[wasm-gc] Make WasmObject a subclass of JSReceiver

This is a first step towards supporting unwrapped WasmObject objects on
JavaScript side.

In addition this CL
1) introduces Representation::WasmValue which is used for all WasmObject
   fields exposed to JavaScript side.
2) adds creation of meaningful DescriptorArrays for WasmObject's Maps.

Bug: v8:11804
Change-Id: I4afcd39da5cb77b659943da54a2ca34d13bcc9bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912776
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74744}

src/builtins/wasm.tq

@@ -293,6 +293,8 @@ builtin WasmAllocateStructWithRtt(rtt: Map): HeapObject {
   const result: HeapObject = unsafe::Allocate(
       instanceSize, AllocationFlag::kAllowLargeObjectAllocation);
   *UnsafeConstCast(&result.map) = rtt;
+  // TODO(ishell): consider removing properties_or_hash field from WasmObjects.
+  %RawDownCast<WasmStruct>(result).properties_or_hash = kEmptyFixedArray;
   return result;
 }
 
@@ -307,6 +309,8 @@ builtin WasmAllocateArrayWithRtt(
   const result: HeapObject = unsafe::Allocate(
       instanceSize, AllocationFlag::kAllowLargeObjectAllocation);
   *UnsafeConstCast(&result.map) = rtt;
+  // TODO(ishell): consider removing properties_or_hash field from WasmObjects.
+  %RawDownCast<WasmArray>(result).properties_or_hash = kEmptyFixedArray;
   %RawDownCast<WasmArray>(result).length = length;
   return result;
 }

src/codegen/code-stub-assembler.cc

@@ -9776,8 +9776,6 @@ void CodeStubAssembler::TryPrototypeChainLookup(
   TNode<Uint16T> instance_type = LoadMapInstanceType(map);
   {
     Label if_objectisreceiver(this);
-    STATIC_ASSERT(LAST_JS_RECEIVER_TYPE == LAST_TYPE);
-    STATIC_ASSERT(FIRST_JS_RECEIVER_TYPE == JS_PROXY_TYPE);
     Branch(IsJSReceiverInstanceType(instance_type), &if_objectisreceiver,
            if_bailout);
     BIND(&if_objectisreceiver);

src/compiler/wasm-compiler.cc

@@ -5530,16 +5530,11 @@ Node* WasmGraphBuilder::StructNewWithRtt(uint32_t struct_index,
   for (uint32_t i = 0; i < type->field_count(); i++) {
     gasm_->StoreStructField(s, type, i, fields[i]);
   }
-  if (type->field_count() == 0) {
-    static_assert(Heap::kMinObjectSizeInTaggedWords == 2 &&
-                      WasmStruct::kHeaderSize == kTaggedSize,
-                  "empty structs need exactly one padding field");
-    wasm::ValueType fake_type = wasm::kWasmAnyRef;
-    Node* padding_offset = gasm_->IntPtrConstant(
-        wasm::ObjectAccess::ToTagged(WasmStruct::kHeaderSize));
-    gasm_->StoreToObject(ObjectAccessForGCStores(fake_type), s, padding_offset,
-                         RefNull());
-  }
+  // If this assert fails then initialization of padding field might be
+  // necessary.
+  static_assert(Heap::kMinObjectSizeInTaggedWords == 2 &&
+                    WasmStruct::kHeaderSize == 2 * kTaggedSize,
+                "empty struct might require initialization of padding field");
   return s;
 }
 

src/diagnostics/objects-printer.cc

@@ -1835,6 +1835,8 @@ void AsmWasmData::AsmWasmDataPrint(std::ostream& os) {
 void WasmTypeInfo::WasmTypeInfoPrint(std::ostream& os) {
   PrintHeader(os, "WasmTypeInfo");
   os << "\n - type address: " << reinterpret_cast<void*>(foreign_address());
+  os << "\n - supertypes: " << Brief(supertypes());
+  os << "\n - subtypes: " << Brief(subtypes());
   os << "\n";
 }
 
@@ -1846,7 +1848,7 @@ void WasmStruct::WasmStructPrint(std::ostream& os) {
     wasm::ValueType field = struct_type->field(i);
     os << "\n   - " << field.short_name() << ": ";
     uint32_t field_offset = struct_type->field_offset(i);
-    Address field_address = RawField(field_offset).address();
+    Address field_address = RawFieldAddress(field_offset);
     switch (field.kind()) {
       case wasm::kI32:
         os << base::ReadUnalignedValue<int32_t>(field_address);

src/objects/instance-type.h

@@ -175,13 +175,15 @@ TORQUE_ASSIGNED_INSTANCE_TYPE_LIST(CHECK_NONSTRING_RANGE)
 #define CHECK_INSTANCE_TYPE(TYPE)                                          \
   STATIC_ASSERT((TYPE >= FIRST_JS_RECEIVER_TYPE &&                         \
                  TYPE <= LAST_SPECIAL_RECEIVER_TYPE) ==                    \
-                (TYPE == JS_PROXY_TYPE || TYPE == JS_GLOBAL_OBJECT_TYPE || \
+                (TYPE == WASM_STRUCT_TYPE || TYPE == WASM_ARRAY_TYPE ||    \
+                 TYPE == JS_PROXY_TYPE || TYPE == JS_GLOBAL_OBJECT_TYPE || \
                  TYPE == JS_GLOBAL_PROXY_TYPE ||                           \
                  TYPE == JS_MODULE_NAMESPACE_TYPE ||                       \
                  TYPE == JS_SPECIAL_API_OBJECT_TYPE));                     \
   STATIC_ASSERT((TYPE >= FIRST_JS_RECEIVER_TYPE &&                         \
                  TYPE <= LAST_CUSTOM_ELEMENTS_RECEIVER) ==                 \
-                (TYPE == JS_PROXY_TYPE || TYPE == JS_GLOBAL_OBJECT_TYPE || \
+                (TYPE == WASM_STRUCT_TYPE || TYPE == WASM_ARRAY_TYPE ||    \
+                 TYPE == JS_PROXY_TYPE || TYPE == JS_GLOBAL_OBJECT_TYPE || \
                  TYPE == JS_GLOBAL_PROXY_TYPE ||                           \
                  TYPE == JS_MODULE_NAMESPACE_TYPE ||                       \
                  TYPE == JS_SPECIAL_API_OBJECT_TYPE ||                     \

src/objects/property-details.h

@@ -91,7 +91,18 @@ enum class PropertyConstness { kMutable = 0, kConst = 1 };
 
 class Representation {
  public:
-  enum Kind { kNone, kSmi, kDouble, kHeapObject, kTagged, kNumRepresentations };
+  enum Kind {
+    kNone,
+    kSmi,
+    kDouble,
+    kHeapObject,
+    kTagged,
+    // This representation is used for WasmObject fields and basically means
+    // that the actual field type information must be taken from the Wasm RTT
+    // associated with the map.
+    kWasmValue,
+    kNumRepresentations
+  };
 
   Representation() : kind_(kNone) {}
 
@@ -100,6 +111,7 @@ class Representation {
   static Representation Smi() { return Representation(kSmi); }
   static Representation Double() { return Representation(kDouble); }
   static Representation HeapObject() { return Representation(kHeapObject); }
+  static Representation WasmValue() { return Representation(kWasmValue); }
 
   static Representation FromKind(Kind kind) { return Representation(kind); }
 
@@ -120,7 +132,12 @@ class Representation {
   bool MightCauseMapDeprecation() const {
     // HeapObject to tagged representation change can be done in-place.
     // Boxed double to tagged transition is always done in-place.
-    if (IsTagged() || IsHeapObject() || IsDouble()) return false;
+    // Note that WasmValue is not supposed to be changed at all (the only
+    // representation it fits into is WasmValue), so for the sake of predicate
+    // correctness we treat it as in-place "changeable".
+    if (IsTagged() || IsHeapObject() || IsDouble() || IsWasmValue()) {
+      return false;
+    }
     // None to double and smi to double representation changes require
     // deprecation, because doubles might require box allocation, see
     // CanBeInPlaceChangedTo().
@@ -130,6 +147,7 @@ class Representation {
 
   bool CanBeInPlaceChangedTo(const Representation& other) const {
     if (Equals(other)) return true;
+    if (IsWasmValue() || other.IsWasmValue()) return false;
     // If it's just a representation generalization case (i.e. property kind and
     // attributes stays unchanged) it's fine to transition from None to anything
     // but double without any modification to the object, because the default
@@ -145,10 +163,12 @@ class Representation {
   // changed to in-place. If an in-place representation change is not allowed,
   // then this will return the current representation.
   Representation MostGenericInPlaceChange() const {
+    if (IsWasmValue()) return Representation::WasmValue();
     return Representation::Tagged();
   }
 
   bool is_more_general_than(const Representation& other) const {
+    if (IsWasmValue()) return false;
     if (IsHeapObject()) return other.IsNone();
     return kind_ > other.kind_;
   }
@@ -172,6 +192,7 @@ class Representation {
 
   Kind kind() const { return static_cast<Kind>(kind_); }
   bool IsNone() const { return kind_ == kNone; }
+  bool IsWasmValue() const { return kind_ == kWasmValue; }
   bool IsTagged() const { return kind_ == kTagged; }
   bool IsSmi() const { return kind_ == kSmi; }
   bool IsSmiOrTagged() const { return IsSmi() || IsTagged(); }
@@ -190,6 +211,8 @@ class Representation {
         return "d";
       case kHeapObject:
         return "h";
+      case kWasmValue:
+        return "w";
     }
     UNREACHABLE();
   }

src/wasm/baseline/liftoff-compiler.cc

@@ -4833,18 +4833,11 @@ class LiftoffCompiler {
       StoreObjectField(obj.gp(), no_reg, offset, value, pinned, field_kind);
       pinned.clear(value);
     }
-    if (imm.struct_type->field_count() == 0) {
-      static_assert(Heap::kMinObjectSizeInTaggedWords == 2 &&
-                        WasmStruct::kHeaderSize == kTaggedSize,
-                    "empty structs need exactly one padding field");
-      ValueKind field_kind = ValueKind::kRef;
-      LiftoffRegister value = pinned.set(__ GetUnusedRegister(kGpReg, pinned));
-      LoadNullValue(value.gp(), pinned);
-      StoreObjectField(obj.gp(), no_reg,
-                       wasm::ObjectAccess::ToTagged(WasmStruct::kHeaderSize),
-                       value, pinned, field_kind);
-      pinned.clear(value);
-    }
+    // If this assert fails then initialization of padding field might be
+    // necessary.
+    static_assert(Heap::kMinObjectSizeInTaggedWords == 2 &&
+                      WasmStruct::kHeaderSize == 2 * kTaggedSize,
+                  "empty struct might require initialization of padding field");
     __ PushRegister(kRef, obj);
   }
 

src/wasm/module-instantiate.cc

@@ -10,6 +10,7 @@
 #include "src/logging/counters.h"
 #include "src/logging/metrics.h"
 #include "src/numbers/conversions-inl.h"
+#include "src/objects/descriptor-array-inl.h"
 #include "src/objects/property-descriptor.h"
 #include "src/tracing/trace-event.h"
 #include "src/utils/utils.h"
@@ -116,6 +117,61 @@ class CompileImportWrapperJob final : public JobTask {
   WasmImportWrapperCache::ModificationScope* const cache_scope_;
 };
 
+Handle<DescriptorArray> CreateStructDescriptorArray(
+    Isolate* isolate, const wasm::StructType* type) {
+  if (type->field_count() == 0) {
+    return isolate->factory()->empty_descriptor_array();
+  }
+  uint32_t field_count = type->field_count();
+  static_assert(kV8MaxWasmStructFields <= kMaxNumberOfDescriptors,
+                "Bigger numbers of struct fields require different approach");
+  Handle<DescriptorArray> descriptors =
+      isolate->factory()->NewDescriptorArray(field_count);
+
+  // TODO(ishell): cache Wasm field type in FieldType value.
+  MaybeObject any_type = MaybeObject::FromObject(FieldType::Any());
+  DCHECK(any_type->IsSmi());
+
+  i::EmbeddedVector<char, 128> name_buffer;
+  for (uint32_t i = 0; i < field_count; i++) {
+    // TODO(ishell): consider introducing a cache of first N internalized field
+    // names similar to LookupSingleCharacterStringFromCode().
+    SNPrintF(name_buffer, "$field%d", i);
+    Handle<String> name =
+        isolate->factory()->InternalizeUtf8String(name_buffer.begin());
+
+    PropertyAttributes attributes = type->mutability(i) ? SEALED : FROZEN;
+    PropertyDetails details(
+        PropertyKind::kData, attributes, PropertyLocation::kField,
+        PropertyConstness::kMutable,  // Don't track constness
+        Representation::WasmValue(), static_cast<int>(i));
+    descriptors->Set(InternalIndex(i), *name, any_type, details);
+  }
+  descriptors->Sort();
+  return descriptors;
+}
+
+Handle<DescriptorArray> CreateArrayDescriptorArray(
+    Isolate* isolate, const wasm::ArrayType* type) {
+  uint32_t kDescriptorsCount = 1;
+  Handle<DescriptorArray> descriptors =
+      isolate->factory()->NewDescriptorArray(kDescriptorsCount);
+
+  // TODO(ishell): cache Wasm field type in FieldType value.
+  MaybeObject any_type = MaybeObject::FromObject(FieldType::Any());
+  DCHECK(any_type->IsSmi());
+
+  // Add descriptor for length property.
+  PropertyDetails details(PropertyKind::kData, FROZEN, PropertyLocation::kField,
+                          PropertyConstness::kConst,
+                          Representation::WasmValue(), static_cast<int>(0));
+  descriptors->Set(InternalIndex(0), *isolate->factory()->length_string(),
+                   any_type, details);
+
+  descriptors->Sort();
+  return descriptors;
+}
+
 }  // namespace
 
 // TODO(jkummerow): Move these elsewhere.
@@ -132,9 +188,14 @@ Handle<Map> CreateStructMap(Isolate* isolate, const WasmModule* module,
   const ElementsKind elements_kind = TERMINAL_FAST_ELEMENTS_KIND;
   Handle<WasmTypeInfo> type_info = isolate->factory()->NewWasmTypeInfo(
       reinterpret_cast<Address>(type), opt_rtt_parent, real_instance_size);
+  Handle<DescriptorArray> descriptors =
+      CreateStructDescriptorArray(isolate, type);
   Handle<Map> map = isolate->factory()->NewMap(
       instance_type, map_instance_size, elements_kind, inobject_properties);
   map->set_wasm_type_info(*type_info);
+  map->SetInstanceDescriptors(isolate, *descriptors,
+                              descriptors->number_of_descriptors());
+  map->set_is_extensible(false);
   return map;
 }
 
@@ -149,9 +210,15 @@ Handle<Map> CreateArrayMap(Isolate* isolate, const WasmModule* module,
   const ElementsKind elements_kind = TERMINAL_FAST_ELEMENTS_KIND;
   Handle<WasmTypeInfo> type_info = isolate->factory()->NewWasmTypeInfo(
       reinterpret_cast<Address>(type), opt_rtt_parent, cached_instance_size);
+  // TODO(ishell): get canonical descriptor array for WasmArrays from roots.
+  Handle<DescriptorArray> descriptors =
+      CreateArrayDescriptorArray(isolate, type);
   Handle<Map> map = isolate->factory()->NewMap(
       instance_type, instance_size, elements_kind, inobject_properties);
   map->set_wasm_type_info(*type_info);
+  map->SetInstanceDescriptors(isolate, *descriptors,
+                              descriptors->number_of_descriptors());
+  map->set_is_extensible(false);
   return map;
 }
 

src/wasm/wasm-objects-inl.h

@@ -40,7 +40,7 @@ OBJECT_CONSTRUCTORS_IMPL(WasmCapiFunctionData, WasmFunctionData)
 OBJECT_CONSTRUCTORS_IMPL(WasmExportedFunctionData, WasmFunctionData)
 OBJECT_CONSTRUCTORS_IMPL(WasmGlobalObject, JSObject)
 OBJECT_CONSTRUCTORS_IMPL(WasmInstanceObject, JSObject)
-OBJECT_CONSTRUCTORS_IMPL(WasmObject, HeapObject)
+OBJECT_CONSTRUCTORS_IMPL(WasmObject, JSReceiver)
 OBJECT_CONSTRUCTORS_IMPL(WasmMemoryObject, JSObject)
 OBJECT_CONSTRUCTORS_IMPL(WasmModuleObject, JSObject)
 OBJECT_CONSTRUCTORS_IMPL(WasmTableObject, JSObject)
@@ -447,9 +447,13 @@ int WasmStruct::GcSafeSize(Map map) {
 
 wasm::StructType* WasmStruct::type() const { return type(map()); }
 
-ObjectSlot WasmStruct::RawField(int raw_offset) {
+Address WasmStruct::RawFieldAddress(int raw_offset) {
   int offset = WasmStruct::kHeaderSize + raw_offset;
-  return ObjectSlot(FIELD_ADDR(*this, offset));
+  return FIELD_ADDR(*this, offset);
+}
+
+ObjectSlot WasmStruct::RawField(int raw_offset) {
+  return ObjectSlot(RawFieldAddress(raw_offset));
 }
 
 wasm::ArrayType* WasmArray::type(Map map) {

src/wasm/wasm-objects.h

@@ -17,6 +17,7 @@
 #include "src/debug/debug.h"
 #include "src/heap/heap.h"
 #include "src/objects/js-function.h"
+#include "src/objects/js-objects.h"
 #include "src/objects/objects.h"
 #include "src/wasm/struct-types.h"
 #include "src/wasm/value-type.h"
@@ -935,12 +936,12 @@ class WasmTypeInfo : public TorqueGeneratedWasmTypeInfo<WasmTypeInfo, Foreign> {
   TQ_OBJECT_CONSTRUCTORS(WasmTypeInfo)
 };
 
-class WasmObject : public HeapObject {
+class WasmObject : public JSReceiver {
  public:
   DECL_CAST(WasmObject)
   DECL_VERIFIER(WasmObject)
 
-  OBJECT_CONSTRUCTORS(WasmObject, HeapObject);
+  OBJECT_CONSTRUCTORS(WasmObject, JSReceiver);
 };
 
 class WasmStruct : public TorqueGeneratedWasmStruct<WasmStruct, WasmObject> {
@@ -951,6 +952,10 @@ class WasmStruct : public TorqueGeneratedWasmStruct<WasmStruct, WasmObject> {
   static inline int Size(const wasm::StructType* type);
   static inline int GcSafeSize(Map map);
 
+  // Returns the address of the field at given offset.
+  inline Address RawFieldAddress(int raw_offset);
+
+  // Returns the ObjectSlot for tagged value at given offset.
   inline ObjectSlot RawField(int raw_offset);
 
   wasm::WasmValue GetFieldValue(uint32_t field_index);

src/wasm/wasm-objects.tq

@@ -119,7 +119,7 @@ extern class WasmTypeInfo extends Foreign {
 
 // WasmObject corresponds to data ref types which are WasmStruct and WasmArray.
 @abstract
-extern class WasmObject extends HeapObject {
+extern class WasmObject extends JSReceiver {
 }
 
 @generateCppClass

test/cctest/test-field-type-tracking.cc

@@ -3015,10 +3015,11 @@ TEST(NormalizeToMigrationTarget) {
 }
 
 TEST(RepresentationPredicatesAreInSync) {
-  STATIC_ASSERT(Representation::kNumRepresentations == 5);
+  STATIC_ASSERT(Representation::kNumRepresentations == 6);
   static Representation reps[] = {
-      Representation::None(), Representation::Smi(), Representation::Double(),
-      Representation::HeapObject(), Representation::Tagged()};
+      Representation::None(),   Representation::Smi(),
+      Representation::Double(), Representation::HeapObject(),
+      Representation::Tagged(), Representation::WasmValue()};
 
   for (Representation from : reps) {
     Representation most_generic_rep = from.MostGenericInPlaceChange();

tools/v8heapconst.py

@@ -120,35 +120,35 @@ INSTANCE_TYPES = {
   156: "SYNTHETIC_MODULE_TYPE",
   157: "UNCOMPILED_DATA_WITH_PREPARSE_DATA_TYPE",
   158: "UNCOMPILED_DATA_WITHOUT_PREPARSE_DATA_TYPE",
-  159: "WASM_ARRAY_TYPE",
-  160: "WASM_STRUCT_TYPE",
-  161: "WEAK_FIXED_ARRAY_TYPE",
-  162: "TRANSITION_ARRAY_TYPE",
-  163: "CELL_TYPE",
-  164: "CODE_TYPE",
-  165: "CODE_DATA_CONTAINER_TYPE",
-  166: "COVERAGE_INFO_TYPE",
-  167: "EMBEDDER_DATA_ARRAY_TYPE",
-  168: "FEEDBACK_METADATA_TYPE",
-  169: "FEEDBACK_VECTOR_TYPE",
-  170: "FILLER_TYPE",
-  171: "FREE_SPACE_TYPE",
-  172: "INTERNAL_CLASS_TYPE",
-  173: "INTERNAL_CLASS_WITH_STRUCT_ELEMENTS_TYPE",
-  174: "MAP_TYPE",
-  175: "MEGA_DOM_HANDLER_TYPE",
-  176: "ON_HEAP_BASIC_BLOCK_PROFILER_DATA_TYPE",
-  177: "PREPARSE_DATA_TYPE",
-  178: "PROPERTY_ARRAY_TYPE",
-  179: "PROPERTY_CELL_TYPE",
-  180: "SCOPE_INFO_TYPE",
-  181: "SHARED_FUNCTION_INFO_TYPE",
-  182: "SMI_BOX_TYPE",
-  183: "SMI_PAIR_TYPE",
-  184: "SORT_STATE_TYPE",
-  185: "SWISS_NAME_DICTIONARY_TYPE",
-  186: "WEAK_ARRAY_LIST_TYPE",
-  187: "WEAK_CELL_TYPE",
+  159: "WEAK_FIXED_ARRAY_TYPE",
+  160: "TRANSITION_ARRAY_TYPE",
+  161: "CELL_TYPE",
+  162: "CODE_TYPE",
+  163: "CODE_DATA_CONTAINER_TYPE",
+  164: "COVERAGE_INFO_TYPE",
+  165: "EMBEDDER_DATA_ARRAY_TYPE",
+  166: "FEEDBACK_METADATA_TYPE",
+  167: "FEEDBACK_VECTOR_TYPE",
+  168: "FILLER_TYPE",
+  169: "FREE_SPACE_TYPE",
+  170: "INTERNAL_CLASS_TYPE",
+  171: "INTERNAL_CLASS_WITH_STRUCT_ELEMENTS_TYPE",
+  172: "MAP_TYPE",
+  173: "MEGA_DOM_HANDLER_TYPE",
+  174: "ON_HEAP_BASIC_BLOCK_PROFILER_DATA_TYPE",
+  175: "PREPARSE_DATA_TYPE",
+  176: "PROPERTY_ARRAY_TYPE",
+  177: "PROPERTY_CELL_TYPE",
+  178: "SCOPE_INFO_TYPE",
+  179: "SHARED_FUNCTION_INFO_TYPE",
+  180: "SMI_BOX_TYPE",
+  181: "SMI_PAIR_TYPE",
+  182: "SORT_STATE_TYPE",
+  183: "SWISS_NAME_DICTIONARY_TYPE",
+  184: "WEAK_ARRAY_LIST_TYPE",
+  185: "WEAK_CELL_TYPE",
+  186: "WASM_ARRAY_TYPE",
+  187: "WASM_STRUCT_TYPE",
   188: "JS_PROXY_TYPE",
   1057: "JS_OBJECT_TYPE",
   189: "JS_GLOBAL_OBJECT_TYPE",
@@ -235,16 +235,16 @@ INSTANCE_TYPES = {
 
 # List of known V8 maps.
 KNOWN_MAPS = {
-  ("read_only_space", 0x02119): (174, "MetaMap"),
+  ("read_only_space", 0x02119): (172, "MetaMap"),
   ("read_only_space", 0x02141): (67, "NullMap"),
   ("read_only_space", 0x02169): (154, "StrongDescriptorArrayMap"),
-  ("read_only_space", 0x02191): (161, "WeakFixedArrayMap"),
+  ("read_only_space", 0x02191): (159, "WeakFixedArrayMap"),
   ("read_only_space", 0x021d1): (101, "EnumCacheMap"),
   ("read_only_space", 0x02205): (119, "FixedArrayMap"),
   ("read_only_space", 0x02251): (8, "OneByteInternalizedStringMap"),
-  ("read_only_space", 0x0229d): (171, "FreeSpaceMap"),
-  ("read_only_space", 0x022c5): (170, "OnePointerFillerMap"),
-  ("read_only_space", 0x022ed): (170, "TwoPointerFillerMap"),
+  ("read_only_space", 0x0229d): (169, "FreeSpaceMap"),
+  ("read_only_space", 0x022c5): (168, "OnePointerFillerMap"),
+  ("read_only_space", 0x022ed): (168, "TwoPointerFillerMap"),
   ("read_only_space", 0x02315): (67, "UninitializedMap"),
   ("read_only_space", 0x0238d): (67, "UndefinedMap"),
   ("read_only_space", 0x023d1): (66, "HeapNumberMap"),
@@ -255,15 +255,15 @@ KNOWN_MAPS = {
   ("read_only_space", 0x02559): (120, "HashTableMap"),
   ("read_only_space", 0x02581): (64, "SymbolMap"),
   ("read_only_space", 0x025a9): (40, "OneByteStringMap"),
-  ("read_only_space", 0x025d1): (180, "ScopeInfoMap"),
-  ("read_only_space", 0x025f9): (181, "SharedFunctionInfoMap"),
-  ("read_only_space", 0x02621): (164, "CodeMap"),
-  ("read_only_space", 0x02649): (163, "CellMap"),
-  ("read_only_space", 0x02671): (179, "GlobalPropertyCellMap"),
+  ("read_only_space", 0x025d1): (178, "ScopeInfoMap"),
+  ("read_only_space", 0x025f9): (179, "SharedFunctionInfoMap"),
+  ("read_only_space", 0x02621): (162, "CodeMap"),
+  ("read_only_space", 0x02649): (161, "CellMap"),
+  ("read_only_space", 0x02671): (177, "GlobalPropertyCellMap"),
   ("read_only_space", 0x02699): (70, "ForeignMap"),
-  ("read_only_space", 0x026c1): (162, "TransitionArrayMap"),
+  ("read_only_space", 0x026c1): (160, "TransitionArrayMap"),
   ("read_only_space", 0x026e9): (45, "ThinOneByteStringMap"),
-  ("read_only_space", 0x02711): (169, "FeedbackVectorMap"),
+  ("read_only_space", 0x02711): (167, "FeedbackVectorMap"),
   ("read_only_space", 0x02749): (67, "ArgumentsMarkerMap"),
   ("read_only_space", 0x027a9): (67, "ExceptionMap"),
   ("read_only_space", 0x02805): (67, "TerminationExceptionMap"),
@@ -271,17 +271,17 @@ KNOWN_MAPS = {
   ("read_only_space", 0x028cd): (67, "StaleRegisterMap"),
   ("read_only_space", 0x0292d): (131, "ScriptContextTableMap"),
   ("read_only_space", 0x02955): (129, "ClosureFeedbackCellArrayMap"),
-  ("read_only_space", 0x0297d): (168, "FeedbackMetadataArrayMap"),
+  ("read_only_space", 0x0297d): (166, "FeedbackMetadataArrayMap"),
   ("read_only_space", 0x029a5): (119, "ArrayListMap"),
   ("read_only_space", 0x029cd): (65, "BigIntMap"),
   ("read_only_space", 0x029f5): (130, "ObjectBoilerplateDescriptionMap"),
   ("read_only_space", 0x02a1d): (133, "BytecodeArrayMap"),
-  ("read_only_space", 0x02a45): (165, "CodeDataContainerMap"),
-  ("read_only_space", 0x02a6d): (166, "CoverageInfoMap"),
+  ("read_only_space", 0x02a45): (163, "CodeDataContainerMap"),
+  ("read_only_space", 0x02a6d): (164, "CoverageInfoMap"),
   ("read_only_space", 0x02a95): (134, "FixedDoubleArrayMap"),
   ("read_only_space", 0x02abd): (122, "GlobalDictionaryMap"),
   ("read_only_space", 0x02ae5): (102, "ManyClosuresCellMap"),
-  ("read_only_space", 0x02b0d): (175, "MegaDomHandlerMap"),
+  ("read_only_space", 0x02b0d): (173, "MegaDomHandlerMap"),
   ("read_only_space", 0x02b35): (119, "ModuleInfoMap"),
   ("read_only_space", 0x02b5d): (123, "NameDictionaryMap"),
   ("read_only_space", 0x02b85): (102, "NoClosuresCellMap"),
@@ -290,8 +290,8 @@ KNOWN_MAPS = {
   ("read_only_space", 0x02bfd): (125, "OrderedHashMapMap"),
   ("read_only_space", 0x02c25): (126, "OrderedHashSetMap"),
   ("read_only_space", 0x02c4d): (127, "OrderedNameDictionaryMap"),
-  ("read_only_space", 0x02c75): (177, "PreparseDataMap"),
-  ("read_only_space", 0x02c9d): (178, "PropertyArrayMap"),
+  ("read_only_space", 0x02c75): (175, "PreparseDataMap"),
+  ("read_only_space", 0x02c9d): (176, "PropertyArrayMap"),
   ("read_only_space", 0x02cc5): (98, "SideEffectCallHandlerInfoMap"),
   ("read_only_space", 0x02ced): (98, "SideEffectFreeCallHandlerInfoMap"),
   ("read_only_space", 0x02d15): (98, "NextCallSideEffectFreeCallHandlerInfoMap"),
@@ -300,16 +300,16 @@ KNOWN_MAPS = {
   ("read_only_space", 0x02d8d): (151, "SmallOrderedHashSetMap"),
   ("read_only_space", 0x02db5): (152, "SmallOrderedNameDictionaryMap"),
   ("read_only_space", 0x02ddd): (155, "SourceTextModuleMap"),
-  ("read_only_space", 0x02e05): (185, "SwissNameDictionaryMap"),
+  ("read_only_space", 0x02e05): (183, "SwissNameDictionaryMap"),
   ("read_only_space", 0x02e2d): (156, "SyntheticModuleMap"),
   ("read_only_space", 0x02e55): (72, "WasmCapiFunctionDataMap"),
   ("read_only_space", 0x02e7d): (73, "WasmExportedFunctionDataMap"),
   ("read_only_space", 0x02ea5): (74, "WasmJSFunctionDataMap"),
   ("read_only_space", 0x02ecd): (75, "WasmTypeInfoMap"),
-  ("read_only_space", 0x02ef5): (186, "WeakArrayListMap"),
+  ("read_only_space", 0x02ef5): (184, "WeakArrayListMap"),
   ("read_only_space", 0x02f1d): (121, "EphemeronHashTableMap"),
-  ("read_only_space", 0x02f45): (167, "EmbedderDataArrayMap"),
-  ("read_only_space", 0x02f6d): (187, "WeakCellMap"),
+  ("read_only_space", 0x02f45): (165, "EmbedderDataArrayMap"),
+  ("read_only_space", 0x02f6d): (185, "WeakCellMap"),
   ("read_only_space", 0x02f95): (32, "StringMap"),
   ("read_only_space", 0x02fbd): (41, "ConsOneByteStringMap"),
   ("read_only_space", 0x02fe5): (33, "ConsStringMap"),
@@ -368,18 +368,18 @@ KNOWN_MAPS = {
   ("read_only_space", 0x05c01): (153, "DescriptorArrayMap"),
   ("read_only_space", 0x05c29): (158, "UncompiledDataWithoutPreparseDataMap"),
   ("read_only_space", 0x05c51): (157, "UncompiledDataWithPreparseDataMap"),
-  ("read_only_space", 0x05c79): (176, "OnHeapBasicBlockProfilerDataMap"),
-  ("read_only_space", 0x05ca1): (172, "InternalClassMap"),
-  ("read_only_space", 0x05cc9): (183, "SmiPairMap"),
-  ("read_only_space", 0x05cf1): (182, "SmiBoxMap"),
+  ("read_only_space", 0x05c79): (174, "OnHeapBasicBlockProfilerDataMap"),
+  ("read_only_space", 0x05ca1): (170, "InternalClassMap"),
+  ("read_only_space", 0x05cc9): (181, "SmiPairMap"),
+  ("read_only_space", 0x05cf1): (180, "SmiBoxMap"),
   ("read_only_space", 0x05d19): (147, "ExportedSubClassBaseMap"),
   ("read_only_space", 0x05d41): (148, "ExportedSubClassMap"),
   ("read_only_space", 0x05d69): (68, "AbstractInternalClassSubclass1Map"),
   ("read_only_space", 0x05d91): (69, "AbstractInternalClassSubclass2Map"),
   ("read_only_space", 0x05db9): (135, "InternalClassWithSmiElementsMap"),
-  ("read_only_space", 0x05de1): (173, "InternalClassWithStructElementsMap"),
+  ("read_only_space", 0x05de1): (171, "InternalClassWithStructElementsMap"),
   ("read_only_space", 0x05e09): (149, "ExportedSubClass2Map"),
-  ("read_only_space", 0x05e31): (184, "SortStateMap"),
+  ("read_only_space", 0x05e31): (182, "SortStateMap"),
   ("read_only_space", 0x05e59): (90, "AllocationSiteWithWeakNextMap"),
   ("read_only_space", 0x05e81): (90, "AllocationSiteWithoutWeakNextMap"),
   ("read_only_space", 0x05ea9): (81, "LoadHandler1Map"),