+void Page::MergeOldToNewRememberedSets() {
+  if (sweeping_slot_set_ == nullptr) return;
+
+  RememberedSet<OLD_TO_NEW>::Iterate(
+      this,
+      [this](MaybeObjectSlot slot) {
+        Address address = slot.address();
+        RememberedSetSweeping::Insert(this, address);
+        return KEEP_SLOT;
+      },
+      SlotSet::KEEP_EMPTY_BUCKETS);
+
+  if (slot_set_[OLD_TO_NEW]) {
+    ReleaseSlotSet<OLD_TO_NEW>();
+  }
+
+  CHECK_NULL(slot_set_[OLD_TO_NEW]);
+  slot_set_[OLD_TO_NEW] = sweeping_slot_set_;
+  sweeping_slot_set_ = nullptr;
+}
+
 size_t MemoryChunk::CommittedPhysicalMemory() {
   if (!base::OS::HasLazyCommits() || owner_identity() == LO_SPACE)
     return size();
@@ -1375,6 +1404,7 @@ void MemoryChunk::ReleaseAllocatedMemoryNeededForWritableChunk() {
   }
 
   ReleaseSlotSet<OLD_TO_NEW>();
+  ReleaseSlotSet(&sweeping_slot_set_);
   ReleaseSlotSet<OLD_TO_OLD>();
   ReleaseTypedSlotSet<OLD_TO_NEW>();
   ReleaseTypedSlotSet<OLD_TO_OLD>();
@@ -1410,15 +1440,23 @@ template V8_EXPORT_PRIVATE SlotSet* MemoryChunk::AllocateSlotSet<OLD_TO_OLD>();
 
 template <RememberedSetType type>
 SlotSet* MemoryChunk::AllocateSlotSet() {
-  SlotSet* slot_set = AllocateAndInitializeSlotSet(size(), address());
+  return AllocateSlotSet(&slot_set_[type]);
+}
+
+SlotSet* MemoryChunk::AllocateSweepingSlotSet() {
+  return AllocateSlotSet(&sweeping_slot_set_);
+}
+
+SlotSet* MemoryChunk::AllocateSlotSet(SlotSet** slot_set) {
+  SlotSet* new_slot_set = AllocateAndInitializeSlotSet(size(), address());
   SlotSet* old_slot_set = base::AsAtomicPointer::Release_CompareAndSwap(
-      &slot_set_[type], nullptr, slot_set);
+      slot_set, nullptr, new_slot_set);
   if (old_slot_set != nullptr) {
-    delete[] slot_set;
-    slot_set = old_slot_set;
+    delete[] new_slot_set;
+    new_slot_set = old_slot_set;
   }
-  DCHECK(slot_set);
-  return slot_set;
+  DCHECK(new_slot_set);
+  return new_slot_set;
 }
 
 template void MemoryChunk::ReleaseSlotSet<OLD_TO_NEW>();
@@ -1426,10 +1464,13 @@ template void MemoryChunk::ReleaseSlotSet<OLD_TO_OLD>();
 
 template <RememberedSetType type>
 void MemoryChunk::ReleaseSlotSet() {
-  SlotSet* slot_set = slot_set_[type];
-  if (slot_set) {
-    slot_set_[type] = nullptr;
-    delete[] slot_set;
+  ReleaseSlotSet(&slot_set_[type]);
+}
+
+void MemoryChunk::ReleaseSlotSet(SlotSet** slot_set) {
+  if (*slot_set) {
+    delete[] * slot_set;
+    *slot_set = nullptr;
   }
 }
 
@@ -1626,6 +1667,13 @@ void PagedSpace::RefillFreeList() {
   DCHECK(!IsDetached());
   MarkCompactCollector* collector = heap()->mark_compact_collector();
   size_t added = 0;
+
+  // Avoid races with concurrent store buffer processing when merging
+  // old-to-new remembered sets later.
+  if (!is_local()) {
+    heap()->MoveStoreBufferEntriesToRememberedSet();
+  }
+
   {
     Page* p = nullptr;
     while ((p = collector->sweeper()->GetSweptPageSafe(this)) != nullptr) {
@@ -1636,6 +1684,15 @@ void PagedSpace::RefillFreeList() {
           category->Reset(free_list());
         });
       }
+
+      // Also merge old-to-new remembered sets outside of collections.
+      // Do not do this during GC, because of races during scavenges.
+      // One thread might iterate remembered set, while another thread merges
+      // them.
+      if (!is_local()) {
+        p->MergeOldToNewRememberedSets();
+      }
+
       // Only during compaction pages can actually change ownership. This is
       // safe because there exists no other competing action on the page links
       // during compaction.
@@ -1678,6 +1735,9 @@ void PagedSpace::MergeCompactionSpace(CompactionSpace* other) {
   // Move over pages.
   for (auto it = other->begin(); it != other->end();) {
     Page* p = *(it++);
+
+    p->MergeOldToNewRememberedSets();
+
     // Relinking requires the category to be unlinked.
     other->RemovePage(p);
     AddPage(p);

src/heap/spaces.h

@@ -133,7 +133,7 @@ enum class SpaceAccountingMode { kSpaceAccounted, kSpaceUnaccounted };
 enum RememberedSetType {
   OLD_TO_NEW,
   OLD_TO_OLD,
-  NUMBER_OF_REMEMBERED_SET_TYPES = OLD_TO_OLD + 1
+  NUMBER_OF_REMEMBERED_SET_TYPES
 };
 
 // A free list category maintains a linked list of free memory blocks.
@@ -607,6 +607,7 @@ class MemoryChunk : public BasicMemoryChunk {
       + kSizetSize                   // size_t progress_bar_
       + kIntptrSize                  // intptr_t live_byte_count_
       + kSystemPointerSize * NUMBER_OF_REMEMBERED_SET_TYPES  // SlotSet* array
+      + kSystemPointerSize  // SlotSet* sweeping_slot_set_
       + kSystemPointerSize *
             NUMBER_OF_REMEMBERED_SET_TYPES  // TypedSlotSet* array
       + kSystemPointerSize *
@@ -706,6 +707,13 @@ class MemoryChunk : public BasicMemoryChunk {
     return slot_set_[type];
   }
 
+  template <AccessMode access_mode = AccessMode::ATOMIC>
+  SlotSet* sweeping_slot_set() {
+    if (access_mode == AccessMode::ATOMIC)
+      return base::AsAtomicPointer::Acquire_Load(&sweeping_slot_set_);
+    return sweeping_slot_set_;
+  }
+
   template <RememberedSetType type, AccessMode access_mode = AccessMode::ATOMIC>
   TypedSlotSet* typed_slot_set() {
     if (access_mode == AccessMode::ATOMIC)
@@ -715,9 +723,13 @@ class MemoryChunk : public BasicMemoryChunk {
 
   template <RememberedSetType type>
   V8_EXPORT_PRIVATE SlotSet* AllocateSlotSet();
+  SlotSet* AllocateSweepingSlotSet();
+  SlotSet* AllocateSlotSet(SlotSet** slot_set);
+
   // Not safe to be called concurrently.
   template <RememberedSetType type>
   void ReleaseSlotSet();
+  void ReleaseSlotSet(SlotSet** slot_set);
   template <RememberedSetType type>
   TypedSlotSet* AllocateTypedSlotSet();
   // Not safe to be called concurrently.
@@ -911,6 +923,7 @@ class MemoryChunk : public BasicMemoryChunk {
   // set for large pages. In the latter case the number of entries in the array
   // is ceil(size() / kPageSize).
   SlotSet* slot_set_[NUMBER_OF_REMEMBERED_SET_TYPES];
+  SlotSet* sweeping_slot_set_;
   TypedSlotSet* typed_slot_set_[NUMBER_OF_REMEMBERED_SET_TYPES];
   InvalidatedSlots* invalidated_slots_[NUMBER_OF_REMEMBERED_SET_TYPES];
 
@@ -1093,6 +1106,9 @@ class Page : public MemoryChunk {
   void AllocateFreeListCategories();
   void ReleaseFreeListCategories();
 
+  void MoveOldToNewRememberedSetForSweeping();
+  void MergeOldToNewRememberedSets();
+
 #ifdef DEBUG
   void Print();
 #endif  // DEBUG

src/heap/sweeper.cc

@@ -320,8 +320,8 @@ int Sweeper::RawSweep(
             ClearFreedMemoryMode::kClearFreedMemory);
       }
       if (should_reduce_memory_) p->DiscardUnusedMemory(free_start, size);
-      RememberedSet<OLD_TO_NEW>::RemoveRange(p, free_start, free_end,
-                                             SlotSet::KEEP_EMPTY_BUCKETS);
+      RememberedSetSweeping::RemoveRange(p, free_start, free_end,
+                                         SlotSet::KEEP_EMPTY_BUCKETS);
       RememberedSet<OLD_TO_OLD>::RemoveRange(p, free_start, free_end,
                                              SlotSet::KEEP_EMPTY_BUCKETS);
       if (non_empty_typed_slots) {
@@ -354,8 +354,8 @@ int Sweeper::RawSweep(
                                       ClearFreedMemoryMode::kClearFreedMemory);
     }
     if (should_reduce_memory_) p->DiscardUnusedMemory(free_start, size);
-    RememberedSet<OLD_TO_NEW>::RemoveRange(p, free_start, p->area_end(),
-                                           SlotSet::KEEP_EMPTY_BUCKETS);
+    RememberedSetSweeping::RemoveRange(p, free_start, p->area_end(),
+                                       SlotSet::KEEP_EMPTY_BUCKETS);
     RememberedSet<OLD_TO_OLD>::RemoveRange(p, free_start, p->area_end(),
                                            SlotSet::KEEP_EMPTY_BUCKETS);
     if (non_empty_typed_slots) {
@@ -516,6 +516,7 @@ void Sweeper::PrepareToBeSweptPage(AllocationSpace space, Page* page) {
     DCHECK(!category->is_linked(page->owner()->free_list()));
   });
 #endif  // DEBUG
+  page->MoveOldToNewRememberedSetForSweeping();
   page->set_concurrent_sweeping_state(Page::kSweepingPending);
   heap_->paged_space(space)->IncreaseAllocatedBytes(
       marking_state_->live_bytes(page), page);

src/objects/js-objects.cc

@@ -2795,7 +2795,6 @@ void MigrateFastToFast(Isolate* isolate, Handle<JSObject> object,
           index, HeapNumber::cast(value).value_as_bits());
       if (i < old_number_of_fields && !old_map->IsUnboxedDoubleField(index)) {
         // Transition from tagged to untagged slot.
-        heap->ClearRecordedSlot(*object, object->RawField(index.offset()));
         MemoryChunk* chunk = MemoryChunk::FromHeapObject(*object);
         chunk->InvalidateRecordedSlots(*object);
       } else {

src/runtime/runtime-object.cc

@@ -153,6 +153,9 @@ bool DeleteObjectPropertyFast(Isolate* isolate, Handle<JSReceiver> receiver,
       // Slot clearing is the reason why this entire function cannot currently
       // be implemented in the DeleteProperty stub.
       if (index.is_inobject() && !receiver_map->IsUnboxedDoubleField(index)) {
+        // We need to clear the recorded slot in this case because in-object
+        // slack tracking might not be finished. This ensures that we don't
+        // have recorded slots in free space.
         isolate->heap()->ClearRecordedSlot(*receiver,
                                            receiver->RawField(index.offset()));
         MemoryChunk* chunk = MemoryChunk::FromHeapObject(*receiver);

tools/v8heapconst.py

@@ -190,238 +190,238 @@ INSTANCE_TYPES = {
 
 # List of known V8 maps.
 KNOWN_MAPS = {
-  ("read_only_space", 0x00119): (73, "FreeSpaceMap"),
-  ("read_only_space", 0x00169): (68, "MetaMap"),
-  ("read_only_space", 0x001e9): (67, "NullMap"),
-  ("read_only_space", 0x00251): (153, "DescriptorArrayMap"),
-  ("read_only_space", 0x002b1): (148, "WeakFixedArrayMap"),
-  ("read_only_space", 0x00301): (76, "OnePointerFillerMap"),
-  ("read_only_space", 0x00351): (76, "TwoPointerFillerMap"),
-  ("read_only_space", 0x003d1): (67, "UninitializedMap"),
-  ("read_only_space", 0x00441): (8, "OneByteInternalizedStringMap"),
-  ("read_only_space", 0x004e1): (67, "UndefinedMap"),
-  ("read_only_space", 0x00541): (65, "HeapNumberMap"),
-  ("read_only_space", 0x005c1): (67, "TheHoleMap"),
-  ("read_only_space", 0x00669): (67, "BooleanMap"),
-  ("read_only_space", 0x00741): (71, "ByteArrayMap"),
-  ("read_only_space", 0x00791): (123, "FixedArrayMap"),
-  ("read_only_space", 0x007e1): (123, "FixedCOWArrayMap"),
-  ("read_only_space", 0x00831): (126, "HashTableMap"),
-  ("read_only_space", 0x00881): (64, "SymbolMap"),
-  ("read_only_space", 0x008d1): (40, "OneByteStringMap"),
-  ("read_only_space", 0x00921): (136, "ScopeInfoMap"),
-  ("read_only_space", 0x00971): (160, "SharedFunctionInfoMap"),
-  ("read_only_space", 0x009c1): (69, "CodeMap"),
-  ("read_only_space", 0x00a11): (143, "FunctionContextMap"),
-  ("read_only_space", 0x00a61): (151, "CellMap"),
-  ("read_only_space", 0x00ab1): (159, "GlobalPropertyCellMap"),
-  ("read_only_space", 0x00b01): (70, "ForeignMap"),
-  ("read_only_space", 0x00b51): (149, "TransitionArrayMap"),
-  ("read_only_space", 0x00ba1): (155, "FeedbackVectorMap"),
-  ("read_only_space", 0x00c41): (67, "ArgumentsMarkerMap"),
-  ("read_only_space", 0x00ce1): (67, "ExceptionMap"),
-  ("read_only_space", 0x00d81): (67, "TerminationExceptionMap"),
-  ("read_only_space", 0x00e29): (67, "OptimizedOutMap"),
-  ("read_only_space", 0x00ec9): (67, "StaleRegisterMap"),
-  ("read_only_space", 0x00f39): (145, "NativeContextMap"),
-  ("read_only_space", 0x00f89): (144, "ModuleContextMap"),
-  ("read_only_space", 0x00fd9): (142, "EvalContextMap"),
-  ("read_only_space", 0x01029): (146, "ScriptContextMap"),
-  ("read_only_space", 0x01079): (138, "AwaitContextMap"),
-  ("read_only_space", 0x010c9): (139, "BlockContextMap"),
-  ("read_only_space", 0x01119): (140, "CatchContextMap"),
-  ("read_only_space", 0x01169): (147, "WithContextMap"),
-  ("read_only_space", 0x011b9): (141, "DebugEvaluateContextMap"),
-  ("read_only_space", 0x01209): (137, "ScriptContextTableMap"),
-  ("read_only_space", 0x01259): (125, "ClosureFeedbackCellArrayMap"),
-  ("read_only_space", 0x012a9): (75, "FeedbackMetadataArrayMap"),
-  ("read_only_space", 0x012f9): (123, "ArrayListMap"),
-  ("read_only_space", 0x01349): (66, "BigIntMap"),
-  ("read_only_space", 0x01399): (124, "ObjectBoilerplateDescriptionMap"),
-  ("read_only_space", 0x013e9): (72, "BytecodeArrayMap"),
-  ("read_only_space", 0x01439): (152, "CodeDataContainerMap"),
-  ("read_only_space", 0x01489): (74, "FixedDoubleArrayMap"),
-  ("read_only_space", 0x014d9): (131, "GlobalDictionaryMap"),
-  ("read_only_space", 0x01529): (154, "ManyClosuresCellMap"),
-  ("read_only_space", 0x01579): (123, "ModuleInfoMap"),
-  ("read_only_space", 0x015c9): (130, "NameDictionaryMap"),
-  ("read_only_space", 0x01619): (154, "NoClosuresCellMap"),
-  ("read_only_space", 0x01669): (132, "NumberDictionaryMap"),
-  ("read_only_space", 0x016b9): (154, "OneClosureCellMap"),
-  ("read_only_space", 0x01709): (127, "OrderedHashMapMap"),
-  ("read_only_space", 0x01759): (128, "OrderedHashSetMap"),
-  ("read_only_space", 0x017a9): (129, "OrderedNameDictionaryMap"),
-  ("read_only_space", 0x017f9): (157, "PreparseDataMap"),
-  ("read_only_space", 0x01849): (158, "PropertyArrayMap"),
-  ("read_only_space", 0x01899): (150, "SideEffectCallHandlerInfoMap"),
-  ("read_only_space", 0x018e9): (150, "SideEffectFreeCallHandlerInfoMap"),
-  ("read_only_space", 0x01939): (150, "NextCallSideEffectFreeCallHandlerInfoMap"),
-  ("read_only_space", 0x01989): (133, "SimpleNumberDictionaryMap"),
-  ("read_only_space", 0x019d9): (123, "SloppyArgumentsElementsMap"),
-  ("read_only_space", 0x01a29): (161, "SmallOrderedHashMapMap"),
-  ("read_only_space", 0x01a79): (162, "SmallOrderedHashSetMap"),
-  ("read_only_space", 0x01ac9): (163, "SmallOrderedNameDictionaryMap"),
-  ("read_only_space", 0x01b19): (119, "SourceTextModuleMap"),
-  ("read_only_space", 0x01b69): (134, "StringTableMap"),
-  ("read_only_space", 0x01bb9): (120, "SyntheticModuleMap"),
-  ("read_only_space", 0x01c09): (165, "UncompiledDataWithoutPreparseDataMap"),
-  ("read_only_space", 0x01c59): (166, "UncompiledDataWithPreparseDataMap"),
-  ("read_only_space", 0x01ca9): (167, "WeakArrayListMap"),
-  ("read_only_space", 0x01cf9): (135, "EphemeronHashTableMap"),
-  ("read_only_space", 0x01d49): (122, "EmbedderDataArrayMap"),
-  ("read_only_space", 0x01d99): (168, "WeakCellMap"),
-  ("read_only_space", 0x01de9): (58, "NativeSourceStringMap"),
-  ("read_only_space", 0x01e39): (32, "StringMap"),
-  ("read_only_space", 0x01e89): (41, "ConsOneByteStringMap"),
-  ("read_only_space", 0x01ed9): (33, "ConsStringMap"),
-  ("read_only_space", 0x01f29): (45, "ThinOneByteStringMap"),
-  ("read_only_space", 0x01f79): (37, "ThinStringMap"),
-  ("read_only_space", 0x01fc9): (35, "SlicedStringMap"),
-  ("read_only_space", 0x02019): (43, "SlicedOneByteStringMap"),
-  ("read_only_space", 0x02069): (34, "ExternalStringMap"),
-  ("read_only_space", 0x020b9): (42, "ExternalOneByteStringMap"),
-  ("read_only_space", 0x02109): (50, "UncachedExternalStringMap"),
-  ("read_only_space", 0x02159): (0, "InternalizedStringMap"),
-  ("read_only_space", 0x021a9): (2, "ExternalInternalizedStringMap"),
-  ("read_only_space", 0x021f9): (10, "ExternalOneByteInternalizedStringMap"),
-  ("read_only_space", 0x02249): (18, "UncachedExternalInternalizedStringMap"),
-  ("read_only_space", 0x02299): (26, "UncachedExternalOneByteInternalizedStringMap"),
-  ("read_only_space", 0x022e9): (58, "UncachedExternalOneByteStringMap"),
-  ("read_only_space", 0x02339): (67, "SelfReferenceMarkerMap"),
-  ("read_only_space", 0x023a1): (87, "EnumCacheMap"),
-  ("read_only_space", 0x02441): (82, "ArrayBoilerplateDescriptionMap"),
-  ("read_only_space", 0x02631): (90, "InterceptorInfoMap"),
-  ("read_only_space", 0x04f51): (77, "AccessCheckInfoMap"),
-  ("read_only_space", 0x04fa1): (78, "AccessorInfoMap"),
-  ("read_only_space", 0x04ff1): (79, "AccessorPairMap"),
-  ("read_only_space", 0x05041): (80, "AliasedArgumentsEntryMap"),
-  ("read_only_space", 0x05091): (81, "AllocationMementoMap"),
-  ("read_only_space", 0x050e1): (83, "AsmWasmDataMap"),
-  ("read_only_space", 0x05131): (84, "AsyncGeneratorRequestMap"),
-  ("read_only_space", 0x05181): (85, "ClassPositionsMap"),
-  ("read_only_space", 0x051d1): (86, "DebugInfoMap"),
-  ("read_only_space", 0x05221): (88, "FunctionTemplateInfoMap"),
-  ("read_only_space", 0x05271): (89, "FunctionTemplateRareDataMap"),
-  ("read_only_space", 0x052c1): (91, "InterpreterDataMap"),
-  ("read_only_space", 0x05311): (92, "ObjectTemplateInfoMap"),
-  ("read_only_space", 0x05361): (93, "PromiseCapabilityMap"),
-  ("read_only_space", 0x053b1): (94, "PromiseReactionMap"),
-  ("read_only_space", 0x05401): (95, "PrototypeInfoMap"),
-  ("read_only_space", 0x05451): (96, "ScriptMap"),
-  ("read_only_space", 0x054a1): (97, "SourcePositionTableWithFrameCacheMap"),
-  ("read_only_space", 0x054f1): (98, "SourceTextModuleInfoEntryMap"),
-  ("read_only_space", 0x05541): (99, "StackFrameInfoMap"),
-  ("read_only_space", 0x05591): (100, "StackTraceFrameMap"),
-  ("read_only_space", 0x055e1): (101, "TemplateObjectDescriptionMap"),
-  ("read_only_space", 0x05631): (102, "Tuple2Map"),
-  ("read_only_space", 0x05681): (103, "Tuple3Map"),
-  ("read_only_space", 0x056d1): (104, "WasmCapiFunctionDataMap"),
-  ("read_only_space", 0x05721): (105, "WasmDebugInfoMap"),
-  ("read_only_space", 0x05771): (106, "WasmExceptionTagMap"),
-  ("read_only_space", 0x057c1): (107, "WasmExportedFunctionDataMap"),
-  ("read_only_space", 0x05811): (108, "WasmIndirectFunctionTableMap"),
-  ("read_only_space", 0x05861): (109, "WasmJSFunctionDataMap"),
-  ("read_only_space", 0x058b1): (110, "CallableTaskMap"),
-  ("read_only_space", 0x05901): (111, "CallbackTaskMap"),
-  ("read_only_space", 0x05951): (112, "PromiseFulfillReactionJobTaskMap"),
-  ("read_only_space", 0x059a1): (113, "PromiseRejectReactionJobTaskMap"),
-  ("read_only_space", 0x059f1): (114, "PromiseResolveThenableJobTaskMap"),
-  ("read_only_space", 0x05a41): (115, "InternalClassMap"),
-  ("read_only_space", 0x05a91): (116, "SmiPairMap"),
-  ("read_only_space", 0x05ae1): (117, "SmiBoxMap"),
-  ("read_only_space", 0x05b31): (118, "SortStateMap"),
-  ("read_only_space", 0x05b81): (121, "AllocationSiteWithWeakNextMap"),
-  ("read_only_space", 0x05bd1): (121, "AllocationSiteWithoutWeakNextMap"),
-  ("read_only_space", 0x05c21): (156, "LoadHandler1Map"),
-  ("read_only_space", 0x05c71): (156, "LoadHandler2Map"),
-  ("read_only_space", 0x05cc1): (156, "LoadHandler3Map"),
-  ("read_only_space", 0x05d11): (164, "StoreHandler0Map"),
-  ("read_only_space", 0x05d61): (164, "StoreHandler1Map"),
-  ("read_only_space", 0x05db1): (164, "StoreHandler2Map"),
-  ("read_only_space", 0x05e01): (164, "StoreHandler3Map"),
-  ("map_space", 0x00119): (1057, "ExternalMap"),
-  ("map_space", 0x00169): (1073, "JSMessageObjectMap"),
+  ("read_only_space", 0x00121): (73, "FreeSpaceMap"),
+  ("read_only_space", 0x00171): (68, "MetaMap"),
+  ("read_only_space", 0x001f1): (67, "NullMap"),
+  ("read_only_space", 0x00259): (153, "DescriptorArrayMap"),
+  ("read_only_space", 0x002b9): (148, "WeakFixedArrayMap"),
+  ("read_only_space", 0x00309): (76, "OnePointerFillerMap"),
+  ("read_only_space", 0x00359): (76, "TwoPointerFillerMap"),
+  ("read_only_space", 0x003d9): (67, "UninitializedMap"),
+  ("read_only_space", 0x00449): (8, "OneByteInternalizedStringMap"),
+  ("read_only_space", 0x004e9): (67, "UndefinedMap"),
+  ("read_only_space", 0x00549): (65, "HeapNumberMap"),
+  ("read_only_space", 0x005c9): (67, "TheHoleMap"),
+  ("read_only_space", 0x00671): (67, "BooleanMap"),
+  ("read_only_space", 0x00749): (71, "ByteArrayMap"),
+  ("read_only_space", 0x00799): (123, "FixedArrayMap"),
+  ("read_only_space", 0x007e9): (123, "FixedCOWArrayMap"),
+  ("read_only_space", 0x00839): (126, "HashTableMap"),
+  ("read_only_space", 0x00889): (64, "SymbolMap"),
+  ("read_only_space", 0x008d9): (40, "OneByteStringMap"),
+  ("read_only_space", 0x00929): (136, "ScopeInfoMap"),
+  ("read_only_space", 0x00979): (160, "SharedFunctionInfoMap"),
+  ("read_only_space", 0x009c9): (69, "CodeMap"),
+  ("read_only_space", 0x00a19): (143, "FunctionContextMap"),
+  ("read_only_space", 0x00a69): (151, "CellMap"),
+  ("read_only_space", 0x00ab9): (159, "GlobalPropertyCellMap"),
+  ("read_only_space", 0x00b09): (70, "ForeignMap"),
+  ("read_only_space", 0x00b59): (149, "TransitionArrayMap"),
+  ("read_only_space", 0x00ba9): (155, "FeedbackVectorMap"),
+  ("read_only_space", 0x00c49): (67, "ArgumentsMarkerMap"),
+  ("read_only_space", 0x00ce9): (67, "ExceptionMap"),
+  ("read_only_space", 0x00d89): (67, "TerminationExceptionMap"),
+  ("read_only_space", 0x00e31): (67, "OptimizedOutMap"),
+  ("read_only_space", 0x00ed1): (67, "StaleRegisterMap"),
+  ("read_only_space", 0x00f41): (145, "NativeContextMap"),
+  ("read_only_space", 0x00f91): (144, "ModuleContextMap"),
+  ("read_only_space", 0x00fe1): (142, "EvalContextMap"),
+  ("read_only_space", 0x01031): (146, "ScriptContextMap"),
+  ("read_only_space", 0x01081): (138, "AwaitContextMap"),
+  ("read_only_space", 0x010d1): (139, "BlockContextMap"),
+  ("read_only_space", 0x01121): (140, "CatchContextMap"),
+  ("read_only_space", 0x01171): (147, "WithContextMap"),
+  ("read_only_space", 0x011c1): (141, "DebugEvaluateContextMap"),
+  ("read_only_space", 0x01211): (137, "ScriptContextTableMap"),
+  ("read_only_space", 0x01261): (125, "ClosureFeedbackCellArrayMap"),
+  ("read_only_space", 0x012b1): (75, "FeedbackMetadataArrayMap"),
+  ("read_only_space", 0x01301): (123, "ArrayListMap"),
+  ("read_only_space", 0x01351): (66, "BigIntMap"),
+  ("read_only_space", 0x013a1): (124, "ObjectBoilerplateDescriptionMap"),
+  ("read_only_space", 0x013f1): (72, "BytecodeArrayMap"),
+  ("read_only_space", 0x01441): (152, "CodeDataContainerMap"),
+  ("read_only_space", 0x01491): (74, "FixedDoubleArrayMap"),
+  ("read_only_space", 0x014e1): (131, "GlobalDictionaryMap"),
+  ("read_only_space", 0x01531): (154, "ManyClosuresCellMap"),
+  ("read_only_space", 0x01581): (123, "ModuleInfoMap"),
+  ("read_only_space", 0x015d1): (130, "NameDictionaryMap"),
+  ("read_only_space", 0x01621): (154, "NoClosuresCellMap"),
+  ("read_only_space", 0x01671): (132, "NumberDictionaryMap"),
+  ("read_only_space", 0x016c1): (154, "OneClosureCellMap"),
+  ("read_only_space", 0x01711): (127, "OrderedHashMapMap"),
+  ("read_only_space", 0x01761): (128, "OrderedHashSetMap"),
+  ("read_only_space", 0x017b1): (129, "OrderedNameDictionaryMap"),
+  ("read_only_space", 0x01801): (157, "PreparseDataMap"),
+  ("read_only_space", 0x01851): (158, "PropertyArrayMap"),
+  ("read_only_space", 0x018a1): (150, "SideEffectCallHandlerInfoMap"),
+  ("read_only_space", 0x018f1): (150, "SideEffectFreeCallHandlerInfoMap"),
+  ("read_only_space", 0x01941): (150, "NextCallSideEffectFreeCallHandlerInfoMap"),
+  ("read_only_space", 0x01991): (133, "SimpleNumberDictionaryMap"),
+  ("read_only_space", 0x019e1): (123, "SloppyArgumentsElementsMap"),
+  ("read_only_space", 0x01a31): (161, "SmallOrderedHashMapMap"),
+  ("read_only_space", 0x01a81): (162, "SmallOrderedHashSetMap"),
+  ("read_only_space", 0x01ad1): (163, "SmallOrderedNameDictionaryMap"),
+  ("read_only_space", 0x01b21): (119, "SourceTextModuleMap"),
+  ("read_only_space", 0x01b71): (134, "StringTableMap"),
+  ("read_only_space", 0x01bc1): (120, "SyntheticModuleMap"),
+  ("read_only_space", 0x01c11): (165, "UncompiledDataWithoutPreparseDataMap"),
+  ("read_only_space", 0x01c61): (166, "UncompiledDataWithPreparseDataMap"),
+  ("read_only_space", 0x01cb1): (167, "WeakArrayListMap"),
+  ("read_only_space", 0x01d01): (135, "EphemeronHashTableMap"),
+  ("read_only_space", 0x01d51): (122, "EmbedderDataArrayMap"),
+  ("read_only_space", 0x01da1): (168, "WeakCellMap"),
+  ("read_only_space", 0x01df1): (58, "NativeSourceStringMap"),
+  ("read_only_space", 0x01e41): (32, "StringMap"),
+  ("read_only_space", 0x01e91): (41, "ConsOneByteStringMap"),
+  ("read_only_space", 0x01ee1): (33, "ConsStringMap"),
+  ("read_only_space", 0x01f31): (45, "ThinOneByteStringMap"),
+  ("read_only_space", 0x01f81): (37, "ThinStringMap"),
+  ("read_only_space", 0x01fd1): (35, "SlicedStringMap"),
+  ("read_only_space", 0x02021): (43, "SlicedOneByteStringMap"),
+  ("read_only_space", 0x02071): (34, "ExternalStringMap"),
+  ("read_only_space", 0x020c1): (42, "ExternalOneByteStringMap"),
+  ("read_only_space", 0x02111): (50, "UncachedExternalStringMap"),
+  ("read_only_space", 0x02161): (0, "InternalizedStringMap"),
+  ("read_only_space", 0x021b1): (2, "ExternalInternalizedStringMap"),
+  ("read_only_space", 0x02201): (10, "ExternalOneByteInternalizedStringMap"),
+  ("read_only_space", 0x02251): (18, "UncachedExternalInternalizedStringMap"),
+  ("read_only_space", 0x022a1): (26, "UncachedExternalOneByteInternalizedStringMap"),
+  ("read_only_space", 0x022f1): (58, "UncachedExternalOneByteStringMap"),
+  ("read_only_space", 0x02341): (67, "SelfReferenceMarkerMap"),
+  ("read_only_space", 0x023a9): (87, "EnumCacheMap"),
+  ("read_only_space", 0x02449): (82, "ArrayBoilerplateDescriptionMap"),
+  ("read_only_space", 0x02639): (90, "InterceptorInfoMap"),
+  ("read_only_space", 0x04f59): (77, "AccessCheckInfoMap"),
+  ("read_only_space", 0x04fa9): (78, "AccessorInfoMap"),
+  ("read_only_space", 0x04ff9): (79, "AccessorPairMap"),
+  ("read_only_space", 0x05049): (80, "AliasedArgumentsEntryMap"),
+  ("read_only_space", 0x05099): (81, "AllocationMementoMap"),
+  ("read_only_space", 0x050e9): (83, "AsmWasmDataMap"),
+  ("read_only_space", 0x05139): (84, "AsyncGeneratorRequestMap"),
+  ("read_only_space", 0x05189): (85, "ClassPositionsMap"),
+  ("read_only_space", 0x051d9): (86, "DebugInfoMap"),
+  ("read_only_space", 0x05229): (88, "FunctionTemplateInfoMap"),
+  ("read_only_space", 0x05279): (89, "FunctionTemplateRareDataMap"),
+  ("read_only_space", 0x052c9): (91, "InterpreterDataMap"),
+  ("read_only_space", 0x05319): (92, "ObjectTemplateInfoMap"),
+  ("read_only_space", 0x05369): (93, "PromiseCapabilityMap"),
+  ("read_only_space", 0x053b9): (94, "PromiseReactionMap"),
+  ("read_only_space", 0x05409): (95, "PrototypeInfoMap"),
+  ("read_only_space", 0x05459): (96, "ScriptMap"),
+  ("read_only_space", 0x054a9): (97, "SourcePositionTableWithFrameCacheMap"),
+  ("read_only_space", 0x054f9): (98, "SourceTextModuleInfoEntryMap"),
+  ("read_only_space", 0x05549): (99, "StackFrameInfoMap"),
+  ("read_only_space", 0x05599): (100, "StackTraceFrameMap"),
+  ("read_only_space", 0x055e9): (101, "TemplateObjectDescriptionMap"),
+  ("read_only_space", 0x05639): (102, "Tuple2Map"),
+  ("read_only_space", 0x05689): (103, "Tuple3Map"),
+  ("read_only_space", 0x056d9): (104, "WasmCapiFunctionDataMap"),
+  ("read_only_space", 0x05729): (105, "WasmDebugInfoMap"),
+  ("read_only_space", 0x05779): (106, "WasmExceptionTagMap"),
+  ("read_only_space", 0x057c9): (107, "WasmExportedFunctionDataMap"),
+  ("read_only_space", 0x05819): (108, "WasmIndirectFunctionTableMap"),
+  ("read_only_space", 0x05869): (109, "WasmJSFunctionDataMap"),
+  ("read_only_space", 0x058b9): (110, "CallableTaskMap"),
+  ("read_only_space", 0x05909): (111, "CallbackTaskMap"),
+  ("read_only_space", 0x05959): (112, "PromiseFulfillReactionJobTaskMap"),
+  ("read_only_space", 0x059a9): (113, "PromiseRejectReactionJobTaskMap"),
+  ("read_only_space", 0x059f9): (114, "PromiseResolveThenableJobTaskMap"),
+  ("read_only_space", 0x05a49): (115, "InternalClassMap"),
+  ("read_only_space", 0x05a99): (116, "SmiPairMap"),
+  ("read_only_space", 0x05ae9): (117, "SmiBoxMap"),
+  ("read_only_space", 0x05b39): (118, "SortStateMap"),
+  ("read_only_space", 0x05b89): (121, "AllocationSiteWithWeakNextMap"),
+  ("read_only_space", 0x05bd9): (121, "AllocationSiteWithoutWeakNextMap"),
+  ("read_only_space", 0x05c29): (156, "LoadHandler1Map"),
+  ("read_only_space", 0x05c79): (156, "LoadHandler2Map"),
+  ("read_only_space", 0x05cc9): (156, "LoadHandler3Map"),
+  ("read_only_space", 0x05d19): (164, "StoreHandler0Map"),
+  ("read_only_space", 0x05d69): (164, "StoreHandler1Map"),
+  ("read_only_space", 0x05db9): (164, "StoreHandler2Map"),
+  ("read_only_space", 0x05e09): (164, "StoreHandler3Map"),
+  ("map_space", 0x00121): (1057, "ExternalMap"),
+  ("map_space", 0x00171): (1073, "JSMessageObjectMap"),
 }
 
 # List of known V8 objects.
 KNOWN_OBJECTS = {
-  ("read_only_space", 0x001b9): "NullValue",
-  ("read_only_space", 0x00239): "EmptyDescriptorArray",
-  ("read_only_space", 0x002a1): "EmptyWeakFixedArray",
-  ("read_only_space", 0x003a1): "UninitializedValue",
-  ("read_only_space", 0x004b1): "UndefinedValue",
-  ("read_only_space", 0x00531): "NanValue",
-  ("read_only_space", 0x00591): "TheHoleValue",
-  ("read_only_space", 0x00629): "HoleNanValue",
-  ("read_only_space", 0x00639): "TrueValue",
-  ("read_only_space", 0x006e9): "FalseValue",
-  ("read_only_space", 0x00731): "empty_string",
-  ("read_only_space", 0x00bf1): "EmptyScopeInfo",
-  ("read_only_space", 0x00c01): "EmptyFixedArray",
-  ("read_only_space", 0x00c11): "ArgumentsMarker",
-  ("read_only_space", 0x00cb1): "Exception",
-  ("read_only_space", 0x00d51): "TerminationException",
-  ("read_only_space", 0x00df9): "OptimizedOut",
-  ("read_only_space", 0x00e99): "StaleRegister",
-  ("read_only_space", 0x02389): "EmptyEnumCache",
-  ("read_only_space", 0x023f1): "EmptyPropertyArray",
-  ("read_only_space", 0x02401): "EmptyByteArray",
-  ("read_only_space", 0x02411): "EmptyObjectBoilerplateDescription",
-  ("read_only_space", 0x02429): "EmptyArrayBoilerplateDescription",
-  ("read_only_space", 0x02491): "EmptyClosureFeedbackCellArray",
-  ("read_only_space", 0x024a1): "EmptySloppyArgumentsElements",
-  ("read_only_space", 0x024c1): "EmptySlowElementDictionary",
-  ("read_only_space", 0x02509): "EmptyOrderedHashMap",
-  ("read_only_space", 0x02531): "EmptyOrderedHashSet",
-  ("read_only_space", 0x02559): "EmptyFeedbackMetadata",
-  ("read_only_space", 0x02569): "EmptyPropertyCell",
-  ("read_only_space", 0x02591): "EmptyPropertyDictionary",
-  ("read_only_space", 0x025e1): "NoOpInterceptorInfo",
-  ("read_only_space", 0x02681): "EmptyWeakArrayList",
-  ("read_only_space", 0x02699): "InfinityValue",
-  ("read_only_space", 0x026a9): "MinusZeroValue",
-  ("read_only_space", 0x026b9): "MinusInfinityValue",
-  ("read_only_space", 0x026c9): "SelfReferenceMarker",
-  ("read_only_space", 0x02721): "OffHeapTrampolineRelocationInfo",
-  ("read_only_space", 0x02739): "TrampolineTrivialCodeDataContainer",
-  ("read_only_space", 0x02751): "TrampolinePromiseRejectionCodeDataContainer",
-  ("read_only_space", 0x02769): "GlobalThisBindingScopeInfo",
-  ("read_only_space", 0x027d1): "EmptyFunctionScopeInfo",
-  ("read_only_space", 0x02821): "HashSeed",
-  ("old_space", 0x00119): "ArgumentsIteratorAccessor",
-  ("old_space", 0x00189): "ArrayLengthAccessor",
-  ("old_space", 0x001f9): "BoundFunctionLengthAccessor",
-  ("old_space", 0x00269): "BoundFunctionNameAccessor",
-  ("old_space", 0x002d9): "ErrorStackAccessor",
-  ("old_space", 0x00349): "FunctionArgumentsAccessor",
-  ("old_space", 0x003b9): "FunctionCallerAccessor",
-  ("old_space", 0x00429): "FunctionNameAccessor",
-  ("old_space", 0x00499): "FunctionLengthAccessor",
-  ("old_space", 0x00509): "FunctionPrototypeAccessor",
-  ("old_space", 0x00579): "RegExpResultIndicesAccessor",
-  ("old_space", 0x005e9): "StringLengthAccessor",
-  ("old_space", 0x00659): "InvalidPrototypeValidityCell",
-  ("old_space", 0x00669): "EmptyScript",
-  ("old_space", 0x006e9): "ManyClosuresCell",
-  ("old_space", 0x00701): "ArrayConstructorProtector",
-  ("old_space", 0x00729): "NoElementsProtector",
-  ("old_space", 0x00751): "IsConcatSpreadableProtector",
-  ("old_space", 0x00761): "ArraySpeciesProtector",
-  ("old_space", 0x00789): "TypedArraySpeciesProtector",
-  ("old_space", 0x007b1): "PromiseSpeciesProtector",
-  ("old_space", 0x007d9): "StringLengthProtector",
-  ("old_space", 0x007e9): "ArrayIteratorProtector",
-  ("old_space", 0x00811): "ArrayBufferDetachingProtector",
-  ("old_space", 0x00839): "PromiseHookProtector",
-  ("old_space", 0x00861): "PromiseResolveProtector",
-  ("old_space", 0x00871): "MapIteratorProtector",
-  ("old_space", 0x00899): "PromiseThenProtector",
-  ("old_space", 0x008c1): "SetIteratorProtector",
-  ("old_space", 0x008e9): "StringIteratorProtector",
-  ("old_space", 0x00911): "SingleCharacterStringCache",
-  ("old_space", 0x01121): "StringSplitCache",
-  ("old_space", 0x01931): "RegExpMultipleCache",
-  ("old_space", 0x02141): "BuiltinsConstantsTable",
+  ("read_only_space", 0x001c1): "NullValue",
+  ("read_only_space", 0x00241): "EmptyDescriptorArray",
+  ("read_only_space", 0x002a9): "EmptyWeakFixedArray",
+  ("read_only_space", 0x003a9): "UninitializedValue",
+  ("read_only_space", 0x004b9): "UndefinedValue",
+  ("read_only_space", 0x00539): "NanValue",
+  ("read_only_space", 0x00599): "TheHoleValue",
+  ("read_only_space", 0x00631): "HoleNanValue",
+  ("read_only_space", 0x00641): "TrueValue",
+  ("read_only_space", 0x006f1): "FalseValue",
+  ("read_only_space", 0x00739): "empty_string",
+  ("read_only_space", 0x00bf9): "EmptyScopeInfo",
+  ("read_only_space", 0x00c09): "EmptyFixedArray",
+  ("read_only_space", 0x00c19): "ArgumentsMarker",
+  ("read_only_space", 0x00cb9): "Exception",
+  ("read_only_space", 0x00d59): "TerminationException",
+  ("read_only_space", 0x00e01): "OptimizedOut",
+  ("read_only_space", 0x00ea1): "StaleRegister",
+  ("read_only_space", 0x02391): "EmptyEnumCache",
+  ("read_only_space", 0x023f9): "EmptyPropertyArray",
+  ("read_only_space", 0x02409): "EmptyByteArray",
+  ("read_only_space", 0x02419): "EmptyObjectBoilerplateDescription",
+  ("read_only_space", 0x02431): "EmptyArrayBoilerplateDescription",
+  ("read_only_space", 0x02499): "EmptyClosureFeedbackCellArray",
+  ("read_only_space", 0x024a9): "EmptySloppyArgumentsElements",
+  ("read_only_space", 0x024c9): "EmptySlowElementDictionary",
+  ("read_only_space", 0x02511): "EmptyOrderedHashMap",
+  ("read_only_space", 0x02539): "EmptyOrderedHashSet",
+  ("read_only_space", 0x02561): "EmptyFeedbackMetadata",
+  ("read_only_space", 0x02571): "EmptyPropertyCell",
+  ("read_only_space", 0x02599): "EmptyPropertyDictionary",
+  ("read_only_space", 0x025e9): "NoOpInterceptorInfo",
+  ("read_only_space", 0x02689): "EmptyWeakArrayList",
+  ("read_only_space", 0x026a1): "InfinityValue",
+  ("read_only_space", 0x026b1): "MinusZeroValue",
+  ("read_only_space", 0x026c1): "MinusInfinityValue",
+  ("read_only_space", 0x026d1): "SelfReferenceMarker",
+  ("read_only_space", 0x02729): "OffHeapTrampolineRelocationInfo",
+  ("read_only_space", 0x02741): "TrampolineTrivialCodeDataContainer",
+  ("read_only_space", 0x02759): "TrampolinePromiseRejectionCodeDataContainer",
+  ("read_only_space", 0x02771): "GlobalThisBindingScopeInfo",
+  ("read_only_space", 0x027d9): "EmptyFunctionScopeInfo",
+  ("read_only_space", 0x02829): "HashSeed",
+  ("old_space", 0x00121): "ArgumentsIteratorAccessor",
+  ("old_space", 0x00191): "ArrayLengthAccessor",
+  ("old_space", 0x00201): "BoundFunctionLengthAccessor",
+  ("old_space", 0x00271): "BoundFunctionNameAccessor",
+  ("old_space", 0x002e1): "ErrorStackAccessor",
+  ("old_space", 0x00351): "FunctionArgumentsAccessor",
+  ("old_space", 0x003c1): "FunctionCallerAccessor",
+  ("old_space", 0x00431): "FunctionNameAccessor",
+  ("old_space", 0x004a1): "FunctionLengthAccessor",
+  ("old_space", 0x00511): "FunctionPrototypeAccessor",
+  ("old_space", 0x00581): "RegExpResultIndicesAccessor",
+  ("old_space", 0x005f1): "StringLengthAccessor",
+  ("old_space", 0x00661): "InvalidPrototypeValidityCell",
+  ("old_space", 0x00671): "EmptyScript",
+  ("old_space", 0x006f1): "ManyClosuresCell",
+  ("old_space", 0x00709): "ArrayConstructorProtector",
+  ("old_space", 0x00731): "NoElementsProtector",
+  ("old_space", 0x00759): "IsConcatSpreadableProtector",
+  ("old_space", 0x00769): "ArraySpeciesProtector",
+  ("old_space", 0x00791): "TypedArraySpeciesProtector",
+  ("old_space", 0x007b9): "PromiseSpeciesProtector",
+  ("old_space", 0x007e1): "StringLengthProtector",
+  ("old_space", 0x007f1): "ArrayIteratorProtector",
+  ("old_space", 0x00819): "ArrayBufferDetachingProtector",
+  ("old_space", 0x00841): "PromiseHookProtector",
+  ("old_space", 0x00869): "PromiseResolveProtector",
+  ("old_space", 0x00879): "MapIteratorProtector",
+  ("old_space", 0x008a1): "PromiseThenProtector",
+  ("old_space", 0x008c9): "SetIteratorProtector",
+  ("old_space", 0x008f1): "StringIteratorProtector",
+  ("old_space", 0x00919): "SingleCharacterStringCache",
+  ("old_space", 0x01129): "StringSplitCache",
+  ("old_space", 0x01939): "RegExpMultipleCache",
+  ("old_space", 0x02149): "BuiltinsConstantsTable",
 }
 
 # List of known V8 Frame Markers.