Revert "[sandbox] Fold V8_SANDBOXED_EXTERNAL_POINTERS into V8_ENABLE_SANDBOX"

This reverts commit 49c59678.

Reason for revert: The change is suspected to be breaking chromium's determinism test: https://ci.chromium.org/ui/p/chromium/builders/ci/Deterministic%20Linux/35003/overview

Original change's description:
> [sandbox] Fold V8_SANDBOXED_EXTERNAL_POINTERS into V8_ENABLE_SANDBOX
>
> Now that all external pointers have been sandboxed,
> V8_SANDBOXED_EXTERNAL_POINTERS is no longer needed. This change also
> shrinks external pointer slots to 32 bits when the sandbox is enabled.
>
> Bug: v8:10391
> Change-Id: Iccbef27ac107b988cb23fe9ef66da6fe0bae087a
> Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3869269
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Samuel Groß <saelo@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83083}

Bug: v8:10391
Change-Id: I515ba771aa21f58b752a3a5b36b4deb2abc5f9c0
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3886870
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83111}

BUILD.gn

@@ -307,6 +307,10 @@ declare_args() {
   # Sets -DV8_ENABLE_SANDBOX.
   v8_enable_sandbox = ""
 
+  # Enable sandboxing for all external pointers. Requires v8_enable_sandbox.
+  # Sets -DV8_SANDBOXED_EXTERNAL_POINTERS.
+  v8_enable_sandboxed_external_pointers = false
+
   # Enable all available sandbox features. Implies v8_enable_sandbox.
   v8_enable_sandbox_future = false
 
@@ -530,6 +534,7 @@ if (v8_enable_sandbox == "") {
 
 # Enable all available sandbox features if sandbox future is enabled.
 if (v8_enable_sandbox_future) {
+  v8_enable_sandboxed_external_pointers = true
   v8_enable_sandbox = true
 }
 
@@ -564,6 +569,9 @@ assert(!v8_enable_sandbox || v8_enable_pointer_compression_shared_cage,
 assert(!v8_enable_sandbox || v8_enable_external_code_space,
        "The sandbox requires the external code space")
 
+assert(!v8_enable_sandboxed_external_pointers || v8_enable_sandbox,
+       "Sandboxed external pointers require the sandbox")
+
 assert(!v8_expose_memory_corruption_api || v8_enable_sandbox,
        "The Memory Corruption API requires the sandbox")
 
@@ -741,6 +749,7 @@ external_v8_defines = [
   "V8_31BIT_SMIS_ON_64BIT_ARCH",
   "V8_COMPRESS_ZONES",
   "V8_ENABLE_SANDBOX",
+  "V8_SANDBOXED_EXTERNAL_POINTERS",
   "V8_DEPRECATION_WARNINGS",
   "V8_IMMINENT_DEPRECATION_WARNINGS",
   "V8_NO_ARGUMENTS_ADAPTOR",
@@ -771,6 +780,9 @@ if (v8_enable_zone_compression) {
 if (v8_enable_sandbox) {
   enabled_external_v8_defines += [ "V8_ENABLE_SANDBOX" ]
 }
+if (v8_enable_sandboxed_external_pointers) {
+  enabled_external_v8_defines += [ "V8_SANDBOXED_EXTERNAL_POINTERS" ]
+}
 if (v8_deprecation_warnings) {
   enabled_external_v8_defines += [ "V8_DEPRECATION_WARNINGS" ]
 }

include/v8-initialization.h

@@ -100,6 +100,9 @@ class V8_EXPORT V8 {
     const int kBuildConfiguration =
         (internal::PointerCompressionIsEnabled() ? kPointerCompression : 0) |
         (internal::SmiValuesAre31Bits() ? k31BitSmis : 0) |
+        (internal::SandboxedExternalPointersAreEnabled()
+             ? kSandboxedExternalPointers
+             : 0) |
         (internal::SandboxIsEnabled() ? kSandbox : 0);
     return Initialize(kBuildConfiguration);
   }
@@ -270,7 +273,8 @@ class V8_EXPORT V8 {
   enum BuildConfigurationFeatures {
     kPointerCompression = 1 << 0,
     k31BitSmis = 1 << 1,
-    kSandbox = 1 << 2,
+    kSandboxedExternalPointers = 1 << 2,
+    kSandbox = 1 << 3,
   };
 
   /**

include/v8-internal.h

@@ -166,6 +166,14 @@ constexpr bool SandboxIsEnabled() {
 #endif
 }
 
+constexpr bool SandboxedExternalPointersAreEnabled() {
+#ifdef V8_SANDBOXED_EXTERNAL_POINTERS
+  return true;
+#else
+  return false;
+#endif
+}
+
 // SandboxedPointers are guaranteed to point into the sandbox. This is achieved
 // for example by storing them as offset rather than as raw pointers.
 using SandboxedPointer_t = Address;
@@ -264,7 +272,7 @@ using ExternalPointerHandle = uint32_t;
 // ExternalPointers point to objects located outside the sandbox. When
 // sandboxed external pointers are enabled, these are stored on heap as
 // ExternalPointerHandles, otherwise they are simply raw pointers.
-#ifdef V8_ENABLE_SANDBOX
+#ifdef V8_SANDBOXED_EXTERNAL_POINTERS
 using ExternalPointer_t = ExternalPointerHandle;
 #else
 using ExternalPointer_t = Address;
@@ -391,8 +399,9 @@ constexpr uint64_t kAllExternalPointerTypeTags[] = {
 
 // When the sandbox is enabled, external pointers marked as "sandboxed" above
 // use the external pointer table (i.e. are sandboxed). This allows a gradual
-// rollout of external pointer sandboxing. If the sandbox is off, no external
-// pointers are sandboxed.
+// rollout of external pointer sandboxing. If V8_SANDBOXED_EXTERNAL_POINTERS is
+// defined, all external pointers are sandboxed. If the sandbox is off, no
+// external pointers are sandboxed.
 //
 // Sandboxed external pointer tags are available when compressing pointers even
 // when the sandbox is off. Some tags (e.g. kWaiterQueueNodeTag) are used
@@ -400,7 +409,9 @@ constexpr uint64_t kAllExternalPointerTypeTags[] = {
 // alignment requirements.
 #define sandboxed(X) (X << kExternalPointerTagShift) | kExternalPointerMarkBit
 #define unsandboxed(X) kUnsandboxedExternalPointerTag
-#if defined(V8_COMPRESS_POINTERS)
+#if defined(V8_SANDBOXED_EXTERNAL_POINTERS)
+#define EXTERNAL_POINTER_TAG_ENUM(Name, State, Bits) Name = sandboxed(Bits),
+#elif defined(V8_COMPRESS_POINTERS)
 #define EXTERNAL_POINTER_TAG_ENUM(Name, State, Bits) Name = State(Bits),
 #else
 #define EXTERNAL_POINTER_TAG_ENUM(Name, State, Bits) Name = unsandboxed(Bits),

src/api/api.cc

@@ -6157,6 +6157,17 @@ bool v8::V8::Initialize(const int build_config) {
         kEmbedderSmiValueSize, internal::kSmiValueSize);
   }
 
+  const bool kEmbedderSandboxedExternalPointers =
+      (build_config & kSandboxedExternalPointers) != 0;
+  if (kEmbedderSandboxedExternalPointers !=
+      V8_SANDBOXED_EXTERNAL_POINTERS_BOOL) {
+    FATAL(
+        "Embedder-vs-V8 build configuration mismatch. On embedder side "
+        "sandboxed external pointers is %s while on V8 side it's %s.",
+        kEmbedderSandboxedExternalPointers ? "ENABLED" : "DISABLED",
+        V8_SANDBOXED_EXTERNAL_POINTERS_BOOL ? "ENABLED" : "DISABLED");
+  }
+
   const bool kEmbedderSandbox = (build_config & kSandbox) != 0;
   if (kEmbedderSandbox != V8_ENABLE_SANDBOX_BOOL) {
     FATAL(

src/codegen/tnode.h

@@ -88,7 +88,7 @@ struct ExternalPointerHandleT : Uint32T {
   static constexpr MachineType kMachineType = MachineType::Uint32();
 };
 
-#ifdef V8_ENABLE_SANDBOX
+#ifdef V8_SANDBOXED_EXTERNAL_POINTERS
 struct ExternalPointerT : Uint32T {
   static constexpr MachineType kMachineType = MachineType::Uint32();
 };

src/common/globals.h

@@ -124,6 +124,12 @@ namespace internal {
 #define V8_CAN_CREATE_SHARED_HEAP_BOOL false
 #endif
 
+#ifdef V8_SANDBOXED_EXTERNAL_POINTERS
+#define V8_SANDBOXED_EXTERNAL_POINTERS_BOOL true
+#else
+#define V8_SANDBOXED_EXTERNAL_POINTERS_BOOL false
+#endif
+
 #ifdef V8_ENABLE_SANDBOX
 #define V8_ENABLE_SANDBOX_BOOL true
 #else
@@ -505,7 +511,7 @@ static_assert(kPointerSize == (1 << kPointerSizeLog2));
 // This type defines raw storage type for external (or off-V8 heap) pointers
 // stored on V8 heap.
 constexpr int kExternalPointerSlotSize = sizeof(ExternalPointer_t);
-#ifdef V8_ENABLE_SANDBOX
+#ifdef V8_SANDBOXED_EXTERNAL_POINTERS
 static_assert(kExternalPointerSlotSize == kTaggedSize);
 #else
 static_assert(kExternalPointerSlotSize == kSystemPointerSize);

src/objects/slots-inl.h

@@ -221,7 +221,7 @@ void ExternalPointerSlot::store(Isolate* isolate, Address value,
 ExternalPointerSlot::RawContent
 ExternalPointerSlot::GetAndClearContentForSerialization(
     const DisallowGarbageCollection& no_gc) {
-#ifdef V8_ENABLE_SANDBOX
+#ifdef V8_SANDBOXED_EXTERNAL_POINTERS
   ExternalPointerHandle content = Relaxed_LoadHandle();
   Relaxed_StoreHandle(kNullExternalPointerHandle);
 #else
@@ -234,7 +234,7 @@ ExternalPointerSlot::GetAndClearContentForSerialization(
 void ExternalPointerSlot::RestoreContentAfterSerialization(
     ExternalPointerSlot::RawContent content,
     const DisallowGarbageCollection& no_gc) {
-#ifdef V8_ENABLE_SANDBOX
+#ifdef V8_SANDBOXED_EXTERNAL_POINTERS
   return Relaxed_StoreHandle(content);
 #else
   return WriteMaybeUnalignedValue<Address>(address(), content);

src/torque/torque-parser.cc

@@ -68,6 +68,8 @@ class BuildFlags : public ContextualClass<BuildFlags> {
     build_flags_["V8_ENABLE_WEBASSEMBLY"] = false;
 #endif
     build_flags_["V8_ENABLE_SANDBOX"] = V8_ENABLE_SANDBOX_BOOL;
+    build_flags_["V8_SANDBOXED_EXTERNAL_POINTERS"] =
+        V8_SANDBOXED_EXTERNAL_POINTERS_BOOL;
     build_flags_["DEBUG"] = DEBUG_BOOL;
   }
   static bool GetFlag(const std::string& name, const char* production) {

src/wasm/wasm-objects.tq

@@ -14,9 +14,9 @@ extern class WasmInstanceObject extends JSObject;
 // Represents the context of a function that is defined through the JS or C
 // APIs. Corresponds to the WasmInstanceObject passed to a Wasm function
 // reference.
-// TODO(manoskouk): If V8_ENABLE_SANDBOX, we cannot encode the isolate_root as
-// a sandboxed pointer, because that would require having access to the isolate
-// root in the first place.
+// TODO(manoskouk): If V8_SANDBOXED_EXTERNAL_POINTERS, we cannot encode the
+// isolate_root as a sandboxed pointer, because that would require having access
+// to the isolate root in the first place.
 extern class WasmApiFunctionRef extends HeapObject {
   isolate_root: RawPtr;
   native_context: NativeContext;

test/cctest/test-api.cc

@@ -687,8 +687,9 @@ TEST(MakingExternalStringConditions) {
   CHECK(local_string->CanMakeExternal());
 
   // Tiny strings are not in-place externalizable when pointer compression is
-  // enabled, but they are if the sandbox is enabled.
-  CHECK_EQ(V8_ENABLE_SANDBOX_BOOL || i::kTaggedSize == i::kSystemPointerSize,
+  // enabled, but they are if sandboxed external pointers are enabled.
+  CHECK_EQ(V8_SANDBOXED_EXTERNAL_POINTERS_BOOL ||
+               i::kTaggedSize == i::kSystemPointerSize,
            tiny_local_string->CanMakeExternal());
 }
 

test/cctest/test-strings.cc

@@ -2066,11 +2066,11 @@ TEST(CheckCachedDataInternalExternalUncachedString) {
   // that we indeed cached it.
   Handle<ExternalOneByteString> external_string =
       Handle<ExternalOneByteString>::cast(string);
-  // If the sandbox is enabled, string objects will always be cacheable because
-  // they are smaller.
-  CHECK(V8_ENABLE_SANDBOX_BOOL || external_string->is_uncached());
+  // If sandboxed external pointers are enabled, string objects will always be
+  // cacheable because they are smaller.
+  CHECK(V8_SANDBOXED_EXTERNAL_POINTERS_BOOL || external_string->is_uncached());
   CHECK(external_string->resource()->IsCacheable());
-  if (!V8_ENABLE_SANDBOX_BOOL) {
+  if (!V8_SANDBOXED_EXTERNAL_POINTERS_BOOL) {
     CHECK_NOT_NULL(external_string->resource()->cached_data());
     CHECK_EQ(external_string->resource()->cached_data(),
              external_string->resource()->data());
@@ -2109,11 +2109,11 @@ TEST(CheckCachedDataInternalExternalUncachedStringTwoByte) {
   // that we indeed cached it.
   Handle<ExternalTwoByteString> external_string =
       Handle<ExternalTwoByteString>::cast(string);
-  // If the sandbox is enabled, string objects will always be cacheable because
-  // they are smaller.
-  CHECK(V8_ENABLE_SANDBOX_BOOL || external_string->is_uncached());
+  // If sandboxed external pointers are enabled, string objects will always be
+  // cacheable because they are smaller.
+  CHECK(V8_SANDBOXED_EXTERNAL_POINTERS_BOOL || external_string->is_uncached());
   CHECK(external_string->resource()->IsCacheable());
-  if (!V8_ENABLE_SANDBOX_BOOL) {
+  if (!V8_SANDBOXED_EXTERNAL_POINTERS_BOOL) {
     CHECK_NOT_NULL(external_string->resource()->cached_data());
     CHECK_EQ(external_string->resource()->cached_data(),
              external_string->resource()->data());

tools/v8heapconst.py

@@ -515,67 +515,67 @@ KNOWN_OBJECTS = {
   ("read_only_space", 0x04b49): "NativeScopeInfo",
   ("read_only_space", 0x04b61): "HashSeed",
   ("old_space", 0x04235): "ArgumentsIteratorAccessor",
-  ("old_space", 0x0424d): "ArrayLengthAccessor",
-  ("old_space", 0x04265): "BoundFunctionLengthAccessor",
-  ("old_space", 0x0427d): "BoundFunctionNameAccessor",
-  ("old_space", 0x04295): "ErrorStackAccessor",
-  ("old_space", 0x042ad): "FunctionArgumentsAccessor",
-  ("old_space", 0x042c5): "FunctionCallerAccessor",
-  ("old_space", 0x042dd): "FunctionNameAccessor",
-  ("old_space", 0x042f5): "FunctionLengthAccessor",
-  ("old_space", 0x0430d): "FunctionPrototypeAccessor",
-  ("old_space", 0x04325): "SharedArrayLengthAccessor",
-  ("old_space", 0x0433d): "StringLengthAccessor",
-  ("old_space", 0x04355): "ValueUnavailableAccessor",
-  ("old_space", 0x0436d): "WrappedFunctionLengthAccessor",
-  ("old_space", 0x04385): "WrappedFunctionNameAccessor",
-  ("old_space", 0x0439d): "InvalidPrototypeValidityCell",
-  ("old_space", 0x043a5): "EmptyScript",
-  ("old_space", 0x043e9): "ManyClosuresCell",
-  ("old_space", 0x043f5): "ArrayConstructorProtector",
-  ("old_space", 0x04409): "NoElementsProtector",
-  ("old_space", 0x0441d): "MegaDOMProtector",
-  ("old_space", 0x04431): "IsConcatSpreadableProtector",
-  ("old_space", 0x04445): "ArraySpeciesProtector",
-  ("old_space", 0x04459): "TypedArraySpeciesProtector",
-  ("old_space", 0x0446d): "PromiseSpeciesProtector",
-  ("old_space", 0x04481): "RegExpSpeciesProtector",
-  ("old_space", 0x04495): "StringLengthProtector",
-  ("old_space", 0x044a9): "ArrayIteratorProtector",
-  ("old_space", 0x044bd): "ArrayBufferDetachingProtector",
-  ("old_space", 0x044d1): "PromiseHookProtector",
-  ("old_space", 0x044e5): "PromiseResolveProtector",
-  ("old_space", 0x044f9): "MapIteratorProtector",
-  ("old_space", 0x0450d): "PromiseThenProtector",
-  ("old_space", 0x04521): "SetIteratorProtector",
-  ("old_space", 0x04535): "StringIteratorProtector",
-  ("old_space", 0x04549): "StringSplitCache",
-  ("old_space", 0x04951): "RegExpMultipleCache",
-  ("old_space", 0x04d59): "BuiltinsConstantsTable",
-  ("old_space", 0x051ad): "AsyncFunctionAwaitRejectSharedFun",
-  ("old_space", 0x051d1): "AsyncFunctionAwaitResolveSharedFun",
-  ("old_space", 0x051f5): "AsyncGeneratorAwaitRejectSharedFun",
-  ("old_space", 0x05219): "AsyncGeneratorAwaitResolveSharedFun",
-  ("old_space", 0x0523d): "AsyncGeneratorYieldResolveSharedFun",
-  ("old_space", 0x05261): "AsyncGeneratorReturnResolveSharedFun",
-  ("old_space", 0x05285): "AsyncGeneratorReturnClosedRejectSharedFun",
-  ("old_space", 0x052a9): "AsyncGeneratorReturnClosedResolveSharedFun",
-  ("old_space", 0x052cd): "AsyncIteratorValueUnwrapSharedFun",
-  ("old_space", 0x052f1): "PromiseAllResolveElementSharedFun",
-  ("old_space", 0x05315): "PromiseAllSettledResolveElementSharedFun",
-  ("old_space", 0x05339): "PromiseAllSettledRejectElementSharedFun",
-  ("old_space", 0x0535d): "PromiseAnyRejectElementSharedFun",
-  ("old_space", 0x05381): "PromiseCapabilityDefaultRejectSharedFun",
-  ("old_space", 0x053a5): "PromiseCapabilityDefaultResolveSharedFun",
-  ("old_space", 0x053c9): "PromiseCatchFinallySharedFun",
-  ("old_space", 0x053ed): "PromiseGetCapabilitiesExecutorSharedFun",
-  ("old_space", 0x05411): "PromiseThenFinallySharedFun",
-  ("old_space", 0x05435): "PromiseThrowerFinallySharedFun",
-  ("old_space", 0x05459): "PromiseValueThunkFinallySharedFun",
-  ("old_space", 0x0547d): "ProxyRevokeSharedFun",
-  ("old_space", 0x054a1): "ShadowRealmImportValueFulfilledSFI",
-  ("old_space", 0x054c5): "SourceTextModuleExecuteAsyncModuleFulfilledSFI",
-  ("old_space", 0x054e9): "SourceTextModuleExecuteAsyncModuleRejectedSFI",
+  ("old_space", 0x04255): "ArrayLengthAccessor",
+  ("old_space", 0x04275): "BoundFunctionLengthAccessor",
+  ("old_space", 0x04295): "BoundFunctionNameAccessor",
+  ("old_space", 0x042b5): "ErrorStackAccessor",
+  ("old_space", 0x042d5): "FunctionArgumentsAccessor",
+  ("old_space", 0x042f5): "FunctionCallerAccessor",
+  ("old_space", 0x04315): "FunctionNameAccessor",
+  ("old_space", 0x04335): "FunctionLengthAccessor",
+  ("old_space", 0x04355): "FunctionPrototypeAccessor",
+  ("old_space", 0x04375): "SharedArrayLengthAccessor",
+  ("old_space", 0x04395): "StringLengthAccessor",
+  ("old_space", 0x043b5): "ValueUnavailableAccessor",
+  ("old_space", 0x043d5): "WrappedFunctionLengthAccessor",
+  ("old_space", 0x043f5): "WrappedFunctionNameAccessor",
+  ("old_space", 0x04415): "InvalidPrototypeValidityCell",
+  ("old_space", 0x0441d): "EmptyScript",
+  ("old_space", 0x04461): "ManyClosuresCell",
+  ("old_space", 0x0446d): "ArrayConstructorProtector",
+  ("old_space", 0x04481): "NoElementsProtector",
+  ("old_space", 0x04495): "MegaDOMProtector",
+  ("old_space", 0x044a9): "IsConcatSpreadableProtector",
+  ("old_space", 0x044bd): "ArraySpeciesProtector",
+  ("old_space", 0x044d1): "TypedArraySpeciesProtector",
+  ("old_space", 0x044e5): "PromiseSpeciesProtector",
+  ("old_space", 0x044f9): "RegExpSpeciesProtector",
+  ("old_space", 0x0450d): "StringLengthProtector",
+  ("old_space", 0x04521): "ArrayIteratorProtector",
+  ("old_space", 0x04535): "ArrayBufferDetachingProtector",
+  ("old_space", 0x04549): "PromiseHookProtector",
+  ("old_space", 0x0455d): "PromiseResolveProtector",
+  ("old_space", 0x04571): "MapIteratorProtector",
+  ("old_space", 0x04585): "PromiseThenProtector",
+  ("old_space", 0x04599): "SetIteratorProtector",
+  ("old_space", 0x045ad): "StringIteratorProtector",
+  ("old_space", 0x045c1): "StringSplitCache",
+  ("old_space", 0x049c9): "RegExpMultipleCache",
+  ("old_space", 0x04dd1): "BuiltinsConstantsTable",
+  ("old_space", 0x05225): "AsyncFunctionAwaitRejectSharedFun",
+  ("old_space", 0x05249): "AsyncFunctionAwaitResolveSharedFun",
+  ("old_space", 0x0526d): "AsyncGeneratorAwaitRejectSharedFun",
+  ("old_space", 0x05291): "AsyncGeneratorAwaitResolveSharedFun",
+  ("old_space", 0x052b5): "AsyncGeneratorYieldResolveSharedFun",
+  ("old_space", 0x052d9): "AsyncGeneratorReturnResolveSharedFun",
+  ("old_space", 0x052fd): "AsyncGeneratorReturnClosedRejectSharedFun",
+  ("old_space", 0x05321): "AsyncGeneratorReturnClosedResolveSharedFun",
+  ("old_space", 0x05345): "AsyncIteratorValueUnwrapSharedFun",
+  ("old_space", 0x05369): "PromiseAllResolveElementSharedFun",
+  ("old_space", 0x0538d): "PromiseAllSettledResolveElementSharedFun",
+  ("old_space", 0x053b1): "PromiseAllSettledRejectElementSharedFun",
+  ("old_space", 0x053d5): "PromiseAnyRejectElementSharedFun",
+  ("old_space", 0x053f9): "PromiseCapabilityDefaultRejectSharedFun",
+  ("old_space", 0x0541d): "PromiseCapabilityDefaultResolveSharedFun",
+  ("old_space", 0x05441): "PromiseCatchFinallySharedFun",
+  ("old_space", 0x05465): "PromiseGetCapabilitiesExecutorSharedFun",
+  ("old_space", 0x05489): "PromiseThenFinallySharedFun",
+  ("old_space", 0x054ad): "PromiseThrowerFinallySharedFun",
+  ("old_space", 0x054d1): "PromiseValueThunkFinallySharedFun",
+  ("old_space", 0x054f5): "ProxyRevokeSharedFun",
+  ("old_space", 0x05519): "ShadowRealmImportValueFulfilledSFI",
+  ("old_space", 0x0553d): "SourceTextModuleExecuteAsyncModuleFulfilledSFI",
+  ("old_space", 0x05561): "SourceTextModuleExecuteAsyncModuleRejectedSFI",
 }
 
 # Lower 32 bits of first page addresses for various heap spaces.