Store JSMessageObject on rejected promises

When V8 throws an uncaught exception, we store a JSMessageObject
with a stack trace and source positions on the isolate itself.
The JSMessageObject can be retrieved by a TryCatch scope
and is used by the inspector to provide additional information to the DevTools
frontend (besides the exception).

Introducing top-level await for REPL mode causes all thrown exceptions
to be turned into a rejected promise. The implicit catch block that does this
conversion clears the JSMessageObject from the isolate as to not leak memory.

This CL preserves the JSMessageObject when the debugger is active and stores
the JSMessageObject on the rejected promise itself. The inspector is changed
to retrieve the JSMessageObject in the existing catch handler and pass the
information along to the frontend.

Drive-by: This CL removes a inspector test that made assumptions when a promise
is cleaned up by the GC. These assumptions no longer hold since we hold on to
the promise longer.

Bug: chromium:1021921
Change-Id: Id0380e2cf3bd79aca05191bc4f3c616f6ced8db7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1967375
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65497}

src/api/api.cc

@@ -10259,6 +10259,19 @@ bool debug::AccessorPair::IsAccessorPair(Local<Value> that) {
   return obj->IsAccessorPair();
 }
 
+MaybeLocal<Message> debug::GetMessageFromPromise(Local<Promise> p) {
+  i::Handle<i::JSPromise> promise = Utils::OpenHandle(*p);
+  i::Isolate* isolate = promise->GetIsolate();
+
+  i::Handle<i::Symbol> key = isolate->factory()->promise_debug_message_symbol();
+  i::Handle<i::Object> maybeMessage =
+      i::JSReceiver::GetDataProperty(promise, key);
+
+  if (!maybeMessage->IsJSMessageObject(isolate)) return MaybeLocal<Message>();
+  return ToApiHandle<Message>(
+      i::Handle<i::JSMessageObject>::cast(maybeMessage));
+}
+
 const char* CpuProfileNode::GetFunctionNameStr() const {
   const i::ProfileNode* node = reinterpret_cast<const i::ProfileNode*>(this);
   return node->entry()->name();

src/ast/ast.h

@@ -913,8 +913,17 @@ class TryCatchStatement final : public TryStatement {
   // (When the catch block doesn't rethrow but is guaranteed to perform an
   // ordinary throw, not clearing the old message is safe but not very
   // useful.)
+  //
+  // For scripts in repl mode there is exactly one catch block with
+  // UNCAUGHT_ASYNC_AWAIT prediction. This catch block needs to preserve
+  // the exception so it can be re-used later by the inspector.
   inline bool ShouldClearPendingException(
       HandlerTable::CatchPrediction outer_catch_prediction) const {
+    if (catch_prediction_ == HandlerTable::UNCAUGHT_ASYNC_AWAIT) {
+      DCHECK_EQ(outer_catch_prediction, HandlerTable::UNCAUGHT);
+      return false;
+    }
+
     return catch_prediction_ != HandlerTable::UNCAUGHT ||
            outer_catch_prediction != HandlerTable::UNCAUGHT;
   }
@@ -2938,6 +2947,14 @@ class AstNodeFactory final {
                                          HandlerTable::ASYNC_AWAIT, pos);
   }
 
+  TryCatchStatement* NewTryCatchStatementForReplAsyncAwait(Block* try_block,
+                                                           Scope* scope,
+                                                           Block* catch_block,
+                                                           int pos) {
+    return new (zone_) TryCatchStatement(
+        try_block, scope, catch_block, HandlerTable::UNCAUGHT_ASYNC_AWAIT, pos);
+  }
+
   TryFinallyStatement* NewTryFinallyStatement(Block* try_block,
                                               Block* finally_block, int pos) {
     return new (zone_) TryFinallyStatement(try_block, finally_block, pos);

src/ast/prettyprinter.cc

@@ -1049,6 +1049,9 @@ void AstPrinter::VisitTryCatchStatement(TryCatchStatement* node) {
     case HandlerTable::ASYNC_AWAIT:
       prediction = "ASYNC_AWAIT";
       break;
+    case HandlerTable::UNCAUGHT_ASYNC_AWAIT:
+      prediction = "UNCAUGHT_ASYNC_AWAIT";
+      break;
     case HandlerTable::PROMISE:
       // Catch prediction resulting in promise rejections aren't
       // parsed by the parser.

src/codegen/handler-table.h

@@ -43,6 +43,10 @@ class V8_EXPORT_PRIVATE HandlerTable {
     ASYNC_AWAIT,  // The exception will be caught and cause a promise rejection
                   // in the desugaring of an async function, so special
                   // async/await handling in the debugger can take place.
+    UNCAUGHT_ASYNC_AWAIT,  // The exception will be caught and cause a promise
+                           // rejection in the desugaring of an async REPL
+                           // script. The corresponding message object needs to
+                           // be kept alive on the Isolate though.
   };
 
   enum EncodingMode { kRangeBasedEncoding, kReturnAddressBasedEncoding };

src/debug/debug-interface.h

@@ -580,6 +580,8 @@ AccessorPair* AccessorPair::Cast(v8::Value* value) {
   return static_cast<AccessorPair*>(value);
 }
 
+MaybeLocal<Message> GetMessageFromPromise(Local<Promise> promise);
+
 }  // namespace debug
 }  // namespace v8
 

src/execution/isolate.cc

@@ -1846,6 +1846,7 @@ Isolate::CatchType ToCatchType(HandlerTable::CatchPrediction prediction) {
       return Isolate::CAUGHT_BY_PROMISE;
     case HandlerTable::DESUGARING:
       return Isolate::CAUGHT_BY_DESUGARING;
+    case HandlerTable::UNCAUGHT_ASYNC_AWAIT:
     case HandlerTable::ASYNC_AWAIT:
       return Isolate::CAUGHT_BY_ASYNC_AWAIT;
     default:
@@ -2512,6 +2513,7 @@ Handle<Object> Isolate::GetPromiseOnStackOnThrow() {
         return promise_on_stack
                    ? Handle<Object>::cast(promise_on_stack->promise())
                    : undefined;
+      case HandlerTable::UNCAUGHT_ASYNC_AWAIT:
       case HandlerTable::ASYNC_AWAIT: {
         // If in the initial portion of async/await, continue the loop to pop up
         // successive async/await stack frames until an asynchronous one with

src/init/heap-symbols.h

@@ -346,6 +346,7 @@
   V(_, nonextensible_symbol)                          \
   V(_, not_mapped_symbol)                             \
   V(_, promise_debug_marker_symbol)                   \
+  V(_, promise_debug_message_symbol)                  \
   V(_, promise_forwarding_handler_symbol)             \
   V(_, promise_handled_by_symbol)                     \
   V(_, regexp_result_cached_indices_or_regexp_symbol) \

src/inspector/injected-script.cc

@@ -80,10 +80,13 @@ class InjectedScript::ProtocolPromiseHandler {
       return false;
     }
 
-    v8::Local<v8::Promise> promise = resolver->GetPromise();
+    v8::MaybeLocal<v8::Promise> originalPromise =
+        value->IsPromise() ? v8::Local<v8::Promise>::Cast(value)
+                           : v8::MaybeLocal<v8::Promise>();
     V8InspectorImpl* inspector = session->inspector();
     ProtocolPromiseHandler* handler = new ProtocolPromiseHandler(
-        session, executionContextId, objectGroup, wrapMode, replMode, callback);
+        session, executionContextId, objectGroup, wrapMode, replMode, callback,
+        originalPromise);
     v8::Local<v8::Value> wrapper = handler->m_wrapper.Get(inspector->isolate());
     v8::Local<v8::Function> thenCallbackFunction =
         v8::Function::New(context, thenCallback, wrapper, 0,
@@ -93,6 +96,7 @@ class InjectedScript::ProtocolPromiseHandler {
         v8::Function::New(context, catchCallback, wrapper, 0,
                           v8::ConstructorBehavior::kThrow)
             .ToLocalChecked();
+    v8::Local<v8::Promise> promise = resolver->GetPromise();
     if (promise->Then(context, thenCallbackFunction, catchCallbackFunction)
             .IsEmpty()) {
       callback->sendFailure(Response::InternalError());
@@ -136,7 +140,8 @@ class InjectedScript::ProtocolPromiseHandler {
   ProtocolPromiseHandler(V8InspectorSessionImpl* session,
                          int executionContextId, const String16& objectGroup,
                          WrapMode wrapMode, bool replMode,
-                         EvaluateCallback* callback)
+                         EvaluateCallback* callback,
+                         v8::MaybeLocal<v8::Promise> maybeEvaluationResult)
       : m_inspector(session->inspector()),
         m_sessionId(session->sessionId()),
         m_contextGroupId(session->contextGroupId()),
@@ -148,12 +153,18 @@ class InjectedScript::ProtocolPromiseHandler {
         m_wrapper(m_inspector->isolate(),
                   v8::External::New(m_inspector->isolate(), this)) {
     m_wrapper.SetWeak(this, cleanup, v8::WeakCallbackType::kParameter);
+    v8::Local<v8::Promise> promise;
+    if (maybeEvaluationResult.ToLocal(&promise)) {
+      m_evaluationResult =
+          v8::Global<v8::Promise>(m_inspector->isolate(), promise);
+    }
   }
 
   static void cleanup(
       const v8::WeakCallbackInfo<ProtocolPromiseHandler>& data) {
     if (!data.GetParameter()->m_wrapper.IsEmpty()) {
       data.GetParameter()->m_wrapper.Reset();
+      data.GetParameter()->m_evaluationResult.Reset();
       data.SetSecondPassCallback(cleanup);
     } else {
       data.GetParameter()->sendPromiseCollected();
@@ -223,14 +234,40 @@ class InjectedScript::ProtocolPromiseHandler {
       callback->sendFailure(response);
       return;
     }
-    String16 message;
-    std::unique_ptr<V8StackTraceImpl> stack;
     v8::Isolate* isolate = session->inspector()->isolate();
+
+    v8::MaybeLocal<v8::Message> maybeMessage =
+        m_evaluationResult.IsEmpty()
+            ? v8::MaybeLocal<v8::Message>()
+            : v8::debug::GetMessageFromPromise(m_evaluationResult.Get(isolate));
+    v8::Local<v8::Message> message;
+    // In case a MessageObject was attached to the rejected promise, we
+    // construct the exception details from the message object. Otherwise
+    // we try to capture a fresh stack trace.
+    if (maybeMessage.ToLocal(&message)) {
+      v8::Local<v8::Value> exception = result;
+      protocol::detail::PtrMaybe<protocol::Runtime::ExceptionDetails>
+          exceptionDetails;
+      response = scope.injectedScript()->createExceptionDetails(
+          message, exception, m_objectGroup, &exceptionDetails);
+      if (!response.isSuccess()) {
+        callback->sendFailure(response);
+        return;
+      }
+
+      callback->sendSuccess(std::move(wrappedValue),
+                            std::move(exceptionDetails));
+      return;
+    }
+
+    String16 messageString;
+    std::unique_ptr<V8StackTraceImpl> stack;
     if (result->IsNativeError()) {
-      message = " " + toProtocolString(
-                          isolate,
-                          result->ToDetailString(isolate->GetCurrentContext())
-                              .ToLocalChecked());
+      messageString =
+          " " +
+          toProtocolString(isolate,
+                           result->ToDetailString(isolate->GetCurrentContext())
+                               .ToLocalChecked());
       v8::Local<v8::StackTrace> stackTrace = v8::debug::GetDetailedStackTrace(
           isolate, v8::Local<v8::Object>::Cast(result));
       if (!stackTrace.IsEmpty()) {
@@ -247,7 +284,7 @@ class InjectedScript::ProtocolPromiseHandler {
     // exception and does not need to be added in REPL mode, otherwise it would
     // be printed twice.
     String16 exceptionDetailsText =
-        m_replMode ? "Uncaught" : "Uncaught (in promise)" + message;
+        m_replMode ? "Uncaught" : "Uncaught (in promise)" + messageString;
     std::unique_ptr<protocol::Runtime::ExceptionDetails> exceptionDetails =
         protocol::Runtime::ExceptionDetails::create()
             .setExceptionId(m_inspector->nextExceptionId())
@@ -293,6 +330,7 @@ class InjectedScript::ProtocolPromiseHandler {
   bool m_replMode;
   EvaluateCallback* m_callback;
   v8::Global<v8::External> m_wrapper;
+  v8::Global<v8::Promise> m_evaluationResult;
 };
 
 InjectedScript::InjectedScript(InspectedContext* context, int sessionId)
@@ -733,6 +771,13 @@ Response InjectedScript::createExceptionDetails(
   if (!tryCatch.HasCaught()) return Response::InternalError();
   v8::Local<v8::Message> message = tryCatch.Message();
   v8::Local<v8::Value> exception = tryCatch.Exception();
+  return createExceptionDetails(message, exception, objectGroup, result);
+}
+
+Response InjectedScript::createExceptionDetails(
+    v8::Local<v8::Message> message, v8::Local<v8::Value> exception,
+    const String16& objectGroup,
+    Maybe<protocol::Runtime::ExceptionDetails>* result) {
   String16 messageText =
       message.IsEmpty()
           ? String16()

src/inspector/injected-script.h

@@ -121,6 +121,11 @@ class InjectedScript final {
   Response createExceptionDetails(
       const v8::TryCatch&, const String16& groupName,
       Maybe<protocol::Runtime::ExceptionDetails>* result);
+  Response createExceptionDetails(
+      v8::Local<v8::Message> message, v8::Local<v8::Value> exception,
+      const String16& groupName,
+      Maybe<protocol::Runtime::ExceptionDetails>* result);
+
   Response wrapEvaluateResult(
       v8::MaybeLocal<v8::Value> maybeResultValue, const v8::TryCatch&,
       const String16& objectGroup, WrapMode wrapMode,

src/objects/objects.cc

@@ -5805,11 +5805,30 @@ Handle<Object> JSPromise::Fulfill(Handle<JSPromise> promise,
                                  PromiseReaction::kFulfill);
 }
 
+static void MoveMessageToPromise(Isolate* isolate, Handle<JSPromise> promise) {
+  if (isolate->thread_local_top()->pending_message_obj_.IsTheHole(isolate)) {
+    return;
+  }
+
+  Handle<Object> message =
+      handle(isolate->thread_local_top()->pending_message_obj_, isolate);
+  Handle<Symbol> key = isolate->factory()->promise_debug_message_symbol();
+  Object::SetProperty(isolate, promise, key, message, StoreOrigin::kMaybeKeyed,
+                      Just(ShouldThrow::kThrowOnError))
+      .Assert();
+
+  // The message object for a rejected promise was only stored for this purpose.
+  // Clear it, otherwise we might leak memory.
+  isolate->clear_pending_message();
+}
+
 // static
 Handle<Object> JSPromise::Reject(Handle<JSPromise> promise,
                                  Handle<Object> reason, bool debug_event) {
   Isolate* const isolate = promise->GetIsolate();
 
+  if (isolate->debug()->is_active()) MoveMessageToPromise(isolate, promise);
+
   if (debug_event) isolate->debug()->OnPromiseReject(promise, reason);
   isolate->RunPromiseHook(PromiseHookType::kResolve, promise,
                           isolate->factory()->undefined_value());

src/parsing/parser.cc

@@ -742,7 +742,8 @@ void Parser::ParseREPLProgram(ParseInfo* info, ScopedPtrList<Statement>* body,
           ? static_cast<Expression*>(*maybe_result)
           : factory()->NewUndefinedLiteral(kNoSourcePosition);
 
-  impl()->RewriteAsyncFunctionBody(body, block, WrapREPLResult(result_value));
+  impl()->RewriteAsyncFunctionBody(body, block, WrapREPLResult(result_value),
+                                   REPLMode::kYes);
 }
 
 Expression* Parser::WrapREPLResult(Expression* value) {
@@ -2699,7 +2700,8 @@ Scope* Parser::NewHiddenCatchScope() {
   return catch_scope;
 }
 
-Block* Parser::BuildRejectPromiseOnException(Block* inner_block) {
+Block* Parser::BuildRejectPromiseOnException(Block* inner_block,
+                                             REPLMode repl_mode) {
   // try {
   //   <inner_block>
   // } catch (.catch) {
@@ -2726,9 +2728,16 @@ Block* Parser::BuildRejectPromiseOnException(Block* inner_block) {
   Block* catch_block = IgnoreCompletion(
       factory()->NewReturnStatement(reject_promise, kNoSourcePosition));
 
+  // Treat the exception for REPL mode scripts as UNCAUGHT. This will
+  // keep the corresponding JSMessageObject alive on the Isolate. The
+  // message object is used by the inspector to provide better error
+  // messages for REPL inputs that throw.
   TryStatement* try_catch_statement =
-      factory()->NewTryCatchStatementForAsyncAwait(
-          inner_block, catch_scope, catch_block, kNoSourcePosition);
+      repl_mode == REPLMode::kYes
+          ? factory()->NewTryCatchStatementForReplAsyncAwait(
+                inner_block, catch_scope, catch_block, kNoSourcePosition)
+          : factory()->NewTryCatchStatementForAsyncAwait(
+                inner_block, catch_scope, catch_block, kNoSourcePosition);
   result->statements()->Add(try_catch_statement, zone());
   return result;
 }
@@ -3327,7 +3336,8 @@ Expression* Parser::ExpressionListToExpression(
 
 // This method completes the desugaring of the body of async_function.
 void Parser::RewriteAsyncFunctionBody(ScopedPtrList<Statement>* body,
-                                      Block* block, Expression* return_value) {
+                                      Block* block, Expression* return_value,
+                                      REPLMode repl_mode) {
   // function async_function() {
   //   .generator_object = %_AsyncFunctionEnter();
   //   BuildRejectPromiseOnException({
@@ -3339,7 +3349,7 @@ void Parser::RewriteAsyncFunctionBody(ScopedPtrList<Statement>* body,
   block->statements()->Add(factory()->NewSyntheticAsyncReturnStatement(
                                return_value, return_value->position()),
                            zone());
-  block = BuildRejectPromiseOnException(block);
+  block = BuildRejectPromiseOnException(block, repl_mode);
   body->Add(block);
 }
 

src/parsing/parser.h

@@ -432,7 +432,8 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
 
   Block* BuildParameterInitializationBlock(
       const ParserFormalParameters& parameters);
-  Block* BuildRejectPromiseOnException(Block* block);
+  Block* BuildRejectPromiseOnException(Block* block,
+                                       REPLMode repl_mode = REPLMode::kNo);
 
   void ParseFunction(
       ScopedPtrList<Statement>* body, const AstRawString* function_name,
@@ -514,7 +515,8 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase<Parser>) {
   Statement* CheckCallable(Variable* var, Expression* error, int pos);
 
   void RewriteAsyncFunctionBody(ScopedPtrList<Statement>* body, Block* block,
-                                Expression* return_value);
+                                Expression* return_value,
+                                REPLMode repl_mode = REPLMode::kNo);
 
   void AddArrowFunctionFormalParameters(ParserFormalParameters* parameters,
                                         Expression* params, int end_pos);

test/inspector/runtime/await-promise-expected.txt

@@ -120,12 +120,3 @@ Running test: testResolvedWithoutArgsPromise
         }
     }
 }
-
-Running test: testGarbageCollectedPromise
-{
-    error : {
-        code : -32000
-        message : Promise was collected
-    }
-    id : <messageId>
-}

test/inspector/runtime/await-promise.js

@@ -117,28 +117,6 @@ function testSuite()
         .then(result => Protocol.Runtime.awaitPromise({ promiseObjectId: result.result.result.objectId, returnByValue: true, generatePreview: false }))
         .then(result => InspectorTest.logMessage(result))
         .then(() => next());
-    },
-
-    function testGarbageCollectedPromise(next)
-    {
-      Protocol.Runtime.evaluate({ expression: "new Promise(() => undefined)" })
-        .then(result => scheduleGCAndawaitPromise(result))
-        .then(result => InspectorTest.logMessage(result))
-        .then(() => next());
-
-      function scheduleGCAndawaitPromise(result)
-      {
-        var objectId = result.result.result.objectId;
-        var promise = Protocol.Runtime.awaitPromise({ promiseObjectId: objectId });
-        gcPromise(objectId);
-        return promise;
-      }
-
-      function gcPromise(objectId)
-      {
-        Protocol.Runtime.releaseObject({ objectId: objectId})
-          .then(() => Protocol.Runtime.evaluate({ expression: "gc()" }));
-      }
     }
   ]);
 }

test/inspector/runtime/evaluate-repl-await-expected.txt

+Tests that top-level await in Runtime.evaluate REPL mode includes stack trace.
+{
+    id : <messageId>
+    result : {
+        exceptionDetails : {
+            columnNumber : 0
+            exception : {
+                type : undefined
+            }
+            exceptionId : <exceptionId>
+            lineNumber : 0
+            scriptId : <scriptId>
+            stackTrace : {
+                callFrames : [
+                    [0] : {
+                        columnNumber : 0
+                        functionName : 
+                        lineNumber : 0
+                        scriptId : <scriptId>
+                        url : 
+                    }
+                ]
+            }
+            text : Uncaught
+        }
+        result : {
+            type : undefined
+        }
+    }
+}
+{
+    id : <messageId>
+    result : {
+        exceptionDetails : {
+            columnNumber : 6
+            exception : {
+                className : Error
+                description : Error: ba dum tsh     at bar (<anonymous>:3:13)     at foo (<anonymous>:7:7)     at <anonymous>:10:5
+                objectId : <objectId>
+                subtype : error
+                type : object
+            }
+            exceptionId : <exceptionId>
+            lineNumber : 2
+            scriptId : <scriptId>
+            stackTrace : {
+                callFrames : [
+                    [0] : {
+                        columnNumber : 12
+                        functionName : bar
+                        lineNumber : 2
+                        scriptId : <scriptId>
+                        url : 
+                    }
+                    [1] : {
+                        columnNumber : 6
+                        functionName : foo
+                        lineNumber : 6
+                        scriptId : <scriptId>
+                        url : 
+                    }
+                    [2] : {
+                        columnNumber : 4
+                        functionName : 
+                        lineNumber : 9
+                        scriptId : <scriptId>
+                        url : 
+                    }
+                ]
+            }
+            text : Uncaught
+        }
+        result : {
+            className : Error
+            description : Error: ba dum tsh     at bar (<anonymous>:3:13)     at foo (<anonymous>:7:7)     at <anonymous>:10:5
+            objectId : <objectId>
+            subtype : error
+            type : object
+        }
+    }
+}

test/inspector/runtime/evaluate-repl-await.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {Protocol} = InspectorTest.start(
+  "Tests that top-level await in Runtime.evaluate REPL mode includes stack trace.");
+
+Protocol.Debugger.enable();
+Protocol.Runtime.enable();
+
+(async function() {
+  evaluateRepl('throw undefined;');
+
+  evaluateRepl(`
+    function bar() {
+      throw new Error('ba dum tsh');
+    }
+
+    function foo() {
+      bar();
+    }
+
+    foo();
+  `);
+
+  InspectorTest.completeTest();
+})();
+
+async function evaluateRepl(expression) {
+  InspectorTest.logMessage(await Protocol.Runtime.evaluate({
+    expression: expression,
+    replMode: true,
+  }));
+}

tools/v8heapconst.py

@@ -280,53 +280,53 @@ KNOWN_MAPS = {
   ("read_only_space", 0x01151): (92, "EnumCacheMap"),
   ("read_only_space", 0x011a1): (86, "ArrayBoilerplateDescriptionMap"),
   ("read_only_space", 0x0129d): (95, "InterceptorInfoMap"),
-  ("read_only_space", 0x03289): (71, "PromiseFulfillReactionJobTaskMap"),
-  ("read_only_space", 0x032b1): (72, "PromiseRejectReactionJobTaskMap"),
-  ("read_only_space", 0x032d9): (73, "CallableTaskMap"),
-  ("read_only_space", 0x03301): (74, "CallbackTaskMap"),
-  ("read_only_space", 0x03329): (75, "PromiseResolveThenableJobTaskMap"),
-  ("read_only_space", 0x03351): (78, "FunctionTemplateInfoMap"),
-  ("read_only_space", 0x03379): (79, "ObjectTemplateInfoMap"),
-  ("read_only_space", 0x033a1): (80, "AccessCheckInfoMap"),
-  ("read_only_space", 0x033c9): (81, "AccessorInfoMap"),
-  ("read_only_space", 0x033f1): (82, "AccessorPairMap"),
-  ("read_only_space", 0x03419): (83, "AliasedArgumentsEntryMap"),
-  ("read_only_space", 0x03441): (84, "AllocationMementoMap"),
-  ("read_only_space", 0x03469): (87, "AsmWasmDataMap"),
-  ("read_only_space", 0x03491): (88, "AsyncGeneratorRequestMap"),
-  ("read_only_space", 0x034b9): (90, "ClassPositionsMap"),
-  ("read_only_space", 0x034e1): (91, "DebugInfoMap"),
-  ("read_only_space", 0x03509): (94, "FunctionTemplateRareDataMap"),
-  ("read_only_space", 0x03531): (97, "InterpreterDataMap"),
-  ("read_only_space", 0x03559): (98, "PromiseCapabilityMap"),
-  ("read_only_space", 0x03581): (99, "PromiseReactionMap"),
-  ("read_only_space", 0x035a9): (100, "PrototypeInfoMap"),
-  ("read_only_space", 0x035d1): (101, "ScriptMap"),
-  ("read_only_space", 0x035f9): (105, "SourceTextModuleInfoEntryMap"),
-  ("read_only_space", 0x03621): (106, "StackFrameInfoMap"),
-  ("read_only_space", 0x03649): (107, "StackTraceFrameMap"),
-  ("read_only_space", 0x03671): (108, "TemplateObjectDescriptionMap"),
-  ("read_only_space", 0x03699): (109, "Tuple2Map"),
-  ("read_only_space", 0x036c1): (110, "Tuple3Map"),
-  ("read_only_space", 0x036e9): (111, "WasmCapiFunctionDataMap"),
-  ("read_only_space", 0x03711): (112, "WasmDebugInfoMap"),
-  ("read_only_space", 0x03739): (113, "WasmExceptionTagMap"),
-  ("read_only_space", 0x03761): (114, "WasmExportedFunctionDataMap"),
-  ("read_only_space", 0x03789): (115, "WasmIndirectFunctionTableMap"),
-  ("read_only_space", 0x037b1): (116, "WasmJSFunctionDataMap"),
-  ("read_only_space", 0x037d9): (96, "InternalClassMap"),
-  ("read_only_space", 0x03801): (103, "SmiPairMap"),
-  ("read_only_space", 0x03829): (102, "SmiBoxMap"),
-  ("read_only_space", 0x03851): (104, "SortStateMap"),
-  ("read_only_space", 0x03879): (85, "AllocationSiteWithWeakNextMap"),
-  ("read_only_space", 0x038a1): (85, "AllocationSiteWithoutWeakNextMap"),
-  ("read_only_space", 0x038c9): (76, "LoadHandler1Map"),
-  ("read_only_space", 0x038f1): (76, "LoadHandler2Map"),
-  ("read_only_space", 0x03919): (76, "LoadHandler3Map"),
-  ("read_only_space", 0x03941): (77, "StoreHandler0Map"),
-  ("read_only_space", 0x03969): (77, "StoreHandler1Map"),
-  ("read_only_space", 0x03991): (77, "StoreHandler2Map"),
-  ("read_only_space", 0x039b9): (77, "StoreHandler3Map"),
+  ("read_only_space", 0x03299): (71, "PromiseFulfillReactionJobTaskMap"),
+  ("read_only_space", 0x032c1): (72, "PromiseRejectReactionJobTaskMap"),
+  ("read_only_space", 0x032e9): (73, "CallableTaskMap"),
+  ("read_only_space", 0x03311): (74, "CallbackTaskMap"),
+  ("read_only_space", 0x03339): (75, "PromiseResolveThenableJobTaskMap"),
+  ("read_only_space", 0x03361): (78, "FunctionTemplateInfoMap"),
+  ("read_only_space", 0x03389): (79, "ObjectTemplateInfoMap"),
+  ("read_only_space", 0x033b1): (80, "AccessCheckInfoMap"),
+  ("read_only_space", 0x033d9): (81, "AccessorInfoMap"),
+  ("read_only_space", 0x03401): (82, "AccessorPairMap"),
+  ("read_only_space", 0x03429): (83, "AliasedArgumentsEntryMap"),
+  ("read_only_space", 0x03451): (84, "AllocationMementoMap"),
+  ("read_only_space", 0x03479): (87, "AsmWasmDataMap"),
+  ("read_only_space", 0x034a1): (88, "AsyncGeneratorRequestMap"),
+  ("read_only_space", 0x034c9): (90, "ClassPositionsMap"),
+  ("read_only_space", 0x034f1): (91, "DebugInfoMap"),
+  ("read_only_space", 0x03519): (94, "FunctionTemplateRareDataMap"),
+  ("read_only_space", 0x03541): (97, "InterpreterDataMap"),
+  ("read_only_space", 0x03569): (98, "PromiseCapabilityMap"),
+  ("read_only_space", 0x03591): (99, "PromiseReactionMap"),
+  ("read_only_space", 0x035b9): (100, "PrototypeInfoMap"),
+  ("read_only_space", 0x035e1): (101, "ScriptMap"),
+  ("read_only_space", 0x03609): (105, "SourceTextModuleInfoEntryMap"),
+  ("read_only_space", 0x03631): (106, "StackFrameInfoMap"),
+  ("read_only_space", 0x03659): (107, "StackTraceFrameMap"),
+  ("read_only_space", 0x03681): (108, "TemplateObjectDescriptionMap"),
+  ("read_only_space", 0x036a9): (109, "Tuple2Map"),
+  ("read_only_space", 0x036d1): (110, "Tuple3Map"),
+  ("read_only_space", 0x036f9): (111, "WasmCapiFunctionDataMap"),
+  ("read_only_space", 0x03721): (112, "WasmDebugInfoMap"),
+  ("read_only_space", 0x03749): (113, "WasmExceptionTagMap"),
+  ("read_only_space", 0x03771): (114, "WasmExportedFunctionDataMap"),
+  ("read_only_space", 0x03799): (115, "WasmIndirectFunctionTableMap"),
+  ("read_only_space", 0x037c1): (116, "WasmJSFunctionDataMap"),
+  ("read_only_space", 0x037e9): (96, "InternalClassMap"),
+  ("read_only_space", 0x03811): (103, "SmiPairMap"),
+  ("read_only_space", 0x03839): (102, "SmiBoxMap"),
+  ("read_only_space", 0x03861): (104, "SortStateMap"),
+  ("read_only_space", 0x03889): (85, "AllocationSiteWithWeakNextMap"),
+  ("read_only_space", 0x038b1): (85, "AllocationSiteWithoutWeakNextMap"),
+  ("read_only_space", 0x038d9): (76, "LoadHandler1Map"),
+  ("read_only_space", 0x03901): (76, "LoadHandler2Map"),
+  ("read_only_space", 0x03929): (76, "LoadHandler3Map"),
+  ("read_only_space", 0x03951): (77, "StoreHandler0Map"),
+  ("read_only_space", 0x03979): (77, "StoreHandler1Map"),
+  ("read_only_space", 0x039a1): (77, "StoreHandler2Map"),
+  ("read_only_space", 0x039c9): (77, "StoreHandler3Map"),
   ("map_space", 0x00121): (1057, "ExternalMap"),
   ("map_space", 0x00149): (1073, "JSMessageObjectMap"),
 }