Revert "[serializer] Change deferring to use forward refs"

This reverts commit 81577a79.

Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20-%20shared/10544

Original change's description:
> [serializer] Change deferring to use forward refs
> 
> Now that we have forward references, we can replace the body deferring
> mechanism with forward references to the entire pointer.
> 
> This ensures that objects are always deserialized with their contents
> (aside from themselves maybe holding forward refs), and as a result we
> can simplify the CanBeDeferred conditions which encode the constraint
> that some objects either need immediately have contents, or cannot be
> deferred because their fields are changed temporarily (e.g. backing
> store refs).
> 
> This also means that objects with length fields (e.g. arrays) will
> always have those length fields deserialized when the object is
> deserialized, which was not the case when the body could be deferred.
> This helps us in the plan to make GC possible during deserialization.
> 
> Bug: v8:10815
> Change-Id: Ib0e5399b9de6027765691e8cb47410a2ccc15485
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390643
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69760}

TBR=jgruber@chromium.org,leszeks@chromium.org

Change-Id: I7a93a59217a2b38e2157c0f7ffc7ac648590a8d6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10815
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2398535Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69763}

src/snapshot/deserializer.cc

@@ -117,8 +117,36 @@ void Deserializer::DeserializeDeferredObjects() {
   DisallowHeapAllocation no_gc;
 
   for (int code = source_.Get(); code != kSynchronize; code = source_.Get()) {
+    switch (code) {
+      case kAlignmentPrefix:
+      case kAlignmentPrefix + 1:
+      case kAlignmentPrefix + 2: {
+        int alignment = code - (SerializerDeserializer::kAlignmentPrefix - 1);
+        allocator()->SetAlignment(static_cast<AllocationAlignment>(alignment));
+        break;
+      }
+      default: {
         SnapshotSpace space = NewObject::Decode(code);
-    ReadObject(space);
+        HeapObject object = GetBackReferencedObject(space);
+        int size = source_.GetInt() << kTaggedSizeLog2;
+        Address obj_address = object.address();
+        // Object's map is already initialized, now read the rest.
+        MaybeObjectSlot start(obj_address + kTaggedSize);
+        MaybeObjectSlot end(obj_address + size);
+        bool filled = ReadData(start, end, space, obj_address);
+        CHECK(filled);
+        DCHECK(CanBeDeferred(object));
+        PostProcessNewObject(object, space);
+      }
+    }
+  }
+
+  // When the deserialization of maps are deferred, they will be created
+  // as filler maps, and we postpone the post processing until the maps
+  // are also deserialized.
+  for (const auto& pair : fillers_to_post_process_) {
+    DCHECK(!pair.first.IsFiller());
+    PostProcessNewObject(pair.first, pair.second);
   }
 }
 
@@ -164,7 +192,11 @@ HeapObject Deserializer::PostProcessNewObject(HeapObject obj,
   DisallowHeapAllocation no_gc;
 
   if ((FLAG_rehash_snapshot && can_rehash_) || deserializing_user_code()) {
-    if (obj.IsString()) {
+    if (obj.IsFiller()) {
+      DCHECK_EQ(fillers_to_post_process_.find(obj),
+                fillers_to_post_process_.end());
+      fillers_to_post_process_.insert({obj, space});
+    } else if (obj.IsString()) {
       // Uninitialize hash field as we need to recompute the hash.
       String string = String::cast(obj);
       string.set_hash_field(String::kEmptyHashField);
@@ -339,8 +371,10 @@ HeapObject Deserializer::ReadObject() {
   MaybeObject object;
   // We are reading to a location outside of JS heap, so pass kNew to avoid
   // triggering write barriers.
+  bool filled =
       ReadData(FullMaybeObjectSlot(&object), FullMaybeObjectSlot(&object + 1),
                SnapshotSpace::kNew, kNullAddress);
+  CHECK(filled);
   return object.GetHeapObjectAssumeStrong();
 }
 
@@ -380,8 +414,10 @@ HeapObject Deserializer::ReadObject(SnapshotSpace space) {
   MaybeObjectSlot limit(address + size);
 
   current.store(MaybeObject::FromObject(map));
-  ReadData(current + 1, limit, space, address);
+  if (ReadData(current + 1, limit, space, address)) {
+    // Only post process if object content has not been deferred.
     obj = PostProcessNewObject(obj, space);
+  }
 
 #ifdef DEBUG
   if (obj.IsCode()) {
@@ -410,7 +446,8 @@ HeapObject Deserializer::ReadMetaMap() {
   current.store(MaybeObject(current.address() + kHeapObjectTag));
   // Set the instance-type manually, to allow backrefs to read it.
   Map::unchecked_cast(obj).set_instance_type(MAP_TYPE);
-  ReadData(current + 1, limit, space, address);
+  // The meta map's contents cannot be deferred.
+  CHECK(ReadData(current + 1, limit, space, address));
 
   return obj;
 }
@@ -422,7 +459,8 @@ void Deserializer::ReadCodeObjectBody(SnapshotSpace space,
   // Now we read the rest of code header's fields.
   MaybeObjectSlot current(code_object_address + HeapObject::kHeaderSize);
   MaybeObjectSlot limit(code_object_address + Code::kDataStart);
-  ReadData(current, limit, space, code_object_address);
+  bool filled = ReadData(current, limit, space, code_object_address);
+  CHECK(filled);
 
   // Now iterate RelocInfos the same way it was done by the serialzier and
   // deserialize respective data into RelocInfos.
@@ -535,7 +573,7 @@ constexpr byte VerifyBytecodeCount(byte bytecode) {
 }  // namespace
 
 template <typename TSlot>
-void Deserializer::ReadData(TSlot current, TSlot limit,
+bool Deserializer::ReadData(TSlot current, TSlot limit,
                             SnapshotSpace source_space,
                             Address current_object_address) {
   // Write barrier support costs around 1% in startup time.  In fact there
@@ -640,8 +678,18 @@ void Deserializer::ReadData(TSlot current, TSlot limit,
         break;
       }
 
+      case kDeferred: {
+        // Deferred can only occur right after the heap object's map field.
+        DCHECK_EQ(current.address(), current_object_address + kTaggedSize);
+        HeapObject obj = HeapObject::FromAddress(current_object_address);
+        // If the deferred object is a map, its instance type may be used
+        // during deserialization. Initialize it with a temporary value.
+        if (obj.IsMap()) Map::cast(obj).set_instance_type(FILLER_TYPE);
+        current = limit;
+        return false;
+      }
+
       case kRegisterPendingForwardRef: {
-        DCHECK_NE(current_object_address, kNullAddress);
         HeapObject obj = HeapObject::FromAddress(current_object_address);
         unresolved_forward_refs_.emplace_back(
             obj, current.address() - current_object_address);
@@ -833,6 +881,7 @@ void Deserializer::ReadData(TSlot current, TSlot limit,
     }
   }
   CHECK_EQ(limit, current);
+  return true;
 }
 
 Address Deserializer::ReadExternalReferenceCase() {

src/snapshot/deserializer.h

@@ -135,9 +135,9 @@ class V8_EXPORT_PRIVATE Deserializer : public SerializerDeserializer {
   // space id is used for the write barrier.  The object_address is the address
   // of the object we are writing into, or nullptr if we are not writing into an
   // object, i.e. if we are writing a series of tagged values that are not on
-  // the heap.
+  // the heap. Return false if the object content has been deferred.
   template <typename TSlot>
-  void ReadData(TSlot start, TSlot end, SnapshotSpace space,
+  bool ReadData(TSlot start, TSlot end, SnapshotSpace space,
                 Address object_address);
 
   // A helper function for ReadData, templatized on the bytecode for efficiency.
@@ -205,6 +205,11 @@ class V8_EXPORT_PRIVATE Deserializer : public SerializerDeserializer {
   // TODO(6593): generalize rehashing, and remove this flag.
   bool can_rehash_;
   std::vector<HeapObject> to_rehash_;
+  // Store the objects whose maps are deferred and thus initialized as filler
+  // maps during deserialization, so that they can be processed later when the
+  // maps become available.
+  std::unordered_map<HeapObject, SnapshotSpace, Object::Hasher>
+      fillers_to_post_process_;
 
 #ifdef DEBUG
   uint32_t num_api_references_;

src/snapshot/read-only-serializer.cc

@@ -86,9 +86,12 @@ bool ReadOnlySerializer::MustBeDeferred(HeapObject object) {
     // be saved without problems.
     return false;
   }
-  // Defer objects with special alignment requirements until the filler roots
-  // are serialized.
-  return HeapObject::RequiredAlignment(object.map()) != kWordAligned;
+  // Just defer everything except for Map objects until all required roots are
+  // serialized. Some objects may have special alignment requirements, that may
+  // not be fulfilled during deserialization until few first root objects are
+  // serialized. But we must serialize Map objects since deserializer checks
+  // that these root objects are indeed Maps.
+  return !object.IsMap();
 }
 
 bool ReadOnlySerializer::SerializeUsingReadOnlyObjectCache(

src/snapshot/serializer-deserializer.cc

@@ -30,9 +30,14 @@ void SerializerDeserializer::Iterate(Isolate* isolate, RootVisitor* visitor) {
 }
 
 bool SerializerDeserializer::CanBeDeferred(HeapObject o) {
-  // Maps cannot be deferred as objects are expected to have a valid map
-  // immediately.
-  return !o.IsMap();
+  // ArrayBuffer instances are serialized by first re-assigning a index
+  // to the backing store field, then serializing the object, and then
+  // storing the actual backing store address again (and the same for the
+  // ArrayBufferExtension). If serialization of the object itself is deferred,
+  // the real backing store address is written into the snapshot, which cannot
+  // be processed when deserializing.
+  return !o.IsString() && !o.IsScript() && !o.IsJSTypedArray() &&
+         !o.IsJSArrayBuffer();
 }
 
 void SerializerDeserializer::RestoreExternalReferenceRedirectors(

src/snapshot/serializer-deserializer.h

@@ -72,8 +72,8 @@ class SerializerDeserializer : public RootVisitor {
 // clang-format off
 #define UNUSED_SERIALIZER_BYTE_CODES(V)                           \
   V(0x06) V(0x07) V(0x0e) V(0x0f)                                 \
-  /* Free range 0x2a..0x2f */                                     \
-  V(0x2a) V(0x2b) V(0x2c) V(0x2d) V(0x2e) V(0x2f)                 \
+  /* Free range 0x2b..0x2f */                                     \
+  V(0x2b) V(0x2c) V(0x2d) V(0x2e) V(0x2f)                         \
   /* Free range 0x30..0x3f */                                     \
   V(0x30) V(0x31) V(0x32) V(0x33) V(0x34) V(0x35) V(0x36) V(0x37) \
   V(0x38) V(0x39) V(0x3a) V(0x3b) V(0x3c) V(0x3d) V(0x3e) V(0x3f) \
@@ -145,14 +145,16 @@ class SerializerDeserializer : public RootVisitor {
     kNop,
     // Move to next reserved chunk.
     kNextChunk,
-    // 3 alignment prefixes 0x16..0x18
-    kAlignmentPrefix = 0x16,
+    // Deferring object content.
+    kDeferred,
+    // 3 alignment prefixes 0x17..0x19
+    kAlignmentPrefix = 0x17,
     // A tag emitted at strategic points in the snapshot to delineate sections.
     // If the deserializer does not find these at the expected moments then it
     // is an indication that the snapshot and the VM do not fit together.
     // Examine the build process for architecture, version or configuration
     // mismatches.
-    kSynchronize = 0x19,
+    kSynchronize = 0x1a,
     // Repeats of variable length.
     kVariableRepeat,
     // Used for embedder-allocated backing stores for TypedArrays.

src/snapshot/serializer.cc

@@ -71,9 +71,6 @@ void Serializer::OutputStatistics(const char* name) {
 }
 
 void Serializer::SerializeDeferredObjects() {
-  if (FLAG_trace_serializer) {
-    PrintF("Serializing deferred objects\n");
-  }
   while (!deferred_objects_.empty()) {
     HeapObject obj = deferred_objects_.back();
     deferred_objects_.pop_back();
@@ -168,13 +165,13 @@ bool Serializer::SerializeBackReference(HeapObject obj) {
 }
 
 bool Serializer::SerializePendingObject(HeapObject obj) {
-  PendingObjectReference pending_obj =
-      forward_refs_per_pending_object_.find(obj);
-  if (pending_obj == forward_refs_per_pending_object_.end()) {
+  auto it = forward_refs_per_pending_object_.find(obj);
+  if (it == forward_refs_per_pending_object_.end()) {
     return false;
   }
 
-  PutPendingForwardReferenceTo(pending_obj);
+  int forward_ref_id = PutPendingForwardReference();
+  it->second.push_back(forward_ref_id);
   return true;
 }
 
@@ -274,13 +271,10 @@ void Serializer::PutRepeat(int repeat_count) {
   }
 }
 
-void Serializer::PutPendingForwardReferenceTo(
-    PendingObjectReference reference) {
+int Serializer::PutPendingForwardReference() {
   sink_.Put(kRegisterPendingForwardRef, "RegisterPendingForwardRef");
   unresolved_forward_refs_++;
-  // Register the current slot with the pending object.
-  int forward_ref_id = next_forward_ref_id_++;
-  reference->second.push_back(forward_ref_id);
+  return next_forward_ref_id_++;
 }
 
 void Serializer::ResolvePendingForwardReference(int forward_reference_id) {
@@ -301,11 +295,9 @@ Serializer::PendingObjectReference Serializer::RegisterObjectIsPending(
   auto forward_refs_entry_insertion =
       forward_refs_per_pending_object_.emplace(obj, std::vector<int>());
 
-  // If the above emplace didn't actually add the object, then the object must
-  // already have been registered pending by deferring. It might not be in the
-  // deferred objects queue though, since it may be the very object we just
-  // popped off that queue, so just check that it can be deferred.
-  DCHECK_IMPLIES(!forward_refs_entry_insertion.second, CanBeDeferred(obj));
+  // Make sure the above emplace actually added the object, rather than
+  // overwriting an existing entry.
+  DCHECK(forward_refs_entry_insertion.second);
 
   // return the iterator into the map as the reference.
   return forward_refs_entry_insertion.first;
@@ -589,26 +581,6 @@ class UnlinkWeakNextScope {
 };
 
 void Serializer::ObjectSerializer::Serialize() {
-  RecursionScope recursion(serializer_);
-
-  // Defer objects as "pending" if they cannot be serialized now, or if we
-  // exceed a certain recursion depth. Some objects cannot be deferred
-  if ((recursion.ExceedsMaximum() && CanBeDeferred(object_)) ||
-      serializer_->MustBeDeferred(object_)) {
-    DCHECK(CanBeDeferred(object_));
-    if (FLAG_trace_serializer) {
-      PrintF(" Deferring heap object: ");
-      object_.ShortPrint();
-      PrintF("\n");
-    }
-    // Deferred objects are considered "pending".
-    PendingObjectReference pending_obj =
-        serializer_->RegisterObjectIsPending(object_);
-    serializer_->PutPendingForwardReferenceTo(pending_obj);
-    serializer_->QueueDeferredObject(object_);
-    return;
-  }
-
   if (FLAG_trace_serializer) {
     PrintF(" Encoding heap object: ");
     object_.ShortPrint();
@@ -697,27 +669,43 @@ void Serializer::ObjectSerializer::SerializeObject() {
   CHECK_EQ(0, bytes_processed_so_far_);
   bytes_processed_so_far_ = kTaggedSize;
 
+  RecursionScope recursion(serializer_);
+  // Objects that are immediately post processed during deserialization
+  // cannot be deferred, since post processing requires the object content.
+  if ((recursion.ExceedsMaximum() && CanBeDeferred(object_)) ||
+      serializer_->MustBeDeferred(object_)) {
+    serializer_->QueueDeferredObject(object_);
+    sink_->Put(kDeferred, "Deferring object content");
+    return;
+  }
+
   SerializeContent(map, size);
 }
 
 void Serializer::ObjectSerializer::SerializeDeferred() {
+  if (FLAG_trace_serializer) {
+    PrintF(" Encoding deferred heap object: ");
+    object_.ShortPrint();
+    PrintF("\n");
+  }
+
+  int size = object_.Size();
+  Map map = object_.map();
   SerializerReference back_reference =
       serializer_->reference_map()->LookupReference(
           reinterpret_cast<void*>(object_.ptr()));
+  DCHECK(back_reference.is_back_reference());
 
-  if (back_reference.is_valid()) {
-    if (FLAG_trace_serializer) {
-      PrintF(" Deferred heap object ");
-      object_.ShortPrint();
-      PrintF(" was already serialized\n");
-    }
-    return;
-  }
+  // Serialize the rest of the object.
+  CHECK_EQ(0, bytes_processed_so_far_);
+  bytes_processed_so_far_ = kTaggedSize;
 
-  if (FLAG_trace_serializer) {
-    PrintF(" Encoding deferred heap object\n");
-  }
-  Serialize();
+  serializer_->PutAlignmentPrefix(object_);
+  sink_->Put(NewObject::Encode(back_reference.space()), "deferred object");
+  serializer_->PutBackReference(object_, back_reference);
+  sink_->PutInt(size >> kTaggedSizeLog2, "deferred object size");
+
+  SerializeContent(map, size);
 }
 
 void Serializer::ObjectSerializer::SerializeContent(Map map, int size) {

src/snapshot/serializer.h

@@ -176,9 +176,6 @@ class Serializer : public SerializerDeserializer {
   Isolate* isolate() const { return isolate_; }
 
  protected:
-  using PendingObjectReference =
-      std::map<HeapObject, std::vector<int>>::iterator;
-
   class ObjectSerializer;
   class RecursionScope {
    public:
@@ -215,7 +212,7 @@ class Serializer : public SerializerDeserializer {
 
   // Emit a marker noting that this slot is a forward reference to the an
   // object which has not yet been serialized.
-  void PutPendingForwardReferenceTo(PendingObjectReference reference);
+  int PutPendingForwardReference();
   // Resolve the given previously registered forward reference to the current
   // object.
   void ResolvePendingForwardReference(int obj);
@@ -254,11 +251,14 @@ class Serializer : public SerializerDeserializer {
   Code CopyCode(Code code);
 
   void QueueDeferredObject(HeapObject obj) {
-    DCHECK(!reference_map_.LookupReference(reinterpret_cast<void*>(obj.ptr()))
-                .is_valid());
+    DCHECK(reference_map_.LookupReference(reinterpret_cast<void*>(obj.ptr()))
+               .is_back_reference());
     deferred_objects_.push_back(obj);
   }
 
+  using PendingObjectReference =
+      std::map<HeapObject, std::vector<int>>::iterator;
+
   // Register that the the given object shouldn't be immediately serialized, but
   // will be serialized later and any references to it should be pending forward
   // references.

tools/v8heapconst.py

@@ -209,93 +209,93 @@ KNOWN_MAPS = {
   ("read_only_space", 0x0213d): (67, "NullMap"),
   ("read_only_space", 0x02165): (162, "DescriptorArrayMap"),
   ("read_only_space", 0x0218d): (156, "WeakFixedArrayMap"),
-  ("read_only_space", 0x021cd): (96, "EnumCacheMap"),
-  ("read_only_space", 0x02201): (117, "FixedArrayMap"),
-  ("read_only_space", 0x0224d): (8, "OneByteInternalizedStringMap"),
-  ("read_only_space", 0x02299): (167, "FreeSpaceMap"),
-  ("read_only_space", 0x022c1): (166, "OnePointerFillerMap"),
-  ("read_only_space", 0x022e9): (166, "TwoPointerFillerMap"),
-  ("read_only_space", 0x02311): (67, "UninitializedMap"),
-  ("read_only_space", 0x02389): (67, "UndefinedMap"),
-  ("read_only_space", 0x023cd): (66, "HeapNumberMap"),
-  ("read_only_space", 0x02401): (67, "TheHoleMap"),
-  ("read_only_space", 0x02461): (67, "BooleanMap"),
-  ("read_only_space", 0x02505): (131, "ByteArrayMap"),
-  ("read_only_space", 0x0252d): (117, "FixedCOWArrayMap"),
-  ("read_only_space", 0x02555): (118, "HashTableMap"),
-  ("read_only_space", 0x0257d): (64, "SymbolMap"),
-  ("read_only_space", 0x025a5): (40, "OneByteStringMap"),
-  ("read_only_space", 0x025cd): (129, "ScopeInfoMap"),
-  ("read_only_space", 0x025f5): (175, "SharedFunctionInfoMap"),
-  ("read_only_space", 0x0261d): (159, "CodeMap"),
-  ("read_only_space", 0x02645): (158, "CellMap"),
-  ("read_only_space", 0x0266d): (174, "GlobalPropertyCellMap"),
-  ("read_only_space", 0x02695): (70, "ForeignMap"),
-  ("read_only_space", 0x026bd): (157, "TransitionArrayMap"),
-  ("read_only_space", 0x026e5): (45, "ThinOneByteStringMap"),
-  ("read_only_space", 0x0270d): (165, "FeedbackVectorMap"),
-  ("read_only_space", 0x0273d): (67, "ArgumentsMarkerMap"),
-  ("read_only_space", 0x0279d): (67, "ExceptionMap"),
-  ("read_only_space", 0x027f9): (67, "TerminationExceptionMap"),
-  ("read_only_space", 0x02861): (67, "OptimizedOutMap"),
-  ("read_only_space", 0x028c1): (67, "StaleRegisterMap"),
-  ("read_only_space", 0x02921): (130, "ScriptContextTableMap"),
-  ("read_only_space", 0x02949): (127, "ClosureFeedbackCellArrayMap"),
-  ("read_only_space", 0x02971): (164, "FeedbackMetadataArrayMap"),
-  ("read_only_space", 0x02999): (117, "ArrayListMap"),
-  ("read_only_space", 0x029c1): (65, "BigIntMap"),
-  ("read_only_space", 0x029e9): (128, "ObjectBoilerplateDescriptionMap"),
-  ("read_only_space", 0x02a11): (132, "BytecodeArrayMap"),
-  ("read_only_space", 0x02a39): (160, "CodeDataContainerMap"),
-  ("read_only_space", 0x02a61): (161, "CoverageInfoMap"),
-  ("read_only_space", 0x02a89): (133, "FixedDoubleArrayMap"),
-  ("read_only_space", 0x02ab1): (120, "GlobalDictionaryMap"),
-  ("read_only_space", 0x02ad9): (97, "ManyClosuresCellMap"),
-  ("read_only_space", 0x02b01): (117, "ModuleInfoMap"),
-  ("read_only_space", 0x02b29): (121, "NameDictionaryMap"),
-  ("read_only_space", 0x02b51): (97, "NoClosuresCellMap"),
-  ("read_only_space", 0x02b79): (122, "NumberDictionaryMap"),
-  ("read_only_space", 0x02ba1): (97, "OneClosureCellMap"),
-  ("read_only_space", 0x02bc9): (123, "OrderedHashMapMap"),
-  ("read_only_space", 0x02bf1): (124, "OrderedHashSetMap"),
-  ("read_only_space", 0x02c19): (125, "OrderedNameDictionaryMap"),
-  ("read_only_space", 0x02c41): (172, "PreparseDataMap"),
-  ("read_only_space", 0x02c69): (173, "PropertyArrayMap"),
-  ("read_only_space", 0x02c91): (93, "SideEffectCallHandlerInfoMap"),
-  ("read_only_space", 0x02cb9): (93, "SideEffectFreeCallHandlerInfoMap"),
-  ("read_only_space", 0x02ce1): (93, "NextCallSideEffectFreeCallHandlerInfoMap"),
-  ("read_only_space", 0x02d09): (126, "SimpleNumberDictionaryMap"),
-  ("read_only_space", 0x02d31): (149, "SmallOrderedHashMapMap"),
-  ("read_only_space", 0x02d59): (150, "SmallOrderedHashSetMap"),
-  ("read_only_space", 0x02d81): (151, "SmallOrderedNameDictionaryMap"),
-  ("read_only_space", 0x02da9): (152, "SourceTextModuleMap"),
-  ("read_only_space", 0x02dd1): (153, "SyntheticModuleMap"),
-  ("read_only_space", 0x02df9): (155, "UncompiledDataWithoutPreparseDataMap"),
-  ("read_only_space", 0x02e21): (154, "UncompiledDataWithPreparseDataMap"),
-  ("read_only_space", 0x02e49): (71, "WasmTypeInfoMap"),
-  ("read_only_space", 0x02e71): (181, "WeakArrayListMap"),
-  ("read_only_space", 0x02e99): (119, "EphemeronHashTableMap"),
-  ("read_only_space", 0x02ec1): (163, "EmbedderDataArrayMap"),
-  ("read_only_space", 0x02ee9): (182, "WeakCellMap"),
-  ("read_only_space", 0x02f11): (32, "StringMap"),
-  ("read_only_space", 0x02f39): (41, "ConsOneByteStringMap"),
-  ("read_only_space", 0x02f61): (33, "ConsStringMap"),
-  ("read_only_space", 0x02f89): (37, "ThinStringMap"),
-  ("read_only_space", 0x02fb1): (35, "SlicedStringMap"),
-  ("read_only_space", 0x02fd9): (43, "SlicedOneByteStringMap"),
-  ("read_only_space", 0x03001): (34, "ExternalStringMap"),
-  ("read_only_space", 0x03029): (42, "ExternalOneByteStringMap"),
-  ("read_only_space", 0x03051): (50, "UncachedExternalStringMap"),
-  ("read_only_space", 0x03079): (0, "InternalizedStringMap"),
-  ("read_only_space", 0x030a1): (2, "ExternalInternalizedStringMap"),
-  ("read_only_space", 0x030c9): (10, "ExternalOneByteInternalizedStringMap"),
-  ("read_only_space", 0x030f1): (18, "UncachedExternalInternalizedStringMap"),
-  ("read_only_space", 0x03119): (26, "UncachedExternalOneByteInternalizedStringMap"),
-  ("read_only_space", 0x03141): (58, "UncachedExternalOneByteStringMap"),
-  ("read_only_space", 0x03169): (67, "SelfReferenceMarkerMap"),
-  ("read_only_space", 0x03191): (67, "BasicBlockCountersMarkerMap"),
-  ("read_only_space", 0x031d5): (87, "ArrayBoilerplateDescriptionMap"),
-  ("read_only_space", 0x032a5): (99, "InterceptorInfoMap"),
+  ("read_only_space", 0x021e9): (167, "FreeSpaceMap"),
+  ("read_only_space", 0x02211): (166, "OnePointerFillerMap"),
+  ("read_only_space", 0x02239): (166, "TwoPointerFillerMap"),
+  ("read_only_space", 0x02261): (67, "UninitializedMap"),
+  ("read_only_space", 0x022a5): (8, "OneByteInternalizedStringMap"),
+  ("read_only_space", 0x02301): (67, "UndefinedMap"),
+  ("read_only_space", 0x02345): (66, "HeapNumberMap"),
+  ("read_only_space", 0x02379): (67, "TheHoleMap"),
+  ("read_only_space", 0x023d9): (67, "BooleanMap"),
+  ("read_only_space", 0x0247d): (131, "ByteArrayMap"),
+  ("read_only_space", 0x024a5): (117, "FixedArrayMap"),
+  ("read_only_space", 0x024cd): (117, "FixedCOWArrayMap"),
+  ("read_only_space", 0x024f5): (118, "HashTableMap"),
+  ("read_only_space", 0x0251d): (64, "SymbolMap"),
+  ("read_only_space", 0x02545): (40, "OneByteStringMap"),
+  ("read_only_space", 0x0256d): (129, "ScopeInfoMap"),
+  ("read_only_space", 0x02595): (175, "SharedFunctionInfoMap"),
+  ("read_only_space", 0x025bd): (159, "CodeMap"),
+  ("read_only_space", 0x025e5): (158, "CellMap"),
+  ("read_only_space", 0x0260d): (174, "GlobalPropertyCellMap"),
+  ("read_only_space", 0x02635): (70, "ForeignMap"),
+  ("read_only_space", 0x0265d): (157, "TransitionArrayMap"),
+  ("read_only_space", 0x02685): (45, "ThinOneByteStringMap"),
+  ("read_only_space", 0x026ad): (165, "FeedbackVectorMap"),
+  ("read_only_space", 0x026e5): (67, "ArgumentsMarkerMap"),
+  ("read_only_space", 0x02745): (67, "ExceptionMap"),
+  ("read_only_space", 0x027a1): (67, "TerminationExceptionMap"),
+  ("read_only_space", 0x02809): (67, "OptimizedOutMap"),
+  ("read_only_space", 0x02869): (67, "StaleRegisterMap"),
+  ("read_only_space", 0x028c9): (130, "ScriptContextTableMap"),
+  ("read_only_space", 0x028f1): (127, "ClosureFeedbackCellArrayMap"),
+  ("read_only_space", 0x02919): (164, "FeedbackMetadataArrayMap"),
+  ("read_only_space", 0x02941): (117, "ArrayListMap"),
+  ("read_only_space", 0x02969): (65, "BigIntMap"),
+  ("read_only_space", 0x02991): (128, "ObjectBoilerplateDescriptionMap"),
+  ("read_only_space", 0x029b9): (132, "BytecodeArrayMap"),
+  ("read_only_space", 0x029e1): (160, "CodeDataContainerMap"),
+  ("read_only_space", 0x02a09): (161, "CoverageInfoMap"),
+  ("read_only_space", 0x02a31): (133, "FixedDoubleArrayMap"),
+  ("read_only_space", 0x02a59): (120, "GlobalDictionaryMap"),
+  ("read_only_space", 0x02a81): (97, "ManyClosuresCellMap"),
+  ("read_only_space", 0x02aa9): (117, "ModuleInfoMap"),
+  ("read_only_space", 0x02ad1): (121, "NameDictionaryMap"),
+  ("read_only_space", 0x02af9): (97, "NoClosuresCellMap"),
+  ("read_only_space", 0x02b21): (122, "NumberDictionaryMap"),
+  ("read_only_space", 0x02b49): (97, "OneClosureCellMap"),
+  ("read_only_space", 0x02b71): (123, "OrderedHashMapMap"),
+  ("read_only_space", 0x02b99): (124, "OrderedHashSetMap"),
+  ("read_only_space", 0x02bc1): (125, "OrderedNameDictionaryMap"),
+  ("read_only_space", 0x02be9): (172, "PreparseDataMap"),
+  ("read_only_space", 0x02c11): (173, "PropertyArrayMap"),
+  ("read_only_space", 0x02c39): (93, "SideEffectCallHandlerInfoMap"),
+  ("read_only_space", 0x02c61): (93, "SideEffectFreeCallHandlerInfoMap"),
+  ("read_only_space", 0x02c89): (93, "NextCallSideEffectFreeCallHandlerInfoMap"),
+  ("read_only_space", 0x02cb1): (126, "SimpleNumberDictionaryMap"),
+  ("read_only_space", 0x02cd9): (149, "SmallOrderedHashMapMap"),
+  ("read_only_space", 0x02d01): (150, "SmallOrderedHashSetMap"),
+  ("read_only_space", 0x02d29): (151, "SmallOrderedNameDictionaryMap"),
+  ("read_only_space", 0x02d51): (152, "SourceTextModuleMap"),
+  ("read_only_space", 0x02d79): (153, "SyntheticModuleMap"),
+  ("read_only_space", 0x02da1): (155, "UncompiledDataWithoutPreparseDataMap"),
+  ("read_only_space", 0x02dc9): (154, "UncompiledDataWithPreparseDataMap"),
+  ("read_only_space", 0x02df1): (71, "WasmTypeInfoMap"),
+  ("read_only_space", 0x02e19): (181, "WeakArrayListMap"),
+  ("read_only_space", 0x02e41): (119, "EphemeronHashTableMap"),
+  ("read_only_space", 0x02e69): (163, "EmbedderDataArrayMap"),
+  ("read_only_space", 0x02e91): (182, "WeakCellMap"),
+  ("read_only_space", 0x02eb9): (32, "StringMap"),
+  ("read_only_space", 0x02ee1): (41, "ConsOneByteStringMap"),
+  ("read_only_space", 0x02f09): (33, "ConsStringMap"),
+  ("read_only_space", 0x02f31): (37, "ThinStringMap"),
+  ("read_only_space", 0x02f59): (35, "SlicedStringMap"),
+  ("read_only_space", 0x02f81): (43, "SlicedOneByteStringMap"),
+  ("read_only_space", 0x02fa9): (34, "ExternalStringMap"),
+  ("read_only_space", 0x02fd1): (42, "ExternalOneByteStringMap"),
+  ("read_only_space", 0x02ff9): (50, "UncachedExternalStringMap"),
+  ("read_only_space", 0x03021): (0, "InternalizedStringMap"),
+  ("read_only_space", 0x03049): (2, "ExternalInternalizedStringMap"),
+  ("read_only_space", 0x03071): (10, "ExternalOneByteInternalizedStringMap"),
+  ("read_only_space", 0x03099): (18, "UncachedExternalInternalizedStringMap"),
+  ("read_only_space", 0x030c1): (26, "UncachedExternalOneByteInternalizedStringMap"),
+  ("read_only_space", 0x030e9): (58, "UncachedExternalOneByteStringMap"),
+  ("read_only_space", 0x03111): (67, "SelfReferenceMarkerMap"),
+  ("read_only_space", 0x03139): (67, "BasicBlockCountersMarkerMap"),
+  ("read_only_space", 0x03161): (96, "EnumCacheMap"),
+  ("read_only_space", 0x031b1): (87, "ArrayBoilerplateDescriptionMap"),
+  ("read_only_space", 0x03281): (99, "InterceptorInfoMap"),
   ("read_only_space", 0x05399): (72, "PromiseFulfillReactionJobTaskMap"),
   ("read_only_space", 0x053c1): (73, "PromiseRejectReactionJobTaskMap"),
   ("read_only_space", 0x053e9): (74, "CallableTaskMap"),
@@ -367,48 +367,48 @@ KNOWN_MAPS = {
 KNOWN_OBJECTS = {
   ("read_only_space", 0x021b5): "EmptyWeakFixedArray",
   ("read_only_space", 0x021bd): "EmptyDescriptorArray",
-  ("read_only_space", 0x021f5): "EmptyEnumCache",
-  ("read_only_space", 0x02229): "EmptyFixedArray",
-  ("read_only_space", 0x02231): "NullValue",
-  ("read_only_space", 0x02339): "UninitializedValue",
-  ("read_only_space", 0x023b1): "UndefinedValue",
-  ("read_only_space", 0x023f5): "NanValue",
-  ("read_only_space", 0x02429): "TheHoleValue",
-  ("read_only_space", 0x02455): "HoleNanValue",
-  ("read_only_space", 0x02489): "TrueValue",
-  ("read_only_space", 0x024c9): "FalseValue",
-  ("read_only_space", 0x024f9): "empty_string",
-  ("read_only_space", 0x02735): "EmptyScopeInfo",
-  ("read_only_space", 0x02765): "ArgumentsMarker",
-  ("read_only_space", 0x027c5): "Exception",
-  ("read_only_space", 0x02821): "TerminationException",
-  ("read_only_space", 0x02889): "OptimizedOut",
-  ("read_only_space", 0x028e9): "StaleRegister",
-  ("read_only_space", 0x031b9): "EmptyPropertyArray",
-  ("read_only_space", 0x031c1): "EmptyByteArray",
-  ("read_only_space", 0x031c9): "EmptyObjectBoilerplateDescription",
-  ("read_only_space", 0x031fd): "EmptyArrayBoilerplateDescription",
-  ("read_only_space", 0x03209): "EmptyClosureFeedbackCellArray",
-  ("read_only_space", 0x03211): "EmptySlowElementDictionary",
-  ("read_only_space", 0x03235): "EmptyOrderedHashMap",
-  ("read_only_space", 0x03249): "EmptyOrderedHashSet",
-  ("read_only_space", 0x0325d): "EmptyFeedbackMetadata",
-  ("read_only_space", 0x03269): "EmptyPropertyCell",
-  ("read_only_space", 0x0327d): "EmptyPropertyDictionary",
-  ("read_only_space", 0x032cd): "NoOpInterceptorInfo",
-  ("read_only_space", 0x032f5): "EmptyWeakArrayList",
-  ("read_only_space", 0x03301): "InfinityValue",
-  ("read_only_space", 0x0330d): "MinusZeroValue",
-  ("read_only_space", 0x03319): "MinusInfinityValue",
-  ("read_only_space", 0x03325): "SelfReferenceMarker",
-  ("read_only_space", 0x03365): "BasicBlockCountersMarker",
-  ("read_only_space", 0x033a9): "OffHeapTrampolineRelocationInfo",
-  ("read_only_space", 0x033b5): "TrampolineTrivialCodeDataContainer",
-  ("read_only_space", 0x033c1): "TrampolinePromiseRejectionCodeDataContainer",
-  ("read_only_space", 0x033cd): "GlobalThisBindingScopeInfo",
-  ("read_only_space", 0x03405): "EmptyFunctionScopeInfo",
-  ("read_only_space", 0x0342d): "NativeScopeInfo",
-  ("read_only_space", 0x03449): "HashSeed",
+  ("read_only_space", 0x021cd): "NullValue",
+  ("read_only_space", 0x02289): "UninitializedValue",
+  ("read_only_space", 0x02329): "UndefinedValue",
+  ("read_only_space", 0x0236d): "NanValue",
+  ("read_only_space", 0x023a1): "TheHoleValue",
+  ("read_only_space", 0x023cd): "HoleNanValue",
+  ("read_only_space", 0x02401): "TrueValue",
+  ("read_only_space", 0x02441): "FalseValue",
+  ("read_only_space", 0x02471): "empty_string",
+  ("read_only_space", 0x026d5): "EmptyScopeInfo",
+  ("read_only_space", 0x026dd): "EmptyFixedArray",
+  ("read_only_space", 0x0270d): "ArgumentsMarker",
+  ("read_only_space", 0x0276d): "Exception",
+  ("read_only_space", 0x027c9): "TerminationException",
+  ("read_only_space", 0x02831): "OptimizedOut",
+  ("read_only_space", 0x02891): "StaleRegister",
+  ("read_only_space", 0x03189): "EmptyEnumCache",
+  ("read_only_space", 0x03195): "EmptyPropertyArray",
+  ("read_only_space", 0x0319d): "EmptyByteArray",
+  ("read_only_space", 0x031a5): "EmptyObjectBoilerplateDescription",
+  ("read_only_space", 0x031d9): "EmptyArrayBoilerplateDescription",
+  ("read_only_space", 0x031e5): "EmptyClosureFeedbackCellArray",
+  ("read_only_space", 0x031ed): "EmptySlowElementDictionary",
+  ("read_only_space", 0x03211): "EmptyOrderedHashMap",
+  ("read_only_space", 0x03225): "EmptyOrderedHashSet",
+  ("read_only_space", 0x03239): "EmptyFeedbackMetadata",
+  ("read_only_space", 0x03245): "EmptyPropertyCell",
+  ("read_only_space", 0x03259): "EmptyPropertyDictionary",
+  ("read_only_space", 0x032a9): "NoOpInterceptorInfo",
+  ("read_only_space", 0x032d1): "EmptyWeakArrayList",
+  ("read_only_space", 0x032dd): "InfinityValue",
+  ("read_only_space", 0x032e9): "MinusZeroValue",
+  ("read_only_space", 0x032f5): "MinusInfinityValue",
+  ("read_only_space", 0x03301): "SelfReferenceMarker",
+  ("read_only_space", 0x03341): "BasicBlockCountersMarker",
+  ("read_only_space", 0x03385): "OffHeapTrampolineRelocationInfo",
+  ("read_only_space", 0x03391): "TrampolineTrivialCodeDataContainer",
+  ("read_only_space", 0x0339d): "TrampolinePromiseRejectionCodeDataContainer",
+  ("read_only_space", 0x033a9): "GlobalThisBindingScopeInfo",
+  ("read_only_space", 0x033e1): "EmptyFunctionScopeInfo",
+  ("read_only_space", 0x03409): "NativeScopeInfo",
+  ("read_only_space", 0x03425): "HashSeed",
   ("old_space", 0x02115): "ArgumentsIteratorAccessor",
   ("old_space", 0x02159): "ArrayLengthAccessor",
   ("old_space", 0x0219d): "BoundFunctionLengthAccessor",