[string] Add a is_shared bit to strings and String::Share

The is_shared bit bumps the number of reserved bits for Strings'
InstanceType from 6 to 7. This has the side effect of shuffling the
InstanceType enum values.

There are no users of this bit yet. This is steps 1-2 from the following
design doc [1], in preparation for sharing internalized and
in-place-internalizable strings.

[1] https://docs.google.com/document/d/1c5i8f2EfKIQygGZ23hNiGxouvRISjUMnJjNsOodj6z0/edit?usp=sharing

Bug: v8:12007
Change-Id: Idf11a6035305f0375b4f824ffd32a64f6b5b043b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3266017
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77831}

include/v8-internal.h

@@ -268,9 +268,9 @@ class Internals {
   static const int kNodeStateIsWeakValue = 2;
   static const int kNodeStateIsPendingValue = 3;
 
-  static const int kFirstNonstringType = 0x40;
-  static const int kOddballType = 0x43;
-  static const int kForeignType = 0x46;
+  static const int kFirstNonstringType = 0x80;
+  static const int kOddballType = 0x83;
+  static const int kForeignType = 0xcc;
   static const int kJSSpecialApiObjectType = 0x410;
   static const int kJSObjectType = 0x421;
   static const int kFirstJSApiObjectType = 0x422;

src/common/globals.h

@@ -1883,13 +1883,13 @@ enum PropertiesEnumerationMode {
   kPropertyAdditionOrder,
 };
 
-enum class StringInternalizationStrategy {
-  // The string must be internalized by first copying.
+enum class StringTransitionStrategy {
+  // The string must be transitioned to a new representation by first copying.
   kCopy,
-  // The string can be internalized in-place by changing its map.
+  // The string can be transitioned in-place by changing its map.
   kInPlace,
-  // The string is already internalized.
-  kAlreadyInternalized
+  // The string is already transitioned to the desired representation.
+  kAlreadyTransitioned
 };
 
 }  // namespace internal

src/diagnostics/objects-printer.cc

@@ -264,6 +264,8 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {
     case THIN_ONE_BYTE_STRING_TYPE:
     case UNCACHED_EXTERNAL_STRING_TYPE:
     case UNCACHED_EXTERNAL_ONE_BYTE_STRING_TYPE:
+    case SHARED_STRING_TYPE:
+    case SHARED_ONE_BYTE_STRING_TYPE:
     case JS_LAST_DUMMY_API_OBJECT_TYPE:
       // TODO(all): Handle these types too.
       os << "UNKNOWN TYPE " << map().instance_type();

src/heap/factory-base.cc

@@ -593,19 +593,22 @@ Handle<SeqTwoByteString> FactoryBase<Impl>::NewTwoByteInternalizedString(
 }
 
 template <typename Impl>
-MaybeHandle<SeqOneByteString> FactoryBase<Impl>::NewRawOneByteString(
-    int length, AllocationType allocation) {
+template <typename SeqStringT>
+MaybeHandle<SeqStringT> FactoryBase<Impl>::NewRawStringWithMap(
+    int length, Map map, AllocationType allocation) {
+  DCHECK(SeqStringT::IsCompatibleMap(map, read_only_roots()));
+  DCHECK_IMPLIES(!StringShape(map).IsShared(),
+                 RefineAllocationTypeForInPlaceInternalizableString(
+                     allocation, map) == allocation);
   if (length > String::kMaxLength || length < 0) {
-    THROW_NEW_ERROR(isolate(), NewInvalidStringLengthError(), SeqOneByteString);
+    THROW_NEW_ERROR(isolate(), NewInvalidStringLengthError(), SeqStringT);
   }
   DCHECK_GT(length, 0);  // Use Factory::empty_string() instead.
-  int size = SeqOneByteString::SizeFor(length);
-  DCHECK_GE(SeqOneByteString::kMaxSize, size);
+  int size = SeqStringT::SizeFor(length);
+  DCHECK_GE(SeqStringT::kMaxSize, size);
 
-  Map map = read_only_roots().one_byte_string_map();
-  SeqOneByteString string = SeqOneByteString::cast(AllocateRawWithImmortalMap(
-      size, RefineAllocationTypeForInPlaceInternalizableString(allocation, map),
-      map));
+  SeqStringT string =
+      SeqStringT::cast(AllocateRawWithImmortalMap(size, allocation, map));
   DisallowGarbageCollection no_gc;
   string.set_length(length);
   string.set_raw_hash_field(String::kEmptyHashField);
@@ -614,24 +617,37 @@ MaybeHandle<SeqOneByteString> FactoryBase<Impl>::NewRawOneByteString(
 }
 
 template <typename Impl>
-MaybeHandle<SeqTwoByteString> FactoryBase<Impl>::NewRawTwoByteString(
+MaybeHandle<SeqOneByteString> FactoryBase<Impl>::NewRawOneByteString(
     int length, AllocationType allocation) {
-  if (length > String::kMaxLength || length < 0) {
-    THROW_NEW_ERROR(isolate(), NewInvalidStringLengthError(), SeqTwoByteString);
-  }
-  DCHECK_GT(length, 0);  // Use Factory::empty_string() instead.
-  int size = SeqTwoByteString::SizeFor(length);
-  DCHECK_GE(SeqTwoByteString::kMaxSize, size);
+  Map map = read_only_roots().one_byte_string_map();
+  return NewRawStringWithMap<SeqOneByteString>(
+      length, map,
+      RefineAllocationTypeForInPlaceInternalizableString(allocation, map));
+}
 
+template <typename Impl>
+MaybeHandle<SeqTwoByteString> FactoryBase<Impl>::NewRawTwoByteString(
+    int length, AllocationType allocation) {
   Map map = read_only_roots().string_map();
-  SeqTwoByteString string = SeqTwoByteString::cast(AllocateRawWithImmortalMap(
-      size, RefineAllocationTypeForInPlaceInternalizableString(allocation, map),
-      map));
-  DisallowGarbageCollection no_gc;
-  string.set_length(length);
-  string.set_raw_hash_field(String::kEmptyHashField);
-  DCHECK_EQ(size, string.Size());
-  return handle(string, isolate());
+  return NewRawStringWithMap<SeqTwoByteString>(
+      length, map,
+      RefineAllocationTypeForInPlaceInternalizableString(allocation, map));
+}
+
+template <typename Impl>
+MaybeHandle<SeqOneByteString> FactoryBase<Impl>::NewRawSharedOneByteString(
+    int length) {
+  return NewRawStringWithMap<SeqOneByteString>(
+      length, read_only_roots().shared_one_byte_string_map(),
+      AllocationType::kSharedOld);
+}
+
+template <typename Impl>
+MaybeHandle<SeqTwoByteString> FactoryBase<Impl>::NewRawSharedTwoByteString(
+    int length) {
+  return NewRawStringWithMap<SeqTwoByteString>(
+      length, read_only_roots().shared_string_map(),
+      AllocationType::kSharedOld);
 }
 
 template <typename Impl>

src/heap/factory-base.h

@@ -219,6 +219,11 @@ class EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE) FactoryBase
       Handle<String> left, Handle<String> right, int length, bool one_byte,
       AllocationType allocation = AllocationType::kYoung);
 
+  V8_WARN_UNUSED_RESULT MaybeHandle<SeqOneByteString> NewRawSharedOneByteString(
+      int length);
+  V8_WARN_UNUSED_RESULT MaybeHandle<SeqTwoByteString> NewRawSharedTwoByteString(
+      int length);
+
   // Allocates a new BigInt with {length} digits. Only to be used by
   // MutableBigInt::New*.
   Handle<FreshlyAllocatedBigInt> NewBigInt(
@@ -279,6 +284,10 @@ class EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE) FactoryBase
 
   Handle<String> MakeOrFindTwoCharacterString(uint16_t c1, uint16_t c2);
 
+  template <typename SeqStringT>
+  MaybeHandle<SeqStringT> NewRawStringWithMap(int length, Map map,
+                                              AllocationType allocation);
+
  private:
   friend class WebSnapshotDeserializer;
   Impl* impl() { return static_cast<Impl*>(this); }

src/heap/factory.cc

@@ -877,12 +877,12 @@ namespace {
 
 }  // namespace
 
-StringInternalizationStrategy Factory::ComputeInternalizationStrategyForString(
+StringTransitionStrategy Factory::ComputeInternalizationStrategyForString(
     Handle<String> string, MaybeHandle<Map>* internalized_map) {
   // Do not internalize young strings in-place: This allows us to ignore both
   // string table and stub cache on scavenges.
   if (Heap::InYoungGeneration(*string)) {
-    return StringInternalizationStrategy::kCopy;
+    return StringTransitionStrategy::kCopy;
   }
   DCHECK_NOT_NULL(internalized_map);
   DisallowGarbageCollection no_gc;
@@ -892,12 +892,12 @@ StringInternalizationStrategy Factory::ComputeInternalizationStrategyForString(
   Map map = string->map();
   *internalized_map = GetInPlaceInternalizedStringMap(map);
   if (!internalized_map->is_null()) {
-    return StringInternalizationStrategy::kInPlace;
+    return StringTransitionStrategy::kInPlace;
   }
   if (InstanceTypeChecker::IsInternalizedString(map.instance_type())) {
-    return StringInternalizationStrategy::kAlreadyInternalized;
+    return StringTransitionStrategy::kAlreadyTransitioned;
   }
-  return StringInternalizationStrategy::kCopy;
+  return StringTransitionStrategy::kCopy;
 }
 
 template <class StringClass>
@@ -921,6 +921,31 @@ template Handle<ExternalOneByteString>
 template Handle<ExternalTwoByteString>
     Factory::InternalizeExternalString<ExternalTwoByteString>(Handle<String>);
 
+StringTransitionStrategy Factory::ComputeSharingStrategyForString(
+    Handle<String> string, MaybeHandle<Map>* shared_map) {
+  DCHECK(FLAG_shared_string_table);
+  // Do not share young strings in-place: there is no shared young space.
+  if (Heap::InYoungGeneration(*string)) {
+    return StringTransitionStrategy::kCopy;
+  }
+  DCHECK_NOT_NULL(shared_map);
+  DisallowGarbageCollection no_gc;
+  InstanceType instance_type = string->map().instance_type();
+  if (StringShape(instance_type).IsShared()) {
+    return StringTransitionStrategy::kAlreadyTransitioned;
+  }
+  switch (instance_type) {
+    case STRING_TYPE:
+      *shared_map = read_only_roots().shared_string_map_handle();
+      return StringTransitionStrategy::kInPlace;
+    case ONE_BYTE_STRING_TYPE:
+      *shared_map = read_only_roots().shared_one_byte_string_map_handle();
+      return StringTransitionStrategy::kInPlace;
+    default:
+      return StringTransitionStrategy::kCopy;
+  }
+}
+
 Handle<String> Factory::LookupSingleCharacterStringFromCode(uint16_t code) {
   if (code <= unibrow::Latin1::kMaxChar) {
     {

src/heap/factory.h

@@ -278,15 +278,15 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
 
   // Compute the internalization strategy for the input string.
   //
-  // Old-generation flat strings can be internalized by mutating their map
-  // return kInPlace, along with the matching internalized string map for string
-  // is stored in internalized_map.
+  // Old-generation sequential strings can be internalized by mutating their map
+  // and return kInPlace, along with the matching internalized string map for
+  // string stored in internalized_map.
   //
-  // Internalized strings return kAlreadyInternalized.
+  // Internalized strings return kAlreadyTransitioned.
   //
   // All other strings are internalized by flattening and copying and return
   // kCopy.
-  V8_WARN_UNUSED_RESULT StringInternalizationStrategy
+  V8_WARN_UNUSED_RESULT StringTransitionStrategy
   ComputeInternalizationStrategyForString(Handle<String> string,
                                           MaybeHandle<Map>* internalized_map);
 
@@ -295,6 +295,20 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
   template <class StringClass>
   Handle<StringClass> InternalizeExternalString(Handle<String> string);
 
+  // Compute the sharing strategy for the input string.
+  //
+  // Old-generation sequential and thin strings can be shared by mutating their
+  // map and return kInPlace, along with the matching shared string map for the
+  // string stored in shared_map.
+  //
+  // Already-shared strings return kAlreadyTransitioned.
+  //
+  // All other strings are shared by flattening and copying into a sequential
+  // string then sharing that sequential string, and return kCopy.
+  V8_WARN_UNUSED_RESULT StringTransitionStrategy
+  ComputeSharingStrategyForString(Handle<String> string,
+                                  MaybeHandle<Map>* shared_map);
+
   // Creates a single character string where the character has given code.
   // A cache is used for Latin1 codes.
   Handle<String> LookupSingleCharacterStringFromCode(uint16_t code);

src/objects/foreign.tq

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-@apiExposedInstanceTypeValue(0x46)
+@apiExposedInstanceTypeValue(0xcc)
 extern class Foreign extends HeapObject {
   foreign_address: ExternalPointer;
 }

src/objects/instance-type.h

@@ -16,9 +16,9 @@ namespace v8 {
 namespace internal {
 
 // We use the full 16 bits of the instance_type field to encode heap object
-// instance types. All the high-order bits (bits 6-15) are cleared if the object
+// instance types. All the high-order bits (bits 7-15) are cleared if the object
 // is a string, and contain set bits if it is not a string.
-const uint32_t kIsNotStringMask = ~((1 << 6) - 1);
+const uint32_t kIsNotStringMask = ~((1 << 7) - 1);
 const uint32_t kStringTag = 0x0;
 
 // For strings, bits 0-2 indicate the representation of the string. In
@@ -68,6 +68,23 @@ const uint32_t kIsNotInternalizedMask = 1 << 5;
 const uint32_t kNotInternalizedTag = 1 << 5;
 const uint32_t kInternalizedTag = 0;
 
+// For strings, bit 6 indicates that the string is accessible by more than one
+// thread. Note that a string that is allocated in the shared heap is not
+// accessible by more than one thread until it is explicitly shared (e.g. by
+// postMessage).
+//
+// Runtime code that shares strings with other threads directly need to manually
+// set this bit.
+//
+// TODO(v8:12007): External strings cannot be shared yet.
+//
+// TODO(v8:12007): This bit is currently ignored on internalized strings, which
+// are either always shared or always not shared depending on
+// FLAG_shared_string_table. This will be hardcoded once
+// FLAG_shared_string_table is removed.
+const uint32_t kSharedStringMask = 1 << 6;
+const uint32_t kSharedStringTag = 1 << 6;
+
 // A ConsString with an empty string as the right side is a candidate
 // for being shortcut by the garbage collector. We don't allocate any
 // non-flat internalized strings, so we do not shortcut them thereby
@@ -119,6 +136,8 @@ enum InstanceType : uint16_t {
   THIN_STRING_TYPE = kTwoByteStringTag | kThinStringTag | kNotInternalizedTag,
   THIN_ONE_BYTE_STRING_TYPE =
       kOneByteStringTag | kThinStringTag | kNotInternalizedTag,
+  SHARED_STRING_TYPE = STRING_TYPE | kSharedStringTag,
+  SHARED_ONE_BYTE_STRING_TYPE = ONE_BYTE_STRING_TYPE | kSharedStringTag,
 
 // Most instance types are defined in Torque, with the exception of the string
 // types above. They are ordered by inheritance hierarchy so that we can easily

src/objects/objects-definitions.h

@@ -49,7 +49,9 @@ namespace internal {
   V(SLICED_ONE_BYTE_STRING_TYPE)                         \
   V(THIN_ONE_BYTE_STRING_TYPE)                           \
   V(UNCACHED_EXTERNAL_STRING_TYPE)                       \
-  V(UNCACHED_EXTERNAL_ONE_BYTE_STRING_TYPE)
+  V(UNCACHED_EXTERNAL_ONE_BYTE_STRING_TYPE)              \
+  V(SHARED_STRING_TYPE)                                  \
+  V(SHARED_ONE_BYTE_STRING_TYPE)
 
 #define INSTANCE_TYPE_LIST(V) \
   INSTANCE_TYPE_LIST_BASE(V)  \
@@ -94,7 +96,11 @@ namespace internal {
     UncachedExternalOneByteInternalizedString)                                 \
   V(THIN_STRING_TYPE, ThinString::kSize, thin_string, ThinString)              \
   V(THIN_ONE_BYTE_STRING_TYPE, ThinString::kSize, thin_one_byte_string,        \
-    ThinOneByteString)
+    ThinOneByteString)                                                         \
+                                                                               \
+  V(SHARED_STRING_TYPE, kVariableSizeSentinel, shared_string, SharedString)    \
+  V(SHARED_ONE_BYTE_STRING_TYPE, kVariableSizeSentinel,                        \
+    shared_one_byte_string, SharedOneByteString)
 
 // A struct is a simple object a set of object-valued fields.  Including an
 // object type in this causes the compiler to generate most of the boilerplate

src/objects/objects.cc

@@ -2197,7 +2197,8 @@ int HeapObject::SizeFromMap(Map map) const {
     return Context::SizeFor(Context::unchecked_cast(*this).length());
   }
   if (instance_type == ONE_BYTE_STRING_TYPE ||
-      instance_type == ONE_BYTE_INTERNALIZED_STRING_TYPE) {
+      instance_type == ONE_BYTE_INTERNALIZED_STRING_TYPE ||
+      instance_type == SHARED_ONE_BYTE_STRING_TYPE) {
     // Strings may get concurrently truncated, hence we have to access its
     // length synchronized.
     return SeqOneByteString::SizeFor(
@@ -2215,7 +2216,8 @@ int HeapObject::SizeFromMap(Map map) const {
     return FreeSpace::unchecked_cast(*this).size(kRelaxedLoad);
   }
   if (instance_type == STRING_TYPE ||
-      instance_type == INTERNALIZED_STRING_TYPE) {
+      instance_type == INTERNALIZED_STRING_TYPE ||
+      instance_type == SHARED_STRING_TYPE) {
     // Strings may get concurrently truncated, hence we have to access its
     // length synchronized.
     return SeqTwoByteString::SizeFor(

src/objects/oddball.tq

@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 @generateBodyDescriptor
-@apiExposedInstanceTypeValue(0x43)
+@apiExposedInstanceTypeValue(0x83)
 @highestInstanceTypeWithinParentClassRange
 extern class Oddball extends PrimitiveHeapObject {
   to_number_raw: float64;

src/objects/string-inl.h

@@ -172,6 +172,13 @@ bool StringShape::IsUncachedExternal() const {
   return (type_ & kUncachedExternalStringMask) == kUncachedExternalStringTag;
 }
 
+bool StringShape::IsShared() const {
+  // TODO(v8:12007): Set is_shared to true on internalized string when
+  // FLAG_shared_string_table is removed.
+  return (type_ & kSharedStringMask) == kSharedStringTag ||
+         (FLAG_shared_string_table && IsInternalized());
+}
+
 StringRepresentationTag StringShape::representation_tag() const {
   uint32_t tag = (type_ & kStringRepresentationMask);
   return static_cast<StringRepresentationTag>(tag);
@@ -696,6 +703,24 @@ String::FlatContent String::GetFlatContent(
   return SlowGetFlatContent(no_gc, access_guard);
 }
 
+Handle<String> String::Share(Isolate* isolate, Handle<String> string) {
+  DCHECK(FLAG_shared_string_table);
+  MaybeHandle<Map> new_map;
+  switch (
+      isolate->factory()->ComputeSharingStrategyForString(string, &new_map)) {
+    case StringTransitionStrategy::kCopy:
+      return SlowShare(isolate, string);
+    case StringTransitionStrategy::kInPlace:
+      // A relaxed write is sufficient here, because at this point the string
+      // has not yet escaped the current thread.
+      DCHECK(string->InSharedHeap());
+      string->set_map_no_write_barrier(*new_map.ToHandleChecked());
+      return string;
+    case StringTransitionStrategy::kAlreadyTransitioned:
+      return string;
+  }
+}
+
 uint16_t String::Get(int index) const {
   DCHECK(!SharedStringAccessGuardIfNeeded::IsNeeded(*this));
   return GetImpl(index, GetPtrComprCageBase(*this),
@@ -761,6 +786,14 @@ bool String::IsFlat(PtrComprCageBase cage_base) const {
   return ConsString::cast(*this).IsFlat(cage_base);
 }
 
+bool String::IsShared() const { return IsShared(GetPtrComprCageBase(*this)); }
+
+bool String::IsShared(PtrComprCageBase cage_base) const {
+  const bool result = StringShape(*this, cage_base).IsShared();
+  DCHECK_IMPLIES(result, InSharedHeap());
+  return result;
+}
+
 String String::GetUnderlying() const {
   // Giving direct access to underlying string only makes sense if the
   // wrapping string is already flattened.
@@ -952,6 +985,17 @@ inline int SeqTwoByteString::AllocatedSize() {
   return SizeFor(length(kAcquireLoad));
 }
 
+// static
+bool SeqOneByteString::IsCompatibleMap(Map map, ReadOnlyRoots roots) {
+  return map == roots.one_byte_string_map() ||
+         map == roots.shared_one_byte_string_map();
+}
+
+// static
+bool SeqTwoByteString::IsCompatibleMap(Map map, ReadOnlyRoots roots) {
+  return map == roots.string_map() || map == roots.shared_string_map();
+}
+
 void SlicedString::set_parent(String parent, WriteBarrierMode mode) {
   DCHECK(parent.IsSeqString() || parent.IsExternalString());
   TorqueGeneratedSlicedString<SlicedString, Super>::set_parent(parent, mode);

src/objects/string-table.cc

@@ -364,13 +364,13 @@ class InternalizedStringKey final : public StringTableKey {
   Handle<String> AsHandle(Isolate* isolate) {
     // Internalize the string in-place if possible.
     MaybeHandle<Map> maybe_internalized_map;
-    StringInternalizationStrategy strategy =
+    StringTransitionStrategy strategy =
         isolate->factory()->ComputeInternalizationStrategyForString(
             string_, &maybe_internalized_map);
     switch (strategy) {
-      case StringInternalizationStrategy::kCopy:
+      case StringTransitionStrategy::kCopy:
         break;
-      case StringInternalizationStrategy::kInPlace:
+      case StringTransitionStrategy::kInPlace:
         // A relaxed write is sufficient here even with concurrent
         // internalization. Though it is not synchronizing, a thread that does
         // not see the relaxed write will wait on the string table write
@@ -381,7 +381,7 @@ class InternalizedStringKey final : public StringTableKey {
             *maybe_internalized_map.ToHandleChecked());
         DCHECK(string_->IsInternalizedString());
         return string_;
-      case StringInternalizationStrategy::kAlreadyInternalized:
+      case StringTransitionStrategy::kAlreadyTransitioned:
         // We can see already internalized strings here only when sharing the
         // string table and allowing concurrent internalization.
         DCHECK(FLAG_shared_string_table);
@@ -505,7 +505,7 @@ Handle<String> StringTable::LookupKey(IsolateT* isolate, StringTableKey* key) {
   InternalIndex entry = data->FindEntry(isolate, key, key->hash());
   if (entry.is_found()) {
     Handle<String> result(String::cast(data->Get(isolate, entry)), isolate);
-    DCHECK_IMPLIES(FLAG_shared_string_table, result->InSharedHeap());
+    DCHECK_IMPLIES(FLAG_shared_string_table, result->IsShared());
     return result;
   }
 
@@ -516,7 +516,7 @@ Handle<String> StringTable::LookupKey(IsolateT* isolate, StringTableKey* key) {
   // allocates the same string, the insert will fail, the lookup above will
   // succeed, and this string will be discarded.
   Handle<String> new_string = key->AsHandle(isolate);
-  DCHECK_IMPLIES(FLAG_shared_string_table, new_string->InSharedHeap());
+  DCHECK_IMPLIES(FLAG_shared_string_table, new_string->IsShared());
 
   {
     base::MutexGuard table_write_guard(&write_mutex_);

src/objects/string.cc

@@ -104,6 +104,42 @@ Handle<String> String::SlowCopy(Isolate* isolate, Handle<SeqString> source,
   return copy;
 }
 
+Handle<String> String::SlowShare(Isolate* isolate, Handle<String> source) {
+  DCHECK(FLAG_shared_string_table);
+  Handle<String> flat = Flatten(isolate, source, AllocationType::kSharedOld);
+
+  // Do not recursively call Share, so directly compute the sharing strategy for
+  // the flat string, which could already be a copy or an existing string from
+  // e.g. a shortcut ConsString.
+  MaybeHandle<Map> new_map;
+  switch (isolate->factory()->ComputeSharingStrategyForString(flat, &new_map)) {
+    case StringTransitionStrategy::kCopy:
+      break;
+    case StringTransitionStrategy::kInPlace:
+      // A relaxed write is sufficient here, because at this point the string
+      // has not yet escaped the current thread.
+      DCHECK(flat->InSharedHeap());
+      flat->set_map_no_write_barrier(*new_map.ToHandleChecked());
+      return flat;
+    case StringTransitionStrategy::kAlreadyTransitioned:
+      return flat;
+  }
+
+  int length = flat->length();
+  if (flat->IsOneByteRepresentation()) {
+    Handle<SeqOneByteString> copy =
+        isolate->factory()->NewRawSharedOneByteString(length).ToHandleChecked();
+    DisallowGarbageCollection no_gc;
+    WriteToFlat(*flat, copy->GetChars(no_gc), 0, length);
+    return copy;
+  }
+  Handle<SeqTwoByteString> copy =
+      isolate->factory()->NewRawSharedTwoByteString(length).ToHandleChecked();
+  DisallowGarbageCollection no_gc;
+  WriteToFlat(*flat, copy->GetChars(no_gc), 0, length);
+  return copy;
+}
+
 namespace {
 
 template <class StringClass>
@@ -149,6 +185,7 @@ void String::MakeThin(IsolateT* isolate, String internalized) {
   DCHECK_NE(*this, internalized);
   DCHECK(internalized.IsInternalizedString());
   // TODO(v8:12007): Make this method threadsafe.
+  DCHECK(!IsShared());
   DCHECK_IMPLIES(
       InSharedWritableHeap(),
       ThreadId::Current() == GetIsolateFromWritableObject(*this)->thread_id());

src/objects/string.h

@@ -59,6 +59,7 @@ class StringShape {
   V8_INLINE bool IsSequentialOneByte() const;
   V8_INLINE bool IsSequentialTwoByte() const;
   V8_INLINE bool IsInternalized() const;
+  V8_INLINE bool IsShared() const;
   V8_INLINE StringRepresentationTag representation_tag() const;
   V8_INLINE uint32_t encoding_tag() const;
   V8_INLINE uint32_t full_representation_tag() const;
@@ -275,6 +276,11 @@ class String : public TorqueGeneratedString<String, Name> {
   // Requires: StringShape(this).IsIndirect() && this->IsFlat()
   inline String GetUnderlying() const;
 
+  // Shares the string. Checks inline if the string is already shared or can be
+  // shared by transitioning its map in-place. If neither is possible, flattens
+  // and copies into a new shared sequential string.
+  static inline Handle<String> Share(Isolate* isolate, Handle<String> string);
+
   // String relational comparison, implemented according to ES6 section 7.2.11
   // Abstract Relational Comparison (step 5): The comparison of Strings uses a
   // simple lexicographic ordering on sequences of code unit values. There is no
@@ -443,6 +449,9 @@ class String : public TorqueGeneratedString<String, Name> {
   inline bool IsFlat() const;
   inline bool IsFlat(PtrComprCageBase cage_base) const;
 
+  inline bool IsShared() const;
+  inline bool IsShared(PtrComprCageBase cage_base) const;
+
   // Max char codes.
   static const int32_t kMaxOneByteCharCode = unibrow::Latin1::kMaxChar;
   static const uint32_t kMaxOneByteCharCodeU = unibrow::Latin1::kMaxChar;
@@ -603,6 +612,9 @@ class String : public TorqueGeneratedString<String, Name> {
   static Handle<String> SlowCopy(Isolate* isolate, Handle<SeqString> source,
                                  AllocationType allocation);
 
+  V8_EXPORT_PRIVATE static Handle<String> SlowShare(Isolate* isolate,
+                                                    Handle<String> source);
+
   // Slow case of String::Equals.  This implementation works on any strings
   // but it is most efficient on strings that are almost flat.
   V8_EXPORT_PRIVATE bool SlowEquals(String other) const;
@@ -709,11 +721,6 @@ class SeqOneByteString
   // is deterministic.
   void clear_padding();
 
-  // Garbage collection support.  This method is called by the
-  // garbage collector to compute the actual size of an OneByteString
-  // instance.
-  inline int SeqOneByteStringSize(InstanceType instance_type);
-
   // Maximal memory usage for a single sequential one-byte string.
   static const int kMaxCharsSize = kMaxLength;
   static const int kMaxSize = OBJECT_POINTER_ALIGN(kMaxCharsSize + kHeaderSize);
@@ -721,6 +728,9 @@ class SeqOneByteString
 
   int AllocatedSize();
 
+  // A SeqOneByteString have different maps depending on whether it is shared.
+  static inline bool IsCompatibleMap(Map map, ReadOnlyRoots roots);
+
   class BodyDescriptor;
 
   TQ_OBJECT_CONSTRUCTORS(SeqOneByteString)
@@ -757,11 +767,6 @@ class SeqTwoByteString
   // is deterministic.
   void clear_padding();
 
-  // Garbage collection support.  This method is called by the
-  // garbage collector to compute the actual size of a TwoByteString
-  // instance.
-  inline int SeqTwoByteStringSize(InstanceType instance_type);
-
   // Maximal memory usage for a single sequential two-byte string.
   static const int kMaxCharsSize = kMaxLength * 2;
   static const int kMaxSize = OBJECT_POINTER_ALIGN(kMaxCharsSize + kHeaderSize);
@@ -770,6 +775,9 @@ class SeqTwoByteString
 
   int AllocatedSize();
 
+  // A SeqTwoByteString have different maps depending on whether it is shared.
+  static inline bool IsCompatibleMap(Map map, ReadOnlyRoots roots);
+
   class BodyDescriptor;
 
   TQ_OBJECT_CONSTRUCTORS(SeqTwoByteString)

src/objects/string.tq

@@ -5,7 +5,7 @@
 #include 'src/builtins/builtins-string-gen.h'
 
 @abstract
-@reserveBitsInInstanceType(6)
+@reserveBitsInInstanceType(7)
 extern class String extends Name {
   macro StringInstanceType(): StringInstanceType {
     return %RawDownCast<StringInstanceType>(
@@ -32,6 +32,7 @@ bitfield struct StringInstanceType extends uint16 {
   is_one_byte: bool: 1 bit;
   is_uncached: bool: 1 bit;
   is_not_internalized: bool: 1 bit;
+  is_shared: bool: 1 bit;
 }
 
 @generateBodyDescriptor

src/roots/roots.h

@@ -142,6 +142,8 @@ class Symbol;
     UncachedExternalOneByteInternalizedStringMap)                              \
   V(Map, uncached_external_one_byte_string_map,                                \
     UncachedExternalOneByteStringMap)                                          \
+  V(Map, shared_one_byte_string_map, SharedOneByteStringMap)                   \
+  V(Map, shared_string_map, SharedStringMap)                                   \
   /* Oddball maps */                                                           \
   V(Map, undefined_map, UndefinedMap)                                          \
   V(Map, the_hole_map, TheHoleMap)                                             \

test/cctest/test-shared-strings.cc

@@ -219,9 +219,9 @@ UNINITIALIZED_TEST(YoungInternalization) {
   // Allocate two young strings with the same contents in isolate2 then intern
   // them. They should be the same as the interned strings from isolate1.
   Handle<String> young_one_byte_seq2 =
-      factory2->NewStringFromAsciiChecked(raw_one_byte, AllocationType::kOld);
+      factory2->NewStringFromAsciiChecked(raw_one_byte, AllocationType::kYoung);
   Handle<String> young_two_byte_seq2 =
-      factory2->NewStringFromTwoByte(two_byte, AllocationType::kOld)
+      factory2->NewStringFromTwoByte(two_byte, AllocationType::kYoung)
           .ToHandleChecked();
   Handle<String> one_byte_intern2 =
       factory2->InternalizeString(young_one_byte_seq2);
@@ -330,6 +330,146 @@ UNINITIALIZED_TEST(ConcurrentInternalization) {
   }
 }
 
+namespace {
+void CheckSharedStringIsEqualCopy(Handle<String> shared,
+                                  Handle<String> original) {
+  CHECK(shared->IsShared());
+  CHECK(shared->Equals(*original));
+  CHECK_NE(*shared, *original);
+}
+
+Handle<String> ShareAndVerify(Isolate* isolate, Handle<String> string) {
+  Handle<String> shared = String::Share(isolate, string);
+  CHECK(shared->IsShared());
+#ifdef VERIFY_HEAP
+  shared->ObjectVerify(isolate);
+  string->ObjectVerify(isolate);
+#endif  // VERIFY_HEAP
+  return shared;
+}
+}  // namespace
+
+UNINITIALIZED_TEST(StringShare) {
+  if (!ReadOnlyHeap::IsReadOnlySpaceShared()) return;
+  if (!COMPRESS_POINTERS_IN_SHARED_CAGE_BOOL) return;
+
+  FLAG_shared_string_table = true;
+
+  MultiClientIsolateTest test;
+  v8::Isolate* isolate = test.NewClientIsolate();
+  Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
+  Factory* factory = i_isolate->factory();
+
+  HandleScope scope(i_isolate);
+
+  // A longer string so that concatenated to itself, the result is >
+  // ConsString::kMinLength.
+  const char raw_one_byte[] =
+      "Lorem ipsum dolor sit amet, consectetur adipiscing elit";
+  base::uc16 raw_two_byte[] = {2001, 2002, 2003};
+  base::Vector<const base::uc16> two_byte(raw_two_byte, 3);
+
+  {
+    // Old-generation sequential strings are shared in-place.
+    Handle<String> one_byte_seq =
+        factory->NewStringFromAsciiChecked(raw_one_byte, AllocationType::kOld);
+    Handle<String> two_byte_seq =
+        factory->NewStringFromTwoByte(two_byte, AllocationType::kOld)
+            .ToHandleChecked();
+    CHECK(!one_byte_seq->IsShared());
+    CHECK(!two_byte_seq->IsShared());
+    Handle<String> shared_one_byte = ShareAndVerify(i_isolate, one_byte_seq);
+    Handle<String> shared_two_byte = ShareAndVerify(i_isolate, two_byte_seq);
+    CHECK_EQ(*one_byte_seq, *shared_one_byte);
+    CHECK_EQ(*two_byte_seq, *shared_two_byte);
+  }
+
+  {
+    // Internalized strings are always shared.
+    Handle<String> one_byte_seq =
+        factory->NewStringFromAsciiChecked(raw_one_byte, AllocationType::kOld);
+    Handle<String> two_byte_seq =
+        factory->NewStringFromTwoByte(two_byte, AllocationType::kOld)
+            .ToHandleChecked();
+    CHECK(!one_byte_seq->IsShared());
+    CHECK(!two_byte_seq->IsShared());
+    Handle<String> one_byte_intern = factory->InternalizeString(one_byte_seq);
+    Handle<String> two_byte_intern = factory->InternalizeString(two_byte_seq);
+    CHECK(one_byte_intern->IsShared());
+    CHECK(two_byte_intern->IsShared());
+    Handle<String> shared_one_byte_intern =
+        ShareAndVerify(i_isolate, one_byte_intern);
+    Handle<String> shared_two_byte_intern =
+        ShareAndVerify(i_isolate, two_byte_intern);
+    CHECK_EQ(*one_byte_intern, *shared_one_byte_intern);
+    CHECK_EQ(*two_byte_intern, *shared_two_byte_intern);
+  }
+
+  // All other strings are flattened then copied if the flatten didn't already
+  // create a new copy.
+
+  {
+    // Young strings
+    Handle<String> young_one_byte_seq = factory->NewStringFromAsciiChecked(
+        raw_one_byte, AllocationType::kYoung);
+    Handle<String> young_two_byte_seq =
+        factory->NewStringFromTwoByte(two_byte, AllocationType::kYoung)
+            .ToHandleChecked();
+    CHECK(!young_one_byte_seq->IsShared());
+    CHECK(!young_two_byte_seq->IsShared());
+    Handle<String> shared_one_byte =
+        ShareAndVerify(i_isolate, young_one_byte_seq);
+    Handle<String> shared_two_byte =
+        ShareAndVerify(i_isolate, young_two_byte_seq);
+    CheckSharedStringIsEqualCopy(shared_one_byte, young_one_byte_seq);
+    CheckSharedStringIsEqualCopy(shared_two_byte, young_two_byte_seq);
+  }
+
+  {
+    // Thin strings
+    Handle<String> one_byte_seq1 =
+        factory->NewStringFromAsciiChecked(raw_one_byte);
+    Handle<String> one_byte_seq2 =
+        factory->NewStringFromAsciiChecked(raw_one_byte);
+    CHECK(!one_byte_seq1->IsShared());
+    CHECK(!one_byte_seq2->IsShared());
+    factory->InternalizeString(one_byte_seq1);
+    factory->InternalizeString(one_byte_seq2);
+    CHECK(StringShape(*one_byte_seq2).IsThin());
+    Handle<String> shared = ShareAndVerify(i_isolate, one_byte_seq2);
+    CheckSharedStringIsEqualCopy(shared, one_byte_seq2);
+  }
+
+  {
+    // Cons strings
+    Handle<String> one_byte_seq1 =
+        factory->NewStringFromAsciiChecked(raw_one_byte);
+    Handle<String> one_byte_seq2 =
+        factory->NewStringFromAsciiChecked(raw_one_byte);
+    CHECK(!one_byte_seq1->IsShared());
+    CHECK(!one_byte_seq2->IsShared());
+    Handle<String> cons =
+        factory->NewConsString(one_byte_seq1, one_byte_seq2).ToHandleChecked();
+    CHECK(!cons->IsShared());
+    CHECK(cons->IsConsString());
+    Handle<String> shared = ShareAndVerify(i_isolate, cons);
+    CheckSharedStringIsEqualCopy(shared, cons);
+  }
+
+  {
+    // Sliced strings
+    Handle<String> one_byte_seq =
+        factory->NewStringFromAsciiChecked(raw_one_byte);
+    CHECK(!one_byte_seq->IsShared());
+    Handle<String> sliced =
+        factory->NewSubString(one_byte_seq, 1, one_byte_seq->length());
+    CHECK(!sliced->IsShared());
+    CHECK(sliced->IsSlicedString());
+    Handle<String> shared = ShareAndVerify(i_isolate, sliced);
+    CheckSharedStringIsEqualCopy(shared, sliced);
+  }
+}
+
 UNINITIALIZED_TEST(PromotionMarkCompact) {
   if (FLAG_single_generation) return;
   if (!ReadOnlyHeap::IsReadOnlySpaceShared()) return;

tools/v8heapconst.py

@@ -25,143 +25,145 @@ INSTANCE_TYPES = {
   45: "THIN_ONE_BYTE_STRING_TYPE",
   50: "UNCACHED_EXTERNAL_STRING_TYPE",
   58: "UNCACHED_EXTERNAL_ONE_BYTE_STRING_TYPE",
-  64: "SYMBOL_TYPE",
-  65: "BIG_INT_BASE_TYPE",
-  66: "HEAP_NUMBER_TYPE",
-  67: "ODDBALL_TYPE",
-  68: "ABSTRACT_INTERNAL_CLASS_SUBCLASS1_TYPE",
-  69: "ABSTRACT_INTERNAL_CLASS_SUBCLASS2_TYPE",
-  70: "FOREIGN_TYPE",
-  71: "WASM_FUNCTION_DATA_TYPE",
-  72: "WASM_CAPI_FUNCTION_DATA_TYPE",
-  73: "WASM_EXPORTED_FUNCTION_DATA_TYPE",
-  74: "WASM_JS_FUNCTION_DATA_TYPE",
-  75: "WASM_TYPE_INFO_TYPE",
-  76: "PROMISE_FULFILL_REACTION_JOB_TASK_TYPE",
-  77: "PROMISE_REJECT_REACTION_JOB_TASK_TYPE",
-  78: "CALLABLE_TASK_TYPE",
-  79: "CALLBACK_TASK_TYPE",
-  80: "PROMISE_RESOLVE_THENABLE_JOB_TASK_TYPE",
-  81: "LOAD_HANDLER_TYPE",
-  82: "STORE_HANDLER_TYPE",
-  83: "FUNCTION_TEMPLATE_INFO_TYPE",
-  84: "OBJECT_TEMPLATE_INFO_TYPE",
-  85: "ACCESS_CHECK_INFO_TYPE",
-  86: "ACCESSOR_INFO_TYPE",
-  87: "ACCESSOR_PAIR_TYPE",
-  88: "ALIASED_ARGUMENTS_ENTRY_TYPE",
-  89: "ALLOCATION_MEMENTO_TYPE",
-  90: "ALLOCATION_SITE_TYPE",
-  91: "ARRAY_BOILERPLATE_DESCRIPTION_TYPE",
-  92: "ASM_WASM_DATA_TYPE",
-  93: "ASYNC_GENERATOR_REQUEST_TYPE",
-  94: "BREAK_POINT_TYPE",
-  95: "BREAK_POINT_INFO_TYPE",
-  96: "CACHED_TEMPLATE_OBJECT_TYPE",
-  97: "CALL_HANDLER_INFO_TYPE",
-  98: "CLASS_POSITIONS_TYPE",
-  99: "DEBUG_INFO_TYPE",
-  100: "ENUM_CACHE_TYPE",
-  101: "FEEDBACK_CELL_TYPE",
-  102: "FUNCTION_TEMPLATE_RARE_DATA_TYPE",
-  103: "INTERCEPTOR_INFO_TYPE",
-  104: "INTERPRETER_DATA_TYPE",
-  105: "MODULE_REQUEST_TYPE",
-  106: "PROMISE_CAPABILITY_TYPE",
-  107: "PROMISE_REACTION_TYPE",
-  108: "PROPERTY_DESCRIPTOR_OBJECT_TYPE",
-  109: "PROTOTYPE_INFO_TYPE",
-  110: "REG_EXP_BOILERPLATE_DESCRIPTION_TYPE",
-  111: "SCRIPT_TYPE",
-  112: "SCRIPT_OR_MODULE_TYPE",
-  113: "SOURCE_TEXT_MODULE_INFO_ENTRY_TYPE",
-  114: "STACK_FRAME_INFO_TYPE",
-  115: "TEMPLATE_OBJECT_DESCRIPTION_TYPE",
-  116: "TUPLE2_TYPE",
-  117: "WASM_CONTINUATION_OBJECT_TYPE",
-  118: "WASM_EXCEPTION_TAG_TYPE",
-  119: "WASM_INDIRECT_FUNCTION_TABLE_TYPE",
-  120: "FIXED_ARRAY_TYPE",
-  121: "HASH_TABLE_TYPE",
-  122: "EPHEMERON_HASH_TABLE_TYPE",
-  123: "GLOBAL_DICTIONARY_TYPE",
-  124: "NAME_DICTIONARY_TYPE",
-  125: "NUMBER_DICTIONARY_TYPE",
-  126: "ORDERED_HASH_MAP_TYPE",
-  127: "ORDERED_HASH_SET_TYPE",
-  128: "ORDERED_NAME_DICTIONARY_TYPE",
-  129: "SIMPLE_NUMBER_DICTIONARY_TYPE",
-  130: "CLOSURE_FEEDBACK_CELL_ARRAY_TYPE",
-  131: "OBJECT_BOILERPLATE_DESCRIPTION_TYPE",
-  132: "SCRIPT_CONTEXT_TABLE_TYPE",
-  133: "BYTE_ARRAY_TYPE",
-  134: "BYTECODE_ARRAY_TYPE",
-  135: "FIXED_DOUBLE_ARRAY_TYPE",
-  136: "INTERNAL_CLASS_WITH_SMI_ELEMENTS_TYPE",
-  137: "SLOPPY_ARGUMENTS_ELEMENTS_TYPE",
-  138: "AWAIT_CONTEXT_TYPE",
-  139: "BLOCK_CONTEXT_TYPE",
-  140: "CATCH_CONTEXT_TYPE",
-  141: "DEBUG_EVALUATE_CONTEXT_TYPE",
-  142: "EVAL_CONTEXT_TYPE",
-  143: "FUNCTION_CONTEXT_TYPE",
-  144: "MODULE_CONTEXT_TYPE",
-  145: "NATIVE_CONTEXT_TYPE",
-  146: "SCRIPT_CONTEXT_TYPE",
-  147: "WITH_CONTEXT_TYPE",
-  148: "TURBOFAN_BITSET_TYPE_TYPE",
-  149: "TURBOFAN_HEAP_CONSTANT_TYPE_TYPE",
-  150: "TURBOFAN_OTHER_NUMBER_CONSTANT_TYPE_TYPE",
-  151: "TURBOFAN_RANGE_TYPE_TYPE",
-  152: "TURBOFAN_UNION_TYPE_TYPE",
-  153: "EXPORTED_SUB_CLASS_BASE_TYPE",
-  154: "EXPORTED_SUB_CLASS_TYPE",
-  155: "EXPORTED_SUB_CLASS2_TYPE",
-  156: "SMALL_ORDERED_HASH_MAP_TYPE",
-  157: "SMALL_ORDERED_HASH_SET_TYPE",
-  158: "SMALL_ORDERED_NAME_DICTIONARY_TYPE",
-  159: "DESCRIPTOR_ARRAY_TYPE",
-  160: "STRONG_DESCRIPTOR_ARRAY_TYPE",
-  161: "SOURCE_TEXT_MODULE_TYPE",
-  162: "SYNTHETIC_MODULE_TYPE",
-  163: "UNCOMPILED_DATA_WITH_PREPARSE_DATA_TYPE",
-  164: "UNCOMPILED_DATA_WITHOUT_PREPARSE_DATA_TYPE",
-  165: "WEAK_FIXED_ARRAY_TYPE",
-  166: "TRANSITION_ARRAY_TYPE",
-  167: "CALL_REF_DATA_TYPE",
-  168: "CELL_TYPE",
-  169: "CODE_TYPE",
-  170: "CODE_DATA_CONTAINER_TYPE",
-  171: "COVERAGE_INFO_TYPE",
-  172: "EMBEDDER_DATA_ARRAY_TYPE",
-  173: "FEEDBACK_METADATA_TYPE",
-  174: "FEEDBACK_VECTOR_TYPE",
-  175: "FILLER_TYPE",
-  176: "FREE_SPACE_TYPE",
-  177: "INTERNAL_CLASS_TYPE",
-  178: "INTERNAL_CLASS_WITH_STRUCT_ELEMENTS_TYPE",
-  179: "MAP_TYPE",
-  180: "MEGA_DOM_HANDLER_TYPE",
-  181: "ON_HEAP_BASIC_BLOCK_PROFILER_DATA_TYPE",
-  182: "PREPARSE_DATA_TYPE",
-  183: "PROPERTY_ARRAY_TYPE",
-  184: "PROPERTY_CELL_TYPE",
-  185: "SCOPE_INFO_TYPE",
-  186: "SHARED_FUNCTION_INFO_TYPE",
-  187: "SMI_BOX_TYPE",
-  188: "SMI_PAIR_TYPE",
-  189: "SORT_STATE_TYPE",
-  190: "SWISS_NAME_DICTIONARY_TYPE",
-  191: "WASM_API_FUNCTION_REF_TYPE",
-  192: "WEAK_ARRAY_LIST_TYPE",
-  193: "WEAK_CELL_TYPE",
-  194: "WASM_ARRAY_TYPE",
-  195: "WASM_STRUCT_TYPE",
-  196: "JS_PROXY_TYPE",
+  96: "SHARED_STRING_TYPE",
+  104: "SHARED_ONE_BYTE_STRING_TYPE",
+  128: "SYMBOL_TYPE",
+  129: "BIG_INT_BASE_TYPE",
+  130: "HEAP_NUMBER_TYPE",
+  131: "ODDBALL_TYPE",
+  132: "PROMISE_FULFILL_REACTION_JOB_TASK_TYPE",
+  133: "PROMISE_REJECT_REACTION_JOB_TASK_TYPE",
+  134: "CALLABLE_TASK_TYPE",
+  135: "CALLBACK_TASK_TYPE",
+  136: "PROMISE_RESOLVE_THENABLE_JOB_TASK_TYPE",
+  137: "LOAD_HANDLER_TYPE",
+  138: "STORE_HANDLER_TYPE",
+  139: "FUNCTION_TEMPLATE_INFO_TYPE",
+  140: "OBJECT_TEMPLATE_INFO_TYPE",
+  141: "ACCESS_CHECK_INFO_TYPE",
+  142: "ACCESSOR_INFO_TYPE",
+  143: "ACCESSOR_PAIR_TYPE",
+  144: "ALIASED_ARGUMENTS_ENTRY_TYPE",
+  145: "ALLOCATION_MEMENTO_TYPE",
+  146: "ALLOCATION_SITE_TYPE",
+  147: "ARRAY_BOILERPLATE_DESCRIPTION_TYPE",
+  148: "ASM_WASM_DATA_TYPE",
+  149: "ASYNC_GENERATOR_REQUEST_TYPE",
+  150: "BREAK_POINT_TYPE",
+  151: "BREAK_POINT_INFO_TYPE",
+  152: "CACHED_TEMPLATE_OBJECT_TYPE",
+  153: "CALL_HANDLER_INFO_TYPE",
+  154: "CLASS_POSITIONS_TYPE",
+  155: "DEBUG_INFO_TYPE",
+  156: "ENUM_CACHE_TYPE",
+  157: "FEEDBACK_CELL_TYPE",
+  158: "FUNCTION_TEMPLATE_RARE_DATA_TYPE",
+  159: "INTERCEPTOR_INFO_TYPE",
+  160: "INTERPRETER_DATA_TYPE",
+  161: "MODULE_REQUEST_TYPE",
+  162: "PROMISE_CAPABILITY_TYPE",
+  163: "PROMISE_REACTION_TYPE",
+  164: "PROPERTY_DESCRIPTOR_OBJECT_TYPE",
+  165: "PROTOTYPE_INFO_TYPE",
+  166: "REG_EXP_BOILERPLATE_DESCRIPTION_TYPE",
+  167: "SCRIPT_TYPE",
+  168: "SCRIPT_OR_MODULE_TYPE",
+  169: "SOURCE_TEXT_MODULE_INFO_ENTRY_TYPE",
+  170: "STACK_FRAME_INFO_TYPE",
+  171: "TEMPLATE_OBJECT_DESCRIPTION_TYPE",
+  172: "TUPLE2_TYPE",
+  173: "WASM_CONTINUATION_OBJECT_TYPE",
+  174: "WASM_EXCEPTION_TAG_TYPE",
+  175: "WASM_INDIRECT_FUNCTION_TABLE_TYPE",
+  176: "FIXED_ARRAY_TYPE",
+  177: "HASH_TABLE_TYPE",
+  178: "EPHEMERON_HASH_TABLE_TYPE",
+  179: "GLOBAL_DICTIONARY_TYPE",
+  180: "NAME_DICTIONARY_TYPE",
+  181: "NUMBER_DICTIONARY_TYPE",
+  182: "ORDERED_HASH_MAP_TYPE",
+  183: "ORDERED_HASH_SET_TYPE",
+  184: "ORDERED_NAME_DICTIONARY_TYPE",
+  185: "SIMPLE_NUMBER_DICTIONARY_TYPE",
+  186: "CLOSURE_FEEDBACK_CELL_ARRAY_TYPE",
+  187: "OBJECT_BOILERPLATE_DESCRIPTION_TYPE",
+  188: "SCRIPT_CONTEXT_TABLE_TYPE",
+  189: "BYTE_ARRAY_TYPE",
+  190: "BYTECODE_ARRAY_TYPE",
+  191: "FIXED_DOUBLE_ARRAY_TYPE",
+  192: "INTERNAL_CLASS_WITH_SMI_ELEMENTS_TYPE",
+  193: "SLOPPY_ARGUMENTS_ELEMENTS_TYPE",
+  194: "AWAIT_CONTEXT_TYPE",
+  195: "BLOCK_CONTEXT_TYPE",
+  196: "CATCH_CONTEXT_TYPE",
+  197: "DEBUG_EVALUATE_CONTEXT_TYPE",
+  198: "EVAL_CONTEXT_TYPE",
+  199: "FUNCTION_CONTEXT_TYPE",
+  200: "MODULE_CONTEXT_TYPE",
+  201: "NATIVE_CONTEXT_TYPE",
+  202: "SCRIPT_CONTEXT_TYPE",
+  203: "WITH_CONTEXT_TYPE",
+  204: "FOREIGN_TYPE",
+  205: "WASM_FUNCTION_DATA_TYPE",
+  206: "WASM_CAPI_FUNCTION_DATA_TYPE",
+  207: "WASM_EXPORTED_FUNCTION_DATA_TYPE",
+  208: "WASM_JS_FUNCTION_DATA_TYPE",
+  209: "WASM_TYPE_INFO_TYPE",
+  210: "TURBOFAN_BITSET_TYPE_TYPE",
+  211: "TURBOFAN_HEAP_CONSTANT_TYPE_TYPE",
+  212: "TURBOFAN_OTHER_NUMBER_CONSTANT_TYPE_TYPE",
+  213: "TURBOFAN_RANGE_TYPE_TYPE",
+  214: "TURBOFAN_UNION_TYPE_TYPE",
+  215: "EXPORTED_SUB_CLASS_BASE_TYPE",
+  216: "EXPORTED_SUB_CLASS_TYPE",
+  217: "EXPORTED_SUB_CLASS2_TYPE",
+  218: "SMALL_ORDERED_HASH_MAP_TYPE",
+  219: "SMALL_ORDERED_HASH_SET_TYPE",
+  220: "SMALL_ORDERED_NAME_DICTIONARY_TYPE",
+  221: "ABSTRACT_INTERNAL_CLASS_SUBCLASS1_TYPE",
+  222: "ABSTRACT_INTERNAL_CLASS_SUBCLASS2_TYPE",
+  223: "DESCRIPTOR_ARRAY_TYPE",
+  224: "STRONG_DESCRIPTOR_ARRAY_TYPE",
+  225: "SOURCE_TEXT_MODULE_TYPE",
+  226: "SYNTHETIC_MODULE_TYPE",
+  227: "UNCOMPILED_DATA_WITH_PREPARSE_DATA_TYPE",
+  228: "UNCOMPILED_DATA_WITHOUT_PREPARSE_DATA_TYPE",
+  229: "WEAK_FIXED_ARRAY_TYPE",
+  230: "TRANSITION_ARRAY_TYPE",
+  231: "CALL_REF_DATA_TYPE",
+  232: "CELL_TYPE",
+  233: "CODE_TYPE",
+  234: "CODE_DATA_CONTAINER_TYPE",
+  235: "COVERAGE_INFO_TYPE",
+  236: "EMBEDDER_DATA_ARRAY_TYPE",
+  237: "FEEDBACK_METADATA_TYPE",
+  238: "FEEDBACK_VECTOR_TYPE",
+  239: "FILLER_TYPE",
+  240: "FREE_SPACE_TYPE",
+  241: "INTERNAL_CLASS_TYPE",
+  242: "INTERNAL_CLASS_WITH_STRUCT_ELEMENTS_TYPE",
+  243: "MAP_TYPE",
+  244: "MEGA_DOM_HANDLER_TYPE",
+  245: "ON_HEAP_BASIC_BLOCK_PROFILER_DATA_TYPE",
+  246: "PREPARSE_DATA_TYPE",
+  247: "PROPERTY_ARRAY_TYPE",
+  248: "PROPERTY_CELL_TYPE",
+  249: "SCOPE_INFO_TYPE",
+  250: "SHARED_FUNCTION_INFO_TYPE",
+  251: "SMI_BOX_TYPE",
+  252: "SMI_PAIR_TYPE",
+  253: "SORT_STATE_TYPE",
+  254: "SWISS_NAME_DICTIONARY_TYPE",
+  255: "WASM_API_FUNCTION_REF_TYPE",
+  256: "WEAK_ARRAY_LIST_TYPE",
+  257: "WEAK_CELL_TYPE",
+  258: "WASM_ARRAY_TYPE",
+  259: "WASM_STRUCT_TYPE",
+  260: "JS_PROXY_TYPE",
   1057: "JS_OBJECT_TYPE",
-  197: "JS_GLOBAL_OBJECT_TYPE",
-  198: "JS_GLOBAL_PROXY_TYPE",
-  199: "JS_MODULE_NAMESPACE_TYPE",
+  261: "JS_GLOBAL_OBJECT_TYPE",
+  262: "JS_GLOBAL_PROXY_TYPE",
+  263: "JS_MODULE_NAMESPACE_TYPE",
   1040: "JS_SPECIAL_API_OBJECT_TYPE",
   1041: "JS_PRIMITIVE_WRAPPER_TYPE",
   1058: "JS_API_OBJECT_TYPE",
@@ -256,82 +258,82 @@ INSTANCE_TYPES = {
 
 # List of known V8 maps.
 KNOWN_MAPS = {
-  ("read_only_space", 0x02119): (179, "MetaMap"),
-  ("read_only_space", 0x02141): (67, "NullMap"),
-  ("read_only_space", 0x02169): (160, "StrongDescriptorArrayMap"),
-  ("read_only_space", 0x02191): (165, "WeakFixedArrayMap"),
-  ("read_only_space", 0x021d1): (100, "EnumCacheMap"),
-  ("read_only_space", 0x02205): (120, "FixedArrayMap"),
+  ("read_only_space", 0x02119): (243, "MetaMap"),
+  ("read_only_space", 0x02141): (131, "NullMap"),
+  ("read_only_space", 0x02169): (224, "StrongDescriptorArrayMap"),
+  ("read_only_space", 0x02191): (229, "WeakFixedArrayMap"),
+  ("read_only_space", 0x021d1): (156, "EnumCacheMap"),
+  ("read_only_space", 0x02205): (176, "FixedArrayMap"),
   ("read_only_space", 0x02251): (8, "OneByteInternalizedStringMap"),
-  ("read_only_space", 0x0229d): (176, "FreeSpaceMap"),
-  ("read_only_space", 0x022c5): (175, "OnePointerFillerMap"),
-  ("read_only_space", 0x022ed): (175, "TwoPointerFillerMap"),
-  ("read_only_space", 0x02315): (67, "UninitializedMap"),
-  ("read_only_space", 0x0238d): (67, "UndefinedMap"),
-  ("read_only_space", 0x023d1): (66, "HeapNumberMap"),
-  ("read_only_space", 0x02405): (67, "TheHoleMap"),
-  ("read_only_space", 0x02465): (67, "BooleanMap"),
-  ("read_only_space", 0x02509): (133, "ByteArrayMap"),
-  ("read_only_space", 0x02531): (120, "FixedCOWArrayMap"),
-  ("read_only_space", 0x02559): (121, "HashTableMap"),
-  ("read_only_space", 0x02581): (64, "SymbolMap"),
+  ("read_only_space", 0x0229d): (240, "FreeSpaceMap"),
+  ("read_only_space", 0x022c5): (239, "OnePointerFillerMap"),
+  ("read_only_space", 0x022ed): (239, "TwoPointerFillerMap"),
+  ("read_only_space", 0x02315): (131, "UninitializedMap"),
+  ("read_only_space", 0x0238d): (131, "UndefinedMap"),
+  ("read_only_space", 0x023d1): (130, "HeapNumberMap"),
+  ("read_only_space", 0x02405): (131, "TheHoleMap"),
+  ("read_only_space", 0x02465): (131, "BooleanMap"),
+  ("read_only_space", 0x02509): (189, "ByteArrayMap"),
+  ("read_only_space", 0x02531): (176, "FixedCOWArrayMap"),
+  ("read_only_space", 0x02559): (177, "HashTableMap"),
+  ("read_only_space", 0x02581): (128, "SymbolMap"),
   ("read_only_space", 0x025a9): (40, "OneByteStringMap"),
-  ("read_only_space", 0x025d1): (185, "ScopeInfoMap"),
-  ("read_only_space", 0x025f9): (186, "SharedFunctionInfoMap"),
-  ("read_only_space", 0x02621): (169, "CodeMap"),
-  ("read_only_space", 0x02649): (168, "CellMap"),
-  ("read_only_space", 0x02671): (184, "GlobalPropertyCellMap"),
-  ("read_only_space", 0x02699): (70, "ForeignMap"),
-  ("read_only_space", 0x026c1): (166, "TransitionArrayMap"),
+  ("read_only_space", 0x025d1): (249, "ScopeInfoMap"),
+  ("read_only_space", 0x025f9): (250, "SharedFunctionInfoMap"),
+  ("read_only_space", 0x02621): (233, "CodeMap"),
+  ("read_only_space", 0x02649): (232, "CellMap"),
+  ("read_only_space", 0x02671): (248, "GlobalPropertyCellMap"),
+  ("read_only_space", 0x02699): (204, "ForeignMap"),
+  ("read_only_space", 0x026c1): (230, "TransitionArrayMap"),
   ("read_only_space", 0x026e9): (45, "ThinOneByteStringMap"),
-  ("read_only_space", 0x02711): (174, "FeedbackVectorMap"),
-  ("read_only_space", 0x02749): (67, "ArgumentsMarkerMap"),
-  ("read_only_space", 0x027a9): (67, "ExceptionMap"),
-  ("read_only_space", 0x02805): (67, "TerminationExceptionMap"),
-  ("read_only_space", 0x0286d): (67, "OptimizedOutMap"),
-  ("read_only_space", 0x028cd): (67, "StaleRegisterMap"),
-  ("read_only_space", 0x0292d): (132, "ScriptContextTableMap"),
-  ("read_only_space", 0x02955): (130, "ClosureFeedbackCellArrayMap"),
-  ("read_only_space", 0x0297d): (173, "FeedbackMetadataArrayMap"),
-  ("read_only_space", 0x029a5): (120, "ArrayListMap"),
-  ("read_only_space", 0x029cd): (65, "BigIntMap"),
-  ("read_only_space", 0x029f5): (131, "ObjectBoilerplateDescriptionMap"),
-  ("read_only_space", 0x02a1d): (134, "BytecodeArrayMap"),
-  ("read_only_space", 0x02a45): (170, "CodeDataContainerMap"),
-  ("read_only_space", 0x02a6d): (171, "CoverageInfoMap"),
-  ("read_only_space", 0x02a95): (135, "FixedDoubleArrayMap"),
-  ("read_only_space", 0x02abd): (123, "GlobalDictionaryMap"),
-  ("read_only_space", 0x02ae5): (101, "ManyClosuresCellMap"),
-  ("read_only_space", 0x02b0d): (180, "MegaDomHandlerMap"),
-  ("read_only_space", 0x02b35): (120, "ModuleInfoMap"),
-  ("read_only_space", 0x02b5d): (124, "NameDictionaryMap"),
-  ("read_only_space", 0x02b85): (101, "NoClosuresCellMap"),
-  ("read_only_space", 0x02bad): (125, "NumberDictionaryMap"),
-  ("read_only_space", 0x02bd5): (101, "OneClosureCellMap"),
-  ("read_only_space", 0x02bfd): (126, "OrderedHashMapMap"),
-  ("read_only_space", 0x02c25): (127, "OrderedHashSetMap"),
-  ("read_only_space", 0x02c4d): (128, "OrderedNameDictionaryMap"),
-  ("read_only_space", 0x02c75): (182, "PreparseDataMap"),
-  ("read_only_space", 0x02c9d): (183, "PropertyArrayMap"),
-  ("read_only_space", 0x02cc5): (97, "SideEffectCallHandlerInfoMap"),
-  ("read_only_space", 0x02ced): (97, "SideEffectFreeCallHandlerInfoMap"),
-  ("read_only_space", 0x02d15): (97, "NextCallSideEffectFreeCallHandlerInfoMap"),
-  ("read_only_space", 0x02d3d): (129, "SimpleNumberDictionaryMap"),
-  ("read_only_space", 0x02d65): (156, "SmallOrderedHashMapMap"),
-  ("read_only_space", 0x02d8d): (157, "SmallOrderedHashSetMap"),
-  ("read_only_space", 0x02db5): (158, "SmallOrderedNameDictionaryMap"),
-  ("read_only_space", 0x02ddd): (161, "SourceTextModuleMap"),
-  ("read_only_space", 0x02e05): (190, "SwissNameDictionaryMap"),
-  ("read_only_space", 0x02e2d): (162, "SyntheticModuleMap"),
-  ("read_only_space", 0x02e55): (72, "WasmCapiFunctionDataMap"),
-  ("read_only_space", 0x02e7d): (73, "WasmExportedFunctionDataMap"),
-  ("read_only_space", 0x02ea5): (74, "WasmJSFunctionDataMap"),
-  ("read_only_space", 0x02ecd): (191, "WasmApiFunctionRefMap"),
-  ("read_only_space", 0x02ef5): (75, "WasmTypeInfoMap"),
-  ("read_only_space", 0x02f1d): (192, "WeakArrayListMap"),
-  ("read_only_space", 0x02f45): (122, "EphemeronHashTableMap"),
-  ("read_only_space", 0x02f6d): (172, "EmbedderDataArrayMap"),
-  ("read_only_space", 0x02f95): (193, "WeakCellMap"),
+  ("read_only_space", 0x02711): (238, "FeedbackVectorMap"),
+  ("read_only_space", 0x02749): (131, "ArgumentsMarkerMap"),
+  ("read_only_space", 0x027a9): (131, "ExceptionMap"),
+  ("read_only_space", 0x02805): (131, "TerminationExceptionMap"),
+  ("read_only_space", 0x0286d): (131, "OptimizedOutMap"),
+  ("read_only_space", 0x028cd): (131, "StaleRegisterMap"),
+  ("read_only_space", 0x0292d): (188, "ScriptContextTableMap"),
+  ("read_only_space", 0x02955): (186, "ClosureFeedbackCellArrayMap"),
+  ("read_only_space", 0x0297d): (237, "FeedbackMetadataArrayMap"),
+  ("read_only_space", 0x029a5): (176, "ArrayListMap"),
+  ("read_only_space", 0x029cd): (129, "BigIntMap"),
+  ("read_only_space", 0x029f5): (187, "ObjectBoilerplateDescriptionMap"),
+  ("read_only_space", 0x02a1d): (190, "BytecodeArrayMap"),
+  ("read_only_space", 0x02a45): (234, "CodeDataContainerMap"),
+  ("read_only_space", 0x02a6d): (235, "CoverageInfoMap"),
+  ("read_only_space", 0x02a95): (191, "FixedDoubleArrayMap"),
+  ("read_only_space", 0x02abd): (179, "GlobalDictionaryMap"),
+  ("read_only_space", 0x02ae5): (157, "ManyClosuresCellMap"),
+  ("read_only_space", 0x02b0d): (244, "MegaDomHandlerMap"),
+  ("read_only_space", 0x02b35): (176, "ModuleInfoMap"),
+  ("read_only_space", 0x02b5d): (180, "NameDictionaryMap"),
+  ("read_only_space", 0x02b85): (157, "NoClosuresCellMap"),
+  ("read_only_space", 0x02bad): (181, "NumberDictionaryMap"),
+  ("read_only_space", 0x02bd5): (157, "OneClosureCellMap"),
+  ("read_only_space", 0x02bfd): (182, "OrderedHashMapMap"),
+  ("read_only_space", 0x02c25): (183, "OrderedHashSetMap"),
+  ("read_only_space", 0x02c4d): (184, "OrderedNameDictionaryMap"),
+  ("read_only_space", 0x02c75): (246, "PreparseDataMap"),
+  ("read_only_space", 0x02c9d): (247, "PropertyArrayMap"),
+  ("read_only_space", 0x02cc5): (153, "SideEffectCallHandlerInfoMap"),
+  ("read_only_space", 0x02ced): (153, "SideEffectFreeCallHandlerInfoMap"),
+  ("read_only_space", 0x02d15): (153, "NextCallSideEffectFreeCallHandlerInfoMap"),
+  ("read_only_space", 0x02d3d): (185, "SimpleNumberDictionaryMap"),
+  ("read_only_space", 0x02d65): (218, "SmallOrderedHashMapMap"),
+  ("read_only_space", 0x02d8d): (219, "SmallOrderedHashSetMap"),
+  ("read_only_space", 0x02db5): (220, "SmallOrderedNameDictionaryMap"),
+  ("read_only_space", 0x02ddd): (225, "SourceTextModuleMap"),
+  ("read_only_space", 0x02e05): (254, "SwissNameDictionaryMap"),
+  ("read_only_space", 0x02e2d): (226, "SyntheticModuleMap"),
+  ("read_only_space", 0x02e55): (206, "WasmCapiFunctionDataMap"),
+  ("read_only_space", 0x02e7d): (207, "WasmExportedFunctionDataMap"),
+  ("read_only_space", 0x02ea5): (208, "WasmJSFunctionDataMap"),
+  ("read_only_space", 0x02ecd): (255, "WasmApiFunctionRefMap"),
+  ("read_only_space", 0x02ef5): (209, "WasmTypeInfoMap"),
+  ("read_only_space", 0x02f1d): (256, "WeakArrayListMap"),
+  ("read_only_space", 0x02f45): (178, "EphemeronHashTableMap"),
+  ("read_only_space", 0x02f6d): (236, "EmbedderDataArrayMap"),
+  ("read_only_space", 0x02f95): (257, "WeakCellMap"),
   ("read_only_space", 0x02fbd): (32, "StringMap"),
   ("read_only_space", 0x02fe5): (41, "ConsOneByteStringMap"),
   ("read_only_space", 0x0300d): (33, "ConsStringMap"),
@@ -347,77 +349,79 @@ KNOWN_MAPS = {
   ("read_only_space", 0x0319d): (18, "UncachedExternalInternalizedStringMap"),
   ("read_only_space", 0x031c5): (26, "UncachedExternalOneByteInternalizedStringMap"),
   ("read_only_space", 0x031ed): (58, "UncachedExternalOneByteStringMap"),
-  ("read_only_space", 0x03215): (67, "SelfReferenceMarkerMap"),
-  ("read_only_space", 0x0323d): (67, "BasicBlockCountersMarkerMap"),
-  ("read_only_space", 0x03281): (91, "ArrayBoilerplateDescriptionMap"),
-  ("read_only_space", 0x03381): (103, "InterceptorInfoMap"),
-  ("read_only_space", 0x05c15): (76, "PromiseFulfillReactionJobTaskMap"),
-  ("read_only_space", 0x05c3d): (77, "PromiseRejectReactionJobTaskMap"),
-  ("read_only_space", 0x05c65): (78, "CallableTaskMap"),
-  ("read_only_space", 0x05c8d): (79, "CallbackTaskMap"),
-  ("read_only_space", 0x05cb5): (80, "PromiseResolveThenableJobTaskMap"),
-  ("read_only_space", 0x05cdd): (83, "FunctionTemplateInfoMap"),
-  ("read_only_space", 0x05d05): (84, "ObjectTemplateInfoMap"),
-  ("read_only_space", 0x05d2d): (85, "AccessCheckInfoMap"),
-  ("read_only_space", 0x05d55): (86, "AccessorInfoMap"),
-  ("read_only_space", 0x05d7d): (87, "AccessorPairMap"),
-  ("read_only_space", 0x05da5): (88, "AliasedArgumentsEntryMap"),
-  ("read_only_space", 0x05dcd): (89, "AllocationMementoMap"),
-  ("read_only_space", 0x05df5): (92, "AsmWasmDataMap"),
-  ("read_only_space", 0x05e1d): (93, "AsyncGeneratorRequestMap"),
-  ("read_only_space", 0x05e45): (94, "BreakPointMap"),
-  ("read_only_space", 0x05e6d): (95, "BreakPointInfoMap"),
-  ("read_only_space", 0x05e95): (96, "CachedTemplateObjectMap"),
-  ("read_only_space", 0x05ebd): (98, "ClassPositionsMap"),
-  ("read_only_space", 0x05ee5): (99, "DebugInfoMap"),
-  ("read_only_space", 0x05f0d): (102, "FunctionTemplateRareDataMap"),
-  ("read_only_space", 0x05f35): (104, "InterpreterDataMap"),
-  ("read_only_space", 0x05f5d): (105, "ModuleRequestMap"),
-  ("read_only_space", 0x05f85): (106, "PromiseCapabilityMap"),
-  ("read_only_space", 0x05fad): (107, "PromiseReactionMap"),
-  ("read_only_space", 0x05fd5): (108, "PropertyDescriptorObjectMap"),
-  ("read_only_space", 0x05ffd): (109, "PrototypeInfoMap"),
-  ("read_only_space", 0x06025): (110, "RegExpBoilerplateDescriptionMap"),
-  ("read_only_space", 0x0604d): (111, "ScriptMap"),
-  ("read_only_space", 0x06075): (112, "ScriptOrModuleMap"),
-  ("read_only_space", 0x0609d): (113, "SourceTextModuleInfoEntryMap"),
-  ("read_only_space", 0x060c5): (114, "StackFrameInfoMap"),
-  ("read_only_space", 0x060ed): (115, "TemplateObjectDescriptionMap"),
-  ("read_only_space", 0x06115): (116, "Tuple2Map"),
-  ("read_only_space", 0x0613d): (117, "WasmContinuationObjectMap"),
-  ("read_only_space", 0x06165): (118, "WasmExceptionTagMap"),
-  ("read_only_space", 0x0618d): (119, "WasmIndirectFunctionTableMap"),
-  ("read_only_space", 0x061b5): (137, "SloppyArgumentsElementsMap"),
-  ("read_only_space", 0x061dd): (159, "DescriptorArrayMap"),
-  ("read_only_space", 0x06205): (164, "UncompiledDataWithoutPreparseDataMap"),
-  ("read_only_space", 0x0622d): (163, "UncompiledDataWithPreparseDataMap"),
-  ("read_only_space", 0x06255): (181, "OnHeapBasicBlockProfilerDataMap"),
-  ("read_only_space", 0x0627d): (148, "TurbofanBitsetTypeMap"),
-  ("read_only_space", 0x062a5): (152, "TurbofanUnionTypeMap"),
-  ("read_only_space", 0x062cd): (151, "TurbofanRangeTypeMap"),
-  ("read_only_space", 0x062f5): (149, "TurbofanHeapConstantTypeMap"),
-  ("read_only_space", 0x0631d): (150, "TurbofanOtherNumberConstantTypeMap"),
-  ("read_only_space", 0x06345): (177, "InternalClassMap"),
-  ("read_only_space", 0x0636d): (188, "SmiPairMap"),
-  ("read_only_space", 0x06395): (187, "SmiBoxMap"),
-  ("read_only_space", 0x063bd): (153, "ExportedSubClassBaseMap"),
-  ("read_only_space", 0x063e5): (154, "ExportedSubClassMap"),
-  ("read_only_space", 0x0640d): (68, "AbstractInternalClassSubclass1Map"),
-  ("read_only_space", 0x06435): (69, "AbstractInternalClassSubclass2Map"),
-  ("read_only_space", 0x0645d): (136, "InternalClassWithSmiElementsMap"),
-  ("read_only_space", 0x06485): (178, "InternalClassWithStructElementsMap"),
-  ("read_only_space", 0x064ad): (155, "ExportedSubClass2Map"),
-  ("read_only_space", 0x064d5): (189, "SortStateMap"),
-  ("read_only_space", 0x064fd): (167, "CallRefDataMap"),
-  ("read_only_space", 0x06525): (90, "AllocationSiteWithWeakNextMap"),
-  ("read_only_space", 0x0654d): (90, "AllocationSiteWithoutWeakNextMap"),
-  ("read_only_space", 0x06575): (81, "LoadHandler1Map"),
-  ("read_only_space", 0x0659d): (81, "LoadHandler2Map"),
-  ("read_only_space", 0x065c5): (81, "LoadHandler3Map"),
-  ("read_only_space", 0x065ed): (82, "StoreHandler0Map"),
-  ("read_only_space", 0x06615): (82, "StoreHandler1Map"),
-  ("read_only_space", 0x0663d): (82, "StoreHandler2Map"),
-  ("read_only_space", 0x06665): (82, "StoreHandler3Map"),
+  ("read_only_space", 0x03215): (104, "SharedOneByteStringMap"),
+  ("read_only_space", 0x0323d): (96, "SharedStringMap"),
+  ("read_only_space", 0x03265): (131, "SelfReferenceMarkerMap"),
+  ("read_only_space", 0x0328d): (131, "BasicBlockCountersMarkerMap"),
+  ("read_only_space", 0x032d1): (147, "ArrayBoilerplateDescriptionMap"),
+  ("read_only_space", 0x033d1): (159, "InterceptorInfoMap"),
+  ("read_only_space", 0x05c65): (132, "PromiseFulfillReactionJobTaskMap"),
+  ("read_only_space", 0x05c8d): (133, "PromiseRejectReactionJobTaskMap"),
+  ("read_only_space", 0x05cb5): (134, "CallableTaskMap"),
+  ("read_only_space", 0x05cdd): (135, "CallbackTaskMap"),
+  ("read_only_space", 0x05d05): (136, "PromiseResolveThenableJobTaskMap"),
+  ("read_only_space", 0x05d2d): (139, "FunctionTemplateInfoMap"),
+  ("read_only_space", 0x05d55): (140, "ObjectTemplateInfoMap"),
+  ("read_only_space", 0x05d7d): (141, "AccessCheckInfoMap"),
+  ("read_only_space", 0x05da5): (142, "AccessorInfoMap"),
+  ("read_only_space", 0x05dcd): (143, "AccessorPairMap"),
+  ("read_only_space", 0x05df5): (144, "AliasedArgumentsEntryMap"),
+  ("read_only_space", 0x05e1d): (145, "AllocationMementoMap"),
+  ("read_only_space", 0x05e45): (148, "AsmWasmDataMap"),
+  ("read_only_space", 0x05e6d): (149, "AsyncGeneratorRequestMap"),
+  ("read_only_space", 0x05e95): (150, "BreakPointMap"),
+  ("read_only_space", 0x05ebd): (151, "BreakPointInfoMap"),
+  ("read_only_space", 0x05ee5): (152, "CachedTemplateObjectMap"),
+  ("read_only_space", 0x05f0d): (154, "ClassPositionsMap"),
+  ("read_only_space", 0x05f35): (155, "DebugInfoMap"),
+  ("read_only_space", 0x05f5d): (158, "FunctionTemplateRareDataMap"),
+  ("read_only_space", 0x05f85): (160, "InterpreterDataMap"),
+  ("read_only_space", 0x05fad): (161, "ModuleRequestMap"),
+  ("read_only_space", 0x05fd5): (162, "PromiseCapabilityMap"),
+  ("read_only_space", 0x05ffd): (163, "PromiseReactionMap"),
+  ("read_only_space", 0x06025): (164, "PropertyDescriptorObjectMap"),
+  ("read_only_space", 0x0604d): (165, "PrototypeInfoMap"),
+  ("read_only_space", 0x06075): (166, "RegExpBoilerplateDescriptionMap"),
+  ("read_only_space", 0x0609d): (167, "ScriptMap"),
+  ("read_only_space", 0x060c5): (168, "ScriptOrModuleMap"),
+  ("read_only_space", 0x060ed): (169, "SourceTextModuleInfoEntryMap"),
+  ("read_only_space", 0x06115): (170, "StackFrameInfoMap"),
+  ("read_only_space", 0x0613d): (171, "TemplateObjectDescriptionMap"),
+  ("read_only_space", 0x06165): (172, "Tuple2Map"),
+  ("read_only_space", 0x0618d): (173, "WasmContinuationObjectMap"),
+  ("read_only_space", 0x061b5): (174, "WasmExceptionTagMap"),
+  ("read_only_space", 0x061dd): (175, "WasmIndirectFunctionTableMap"),
+  ("read_only_space", 0x06205): (193, "SloppyArgumentsElementsMap"),
+  ("read_only_space", 0x0622d): (223, "DescriptorArrayMap"),
+  ("read_only_space", 0x06255): (228, "UncompiledDataWithoutPreparseDataMap"),
+  ("read_only_space", 0x0627d): (227, "UncompiledDataWithPreparseDataMap"),
+  ("read_only_space", 0x062a5): (245, "OnHeapBasicBlockProfilerDataMap"),
+  ("read_only_space", 0x062cd): (210, "TurbofanBitsetTypeMap"),
+  ("read_only_space", 0x062f5): (214, "TurbofanUnionTypeMap"),
+  ("read_only_space", 0x0631d): (213, "TurbofanRangeTypeMap"),
+  ("read_only_space", 0x06345): (211, "TurbofanHeapConstantTypeMap"),
+  ("read_only_space", 0x0636d): (212, "TurbofanOtherNumberConstantTypeMap"),
+  ("read_only_space", 0x06395): (241, "InternalClassMap"),
+  ("read_only_space", 0x063bd): (252, "SmiPairMap"),
+  ("read_only_space", 0x063e5): (251, "SmiBoxMap"),
+  ("read_only_space", 0x0640d): (215, "ExportedSubClassBaseMap"),
+  ("read_only_space", 0x06435): (216, "ExportedSubClassMap"),
+  ("read_only_space", 0x0645d): (221, "AbstractInternalClassSubclass1Map"),
+  ("read_only_space", 0x06485): (222, "AbstractInternalClassSubclass2Map"),
+  ("read_only_space", 0x064ad): (192, "InternalClassWithSmiElementsMap"),
+  ("read_only_space", 0x064d5): (242, "InternalClassWithStructElementsMap"),
+  ("read_only_space", 0x064fd): (217, "ExportedSubClass2Map"),
+  ("read_only_space", 0x06525): (253, "SortStateMap"),
+  ("read_only_space", 0x0654d): (231, "CallRefDataMap"),
+  ("read_only_space", 0x06575): (146, "AllocationSiteWithWeakNextMap"),
+  ("read_only_space", 0x0659d): (146, "AllocationSiteWithoutWeakNextMap"),
+  ("read_only_space", 0x065c5): (137, "LoadHandler1Map"),
+  ("read_only_space", 0x065ed): (137, "LoadHandler2Map"),
+  ("read_only_space", 0x06615): (137, "LoadHandler3Map"),
+  ("read_only_space", 0x0663d): (138, "StoreHandler0Map"),
+  ("read_only_space", 0x06665): (138, "StoreHandler1Map"),
+  ("read_only_space", 0x0668d): (138, "StoreHandler2Map"),
+  ("read_only_space", 0x066b5): (138, "StoreHandler3Map"),
   ("map_space", 0x02119): (1057, "ExternalMap"),
   ("map_space", 0x02141): (2114, "JSMessageObjectMap"),
 }
@@ -443,32 +447,32 @@ KNOWN_OBJECTS = {
   ("read_only_space", 0x0282d): "TerminationException",
   ("read_only_space", 0x02895): "OptimizedOut",
   ("read_only_space", 0x028f5): "StaleRegister",
-  ("read_only_space", 0x03265): "EmptyPropertyArray",
-  ("read_only_space", 0x0326d): "EmptyByteArray",
-  ("read_only_space", 0x03275): "EmptyObjectBoilerplateDescription",
-  ("read_only_space", 0x032a9): "EmptyArrayBoilerplateDescription",
-  ("read_only_space", 0x032b5): "EmptyClosureFeedbackCellArray",
-  ("read_only_space", 0x032bd): "EmptySlowElementDictionary",
-  ("read_only_space", 0x032e1): "EmptyOrderedHashMap",
-  ("read_only_space", 0x032f5): "EmptyOrderedHashSet",
-  ("read_only_space", 0x03309): "EmptyFeedbackMetadata",
-  ("read_only_space", 0x03315): "EmptyPropertyDictionary",
-  ("read_only_space", 0x0333d): "EmptyOrderedPropertyDictionary",
-  ("read_only_space", 0x03355): "EmptySwissPropertyDictionary",
-  ("read_only_space", 0x033a9): "NoOpInterceptorInfo",
-  ("read_only_space", 0x033d1): "EmptyWeakArrayList",
-  ("read_only_space", 0x033dd): "InfinityValue",
-  ("read_only_space", 0x033e9): "MinusZeroValue",
-  ("read_only_space", 0x033f5): "MinusInfinityValue",
-  ("read_only_space", 0x03401): "SelfReferenceMarker",
-  ("read_only_space", 0x03441): "BasicBlockCountersMarker",
-  ("read_only_space", 0x03485): "OffHeapTrampolineRelocationInfo",
-  ("read_only_space", 0x03491): "TrampolineTrivialCodeDataContainer",
-  ("read_only_space", 0x0349d): "TrampolinePromiseRejectionCodeDataContainer",
-  ("read_only_space", 0x034a9): "GlobalThisBindingScopeInfo",
-  ("read_only_space", 0x034d9): "EmptyFunctionScopeInfo",
-  ("read_only_space", 0x034fd): "NativeScopeInfo",
-  ("read_only_space", 0x03515): "HashSeed",
+  ("read_only_space", 0x032b5): "EmptyPropertyArray",
+  ("read_only_space", 0x032bd): "EmptyByteArray",
+  ("read_only_space", 0x032c5): "EmptyObjectBoilerplateDescription",
+  ("read_only_space", 0x032f9): "EmptyArrayBoilerplateDescription",
+  ("read_only_space", 0x03305): "EmptyClosureFeedbackCellArray",
+  ("read_only_space", 0x0330d): "EmptySlowElementDictionary",
+  ("read_only_space", 0x03331): "EmptyOrderedHashMap",
+  ("read_only_space", 0x03345): "EmptyOrderedHashSet",
+  ("read_only_space", 0x03359): "EmptyFeedbackMetadata",
+  ("read_only_space", 0x03365): "EmptyPropertyDictionary",
+  ("read_only_space", 0x0338d): "EmptyOrderedPropertyDictionary",
+  ("read_only_space", 0x033a5): "EmptySwissPropertyDictionary",
+  ("read_only_space", 0x033f9): "NoOpInterceptorInfo",
+  ("read_only_space", 0x03421): "EmptyWeakArrayList",
+  ("read_only_space", 0x0342d): "InfinityValue",
+  ("read_only_space", 0x03439): "MinusZeroValue",
+  ("read_only_space", 0x03445): "MinusInfinityValue",
+  ("read_only_space", 0x03451): "SelfReferenceMarker",
+  ("read_only_space", 0x03491): "BasicBlockCountersMarker",
+  ("read_only_space", 0x034d5): "OffHeapTrampolineRelocationInfo",
+  ("read_only_space", 0x034e1): "TrampolineTrivialCodeDataContainer",
+  ("read_only_space", 0x034ed): "TrampolinePromiseRejectionCodeDataContainer",
+  ("read_only_space", 0x034f9): "GlobalThisBindingScopeInfo",
+  ("read_only_space", 0x03529): "EmptyFunctionScopeInfo",
+  ("read_only_space", 0x0354d): "NativeScopeInfo",
+  ("read_only_space", 0x03565): "HashSeed",
   ("old_space", 0x04211): "ArgumentsIteratorAccessor",
   ("old_space", 0x04255): "ArrayLengthAccessor",
   ("old_space", 0x04299): "BoundFunctionLengthAccessor",