[Promise.any] Add AggregateError

Spec: https://github.com/tc39/proposal-promise-any

Bug: v8:9808
Change-Id: I568b2444df9f00f615f2cda1268e4ecc5b36667e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2139571
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67224}

BUILD.gn

@@ -1114,6 +1114,7 @@ torque_files = [
   "src/objects/heap-number.tq",
   "src/objects/heap-object.tq",
   "src/objects/intl-objects.tq",
+  "src/objects/js-aggregate-error.tq",
   "src/objects/js-array-buffer.tq",
   "src/objects/js-array.tq",
   "src/objects/js-collection-iterator.tq",
@@ -2628,6 +2629,8 @@ v8_source_set("v8_base_without_compiler") {
     "src/objects/internal-index.h",
     "src/objects/intl-objects.cc",
     "src/objects/intl-objects.h",
+    "src/objects/js-aggregate-error-inl.h",
+    "src/objects/js-aggregate-error.h",
     "src/objects/js-array-buffer-inl.h",
     "src/objects/js-array-buffer.cc",
     "src/objects/js-array-buffer.h",

src/builtins/base.tq

@@ -257,6 +257,7 @@ extern enum MessageTemplate {
   kInvalidArrayLength,
   kInvalidIndex,
   kNotConstructor,
+  kNotGeneric,
   kCalledNonCallable,
   kCalledOnNullOrUndefined,
   kProtoObjectOrNull,
@@ -373,6 +374,7 @@ extern macro Int32TrueConstant(): bool;
 extern macro Int32FalseConstant(): bool;
 extern macro EmptyStringConstant(): EmptyString;
 extern macro LengthStringConstant(): String;
+extern macro MessageStringConstant(): String;
 extern macro NanConstant(): NaN;
 extern macro IteratorSymbolConstant(): PublicSymbol;
 extern macro MatchSymbolConstant(): Symbol;
@@ -385,6 +387,7 @@ const True: True = TrueConstant();
 const False: False = FalseConstant();
 const kEmptyString: EmptyString = EmptyStringConstant();
 const kLengthString: String = LengthStringConstant();
+const kMessageString: String = MessageStringConstant();
 const kReturnString: String = ReturnStringConstant();
 
 const kNaN: NaN = NanConstant();

src/builtins/builtins-error.cc

@@ -18,24 +18,9 @@ namespace internal {
 // ES6 section 19.5.1.1 Error ( message )
 BUILTIN(ErrorConstructor) {
   HandleScope scope(isolate);
-
-  FrameSkipMode mode = SKIP_FIRST;
-  Handle<Object> caller;
-
-  // When we're passed a JSFunction as new target, we can skip frames until that
-  // specific function is seen instead of unconditionally skipping the first
-  // frame.
-  if (args.new_target()->IsJSFunction()) {
-    mode = SKIP_UNTIL_SEEN;
-    caller = args.new_target();
-  }
-
   RETURN_RESULT_OR_FAILURE(
-      isolate,
-      ErrorUtils::Construct(isolate, args.target(),
-                            Handle<Object>::cast(args.new_target()),
-                            args.atOrUndefined(isolate, 1), mode, caller,
-                            ErrorUtils::StackTraceCollection::kDetailed));
+      isolate, ErrorUtils::Construct(isolate, args.target(), args.new_target(),
+                                     args.atOrUndefined(isolate, 1)));
 }
 
 // static

src/builtins/cast.tq

@@ -4,6 +4,7 @@
 
 extern macro IsConstructor(HeapObject): bool;
 extern macro IsFeedbackVector(HeapObject): bool;
+extern macro IsJSAggregateError(HeapObject): bool;
 extern macro IsJSArray(HeapObject): bool;
 extern macro IsJSProxy(HeapObject): bool;
 extern macro IsJSRegExp(HeapObject): bool;
@@ -56,6 +57,8 @@ extern macro TaggedToPositiveSmi(Object): PositiveSmi
     labels CastError;
 extern macro TaggedToDirectString(Object): DirectString
     labels CastError;
+extern macro HeapObjectToJSAggregateError(HeapObject): JSAggregateError
+    labels CastError;
 extern macro HeapObjectToJSArray(HeapObject): JSArray
     labels CastError;
 extern macro HeapObjectToCallable(HeapObject): Callable
@@ -364,6 +367,11 @@ Cast<Undefined|Callable>(o: HeapObject): Undefined|Callable
   return HeapObjectToCallable(o) otherwise CastError;
 }
 
+Cast<JSAggregateError>(o: HeapObject): JSAggregateError
+    labels CastError {
+  return HeapObjectToJSAggregateError(o) otherwise CastError;
+}
+
 Cast<JSArray>(o: HeapObject): JSArray
     labels CastError {
   return HeapObjectToJSArray(o) otherwise CastError;

src/builtins/iterator.tq

@@ -49,7 +49,7 @@ namespace iterator {
   extern builtin IterableToListMayPreserveHoles(implicit context:
                                                     Context)(JSAny, JSAny);
   extern builtin IterableToListWithSymbolLookup(implicit context:
-                                                    Context)(JSAny);
+                                                    Context)(JSAny): JSArray;
 
   transitioning builtin GetIteratorWithFeedback(
       context: Context, receiver: JSAny, loadSlot: TaggedIndex,

src/codegen/code-stub-assembler.cc

@@ -19,6 +19,7 @@
 #include "src/objects/descriptor-array.h"
 #include "src/objects/function-kind.h"
 #include "src/objects/heap-number.h"
+#include "src/objects/js-aggregate-error.h"
 #include "src/objects/js-generator.h"
 #include "src/objects/oddball.h"
 #include "src/objects/ordered-hash-table-inl.h"
@@ -4900,6 +4901,12 @@ void CodeStubAssembler::CopyFixedArrayElements(
   Comment("] CopyFixedArrayElements");
 }
 
+TNode<JSAggregateError> CodeStubAssembler::HeapObjectToJSAggregateError(
+    TNode<HeapObject> heap_object, Label* fail) {
+  GotoIfNot(IsJSAggregateError(heap_object), fail);
+  return UncheckedCast<JSAggregateError>(heap_object);
+}
+
 TNode<FixedArray> CodeStubAssembler::HeapObjectToFixedArray(
     TNode<HeapObject> base, Label* cast_fail) {
   Label fixed_array(this);
@@ -6039,6 +6046,10 @@ TNode<BoolT> CodeStubAssembler::IsJSPrimitiveWrapperMap(SloppyTNode<Map> map) {
   return IsJSPrimitiveWrapperInstanceType(LoadMapInstanceType(map));
 }
 
+TNode<BoolT> CodeStubAssembler::IsJSAggregateError(TNode<HeapObject> object) {
+  return HasInstanceType(object, JS_AGGREGATE_ERROR_TYPE);
+}
+
 TNode<BoolT> CodeStubAssembler::IsJSArrayInstanceType(
     SloppyTNode<Int32T> instance_type) {
   return InstanceTypeEqual(instance_type, JS_ARRAY_TYPE);

src/codegen/code-stub-assembler.h

@@ -20,7 +20,6 @@
 #include "src/objects/smi.h"
 #include "src/objects/tagged-index.h"
 #include "src/roots/roots.h"
-
 #include "torque-generated/exported-macros-assembler-tq.h"
 
 namespace v8 {
@@ -103,6 +102,7 @@ enum class PrimitiveType { kBoolean, kNumber, kString, kSymbol };
   V(ManyClosuresCellMap, many_closures_cell_map, ManyClosuresCellMap)          \
   V(match_symbol, match_symbol, MatchSymbol)                                   \
   V(megamorphic_symbol, megamorphic_symbol, MegamorphicSymbol)                 \
+  V(message_string, message_string, MessageString)                             \
   V(MetaMap, meta_map, MetaMap)                                                \
   V(minus_Infinity_string, minus_Infinity_string, MinusInfinityString)         \
   V(MinusZeroValue, minus_zero_value, MinusZero)                               \
@@ -426,6 +426,9 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
     return UncheckedCast<HeapObject>(value);
   }
 
+  TNode<JSAggregateError> HeapObjectToJSAggregateError(
+      TNode<HeapObject> heap_object, Label* fail);
+
   TNode<JSArray> HeapObjectToJSArray(TNode<HeapObject> heap_object,
                                      Label* fail) {
     GotoIfNot(IsJSArray(heap_object), fail);
@@ -2542,6 +2545,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<BoolT> IsOddball(SloppyTNode<HeapObject> object);
   TNode<BoolT> IsOddballInstanceType(SloppyTNode<Int32T> instance_type);
   TNode<BoolT> IsIndirectStringInstanceType(SloppyTNode<Int32T> instance_type);
+  TNode<BoolT> IsJSAggregateError(TNode<HeapObject> object);
   TNode<BoolT> IsJSArrayBuffer(SloppyTNode<HeapObject> object);
   TNode<BoolT> IsJSDataView(TNode<HeapObject> object);
   TNode<BoolT> IsJSArrayInstanceType(SloppyTNode<Int32T> instance_type);

src/compiler/types.cc

@@ -224,6 +224,7 @@ Type::bitset BitsetType::Lub(const MapRefLike& map) {
     case JS_ASYNC_FUNCTION_OBJECT_TYPE:
     case JS_ASYNC_GENERATOR_OBJECT_TYPE:
     case JS_MODULE_NAMESPACE_TYPE:
+    case JS_AGGREGATE_ERROR_TYPE:
     case JS_ARRAY_BUFFER_TYPE:
     case JS_ARRAY_ITERATOR_TYPE:
     case JS_REG_EXP_TYPE:

src/diagnostics/objects-debug.cc

@@ -29,6 +29,7 @@
 #include "src/objects/free-space-inl.h"
 #include "src/objects/function-kind.h"
 #include "src/objects/hash-table-inl.h"
+#include "src/objects/js-aggregate-error-inl.h"
 #include "src/objects/js-array-inl.h"
 #include "src/objects/layout-descriptor.h"
 #include "src/objects/objects-inl.h"

src/diagnostics/objects-printer.cc

@@ -24,6 +24,7 @@
 #include "src/objects/free-space-inl.h"
 #include "src/objects/hash-table-inl.h"
 #include "src/objects/heap-number-inl.h"
+#include "src/objects/js-aggregate-error-inl.h"
 #include "src/objects/js-array-buffer-inl.h"
 #include "src/objects/js-array-inl.h"
 #include "src/objects/objects-inl.h"
@@ -639,6 +640,12 @@ void JSGeneratorObject::JSGeneratorObjectPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintBody(os, *this);
 }
 
+void JSAggregateError::JSAggregateErrorPrint(std::ostream& os) {
+  JSObjectPrintHeader(os, *this, "JSAggregateError");
+  os << "\n - errors: " << Brief(errors());
+  JSObjectPrintBody(os, *this);
+}
+
 void JSArray::JSArrayPrint(std::ostream& os) {  // NOLINT
   JSObjectPrintHeader(os, *this, "JSArray");
   os << "\n - length: " << Brief(this->length());

src/execution/messages.cc

@@ -991,6 +991,26 @@ MaybeHandle<String> MessageFormatter::Format(Isolate* isolate,
   return builder.Finish();
 }
 
+MaybeHandle<JSObject> ErrorUtils::Construct(Isolate* isolate,
+                                            Handle<JSFunction> target,
+                                            Handle<Object> new_target,
+                                            Handle<Object> message) {
+  FrameSkipMode mode = SKIP_FIRST;
+  Handle<Object> caller;
+
+  // When we're passed a JSFunction as new target, we can skip frames until that
+  // specific function is seen instead of unconditionally skipping the first
+  // frame.
+  if (new_target->IsJSFunction()) {
+    mode = SKIP_UNTIL_SEEN;
+    caller = new_target;
+  }
+
+  return ErrorUtils::Construct(isolate, target, new_target, message, mode,
+                               caller,
+                               ErrorUtils::StackTraceCollection::kDetailed);
+}
+
 MaybeHandle<JSObject> ErrorUtils::Construct(
     Isolate* isolate, Handle<JSFunction> target, Handle<Object> new_target,
     Handle<Object> message, FrameSkipMode mode, Handle<Object> caller,

src/execution/messages.h

@@ -269,6 +269,10 @@ class ErrorUtils : public AllStatic {
   // |kNone| is useful when you don't need the stack information at all, for
   // example when creating a deserialized error.
   enum class StackTraceCollection { kDetailed, kSimple, kNone };
+  static MaybeHandle<JSObject> Construct(Isolate* isolate,
+                                         Handle<JSFunction> target,
+                                         Handle<Object> new_target,
+                                         Handle<Object> message);
   static MaybeHandle<JSObject> Construct(
       Isolate* isolate, Handle<JSFunction> target, Handle<Object> new_target,
       Handle<Object> message, FrameSkipMode mode, Handle<Object> caller,

src/flags/flag-definitions.h

@@ -214,6 +214,7 @@ DEFINE_IMPLICATION(harmony_weak_refs_with_cleanup_some, harmony_weak_refs)
 
 // Features that are still work in progress (behind individual flags).
 #define HARMONY_INPROGRESS_BASE(V)                                             \
+  V(harmony_promise_any, "harmony Promise.any")                                \
   V(harmony_string_replaceall, "harmony String.prototype.replaceAll")          \
   V(harmony_regexp_sequence, "RegExp Unicode sequence properties")             \
   V(harmony_weak_refs, "harmony weak references")                              \

src/init/bootstrapper.cc

@@ -33,6 +33,7 @@
 #ifdef V8_INTL_SUPPORT
 #include "src/objects/intl-objects.h"
 #endif  // V8_INTL_SUPPORT
+#include "src/objects/js-aggregate-error.h"
 #include "src/objects/js-array-buffer-inl.h"
 #include "src/objects/js-array-inl.h"
 #ifdef V8_INTL_SUPPORT
@@ -1334,21 +1335,24 @@ static void InstallWithIntrinsicDefaultProto(Isolate* isolate,
   isolate->native_context()->set(context_index, *function);
 }
 
-static void InstallError(Isolate* isolate, Handle<JSObject> global,
-                         Handle<String> name, int context_index) {
+static void InstallError(
+    Isolate* isolate, Handle<JSObject> global, Handle<String> name,
+    int context_index,
+    Builtins::Name error_constructor = Builtins::kErrorConstructor,
+    InstanceType error_type = JS_ERROR_TYPE, int error_function_length = 1,
+    int header_size = JSObject::kHeaderSize) {
   Factory* factory = isolate->factory();
 
   // Most Error objects consist of a message and a stack trace.
   // Reserve two in-object properties for these.
   const int kInObjectPropertiesCount = 2;
   const int kErrorObjectSize =
-      JSObject::kHeaderSize + kInObjectPropertiesCount * kTaggedSize;
-  Handle<JSFunction> error_fun =
-      InstallFunction(isolate, global, name, JS_ERROR_TYPE, kErrorObjectSize,
-                      kInObjectPropertiesCount, factory->the_hole_value(),
-                      Builtins::kErrorConstructor);
+      header_size + kInObjectPropertiesCount * kTaggedSize;
+  Handle<JSFunction> error_fun = InstallFunction(
+      isolate, global, name, error_type, kErrorObjectSize,
+      kInObjectPropertiesCount, factory->the_hole_value(), error_constructor);
   error_fun->shared().DontAdaptArguments();
-  error_fun->shared().set_length(1);
+  error_fun->shared().set_length(error_function_length);
 
   if (context_index == Context::ERROR_FUNCTION_INDEX) {
     SimpleInstallFunction(isolate, error_fun, "captureStackTrace",
@@ -4369,6 +4373,39 @@ void Genesis::InitializeGlobal_harmony_weak_refs_with_cleanup_some() {
                         DONT_ENUM);
 }
 
+void Genesis::InitializeGlobal_harmony_promise_any() {
+  if (!FLAG_harmony_promise_any) {
+    return;
+  }
+
+  Factory* factory = isolate()->factory();
+  Handle<JSGlobalObject> global(native_context()->global_object(), isolate());
+
+  InstallError(isolate_, global, factory->AggregateError_string(),
+               Context::AGGREGATE_ERROR_FUNCTION_INDEX,
+               Builtins::kAggregateErrorConstructor, JS_AGGREGATE_ERROR_TYPE, 2,
+               JSAggregateError::kHeaderSize);
+
+  // Setup %AggregateErrorPrototype%.
+  Handle<JSFunction> aggregate_error_function(
+      native_context()->aggregate_error_function(), isolate());
+  Handle<JSObject> prototype(
+      JSObject::cast(aggregate_error_function->instance_prototype()),
+      isolate());
+
+  Handle<String> getter_name =
+      Name::ToFunctionName(isolate_, factory->errors_string(),
+                           isolate_->factory()->get_string())
+          .ToHandleChecked();
+
+  Handle<JSFunction> getter = SimpleCreateFunction(
+      isolate(), getter_name, Builtins::kAggregateErrorPrototypeErrorsGetter, 0,
+      true);
+
+  JSObject::DefineAccessor(prototype, factory->errors_string(), getter,
+                           factory->undefined_value(), DONT_ENUM);
+}
+
 void Genesis::InitializeGlobal_harmony_promise_all_settled() {
   if (!FLAG_harmony_promise_all_settled) return;
   SimpleInstallFunction(isolate(), isolate()->promise_function(), "allSettled",

src/init/heap-symbols.h

@@ -118,6 +118,7 @@
 #define INTERNALIZED_STRING_LIST_GENERATOR(V, _)                     \
   INTERNALIZED_STRING_LIST_GENERATOR_INTL(V, _)                      \
   V(_, add_string, "add")                                            \
+  V(_, AggregateError_string, "AggregateError")                      \
   V(_, always_string, "always")                                      \
   V(_, anonymous_function_string, "(anonymous function)")            \
   V(_, anonymous_string, "anonymous")                                \
@@ -179,6 +180,7 @@
   V(_, enumerable_string, "enumerable")                              \
   V(_, element_string, "element")                                    \
   V(_, Error_string, "Error")                                        \
+  V(_, errors_string, "errors")                                      \
   V(_, error_to_string, "[object Error]")                            \
   V(_, eval_string, "eval")                                          \
   V(_, EvalError_string, "EvalError")                                \

src/objects/contexts.h

@@ -335,6 +335,7 @@ enum ContextLookupFlags {
   V(ERROR_FUNCTION_INDEX, JSFunction, error_function)                          \
   V(ERROR_TO_STRING, JSFunction, error_to_string)                              \
   V(EVAL_ERROR_FUNCTION_INDEX, JSFunction, eval_error_function)                \
+  V(AGGREGATE_ERROR_FUNCTION_INDEX, JSFunction, aggregate_error_function)      \
   V(GLOBAL_EVAL_FUN_INDEX, JSFunction, global_eval_fun)                        \
   V(GLOBAL_PROXY_FUNCTION_INDEX, JSFunction, global_proxy_function)            \
   V(MAP_DELETE_INDEX, JSFunction, map_delete)                                  \

src/objects/js-aggregate-error-inl.h

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_JS_AGGREGATE_ERROR_INL_H_
+#define V8_OBJECTS_JS_AGGREGATE_ERROR_INL_H_
+
+#include "src/objects/js-aggregate-error.h"
+
+#include "src/objects/objects-inl.h"  // Needed for write barriers
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+CAST_ACCESSOR(JSAggregateError)
+TQ_OBJECT_CONSTRUCTORS_IMPL(JSAggregateError)
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_JS_AGGREGATE_ERROR_INL_H_

src/objects/js-aggregate-error.h

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_JS_AGGREGATE_ERROR_H_
+#define V8_OBJECTS_JS_AGGREGATE_ERROR_H_
+
+#include "src/objects/js-objects.h"
+#include "torque-generated/builtin-definitions-tq.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+class JSAggregateError
+    : public TorqueGeneratedJSAggregateError<JSAggregateError, JSObject> {
+ public:
+  DECL_CAST(JSAggregateError)
+  DECL_PRINTER(JSAggregateError)
+  TQ_OBJECT_CONSTRUCTORS(JSAggregateError)
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_OBJECTS_JS_AGGREGATE_ERROR_H_

src/objects/js-aggregate-error.tq

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include 'src/objects/js-aggregate-error.h'
+
+@generateCppClass
+extern class JSAggregateError extends JSObject {
+  // Only Undefined during AggregateError object creation.
+  errors: JSAny|Undefined;
+}
+
+namespace error {
+
+  transitioning javascript builtin AggregateErrorConstructor(
+      js-implicit context: NativeContext, target: JSFunction,
+      newTarget: JSAny)(...arguments): JSAny {
+    // This function is implementing the spec as suggested by
+    // https://github.com/tc39/proposal-promise-any/pull/59 . FIXME(marja):
+    // change this if the PR is declined.
+
+    // 1. If NewTarget is undefined, let newTarget be the active function
+    // object, else let newTarget be NewTarget.
+    // 2. Let O be ? OrdinaryCreateFromConstructor(newTarget,
+    // "%AggregateError.prototype%", « [[ErrorData]], [[AggregateErrors]] »).
+    // 3. If _message_ is not _undefined_, then
+    //   a. Let msg be ? ToString(_message_).
+    //   b. Let msgDesc be the PropertyDescriptor { [[Value]]: _msg_,
+    //   [[Writable]]: *true*, [[Enumerable]]: *false*, [[Configurable]]: *true*
+    //   c. Perform ! DefinePropertyOrThrow(_O_, *"message"*, _msgDesc_).
+    const message: JSAny = arguments.length > 0 ? arguments[1] : Undefined;
+    const obj: JSAggregateError =
+        ConstructAggregateErrorHelper(context, target, newTarget, message);
+
+    // 4. Let errorsList be ? IterableToList(errors).
+    const errors: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
+    const errorsArray = iterator::IterableToListWithSymbolLookup(errors);
+
+    // 5. Set O.[[AggregateErrors]] to errorsList.
+    obj.errors = errorsArray;
+
+    // 6. Return O.
+    return obj;
+  }
+
+  transitioning javascript builtin AggregateErrorPrototypeErrorsGetter(
+      js-implicit context: NativeContext, receiver: JSAny)(): JSAny {
+    // 1. Let E be the this value.
+    // 2. If Type(E) is not Object, throw a TypeError exception.
+    // 3. If E does not have an [[ErrorData]] internal slot, throw a TypeError
+    // exception.
+    // 4. If E does not have an [[AggregateErrors]] internal slot, throw a
+    // TypeError exception.
+    // 5. Return ! CreateArrayFromList(E.[[AggregateErrors]]).
+    typeswitch (receiver) {
+      case (receiver: JSAggregateError): {
+        return CloneFastJSArrayFillingHoles(
+            context, UnsafeCast<JSArray>(receiver.errors));
+      }
+      case (Object): {
+        ThrowTypeError(
+            MessageTemplate::kNotGeneric,
+            'JSAggregateError.prototype.errors.get', 'AggregateError');
+      }
+    }
+  }
+
+  extern runtime ConstructAggregateErrorHelper(
+      Context, JSFunction, JSAny, JSAny): JSAggregateError;
+
+  extern transitioning builtin CloneFastJSArrayFillingHoles(Context, JSArray):
+      JSArray;
+}

src/objects/js-objects.cc

@@ -26,6 +26,7 @@
 #include "src/objects/field-type.h"
 #include "src/objects/fixed-array.h"
 #include "src/objects/heap-number.h"
+#include "src/objects/js-aggregate-error.h"
 #include "src/objects/js-array-buffer.h"
 #include "src/objects/js-array-inl.h"
 #include "src/objects/layout-descriptor.h"
@@ -2097,6 +2098,8 @@ int JSObject::GetHeaderSize(InstanceType type,
       return JSObject::kHeaderSize;
     case JS_GENERATOR_OBJECT_TYPE:
       return JSGeneratorObject::kHeaderSize;
+    case JS_AGGREGATE_ERROR_TYPE:
+      return JSAggregateError::kHeaderSize;
     case JS_ASYNC_FUNCTION_OBJECT_TYPE:
       return JSAsyncFunctionObject::kHeaderSize;
     case JS_ASYNC_GENERATOR_OBJECT_TYPE:
@@ -5218,6 +5221,7 @@ namespace {
 
 bool CanSubclassHaveInobjectProperties(InstanceType instance_type) {
   switch (instance_type) {
+    case JS_AGGREGATE_ERROR_TYPE:
     case JS_API_OBJECT_TYPE:
     case JS_ARRAY_BUFFER_TYPE:
     case JS_ARRAY_TYPE:

src/objects/map.cc

@@ -272,6 +272,7 @@ VisitorId Map::GetVisitorId(Map map) {
 
     case JS_OBJECT_TYPE:
     case JS_ERROR_TYPE:
+    case JS_AGGREGATE_ERROR_TYPE:
     case JS_ARGUMENTS_OBJECT_TYPE:
     case JS_ASYNC_FROM_SYNC_ITERATOR_TYPE:
     case JS_CONTEXT_EXTENSION_OBJECT_TYPE:

src/objects/object-list-macros.h

@@ -126,6 +126,7 @@ class ZoneForwardList;
   V(HandlerTable)                              \
   V(HeapNumber)                                \
   V(InternalizedString)                        \
+  V(JSAggregateError)                          \
   V(JSArgumentsObject)                         \
   V(JSArray)                                   \
   V(JSArrayBuffer)                             \

src/objects/objects-body-descriptors-inl.h

@@ -960,6 +960,7 @@ ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3, T4 p4) {
     case JS_ASYNC_GENERATOR_OBJECT_TYPE:
     case JS_PRIMITIVE_WRAPPER_TYPE:
     case JS_DATE_TYPE:
+    case JS_AGGREGATE_ERROR_TYPE:
     case JS_ARRAY_TYPE:
     case JS_ARRAY_ITERATOR_TYPE:
     case JS_MODULE_NAMESPACE_TYPE:

src/runtime/runtime-promise.cc

@@ -260,5 +260,24 @@ RUNTIME_FUNCTION(Runtime_ResolvePromise) {
   return *result;
 }
 
+// A helper function to be called when constructing AggregateError objects. This
+// takes care of the Error-related construction, e.g., stack traces.
+RUNTIME_FUNCTION(Runtime_ConstructAggregateErrorHelper) {
+  DCHECK(FLAG_harmony_promise_any);
+  HandleScope scope(isolate);
+  DCHECK_EQ(3, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(JSFunction, target, 0);
+  CONVERT_ARG_HANDLE_CHECKED(Object, new_target, 1);
+  CONVERT_ARG_HANDLE_CHECKED(Object, message, 2);
+
+  DCHECK_EQ(*target, *isolate->aggregate_error_function());
+
+  Handle<Object> result;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, result,
+      ErrorUtils::Construct(isolate, target, new_target, message));
+  return *result;
+}
+
 }  // namespace internal
 }  // namespace v8

src/runtime/runtime.h

@@ -367,7 +367,8 @@ namespace internal {
   F(RejectPromise, 3, 1)                 \
   F(ResolvePromise, 2, 1)                \
   F(PromiseRejectAfterResolved, 2, 1)    \
-  F(PromiseResolveAfterResolved, 2, 1)
+  F(PromiseResolveAfterResolved, 2, 1)   \
+  F(ConstructAggregateErrorHelper, 3, 1)
 
 #define FOR_EACH_INTRINSIC_PROXY(F, I) \
   F(CheckProxyGetSetTrapResult, 2, 1)  \

src/torque/implementation-visitor.cc

@@ -3876,6 +3876,7 @@ void ImplementationVisitor::GenerateClassDefinitions(
         << "#include \"torque-generated/class-definitions-tq.h\"\n\n";
     implementation << "#include \"torque-generated/class-verifiers-tq.h\"\n\n";
     implementation << "#include \"src/objects/arguments-inl.h\"\n";
+    implementation << "#include \"src/objects/js-aggregate-error-inl.h\"\n";
     implementation << "#include \"src/objects/js-collection-inl.h\"\n";
     implementation << "#include \"src/objects/embedder-data-array-inl.h\"\n";
     implementation << "#include \"src/objects/js-generator-inl.h\"\n";

test/mjsunit/es6/reflect-construct.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
-// Flags: --allow-unsafe-function-constructor
+// Flags: --allow-unsafe-function-constructor --harmony-promise-any
 
 
 (function testReflectConstructArity() {
@@ -311,6 +311,7 @@
   var realm2 = Realm.create();
 
   var well_known_intrinsic_constructors = [
+    ["AggregateError", [[]]],
       "Array",
       "ArrayBuffer",
       "Boolean",

test/mjsunit/harmony/aggregate-error.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-promise-any
+
+(function TestNoParameters() {
+    // Can't omit the "errors" parameter; there's nothing to iterate.
+    assertThrows(() => { new AggregateError(); });
+})();
+
+(function TestNoParameters_NoNew() {
+    // Can't omit the "errors" parameter; there's nothing to iterate.
+    assertThrows(() => { AggregateError(); });
+})();
+
+(function TestOneParameterErrorsIsArray() {
+    let error = new AggregateError([1, 20, 4]);
+    assertEquals('', error.message);
+    assertEquals([1, 20, 4], error.errors);
+})();
+
+(function TestOneParameterErrorsIsArray_NoNew() {
+    let error = AggregateError([1, 20, 4]);
+    assertEquals('', error.message);
+    assertEquals([1, 20, 4], error.errors);
+})();
+
+(function TestOneParameterErrosIsAnEmptyArray() {
+    let error = new AggregateError([]);
+    assertEquals('', error.message);
+    assertEquals([], error.errors);
+})();
+
+(function TestOneParameterErrorsIsASet() {
+    let set = new Set();
+    set.add(5);
+    set.add(100);
+    let error = new AggregateError(set);
+    assertEquals('', error.message);
+    assertEquals(2, error.errors.length);
+    assertTrue(error.errors[0] == 5 || error.errors[1] == 5);
+    assertTrue(error.errors[0] == 100 || error.errors[1] == 100);
+})();
+
+(function TestOneParameterErrorsNotIterable() {
+    assertThrows(() => { new AggregateError(5); });
+})();
+
+(function TestOneParameterErrorsNotIterable_NoNew() {
+    assertThrows(() => { AggregateError(5); });
+})();
+
+(function TestTwoParameters() {
+    let error = new AggregateError([1, 20, 4], 'custom message');
+    assertEquals('custom message', error.message);
+    assertEquals([1, 20, 4], error.errors);
+})();
+
+(function TestTwoParameters_NoNew() {
+    let error = AggregateError([1, 20, 4], 'custom message');
+    assertEquals('custom message', error.message);
+    assertEquals([1, 20, 4], error.errors);
+})();
+
+(function TestTwoParametersMessageNotString() {
+    let custom = { toString() { return 'hello'; } };
+    let error = new AggregateError([], custom);
+    assertEquals('hello', error.message);
+})();
+
+(function TestTwoParametersMessageUndefined() {
+    let error = new AggregateError([], undefined);
+    assertFalse(Object.prototype.hasOwnProperty.call(error, 'message'));
+})();
+
+(function AggregateErrorPrototypeErrorsCalledWithWrongTypeOfObject() {
+    let f = Object.getOwnPropertyDescriptor(AggregateError.prototype, 'errors').get;
+
+    // This works:
+    let error = new AggregateError([3]);
+    let got_errors = f.call(error);
+    assertEquals([3], got_errors);
+
+    // This doesn't:
+    assertThrows(() => { f.call({}) } );
+})();
+
+(function AggregateErrorPrototypeErrorsCalledWithTooManyArguments() {
+    let f = Object.getOwnPropertyDescriptor(AggregateError.prototype, 'errors').get;
+    let error = new AggregateError([3]);
+    let got_errors = f.call(error, ["unnecessary", "arguments"]);
+    assertEquals([3], got_errors);
+})();
+
+(function SetErrorsSloppy() {
+  let e = new AggregateError([1]);
+  e.errors = [4, 5, 6];
+  assertEquals([1], e.errors);
+})();
+
+(function SetErrorsStrict() {
+    "use strict";
+    let e = new AggregateError([1]);
+    assertThrows(() => { e.errors = [4, 5, 6];});
+})();
+
+(function SubClassProto() {
+    class A extends AggregateError {
+        constructor() {
+            super([]);
+        }
+    }
+
+    let o = new A();
+    assertEquals(o.__proto__, A.prototype);
+})();
+
+(function ErrorsWithHoles() {
+    let errors = [0];
+    errors[2] = 2;
+    let a = new AggregateError(errors);
+    assertEquals([0, undefined, 2], a.errors);
+})();
+
+(function ErrorsIsANewArray(){
+  let array = [8, 9];
+  let e = new AggregateError(array);
+  array.push(1);
+  assertEquals([8, 9], e.errors);
+})();
+
+(function ErrorsIsANewArrayForEachGetterCall(){
+    let e = new AggregateError([9, 6, 3]);
+    const errors1 = e.errors;
+    const errors2 = e.errors;
+    assertNotSame(errors1, errors2);
+})();
+
+(function AggregateErrorCreation() {
+    // Verify that we match the spec wrt getting the prototype from the
+    // newTarget, iterating the errors array and calling toString on the
+    // message.
+    let counter = 1;
+    let prototype_got = 0;
+    let errors_iterated = 0;
+    let to_string_called = 0;
+
+    // For observing Get(new target, "prototype")
+    function target() {}
+    let handler = {
+        get: (target, prop, receiver) => {
+          if (prop == 'prototype') {
+            prototype_got = counter++;
+            return target.prototype;
+          }
+        }
+    };
+    let p = new Proxy(target, handler);
+
+    // For observing IterableToList(errors)
+    var errors = {
+      [Symbol.iterator]() {
+        return {
+          next() {
+            errors_iterated = counter++;
+            return { done: true };
+          }
+        };
+      }
+    };
+
+    // For observing ToString(message)
+    let message = { toString: () => { to_string_called = counter++;}}
+
+    let o = Reflect.construct(AggregateError, [errors, message], p);
+
+    assertEquals(1, prototype_got);
+    assertEquals(2, to_string_called);
+    assertEquals(3, errors_iterated);
+ })();

test/test262/test262.status

@@ -625,8 +625,6 @@
   'built-ins/AsyncFunction/proto-from-ctor-realm': [FAIL],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=9808
-  'built-ins/AggregateError/*': [FAIL],
-  'built-ins/NativeErrors/AggregateError/*': [FAIL],
   'built-ins/Promise/any/*': [FAIL],
 
   # https://bugs.chromium.org/p/v8/issues/detail?id=10111

test/test262/testcfg.py

@@ -62,6 +62,7 @@ FEATURE_FLAGS = {
   'regexp-named-groups': '--harmony-regexp-match-indices',
   'class-methods-private': '--harmony-private-methods',
   'class-static-methods-private': '--harmony-private-methods',
+  'AggregateError': '--harmony-promise-any',
 }
 
 SKIPPED_FEATURES = set([])

tools/v8heapconst.py

@@ -160,40 +160,41 @@ INSTANCE_TYPES = {
   1054: "JS_WEAK_MAP_TYPE",
   1055: "JS_WEAK_SET_TYPE",
   1056: "JS_API_OBJECT_TYPE",
-  1058: "JS_ARGUMENTS_OBJECT_TYPE",
-  1059: "JS_ARRAY_TYPE",
-  1060: "JS_ARRAY_BUFFER_TYPE",
-  1061: "JS_ARRAY_ITERATOR_TYPE",
-  1062: "JS_ASYNC_FROM_SYNC_ITERATOR_TYPE",
-  1063: "JS_COLLATOR_TYPE",
-  1064: "JS_CONTEXT_EXTENSION_OBJECT_TYPE",
-  1065: "JS_DATE_TYPE",
-  1066: "JS_DATE_TIME_FORMAT_TYPE",
-  1067: "JS_DISPLAY_NAMES_TYPE",
-  1068: "JS_ERROR_TYPE",
-  1069: "JS_FINALIZATION_REGISTRY_TYPE",
-  1070: "JS_LIST_FORMAT_TYPE",
-  1071: "JS_LOCALE_TYPE",
-  1072: "JS_MESSAGE_OBJECT_TYPE",
-  1073: "JS_NUMBER_FORMAT_TYPE",
-  1074: "JS_PLURAL_RULES_TYPE",
-  1075: "JS_PROMISE_TYPE",
-  1076: "JS_REG_EXP_TYPE",
-  1077: "JS_REG_EXP_STRING_ITERATOR_TYPE",
-  1078: "JS_RELATIVE_TIME_FORMAT_TYPE",
-  1079: "JS_SEGMENT_ITERATOR_TYPE",
-  1080: "JS_SEGMENTER_TYPE",
-  1081: "JS_STRING_ITERATOR_TYPE",
-  1082: "JS_V8_BREAK_ITERATOR_TYPE",
-  1083: "JS_WEAK_REF_TYPE",
-  1084: "WASM_EXCEPTION_OBJECT_TYPE",
-  1085: "WASM_GLOBAL_OBJECT_TYPE",
-  1086: "WASM_INSTANCE_OBJECT_TYPE",
-  1087: "WASM_MEMORY_OBJECT_TYPE",
-  1088: "WASM_MODULE_OBJECT_TYPE",
-  1089: "WASM_TABLE_OBJECT_TYPE",
-  1090: "JS_BOUND_FUNCTION_TYPE",
-  1091: "JS_FUNCTION_TYPE",
+  1058: "JS_AGGREGATE_ERROR_TYPE",
+  1059: "JS_ARGUMENTS_OBJECT_TYPE",
+  1060: "JS_ARRAY_TYPE",
+  1061: "JS_ARRAY_BUFFER_TYPE",
+  1062: "JS_ARRAY_ITERATOR_TYPE",
+  1063: "JS_ASYNC_FROM_SYNC_ITERATOR_TYPE",
+  1064: "JS_COLLATOR_TYPE",
+  1065: "JS_CONTEXT_EXTENSION_OBJECT_TYPE",
+  1066: "JS_DATE_TYPE",
+  1067: "JS_DATE_TIME_FORMAT_TYPE",
+  1068: "JS_DISPLAY_NAMES_TYPE",
+  1069: "JS_ERROR_TYPE",
+  1070: "JS_FINALIZATION_REGISTRY_TYPE",
+  1071: "JS_LIST_FORMAT_TYPE",
+  1072: "JS_LOCALE_TYPE",
+  1073: "JS_MESSAGE_OBJECT_TYPE",
+  1074: "JS_NUMBER_FORMAT_TYPE",
+  1075: "JS_PLURAL_RULES_TYPE",
+  1076: "JS_PROMISE_TYPE",
+  1077: "JS_REG_EXP_TYPE",
+  1078: "JS_REG_EXP_STRING_ITERATOR_TYPE",
+  1079: "JS_RELATIVE_TIME_FORMAT_TYPE",
+  1080: "JS_SEGMENT_ITERATOR_TYPE",
+  1081: "JS_SEGMENTER_TYPE",
+  1082: "JS_STRING_ITERATOR_TYPE",
+  1083: "JS_V8_BREAK_ITERATOR_TYPE",
+  1084: "JS_WEAK_REF_TYPE",
+  1085: "WASM_EXCEPTION_OBJECT_TYPE",
+  1086: "WASM_GLOBAL_OBJECT_TYPE",
+  1087: "WASM_INSTANCE_OBJECT_TYPE",
+  1088: "WASM_MEMORY_OBJECT_TYPE",
+  1089: "WASM_MODULE_OBJECT_TYPE",
+  1090: "WASM_TABLE_OBJECT_TYPE",
+  1091: "JS_BOUND_FUNCTION_TYPE",
+  1092: "JS_FUNCTION_TYPE",
 }
 
 # List of known V8 maps.
@@ -289,63 +290,63 @@ KNOWN_MAPS = {
   ("read_only_space", 0x01179): (95, "EnumCacheMap"),
   ("read_only_space", 0x011c9): (86, "ArrayBoilerplateDescriptionMap"),
   ("read_only_space", 0x012c5): (98, "InterceptorInfoMap"),
-  ("read_only_space", 0x032e5): (71, "PromiseFulfillReactionJobTaskMap"),
-  ("read_only_space", 0x0330d): (72, "PromiseRejectReactionJobTaskMap"),
-  ("read_only_space", 0x03335): (73, "CallableTaskMap"),
-  ("read_only_space", 0x0335d): (74, "CallbackTaskMap"),
-  ("read_only_space", 0x03385): (75, "PromiseResolveThenableJobTaskMap"),
-  ("read_only_space", 0x033ad): (78, "FunctionTemplateInfoMap"),
-  ("read_only_space", 0x033d5): (79, "ObjectTemplateInfoMap"),
-  ("read_only_space", 0x033fd): (80, "AccessCheckInfoMap"),
-  ("read_only_space", 0x03425): (81, "AccessorInfoMap"),
-  ("read_only_space", 0x0344d): (82, "AccessorPairMap"),
-  ("read_only_space", 0x03475): (83, "AliasedArgumentsEntryMap"),
-  ("read_only_space", 0x0349d): (84, "AllocationMementoMap"),
-  ("read_only_space", 0x034c5): (87, "AsmWasmDataMap"),
-  ("read_only_space", 0x034ed): (88, "AsyncGeneratorRequestMap"),
-  ("read_only_space", 0x03515): (89, "BreakPointMap"),
-  ("read_only_space", 0x0353d): (90, "BreakPointInfoMap"),
-  ("read_only_space", 0x03565): (91, "CachedTemplateObjectMap"),
-  ("read_only_space", 0x0358d): (93, "ClassPositionsMap"),
-  ("read_only_space", 0x035b5): (94, "DebugInfoMap"),
-  ("read_only_space", 0x035dd): (97, "FunctionTemplateRareDataMap"),
-  ("read_only_space", 0x03605): (99, "InterpreterDataMap"),
-  ("read_only_space", 0x0362d): (100, "PromiseCapabilityMap"),
-  ("read_only_space", 0x03655): (101, "PromiseReactionMap"),
-  ("read_only_space", 0x0367d): (102, "PropertyDescriptorObjectMap"),
-  ("read_only_space", 0x036a5): (103, "PrototypeInfoMap"),
-  ("read_only_space", 0x036cd): (104, "ScriptMap"),
-  ("read_only_space", 0x036f5): (105, "SourceTextModuleInfoEntryMap"),
-  ("read_only_space", 0x0371d): (106, "StackFrameInfoMap"),
-  ("read_only_space", 0x03745): (107, "StackTraceFrameMap"),
-  ("read_only_space", 0x0376d): (108, "TemplateObjectDescriptionMap"),
-  ("read_only_space", 0x03795): (109, "Tuple2Map"),
-  ("read_only_space", 0x037bd): (110, "WasmCapiFunctionDataMap"),
-  ("read_only_space", 0x037e5): (111, "WasmDebugInfoMap"),
-  ("read_only_space", 0x0380d): (112, "WasmExceptionTagMap"),
-  ("read_only_space", 0x03835): (113, "WasmExportedFunctionDataMap"),
-  ("read_only_space", 0x0385d): (114, "WasmIndirectFunctionTableMap"),
-  ("read_only_space", 0x03885): (115, "WasmJSFunctionDataMap"),
-  ("read_only_space", 0x038ad): (116, "WasmValueMap"),
-  ("read_only_space", 0x038d5): (165, "InternalClassMap"),
-  ("read_only_space", 0x038fd): (173, "SmiPairMap"),
-  ("read_only_space", 0x03925): (172, "SmiBoxMap"),
-  ("read_only_space", 0x0394d): (68, "ExportedSubClassBaseMap"),
-  ("read_only_space", 0x03975): (69, "ExportedSubClassMap"),
-  ("read_only_space", 0x0399d): (135, "InternalClassWithSmiElementsMap"),
-  ("read_only_space", 0x039c5): (166, "InternalClassWithStructElementsMap"),
-  ("read_only_space", 0x039ed): (174, "SortStateMap"),
-  ("read_only_space", 0x03a15): (85, "AllocationSiteWithWeakNextMap"),
-  ("read_only_space", 0x03a3d): (85, "AllocationSiteWithoutWeakNextMap"),
-  ("read_only_space", 0x03a65): (76, "LoadHandler1Map"),
-  ("read_only_space", 0x03a8d): (76, "LoadHandler2Map"),
-  ("read_only_space", 0x03ab5): (76, "LoadHandler3Map"),
-  ("read_only_space", 0x03add): (77, "StoreHandler0Map"),
-  ("read_only_space", 0x03b05): (77, "StoreHandler1Map"),
-  ("read_only_space", 0x03b2d): (77, "StoreHandler2Map"),
-  ("read_only_space", 0x03b55): (77, "StoreHandler3Map"),
+  ("read_only_space", 0x03315): (71, "PromiseFulfillReactionJobTaskMap"),
+  ("read_only_space", 0x0333d): (72, "PromiseRejectReactionJobTaskMap"),
+  ("read_only_space", 0x03365): (73, "CallableTaskMap"),
+  ("read_only_space", 0x0338d): (74, "CallbackTaskMap"),
+  ("read_only_space", 0x033b5): (75, "PromiseResolveThenableJobTaskMap"),
+  ("read_only_space", 0x033dd): (78, "FunctionTemplateInfoMap"),
+  ("read_only_space", 0x03405): (79, "ObjectTemplateInfoMap"),
+  ("read_only_space", 0x0342d): (80, "AccessCheckInfoMap"),
+  ("read_only_space", 0x03455): (81, "AccessorInfoMap"),
+  ("read_only_space", 0x0347d): (82, "AccessorPairMap"),
+  ("read_only_space", 0x034a5): (83, "AliasedArgumentsEntryMap"),
+  ("read_only_space", 0x034cd): (84, "AllocationMementoMap"),
+  ("read_only_space", 0x034f5): (87, "AsmWasmDataMap"),
+  ("read_only_space", 0x0351d): (88, "AsyncGeneratorRequestMap"),
+  ("read_only_space", 0x03545): (89, "BreakPointMap"),
+  ("read_only_space", 0x0356d): (90, "BreakPointInfoMap"),
+  ("read_only_space", 0x03595): (91, "CachedTemplateObjectMap"),
+  ("read_only_space", 0x035bd): (93, "ClassPositionsMap"),
+  ("read_only_space", 0x035e5): (94, "DebugInfoMap"),
+  ("read_only_space", 0x0360d): (97, "FunctionTemplateRareDataMap"),
+  ("read_only_space", 0x03635): (99, "InterpreterDataMap"),
+  ("read_only_space", 0x0365d): (100, "PromiseCapabilityMap"),
+  ("read_only_space", 0x03685): (101, "PromiseReactionMap"),
+  ("read_only_space", 0x036ad): (102, "PropertyDescriptorObjectMap"),
+  ("read_only_space", 0x036d5): (103, "PrototypeInfoMap"),
+  ("read_only_space", 0x036fd): (104, "ScriptMap"),
+  ("read_only_space", 0x03725): (105, "SourceTextModuleInfoEntryMap"),
+  ("read_only_space", 0x0374d): (106, "StackFrameInfoMap"),
+  ("read_only_space", 0x03775): (107, "StackTraceFrameMap"),
+  ("read_only_space", 0x0379d): (108, "TemplateObjectDescriptionMap"),
+  ("read_only_space", 0x037c5): (109, "Tuple2Map"),
+  ("read_only_space", 0x037ed): (110, "WasmCapiFunctionDataMap"),
+  ("read_only_space", 0x03815): (111, "WasmDebugInfoMap"),
+  ("read_only_space", 0x0383d): (112, "WasmExceptionTagMap"),
+  ("read_only_space", 0x03865): (113, "WasmExportedFunctionDataMap"),
+  ("read_only_space", 0x0388d): (114, "WasmIndirectFunctionTableMap"),
+  ("read_only_space", 0x038b5): (115, "WasmJSFunctionDataMap"),
+  ("read_only_space", 0x038dd): (116, "WasmValueMap"),
+  ("read_only_space", 0x03905): (165, "InternalClassMap"),
+  ("read_only_space", 0x0392d): (173, "SmiPairMap"),
+  ("read_only_space", 0x03955): (172, "SmiBoxMap"),
+  ("read_only_space", 0x0397d): (68, "ExportedSubClassBaseMap"),
+  ("read_only_space", 0x039a5): (69, "ExportedSubClassMap"),
+  ("read_only_space", 0x039cd): (135, "InternalClassWithSmiElementsMap"),
+  ("read_only_space", 0x039f5): (166, "InternalClassWithStructElementsMap"),
+  ("read_only_space", 0x03a1d): (174, "SortStateMap"),
+  ("read_only_space", 0x03a45): (85, "AllocationSiteWithWeakNextMap"),
+  ("read_only_space", 0x03a6d): (85, "AllocationSiteWithoutWeakNextMap"),
+  ("read_only_space", 0x03a95): (76, "LoadHandler1Map"),
+  ("read_only_space", 0x03abd): (76, "LoadHandler2Map"),
+  ("read_only_space", 0x03ae5): (76, "LoadHandler3Map"),
+  ("read_only_space", 0x03b0d): (77, "StoreHandler0Map"),
+  ("read_only_space", 0x03b35): (77, "StoreHandler1Map"),
+  ("read_only_space", 0x03b5d): (77, "StoreHandler2Map"),
+  ("read_only_space", 0x03b85): (77, "StoreHandler3Map"),
   ("map_space", 0x00121): (1057, "ExternalMap"),
-  ("map_space", 0x00149): (1072, "JSMessageObjectMap"),
+  ("map_space", 0x00149): (1073, "JSMessageObjectMap"),
 }
 
 # List of known V8 objects.