[debug] add ability to do side-effect-free call to NewInstance

Creating a new instance from a v8::Function will invoke its
constructor. If it is an API callback that has not been marked as
kHasNoSideEffect, this CL introduces a way to invoke it without
throwing.

Calls within the constructor are still checked for side effects.

Bug: chromium:829571
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ia4e410d487e2847bc511cb96f0be30a3563991f6
Reviewed-on: https://chromium-review.googlesource.com/1034116
Commit-Queue: Erik Luo <luoe@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53003}

include/v8.h

@@ -3913,6 +3913,15 @@ class V8_EXPORT Function : public Object {
     return NewInstance(context, 0, nullptr);
   }
 
+  /**
+   * When side effect checks are enabled, passing kHasNoSideEffect allows the
+   * constructor to be invoked without throwing. Calls made within the
+   * constructor are still checked.
+   */
+  V8_WARN_UNUSED_RESULT MaybeLocal<Object> NewInstanceWithSideEffectType(
+      Local<Context> context, int argc, Local<Value> argv[],
+      SideEffectType side_effect_type = SideEffectType::kHasSideEffect) const;
+
   V8_DEPRECATE_SOON("Use maybe version",
                     Local<Value> Call(Local<Value> recv, int argc,
                                       Local<Value> argv[]));

src/api.cc

@@ -5119,9 +5119,15 @@ Local<Function> Function::New(Isolate* v8_isolate, FunctionCallback callback,
       .FromMaybe(Local<Function>());
 }
 
-
 MaybeLocal<Object> Function::NewInstance(Local<Context> context, int argc,
                                          v8::Local<v8::Value> argv[]) const {
+  return NewInstanceWithSideEffectType(context, argc, argv,
+                                       SideEffectType::kHasSideEffect);
+}
+
+MaybeLocal<Object> Function::NewInstanceWithSideEffectType(
+    Local<Context> context, int argc, v8::Local<v8::Value> argv[],
+    SideEffectType side_effect_type) const {
   auto isolate = reinterpret_cast<i::Isolate*>(context->GetIsolate());
   TRACE_EVENT_CALL_STATS_SCOPED(isolate, "v8", "V8.Execute");
   ENTER_V8(isolate, context, Function, NewInstance, MaybeLocal<Object>(),
@@ -5129,10 +5135,37 @@ MaybeLocal<Object> Function::NewInstance(Local<Context> context, int argc,
   i::TimerEventScope<i::TimerEventExecute> timer_scope(isolate);
   auto self = Utils::OpenHandle(this);
   STATIC_ASSERT(sizeof(v8::Local<v8::Value>) == sizeof(i::Object**));
+  if (side_effect_type == SideEffectType::kHasNoSideEffect) {
+    CHECK(self->IsJSFunction() &&
+          i::JSFunction::cast(*self)->shared()->IsApiFunction());
+    DCHECK(isolate->debug_execution_mode() == i::DebugInfo::kSideEffects);
+    i::Object* obj =
+        i::JSFunction::cast(*self)->shared()->get_api_func_data()->call_code();
+    if (obj->IsCallHandlerInfo()) {
+      i::CallHandlerInfo* handler_info = i::CallHandlerInfo::cast(obj);
+      if (!handler_info->IsSideEffectFreeCallHandlerInfo()) {
+        handler_info->SetNextCallHasNoSideEffect();
+      }
+    }
+  }
   i::Handle<i::Object>* args = reinterpret_cast<i::Handle<i::Object>*>(argv);
   Local<Object> result;
   has_pending_exception = !ToLocal<Object>(
       i::Execution::New(isolate, self, self, argc, args), &result);
+  if (side_effect_type == SideEffectType::kHasNoSideEffect) {
+    i::Object* obj =
+        i::JSFunction::cast(*self)->shared()->get_api_func_data()->call_code();
+    if (obj->IsCallHandlerInfo()) {
+      i::CallHandlerInfo* handler_info = i::CallHandlerInfo::cast(obj);
+      if (has_pending_exception) {
+        // Restore the map if an exception prevented restoration.
+        handler_info->NextCallHasNoSideEffect();
+      } else {
+        DCHECK(handler_info->IsSideEffectCallHandlerInfo() ||
+               handler_info->IsSideEffectFreeCallHandlerInfo());
+      }
+    }
+  }
   RETURN_ON_FAILED_EXECUTION(Object);
   RETURN_ESCAPED(result);
 }

src/debug/debug.cc

@@ -2429,6 +2429,10 @@ bool Debug::PerformSideEffectCheck(Handle<JSFunction> function,
 
 bool Debug::PerformSideEffectCheckForCallback(Handle<Object> callback_info) {
   DCHECK_EQ(isolate_->debug_execution_mode(), DebugInfo::kSideEffects);
+  if (!callback_info.is_null() && callback_info->IsCallHandlerInfo() &&
+      i::CallHandlerInfo::cast(*callback_info)->NextCallHasNoSideEffect()) {
+    return true;
+  }
   // TODO(7515): always pass a valid callback info object.
   if (!callback_info.is_null() &&
       DebugEvaluate::CallbackHasNoSideEffect(*callback_info)) {

src/heap/heap.h

@@ -132,6 +132,8 @@ using v8::MemoryPressureLevel;
   V(Map, side_effect_call_handler_info_map, SideEffectCallHandlerInfoMap)      \
   V(Map, side_effect_free_call_handler_info_map,                               \
     SideEffectFreeCallHandlerInfoMap)                                          \
+  V(Map, next_call_side_effect_free_call_handler_info_map,                     \
+    NextCallSideEffectFreeCallHandlerInfoMap)                                  \
   V(Map, simple_number_dictionary_map, SimpleNumberDictionaryMap)              \
   V(Map, sloppy_arguments_elements_map, SloppyArgumentsElementsMap)            \
   V(Map, small_ordered_hash_map_map, SmallOrderedHashMapMap)                   \

src/heap/setup-heap-internal.cc

@@ -478,6 +478,8 @@ bool Heap::CreateInitialMaps() {
                  side_effect_call_handler_info)
     ALLOCATE_MAP(CALL_HANDLER_INFO_TYPE, CallHandlerInfo::kSize,
                  side_effect_free_call_handler_info)
+    ALLOCATE_MAP(CALL_HANDLER_INFO_TYPE, CallHandlerInfo::kSize,
+                 next_call_side_effect_free_call_handler_info)
 
     ALLOCATE_MAP(SHARED_FUNCTION_INFO_TYPE, SharedFunctionInfo::kAlignedSize,
                  shared_function_info)

src/objects-debug.cc

@@ -1639,7 +1639,8 @@ void AccessCheckInfo::AccessCheckInfoVerify() {
 void CallHandlerInfo::CallHandlerInfoVerify() {
   CHECK(IsCallHandlerInfo());
   CHECK(map() == GetHeap()->side_effect_call_handler_info_map() ||
-        map() == GetHeap()->side_effect_free_call_handler_info_map());
+        map() == GetHeap()->side_effect_free_call_handler_info_map() ||
+        map() == GetHeap()->next_call_side_effect_free_call_handler_info_map());
   VerifyPointer(callback());
   VerifyPointer(js_callback());
   VerifyPointer(data());

src/objects/api-callbacks-inl.h

@@ -105,10 +105,32 @@ ACCESSORS(CallHandlerInfo, data, Object, kDataOffset)
 
 bool CallHandlerInfo::IsSideEffectFreeCallHandlerInfo() const {
   DCHECK(map() == GetHeap()->side_effect_call_handler_info_map() ||
-         map() == GetHeap()->side_effect_free_call_handler_info_map());
+         map() == GetHeap()->side_effect_free_call_handler_info_map() ||
+         map() ==
+             GetHeap()->next_call_side_effect_free_call_handler_info_map());
   return map() == GetHeap()->side_effect_free_call_handler_info_map();
 }
 
+bool CallHandlerInfo::IsSideEffectCallHandlerInfo() const {
+  DCHECK(map() == GetHeap()->side_effect_call_handler_info_map() ||
+         map() == GetHeap()->side_effect_free_call_handler_info_map() ||
+         map() ==
+             GetHeap()->next_call_side_effect_free_call_handler_info_map());
+  return map() == GetHeap()->side_effect_call_handler_info_map();
+}
+
+void CallHandlerInfo::SetNextCallHasNoSideEffect() {
+  set_map(GetHeap()->next_call_side_effect_free_call_handler_info_map());
+}
+
+bool CallHandlerInfo::NextCallHasNoSideEffect() {
+  if (map() == GetHeap()->next_call_side_effect_free_call_handler_info_map()) {
+    set_map(GetHeap()->side_effect_call_handler_info_map());
+    return true;
+  }
+  return false;
+}
+
 }  // namespace internal
 }  // namespace v8
 

src/objects/api-callbacks.h

@@ -187,6 +187,11 @@ class CallHandlerInfo : public Tuple3 {
   DECL_CAST(CallHandlerInfo)
 
   inline bool IsSideEffectFreeCallHandlerInfo() const;
+  inline bool IsSideEffectCallHandlerInfo() const;
+  inline void SetNextCallHasNoSideEffect();
+  // Returns whether or not the next call can be side effect free.
+  // Calling this will change the state back to having a side effect.
+  inline bool NextCallHasNoSideEffect();
 
   // Dispatched behavior.
   DECL_PRINTER(CallHandlerInfo)

test/cctest/test-api.cc

@@ -13073,6 +13073,92 @@ TEST(FunctionNewHasNoSideEffect) {
   v8::debug::EvaluateGlobal(isolate, v8_str("new f2()"), true).ToLocalChecked();
 }
 
+// These handlers instantiate a function the embedder considers safe in some
+// cases (e.g. "building object wrappers"), but those functions themselves were
+// not explicitly marked as side-effect-free.
+static void DefaultConstructHandler(
+    const v8::FunctionCallbackInfo<v8::Value>& info) {
+  v8::Local<v8::Context> context = info.GetIsolate()->GetCurrentContext();
+  v8::Context::Scope context_scope(context);
+  v8::MaybeLocal<v8::Object> instance = Function::New(context, EmptyHandler)
+                                            .ToLocalChecked()
+                                            ->NewInstance(context, 0, nullptr);
+  USE(instance);
+}
+
+static void NoSideEffectConstructHandler(
+    const v8::FunctionCallbackInfo<v8::Value>& info) {
+  v8::Local<v8::Context> context = info.GetIsolate()->GetCurrentContext();
+  v8::Context::Scope context_scope(context);
+  v8::MaybeLocal<v8::Object> instance =
+      Function::New(context, EmptyHandler)
+          .ToLocalChecked()
+          ->NewInstanceWithSideEffectType(context, 0, nullptr,
+                                          v8::SideEffectType::kHasNoSideEffect);
+  USE(instance);
+}
+
+static void NoSideEffectAndSideEffectConstructHandler(
+    const v8::FunctionCallbackInfo<v8::Value>& info) {
+  v8::Local<v8::Context> context = info.GetIsolate()->GetCurrentContext();
+  v8::Context::Scope context_scope(context);
+  // Constructs an instance in a side-effect-free way, followed by another with
+  // side effects.
+  v8::MaybeLocal<v8::Object> instance =
+      Function::New(context, EmptyHandler)
+          .ToLocalChecked()
+          ->NewInstanceWithSideEffectType(context, 0, nullptr,
+                                          v8::SideEffectType::kHasNoSideEffect);
+  v8::MaybeLocal<v8::Object> instance2 = Function::New(context, EmptyHandler)
+                                             .ToLocalChecked()
+                                             ->NewInstance(context, 0, nullptr);
+  USE(instance);
+  USE(instance2);
+}
+
+TEST(FunctionNewInstanceHasNoSideEffect) {
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::HandleScope scope(isolate);
+  LocalContext context;
+
+  // A whitelisted function that creates a new object with both side-effect
+  // free/full instantiations. Should throw.
+  Local<Function> func0 =
+      Function::New(context.local(), NoSideEffectAndSideEffectConstructHandler,
+                    Local<Value>(), 0, v8::ConstructorBehavior::kAllow,
+                    v8::SideEffectType::kHasNoSideEffect)
+          .ToLocalChecked();
+  CHECK(context->Global()->Set(context.local(), v8_str("f"), func0).FromJust());
+  CHECK(v8::debug::EvaluateGlobal(isolate, v8_str("f()"), true).IsEmpty());
+
+  // A whitelisted function that creates a new object. Should throw.
+  Local<Function> func =
+      Function::New(context.local(), DefaultConstructHandler, Local<Value>(), 0,
+                    v8::ConstructorBehavior::kAllow,
+                    v8::SideEffectType::kHasNoSideEffect)
+          .ToLocalChecked();
+  CHECK(context->Global()->Set(context.local(), v8_str("f"), func).FromJust());
+  CHECK(v8::debug::EvaluateGlobal(isolate, v8_str("f()"), true).IsEmpty());
+
+  // A whitelisted function that creates a new object with explicit intent to
+  // have no side-effects (e.g. building an "object wrapper"). Should not throw.
+  Local<Function> func2 =
+      Function::New(context.local(), NoSideEffectConstructHandler,
+                    Local<Value>(), 0, v8::ConstructorBehavior::kAllow,
+                    v8::SideEffectType::kHasNoSideEffect)
+          .ToLocalChecked();
+  CHECK(
+      context->Global()->Set(context.local(), v8_str("f2"), func2).FromJust());
+  v8::debug::EvaluateGlobal(isolate, v8_str("f2()"), true).ToLocalChecked();
+
+  // Check that side effect skipping did not leak outside to future evaluations.
+  Local<Function> func3 =
+      Function::New(context.local(), EmptyHandler).ToLocalChecked();
+  CHECK(
+      context->Global()->Set(context.local(), v8_str("f3"), func3).FromJust());
+  CHECK(v8::debug::EvaluateGlobal(isolate, v8_str("f3()"), true).IsEmpty());
+}
+
 TEST(CallHandlerAsFunctionHasNoSideEffectNotSupported) {
   v8::Isolate* isolate = CcTest::isolate();
   v8::HandleScope scope(isolate);

tools/v8heapconst.py

@@ -220,75 +220,76 @@ KNOWN_MAPS = {
   ("RO_SPACE", 0x03cf1): (204, "PropertyArrayMap"),
   ("RO_SPACE", 0x03d59): (198, "SideEffectCallHandlerInfoMap"),
   ("RO_SPACE", 0x03dc1): (198, "SideEffectFreeCallHandlerInfoMap"),
-  ("RO_SPACE", 0x03e29): (185, "SimpleNumberDictionaryMap"),
-  ("RO_SPACE", 0x03e91): (182, "SloppyArgumentsElementsMap"),
-  ("RO_SPACE", 0x03ef9): (207, "SmallOrderedHashMapMap"),
-  ("RO_SPACE", 0x03f61): (208, "SmallOrderedHashSetMap"),
-  ("RO_SPACE", 0x03fc9): (185, "StringTableMap"),
-  ("RO_SPACE", 0x04031): (196, "WeakFixedArrayMap"),
-  ("RO_SPACE", 0x04099): (211, "WeakArrayListMap"),
-  ("RO_SPACE", 0x04101): (106, "NativeSourceStringMap"),
-  ("RO_SPACE", 0x04169): (64, "StringMap"),
-  ("RO_SPACE", 0x041d1): (73, "ConsOneByteStringMap"),
-  ("RO_SPACE", 0x04239): (65, "ConsStringMap"),
-  ("RO_SPACE", 0x042a1): (77, "ThinOneByteStringMap"),
-  ("RO_SPACE", 0x04309): (69, "ThinStringMap"),
-  ("RO_SPACE", 0x04371): (67, "SlicedStringMap"),
-  ("RO_SPACE", 0x043d9): (75, "SlicedOneByteStringMap"),
-  ("RO_SPACE", 0x04441): (66, "ExternalStringMap"),
-  ("RO_SPACE", 0x044a9): (82, "ExternalStringWithOneByteDataMap"),
-  ("RO_SPACE", 0x04511): (74, "ExternalOneByteStringMap"),
-  ("RO_SPACE", 0x04579): (98, "ShortExternalStringMap"),
-  ("RO_SPACE", 0x045e1): (114, "ShortExternalStringWithOneByteDataMap"),
-  ("RO_SPACE", 0x04649): (0, "InternalizedStringMap"),
-  ("RO_SPACE", 0x046b1): (2, "ExternalInternalizedStringMap"),
-  ("RO_SPACE", 0x04719): (18, "ExternalInternalizedStringWithOneByteDataMap"),
-  ("RO_SPACE", 0x04781): (10, "ExternalOneByteInternalizedStringMap"),
-  ("RO_SPACE", 0x047e9): (34, "ShortExternalInternalizedStringMap"),
-  ("RO_SPACE", 0x04851): (50, "ShortExternalInternalizedStringWithOneByteDataMap"),
-  ("RO_SPACE", 0x048b9): (42, "ShortExternalOneByteInternalizedStringMap"),
-  ("RO_SPACE", 0x04921): (106, "ShortExternalOneByteStringMap"),
-  ("RO_SPACE", 0x04989): (140, "FixedUint8ArrayMap"),
-  ("RO_SPACE", 0x049f1): (139, "FixedInt8ArrayMap"),
-  ("RO_SPACE", 0x04a59): (142, "FixedUint16ArrayMap"),
-  ("RO_SPACE", 0x04ac1): (141, "FixedInt16ArrayMap"),
-  ("RO_SPACE", 0x04b29): (144, "FixedUint32ArrayMap"),
-  ("RO_SPACE", 0x04b91): (143, "FixedInt32ArrayMap"),
-  ("RO_SPACE", 0x04bf9): (145, "FixedFloat32ArrayMap"),
-  ("RO_SPACE", 0x04c61): (146, "FixedFloat64ArrayMap"),
-  ("RO_SPACE", 0x04cc9): (147, "FixedUint8ClampedArrayMap"),
-  ("RO_SPACE", 0x04d31): (149, "FixedBigUint64ArrayMap"),
-  ("RO_SPACE", 0x04d99): (148, "FixedBigInt64ArrayMap"),
-  ("RO_SPACE", 0x04e01): (131, "SelfReferenceMarkerMap"),
-  ("RO_SPACE", 0x04e81): (172, "Tuple2Map"),
-  ("RO_SPACE", 0x04ef9): (170, "ScriptMap"),
-  ("RO_SPACE", 0x04f61): (162, "InterceptorInfoMap"),
-  ("RO_SPACE", 0x08e59): (154, "AccessorInfoMap"),
-  ("RO_SPACE", 0x09069): (153, "AccessCheckInfoMap"),
-  ("RO_SPACE", 0x090d1): (155, "AccessorPairMap"),
-  ("RO_SPACE", 0x09139): (156, "AliasedArgumentsEntryMap"),
-  ("RO_SPACE", 0x091a1): (157, "AllocationMementoMap"),
-  ("RO_SPACE", 0x09209): (158, "AllocationSiteMap"),
-  ("RO_SPACE", 0x09271): (159, "AsyncGeneratorRequestMap"),
-  ("RO_SPACE", 0x092d9): (160, "DebugInfoMap"),
-  ("RO_SPACE", 0x09341): (161, "FunctionTemplateInfoMap"),
-  ("RO_SPACE", 0x093a9): (163, "InterpreterDataMap"),
-  ("RO_SPACE", 0x09411): (164, "ModuleInfoEntryMap"),
-  ("RO_SPACE", 0x09479): (165, "ModuleMap"),
-  ("RO_SPACE", 0x094e1): (166, "ObjectTemplateInfoMap"),
-  ("RO_SPACE", 0x09549): (167, "PromiseCapabilityMap"),
-  ("RO_SPACE", 0x095b1): (168, "PromiseReactionMap"),
-  ("RO_SPACE", 0x09619): (169, "PrototypeInfoMap"),
-  ("RO_SPACE", 0x09681): (171, "StackFrameInfoMap"),
-  ("RO_SPACE", 0x096e9): (173, "Tuple3Map"),
-  ("RO_SPACE", 0x09751): (174, "WasmCompiledModuleMap"),
-  ("RO_SPACE", 0x097b9): (175, "WasmDebugInfoMap"),
-  ("RO_SPACE", 0x09821): (176, "WasmSharedModuleDataMap"),
-  ("RO_SPACE", 0x09889): (177, "CallableTaskMap"),
-  ("RO_SPACE", 0x098f1): (178, "CallbackTaskMap"),
-  ("RO_SPACE", 0x09959): (179, "PromiseFulfillReactionJobTaskMap"),
-  ("RO_SPACE", 0x099c1): (180, "PromiseRejectReactionJobTaskMap"),
-  ("RO_SPACE", 0x09a29): (181, "PromiseResolveThenableJobTaskMap"),
+  ("RO_SPACE", 0x03e29): (198, "NextCallSideEffectFreeCallHandlerInfoMap"),
+  ("RO_SPACE", 0x03e91): (185, "SimpleNumberDictionaryMap"),
+  ("RO_SPACE", 0x03ef9): (182, "SloppyArgumentsElementsMap"),
+  ("RO_SPACE", 0x03f61): (207, "SmallOrderedHashMapMap"),
+  ("RO_SPACE", 0x03fc9): (208, "SmallOrderedHashSetMap"),
+  ("RO_SPACE", 0x04031): (185, "StringTableMap"),
+  ("RO_SPACE", 0x04099): (196, "WeakFixedArrayMap"),
+  ("RO_SPACE", 0x04101): (211, "WeakArrayListMap"),
+  ("RO_SPACE", 0x04169): (106, "NativeSourceStringMap"),
+  ("RO_SPACE", 0x041d1): (64, "StringMap"),
+  ("RO_SPACE", 0x04239): (73, "ConsOneByteStringMap"),
+  ("RO_SPACE", 0x042a1): (65, "ConsStringMap"),
+  ("RO_SPACE", 0x04309): (77, "ThinOneByteStringMap"),
+  ("RO_SPACE", 0x04371): (69, "ThinStringMap"),
+  ("RO_SPACE", 0x043d9): (67, "SlicedStringMap"),
+  ("RO_SPACE", 0x04441): (75, "SlicedOneByteStringMap"),
+  ("RO_SPACE", 0x044a9): (66, "ExternalStringMap"),
+  ("RO_SPACE", 0x04511): (82, "ExternalStringWithOneByteDataMap"),
+  ("RO_SPACE", 0x04579): (74, "ExternalOneByteStringMap"),
+  ("RO_SPACE", 0x045e1): (98, "ShortExternalStringMap"),
+  ("RO_SPACE", 0x04649): (114, "ShortExternalStringWithOneByteDataMap"),
+  ("RO_SPACE", 0x046b1): (0, "InternalizedStringMap"),
+  ("RO_SPACE", 0x04719): (2, "ExternalInternalizedStringMap"),
+  ("RO_SPACE", 0x04781): (18, "ExternalInternalizedStringWithOneByteDataMap"),
+  ("RO_SPACE", 0x047e9): (10, "ExternalOneByteInternalizedStringMap"),
+  ("RO_SPACE", 0x04851): (34, "ShortExternalInternalizedStringMap"),
+  ("RO_SPACE", 0x048b9): (50, "ShortExternalInternalizedStringWithOneByteDataMap"),
+  ("RO_SPACE", 0x04921): (42, "ShortExternalOneByteInternalizedStringMap"),
+  ("RO_SPACE", 0x04989): (106, "ShortExternalOneByteStringMap"),
+  ("RO_SPACE", 0x049f1): (140, "FixedUint8ArrayMap"),
+  ("RO_SPACE", 0x04a59): (139, "FixedInt8ArrayMap"),
+  ("RO_SPACE", 0x04ac1): (142, "FixedUint16ArrayMap"),
+  ("RO_SPACE", 0x04b29): (141, "FixedInt16ArrayMap"),
+  ("RO_SPACE", 0x04b91): (144, "FixedUint32ArrayMap"),
+  ("RO_SPACE", 0x04bf9): (143, "FixedInt32ArrayMap"),
+  ("RO_SPACE", 0x04c61): (145, "FixedFloat32ArrayMap"),
+  ("RO_SPACE", 0x04cc9): (146, "FixedFloat64ArrayMap"),
+  ("RO_SPACE", 0x04d31): (147, "FixedUint8ClampedArrayMap"),
+  ("RO_SPACE", 0x04d99): (149, "FixedBigUint64ArrayMap"),
+  ("RO_SPACE", 0x04e01): (148, "FixedBigInt64ArrayMap"),
+  ("RO_SPACE", 0x04e69): (131, "SelfReferenceMarkerMap"),
+  ("RO_SPACE", 0x04ee9): (172, "Tuple2Map"),
+  ("RO_SPACE", 0x04f61): (170, "ScriptMap"),
+  ("RO_SPACE", 0x04fc9): (162, "InterceptorInfoMap"),
+  ("RO_SPACE", 0x08ec1): (154, "AccessorInfoMap"),
+  ("RO_SPACE", 0x090d1): (153, "AccessCheckInfoMap"),
+  ("RO_SPACE", 0x09139): (155, "AccessorPairMap"),
+  ("RO_SPACE", 0x091a1): (156, "AliasedArgumentsEntryMap"),
+  ("RO_SPACE", 0x09209): (157, "AllocationMementoMap"),
+  ("RO_SPACE", 0x09271): (158, "AllocationSiteMap"),
+  ("RO_SPACE", 0x092d9): (159, "AsyncGeneratorRequestMap"),
+  ("RO_SPACE", 0x09341): (160, "DebugInfoMap"),
+  ("RO_SPACE", 0x093a9): (161, "FunctionTemplateInfoMap"),
+  ("RO_SPACE", 0x09411): (163, "InterpreterDataMap"),
+  ("RO_SPACE", 0x09479): (164, "ModuleInfoEntryMap"),
+  ("RO_SPACE", 0x094e1): (165, "ModuleMap"),
+  ("RO_SPACE", 0x09549): (166, "ObjectTemplateInfoMap"),
+  ("RO_SPACE", 0x095b1): (167, "PromiseCapabilityMap"),
+  ("RO_SPACE", 0x09619): (168, "PromiseReactionMap"),
+  ("RO_SPACE", 0x09681): (169, "PrototypeInfoMap"),
+  ("RO_SPACE", 0x096e9): (171, "StackFrameInfoMap"),
+  ("RO_SPACE", 0x09751): (173, "Tuple3Map"),
+  ("RO_SPACE", 0x097b9): (174, "WasmCompiledModuleMap"),
+  ("RO_SPACE", 0x09821): (175, "WasmDebugInfoMap"),
+  ("RO_SPACE", 0x09889): (176, "WasmSharedModuleDataMap"),
+  ("RO_SPACE", 0x098f1): (177, "CallableTaskMap"),
+  ("RO_SPACE", 0x09959): (178, "CallbackTaskMap"),
+  ("RO_SPACE", 0x099c1): (179, "PromiseFulfillReactionJobTaskMap"),
+  ("RO_SPACE", 0x09a29): (180, "PromiseRejectReactionJobTaskMap"),
+  ("RO_SPACE", 0x09a91): (181, "PromiseResolveThenableJobTaskMap"),
   ("MAP_SPACE", 0x02201): (1057, "ExternalMap"),
   ("MAP_SPACE", 0x02259): (1072, "JSMessageObjectMap"),
 }
@@ -305,7 +306,7 @@ KNOWN_OBJECTS = {
   ("RO_SPACE", 0x02899): "TrueValue",
   ("RO_SPACE", 0x02971): "FalseValue",
   ("RO_SPACE", 0x029c1): "empty_string",
-  ("RO_SPACE", 0x04ee9): "EmptyByteArray",
+  ("RO_SPACE", 0x04f51): "EmptyByteArray",
   ("OLD_SPACE", 0x02201): "UninitializedValue",
   ("OLD_SPACE", 0x02231): "EmptyScopeInfo",
   ("OLD_SPACE", 0x02241): "ArgumentsMarker",