Reland "[runtime] introduced instrance type for each context type"

This is a reland of 6da438fd

Original change's description:
> [runtime] introduced instrance type for each context type
> 
> Each context type get own instance type:
> - we can make CSA checks more strict in couple places,
> - it is requires step for advanced evaluation without side effects.
> 
> R=yangguo@chromium.org
> 
> Bug: v8:7588
> Change-Id: I585e8b55a280a909fc3c6069ed30e34b7040d0c7
> Reviewed-on: https://chromium-review.googlesource.com/977041
> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52191}

Bug: v8:7588
Change-Id: I80110ff814c0315d7ca694b7d0aef5b10df614f0
Reviewed-on: https://chromium-review.googlesource.com/978584Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52196}

src/builtins/builtins-regexp-gen.cc

@@ -26,7 +26,7 @@ using compiler::Node;
 
 Node* RegExpBuiltinsAssembler::AllocateRegExpResult(Node* context, Node* length,
                                                     Node* index, Node* input) {
-  CSA_ASSERT(this, IsFixedArray(context));
+  CSA_ASSERT(this, IsContext(context));
   CSA_ASSERT(this, TaggedIsSmi(index));
   CSA_ASSERT(this, TaggedIsSmi(length));
   CSA_ASSERT(this, IsString(input));

src/code-stub-assembler.cc

@@ -2134,8 +2134,10 @@ Node* CodeStubAssembler::StoreFixedArrayElement(Node* object, Node* index_node,
                                                 int additional_offset,
                                                 ParameterMode parameter_mode) {
   CSA_SLOW_ASSERT(
-      this, Word32Or(IsHashTable(object),
-                     Word32Or(IsFixedArray(object), IsPropertyArray(object))));
+      this,
+      Word32Or(IsHashTable(object),
+               Word32Or(IsFixedArray(object),
+                        Word32Or(IsPropertyArray(object), IsContext(object)))));
   CSA_SLOW_ASSERT(this, MatchesParameterMode(index_node, parameter_mode));
   DCHECK(barrier_mode == SKIP_WRITE_BARRIER ||
          barrier_mode == UPDATE_WRITE_BARRIER);
@@ -2438,12 +2440,12 @@ TNode<String> CodeStubAssembler::AllocateSeqOneByteString(
   return CAST(result);
 }
 
-Node* CodeStubAssembler::IsZeroOrFixedArray(Node* object) {
+Node* CodeStubAssembler::IsZeroOrContext(Node* object) {
   Label out(this);
   VARIABLE(var_result, MachineRepresentation::kWord32, Int32Constant(1));
 
   GotoIf(WordEqual(object, SmiConstant(0)), &out);
-  GotoIf(IsFixedArray(object), &out);
+  GotoIf(IsContext(object), &out);
 
   var_result.Bind(Int32Constant(0));
   Goto(&out);
@@ -2455,7 +2457,7 @@ Node* CodeStubAssembler::IsZeroOrFixedArray(Node* object) {
 TNode<String> CodeStubAssembler::AllocateSeqOneByteString(
     Node* context, TNode<Smi> length, AllocationFlags flags) {
   Comment("AllocateSeqOneByteString");
-  CSA_SLOW_ASSERT(this, IsZeroOrFixedArray(context));
+  CSA_SLOW_ASSERT(this, IsZeroOrContext(context));
   VARIABLE(var_result, MachineRepresentation::kTagged);
 
   // Compute the SeqOneByteString size and check if it fits into new space.
@@ -2524,7 +2526,7 @@ TNode<String> CodeStubAssembler::AllocateSeqTwoByteString(
 
 TNode<String> CodeStubAssembler::AllocateSeqTwoByteString(
     Node* context, TNode<Smi> length, AllocationFlags flags) {
-  CSA_SLOW_ASSERT(this, IsZeroOrFixedArray(context));
+  CSA_SLOW_ASSERT(this, IsZeroOrContext(context));
   Comment("AllocateSeqTwoByteString");
   VARIABLE(var_result, MachineRepresentation::kTagged);
 
@@ -2650,7 +2652,7 @@ TNode<String> CodeStubAssembler::NewConsString(Node* context, TNode<Smi> length,
                                                TNode<String> left,
                                                TNode<String> right,
                                                AllocationFlags flags) {
-  CSA_ASSERT(this, IsFixedArray(context));
+  CSA_ASSERT(this, IsContext(context));
   // Added string can be a cons string.
   Comment("Allocating ConsString");
   Node* left_instance_type = LoadInstanceType(left);
@@ -4552,6 +4554,13 @@ Node* CodeStubAssembler::IsJSAsyncGeneratorObject(Node* object) {
   return HasInstanceType(object, JS_ASYNC_GENERATOR_OBJECT_TYPE);
 }
 
+Node* CodeStubAssembler::IsContext(Node* object) {
+  Node* instance_type = LoadInstanceType(object);
+  return Word32And(
+      Int32GreaterThanOrEqual(instance_type, Int32Constant(FIRST_CONTEXT_TYPE)),
+      Int32LessThanOrEqual(instance_type, Int32Constant(LAST_CONTEXT_TYPE)));
+}
+
 Node* CodeStubAssembler::IsFixedArray(Node* object) {
   return HasInstanceType(object, FIXED_ARRAY_TYPE);
 }

src/code-stub-assembler.h

@@ -1118,6 +1118,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
       TNode<Context> native_context);
   Node* IsFeedbackCell(Node* object);
   Node* IsFeedbackVector(Node* object);
+  Node* IsContext(Node* object);
   Node* IsFixedArray(Node* object);
   Node* IsFixedArraySubclass(Node* object);
   Node* IsFixedArrayWithKind(Node* object, ElementsKind kind);
@@ -1180,7 +1181,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   Node* IsSymbol(Node* object);
   Node* IsUndetectableMap(Node* map);
   Node* IsWeakCell(Node* object);
-  Node* IsZeroOrFixedArray(Node* object);
+  Node* IsZeroOrContext(Node* object);
 
   inline Node* IsSharedFunctionInfo(Node* object) {
     return IsSharedFunctionInfoMap(LoadMap(object));

src/compiler/allocation-builder.h

@@ -48,6 +48,16 @@ class AllocationBuilder final {
                                index, value, effect_, control_);
   }
 
+  // Compound allocation of a context.
+  void AllocateContext(int length, Handle<Map> map) {
+    DCHECK(map->instance_type() >= BLOCK_CONTEXT_TYPE &&
+           map->instance_type() <= WITH_CONTEXT_TYPE);
+    int size = FixedArray::SizeFor(length);
+    Allocate(size, NOT_TENURED, Type::OtherInternal());
+    Store(AccessBuilder::ForMap(), map);
+    Store(AccessBuilder::ForFixedArrayLength(), jsgraph()->Constant(length));
+  }
+
   // Compound allocation of a FixedArray.
   void AllocateArray(int length, Handle<Map> map,
                      PretenureFlag pretenure = NOT_TENURED) {

src/compiler/js-create-lowering.cc

@@ -1241,7 +1241,7 @@ Reduction JSCreateLowering::ReduceJSCreateFunctionContext(Node* node) {
       default:
         UNREACHABLE();
     }
-    a.AllocateArray(context_length, map);
+    a.AllocateContext(context_length, map);
     a.Store(AccessBuilder::ForContextSlot(Context::CLOSURE_INDEX), closure);
     a.Store(AccessBuilder::ForContextSlot(Context::PREVIOUS_INDEX), context);
     a.Store(AccessBuilder::ForContextSlot(Context::EXTENSION_INDEX), extension);
@@ -1276,7 +1276,7 @@ Reduction JSCreateLowering::ReduceJSCreateWithContext(Node* node) {
 
   AllocationBuilder a(jsgraph(), extension, control);
   STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4);  // Ensure fully covered.
-  a.AllocateArray(Context::MIN_CONTEXT_SLOTS, factory()->with_context_map());
+  a.AllocateContext(Context::MIN_CONTEXT_SLOTS, factory()->with_context_map());
   a.Store(AccessBuilder::ForContextSlot(Context::CLOSURE_INDEX), closure);
   a.Store(AccessBuilder::ForContextSlot(Context::PREVIOUS_INDEX), context);
   a.Store(AccessBuilder::ForContextSlot(Context::EXTENSION_INDEX), extension);
@@ -1308,8 +1308,8 @@ Reduction JSCreateLowering::ReduceJSCreateCatchContext(Node* node) {
 
   AllocationBuilder a(jsgraph(), extension, control);
   STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4);  // Ensure fully covered.
-  a.AllocateArray(Context::MIN_CONTEXT_SLOTS + 1,
-                  factory()->catch_context_map());
+  a.AllocateContext(Context::MIN_CONTEXT_SLOTS + 1,
+                    factory()->catch_context_map());
   a.Store(AccessBuilder::ForContextSlot(Context::CLOSURE_INDEX), closure);
   a.Store(AccessBuilder::ForContextSlot(Context::PREVIOUS_INDEX), context);
   a.Store(AccessBuilder::ForContextSlot(Context::EXTENSION_INDEX), extension);
@@ -1338,7 +1338,7 @@ Reduction JSCreateLowering::ReduceJSCreateBlockContext(Node* node) {
 
     AllocationBuilder a(jsgraph(), effect, control);
     STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4);  // Ensure fully covered.
-    a.AllocateArray(context_length, factory()->block_context_map());
+    a.AllocateContext(context_length, factory()->block_context_map());
     a.Store(AccessBuilder::ForContextSlot(Context::CLOSURE_INDEX), closure);
     a.Store(AccessBuilder::ForContextSlot(Context::PREVIOUS_INDEX), context);
     a.Store(AccessBuilder::ForContextSlot(Context::EXTENSION_INDEX), extension);

src/compiler/types.cc

@@ -275,6 +275,15 @@ Type::bitset BitsetType::Lub(i::Map* map) {
     case PROPERTY_ARRAY_TYPE:
     case FOREIGN_TYPE:
     case SCOPE_INFO_TYPE:
+    case BLOCK_CONTEXT_TYPE:
+    case CATCH_CONTEXT_TYPE:
+    case DEBUG_EVALUATE_CONTEXT_TYPE:
+    case EVAL_CONTEXT_TYPE:
+    case FUNCTION_CONTEXT_TYPE:
+    case MODULE_CONTEXT_TYPE:
+    case NATIVE_CONTEXT_TYPE:
+    case SCRIPT_CONTEXT_TYPE:
+    case WITH_CONTEXT_TYPE:
     case SCRIPT_TYPE:
     case CODE_TYPE:
     case PROPERTY_CELL_TYPE:

src/contexts-inl.h

@@ -80,48 +80,39 @@ void Context::set_native_context(Context* context) {
 }
 
 bool Context::IsNativeContext() const {
-  Map* map = this->map();
-  return map == map->GetHeap()->native_context_map();
+  return map()->instance_type() == NATIVE_CONTEXT_TYPE;
 }
 
 bool Context::IsFunctionContext() const {
-  Map* map = this->map();
-  return map == map->GetHeap()->function_context_map();
+  return map()->instance_type() == FUNCTION_CONTEXT_TYPE;
 }
 
 bool Context::IsCatchContext() const {
-  Map* map = this->map();
-  return map == map->GetHeap()->catch_context_map();
+  return map()->instance_type() == CATCH_CONTEXT_TYPE;
 }
 
 bool Context::IsWithContext() const {
-  Map* map = this->map();
-  return map == map->GetHeap()->with_context_map();
+  return map()->instance_type() == WITH_CONTEXT_TYPE;
 }
 
 bool Context::IsDebugEvaluateContext() const {
-  Map* map = this->map();
-  return map == map->GetHeap()->debug_evaluate_context_map();
+  return map()->instance_type() == DEBUG_EVALUATE_CONTEXT_TYPE;
 }
 
 bool Context::IsBlockContext() const {
-  Map* map = this->map();
-  return map == map->GetHeap()->block_context_map();
+  return map()->instance_type() == BLOCK_CONTEXT_TYPE;
 }
 
 bool Context::IsModuleContext() const {
-  Map* map = this->map();
-  return map == map->GetHeap()->module_context_map();
+  return map()->instance_type() == MODULE_CONTEXT_TYPE;
 }
 
 bool Context::IsEvalContext() const {
-  Map* map = this->map();
-  return map == map->GetHeap()->eval_context_map();
+  return map()->instance_type() == EVAL_CONTEXT_TYPE;
 }
 
 bool Context::IsScriptContext() const {
-  Map* map = this->map();
-  return map == map->GetHeap()->script_context_map();
+  return map()->instance_type() == SCRIPT_CONTEXT_TYPE;
 }
 
 bool Context::HasSameSecurityTokenAs(Context* that) const {

src/deoptimizer.cc

@@ -3375,6 +3375,15 @@ void TranslatedState::InitializeCapturedObjectAt(
       return;
 
     case FIXED_ARRAY_TYPE:
+    case BLOCK_CONTEXT_TYPE:
+    case CATCH_CONTEXT_TYPE:
+    case DEBUG_EVALUATE_CONTEXT_TYPE:
+    case EVAL_CONTEXT_TYPE:
+    case FUNCTION_CONTEXT_TYPE:
+    case MODULE_CONTEXT_TYPE:
+    case NATIVE_CONTEXT_TYPE:
+    case SCRIPT_CONTEXT_TYPE:
+    case WITH_CONTEXT_TYPE:
     case BOILERPLATE_DESCRIPTION_TYPE:
     case HASH_TABLE_TYPE:
     case PROPERTY_ARRAY_TYPE:
@@ -3501,6 +3510,15 @@ void TranslatedState::EnsureCapturedObjectAllocatedAt(
       return MaterializeMutableHeapNumber(frame, &value_index, slot);
 
     case FIXED_ARRAY_TYPE:
+    case BLOCK_CONTEXT_TYPE:
+    case CATCH_CONTEXT_TYPE:
+    case DEBUG_EVALUATE_CONTEXT_TYPE:
+    case EVAL_CONTEXT_TYPE:
+    case FUNCTION_CONTEXT_TYPE:
+    case MODULE_CONTEXT_TYPE:
+    case NATIVE_CONTEXT_TYPE:
+    case SCRIPT_CONTEXT_TYPE:
+    case WITH_CONTEXT_TYPE:
     case HASH_TABLE_TYPE: {
       // Check we have the right size.
       int array_length =

src/heap/object-stats.cc

@@ -775,11 +775,9 @@ void ObjectStatsCollectorImpl::RecordVirtualCodeDetails(Code* code) {
 
 void ObjectStatsCollectorImpl::RecordVirtualContext(Context* context) {
   if (context->IsNativeContext()) {
-    RecordSimpleVirtualObjectStats(nullptr, context,
-                                   ObjectStats::NATIVE_CONTEXT_TYPE);
+    RecordObjectStats(context, NATIVE_CONTEXT_TYPE, context->Size());
   } else if (context->IsFunctionContext()) {
-    RecordSimpleVirtualObjectStats(nullptr, context,
-                                   ObjectStats::FUNCTION_CONTEXT_TYPE);
+    RecordObjectStats(context, FUNCTION_CONTEXT_TYPE, context->Size());
   } else {
     RecordSimpleVirtualObjectStats(nullptr, context,
                                    ObjectStats::OTHER_CONTEXT_TYPE);

src/heap/object-stats.h

@@ -39,14 +39,12 @@
   V(FEEDBACK_VECTOR_SLOT_OTHER_TYPE)        \
   V(FEEDBACK_VECTOR_SLOT_STORE_TYPE)        \
   V(FEEDBACK_VECTOR_SLOT_STORE_UNUSED_TYPE) \
-  V(FUNCTION_CONTEXT_TYPE)                  \
   V(FUNCTION_TEMPLATE_INFO_ENTRIES_TYPE)    \
   V(GLOBAL_ELEMENTS_TYPE)                   \
   V(GLOBAL_PROPERTIES_TYPE)                 \
   V(JS_ARRAY_BOILERPLATE_TYPE)              \
   V(JS_COLLETION_TABLE_TYPE)                \
   V(JS_OBJECT_BOILERPLATE_TYPE)             \
-  V(NATIVE_CONTEXT_TYPE)                    \
   V(NOSCRIPT_SHARED_FUNCTION_INFOS_TYPE)    \
   V(NUMBER_STRING_CACHE_TYPE)               \
   V(OBJECT_PROPERTY_DICTIONARY_TYPE)        \

src/heap/setup-heap-internal.cc

@@ -332,19 +332,19 @@ bool Heap::CreateInitialMaps() {
 
     ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, array_list)
 
-    ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, function_context)
-    ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, catch_context)
-    ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, with_context)
-    ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, debug_evaluate_context)
-    ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, block_context)
-    ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, module_context)
-    ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, eval_context)
-    ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, script_context)
+    ALLOCATE_VARSIZE_MAP(FUNCTION_CONTEXT_TYPE, function_context)
+    ALLOCATE_VARSIZE_MAP(CATCH_CONTEXT_TYPE, catch_context)
+    ALLOCATE_VARSIZE_MAP(WITH_CONTEXT_TYPE, with_context)
+    ALLOCATE_VARSIZE_MAP(DEBUG_EVALUATE_CONTEXT_TYPE, debug_evaluate_context)
+    ALLOCATE_VARSIZE_MAP(BLOCK_CONTEXT_TYPE, block_context)
+    ALLOCATE_VARSIZE_MAP(MODULE_CONTEXT_TYPE, module_context)
+    ALLOCATE_VARSIZE_MAP(EVAL_CONTEXT_TYPE, eval_context)
+    ALLOCATE_VARSIZE_MAP(SCRIPT_CONTEXT_TYPE, script_context)
     ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, script_context_table)
 
     ALLOCATE_VARSIZE_MAP(BOILERPLATE_DESCRIPTION_TYPE, boilerplate_description)
 
-    ALLOCATE_VARSIZE_MAP(FIXED_ARRAY_TYPE, native_context)
+    ALLOCATE_VARSIZE_MAP(NATIVE_CONTEXT_TYPE, native_context)
     native_context_map()->set_visitor_id(kVisitNativeContext);
 
     ALLOCATE_MAP(SHARED_FUNCTION_INFO_TYPE, SharedFunctionInfo::kAlignedSize,

src/objects-body-descriptors-inl.h

@@ -515,6 +515,15 @@ ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3) {
     case BOILERPLATE_DESCRIPTION_TYPE:
     case HASH_TABLE_TYPE:
     case SCOPE_INFO_TYPE:
+    case BLOCK_CONTEXT_TYPE:
+    case CATCH_CONTEXT_TYPE:
+    case DEBUG_EVALUATE_CONTEXT_TYPE:
+    case EVAL_CONTEXT_TYPE:
+    case FUNCTION_CONTEXT_TYPE:
+    case MODULE_CONTEXT_TYPE:
+    case NATIVE_CONTEXT_TYPE:
+    case SCRIPT_CONTEXT_TYPE:
+    case WITH_CONTEXT_TYPE:
       return Op::template apply<FixedArray::BodyDescriptor>(p1, p2, p3);
     case WEAK_FIXED_ARRAY_TYPE:
       return Op::template apply<WeakFixedArray::BodyDescriptor>(p1, p2, p3);

src/objects-debug.cc

@@ -124,6 +124,15 @@ void HeapObject::HeapObjectVerify() {
     case BOILERPLATE_DESCRIPTION_TYPE:
     case FIXED_ARRAY_TYPE:
     case SCOPE_INFO_TYPE:
+    case BLOCK_CONTEXT_TYPE:
+    case CATCH_CONTEXT_TYPE:
+    case DEBUG_EVALUATE_CONTEXT_TYPE:
+    case EVAL_CONTEXT_TYPE:
+    case FUNCTION_CONTEXT_TYPE:
+    case MODULE_CONTEXT_TYPE:
+    case NATIVE_CONTEXT_TYPE:
+    case SCRIPT_CONTEXT_TYPE:
+    case WITH_CONTEXT_TYPE:
       FixedArray::cast(this)->FixedArrayVerify();
       break;
     case WEAK_FIXED_ARRAY_TYPE:

src/objects-printer.cc

@@ -91,6 +91,15 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
       break;
     case HASH_TABLE_TYPE:
     case FIXED_ARRAY_TYPE:
+    case BLOCK_CONTEXT_TYPE:
+    case CATCH_CONTEXT_TYPE:
+    case DEBUG_EVALUATE_CONTEXT_TYPE:
+    case EVAL_CONTEXT_TYPE:
+    case FUNCTION_CONTEXT_TYPE:
+    case MODULE_CONTEXT_TYPE:
+    case NATIVE_CONTEXT_TYPE:
+    case SCRIPT_CONTEXT_TYPE:
+    case WITH_CONTEXT_TYPE:
       FixedArray::cast(this)->FixedArrayPrint(os);
       break;
     case BOILERPLATE_DESCRIPTION_TYPE:

src/objects.cc

@@ -2987,6 +2987,15 @@ VisitorId Map::GetVisitorId(Map* map) {
     case HASH_TABLE_TYPE:
     case DESCRIPTOR_ARRAY_TYPE:
     case SCOPE_INFO_TYPE:
+    case BLOCK_CONTEXT_TYPE:
+    case CATCH_CONTEXT_TYPE:
+    case DEBUG_EVALUATE_CONTEXT_TYPE:
+    case EVAL_CONTEXT_TYPE:
+    case FUNCTION_CONTEXT_TYPE:
+    case MODULE_CONTEXT_TYPE:
+    case NATIVE_CONTEXT_TYPE:
+    case SCRIPT_CONTEXT_TYPE:
+    case WITH_CONTEXT_TYPE:
       return kVisitFixedArray;
 
     case WEAK_FIXED_ARRAY_TYPE:

src/objects.h

@@ -412,6 +412,16 @@ const int kStubMinorKeyBits = kSmiValueSize - kStubMajorKeyBits - 1;
   V(SCOPE_INFO_TYPE)                                            \
   V(TRANSITION_ARRAY_TYPE)                                      \
                                                                 \
+  V(BLOCK_CONTEXT_TYPE)                                         \
+  V(CATCH_CONTEXT_TYPE)                                         \
+  V(DEBUG_EVALUATE_CONTEXT_TYPE)                                \
+  V(EVAL_CONTEXT_TYPE)                                          \
+  V(FUNCTION_CONTEXT_TYPE)                                      \
+  V(MODULE_CONTEXT_TYPE)                                        \
+  V(NATIVE_CONTEXT_TYPE)                                        \
+  V(SCRIPT_CONTEXT_TYPE)                                        \
+  V(WITH_CONTEXT_TYPE)                                          \
+                                                                \
   V(CELL_TYPE)                                                  \
   V(CODE_DATA_CONTAINER_TYPE)                                   \
   V(FEEDBACK_CELL_TYPE)                                         \
@@ -764,7 +774,16 @@ enum InstanceType : uint16_t {
   DESCRIPTOR_ARRAY_TYPE,
   HASH_TABLE_TYPE,
   SCOPE_INFO_TYPE,
-  TRANSITION_ARRAY_TYPE,  // LAST_FIXED_ARRAY_TYPE
+  TRANSITION_ARRAY_TYPE,
+  BLOCK_CONTEXT_TYPE,  // FIRST_CONTEXT_TYPE
+  CATCH_CONTEXT_TYPE,
+  DEBUG_EVALUATE_CONTEXT_TYPE,
+  EVAL_CONTEXT_TYPE,
+  FUNCTION_CONTEXT_TYPE,
+  MODULE_CONTEXT_TYPE,
+  NATIVE_CONTEXT_TYPE,
+  SCRIPT_CONTEXT_TYPE,
+  WITH_CONTEXT_TYPE,  // LAST_FIXED_ARRAY_TYPE, LAST_CONTEXT_TYPE
 
   // Misc.
   CELL_TYPE,
@@ -847,7 +866,10 @@ enum InstanceType : uint16_t {
   LAST_FUNCTION_TYPE = JS_FUNCTION_TYPE,
   // Boundaries for testing if given HeapObject is a subclass of FixedArray.
   FIRST_FIXED_ARRAY_TYPE = FIXED_ARRAY_TYPE,
-  LAST_FIXED_ARRAY_TYPE = TRANSITION_ARRAY_TYPE,
+  LAST_FIXED_ARRAY_TYPE = WITH_CONTEXT_TYPE,
+  // Boundaries for testing if given HeapObject is a Context
+  FIRST_CONTEXT_TYPE = BLOCK_CONTEXT_TYPE,
+  LAST_CONTEXT_TYPE = WITH_CONTEXT_TYPE,
   // Boundaries for testing if given HeapObject is a subclass of Microtask.
   FIRST_MICROTASK_TYPE = CALLABLE_TASK_TYPE,
   LAST_MICROTASK_TYPE = PROMISE_RESOLVE_THENABLE_JOB_TASK_TYPE,

tools/v8heapconst.py

@@ -89,19 +89,28 @@ INSTANCE_TYPES = {
   185: "HASH_TABLE_TYPE",
   186: "SCOPE_INFO_TYPE",
   187: "TRANSITION_ARRAY_TYPE",
-  188: "CELL_TYPE",
-  189: "CODE_DATA_CONTAINER_TYPE",
-  190: "FEEDBACK_CELL_TYPE",
-  191: "FEEDBACK_VECTOR_TYPE",
-  192: "LOAD_HANDLER_TYPE",
-  193: "PROPERTY_ARRAY_TYPE",
-  194: "PROPERTY_CELL_TYPE",
-  195: "SHARED_FUNCTION_INFO_TYPE",
-  196: "SMALL_ORDERED_HASH_MAP_TYPE",
-  197: "SMALL_ORDERED_HASH_SET_TYPE",
-  198: "STORE_HANDLER_TYPE",
-  199: "WEAK_CELL_TYPE",
-  200: "WEAK_FIXED_ARRAY_TYPE",
+  188: "BLOCK_CONTEXT_TYPE",
+  189: "CATCH_CONTEXT_TYPE",
+  190: "DEBUG_EVALUATE_CONTEXT_TYPE",
+  191: "EVAL_CONTEXT_TYPE",
+  192: "FUNCTION_CONTEXT_TYPE",
+  193: "MODULE_CONTEXT_TYPE",
+  194: "NATIVE_CONTEXT_TYPE",
+  195: "SCRIPT_CONTEXT_TYPE",
+  196: "WITH_CONTEXT_TYPE",
+  197: "CELL_TYPE",
+  198: "CODE_DATA_CONTAINER_TYPE",
+  199: "FEEDBACK_CELL_TYPE",
+  200: "FEEDBACK_VECTOR_TYPE",
+  201: "LOAD_HANDLER_TYPE",
+  202: "PROPERTY_ARRAY_TYPE",
+  203: "PROPERTY_CELL_TYPE",
+  204: "SHARED_FUNCTION_INFO_TYPE",
+  205: "SMALL_ORDERED_HASH_MAP_TYPE",
+  206: "SMALL_ORDERED_HASH_SET_TYPE",
+  207: "STORE_HANDLER_TYPE",
+  208: "WEAK_CELL_TYPE",
+  209: "WEAK_FIXED_ARRAY_TYPE",
   1024: "JS_PROXY_TYPE",
   1025: "JS_GLOBAL_OBJECT_TYPE",
   1026: "JS_GLOBAL_PROXY_TYPE",
@@ -164,55 +173,55 @@ KNOWN_MAPS = {
   0x02781: (128, "SymbolMap"),
   0x027d9: (72, "OneByteStringMap"),
   0x02831: (186, "ScopeInfoMap"),
-  0x02889: (195, "SharedFunctionInfoMap"),
+  0x02889: (204, "SharedFunctionInfoMap"),
   0x028e1: (133, "CodeMap"),
-  0x02939: (182, "FunctionContextMap"),
-  0x02991: (188, "CellMap"),
-  0x029e9: (199, "WeakCellMap"),
-  0x02a41: (194, "GlobalPropertyCellMap"),
+  0x02939: (192, "FunctionContextMap"),
+  0x02991: (197, "CellMap"),
+  0x029e9: (208, "WeakCellMap"),
+  0x02a41: (203, "GlobalPropertyCellMap"),
   0x02a99: (135, "ForeignMap"),
   0x02af1: (187, "TransitionArrayMap"),
-  0x02b49: (191, "FeedbackVectorMap"),
+  0x02b49: (200, "FeedbackVectorMap"),
   0x02ba1: (131, "ArgumentsMarkerMap"),
   0x02bf9: (131, "ExceptionMap"),
   0x02c51: (131, "TerminationExceptionMap"),
   0x02ca9: (131, "OptimizedOutMap"),
   0x02d01: (131, "StaleRegisterMap"),
-  0x02d59: (182, "NativeContextMap"),
-  0x02db1: (182, "ModuleContextMap"),
-  0x02e09: (182, "EvalContextMap"),
-  0x02e61: (182, "ScriptContextMap"),
-  0x02eb9: (182, "BlockContextMap"),
-  0x02f11: (182, "CatchContextMap"),
-  0x02f69: (182, "WithContextMap"),
-  0x02fc1: (182, "DebugEvaluateContextMap"),
+  0x02d59: (194, "NativeContextMap"),
+  0x02db1: (193, "ModuleContextMap"),
+  0x02e09: (191, "EvalContextMap"),
+  0x02e61: (195, "ScriptContextMap"),
+  0x02eb9: (188, "BlockContextMap"),
+  0x02f11: (189, "CatchContextMap"),
+  0x02f69: (196, "WithContextMap"),
+  0x02fc1: (190, "DebugEvaluateContextMap"),
   0x03019: (182, "ScriptContextTableMap"),
   0x03071: (151, "FeedbackMetadataArrayMap"),
   0x030c9: (182, "ArrayListMap"),
   0x03121: (130, "BigIntMap"),
   0x03179: (183, "BoilerplateDescriptionMap"),
   0x031d1: (137, "BytecodeArrayMap"),
-  0x03229: (189, "CodeDataContainerMap"),
+  0x03229: (198, "CodeDataContainerMap"),
   0x03281: (1057, "ExternalMap"),
   0x032d9: (150, "FixedDoubleArrayMap"),
   0x03331: (185, "GlobalDictionaryMap"),
-  0x03389: (190, "ManyClosuresCellMap"),
+  0x03389: (199, "ManyClosuresCellMap"),
   0x033e1: (1072, "JSMessageObjectMap"),
   0x03439: (182, "ModuleInfoMap"),
   0x03491: (134, "MutableHeapNumberMap"),
   0x034e9: (185, "NameDictionaryMap"),
-  0x03541: (190, "NoClosuresCellMap"),
+  0x03541: (199, "NoClosuresCellMap"),
   0x03599: (185, "NumberDictionaryMap"),
-  0x035f1: (190, "OneClosureCellMap"),
+  0x035f1: (199, "OneClosureCellMap"),
   0x03649: (185, "OrderedHashMapMap"),
   0x036a1: (185, "OrderedHashSetMap"),
-  0x036f9: (193, "PropertyArrayMap"),
+  0x036f9: (202, "PropertyArrayMap"),
   0x03751: (185, "SimpleNumberDictionaryMap"),
   0x037a9: (182, "SloppyArgumentsElementsMap"),
-  0x03801: (196, "SmallOrderedHashMapMap"),
-  0x03859: (197, "SmallOrderedHashSetMap"),
+  0x03801: (205, "SmallOrderedHashMapMap"),
+  0x03859: (206, "SmallOrderedHashSetMap"),
   0x038b1: (185, "StringTableMap"),
-  0x03909: (200, "WeakFixedArrayMap"),
+  0x03909: (209, "WeakFixedArrayMap"),
   0x03961: (106, "NativeSourceStringMap"),
   0x039b9: (64, "StringMap"),
   0x03a11: (73, "ConsOneByteStringMap"),