[ptr-compr] Isolatify LookupIterator implementation and friends

Tbr: verwaest@chromium.org Bug: v8:9353 Change-Id: I8164e2235ca43e203410277b86e6f166010c11d6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687673Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#62597}

[ptr-compr] Isolatify LookupIterator implementation and friends
Tbr: verwaest@chromium.org Bug: v8:9353 Change-Id: I8164e2235ca43e203410277b86e6f166010c11d6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687673Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#62597}
b51cddc1 · Igor Sheludko · Commit Bot · ad9ead76 · b51cddc1 · b51cddc1
Commit b51cddc1 authored Jul 03, 2019 by Igor Sheludko Committed by Commit Bot Jul 09, 2019
23 changed files
--- a/src/ast/ast.cc
+++ b/src/ast/ast.cc
@@ -603,8 +603,8 @@ void ArrayLiteral::BuildBoilerplateDescription(Isolate* isolate) {
      boilerplate_value = handle(Smi::kZero, isolate);
    }
-    kind = GetMoreGeneralElementsKind(kind,
+    kind = GetMoreGeneralElementsKind(
-                                      boilerplate_value->OptimalElementsKind());
+        kind, boilerplate_value->OptimalElementsKind(isolate));
    fixed_array->set(array_index, *boilerplate_value);
  }

--- a/src/builtins/accessors.cc
+++ b/src/builtins/accessors.cc
@@ -306,7 +306,7 @@ Handle<AccessorInfo> Accessors::MakeStringLengthInfo(Isolate* isolate) {
 static Handle<Object> GetFunctionPrototype(Isolate* isolate,
                                           Handle<JSFunction> function) {
  if (!function->has_prototype()) {
-    Handle<Object> proto = isolate->factory()->NewFunctionPrototype(function);
+    Handle<JSObject> proto = isolate->factory()->NewFunctionPrototype(function);
    JSFunction::SetPrototype(function, proto);
  }
  return Handle<Object>(function->prototype(), isolate);

--- a/src/json/json-parser.cc
+++ b/src/json/json-parser.cc
@@ -499,7 +499,7 @@ Handle<Object> JsonParser<Char>::BuildJsonObject(
    Representation expected_representation = details.representation();
    if (!value->FitsRepresentation(expected_representation)) {
-      Representation representation = value->OptimalRepresentation();
+      Representation representation = value->OptimalRepresentation(isolate());
      representation = representation.generalize(expected_representation);
      if (!expected_representation.CanBeInPlaceChangedTo(representation)) {
        map = ParentOfDescriptorOwner(isolate_, map, target, descriptor);

--- a/src/objects/arguments-inl.h
+++ b/src/objects/arguments-inl.h
@@ -29,12 +29,14 @@ CAST_ACCESSOR(JSArgumentsObject)
 SMI_ACCESSORS(AliasedArgumentsEntry, aliased_context_slot,
              kAliasedContextSlotOffset)
-Context SloppyArgumentsElements::context() {
+DEF_GETTER(SloppyArgumentsElements, context, Context) {
-  return Context::cast(get(kContextIndex));
+  return TaggedField<Context>::load(isolate, *this,
+                                    OffsetOfElementAt(kContextIndex));
 }
-FixedArray SloppyArgumentsElements::arguments() {
+DEF_GETTER(SloppyArgumentsElements, arguments, FixedArray) {
-  return FixedArray::cast(get(kArgumentsIndex));
+  return TaggedField<FixedArray>::load(isolate, *this,
+                                       OffsetOfElementAt(kArgumentsIndex));
 }
 void SloppyArgumentsElements::set_arguments(FixedArray arguments) {

--- a/src/objects/arguments.h
+++ b/src/objects/arguments.h
@@ -102,8 +102,8 @@ class SloppyArgumentsElements : public FixedArray {
  static const int kArgumentsIndex = 1;
  static const uint32_t kParameterMapStart = 2;
-  inline Context context();
+  DECL_GETTER(context, Context)
-  inline FixedArray arguments();
+  DECL_GETTER(arguments, FixedArray)
  inline void set_arguments(FixedArray arguments);
  inline uint32_t parameter_map_length();
  inline Object get_mapped_entry(uint32_t entry);

--- a/src/objects/dictionary-inl.h
+++ b/src/objects/dictionary-inl.h
@@ -98,15 +98,27 @@ RootIndex GlobalDictionaryShape::GetMapRootIndex() {
  return RootIndex::kGlobalDictionaryMap;
 }
-Name NameDictionary::NameAt(int entry) { return Name::cast(KeyAt(entry)); }
+Name NameDictionary::NameAt(int entry) {
+  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  return NameAt(isolate, entry);
+}
+Name NameDictionary::NameAt(Isolate* isolate, int entry) {
+  return Name::cast(KeyAt(isolate, entry));
+}
 RootIndex NameDictionaryShape::GetMapRootIndex() {
  return RootIndex::kNameDictionaryMap;
 }
 PropertyCell GlobalDictionary::CellAt(int entry) {
-  DCHECK(KeyAt(entry).IsPropertyCell());
+  Isolate* isolate = GetIsolateForPtrCompr(*this);
-  return PropertyCell::cast(KeyAt(entry));
+  return CellAt(isolate, entry);
+}
+PropertyCell GlobalDictionary::CellAt(Isolate* isolate, int entry) {
+  DCHECK(KeyAt(isolate, entry).IsPropertyCell(isolate));
+  return PropertyCell::cast(KeyAt(isolate, entry));
 }
 bool GlobalDictionaryShape::IsLive(ReadOnlyRoots roots, Object k) {
@@ -118,8 +130,23 @@ bool GlobalDictionaryShape::IsKey(ReadOnlyRoots roots, Object k) {
  return IsLive(roots, k) && !PropertyCell::cast(k).value().IsTheHole(roots);
 }
-Name GlobalDictionary::NameAt(int entry) { return CellAt(entry).name(); }
+Name GlobalDictionary::NameAt(int entry) {
-Object GlobalDictionary::ValueAt(int entry) { return CellAt(entry).value(); }
+  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  return NameAt(isolate, entry);
+}
+Name GlobalDictionary::NameAt(Isolate* isolate, int entry) {
+  return CellAt(isolate, entry).name(isolate);
+}
+Object GlobalDictionary::ValueAt(int entry) {
+  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  return ValueAt(isolate, entry);
+}
+Object GlobalDictionary::ValueAt(Isolate* isolate, int entry) {
+  return CellAt(isolate, entry).value(isolate);
+}
 void GlobalDictionary::SetEntry(Isolate* isolate, int entry, Object key,
                                Object value, PropertyDetails details) {

--- a/src/objects/dictionary.h
+++ b/src/objects/dictionary.h
@@ -212,6 +212,8 @@ class V8_EXPORT_PRIVATE NameDictionary
  static const int kInitialCapacity = 2;
  inline Name NameAt(int entry);
+  inline Name NameAt(Isolate* isolate, int entry);
  inline void set_hash(int hash);
  inline int hash() const;
@@ -250,10 +252,13 @@ class V8_EXPORT_PRIVATE GlobalDictionary
  DECL_CAST(GlobalDictionary)
  inline Object ValueAt(int entry);
+  inline Object ValueAt(Isolate* isolate, int entry);
  inline PropertyCell CellAt(int entry);
+  inline PropertyCell CellAt(Isolate* isolate, int entry);
  inline void SetEntry(Isolate* isolate, int entry, Object key, Object value,
                       PropertyDetails details);
  inline Name NameAt(int entry);
+  inline Name NameAt(Isolate* isolate, int entry);
  inline void ValueAtPut(int entry, Object value);
  OBJECT_CONSTRUCTORS(

--- a/src/objects/js-objects-inl.h
+++ b/src/objects/js-objects-inl.h
@@ -241,17 +241,16 @@ void JSObject::initialize_elements() {
  set_elements(elements, SKIP_WRITE_BARRIER);
 }
-InterceptorInfo JSObject::GetIndexedInterceptor() {
+DEF_GETTER(JSObject, GetIndexedInterceptor, InterceptorInfo) {
-  return map().GetIndexedInterceptor();
+  return map(isolate).GetIndexedInterceptor(isolate);
 }
-InterceptorInfo JSObject::GetNamedInterceptor() {
+DEF_GETTER(JSObject, GetNamedInterceptor, InterceptorInfo) {
-  return map().GetNamedInterceptor();
+  return map(isolate).GetNamedInterceptor(isolate);
 }
-int JSObject::GetHeaderSize() const { return GetHeaderSize(map()); }
+// static
+int JSObject::GetHeaderSize(Map map) {
-int JSObject::GetHeaderSize(const Map map) {
  // Check for the most common kind of JavaScript object before
  // falling into the generic switch. This speeds up the internal
  // field operations considerably on average.
@@ -262,7 +261,7 @@ int JSObject::GetHeaderSize(const Map map) {
 }
 // static
-int JSObject::GetEmbedderFieldsStartOffset(const Map map) {
+int JSObject::GetEmbedderFieldsStartOffset(Map map) {
  // Embedder fields are located after the object header.
  return GetHeaderSize(map);
 }
@@ -272,7 +271,7 @@ int JSObject::GetEmbedderFieldsStartOffset() {
 }
 // static
-int JSObject::GetEmbedderFieldCount(const Map map) {
+int JSObject::GetEmbedderFieldCount(Map map) {
  int instance_size = map.instance_size();
  if (instance_size == kVariableSizeSentinel) return 0;
  // Embedder fields are located after the object header, whereas in-object
@@ -626,7 +625,7 @@ void JSFunction::set_context(HeapObject value) {
  WRITE_BARRIER(*this, kContextOffset, value);
 }
-ACCESSORS_CHECKED(JSFunction, prototype_or_initial_map, Object,
+ACCESSORS_CHECKED(JSFunction, prototype_or_initial_map, HeapObject,
                  kPrototypeOrInitialMapOffset, map().has_prototype_slot())
 DEF_GETTER(JSFunction, has_prototype_slot, bool) {

--- a/src/objects/js-objects.cc
+++ b/src/objects/js-objects.cc
@@ -4597,22 +4597,22 @@ static ElementsKind BestFittingFastElementsKind(JSObject object) {
 void JSObject::AddDataElement(Handle<JSObject> object, uint32_t index,
                              Handle<Object> value,
                              PropertyAttributes attributes) {
-  DCHECK(object->map().is_extensible());
  Isolate* isolate = object->GetIsolate();
+  DCHECK(object->map(isolate).is_extensible());
  uint32_t old_length = 0;
  uint32_t new_capacity = 0;
-  if (object->IsJSArray()) {
+  if (object->IsJSArray(isolate)) {
    CHECK(JSArray::cast(*object).length().ToArrayLength(&old_length));
  }
-  ElementsKind kind = object->GetElementsKind();
+  ElementsKind kind = object->GetElementsKind(isolate);
-  FixedArrayBase elements = object->elements();
+  FixedArrayBase elements = object->elements(isolate);
  ElementsKind dictionary_kind = DICTIONARY_ELEMENTS;
  if (IsSloppyArgumentsElementsKind(kind)) {
-    elements = SloppyArgumentsElements::cast(elements).arguments();
+    elements = SloppyArgumentsElements::cast(elements).arguments(isolate);
    dictionary_kind = SLOW_SLOPPY_ARGUMENTS_ELEMENTS;
  } else if (IsStringWrapperElementsKind(kind)) {
    dictionary_kind = SLOW_STRING_WRAPPER_ELEMENTS;
@@ -4620,7 +4620,7 @@ void JSObject::AddDataElement(Handle<JSObject> object, uint32_t index,
  if (attributes != NONE) {
    kind = dictionary_kind;
-  } else if (elements.IsNumberDictionary()) {
+  } else if (elements.IsNumberDictionary(isolate)) {
    kind = ShouldConvertToFastElements(
               *object, NumberDictionary::cast(elements), index, &new_capacity)
               ? BestFittingFastElementsKind(*object)
@@ -4631,8 +4631,9 @@ void JSObject::AddDataElement(Handle<JSObject> object, uint32_t index,
    kind = dictionary_kind;
  }
-  ElementsKind to = value->OptimalElementsKind();
+  ElementsKind to = value->OptimalElementsKind(isolate);
-  if (IsHoleyElementsKind(kind) || !object->IsJSArray() || index > old_length) {
+  if (IsHoleyElementsKind(kind) || !object->IsJSArray(isolate) ||
+      index > old_length) {
    to = GetHoleyElementsKind(to);
    kind = GetHoleyElementsKind(kind);
  }
@@ -4640,7 +4641,7 @@ void JSObject::AddDataElement(Handle<JSObject> object, uint32_t index,
  ElementsAccessor* accessor = ElementsAccessor::ForKind(to);
  accessor->Add(object, index, value, attributes, new_capacity);
-  if (object->IsJSArray() && index >= old_length) {
+  if (object->IsJSArray(isolate) && index >= old_length) {
    Handle<Object> new_length =
        isolate->factory()->NewNumberFromUint(index + 1);
    JSArray::cast(*object).set_length(*new_length);

--- a/src/objects/js-objects.h
+++ b/src/objects/js-objects.h
@@ -479,8 +479,8 @@ class JSObject : public JSReceiver {
                                                  int old_index, int new_index);
  // Retrieve interceptors.
-  inline InterceptorInfo GetNamedInterceptor();
+  DECL_GETTER(GetNamedInterceptor, InterceptorInfo)
-  inline InterceptorInfo GetIndexedInterceptor();
+  DECL_GETTER(GetIndexedInterceptor, InterceptorInfo)
  // Used from JSReceiver.
  V8_WARN_UNUSED_RESULT static Maybe<PropertyAttributes>
@@ -566,13 +566,12 @@ class JSObject : public JSReceiver {
  // JSFunction objects.
  static int GetHeaderSize(InstanceType instance_type,
                           bool function_has_prototype_slot = false);
-  static inline int GetHeaderSize(const Map map);
+  static inline int GetHeaderSize(Map map);
-  inline int GetHeaderSize() const;
-  static inline int GetEmbedderFieldsStartOffset(const Map map);
+  static inline int GetEmbedderFieldsStartOffset(Map map);
  inline int GetEmbedderFieldsStartOffset();
-  static inline int GetEmbedderFieldCount(const Map map);
+  static inline int GetEmbedderFieldCount(Map map);
  inline int GetEmbedderFieldCount() const;
  inline int GetEmbedderFieldOffset(int index);
  inline Object GetEmbedderField(int index);
@@ -962,7 +961,7 @@ class JSBoundFunction : public JSObject {
 class JSFunction : public JSObject {
 public:
  // [prototype_or_initial_map]:
-  DECL_ACCESSORS(prototype_or_initial_map, Object)
+  DECL_ACCESSORS(prototype_or_initial_map, HeapObject)
  // [shared]: The information about the function that
  // can be shared by instances.

--- a/src/objects/lookup-inl.h
+++ b/src/objects/lookup-inl.h
@@ -31,7 +31,7 @@ LookupIterator::LookupIterator(Handle<Object> receiver, Handle<Name> name,
 LookupIterator::LookupIterator(Isolate* isolate, Handle<Object> receiver,
                               Handle<Name> name, Handle<JSReceiver> holder,
                               Configuration configuration)
-    : configuration_(ComputeConfiguration(configuration, name)),
+    : configuration_(ComputeConfiguration(isolate, configuration, name)),
      interceptor_state_(InterceptorState::kUninitialized),
      property_details_(PropertyDetails::Empty()),
      isolate_(isolate),
@@ -90,7 +90,7 @@ Handle<Name> LookupIterator::GetName() {
 }
 bool LookupIterator::is_dictionary_holder() const {
-  return !holder_->HasFastProperties();
+  return !holder_->HasFastProperties(isolate_);
 }
 Handle<Map> LookupIterator::transition_map() const {
@@ -111,23 +111,23 @@ Handle<T> LookupIterator::GetHolder() const {
 bool LookupIterator::ExtendingNonExtensible(Handle<JSReceiver> receiver) {
  DCHECK(receiver.is_identical_to(GetStoreTarget<JSReceiver>()));
-  return !receiver->map().is_extensible() &&
+  return !receiver->map(isolate_).is_extensible() &&
-         (IsElement() || !name_->IsPrivate());
+         (IsElement() || !name_->IsPrivate(isolate_));
 }
 bool LookupIterator::IsCacheableTransition() {
  DCHECK_EQ(TRANSITION, state_);
-  return transition_->IsPropertyCell() ||
+  return transition_->IsPropertyCell(isolate_) ||
         (transition_map()->is_dictionary_map() &&
-          !GetStoreTarget<JSReceiver>()->HasFastProperties()) ||
+          !GetStoreTarget<JSReceiver>()->HasFastProperties(isolate_)) ||
-         transition_map()->GetBackPointer().IsMap();
+         transition_map()->GetBackPointer(isolate_).IsMap(isolate_);
 }
 void LookupIterator::UpdateProtector() {
  if (IsElement()) return;
  // This list must be kept in sync with
  // CodeStubAssembler::CheckForAssociatedProtector!
-  ReadOnlyRoots roots(heap());
+  ReadOnlyRoots roots(isolate_);
  if (*name_ == roots.is_concat_spreadable_symbol() ||
      *name_ == roots.constructor_string() || *name_ == roots.next_string() ||
      *name_ == roots.species_symbol() || *name_ == roots.iterator_symbol() ||
@@ -139,52 +139,59 @@ void LookupIterator::UpdateProtector() {
 int LookupIterator::descriptor_number() const {
  DCHECK(!IsElement());
  DCHECK(has_property_);
-  DCHECK(holder_->HasFastProperties());
+  DCHECK(holder_->HasFastProperties(isolate_));
  return number_;
 }
 int LookupIterator::dictionary_entry() const {
  DCHECK(!IsElement());
  DCHECK(has_property_);
-  DCHECK(!holder_->HasFastProperties());
+  DCHECK(!holder_->HasFastProperties(isolate_));
  return number_;
 }
+// static
 LookupIterator::Configuration LookupIterator::ComputeConfiguration(
-    Configuration configuration, Handle<Name> name) {
+    Isolate* isolate, Configuration configuration, Handle<Name> name) {
-  return name->IsPrivate() ? OWN_SKIP_INTERCEPTOR : configuration;
+  return name->IsPrivate(isolate) ? OWN_SKIP_INTERCEPTOR : configuration;
 }
+// static
 Handle<JSReceiver> LookupIterator::GetRoot(Isolate* isolate,
                                           Handle<Object> receiver,
                                           uint32_t index) {
-  if (receiver->IsJSReceiver()) return Handle<JSReceiver>::cast(receiver);
+  if (receiver->IsJSReceiver(isolate))
+    return Handle<JSReceiver>::cast(receiver);
  return GetRootForNonJSReceiver(isolate, receiver, index);
 }
 template <class T>
 Handle<T> LookupIterator::GetStoreTarget() const {
-  DCHECK(receiver_->IsJSReceiver());
+  DCHECK(receiver_->IsJSReceiver(isolate_));
-  if (receiver_->IsJSGlobalProxy()) {
+  if (receiver_->IsJSGlobalProxy(isolate_)) {
-    HeapObject prototype = JSGlobalProxy::cast(*receiver_).map().prototype();
+    HeapObject prototype =
-    if (prototype.IsJSGlobalObject()) {
+        JSGlobalProxy::cast(*receiver_).map(isolate_).prototype(isolate_);
+    if (prototype.IsJSGlobalObject(isolate_)) {
      return handle(JSGlobalObject::cast(prototype), isolate_);
    }
  }
  return Handle<T>::cast(receiver_);
 }
+// static
 template <bool is_element>
-InterceptorInfo LookupIterator::GetInterceptor(JSObject holder) {
+InterceptorInfo LookupIterator::GetInterceptor(Isolate* isolate,
-  return is_element ? holder.GetIndexedInterceptor()
+                                               JSObject holder) {
-                    : holder.GetNamedInterceptor();
+  return is_element ? holder.GetIndexedInterceptor(isolate)
+                    : holder.GetNamedInterceptor(isolate);
 }
 inline Handle<InterceptorInfo> LookupIterator::GetInterceptor() const {
  DCHECK_EQ(INTERCEPTOR, state_);
-  InterceptorInfo result =
+  JSObject holder = JSObject::cast(*holder_);
-      IsElement() ? GetInterceptor<true>(JSObject::cast(*holder_))
+  InterceptorInfo result = IsElement()
-                  : GetInterceptor<false>(JSObject::cast(*holder_));
+                               ? GetInterceptor<true>(isolate_, holder)
+                               : GetInterceptor<false>(isolate_, holder);
  return handle(result, isolate_);
 }

--- a/src/objects/lookup.cc
+++ b/src/objects/lookup.cc
@@ -107,7 +107,7 @@ void LookupIterator::Start() {
  holder_ = initial_holder_;
  JSReceiver holder = *holder_;
-  Map map = holder.map();
+  Map map = holder.map(isolate_);
  state_ = LookupInHolder<is_element>(map, holder);
  if (IsFound()) return;
@@ -125,7 +125,7 @@ void LookupIterator::Next() {
  has_property_ = false;
  JSReceiver holder = *holder_;
-  Map map = holder.map();
+  Map map = holder.map(isolate_);
  if (map.IsSpecialReceiverMap()) {
    state_ = IsElement() ? LookupInSpecialHolder<true>(map, holder)
@@ -151,7 +151,7 @@ void LookupIterator::NextInternal(Map map, JSReceiver holder) {
      return;
    }
    holder = maybe_holder;
-    map = holder.map();
+    map = holder.map(isolate_);
    state_ = LookupInHolder<is_element>(map, holder);
  } while (!IsFound());
@@ -174,7 +174,7 @@ Handle<JSReceiver> LookupIterator::GetRootForNonJSReceiver(
    Isolate* isolate, Handle<Object> receiver, uint32_t index) {
  // Strings are the only objects with properties (only elements) directly on
  // the wrapper. Hence we can skip generating the wrapper for all other cases.
-  if (receiver->IsString() &&
+  if (receiver->IsString(isolate) &&
      index < static_cast<uint32_t>(String::cast(*receiver).length())) {
    // TODO(verwaest): Speed this up. Perhaps use a cached wrapper on the native
    // context, ensuring that we don't leak it into JS?
@@ -183,8 +183,8 @@ Handle<JSReceiver> LookupIterator::GetRootForNonJSReceiver(
    Handle<JSPrimitiveWrapper>::cast(result)->set_value(*receiver);
    return result;
  }
-  auto root =
+  auto root = handle(
-      handle(receiver->GetPrototypeChainRootMap(isolate).prototype(), isolate);
+      receiver->GetPrototypeChainRootMap(isolate).prototype(isolate), isolate);
  if (root->IsNull(isolate)) {
    isolate->PushStackTraceAndDie(reinterpret_cast<void*>(receiver->ptr()));
  }
@@ -192,8 +192,8 @@ Handle<JSReceiver> LookupIterator::GetRootForNonJSReceiver(
 }
 Handle<Map> LookupIterator::GetReceiverMap() const {
-  if (receiver_->IsNumber()) return factory()->heap_number_map();
+  if (receiver_->IsNumber(isolate_)) return factory()->heap_number_map();
-  return handle(Handle<HeapObject>::cast(receiver_)->map(), isolate_);
+  return handle(Handle<HeapObject>::cast(receiver_)->map(isolate_), isolate_);
 }
 bool LookupIterator::HasAccess() const {
@@ -206,8 +206,8 @@ template <bool is_element>
 void LookupIterator::ReloadPropertyInformation() {
  state_ = BEFORE_PROPERTY;
  interceptor_state_ = InterceptorState::kUninitialized;
-  state_ = LookupInHolder<is_element>(holder_->map(), *holder_);
+  state_ = LookupInHolder<is_element>(holder_->map(isolate_), *holder_);
-  DCHECK(IsFound() || !holder_->HasFastProperties());
+  DCHECK(IsFound() || !holder_->HasFastProperties(isolate_));
 }
 namespace {
@@ -221,7 +221,7 @@ bool IsTypedArrayFunctionInAnyContext(Isolate* isolate, JSReceiver holder) {
 #undef TYPED_ARRAY_CONTEXT_SLOTS
  };
-  if (!holder.IsJSFunction()) return false;
+  if (!holder.IsJSFunction(isolate)) return false;
  return std::any_of(
      std::begin(context_slots), std::end(context_slots),
@@ -233,7 +233,7 @@ bool IsTypedArrayFunctionInAnyContext(Isolate* isolate, JSReceiver holder) {
 void LookupIterator::InternalUpdateProtector() {
  if (isolate_->bootstrapper()->IsActive()) return;
-  ReadOnlyRoots roots(heap());
+  ReadOnlyRoots roots(isolate_);
  if (*name_ == roots.constructor_string()) {
    if (!isolate_->IsArraySpeciesLookupChainIntact() &&
        !isolate_->IsPromiseSpeciesLookupChainIntact() &&
@@ -242,26 +242,26 @@ void LookupIterator::InternalUpdateProtector() {
      return;
    }
    // Setting the constructor property could change an instance's @@species
-    if (holder_->IsJSArray()) {
+    if (holder_->IsJSArray(isolate_)) {
      if (!isolate_->IsArraySpeciesLookupChainIntact()) return;
      isolate_->CountUsage(
          v8::Isolate::UseCounterFeature::kArrayInstanceConstructorModified);
      isolate_->InvalidateArraySpeciesProtector();
      return;
-    } else if (holder_->IsJSPromise()) {
+    } else if (holder_->IsJSPromise(isolate_)) {
      if (!isolate_->IsPromiseSpeciesLookupChainIntact()) return;
      isolate_->InvalidatePromiseSpeciesProtector();
      return;
-    } else if (holder_->IsJSRegExp()) {
+    } else if (holder_->IsJSRegExp(isolate_)) {
      if (!isolate_->IsRegExpSpeciesLookupChainIntact()) return;
      isolate_->InvalidateRegExpSpeciesProtector();
      return;
-    } else if (holder_->IsJSTypedArray()) {
+    } else if (holder_->IsJSTypedArray(isolate_)) {
      if (!isolate_->IsTypedArraySpeciesLookupChainIntact()) return;
      isolate_->InvalidateTypedArraySpeciesProtector();
      return;
    }
-    if (holder_->map().is_prototype_map()) {
+    if (holder_->map(isolate_).is_prototype_map()) {
      DisallowHeapAllocation no_gc;
      // Setting the constructor of any prototype with the @@species protector
      // (of any realm) also needs to invalidate the protector.
@@ -283,7 +283,7 @@ void LookupIterator::InternalUpdateProtector() {
        if (!isolate_->IsRegExpSpeciesLookupChainIntact()) return;
        isolate_->InvalidateRegExpSpeciesProtector();
      } else if (isolate_->IsInAnyContext(
-                     holder_->map().prototype(),
+                     holder_->map(isolate_).prototype(isolate_),
                     Context::TYPED_ARRAY_PROTOTYPE_INDEX)) {
        if (!isolate_->IsTypedArraySpeciesLookupChainIntact()) return;
        isolate_->InvalidateTypedArraySpeciesProtector();
@@ -342,7 +342,7 @@ void LookupIterator::InternalUpdateProtector() {
    if (!isolate_->IsIsConcatSpreadableLookupChainIntact()) return;
    isolate_->InvalidateIsConcatSpreadableProtector();
  } else if (*name_ == roots.iterator_symbol()) {
-    if (holder_->IsJSArray()) {
+    if (holder_->IsJSArray(isolate_)) {
      if (!isolate_->IsArrayIteratorLookupChainIntact()) return;
      isolate_->InvalidateArrayIteratorProtector();
    } else if (isolate_->IsInAnyContext(
@@ -382,7 +382,7 @@ void LookupIterator::InternalUpdateProtector() {
    // to guard the fast-path in AsyncGeneratorResolve, where we can skip
    // the ResolvePromise step and go directly to FulfillPromise if we
    // know that the Object.prototype doesn't contain a "then" method.
-    if (holder_->IsJSPromise() ||
+    if (holder_->IsJSPromise(isolate_) ||
        isolate_->IsInAnyContext(*holder_,
                                 Context::INITIAL_OBJECT_PROTOTYPE_INDEX) ||
        isolate_->IsInAnyContext(*holder_, Context::PROMISE_PROTOTYPE_INDEX)) {
@@ -397,15 +397,16 @@ void LookupIterator::PrepareForDataProperty(Handle<Object> value) {
  Handle<JSReceiver> holder = GetHolder<JSReceiver>();
  // JSProxy does not have fast properties so we do an early return.
-  DCHECK_IMPLIES(holder->IsJSProxy(), !holder->HasFastProperties());
+  DCHECK_IMPLIES(holder->IsJSProxy(isolate_),
-  DCHECK_IMPLIES(holder->IsJSProxy(), name()->IsPrivate());
+                 !holder->HasFastProperties(isolate_));
-  if (holder->IsJSProxy()) return;
+  DCHECK_IMPLIES(holder->IsJSProxy(isolate_), name()->IsPrivate(isolate_));
+  if (holder->IsJSProxy(isolate_)) return;
  Handle<JSObject> holder_obj = Handle<JSObject>::cast(holder);
  if (IsElement()) {
-    ElementsKind kind = holder_obj->GetElementsKind();
+    ElementsKind kind = holder_obj->GetElementsKind(isolate_);
-    ElementsKind to = value->OptimalElementsKind();
+    ElementsKind to = value->OptimalElementsKind(isolate_);
    if (IsHoleyElementsKind(kind)) to = GetHoleyElementsKind(to);
    to = GetMoreGeneralElementsKind(kind, to);
@@ -420,17 +421,18 @@ void LookupIterator::PrepareForDataProperty(Handle<Object> value) {
    return;
  }
-  if (holder_obj->IsJSGlobalObject()) {
+  if (holder_obj->IsJSGlobalObject(isolate_)) {
    Handle<GlobalDictionary> dictionary(
-        JSGlobalObject::cast(*holder_obj).global_dictionary(), isolate());
+        JSGlobalObject::cast(*holder_obj).global_dictionary(isolate_),
-    Handle<PropertyCell> cell(dictionary->CellAt(dictionary_entry()),
+        isolate());
+    Handle<PropertyCell> cell(dictionary->CellAt(isolate_, dictionary_entry()),
                              isolate());
    property_details_ = cell->property_details();
    PropertyCell::PrepareForValue(isolate(), dictionary, dictionary_entry(),
                                  value, property_details_);
    return;
  }
-  if (!holder_obj->HasFastProperties()) return;
+  if (!holder_obj->HasFastProperties(isolate_)) return;
  PropertyConstness new_constness = PropertyConstness::kConst;
  if (constness() == PropertyConstness::kConst) {
@@ -441,7 +443,7 @@ void LookupIterator::PrepareForDataProperty(Handle<Object> value) {
      new_constness = PropertyConstness::kMutable;
  }
-  Handle<Map> old_map(holder_obj->map(), isolate_);
+  Handle<Map> old_map(holder_obj->map(isolate_), isolate_);
  DCHECK(!old_map->is_dictionary_map());
  Handle<Map> new_map = Map::Update(isolate_, old_map);
@@ -452,8 +454,8 @@ void LookupIterator::PrepareForDataProperty(Handle<Object> value) {
    if (old_map.is_identical_to(new_map)) {
      // Update the property details if the representation was None.
      if (constness() != new_constness || representation().IsNone()) {
-        property_details_ =
+        property_details_ = new_map->instance_descriptors(isolate_).GetDetails(
-            new_map->instance_descriptors().GetDetails(descriptor_number());
+            descriptor_number());
      }
      return;
    }
@@ -474,21 +476,21 @@ void LookupIterator::ReconfigureDataProperty(Handle<Object> value,
  Handle<JSReceiver> holder = GetHolder<JSReceiver>();
  // Property details can never change for private properties.
-  if (holder->IsJSProxy()) {
+  if (holder->IsJSProxy(isolate_)) {
-    DCHECK(name()->IsPrivate());
+    DCHECK(name()->IsPrivate(isolate_));
    return;
  }
  Handle<JSObject> holder_obj = Handle<JSObject>::cast(holder);
  if (IsElement()) {
-    DCHECK(!holder_obj->HasTypedArrayElements());
+    DCHECK(!holder_obj->HasTypedArrayElements(isolate_));
-    DCHECK(attributes != NONE || !holder_obj->HasFastElements());
+    DCHECK(attributes != NONE || !holder_obj->HasFastElements(isolate_));
-    Handle<FixedArrayBase> elements(holder_obj->elements(), isolate());
+    Handle<FixedArrayBase> elements(holder_obj->elements(isolate_), isolate());
-    holder_obj->GetElementsAccessor()->Reconfigure(holder_obj, elements,
+    holder_obj->GetElementsAccessor(isolate_)->Reconfigure(
-                                                   number_, value, attributes);
+        holder_obj, elements, number_, value, attributes);
    ReloadPropertyInformation<true>();
-  } else if (holder_obj->HasFastProperties()) {
+  } else if (holder_obj->HasFastProperties(isolate_)) {
-    Handle<Map> old_map(holder_obj->map(), isolate_);
+    Handle<Map> old_map(holder_obj->map(isolate_), isolate_);
    // Force mutable to avoid changing constant value by reconfiguring
    // kData -> kAccessor -> kData.
    Handle<Map> new_map = Map::ReconfigureExistingProperty(
@@ -505,27 +507,28 @@ void LookupIterator::ReconfigureDataProperty(Handle<Object> value,
    ReloadPropertyInformation<false>();
  }
-  if (!IsElement() && !holder_obj->HasFastProperties()) {
+  if (!IsElement() && !holder_obj->HasFastProperties(isolate_)) {
    PropertyDetails details(kData, attributes, PropertyCellType::kMutable);
-    if (holder_obj->map().is_prototype_map() &&
+    if (holder_obj->map(isolate_).is_prototype_map() &&
        (property_details_.attributes() & READ_ONLY) == 0 &&
        (attributes & READ_ONLY) != 0) {
      // Invalidate prototype validity cell when a property is reconfigured
      // from writable to read-only as this may invalidate transitioning store
      // IC handlers.
-      JSObject::InvalidatePrototypeChains(holder->map());
+      JSObject::InvalidatePrototypeChains(holder->map(isolate_));
    }
-    if (holder_obj->IsJSGlobalObject()) {
+    if (holder_obj->IsJSGlobalObject(isolate_)) {
      Handle<GlobalDictionary> dictionary(
-          JSGlobalObject::cast(*holder_obj).global_dictionary(), isolate());
+          JSGlobalObject::cast(*holder_obj).global_dictionary(isolate_),
+          isolate());
      Handle<PropertyCell> cell = PropertyCell::PrepareForValue(
          isolate(), dictionary, dictionary_entry(), value, details);
      cell->set_value(*value);
      property_details_ = cell->property_details();
    } else {
-      Handle<NameDictionary> dictionary(holder_obj->property_dictionary(),
+      Handle<NameDictionary> dictionary(
-                                        isolate());
+          holder_obj->property_dictionary(isolate_), isolate());
      PropertyDetails original_details =
          dictionary->DetailsAt(dictionary_entry());
      int enumeration_index = original_details.dictionary_index();
@@ -552,21 +555,21 @@ void LookupIterator::ReconfigureDataProperty(Handle<Object> value,
 void LookupIterator::PrepareTransitionToDataProperty(
    Handle<JSReceiver> receiver, Handle<Object> value,
    PropertyAttributes attributes, StoreOrigin store_origin) {
-  DCHECK_IMPLIES(receiver->IsJSProxy(), name()->IsPrivate());
+  DCHECK_IMPLIES(receiver->IsJSProxy(isolate_), name()->IsPrivate(isolate_));
  DCHECK(receiver.is_identical_to(GetStoreTarget<JSReceiver>()));
  if (state_ == TRANSITION) return;
-  if (!IsElement() && name()->IsPrivate()) {
+  if (!IsElement() && name()->IsPrivate(isolate_)) {
    attributes = static_cast<PropertyAttributes>(attributes | DONT_ENUM);
  }
  DCHECK(state_ != LookupIterator::ACCESSOR ||
-         (GetAccessors()->IsAccessorInfo() &&
+         (GetAccessors()->IsAccessorInfo(isolate_) &&
          AccessorInfo::cast(*GetAccessors()).is_special_data_property()));
  DCHECK_NE(INTEGER_INDEXED_EXOTIC, state_);
  DCHECK(state_ == NOT_FOUND || !HolderIsReceiverOrHiddenPrototype());
-  Handle<Map> map(receiver->map(), isolate_);
+  Handle<Map> map(receiver->map(isolate_), isolate_);
  // Dictionary maps can always have additional data properties.
  if (map->is_dictionary_map()) {
@@ -577,9 +580,9 @@ void LookupIterator::PrepareTransitionToDataProperty(
      int entry;
      Handle<PropertyCell> cell = JSGlobalObject::EnsureEmptyPropertyCell(
          global, name(), PropertyCellType::kUninitialized, &entry);
-      Handle<GlobalDictionary> dictionary(global->global_dictionary(),
+      Handle<GlobalDictionary> dictionary(global->global_dictionary(isolate_),
                                          isolate_);
-      DCHECK(cell->value().IsTheHole(isolate_));
+      DCHECK(cell->value(isolate_).IsTheHole(isolate_));
      DCHECK(!value->IsTheHole(isolate_));
      transition_ = cell;
      // Assign an enumeration index to the property and update
@@ -625,13 +628,14 @@ void LookupIterator::ApplyTransitionToDataProperty(
  DCHECK(receiver.is_identical_to(GetStoreTarget<JSReceiver>()));
  holder_ = receiver;
-  if (receiver->IsJSGlobalObject()) {
+  if (receiver->IsJSGlobalObject(isolate_)) {
-    JSObject::InvalidatePrototypeChains(receiver->map());
+    JSObject::InvalidatePrototypeChains(receiver->map(isolate_));
    state_ = DATA;
    return;
  }
  Handle<Map> transition = transition_map();
-  bool simple_transition = transition->GetBackPointer() == receiver->map();
+  bool simple_transition =
+      transition->GetBackPointer(isolate_) == receiver->map(isolate_);
  if (configuration_ == DEFAULT && !transition->is_dictionary_map() &&
      !transition->IsPrototypeValidityCellValid()) {
@@ -642,7 +646,7 @@ void LookupIterator::ApplyTransitionToDataProperty(
    transition->set_prototype_validity_cell(*validity_cell);
  }
-  if (!receiver->IsJSProxy()) {
+  if (!receiver->IsJSProxy(isolate_)) {
    JSObject::MigrateToMap(isolate_, Handle<JSObject>::cast(receiver),
                           transition);
  }
@@ -652,12 +656,13 @@ void LookupIterator::ApplyTransitionToDataProperty(
    number_ = static_cast<uint32_t>(number);
    property_details_ = transition->GetLastDescriptorDetails(isolate_);
    state_ = DATA;
-  } else if (receiver->map().is_dictionary_map()) {
+  } else if (receiver->map(isolate_).is_dictionary_map()) {
-    Handle<NameDictionary> dictionary(receiver->property_dictionary(),
+    Handle<NameDictionary> dictionary(receiver->property_dictionary(isolate_),
                                      isolate_);
    int entry;
-    if (receiver->map().is_prototype_map() && receiver->IsJSObject()) {
+    if (receiver->map(isolate_).is_prototype_map() &&
-      JSObject::InvalidatePrototypeChains(receiver->map());
+        receiver->IsJSObject(isolate_)) {
+      JSObject::InvalidatePrototypeChains(receiver->map(isolate_));
    }
    dictionary = NameDictionary::Add(isolate(), dictionary, name(),
                                     isolate_->factory()->uninitialized_value(),
@@ -678,11 +683,11 @@ void LookupIterator::Delete() {
  Handle<JSReceiver> holder = Handle<JSReceiver>::cast(holder_);
  if (IsElement()) {
    Handle<JSObject> object = Handle<JSObject>::cast(holder);
-    ElementsAccessor* accessor = object->GetElementsAccessor();
+    ElementsAccessor* accessor = object->GetElementsAccessor(isolate_);
    accessor->Delete(object, number_);
  } else {
-    DCHECK(!name()->IsPrivateName());
+    DCHECK(!name()->IsPrivateName(isolate_));
-    bool is_prototype_map = holder->map().is_prototype_map();
+    bool is_prototype_map = holder->map(isolate_).is_prototype_map();
    RuntimeCallTimerScope stats_scope(
        isolate_, is_prototype_map
                      ? RuntimeCallCounterId::kPrototypeObject_DeleteProperty
@@ -691,13 +696,13 @@ void LookupIterator::Delete() {
    PropertyNormalizationMode mode =
        is_prototype_map ? KEEP_INOBJECT_PROPERTIES : CLEAR_INOBJECT_PROPERTIES;
-    if (holder->HasFastProperties()) {
+    if (holder->HasFastProperties(isolate_)) {
      JSObject::NormalizeProperties(isolate_, Handle<JSObject>::cast(holder),
                                    mode, 0, "DeletingProperty");
      ReloadPropertyInformation<false>();
    }
    JSReceiver::DeleteNormalizedProperty(holder, number_);
-    if (holder->IsJSObject()) {
+    if (holder->IsJSObject(isolate_)) {
      JSObject::ReoptimizeIfPrototype(Handle<JSObject>::cast(holder));
    }
  }
@@ -712,12 +717,12 @@ void LookupIterator::TransitionToAccessorProperty(
  // handled via a trap. Adding properties to primitive values is not
  // observable.
  Handle<JSObject> receiver = GetStoreTarget<JSObject>();
-  if (!IsElement() && name()->IsPrivate()) {
+  if (!IsElement() && name()->IsPrivate(isolate_)) {
    attributes = static_cast<PropertyAttributes>(attributes | DONT_ENUM);
  }
-  if (!IsElement() && !receiver->map().is_dictionary_map()) {
+  if (!IsElement() && !receiver->map(isolate_).is_dictionary_map()) {
-    Handle<Map> old_map(receiver->map(), isolate_);
+    Handle<Map> old_map(receiver->map(isolate_), isolate_);
    if (!holder_.is_identical_to(receiver)) {
      holder_ = receiver;
@@ -730,7 +735,8 @@ void LookupIterator::TransitionToAccessorProperty(
    Handle<Map> new_map = Map::TransitionToAccessorProperty(
        isolate_, old_map, name_, descriptor, getter, setter, attributes);
-    bool simple_transition = new_map->GetBackPointer() == receiver->map();
+    bool simple_transition =
+        new_map->GetBackPointer(isolate_) == receiver->map(isolate_);
    JSObject::MigrateToMap(isolate_, receiver, new_map);
    if (simple_transition) {
@@ -746,7 +752,7 @@ void LookupIterator::TransitionToAccessorProperty(
  }
  Handle<AccessorPair> pair;
-  if (state() == ACCESSOR && GetAccessors()->IsAccessorPair()) {
+  if (state() == ACCESSOR && GetAccessors()->IsAccessorPair(isolate_)) {
    pair = Handle<AccessorPair>::cast(GetAccessors());
    // If the component and attributes are identical, nothing has to be done.
    if (pair->Equals(*getter, *setter)) {
@@ -788,13 +794,14 @@ void LookupIterator::TransitionToAccessorPair(Handle<Object> pair,
                                       receiver, details);
    receiver->RequireSlowElements(*dictionary);
-    if (receiver->HasSlowArgumentsElements()) {
+    if (receiver->HasSlowArgumentsElements(isolate_)) {
-      FixedArray parameter_map = FixedArray::cast(receiver->elements());
+      FixedArray parameter_map = FixedArray::cast(receiver->elements(isolate_));
      uint32_t length = parameter_map.length() - 2;
      if (number_ < length) {
-        parameter_map.set(number_ + 2, ReadOnlyRoots(heap()).the_hole_value());
+        parameter_map.set(number_ + 2,
+                          ReadOnlyRoots(isolate_).the_hole_value());
      }
-      FixedArray::cast(receiver->elements()).set(1, *dictionary);
+      FixedArray::cast(receiver->elements(isolate_)).set(1, *dictionary);
    } else {
      receiver->set_elements(*dictionary);
    }
@@ -802,8 +809,8 @@ void LookupIterator::TransitionToAccessorPair(Handle<Object> pair,
    ReloadPropertyInformation<true>();
  } else {
    PropertyNormalizationMode mode = CLEAR_INOBJECT_PROPERTIES;
-    if (receiver->map().is_prototype_map()) {
+    if (receiver->map(isolate_).is_prototype_map()) {
-      JSObject::InvalidatePrototypeChains(receiver->map());
+      JSObject::InvalidatePrototypeChains(receiver->map(isolate_));
      mode = KEEP_INOBJECT_PROPERTIES;
    }
@@ -830,48 +837,53 @@ bool LookupIterator::HolderIsReceiverOrHiddenPrototype() const {
  // Optimization that only works if configuration_ is not mutable.
  if (!check_prototype_chain()) return true;
  if (*receiver_ == *holder_) return true;
-  if (!receiver_->IsJSGlobalProxy()) return false;
+  if (!receiver_->IsJSGlobalProxy(isolate_)) return false;
-  return Handle<JSGlobalProxy>::cast(receiver_)->map().prototype() == *holder_;
+  return Handle<JSGlobalProxy>::cast(receiver_)->map(isolate_).prototype(
+             isolate_) == *holder_;
 }
 Handle<Object> LookupIterator::FetchValue() const {
  Object result;
  if (IsElement()) {
    Handle<JSObject> holder = GetHolder<JSObject>();
-    ElementsAccessor* accessor = holder->GetElementsAccessor();
+    ElementsAccessor* accessor = holder->GetElementsAccessor(isolate_);
    return accessor->Get(holder, number_);
-  } else if (holder_->IsJSGlobalObject()) {
+  } else if (holder_->IsJSGlobalObject(isolate_)) {
    Handle<JSGlobalObject> holder = GetHolder<JSGlobalObject>();
-    result = holder->global_dictionary().ValueAt(number_);
+    result = holder->global_dictionary(isolate_).ValueAt(isolate_, number_);
-  } else if (!holder_->HasFastProperties()) {
+  } else if (!holder_->HasFastProperties(isolate_)) {
-    result = holder_->property_dictionary().ValueAt(number_);
+    result = holder_->property_dictionary(isolate_).ValueAt(isolate_, number_);
  } else if (property_details_.location() == kField) {
    DCHECK_EQ(kData, property_details_.kind());
    Handle<JSObject> holder = GetHolder<JSObject>();
-    FieldIndex field_index = FieldIndex::ForDescriptor(holder->map(), number_);
+    FieldIndex field_index =
+        FieldIndex::ForDescriptor(holder->map(isolate_), number_);
    return JSObject::FastPropertyAt(holder, property_details_.representation(),
                                    field_index);
  } else {
-    result = holder_->map().instance_descriptors().GetStrongValue(number_);
+    result =
+        holder_->map(isolate_).instance_descriptors(isolate_).GetStrongValue(
+            isolate_, number_);
  }
  return handle(result, isolate_);
 }
 bool LookupIterator::IsConstFieldValueEqualTo(Object value) const {
  DCHECK(!IsElement());
-  DCHECK(holder_->HasFastProperties());
+  DCHECK(holder_->HasFastProperties(isolate_));
  DCHECK_EQ(kField, property_details_.location());
  DCHECK_EQ(PropertyConstness::kConst, property_details_.constness());
  Handle<JSObject> holder = GetHolder<JSObject>();
-  FieldIndex field_index = FieldIndex::ForDescriptor(holder->map(), number_);
+  FieldIndex field_index =
+      FieldIndex::ForDescriptor(holder->map(isolate_), number_);
  if (property_details_.representation().IsDouble()) {
-    if (!value.IsNumber()) return false;
+    if (!value.IsNumber(isolate_)) return false;
    uint64_t bits;
-    if (holder->IsUnboxedDoubleField(field_index)) {
+    if (holder->IsUnboxedDoubleField(isolate_, field_index)) {
      bits = holder->RawFastDoublePropertyAsBitsAt(field_index);
    } else {
-      Object current_value = holder->RawFastPropertyAt(field_index);
+      Object current_value = holder->RawFastPropertyAt(isolate_, field_index);
-      DCHECK(current_value.IsMutableHeapNumber());
+      DCHECK(current_value.IsMutableHeapNumber(isolate_));
      bits = MutableHeapNumber::cast(current_value).value_as_bits();
    }
    // Use bit representation of double to to check for hole double, since
@@ -885,11 +897,11 @@ bool LookupIterator::IsConstFieldValueEqualTo(Object value) const {
    }
    return Object::SameNumberValue(bit_cast<double>(bits), value.Number());
  } else {
-    Object current_value = holder->RawFastPropertyAt(field_index);
+    Object current_value = holder->RawFastPropertyAt(isolate_, field_index);
    if (current_value.IsUninitialized(isolate()) || current_value == value) {
      return true;
    }
-    return current_value.IsNumber() && value.IsNumber() &&
+    return current_value.IsNumber(isolate_) && value.IsNumber(isolate_) &&
           Object::SameNumberValue(current_value.Number(), value.Number());
  }
 }
@@ -904,7 +916,7 @@ int LookupIterator::GetFieldDescriptorIndex() const {
 int LookupIterator::GetAccessorIndex() const {
  DCHECK(has_property_);
-  DCHECK(holder_->HasFastProperties());
+  DCHECK(holder_->HasFastProperties(isolate_));
  DCHECK_EQ(kDescriptor, property_details_.location());
  DCHECK_EQ(kAccessor, property_details_.kind());
  return descriptor_number();
@@ -912,35 +924,37 @@ int LookupIterator::GetAccessorIndex() const {
 Handle<Map> LookupIterator::GetFieldOwnerMap() const {
  DCHECK(has_property_);
-  DCHECK(holder_->HasFastProperties());
+  DCHECK(holder_->HasFastProperties(isolate_));
  DCHECK_EQ(kField, property_details_.location());
  DCHECK(!IsElement());
-  Map holder_map = holder_->map();
+  Map holder_map = holder_->map(isolate_);
  return handle(holder_map.FindFieldOwner(isolate(), descriptor_number()),
                isolate_);
 }
 FieldIndex LookupIterator::GetFieldIndex() const {
  DCHECK(has_property_);
-  DCHECK(holder_->HasFastProperties());
+  DCHECK(holder_->HasFastProperties(isolate_));
  DCHECK_EQ(kField, property_details_.location());
  DCHECK(!IsElement());
-  return FieldIndex::ForDescriptor(holder_->map(), descriptor_number());
+  return FieldIndex::ForDescriptor(holder_->map(isolate_), descriptor_number());
 }
 Handle<FieldType> LookupIterator::GetFieldType() const {
  DCHECK(has_property_);
-  DCHECK(holder_->HasFastProperties());
+  DCHECK(holder_->HasFastProperties(isolate_));
  DCHECK_EQ(kField, property_details_.location());
  return handle(
-      holder_->map().instance_descriptors().GetFieldType(descriptor_number()),
+      holder_->map(isolate_).instance_descriptors(isolate_).GetFieldType(
+          isolate_, descriptor_number()),
      isolate_);
 }
 Handle<PropertyCell> LookupIterator::GetPropertyCell() const {
  DCHECK(!IsElement());
  Handle<JSGlobalObject> holder = GetHolder<JSGlobalObject>();
-  return handle(holder->global_dictionary().CellAt(dictionary_entry()),
+  return handle(
+      holder->global_dictionary(isolate_).CellAt(isolate_, dictionary_entry()),
      isolate_);
 }
@@ -961,9 +975,9 @@ void LookupIterator::WriteDataValue(Handle<Object> value,
  Handle<JSReceiver> holder = GetHolder<JSReceiver>();
  if (IsElement()) {
    Handle<JSObject> object = Handle<JSObject>::cast(holder);
-    ElementsAccessor* accessor = object->GetElementsAccessor();
+    ElementsAccessor* accessor = object->GetElementsAccessor(isolate_);
    accessor->Set(object, number_, *value);
-  } else if (holder->HasFastProperties()) {
+  } else if (holder->HasFastProperties(isolate_)) {
    if (property_details_.location() == kField) {
      // Check that in case of VariableMode::kConst field the existing value is
      // equal to |value|.
@@ -976,21 +990,22 @@ void LookupIterator::WriteDataValue(Handle<Object> value,
      DCHECK_EQ(kDescriptor, property_details_.location());
      DCHECK_EQ(PropertyConstness::kConst, property_details_.constness());
    }
-  } else if (holder->IsJSGlobalObject()) {
+  } else if (holder->IsJSGlobalObject(isolate_)) {
    GlobalDictionary dictionary =
-        JSGlobalObject::cast(*holder).global_dictionary();
+        JSGlobalObject::cast(*holder).global_dictionary(isolate_);
-    dictionary.CellAt(dictionary_entry()).set_value(*value);
+    dictionary.CellAt(isolate_, dictionary_entry()).set_value(*value);
  } else {
-    DCHECK_IMPLIES(holder->IsJSProxy(), name()->IsPrivate());
+    DCHECK_IMPLIES(holder->IsJSProxy(isolate_), name()->IsPrivate(isolate_));
-    NameDictionary dictionary = holder->property_dictionary();
+    NameDictionary dictionary = holder->property_dictionary(isolate_);
    dictionary.ValueAtPut(dictionary_entry(), *value);
  }
 }
 template <bool is_element>
 bool LookupIterator::SkipInterceptor(JSObject holder) {
-  auto info = GetInterceptor<is_element>(holder);
+  InterceptorInfo info = GetInterceptor<is_element>(isolate_, holder);
-  if (!is_element && name_->IsSymbol() && !info.can_intercept_symbols()) {
+  if (!is_element && name_->IsSymbol(isolate_) &&
+      !info.can_intercept_symbols()) {
    return true;
  }
  if (info.non_masking()) {
@@ -1009,18 +1024,19 @@ bool LookupIterator::SkipInterceptor(JSObject holder) {
 JSReceiver LookupIterator::NextHolder(Map map) {
  DisallowHeapAllocation no_gc;
-  if (map.prototype() == ReadOnlyRoots(heap()).null_value()) {
+  if (map.prototype(isolate_) == ReadOnlyRoots(isolate_).null_value()) {
    return JSReceiver();
  }
  if (!check_prototype_chain() && !map.IsJSGlobalProxyMap()) {
    return JSReceiver();
  }
-  return JSReceiver::cast(map.prototype());
+  return JSReceiver::cast(map.prototype(isolate_));
 }
 LookupIterator::State LookupIterator::NotFound(JSReceiver const holder) const {
  DCHECK(!IsElement());
-  if (!holder.IsJSTypedArray() || !name_->IsString()) return NOT_FOUND;
+  if (!holder.IsJSTypedArray(isolate_) || !name_->IsString(isolate_))
+    return NOT_FOUND;
  return IsSpecialIndex(String::cast(*name_)) ? INTEGER_INDEXED_EXOTIC
                                              : NOT_FOUND;
 }
@@ -1042,27 +1058,27 @@ LookupIterator::State LookupIterator::LookupInSpecialHolder(
  switch (state_) {
    case NOT_FOUND:
      if (map.IsJSProxyMap()) {
-        if (is_element || !name_->IsPrivate()) return JSPROXY;
+        if (is_element || !name_->IsPrivate(isolate_)) return JSPROXY;
      }
      if (map.is_access_check_needed()) {
-        if (is_element || !name_->IsPrivate()) return ACCESS_CHECK;
+        if (is_element || !name_->IsPrivate(isolate_)) return ACCESS_CHECK;
      }
      V8_FALLTHROUGH;
    case ACCESS_CHECK:
      if (check_interceptor() && HasInterceptor<is_element>(map) &&
          !SkipInterceptor<is_element>(JSObject::cast(holder))) {
-        if (is_element || !name_->IsPrivate()) return INTERCEPTOR;
+        if (is_element || !name_->IsPrivate(isolate_)) return INTERCEPTOR;
      }
      V8_FALLTHROUGH;
    case INTERCEPTOR:
      if (!is_element && map.IsJSGlobalObjectMap()) {
        GlobalDictionary dict =
-            JSGlobalObject::cast(holder).global_dictionary();
+            JSGlobalObject::cast(holder).global_dictionary(isolate_);
        int number = dict.FindEntry(isolate(), name_);
        if (number == GlobalDictionary::kNotFound) return NOT_FOUND;
        number_ = static_cast<uint32_t>(number);
-        PropertyCell cell = dict.CellAt(number_);
+        PropertyCell cell = dict.CellAt(isolate_, number_);
-        if (cell.value().IsTheHole(isolate_)) return NOT_FOUND;
+        if (cell.value(isolate_).IsTheHole(isolate_)) return NOT_FOUND;
        property_details_ = cell.property_details();
        has_property_ = true;
        switch (property_details_.kind()) {
@@ -1094,12 +1110,13 @@ LookupIterator::State LookupIterator::LookupInRegularHolder(
  if (is_element) {
    JSObject js_object = JSObject::cast(holder);
-    ElementsAccessor* accessor = js_object.GetElementsAccessor();
+    ElementsAccessor* accessor = js_object.GetElementsAccessor(isolate_);
-    FixedArrayBase backing_store = js_object.elements();
+    FixedArrayBase backing_store = js_object.elements(isolate_);
    number_ =
        accessor->GetEntryForIndex(isolate_, js_object, backing_store, index_);
    if (number_ == kMaxUInt32) {
-      return holder.IsJSTypedArray() ? INTEGER_INDEXED_EXOTIC : NOT_FOUND;
+      return holder.IsJSTypedArray(isolate_) ? INTEGER_INDEXED_EXOTIC
+                                             : NOT_FOUND;
    }
    property_details_ = accessor->GetDetails(js_object, number_);
    if (map.has_frozen_or_sealed_elements()) {
@@ -1107,14 +1124,14 @@ LookupIterator::State LookupIterator::LookupInRegularHolder(
      property_details_ = property_details_.CopyAddAttributes(attrs);
    }
  } else if (!map.is_dictionary_map()) {
-    DescriptorArray descriptors = map.instance_descriptors();
+    DescriptorArray descriptors = map.instance_descriptors(isolate_);
    int number = descriptors.SearchWithCache(isolate_, *name_, map);
    if (number == DescriptorArray::kNotFound) return NotFound(holder);
    number_ = static_cast<uint32_t>(number);
    property_details_ = descriptors.GetDetails(number_);
  } else {
-    DCHECK_IMPLIES(holder.IsJSProxy(), name()->IsPrivate());
+    DCHECK_IMPLIES(holder.IsJSProxy(isolate_), name()->IsPrivate(isolate_));
-    NameDictionary dict = holder.property_dictionary();
+    NameDictionary dict = holder.property_dictionary(isolate_);
    int number = dict.FindEntry(isolate(), name_);
    if (number == NameDictionary::kNotFound) return NotFound(holder);
    number_ = static_cast<uint32_t>(number);
@@ -1149,15 +1166,15 @@ Handle<InterceptorInfo> LookupIterator::GetInterceptorForFailedAccessCheck()
 bool LookupIterator::TryLookupCachedProperty() {
  return state() == LookupIterator::ACCESSOR &&
-         GetAccessors()->IsAccessorPair() && LookupCachedProperty();
+         GetAccessors()->IsAccessorPair(isolate_) && LookupCachedProperty();
 }
 bool LookupIterator::LookupCachedProperty() {
  DCHECK_EQ(state(), LookupIterator::ACCESSOR);
-  DCHECK(GetAccessors()->IsAccessorPair());
+  DCHECK(GetAccessors()->IsAccessorPair(isolate_));
  AccessorPair accessor_pair = AccessorPair::cast(*GetAccessors());
-  Handle<Object> getter(accessor_pair.getter(), isolate());
+  Handle<Object> getter(accessor_pair.getter(isolate_), isolate());
  MaybeHandle<Name> maybe_name =
      FunctionTemplateInfo::TryGetCachedPropertyName(isolate(), getter);
  if (maybe_name.is_null()) return false;

--- a/src/objects/lookup.h
+++ b/src/objects/lookup.h
@@ -235,7 +235,8 @@ class V8_EXPORT_PRIVATE LookupIterator final {
  template <bool is_element>
  bool SkipInterceptor(JSObject holder);
  template <bool is_element>
-  static inline InterceptorInfo GetInterceptor(JSObject holder);
+  static inline InterceptorInfo GetInterceptor(Isolate* isolate,
+                                               JSObject holder);
  bool check_interceptor() const {
    return (configuration_ & kInterceptor) != 0;
@@ -243,7 +244,8 @@ class V8_EXPORT_PRIVATE LookupIterator final {
  inline int descriptor_number() const;
  inline int dictionary_entry() const;
-  static inline Configuration ComputeConfiguration(Configuration configuration,
+  static inline Configuration ComputeConfiguration(Isolate* isolate,
+                                                   Configuration configuration,
                                                   Handle<Name> name);
  static Handle<JSReceiver> GetRootForNonJSReceiver(

--- a/src/objects/map-inl.h
+++ b/src/objects/map-inl.h
@@ -92,16 +92,16 @@ BIT_FIELD_ACCESSORS(Map, bit_field3, may_have_interesting_symbols,
 BIT_FIELD_ACCESSORS(Map, bit_field3, construction_counter,
                    Map::ConstructionCounterBits)
-InterceptorInfo Map::GetNamedInterceptor() {
+DEF_GETTER(Map, GetNamedInterceptor, InterceptorInfo) {
  DCHECK(has_named_interceptor());
-  FunctionTemplateInfo info = GetFunctionTemplateInfo();
+  FunctionTemplateInfo info = GetFunctionTemplateInfo(isolate);
-  return InterceptorInfo::cast(info.GetNamedPropertyHandler());
+  return InterceptorInfo::cast(info.GetNamedPropertyHandler(isolate));
 }
-InterceptorInfo Map::GetIndexedInterceptor() {
+DEF_GETTER(Map, GetIndexedInterceptor, InterceptorInfo) {
  DCHECK(has_indexed_interceptor());
-  FunctionTemplateInfo info = GetFunctionTemplateInfo();
+  FunctionTemplateInfo info = GetFunctionTemplateInfo(isolate);
-  return InterceptorInfo::cast(info.GetIndexedPropertyHandler());
+  return InterceptorInfo::cast(info.GetIndexedPropertyHandler(isolate));
 }
 bool Map::IsMostGeneralFieldType(Representation representation,

--- a/src/objects/map.cc
+++ b/src/objects/map.cc
@@ -481,7 +481,7 @@ MaybeHandle<Map> Map::CopyWithConstant(Isolate* isolate, Handle<Map> map,
    return MaybeHandle<Map>();
  }
-  Representation representation = constant->OptimalRepresentation();
+  Representation representation = constant->OptimalRepresentation(isolate);
  Handle<FieldType> type = constant->OptimalType(isolate, representation);
  return CopyWithField(isolate, map, name, type, attributes,
                       PropertyConstness::kConst, representation, flag);
@@ -616,7 +616,8 @@ void Map::DeprecateTransitionTree(Isolate* isolate) {
 void Map::ReplaceDescriptors(Isolate* isolate, DescriptorArray new_descriptors,
                             LayoutDescriptor new_layout_descriptor) {
  // Don't overwrite the empty descriptor array or initial map's descriptors.
-  if (NumberOfOwnDescriptors() == 0 || GetBackPointer().IsUndefined(isolate)) {
+  if (NumberOfOwnDescriptors() == 0 ||
+      GetBackPointer(isolate).IsUndefined(isolate)) {
    return;
  }
@@ -627,8 +628,8 @@ void Map::ReplaceDescriptors(Isolate* isolate, DescriptorArray new_descriptors,
  Map current = *this;
  MarkingBarrierForDescriptorArray(isolate->heap(), current, to_replace,
                                   to_replace.number_of_descriptors());
-  while (current.instance_descriptors() == to_replace) {
+  while (current.instance_descriptors(isolate) == to_replace) {
-    Object next = current.GetBackPointer();
+    Object next = current.GetBackPointer(isolate);
    if (next.IsUndefined(isolate)) break;  // Stop overwriting at initial map.
    current.SetEnumLength(kInvalidEnumCacheSentinel);
    current.UpdateDescriptors(isolate, new_descriptors, new_layout_descriptor,
@@ -641,7 +642,7 @@ void Map::ReplaceDescriptors(Isolate* isolate, DescriptorArray new_descriptors,
 Map Map::FindRootMap(Isolate* isolate) const {
  Map result = *this;
  while (true) {
-    Object back = result.GetBackPointer();
+    Object back = result.GetBackPointer(isolate);
    if (back.IsUndefined(isolate)) {
      // Initial map always owns descriptors and doesn't have unused entries
      // in the descriptor array.
@@ -656,10 +657,11 @@ Map Map::FindRootMap(Isolate* isolate) const {
 Map Map::FindFieldOwner(Isolate* isolate, int descriptor) const {
  DisallowHeapAllocation no_allocation;
-  DCHECK_EQ(kField, instance_descriptors().GetDetails(descriptor).location());
+  DCHECK_EQ(kField,
+            instance_descriptors(isolate).GetDetails(descriptor).location());
  Map result = *this;
  while (true) {
-    Object back = result.GetBackPointer();
+    Object back = result.GetBackPointer(isolate);
    if (back.IsUndefined(isolate)) break;
    const Map parent = Map::cast(back);
    if (parent.NumberOfOwnDescriptors() <= descriptor) break;
@@ -895,7 +897,7 @@ IntegrityLevelTransitionInfo DetectIntegrityLevelTransitions(
  // Figure out the most restrictive integrity level transition (it should
  // be the last one in the transition tree).
  DCHECK(!map.is_extensible());
-  Map previous = Map::cast(map.GetBackPointer());
+  Map previous = Map::cast(map.GetBackPointer(isolate));
  TransitionsAccessor last_transitions(isolate, previous, no_allocation);
  if (!last_transitions.HasIntegrityLevelTransitionTo(
          map, &(info.integrity_level_symbol), &(info.integrity_level))) {
@@ -913,7 +915,7 @@ IntegrityLevelTransitionInfo DetectIntegrityLevelTransitions(
  // transitions. If we encounter any non-integrity level transition interleaved
  // with integrity level transitions, just bail out.
  while (!source_map.is_extensible()) {
-    previous = Map::cast(source_map.GetBackPointer());
+    previous = Map::cast(source_map.GetBackPointer(isolate));
    TransitionsAccessor transitions(isolate, previous, no_allocation);
    if (!transitions.HasIntegrityLevelTransitionTo(source_map)) {
      return info;
@@ -2067,7 +2069,7 @@ Handle<Map> UpdateDescriptorForValue(Isolate* isolate, Handle<Map> map,
  PropertyAttributes attributes =
      map->instance_descriptors().GetDetails(descriptor).attributes();
-  Representation representation = value->OptimalRepresentation();
+  Representation representation = value->OptimalRepresentation(isolate);
  Handle<FieldType> type = value->OptimalType(isolate, representation);
  MapUpdater mu(isolate, map);
@@ -2126,7 +2128,7 @@ Handle<Map> Map::TransitionToDataProperty(Isolate* isolate, Handle<Map> map,
      isolate->bootstrapper()->IsActive() ? OMIT_TRANSITION : INSERT_TRANSITION;
  MaybeHandle<Map> maybe_map;
  if (!map->TooManyFastProperties(store_origin)) {
-    Representation representation = value->OptimalRepresentation();
+    Representation representation = value->OptimalRepresentation(isolate);
    Handle<FieldType> type = value->OptimalType(isolate, representation);
    maybe_map = Map::CopyWithField(isolate, map, name, type, attributes,
                                   constness, representation, flag);

--- a/src/objects/map.h
+++ b/src/objects/map.h
@@ -215,8 +215,8 @@ class Map : public HeapObject {
      Handle<Map> map, Handle<Context> native_context);
  // Retrieve interceptors.
-  inline InterceptorInfo GetNamedInterceptor();
+  DECL_GETTER(GetNamedInterceptor, InterceptorInfo)
-  inline InterceptorInfo GetIndexedInterceptor();
+  DECL_GETTER(GetIndexedInterceptor, InterceptorInfo)
  // Instance type.
  DECL_PRIMITIVE_ACCESSORS(instance_type, InstanceType)

--- a/src/objects/objects-inl.h
+++ b/src/objects/objects-inl.h
@@ -531,25 +531,28 @@ bool Object::FilterKey(PropertyFilter filter) {
  return false;
 }
-Representation Object::OptimalRepresentation() {
+Representation Object::OptimalRepresentation(Isolate* isolate) const {
  if (!FLAG_track_fields) return Representation::Tagged();
  if (IsSmi()) {
    return Representation::Smi();
-  } else if (FLAG_track_double_fields && IsHeapNumber()) {
+  }
+  HeapObject heap_object = HeapObject::cast(*this);
+  if (FLAG_track_double_fields && heap_object.IsHeapNumber(isolate)) {
    return Representation::Double();
-  } else if (FLAG_track_computed_fields && IsUninitialized()) {
+  } else if (FLAG_track_computed_fields &&
+             heap_object.IsUninitialized(
+                 heap_object.GetReadOnlyRoots(isolate))) {
    return Representation::None();
  } else if (FLAG_track_heap_object_fields) {
-    DCHECK(IsHeapObject());
    return Representation::HeapObject();
  } else {
    return Representation::Tagged();
  }
 }
-ElementsKind Object::OptimalElementsKind() {
+ElementsKind Object::OptimalElementsKind(Isolate* isolate) const {
  if (IsSmi()) return PACKED_SMI_ELEMENTS;
-  if (IsNumber()) return PACKED_DOUBLE_ELEMENTS;
+  if (IsNumber(isolate)) return PACKED_DOUBLE_ELEMENTS;
  return PACKED_ELEMENTS;
 }

--- a/src/objects/objects.h
+++ b/src/objects/objects.h
@@ -309,9 +309,9 @@ class Object : public TaggedImpl<HeapObjectReferenceType::STRONG, Address> {
  V8_EXPORT_PRIVATE bool ToInt32(int32_t* value);
  inline bool ToUint32(uint32_t* value) const;
-  inline Representation OptimalRepresentation();
+  inline Representation OptimalRepresentation(Isolate* isolate) const;
-  inline ElementsKind OptimalElementsKind();
+  inline ElementsKind OptimalElementsKind(Isolate* isolate) const;
  inline bool FitsRepresentation(Representation representation);

--- a/src/objects/property.cc
+++ b/src/objects/property.cc
@@ -75,9 +75,10 @@ Descriptor Descriptor::DataField(Handle<Name> key, int field_index,
 Descriptor Descriptor::DataConstant(Handle<Name> key, Handle<Object> value,
                                    PropertyAttributes attributes) {
+  Isolate* isolate = GetIsolateForPtrCompr(*key);
  return Descriptor(key, MaybeObjectHandle(value), kData, attributes,
                    kDescriptor, PropertyConstness::kConst,
-                    value->OptimalRepresentation(), 0);
+                    value->OptimalRepresentation(isolate), 0);
 }
 Descriptor Descriptor::DataConstant(Isolate* isolate, Handle<Name> key,

--- a/src/objects/templates-inl.h
+++ b/src/objects/templates-inl.h
@@ -55,7 +55,7 @@ SMI_ACCESSORS(FunctionTemplateInfo, flag, kFlagOffset)
 // static
 FunctionTemplateRareData FunctionTemplateInfo::EnsureFunctionTemplateRareData(
    Isolate* isolate, Handle<FunctionTemplateInfo> function_template_info) {
-  HeapObject extra = function_template_info->rare_data();
+  HeapObject extra = function_template_info->rare_data(isolate);
  if (extra.IsUndefined(isolate)) {
    return AllocateFunctionTemplateRareData(isolate, function_template_info);
  } else {
@@ -64,9 +64,9 @@ FunctionTemplateRareData FunctionTemplateInfo::EnsureFunctionTemplateRareData(
 }
 #define RARE_ACCESSORS(Name, CamelName, Type)                                 \
-  Type FunctionTemplateInfo::Get##CamelName() {                               \
+  DEF_GETTER(FunctionTemplateInfo, Get##CamelName, Type) {                    \
-    HeapObject extra = rare_data();                                           \
+    HeapObject extra = rare_data(isolate);                                    \
-    HeapObject undefined = GetReadOnlyRoots().undefined_value();              \
+    HeapObject undefined = GetReadOnlyRoots(isolate).undefined_value();       \
    return extra == undefined ? undefined                                     \
                              : FunctionTemplateRareData::cast(extra).Name(); \
  }                                                                           \

--- a/src/objects/templates.h
+++ b/src/objects/templates.h
@@ -86,7 +86,7 @@ class FunctionTemplateInfo : public TemplateInfo {
  DECL_ACCESSORS(rare_data, HeapObject)
 #define DECL_RARE_ACCESSORS(Name, CamelName, Type)                           \
-  inline Type Get##CamelName();                                              \
+  DECL_GETTER(Get##CamelName, Type)                                          \
  static inline void Set##CamelName(                                         \
      Isolate* isolate, Handle<FunctionTemplateInfo> function_template_info, \
      Handle<Type> Name);

--- a/src/objects/transitions-inl.h
+++ b/src/objects/transitions-inl.h
@@ -194,13 +194,13 @@ void TransitionsAccessor::Reload() {
 }
 void TransitionsAccessor::Initialize() {
-  raw_transitions_ = map_.raw_transitions();
+  raw_transitions_ = map_.raw_transitions(isolate_);
  HeapObject heap_object;
  if (raw_transitions_->IsSmi() || raw_transitions_->IsCleared()) {
    encoding_ = kUninitialized;
  } else if (raw_transitions_->IsWeak()) {
    encoding_ = kWeakRef;
-  } else if (raw_transitions_->GetHeapObjectIfStrong(&heap_object)) {
+  } else if (raw_transitions_->GetHeapObjectIfStrong(isolate_, &heap_object)) {
    if (heap_object.IsTransitionArray()) {
      encoding_ = kFullTransitionArray;
    } else if (heap_object.IsPrototypeInfo()) {

--- a/src/runtime/runtime-classes.cc
+++ b/src/runtime/runtime-classes.cc
@@ -332,7 +332,8 @@ bool AddDescriptorsByTemplate(
          value = GetMethodWithSharedNameAndSetHomeObject(isolate, args, value,
                                                          *receiver);
        }
-        details = details.CopyWithRepresentation(value.OptimalRepresentation());
+        details = details.CopyWithRepresentation(
+            value.OptimalRepresentation(isolate));
      } else {
        DCHECK_EQ(kAccessor, details.kind());
        if (value.IsAccessorPair()) {