[heap] Also mark DescriptorArrays for prototypes in object stats.

This introduces a new PROTOTYPE_DESCRIPTOR_ARRAY_TYPE, which is used to
be able to distinguish DescriptorArrays for prototypes from regular
ones. This is primarily useful for the live objects, since for dead
DescriptorArrays we will likely not be able to figure out whether they
belong to a prototype Map, unless they die together.

Bug: v8:7266
Change-Id: I4b8e0008cc8bae607778151b7c18d30f4efba88d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1554687Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60654}

src/heap/object-stats.cc

@@ -807,7 +807,14 @@ void ObjectStatsCollectorImpl::RecordVirtualMapDetails(Map map) {
   DescriptorArray array = map->instance_descriptors();
   if (map->owns_descriptors() &&
       array != ReadOnlyRoots(heap_).empty_descriptor_array()) {
-    // DescriptorArray has its own instance type.
+    // Generally DescriptorArrays have their own instance type already
+    // (DESCRIPTOR_ARRAY_TYPE), but we'd like to be able to tell which
+    // of those are for (abandoned) prototypes.
+    if (map->is_prototype_map()) {
+      RecordSimpleVirtualObjectStats(
+          map, array, ObjectStats::PROTOTYPE_DESCRIPTOR_ARRAY_TYPE);
+    }
+
     EnumCache enum_cache = array->enum_cache();
     RecordSimpleVirtualObjectStats(array, enum_cache->keys(),
                                    ObjectStats::ENUM_CACHE_TYPE);

src/heap/object-stats.h

@@ -57,6 +57,7 @@
   V(OBJECT_TO_CODE_TYPE)                         \
   V(OPTIMIZED_CODE_LITERALS_TYPE)                \
   V(OTHER_CONTEXT_TYPE)                          \
+  V(PROTOTYPE_DESCRIPTOR_ARRAY_TYPE)             \
   V(PROTOTYPE_USERS_TYPE)                        \
   V(REGEXP_MULTIPLE_CACHE_TYPE)                  \
   V(RELOC_INFO_TYPE)                             \