[ptr-compr] Isolatify LookupIterator implementation and friends

Tbr: verwaest@chromium.org
Bug: v8:9353
Change-Id: I8164e2235ca43e203410277b86e6f166010c11d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687673Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62597}

src/ast/ast.cc

@@ -603,8 +603,8 @@ void ArrayLiteral::BuildBoilerplateDescription(Isolate* isolate) {
       boilerplate_value = handle(Smi::kZero, isolate);
     }
 
-    kind = GetMoreGeneralElementsKind(kind,
-                                      boilerplate_value->OptimalElementsKind());
+    kind = GetMoreGeneralElementsKind(
+        kind, boilerplate_value->OptimalElementsKind(isolate));
     fixed_array->set(array_index, *boilerplate_value);
   }
 

src/builtins/accessors.cc

@@ -306,7 +306,7 @@ Handle<AccessorInfo> Accessors::MakeStringLengthInfo(Isolate* isolate) {
 static Handle<Object> GetFunctionPrototype(Isolate* isolate,
                                            Handle<JSFunction> function) {
   if (!function->has_prototype()) {
-    Handle<Object> proto = isolate->factory()->NewFunctionPrototype(function);
+    Handle<JSObject> proto = isolate->factory()->NewFunctionPrototype(function);
     JSFunction::SetPrototype(function, proto);
   }
   return Handle<Object>(function->prototype(), isolate);

src/json/json-parser.cc

@@ -499,7 +499,7 @@ Handle<Object> JsonParser<Char>::BuildJsonObject(
     Representation expected_representation = details.representation();
 
     if (!value->FitsRepresentation(expected_representation)) {
-      Representation representation = value->OptimalRepresentation();
+      Representation representation = value->OptimalRepresentation(isolate());
       representation = representation.generalize(expected_representation);
       if (!expected_representation.CanBeInPlaceChangedTo(representation)) {
         map = ParentOfDescriptorOwner(isolate_, map, target, descriptor);

src/objects/arguments-inl.h

@@ -29,12 +29,14 @@ CAST_ACCESSOR(JSArgumentsObject)
 SMI_ACCESSORS(AliasedArgumentsEntry, aliased_context_slot,
               kAliasedContextSlotOffset)
 
-Context SloppyArgumentsElements::context() {
-  return Context::cast(get(kContextIndex));
+DEF_GETTER(SloppyArgumentsElements, context, Context) {
+  return TaggedField<Context>::load(isolate, *this,
+                                    OffsetOfElementAt(kContextIndex));
 }
 
-FixedArray SloppyArgumentsElements::arguments() {
-  return FixedArray::cast(get(kArgumentsIndex));
+DEF_GETTER(SloppyArgumentsElements, arguments, FixedArray) {
+  return TaggedField<FixedArray>::load(isolate, *this,
+                                       OffsetOfElementAt(kArgumentsIndex));
 }
 
 void SloppyArgumentsElements::set_arguments(FixedArray arguments) {

src/objects/arguments.h

@@ -102,8 +102,8 @@ class SloppyArgumentsElements : public FixedArray {
   static const int kArgumentsIndex = 1;
   static const uint32_t kParameterMapStart = 2;
 
-  inline Context context();
-  inline FixedArray arguments();
+  DECL_GETTER(context, Context)
+  DECL_GETTER(arguments, FixedArray)
   inline void set_arguments(FixedArray arguments);
   inline uint32_t parameter_map_length();
   inline Object get_mapped_entry(uint32_t entry);

src/objects/dictionary-inl.h

@@ -98,15 +98,27 @@ RootIndex GlobalDictionaryShape::GetMapRootIndex() {
   return RootIndex::kGlobalDictionaryMap;
 }
 
-Name NameDictionary::NameAt(int entry) { return Name::cast(KeyAt(entry)); }
+Name NameDictionary::NameAt(int entry) {
+  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  return NameAt(isolate, entry);
+}
+
+Name NameDictionary::NameAt(Isolate* isolate, int entry) {
+  return Name::cast(KeyAt(isolate, entry));
+}
 
 RootIndex NameDictionaryShape::GetMapRootIndex() {
   return RootIndex::kNameDictionaryMap;
 }
 
 PropertyCell GlobalDictionary::CellAt(int entry) {
-  DCHECK(KeyAt(entry).IsPropertyCell());
-  return PropertyCell::cast(KeyAt(entry));
+  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  return CellAt(isolate, entry);
+}
+
+PropertyCell GlobalDictionary::CellAt(Isolate* isolate, int entry) {
+  DCHECK(KeyAt(isolate, entry).IsPropertyCell(isolate));
+  return PropertyCell::cast(KeyAt(isolate, entry));
 }
 
 bool GlobalDictionaryShape::IsLive(ReadOnlyRoots roots, Object k) {
@@ -118,8 +130,23 @@ bool GlobalDictionaryShape::IsKey(ReadOnlyRoots roots, Object k) {
   return IsLive(roots, k) && !PropertyCell::cast(k).value().IsTheHole(roots);
 }
 
-Name GlobalDictionary::NameAt(int entry) { return CellAt(entry).name(); }
-Object GlobalDictionary::ValueAt(int entry) { return CellAt(entry).value(); }
+Name GlobalDictionary::NameAt(int entry) {
+  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  return NameAt(isolate, entry);
+}
+
+Name GlobalDictionary::NameAt(Isolate* isolate, int entry) {
+  return CellAt(isolate, entry).name(isolate);
+}
+
+Object GlobalDictionary::ValueAt(int entry) {
+  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  return ValueAt(isolate, entry);
+}
+
+Object GlobalDictionary::ValueAt(Isolate* isolate, int entry) {
+  return CellAt(isolate, entry).value(isolate);
+}
 
 void GlobalDictionary::SetEntry(Isolate* isolate, int entry, Object key,
                                 Object value, PropertyDetails details) {

src/objects/dictionary.h

@@ -212,6 +212,8 @@ class V8_EXPORT_PRIVATE NameDictionary
   static const int kInitialCapacity = 2;
 
   inline Name NameAt(int entry);
+  inline Name NameAt(Isolate* isolate, int entry);
+
   inline void set_hash(int hash);
   inline int hash() const;
 
@@ -250,10 +252,13 @@ class V8_EXPORT_PRIVATE GlobalDictionary
   DECL_CAST(GlobalDictionary)
 
   inline Object ValueAt(int entry);
+  inline Object ValueAt(Isolate* isolate, int entry);
   inline PropertyCell CellAt(int entry);
+  inline PropertyCell CellAt(Isolate* isolate, int entry);
   inline void SetEntry(Isolate* isolate, int entry, Object key, Object value,
                        PropertyDetails details);
   inline Name NameAt(int entry);
+  inline Name NameAt(Isolate* isolate, int entry);
   inline void ValueAtPut(int entry, Object value);
 
   OBJECT_CONSTRUCTORS(

src/objects/js-objects-inl.h

@@ -241,17 +241,16 @@ void JSObject::initialize_elements() {
   set_elements(elements, SKIP_WRITE_BARRIER);
 }
 
-InterceptorInfo JSObject::GetIndexedInterceptor() {
-  return map().GetIndexedInterceptor();
+DEF_GETTER(JSObject, GetIndexedInterceptor, InterceptorInfo) {
+  return map(isolate).GetIndexedInterceptor(isolate);
 }
 
-InterceptorInfo JSObject::GetNamedInterceptor() {
-  return map().GetNamedInterceptor();
+DEF_GETTER(JSObject, GetNamedInterceptor, InterceptorInfo) {
+  return map(isolate).GetNamedInterceptor(isolate);
 }
 
-int JSObject::GetHeaderSize() const { return GetHeaderSize(map()); }
-
-int JSObject::GetHeaderSize(const Map map) {
+// static
+int JSObject::GetHeaderSize(Map map) {
   // Check for the most common kind of JavaScript object before
   // falling into the generic switch. This speeds up the internal
   // field operations considerably on average.
@@ -262,7 +261,7 @@ int JSObject::GetHeaderSize(const Map map) {
 }
 
 // static
-int JSObject::GetEmbedderFieldsStartOffset(const Map map) {
+int JSObject::GetEmbedderFieldsStartOffset(Map map) {
   // Embedder fields are located after the object header.
   return GetHeaderSize(map);
 }
@@ -272,7 +271,7 @@ int JSObject::GetEmbedderFieldsStartOffset() {
 }
 
 // static
-int JSObject::GetEmbedderFieldCount(const Map map) {
+int JSObject::GetEmbedderFieldCount(Map map) {
   int instance_size = map.instance_size();
   if (instance_size == kVariableSizeSentinel) return 0;
   // Embedder fields are located after the object header, whereas in-object
@@ -626,7 +625,7 @@ void JSFunction::set_context(HeapObject value) {
   WRITE_BARRIER(*this, kContextOffset, value);
 }
 
-ACCESSORS_CHECKED(JSFunction, prototype_or_initial_map, Object,
+ACCESSORS_CHECKED(JSFunction, prototype_or_initial_map, HeapObject,
                   kPrototypeOrInitialMapOffset, map().has_prototype_slot())
 
 DEF_GETTER(JSFunction, has_prototype_slot, bool) {

src/objects/js-objects.cc

@@ -4597,22 +4597,22 @@ static ElementsKind BestFittingFastElementsKind(JSObject object) {
 void JSObject::AddDataElement(Handle<JSObject> object, uint32_t index,
                               Handle<Object> value,
                               PropertyAttributes attributes) {
-  DCHECK(object->map().is_extensible());
-
   Isolate* isolate = object->GetIsolate();
 
+  DCHECK(object->map(isolate).is_extensible());
+
   uint32_t old_length = 0;
   uint32_t new_capacity = 0;
 
-  if (object->IsJSArray()) {
+  if (object->IsJSArray(isolate)) {
     CHECK(JSArray::cast(*object).length().ToArrayLength(&old_length));
   }
 
-  ElementsKind kind = object->GetElementsKind();
-  FixedArrayBase elements = object->elements();
+  ElementsKind kind = object->GetElementsKind(isolate);
+  FixedArrayBase elements = object->elements(isolate);
   ElementsKind dictionary_kind = DICTIONARY_ELEMENTS;
   if (IsSloppyArgumentsElementsKind(kind)) {
-    elements = SloppyArgumentsElements::cast(elements).arguments();
+    elements = SloppyArgumentsElements::cast(elements).arguments(isolate);
     dictionary_kind = SLOW_SLOPPY_ARGUMENTS_ELEMENTS;
   } else if (IsStringWrapperElementsKind(kind)) {
     dictionary_kind = SLOW_STRING_WRAPPER_ELEMENTS;
@@ -4620,7 +4620,7 @@ void JSObject::AddDataElement(Handle<JSObject> object, uint32_t index,
 
   if (attributes != NONE) {
     kind = dictionary_kind;
-  } else if (elements.IsNumberDictionary()) {
+  } else if (elements.IsNumberDictionary(isolate)) {
     kind = ShouldConvertToFastElements(
                *object, NumberDictionary::cast(elements), index, &new_capacity)
                ? BestFittingFastElementsKind(*object)
@@ -4631,8 +4631,9 @@ void JSObject::AddDataElement(Handle<JSObject> object, uint32_t index,
     kind = dictionary_kind;
   }
 
-  ElementsKind to = value->OptimalElementsKind();
-  if (IsHoleyElementsKind(kind) || !object->IsJSArray() || index > old_length) {
+  ElementsKind to = value->OptimalElementsKind(isolate);
+  if (IsHoleyElementsKind(kind) || !object->IsJSArray(isolate) ||
+      index > old_length) {
     to = GetHoleyElementsKind(to);
     kind = GetHoleyElementsKind(kind);
   }
@@ -4640,7 +4641,7 @@ void JSObject::AddDataElement(Handle<JSObject> object, uint32_t index,
   ElementsAccessor* accessor = ElementsAccessor::ForKind(to);
   accessor->Add(object, index, value, attributes, new_capacity);
 
-  if (object->IsJSArray() && index >= old_length) {
+  if (object->IsJSArray(isolate) && index >= old_length) {
     Handle<Object> new_length =
         isolate->factory()->NewNumberFromUint(index + 1);
     JSArray::cast(*object).set_length(*new_length);

src/objects/js-objects.h

@@ -479,8 +479,8 @@ class JSObject : public JSReceiver {
                                                   int old_index, int new_index);
 
   // Retrieve interceptors.
-  inline InterceptorInfo GetNamedInterceptor();
-  inline InterceptorInfo GetIndexedInterceptor();
+  DECL_GETTER(GetNamedInterceptor, InterceptorInfo)
+  DECL_GETTER(GetIndexedInterceptor, InterceptorInfo)
 
   // Used from JSReceiver.
   V8_WARN_UNUSED_RESULT static Maybe<PropertyAttributes>
@@ -566,13 +566,12 @@ class JSObject : public JSReceiver {
   // JSFunction objects.
   static int GetHeaderSize(InstanceType instance_type,
                            bool function_has_prototype_slot = false);
-  static inline int GetHeaderSize(const Map map);
-  inline int GetHeaderSize() const;
+  static inline int GetHeaderSize(Map map);
 
-  static inline int GetEmbedderFieldsStartOffset(const Map map);
+  static inline int GetEmbedderFieldsStartOffset(Map map);
   inline int GetEmbedderFieldsStartOffset();
 
-  static inline int GetEmbedderFieldCount(const Map map);
+  static inline int GetEmbedderFieldCount(Map map);
   inline int GetEmbedderFieldCount() const;
   inline int GetEmbedderFieldOffset(int index);
   inline Object GetEmbedderField(int index);
@@ -962,7 +961,7 @@ class JSBoundFunction : public JSObject {
 class JSFunction : public JSObject {
  public:
   // [prototype_or_initial_map]:
-  DECL_ACCESSORS(prototype_or_initial_map, Object)
+  DECL_ACCESSORS(prototype_or_initial_map, HeapObject)
 
   // [shared]: The information about the function that
   // can be shared by instances.

src/objects/lookup-inl.h

@@ -31,7 +31,7 @@ LookupIterator::LookupIterator(Handle<Object> receiver, Handle<Name> name,
 LookupIterator::LookupIterator(Isolate* isolate, Handle<Object> receiver,
                                Handle<Name> name, Handle<JSReceiver> holder,
                                Configuration configuration)
-    : configuration_(ComputeConfiguration(configuration, name)),
+    : configuration_(ComputeConfiguration(isolate, configuration, name)),
       interceptor_state_(InterceptorState::kUninitialized),
       property_details_(PropertyDetails::Empty()),
       isolate_(isolate),
@@ -90,7 +90,7 @@ Handle<Name> LookupIterator::GetName() {
 }
 
 bool LookupIterator::is_dictionary_holder() const {
-  return !holder_->HasFastProperties();
+  return !holder_->HasFastProperties(isolate_);
 }
 
 Handle<Map> LookupIterator::transition_map() const {
@@ -111,23 +111,23 @@ Handle<T> LookupIterator::GetHolder() const {
 
 bool LookupIterator::ExtendingNonExtensible(Handle<JSReceiver> receiver) {
   DCHECK(receiver.is_identical_to(GetStoreTarget<JSReceiver>()));
-  return !receiver->map().is_extensible() &&
-         (IsElement() || !name_->IsPrivate());
+  return !receiver->map(isolate_).is_extensible() &&
+         (IsElement() || !name_->IsPrivate(isolate_));
 }
 
 bool LookupIterator::IsCacheableTransition() {
   DCHECK_EQ(TRANSITION, state_);
-  return transition_->IsPropertyCell() ||
+  return transition_->IsPropertyCell(isolate_) ||
          (transition_map()->is_dictionary_map() &&
-          !GetStoreTarget<JSReceiver>()->HasFastProperties()) ||
-         transition_map()->GetBackPointer().IsMap();
+          !GetStoreTarget<JSReceiver>()->HasFastProperties(isolate_)) ||
+         transition_map()->GetBackPointer(isolate_).IsMap(isolate_);
 }
 
 void LookupIterator::UpdateProtector() {
   if (IsElement()) return;
   // This list must be kept in sync with
   // CodeStubAssembler::CheckForAssociatedProtector!
-  ReadOnlyRoots roots(heap());
+  ReadOnlyRoots roots(isolate_);
   if (*name_ == roots.is_concat_spreadable_symbol() ||
       *name_ == roots.constructor_string() || *name_ == roots.next_string() ||
       *name_ == roots.species_symbol() || *name_ == roots.iterator_symbol() ||
@@ -139,52 +139,59 @@ void LookupIterator::UpdateProtector() {
 int LookupIterator::descriptor_number() const {
   DCHECK(!IsElement());
   DCHECK(has_property_);
-  DCHECK(holder_->HasFastProperties());
+  DCHECK(holder_->HasFastProperties(isolate_));
   return number_;
 }
 
 int LookupIterator::dictionary_entry() const {
   DCHECK(!IsElement());
   DCHECK(has_property_);
-  DCHECK(!holder_->HasFastProperties());
+  DCHECK(!holder_->HasFastProperties(isolate_));
   return number_;
 }
 
+// static
 LookupIterator::Configuration LookupIterator::ComputeConfiguration(
-    Configuration configuration, Handle<Name> name) {
-  return name->IsPrivate() ? OWN_SKIP_INTERCEPTOR : configuration;
+    Isolate* isolate, Configuration configuration, Handle<Name> name) {
+  return name->IsPrivate(isolate) ? OWN_SKIP_INTERCEPTOR : configuration;
 }
 
+// static
 Handle<JSReceiver> LookupIterator::GetRoot(Isolate* isolate,
                                            Handle<Object> receiver,
                                            uint32_t index) {
-  if (receiver->IsJSReceiver()) return Handle<JSReceiver>::cast(receiver);
+  if (receiver->IsJSReceiver(isolate))
+    return Handle<JSReceiver>::cast(receiver);
   return GetRootForNonJSReceiver(isolate, receiver, index);
 }
 
 template <class T>
 Handle<T> LookupIterator::GetStoreTarget() const {
-  DCHECK(receiver_->IsJSReceiver());
-  if (receiver_->IsJSGlobalProxy()) {
-    HeapObject prototype = JSGlobalProxy::cast(*receiver_).map().prototype();
-    if (prototype.IsJSGlobalObject()) {
+  DCHECK(receiver_->IsJSReceiver(isolate_));
+  if (receiver_->IsJSGlobalProxy(isolate_)) {
+    HeapObject prototype =
+        JSGlobalProxy::cast(*receiver_).map(isolate_).prototype(isolate_);
+    if (prototype.IsJSGlobalObject(isolate_)) {
       return handle(JSGlobalObject::cast(prototype), isolate_);
     }
   }
   return Handle<T>::cast(receiver_);
 }
 
+// static
 template <bool is_element>
-InterceptorInfo LookupIterator::GetInterceptor(JSObject holder) {
-  return is_element ? holder.GetIndexedInterceptor()
-                    : holder.GetNamedInterceptor();
+InterceptorInfo LookupIterator::GetInterceptor(Isolate* isolate,
+                                               JSObject holder) {
+  return is_element ? holder.GetIndexedInterceptor(isolate)
+                    : holder.GetNamedInterceptor(isolate);
 }
 
 inline Handle<InterceptorInfo> LookupIterator::GetInterceptor() const {
   DCHECK_EQ(INTERCEPTOR, state_);
-  InterceptorInfo result =
-      IsElement() ? GetInterceptor<true>(JSObject::cast(*holder_))
-                  : GetInterceptor<false>(JSObject::cast(*holder_));
+  JSObject holder = JSObject::cast(*holder_);
+  InterceptorInfo result = IsElement()
+                               ? GetInterceptor<true>(isolate_, holder)
+                               : GetInterceptor<false>(isolate_, holder);
   return handle(result, isolate_);
 }
 

src/objects/lookup.cc

@@ -107,7 +107,7 @@ void LookupIterator::Start() {
   holder_ = initial_holder_;
 
   JSReceiver holder = *holder_;
-  Map map = holder.map();
+  Map map = holder.map(isolate_);
 
   state_ = LookupInHolder<is_element>(map, holder);
   if (IsFound()) return;
@@ -125,7 +125,7 @@ void LookupIterator::Next() {
   has_property_ = false;
 
   JSReceiver holder = *holder_;
-  Map map = holder.map();
+  Map map = holder.map(isolate_);
 
   if (map.IsSpecialReceiverMap()) {
     state_ = IsElement() ? LookupInSpecialHolder<true>(map, holder)
@@ -151,7 +151,7 @@ void LookupIterator::NextInternal(Map map, JSReceiver holder) {
       return;
     }
     holder = maybe_holder;
-    map = holder.map();
+    map = holder.map(isolate_);
     state_ = LookupInHolder<is_element>(map, holder);
   } while (!IsFound());
 
@@ -174,7 +174,7 @@ Handle<JSReceiver> LookupIterator::GetRootForNonJSReceiver(
     Isolate* isolate, Handle<Object> receiver, uint32_t index) {
   // Strings are the only objects with properties (only elements) directly on
   // the wrapper. Hence we can skip generating the wrapper for all other cases.
-  if (receiver->IsString() &&
+  if (receiver->IsString(isolate) &&
       index < static_cast<uint32_t>(String::cast(*receiver).length())) {
     // TODO(verwaest): Speed this up. Perhaps use a cached wrapper on the native
     // context, ensuring that we don't leak it into JS?
@@ -183,8 +183,8 @@ Handle<JSReceiver> LookupIterator::GetRootForNonJSReceiver(
     Handle<JSPrimitiveWrapper>::cast(result)->set_value(*receiver);
     return result;
   }
-  auto root =
-      handle(receiver->GetPrototypeChainRootMap(isolate).prototype(), isolate);
+  auto root = handle(
+      receiver->GetPrototypeChainRootMap(isolate).prototype(isolate), isolate);
   if (root->IsNull(isolate)) {
     isolate->PushStackTraceAndDie(reinterpret_cast<void*>(receiver->ptr()));
   }
@@ -192,8 +192,8 @@ Handle<JSReceiver> LookupIterator::GetRootForNonJSReceiver(
 }
 
 Handle<Map> LookupIterator::GetReceiverMap() const {
-  if (receiver_->IsNumber()) return factory()->heap_number_map();
-  return handle(Handle<HeapObject>::cast(receiver_)->map(), isolate_);
+  if (receiver_->IsNumber(isolate_)) return factory()->heap_number_map();
+  return handle(Handle<HeapObject>::cast(receiver_)->map(isolate_), isolate_);
 }
 
 bool LookupIterator::HasAccess() const {
@@ -206,8 +206,8 @@ template <bool is_element>
 void LookupIterator::ReloadPropertyInformation() {
   state_ = BEFORE_PROPERTY;
   interceptor_state_ = InterceptorState::kUninitialized;
-  state_ = LookupInHolder<is_element>(holder_->map(), *holder_);
-  DCHECK(IsFound() || !holder_->HasFastProperties());
+  state_ = LookupInHolder<is_element>(holder_->map(isolate_), *holder_);
+  DCHECK(IsFound() || !holder_->HasFastProperties(isolate_));
 }
 
 namespace {
@@ -221,7 +221,7 @@ bool IsTypedArrayFunctionInAnyContext(Isolate* isolate, JSReceiver holder) {
 #undef TYPED_ARRAY_CONTEXT_SLOTS
   };
 
-  if (!holder.IsJSFunction()) return false;
+  if (!holder.IsJSFunction(isolate)) return false;
 
   return std::any_of(
       std::begin(context_slots), std::end(context_slots),
@@ -233,7 +233,7 @@ bool IsTypedArrayFunctionInAnyContext(Isolate* isolate, JSReceiver holder) {
 void LookupIterator::InternalUpdateProtector() {
   if (isolate_->bootstrapper()->IsActive()) return;
 
-  ReadOnlyRoots roots(heap());
+  ReadOnlyRoots roots(isolate_);
   if (*name_ == roots.constructor_string()) {
     if (!isolate_->IsArraySpeciesLookupChainIntact() &&
         !isolate_->IsPromiseSpeciesLookupChainIntact() &&
@@ -242,26 +242,26 @@ void LookupIterator::InternalUpdateProtector() {
       return;
     }
     // Setting the constructor property could change an instance's @@species
-    if (holder_->IsJSArray()) {
+    if (holder_->IsJSArray(isolate_)) {
       if (!isolate_->IsArraySpeciesLookupChainIntact()) return;
       isolate_->CountUsage(
           v8::Isolate::UseCounterFeature::kArrayInstanceConstructorModified);
       isolate_->InvalidateArraySpeciesProtector();
       return;
-    } else if (holder_->IsJSPromise()) {
+    } else if (holder_->IsJSPromise(isolate_)) {
       if (!isolate_->IsPromiseSpeciesLookupChainIntact()) return;
       isolate_->InvalidatePromiseSpeciesProtector();
       return;
-    } else if (holder_->IsJSRegExp()) {
+    } else if (holder_->IsJSRegExp(isolate_)) {
       if (!isolate_->IsRegExpSpeciesLookupChainIntact()) return;
       isolate_->InvalidateRegExpSpeciesProtector();
       return;
-    } else if (holder_->IsJSTypedArray()) {
+    } else if (holder_->IsJSTypedArray(isolate_)) {
       if (!isolate_->IsTypedArraySpeciesLookupChainIntact()) return;
       isolate_->InvalidateTypedArraySpeciesProtector();
       return;
     }
-    if (holder_->map().is_prototype_map()) {
+    if (holder_->map(isolate_).is_prototype_map()) {
       DisallowHeapAllocation no_gc;
       // Setting the constructor of any prototype with the @@species protector
       // (of any realm) also needs to invalidate the protector.
@@ -283,7 +283,7 @@ void LookupIterator::InternalUpdateProtector() {
         if (!isolate_->IsRegExpSpeciesLookupChainIntact()) return;
         isolate_->InvalidateRegExpSpeciesProtector();
       } else if (isolate_->IsInAnyContext(
-                     holder_->map().prototype(),
+                     holder_->map(isolate_).prototype(isolate_),
                      Context::TYPED_ARRAY_PROTOTYPE_INDEX)) {
         if (!isolate_->IsTypedArraySpeciesLookupChainIntact()) return;
         isolate_->InvalidateTypedArraySpeciesProtector();
@@ -342,7 +342,7 @@ void LookupIterator::InternalUpdateProtector() {
     if (!isolate_->IsIsConcatSpreadableLookupChainIntact()) return;
     isolate_->InvalidateIsConcatSpreadableProtector();
   } else if (*name_ == roots.iterator_symbol()) {
-    if (holder_->IsJSArray()) {
+    if (holder_->IsJSArray(isolate_)) {
       if (!isolate_->IsArrayIteratorLookupChainIntact()) return;
       isolate_->InvalidateArrayIteratorProtector();
     } else if (isolate_->IsInAnyContext(
@@ -382,7 +382,7 @@ void LookupIterator::InternalUpdateProtector() {
     // to guard the fast-path in AsyncGeneratorResolve, where we can skip
     // the ResolvePromise step and go directly to FulfillPromise if we
     // know that the Object.prototype doesn't contain a "then" method.
-    if (holder_->IsJSPromise() ||
+    if (holder_->IsJSPromise(isolate_) ||
         isolate_->IsInAnyContext(*holder_,
                                  Context::INITIAL_OBJECT_PROTOTYPE_INDEX) ||
         isolate_->IsInAnyContext(*holder_, Context::PROMISE_PROTOTYPE_INDEX)) {
@@ -397,15 +397,16 @@ void LookupIterator::PrepareForDataProperty(Handle<Object> value) {
 
   Handle<JSReceiver> holder = GetHolder<JSReceiver>();
   // JSProxy does not have fast properties so we do an early return.
-  DCHECK_IMPLIES(holder->IsJSProxy(), !holder->HasFastProperties());
-  DCHECK_IMPLIES(holder->IsJSProxy(), name()->IsPrivate());
-  if (holder->IsJSProxy()) return;
+  DCHECK_IMPLIES(holder->IsJSProxy(isolate_),
+                 !holder->HasFastProperties(isolate_));
+  DCHECK_IMPLIES(holder->IsJSProxy(isolate_), name()->IsPrivate(isolate_));
+  if (holder->IsJSProxy(isolate_)) return;
 
   Handle<JSObject> holder_obj = Handle<JSObject>::cast(holder);
 
   if (IsElement()) {
-    ElementsKind kind = holder_obj->GetElementsKind();
-    ElementsKind to = value->OptimalElementsKind();
+    ElementsKind kind = holder_obj->GetElementsKind(isolate_);
+    ElementsKind to = value->OptimalElementsKind(isolate_);
     if (IsHoleyElementsKind(kind)) to = GetHoleyElementsKind(to);
     to = GetMoreGeneralElementsKind(kind, to);
 
@@ -420,17 +421,18 @@ void LookupIterator::PrepareForDataProperty(Handle<Object> value) {
     return;
   }
 
-  if (holder_obj->IsJSGlobalObject()) {
+  if (holder_obj->IsJSGlobalObject(isolate_)) {
     Handle<GlobalDictionary> dictionary(
-        JSGlobalObject::cast(*holder_obj).global_dictionary(), isolate());
-    Handle<PropertyCell> cell(dictionary->CellAt(dictionary_entry()),
+        JSGlobalObject::cast(*holder_obj).global_dictionary(isolate_),
+        isolate());
+    Handle<PropertyCell> cell(dictionary->CellAt(isolate_, dictionary_entry()),
                               isolate());
     property_details_ = cell->property_details();
     PropertyCell::PrepareForValue(isolate(), dictionary, dictionary_entry(),
                                   value, property_details_);
     return;
   }
-  if (!holder_obj->HasFastProperties()) return;
+  if (!holder_obj->HasFastProperties(isolate_)) return;
 
   PropertyConstness new_constness = PropertyConstness::kConst;
   if (constness() == PropertyConstness::kConst) {
@@ -441,7 +443,7 @@ void LookupIterator::PrepareForDataProperty(Handle<Object> value) {
       new_constness = PropertyConstness::kMutable;
   }
 
-  Handle<Map> old_map(holder_obj->map(), isolate_);
+  Handle<Map> old_map(holder_obj->map(isolate_), isolate_);
   DCHECK(!old_map->is_dictionary_map());
 
   Handle<Map> new_map = Map::Update(isolate_, old_map);
@@ -452,8 +454,8 @@ void LookupIterator::PrepareForDataProperty(Handle<Object> value) {
     if (old_map.is_identical_to(new_map)) {
       // Update the property details if the representation was None.
       if (constness() != new_constness || representation().IsNone()) {
-        property_details_ =
-            new_map->instance_descriptors().GetDetails(descriptor_number());
+        property_details_ = new_map->instance_descriptors(isolate_).GetDetails(
+            descriptor_number());
       }
       return;
     }
@@ -474,21 +476,21 @@ void LookupIterator::ReconfigureDataProperty(Handle<Object> value,
   Handle<JSReceiver> holder = GetHolder<JSReceiver>();
 
   // Property details can never change for private properties.
-  if (holder->IsJSProxy()) {
-    DCHECK(name()->IsPrivate());
+  if (holder->IsJSProxy(isolate_)) {
+    DCHECK(name()->IsPrivate(isolate_));
     return;
   }
 
   Handle<JSObject> holder_obj = Handle<JSObject>::cast(holder);
   if (IsElement()) {
-    DCHECK(!holder_obj->HasTypedArrayElements());
-    DCHECK(attributes != NONE || !holder_obj->HasFastElements());
-    Handle<FixedArrayBase> elements(holder_obj->elements(), isolate());
-    holder_obj->GetElementsAccessor()->Reconfigure(holder_obj, elements,
-                                                   number_, value, attributes);
+    DCHECK(!holder_obj->HasTypedArrayElements(isolate_));
+    DCHECK(attributes != NONE || !holder_obj->HasFastElements(isolate_));
+    Handle<FixedArrayBase> elements(holder_obj->elements(isolate_), isolate());
+    holder_obj->GetElementsAccessor(isolate_)->Reconfigure(
+        holder_obj, elements, number_, value, attributes);
     ReloadPropertyInformation<true>();
-  } else if (holder_obj->HasFastProperties()) {
-    Handle<Map> old_map(holder_obj->map(), isolate_);
+  } else if (holder_obj->HasFastProperties(isolate_)) {
+    Handle<Map> old_map(holder_obj->map(isolate_), isolate_);
     // Force mutable to avoid changing constant value by reconfiguring
     // kData -> kAccessor -> kData.
     Handle<Map> new_map = Map::ReconfigureExistingProperty(
@@ -505,27 +507,28 @@ void LookupIterator::ReconfigureDataProperty(Handle<Object> value,
     ReloadPropertyInformation<false>();
   }
 
-  if (!IsElement() && !holder_obj->HasFastProperties()) {
+  if (!IsElement() && !holder_obj->HasFastProperties(isolate_)) {
     PropertyDetails details(kData, attributes, PropertyCellType::kMutable);
-    if (holder_obj->map().is_prototype_map() &&
+    if (holder_obj->map(isolate_).is_prototype_map() &&
         (property_details_.attributes() & READ_ONLY) == 0 &&
         (attributes & READ_ONLY) != 0) {
       // Invalidate prototype validity cell when a property is reconfigured
       // from writable to read-only as this may invalidate transitioning store
       // IC handlers.
-      JSObject::InvalidatePrototypeChains(holder->map());
+      JSObject::InvalidatePrototypeChains(holder->map(isolate_));
     }
-    if (holder_obj->IsJSGlobalObject()) {
+    if (holder_obj->IsJSGlobalObject(isolate_)) {
       Handle<GlobalDictionary> dictionary(
-          JSGlobalObject::cast(*holder_obj).global_dictionary(), isolate());
+          JSGlobalObject::cast(*holder_obj).global_dictionary(isolate_),
+          isolate());
 
       Handle<PropertyCell> cell = PropertyCell::PrepareForValue(
           isolate(), dictionary, dictionary_entry(), value, details);
       cell->set_value(*value);
       property_details_ = cell->property_details();
     } else {
-      Handle<NameDictionary> dictionary(holder_obj->property_dictionary(),
-                                        isolate());
+      Handle<NameDictionary> dictionary(
+          holder_obj->property_dictionary(isolate_), isolate());
       PropertyDetails original_details =
           dictionary->DetailsAt(dictionary_entry());
       int enumeration_index = original_details.dictionary_index();
@@ -552,21 +555,21 @@ void LookupIterator::ReconfigureDataProperty(Handle<Object> value,
 void LookupIterator::PrepareTransitionToDataProperty(
     Handle<JSReceiver> receiver, Handle<Object> value,
     PropertyAttributes attributes, StoreOrigin store_origin) {
-  DCHECK_IMPLIES(receiver->IsJSProxy(), name()->IsPrivate());
+  DCHECK_IMPLIES(receiver->IsJSProxy(isolate_), name()->IsPrivate(isolate_));
   DCHECK(receiver.is_identical_to(GetStoreTarget<JSReceiver>()));
   if (state_ == TRANSITION) return;
 
-  if (!IsElement() && name()->IsPrivate()) {
+  if (!IsElement() && name()->IsPrivate(isolate_)) {
     attributes = static_cast<PropertyAttributes>(attributes | DONT_ENUM);
   }
 
   DCHECK(state_ != LookupIterator::ACCESSOR ||
-         (GetAccessors()->IsAccessorInfo() &&
+         (GetAccessors()->IsAccessorInfo(isolate_) &&
           AccessorInfo::cast(*GetAccessors()).is_special_data_property()));
   DCHECK_NE(INTEGER_INDEXED_EXOTIC, state_);
   DCHECK(state_ == NOT_FOUND || !HolderIsReceiverOrHiddenPrototype());
 
-  Handle<Map> map(receiver->map(), isolate_);
+  Handle<Map> map(receiver->map(isolate_), isolate_);
 
   // Dictionary maps can always have additional data properties.
   if (map->is_dictionary_map()) {
@@ -577,9 +580,9 @@ void LookupIterator::PrepareTransitionToDataProperty(
       int entry;
       Handle<PropertyCell> cell = JSGlobalObject::EnsureEmptyPropertyCell(
           global, name(), PropertyCellType::kUninitialized, &entry);
-      Handle<GlobalDictionary> dictionary(global->global_dictionary(),
+      Handle<GlobalDictionary> dictionary(global->global_dictionary(isolate_),
                                           isolate_);
-      DCHECK(cell->value().IsTheHole(isolate_));
+      DCHECK(cell->value(isolate_).IsTheHole(isolate_));
       DCHECK(!value->IsTheHole(isolate_));
       transition_ = cell;
       // Assign an enumeration index to the property and update
@@ -625,13 +628,14 @@ void LookupIterator::ApplyTransitionToDataProperty(
 
   DCHECK(receiver.is_identical_to(GetStoreTarget<JSReceiver>()));
   holder_ = receiver;
-  if (receiver->IsJSGlobalObject()) {
-    JSObject::InvalidatePrototypeChains(receiver->map());
+  if (receiver->IsJSGlobalObject(isolate_)) {
+    JSObject::InvalidatePrototypeChains(receiver->map(isolate_));
     state_ = DATA;
     return;
   }
   Handle<Map> transition = transition_map();
-  bool simple_transition = transition->GetBackPointer() == receiver->map();
+  bool simple_transition =
+      transition->GetBackPointer(isolate_) == receiver->map(isolate_);
 
   if (configuration_ == DEFAULT && !transition->is_dictionary_map() &&
       !transition->IsPrototypeValidityCellValid()) {
@@ -642,7 +646,7 @@ void LookupIterator::ApplyTransitionToDataProperty(
     transition->set_prototype_validity_cell(*validity_cell);
   }
 
-  if (!receiver->IsJSProxy()) {
+  if (!receiver->IsJSProxy(isolate_)) {
     JSObject::MigrateToMap(isolate_, Handle<JSObject>::cast(receiver),
                            transition);
   }
@@ -652,12 +656,13 @@ void LookupIterator::ApplyTransitionToDataProperty(
     number_ = static_cast<uint32_t>(number);
     property_details_ = transition->GetLastDescriptorDetails(isolate_);
     state_ = DATA;
-  } else if (receiver->map().is_dictionary_map()) {
-    Handle<NameDictionary> dictionary(receiver->property_dictionary(),
+  } else if (receiver->map(isolate_).is_dictionary_map()) {
+    Handle<NameDictionary> dictionary(receiver->property_dictionary(isolate_),
                                       isolate_);
     int entry;
-    if (receiver->map().is_prototype_map() && receiver->IsJSObject()) {
-      JSObject::InvalidatePrototypeChains(receiver->map());
+    if (receiver->map(isolate_).is_prototype_map() &&
+        receiver->IsJSObject(isolate_)) {
+      JSObject::InvalidatePrototypeChains(receiver->map(isolate_));
     }
     dictionary = NameDictionary::Add(isolate(), dictionary, name(),
                                      isolate_->factory()->uninitialized_value(),
@@ -678,11 +683,11 @@ void LookupIterator::Delete() {
   Handle<JSReceiver> holder = Handle<JSReceiver>::cast(holder_);
   if (IsElement()) {
     Handle<JSObject> object = Handle<JSObject>::cast(holder);
-    ElementsAccessor* accessor = object->GetElementsAccessor();
+    ElementsAccessor* accessor = object->GetElementsAccessor(isolate_);
     accessor->Delete(object, number_);
   } else {
-    DCHECK(!name()->IsPrivateName());
-    bool is_prototype_map = holder->map().is_prototype_map();
+    DCHECK(!name()->IsPrivateName(isolate_));
+    bool is_prototype_map = holder->map(isolate_).is_prototype_map();
     RuntimeCallTimerScope stats_scope(
         isolate_, is_prototype_map
                       ? RuntimeCallCounterId::kPrototypeObject_DeleteProperty
@@ -691,13 +696,13 @@ void LookupIterator::Delete() {
     PropertyNormalizationMode mode =
         is_prototype_map ? KEEP_INOBJECT_PROPERTIES : CLEAR_INOBJECT_PROPERTIES;
 
-    if (holder->HasFastProperties()) {
+    if (holder->HasFastProperties(isolate_)) {
       JSObject::NormalizeProperties(isolate_, Handle<JSObject>::cast(holder),
                                     mode, 0, "DeletingProperty");
       ReloadPropertyInformation<false>();
     }
     JSReceiver::DeleteNormalizedProperty(holder, number_);
-    if (holder->IsJSObject()) {
+    if (holder->IsJSObject(isolate_)) {
       JSObject::ReoptimizeIfPrototype(Handle<JSObject>::cast(holder));
     }
   }
@@ -712,12 +717,12 @@ void LookupIterator::TransitionToAccessorProperty(
   // handled via a trap. Adding properties to primitive values is not
   // observable.
   Handle<JSObject> receiver = GetStoreTarget<JSObject>();
-  if (!IsElement() && name()->IsPrivate()) {
+  if (!IsElement() && name()->IsPrivate(isolate_)) {
     attributes = static_cast<PropertyAttributes>(attributes | DONT_ENUM);
   }
 
-  if (!IsElement() && !receiver->map().is_dictionary_map()) {
-    Handle<Map> old_map(receiver->map(), isolate_);
+  if (!IsElement() && !receiver->map(isolate_).is_dictionary_map()) {
+    Handle<Map> old_map(receiver->map(isolate_), isolate_);
 
     if (!holder_.is_identical_to(receiver)) {
       holder_ = receiver;
@@ -730,7 +735,8 @@ void LookupIterator::TransitionToAccessorProperty(
 
     Handle<Map> new_map = Map::TransitionToAccessorProperty(
         isolate_, old_map, name_, descriptor, getter, setter, attributes);
-    bool simple_transition = new_map->GetBackPointer() == receiver->map();
+    bool simple_transition =
+        new_map->GetBackPointer(isolate_) == receiver->map(isolate_);
     JSObject::MigrateToMap(isolate_, receiver, new_map);
 
     if (simple_transition) {
@@ -746,7 +752,7 @@ void LookupIterator::TransitionToAccessorProperty(
   }
 
   Handle<AccessorPair> pair;
-  if (state() == ACCESSOR && GetAccessors()->IsAccessorPair()) {
+  if (state() == ACCESSOR && GetAccessors()->IsAccessorPair(isolate_)) {
     pair = Handle<AccessorPair>::cast(GetAccessors());
     // If the component and attributes are identical, nothing has to be done.
     if (pair->Equals(*getter, *setter)) {
@@ -788,13 +794,14 @@ void LookupIterator::TransitionToAccessorPair(Handle<Object> pair,
                                        receiver, details);
     receiver->RequireSlowElements(*dictionary);
 
-    if (receiver->HasSlowArgumentsElements()) {
-      FixedArray parameter_map = FixedArray::cast(receiver->elements());
+    if (receiver->HasSlowArgumentsElements(isolate_)) {
+      FixedArray parameter_map = FixedArray::cast(receiver->elements(isolate_));
       uint32_t length = parameter_map.length() - 2;
       if (number_ < length) {
-        parameter_map.set(number_ + 2, ReadOnlyRoots(heap()).the_hole_value());
+        parameter_map.set(number_ + 2,
+                          ReadOnlyRoots(isolate_).the_hole_value());
       }
-      FixedArray::cast(receiver->elements()).set(1, *dictionary);
+      FixedArray::cast(receiver->elements(isolate_)).set(1, *dictionary);
     } else {
       receiver->set_elements(*dictionary);
     }
@@ -802,8 +809,8 @@ void LookupIterator::TransitionToAccessorPair(Handle<Object> pair,
     ReloadPropertyInformation<true>();
   } else {
     PropertyNormalizationMode mode = CLEAR_INOBJECT_PROPERTIES;
-    if (receiver->map().is_prototype_map()) {
-      JSObject::InvalidatePrototypeChains(receiver->map());
+    if (receiver->map(isolate_).is_prototype_map()) {
+      JSObject::InvalidatePrototypeChains(receiver->map(isolate_));
       mode = KEEP_INOBJECT_PROPERTIES;
     }
 
@@ -830,48 +837,53 @@ bool LookupIterator::HolderIsReceiverOrHiddenPrototype() const {
   // Optimization that only works if configuration_ is not mutable.
   if (!check_prototype_chain()) return true;
   if (*receiver_ == *holder_) return true;
-  if (!receiver_->IsJSGlobalProxy()) return false;
-  return Handle<JSGlobalProxy>::cast(receiver_)->map().prototype() == *holder_;
+  if (!receiver_->IsJSGlobalProxy(isolate_)) return false;
+  return Handle<JSGlobalProxy>::cast(receiver_)->map(isolate_).prototype(
+             isolate_) == *holder_;
 }
 
 Handle<Object> LookupIterator::FetchValue() const {
   Object result;
   if (IsElement()) {
     Handle<JSObject> holder = GetHolder<JSObject>();
-    ElementsAccessor* accessor = holder->GetElementsAccessor();
+    ElementsAccessor* accessor = holder->GetElementsAccessor(isolate_);
     return accessor->Get(holder, number_);
-  } else if (holder_->IsJSGlobalObject()) {
+  } else if (holder_->IsJSGlobalObject(isolate_)) {
     Handle<JSGlobalObject> holder = GetHolder<JSGlobalObject>();
-    result = holder->global_dictionary().ValueAt(number_);
-  } else if (!holder_->HasFastProperties()) {
-    result = holder_->property_dictionary().ValueAt(number_);
+    result = holder->global_dictionary(isolate_).ValueAt(isolate_, number_);
+  } else if (!holder_->HasFastProperties(isolate_)) {
+    result = holder_->property_dictionary(isolate_).ValueAt(isolate_, number_);
   } else if (property_details_.location() == kField) {
     DCHECK_EQ(kData, property_details_.kind());
     Handle<JSObject> holder = GetHolder<JSObject>();
-    FieldIndex field_index = FieldIndex::ForDescriptor(holder->map(), number_);
+    FieldIndex field_index =
+        FieldIndex::ForDescriptor(holder->map(isolate_), number_);
     return JSObject::FastPropertyAt(holder, property_details_.representation(),
                                     field_index);
   } else {
-    result = holder_->map().instance_descriptors().GetStrongValue(number_);
+    result =
+        holder_->map(isolate_).instance_descriptors(isolate_).GetStrongValue(
+            isolate_, number_);
   }
   return handle(result, isolate_);
 }
 
 bool LookupIterator::IsConstFieldValueEqualTo(Object value) const {
   DCHECK(!IsElement());
-  DCHECK(holder_->HasFastProperties());
+  DCHECK(holder_->HasFastProperties(isolate_));
   DCHECK_EQ(kField, property_details_.location());
   DCHECK_EQ(PropertyConstness::kConst, property_details_.constness());
   Handle<JSObject> holder = GetHolder<JSObject>();
-  FieldIndex field_index = FieldIndex::ForDescriptor(holder->map(), number_);
+  FieldIndex field_index =
+      FieldIndex::ForDescriptor(holder->map(isolate_), number_);
   if (property_details_.representation().IsDouble()) {
-    if (!value.IsNumber()) return false;
+    if (!value.IsNumber(isolate_)) return false;
     uint64_t bits;
-    if (holder->IsUnboxedDoubleField(field_index)) {
+    if (holder->IsUnboxedDoubleField(isolate_, field_index)) {
       bits = holder->RawFastDoublePropertyAsBitsAt(field_index);
     } else {
-      Object current_value = holder->RawFastPropertyAt(field_index);
-      DCHECK(current_value.IsMutableHeapNumber());
+      Object current_value = holder->RawFastPropertyAt(isolate_, field_index);
+      DCHECK(current_value.IsMutableHeapNumber(isolate_));
       bits = MutableHeapNumber::cast(current_value).value_as_bits();
     }
     // Use bit representation of double to to check for hole double, since
@@ -885,11 +897,11 @@ bool LookupIterator::IsConstFieldValueEqualTo(Object value) const {
     }
     return Object::SameNumberValue(bit_cast<double>(bits), value.Number());
   } else {
-    Object current_value = holder->RawFastPropertyAt(field_index);
+    Object current_value = holder->RawFastPropertyAt(isolate_, field_index);
     if (current_value.IsUninitialized(isolate()) || current_value == value) {
       return true;
     }
-    return current_value.IsNumber() && value.IsNumber() &&
+    return current_value.IsNumber(isolate_) && value.IsNumber(isolate_) &&
            Object::SameNumberValue(current_value.Number(), value.Number());
   }
 }
@@ -904,7 +916,7 @@ int LookupIterator::GetFieldDescriptorIndex() const {
 
 int LookupIterator::GetAccessorIndex() const {
   DCHECK(has_property_);
-  DCHECK(holder_->HasFastProperties());
+  DCHECK(holder_->HasFastProperties(isolate_));
   DCHECK_EQ(kDescriptor, property_details_.location());
   DCHECK_EQ(kAccessor, property_details_.kind());
   return descriptor_number();
@@ -912,35 +924,37 @@ int LookupIterator::GetAccessorIndex() const {
 
 Handle<Map> LookupIterator::GetFieldOwnerMap() const {
   DCHECK(has_property_);
-  DCHECK(holder_->HasFastProperties());
+  DCHECK(holder_->HasFastProperties(isolate_));
   DCHECK_EQ(kField, property_details_.location());
   DCHECK(!IsElement());
-  Map holder_map = holder_->map();
+  Map holder_map = holder_->map(isolate_);
   return handle(holder_map.FindFieldOwner(isolate(), descriptor_number()),
                 isolate_);
 }
 
 FieldIndex LookupIterator::GetFieldIndex() const {
   DCHECK(has_property_);
-  DCHECK(holder_->HasFastProperties());
+  DCHECK(holder_->HasFastProperties(isolate_));
   DCHECK_EQ(kField, property_details_.location());
   DCHECK(!IsElement());
-  return FieldIndex::ForDescriptor(holder_->map(), descriptor_number());
+  return FieldIndex::ForDescriptor(holder_->map(isolate_), descriptor_number());
 }
 
 Handle<FieldType> LookupIterator::GetFieldType() const {
   DCHECK(has_property_);
-  DCHECK(holder_->HasFastProperties());
+  DCHECK(holder_->HasFastProperties(isolate_));
   DCHECK_EQ(kField, property_details_.location());
   return handle(
-      holder_->map().instance_descriptors().GetFieldType(descriptor_number()),
+      holder_->map(isolate_).instance_descriptors(isolate_).GetFieldType(
+          isolate_, descriptor_number()),
       isolate_);
 }
 
 Handle<PropertyCell> LookupIterator::GetPropertyCell() const {
   DCHECK(!IsElement());
   Handle<JSGlobalObject> holder = GetHolder<JSGlobalObject>();
-  return handle(holder->global_dictionary().CellAt(dictionary_entry()),
+  return handle(
+      holder->global_dictionary(isolate_).CellAt(isolate_, dictionary_entry()),
       isolate_);
 }
 
@@ -961,9 +975,9 @@ void LookupIterator::WriteDataValue(Handle<Object> value,
   Handle<JSReceiver> holder = GetHolder<JSReceiver>();
   if (IsElement()) {
     Handle<JSObject> object = Handle<JSObject>::cast(holder);
-    ElementsAccessor* accessor = object->GetElementsAccessor();
+    ElementsAccessor* accessor = object->GetElementsAccessor(isolate_);
     accessor->Set(object, number_, *value);
-  } else if (holder->HasFastProperties()) {
+  } else if (holder->HasFastProperties(isolate_)) {
     if (property_details_.location() == kField) {
       // Check that in case of VariableMode::kConst field the existing value is
       // equal to |value|.
@@ -976,21 +990,22 @@ void LookupIterator::WriteDataValue(Handle<Object> value,
       DCHECK_EQ(kDescriptor, property_details_.location());
       DCHECK_EQ(PropertyConstness::kConst, property_details_.constness());
     }
-  } else if (holder->IsJSGlobalObject()) {
+  } else if (holder->IsJSGlobalObject(isolate_)) {
     GlobalDictionary dictionary =
-        JSGlobalObject::cast(*holder).global_dictionary();
-    dictionary.CellAt(dictionary_entry()).set_value(*value);
+        JSGlobalObject::cast(*holder).global_dictionary(isolate_);
+    dictionary.CellAt(isolate_, dictionary_entry()).set_value(*value);
   } else {
-    DCHECK_IMPLIES(holder->IsJSProxy(), name()->IsPrivate());
-    NameDictionary dictionary = holder->property_dictionary();
+    DCHECK_IMPLIES(holder->IsJSProxy(isolate_), name()->IsPrivate(isolate_));
+    NameDictionary dictionary = holder->property_dictionary(isolate_);
     dictionary.ValueAtPut(dictionary_entry(), *value);
   }
 }
 
 template <bool is_element>
 bool LookupIterator::SkipInterceptor(JSObject holder) {
-  auto info = GetInterceptor<is_element>(holder);
-  if (!is_element && name_->IsSymbol() && !info.can_intercept_symbols()) {
+  InterceptorInfo info = GetInterceptor<is_element>(isolate_, holder);
+  if (!is_element && name_->IsSymbol(isolate_) &&
+      !info.can_intercept_symbols()) {
     return true;
   }
   if (info.non_masking()) {
@@ -1009,18 +1024,19 @@ bool LookupIterator::SkipInterceptor(JSObject holder) {
 
 JSReceiver LookupIterator::NextHolder(Map map) {
   DisallowHeapAllocation no_gc;
-  if (map.prototype() == ReadOnlyRoots(heap()).null_value()) {
+  if (map.prototype(isolate_) == ReadOnlyRoots(isolate_).null_value()) {
     return JSReceiver();
   }
   if (!check_prototype_chain() && !map.IsJSGlobalProxyMap()) {
     return JSReceiver();
   }
-  return JSReceiver::cast(map.prototype());
+  return JSReceiver::cast(map.prototype(isolate_));
 }
 
 LookupIterator::State LookupIterator::NotFound(JSReceiver const holder) const {
   DCHECK(!IsElement());
-  if (!holder.IsJSTypedArray() || !name_->IsString()) return NOT_FOUND;
+  if (!holder.IsJSTypedArray(isolate_) || !name_->IsString(isolate_))
+    return NOT_FOUND;
   return IsSpecialIndex(String::cast(*name_)) ? INTEGER_INDEXED_EXOTIC
                                               : NOT_FOUND;
 }
@@ -1042,27 +1058,27 @@ LookupIterator::State LookupIterator::LookupInSpecialHolder(
   switch (state_) {
     case NOT_FOUND:
       if (map.IsJSProxyMap()) {
-        if (is_element || !name_->IsPrivate()) return JSPROXY;
+        if (is_element || !name_->IsPrivate(isolate_)) return JSPROXY;
       }
       if (map.is_access_check_needed()) {
-        if (is_element || !name_->IsPrivate()) return ACCESS_CHECK;
+        if (is_element || !name_->IsPrivate(isolate_)) return ACCESS_CHECK;
       }
       V8_FALLTHROUGH;
     case ACCESS_CHECK:
       if (check_interceptor() && HasInterceptor<is_element>(map) &&
           !SkipInterceptor<is_element>(JSObject::cast(holder))) {
-        if (is_element || !name_->IsPrivate()) return INTERCEPTOR;
+        if (is_element || !name_->IsPrivate(isolate_)) return INTERCEPTOR;
       }
       V8_FALLTHROUGH;
     case INTERCEPTOR:
       if (!is_element && map.IsJSGlobalObjectMap()) {
         GlobalDictionary dict =
-            JSGlobalObject::cast(holder).global_dictionary();
+            JSGlobalObject::cast(holder).global_dictionary(isolate_);
         int number = dict.FindEntry(isolate(), name_);
         if (number == GlobalDictionary::kNotFound) return NOT_FOUND;
         number_ = static_cast<uint32_t>(number);
-        PropertyCell cell = dict.CellAt(number_);
-        if (cell.value().IsTheHole(isolate_)) return NOT_FOUND;
+        PropertyCell cell = dict.CellAt(isolate_, number_);
+        if (cell.value(isolate_).IsTheHole(isolate_)) return NOT_FOUND;
         property_details_ = cell.property_details();
         has_property_ = true;
         switch (property_details_.kind()) {
@@ -1094,12 +1110,13 @@ LookupIterator::State LookupIterator::LookupInRegularHolder(
 
   if (is_element) {
     JSObject js_object = JSObject::cast(holder);
-    ElementsAccessor* accessor = js_object.GetElementsAccessor();
-    FixedArrayBase backing_store = js_object.elements();
+    ElementsAccessor* accessor = js_object.GetElementsAccessor(isolate_);
+    FixedArrayBase backing_store = js_object.elements(isolate_);
     number_ =
         accessor->GetEntryForIndex(isolate_, js_object, backing_store, index_);
     if (number_ == kMaxUInt32) {
-      return holder.IsJSTypedArray() ? INTEGER_INDEXED_EXOTIC : NOT_FOUND;
+      return holder.IsJSTypedArray(isolate_) ? INTEGER_INDEXED_EXOTIC
+                                             : NOT_FOUND;
     }
     property_details_ = accessor->GetDetails(js_object, number_);
     if (map.has_frozen_or_sealed_elements()) {
@@ -1107,14 +1124,14 @@ LookupIterator::State LookupIterator::LookupInRegularHolder(
       property_details_ = property_details_.CopyAddAttributes(attrs);
     }
   } else if (!map.is_dictionary_map()) {
-    DescriptorArray descriptors = map.instance_descriptors();
+    DescriptorArray descriptors = map.instance_descriptors(isolate_);
     int number = descriptors.SearchWithCache(isolate_, *name_, map);
     if (number == DescriptorArray::kNotFound) return NotFound(holder);
     number_ = static_cast<uint32_t>(number);
     property_details_ = descriptors.GetDetails(number_);
   } else {
-    DCHECK_IMPLIES(holder.IsJSProxy(), name()->IsPrivate());
-    NameDictionary dict = holder.property_dictionary();
+    DCHECK_IMPLIES(holder.IsJSProxy(isolate_), name()->IsPrivate(isolate_));
+    NameDictionary dict = holder.property_dictionary(isolate_);
     int number = dict.FindEntry(isolate(), name_);
     if (number == NameDictionary::kNotFound) return NotFound(holder);
     number_ = static_cast<uint32_t>(number);
@@ -1149,15 +1166,15 @@ Handle<InterceptorInfo> LookupIterator::GetInterceptorForFailedAccessCheck()
 
 bool LookupIterator::TryLookupCachedProperty() {
   return state() == LookupIterator::ACCESSOR &&
-         GetAccessors()->IsAccessorPair() && LookupCachedProperty();
+         GetAccessors()->IsAccessorPair(isolate_) && LookupCachedProperty();
 }
 
 bool LookupIterator::LookupCachedProperty() {
   DCHECK_EQ(state(), LookupIterator::ACCESSOR);
-  DCHECK(GetAccessors()->IsAccessorPair());
+  DCHECK(GetAccessors()->IsAccessorPair(isolate_));
 
   AccessorPair accessor_pair = AccessorPair::cast(*GetAccessors());
-  Handle<Object> getter(accessor_pair.getter(), isolate());
+  Handle<Object> getter(accessor_pair.getter(isolate_), isolate());
   MaybeHandle<Name> maybe_name =
       FunctionTemplateInfo::TryGetCachedPropertyName(isolate(), getter);
   if (maybe_name.is_null()) return false;

src/objects/lookup.h

@@ -235,7 +235,8 @@ class V8_EXPORT_PRIVATE LookupIterator final {
   template <bool is_element>
   bool SkipInterceptor(JSObject holder);
   template <bool is_element>
-  static inline InterceptorInfo GetInterceptor(JSObject holder);
+  static inline InterceptorInfo GetInterceptor(Isolate* isolate,
+                                               JSObject holder);
 
   bool check_interceptor() const {
     return (configuration_ & kInterceptor) != 0;
@@ -243,7 +244,8 @@ class V8_EXPORT_PRIVATE LookupIterator final {
   inline int descriptor_number() const;
   inline int dictionary_entry() const;
 
-  static inline Configuration ComputeConfiguration(Configuration configuration,
+  static inline Configuration ComputeConfiguration(Isolate* isolate,
+                                                   Configuration configuration,
                                                    Handle<Name> name);
 
   static Handle<JSReceiver> GetRootForNonJSReceiver(

src/objects/map-inl.h

@@ -92,16 +92,16 @@ BIT_FIELD_ACCESSORS(Map, bit_field3, may_have_interesting_symbols,
 BIT_FIELD_ACCESSORS(Map, bit_field3, construction_counter,
                     Map::ConstructionCounterBits)
 
-InterceptorInfo Map::GetNamedInterceptor() {
+DEF_GETTER(Map, GetNamedInterceptor, InterceptorInfo) {
   DCHECK(has_named_interceptor());
-  FunctionTemplateInfo info = GetFunctionTemplateInfo();
-  return InterceptorInfo::cast(info.GetNamedPropertyHandler());
+  FunctionTemplateInfo info = GetFunctionTemplateInfo(isolate);
+  return InterceptorInfo::cast(info.GetNamedPropertyHandler(isolate));
 }
 
-InterceptorInfo Map::GetIndexedInterceptor() {
+DEF_GETTER(Map, GetIndexedInterceptor, InterceptorInfo) {
   DCHECK(has_indexed_interceptor());
-  FunctionTemplateInfo info = GetFunctionTemplateInfo();
-  return InterceptorInfo::cast(info.GetIndexedPropertyHandler());
+  FunctionTemplateInfo info = GetFunctionTemplateInfo(isolate);
+  return InterceptorInfo::cast(info.GetIndexedPropertyHandler(isolate));
 }
 
 bool Map::IsMostGeneralFieldType(Representation representation,

src/objects/map.cc

@@ -481,7 +481,7 @@ MaybeHandle<Map> Map::CopyWithConstant(Isolate* isolate, Handle<Map> map,
     return MaybeHandle<Map>();
   }
 
-  Representation representation = constant->OptimalRepresentation();
+  Representation representation = constant->OptimalRepresentation(isolate);
   Handle<FieldType> type = constant->OptimalType(isolate, representation);
   return CopyWithField(isolate, map, name, type, attributes,
                        PropertyConstness::kConst, representation, flag);
@@ -616,7 +616,8 @@ void Map::DeprecateTransitionTree(Isolate* isolate) {
 void Map::ReplaceDescriptors(Isolate* isolate, DescriptorArray new_descriptors,
                              LayoutDescriptor new_layout_descriptor) {
   // Don't overwrite the empty descriptor array or initial map's descriptors.
-  if (NumberOfOwnDescriptors() == 0 || GetBackPointer().IsUndefined(isolate)) {
+  if (NumberOfOwnDescriptors() == 0 ||
+      GetBackPointer(isolate).IsUndefined(isolate)) {
     return;
   }
 
@@ -627,8 +628,8 @@ void Map::ReplaceDescriptors(Isolate* isolate, DescriptorArray new_descriptors,
   Map current = *this;
   MarkingBarrierForDescriptorArray(isolate->heap(), current, to_replace,
                                    to_replace.number_of_descriptors());
-  while (current.instance_descriptors() == to_replace) {
-    Object next = current.GetBackPointer();
+  while (current.instance_descriptors(isolate) == to_replace) {
+    Object next = current.GetBackPointer(isolate);
     if (next.IsUndefined(isolate)) break;  // Stop overwriting at initial map.
     current.SetEnumLength(kInvalidEnumCacheSentinel);
     current.UpdateDescriptors(isolate, new_descriptors, new_layout_descriptor,
@@ -641,7 +642,7 @@ void Map::ReplaceDescriptors(Isolate* isolate, DescriptorArray new_descriptors,
 Map Map::FindRootMap(Isolate* isolate) const {
   Map result = *this;
   while (true) {
-    Object back = result.GetBackPointer();
+    Object back = result.GetBackPointer(isolate);
     if (back.IsUndefined(isolate)) {
       // Initial map always owns descriptors and doesn't have unused entries
       // in the descriptor array.
@@ -656,10 +657,11 @@ Map Map::FindRootMap(Isolate* isolate) const {
 
 Map Map::FindFieldOwner(Isolate* isolate, int descriptor) const {
   DisallowHeapAllocation no_allocation;
-  DCHECK_EQ(kField, instance_descriptors().GetDetails(descriptor).location());
+  DCHECK_EQ(kField,
+            instance_descriptors(isolate).GetDetails(descriptor).location());
   Map result = *this;
   while (true) {
-    Object back = result.GetBackPointer();
+    Object back = result.GetBackPointer(isolate);
     if (back.IsUndefined(isolate)) break;
     const Map parent = Map::cast(back);
     if (parent.NumberOfOwnDescriptors() <= descriptor) break;
@@ -895,7 +897,7 @@ IntegrityLevelTransitionInfo DetectIntegrityLevelTransitions(
   // Figure out the most restrictive integrity level transition (it should
   // be the last one in the transition tree).
   DCHECK(!map.is_extensible());
-  Map previous = Map::cast(map.GetBackPointer());
+  Map previous = Map::cast(map.GetBackPointer(isolate));
   TransitionsAccessor last_transitions(isolate, previous, no_allocation);
   if (!last_transitions.HasIntegrityLevelTransitionTo(
           map, &(info.integrity_level_symbol), &(info.integrity_level))) {
@@ -913,7 +915,7 @@ IntegrityLevelTransitionInfo DetectIntegrityLevelTransitions(
   // transitions. If we encounter any non-integrity level transition interleaved
   // with integrity level transitions, just bail out.
   while (!source_map.is_extensible()) {
-    previous = Map::cast(source_map.GetBackPointer());
+    previous = Map::cast(source_map.GetBackPointer(isolate));
     TransitionsAccessor transitions(isolate, previous, no_allocation);
     if (!transitions.HasIntegrityLevelTransitionTo(source_map)) {
       return info;
@@ -2067,7 +2069,7 @@ Handle<Map> UpdateDescriptorForValue(Isolate* isolate, Handle<Map> map,
 
   PropertyAttributes attributes =
       map->instance_descriptors().GetDetails(descriptor).attributes();
-  Representation representation = value->OptimalRepresentation();
+  Representation representation = value->OptimalRepresentation(isolate);
   Handle<FieldType> type = value->OptimalType(isolate, representation);
 
   MapUpdater mu(isolate, map);
@@ -2126,7 +2128,7 @@ Handle<Map> Map::TransitionToDataProperty(Isolate* isolate, Handle<Map> map,
       isolate->bootstrapper()->IsActive() ? OMIT_TRANSITION : INSERT_TRANSITION;
   MaybeHandle<Map> maybe_map;
   if (!map->TooManyFastProperties(store_origin)) {
-    Representation representation = value->OptimalRepresentation();
+    Representation representation = value->OptimalRepresentation(isolate);
     Handle<FieldType> type = value->OptimalType(isolate, representation);
     maybe_map = Map::CopyWithField(isolate, map, name, type, attributes,
                                    constness, representation, flag);

src/objects/map.h

@@ -215,8 +215,8 @@ class Map : public HeapObject {
       Handle<Map> map, Handle<Context> native_context);
 
   // Retrieve interceptors.
-  inline InterceptorInfo GetNamedInterceptor();
-  inline InterceptorInfo GetIndexedInterceptor();
+  DECL_GETTER(GetNamedInterceptor, InterceptorInfo)
+  DECL_GETTER(GetIndexedInterceptor, InterceptorInfo)
 
   // Instance type.
   DECL_PRIMITIVE_ACCESSORS(instance_type, InstanceType)

src/objects/objects-inl.h

@@ -531,25 +531,28 @@ bool Object::FilterKey(PropertyFilter filter) {
   return false;
 }
 
-Representation Object::OptimalRepresentation() {
+Representation Object::OptimalRepresentation(Isolate* isolate) const {
   if (!FLAG_track_fields) return Representation::Tagged();
   if (IsSmi()) {
     return Representation::Smi();
-  } else if (FLAG_track_double_fields && IsHeapNumber()) {
+  }
+  HeapObject heap_object = HeapObject::cast(*this);
+  if (FLAG_track_double_fields && heap_object.IsHeapNumber(isolate)) {
     return Representation::Double();
-  } else if (FLAG_track_computed_fields && IsUninitialized()) {
+  } else if (FLAG_track_computed_fields &&
+             heap_object.IsUninitialized(
+                 heap_object.GetReadOnlyRoots(isolate))) {
     return Representation::None();
   } else if (FLAG_track_heap_object_fields) {
-    DCHECK(IsHeapObject());
     return Representation::HeapObject();
   } else {
     return Representation::Tagged();
   }
 }
 
-ElementsKind Object::OptimalElementsKind() {
+ElementsKind Object::OptimalElementsKind(Isolate* isolate) const {
   if (IsSmi()) return PACKED_SMI_ELEMENTS;
-  if (IsNumber()) return PACKED_DOUBLE_ELEMENTS;
+  if (IsNumber(isolate)) return PACKED_DOUBLE_ELEMENTS;
   return PACKED_ELEMENTS;
 }
 

src/objects/objects.h

@@ -309,9 +309,9 @@ class Object : public TaggedImpl<HeapObjectReferenceType::STRONG, Address> {
   V8_EXPORT_PRIVATE bool ToInt32(int32_t* value);
   inline bool ToUint32(uint32_t* value) const;
 
-  inline Representation OptimalRepresentation();
+  inline Representation OptimalRepresentation(Isolate* isolate) const;
 
-  inline ElementsKind OptimalElementsKind();
+  inline ElementsKind OptimalElementsKind(Isolate* isolate) const;
 
   inline bool FitsRepresentation(Representation representation);
 

src/objects/property.cc

@@ -75,9 +75,10 @@ Descriptor Descriptor::DataField(Handle<Name> key, int field_index,
 
 Descriptor Descriptor::DataConstant(Handle<Name> key, Handle<Object> value,
                                     PropertyAttributes attributes) {
+  Isolate* isolate = GetIsolateForPtrCompr(*key);
   return Descriptor(key, MaybeObjectHandle(value), kData, attributes,
                     kDescriptor, PropertyConstness::kConst,
-                    value->OptimalRepresentation(), 0);
+                    value->OptimalRepresentation(isolate), 0);
 }
 
 Descriptor Descriptor::DataConstant(Isolate* isolate, Handle<Name> key,

src/objects/templates-inl.h

@@ -55,7 +55,7 @@ SMI_ACCESSORS(FunctionTemplateInfo, flag, kFlagOffset)
 // static
 FunctionTemplateRareData FunctionTemplateInfo::EnsureFunctionTemplateRareData(
     Isolate* isolate, Handle<FunctionTemplateInfo> function_template_info) {
-  HeapObject extra = function_template_info->rare_data();
+  HeapObject extra = function_template_info->rare_data(isolate);
   if (extra.IsUndefined(isolate)) {
     return AllocateFunctionTemplateRareData(isolate, function_template_info);
   } else {
@@ -64,9 +64,9 @@ FunctionTemplateRareData FunctionTemplateInfo::EnsureFunctionTemplateRareData(
 }
 
 #define RARE_ACCESSORS(Name, CamelName, Type)                                 \
-  Type FunctionTemplateInfo::Get##CamelName() {                               \
-    HeapObject extra = rare_data();                                           \
-    HeapObject undefined = GetReadOnlyRoots().undefined_value();              \
+  DEF_GETTER(FunctionTemplateInfo, Get##CamelName, Type) {                    \
+    HeapObject extra = rare_data(isolate);                                    \
+    HeapObject undefined = GetReadOnlyRoots(isolate).undefined_value();       \
     return extra == undefined ? undefined                                     \
                               : FunctionTemplateRareData::cast(extra).Name(); \
   }                                                                           \

src/objects/templates.h

@@ -86,7 +86,7 @@ class FunctionTemplateInfo : public TemplateInfo {
   DECL_ACCESSORS(rare_data, HeapObject)
 
 #define DECL_RARE_ACCESSORS(Name, CamelName, Type)                           \
-  inline Type Get##CamelName();                                              \
+  DECL_GETTER(Get##CamelName, Type)                                          \
   static inline void Set##CamelName(                                         \
       Isolate* isolate, Handle<FunctionTemplateInfo> function_template_info, \
       Handle<Type> Name);

src/objects/transitions-inl.h

@@ -194,13 +194,13 @@ void TransitionsAccessor::Reload() {
 }
 
 void TransitionsAccessor::Initialize() {
-  raw_transitions_ = map_.raw_transitions();
+  raw_transitions_ = map_.raw_transitions(isolate_);
   HeapObject heap_object;
   if (raw_transitions_->IsSmi() || raw_transitions_->IsCleared()) {
     encoding_ = kUninitialized;
   } else if (raw_transitions_->IsWeak()) {
     encoding_ = kWeakRef;
-  } else if (raw_transitions_->GetHeapObjectIfStrong(&heap_object)) {
+  } else if (raw_transitions_->GetHeapObjectIfStrong(isolate_, &heap_object)) {
     if (heap_object.IsTransitionArray()) {
       encoding_ = kFullTransitionArray;
     } else if (heap_object.IsPrototypeInfo()) {

src/runtime/runtime-classes.cc

@@ -332,7 +332,8 @@ bool AddDescriptorsByTemplate(
           value = GetMethodWithSharedNameAndSetHomeObject(isolate, args, value,
                                                           *receiver);
         }
-        details = details.CopyWithRepresentation(value.OptimalRepresentation());
+        details = details.CopyWithRepresentation(
+            value.OptimalRepresentation(isolate));
       } else {
         DCHECK_EQ(kAccessor, details.kind());
         if (value.IsAccessorPair()) {