[runtime] Revert template cache work

This reverts the following commits:

  * [runtime] Clean up dead entries in the template cache"
    8436c0059c.
  * [runtime] Don't update template map for existing templates
    e7b9604040.
  * [runtime] Fix hash used in template cache
    caa087bb18.
  * [runtime] Hold cached template objects weakly
    5d19e724d2.
  * [runtime] Key template object cache on Script
    f3a0e8bccf.

There are gerrit UI issues which appear to be template object caching
related.

For dashboard:
This reverts commit 8436c0059c.
This reverts commit e7b9604040.
This reverts commit caa087bb18.
This reverts commit 5d19e724d2.
This reverts commit f3a0e8bccf.

Bug: v8:13190
Bug: chromium:1366900
Change-Id: I9759771441a4dece2a5dbb47e462ce0c0c01b182
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3925696
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83471}

src/heap/factory-base.cc

@@ -73,22 +73,6 @@ Handle<AccessorPair> FactoryBase<Impl>::NewAccessorPair() {
   return handle(accessors, isolate());
 }
 
-template <typename Impl>
-Handle<CachedTemplateObject> FactoryBase<Impl>::NewCachedTemplateObject(
-    int function_literal_id, int slot_id, Handle<HeapObject> next,
-    Handle<JSArray> template_object, AllocationType allocation) {
-  DCHECK(next->IsCachedTemplateObject() || next->IsTheHole());
-  Map map = read_only_roots().cached_template_object_map();
-  CachedTemplateObject result = CachedTemplateObject::cast(
-      AllocateRawWithImmortalMap(CachedTemplateObject::kSize, allocation, map));
-  DisallowGarbageCollection no_gc;
-  result.set_function_literal_id(function_literal_id);
-  result.set_slot_id(slot_id);
-  result.set_template_object(HeapObjectReference::Weak(*template_object));
-  result.set_next(*next);
-  return handle(result, isolate());
-}
-
 template <typename Impl>
 Handle<CodeDataContainer> FactoryBase<Impl>::NewCodeDataContainer(
     int flags, AllocationType allocation) {

src/heap/factory-base.h

@@ -102,11 +102,6 @@ class FactoryBase : public TorqueGeneratedFactory<Impl> {
   Handle<CodeDataContainer> NewCodeDataContainer(int flags,
                                                  AllocationType allocation);
 
-  Handle<CachedTemplateObject> NewCachedTemplateObject(
-      int function_literal_id, int slot_id, Handle<HeapObject> next,
-      Handle<JSArray> template_object,
-      AllocationType allocation_type = AllocationType::kYoung);
-
   // Allocates a fixed array initialized with undefined values.
   Handle<FixedArray> NewFixedArray(
       int length, AllocationType allocation = AllocationType::kYoung);

src/objects/hash-table-inl.h

@@ -168,7 +168,6 @@ InternalIndex HashTable<Derived, Shape>::FindEntry(PtrComprCageBase cage_base,
   uint32_t count = 1;
   Object undefined = roots.undefined_value();
   Object the_hole = roots.the_hole_value();
-  DCHECK_EQ(Shape::Hash(roots, key), static_cast<uint32_t>(hash));
   // EnsureCapacity will guarantee the hash table is never full.
   for (InternalIndex entry = FirstProbe(hash, capacity);;
        entry = NextProbe(entry, count++, capacity)) {

src/objects/instance-type.h

@@ -315,6 +315,8 @@ IS_TYPE_FUNCTION_DECL(CodeT)
   V(_, BreakPointMap, break_point_map, BreakPoint)                             \
   V(_, BreakPointInfoMap, break_point_info_map, BreakPointInfo)                \
   V(_, BytecodeArrayMap, bytecode_array_map, BytecodeArray)                    \
+  V(_, CachedTemplateObjectMap, cached_template_object_map,                    \
+    CachedTemplateObject)                                                      \
   V(_, CellMap, cell_map, Cell)                                                \
   V(_, WeakCellMap, weak_cell_map, WeakCell)                                   \
   V(_, CodeMap, code_map, Code)                                                \

src/objects/object-list-macros.h

@@ -91,7 +91,6 @@ class ZoneForwardList;
   V(CallHandlerInfo)                            \
   V(Callable)                                   \
   V(Cell)                                       \
-  V(CachedTemplateObject)                       \
   V(ClassBoilerplate)                           \
   V(Code)                                       \
   V(CodeDataContainer)                          \

src/objects/objects-body-descriptors-inl.h

@@ -32,7 +32,7 @@
 #include "src/objects/source-text-module.h"
 #include "src/objects/swiss-name-dictionary-inl.h"
 #include "src/objects/synthetic-module.h"
-#include "src/objects/template-objects-inl.h"
+#include "src/objects/template-objects.h"
 #include "src/objects/torque-defined-classes-inl.h"
 #include "src/objects/transitions.h"
 #include "src/objects/turbofan-types-inl.h"

src/objects/objects-definitions.h

@@ -152,6 +152,8 @@ namespace internal {
     async_generator_request)                                                   \
   V(_, BREAK_POINT_TYPE, BreakPoint, break_point)                              \
   V(_, BREAK_POINT_INFO_TYPE, BreakPointInfo, break_point_info)                \
+  V(_, CACHED_TEMPLATE_OBJECT_TYPE, CachedTemplateObject,                      \
+    cached_template_object)                                                    \
   V(_, CALL_SITE_INFO_TYPE, CallSiteInfo, call_site_info)                      \
   V(_, CLASS_POSITIONS_TYPE, ClassPositions, class_positions)                  \
   V(_, DEBUG_INFO_TYPE, DebugInfo, debug_info)                                 \

src/objects/objects-inl.h

@@ -1140,9 +1140,6 @@ Object Object::GetSimpleHash(Object object) {
   } else if (InstanceTypeChecker::IsSharedFunctionInfo(instance_type)) {
     uint32_t hash = SharedFunctionInfo::cast(object).Hash();
     return Smi::FromInt(hash & Smi::kMaxValue);
-  } else if (InstanceTypeChecker::IsScript(instance_type)) {
-    int id = Script::cast(object).id();
-    return Smi::FromInt(ComputeUnseededHash(id) & Smi::kMaxValue);
   }
   DCHECK(object.IsJSReceiver());
   return object;

src/objects/template-objects.cc

@@ -19,57 +19,26 @@ Handle<JSArray> TemplateObjectDescription::GetTemplateObject(
     Isolate* isolate, Handle<NativeContext> native_context,
     Handle<TemplateObjectDescription> description,
     Handle<SharedFunctionInfo> shared_info, int slot_id) {
-  int function_literal_id = shared_info->function_literal_id();
+  uint32_t hash = shared_info->Hash();
 
   // Check the template weakmap to see if the template object already exists.
   Handle<EphemeronHashTable> template_weakmap;
-  Handle<Script> script(Script::cast(shared_info->script(isolate)), isolate);
-  int32_t hash =
-      EphemeronHashTable::ShapeT::Hash(ReadOnlyRoots(isolate), script);
-  Handle<HeapObject> cached_templates_head;
-  MaybeHandle<CachedTemplateObject> existing_cached_template;
 
   if (native_context->template_weakmap().IsUndefined(isolate)) {
     template_weakmap = EphemeronHashTable::New(isolate, 1);
-    cached_templates_head = isolate->factory()->the_hole_value();
   } else {
     DisallowGarbageCollection no_gc;
     ReadOnlyRoots roots(isolate);
     template_weakmap = handle(
         EphemeronHashTable::cast(native_context->template_weakmap()), isolate);
-    cached_templates_head = handle(
+    Object maybe_cached_template = template_weakmap->Lookup(shared_info, hash);
-        HeapObject::cast(template_weakmap->Lookup(isolate, script, hash)),
-        isolate);
-
-    HeapObject maybe_cached_template = *cached_templates_head;
-    CachedTemplateObject previous_cached_template;
     while (!maybe_cached_template.IsTheHole(roots)) {
       CachedTemplateObject cached_template =
           CachedTemplateObject::cast(maybe_cached_template);
-      if (cached_template.function_literal_id() == function_literal_id &&
+      if (cached_template.slot_id() == slot_id) {
-          cached_template.slot_id() == slot_id) {
+        return handle(cached_template.template_object(), isolate);
-        HeapObject template_object;
-        if (!cached_template.template_object(isolate).GetHeapObject(
-                &template_object)) {
-          // If the existing cached template is a cleared ref, update it
-          // in-place.
-          existing_cached_template = handle(cached_template, isolate);
-          break;
-        }
-        return handle(JSArray::cast(template_object), isolate);
       }
       maybe_cached_template = cached_template.next();
-
-      // Remove this entry from the list if it has a cleared object ref.
-      if (cached_template.template_object(isolate).IsCleared()) {
-        if (!previous_cached_template.is_null()) {
-          previous_cached_template.set_next(maybe_cached_template);
-        } else {
-          DCHECK_EQ(cached_template, *cached_templates_head);
-          cached_templates_head = handle(maybe_cached_template, isolate);
-        }
-      }
-      previous_cached_template = cached_template;
     }
   }
 
@@ -81,24 +50,33 @@ Handle<JSArray> TemplateObjectDescription::GetTemplateObject(
                                                             raw_strings);
 
   // Insert the template object into the template weakmap.
-  Handle<CachedTemplateObject> cached_template;
+  Handle<HeapObject> previous_cached_templates = handle(
-  if (existing_cached_template.ToHandle(&cached_template)) {
+      HeapObject::cast(template_weakmap->Lookup(shared_info, hash)), isolate);
-    cached_template->set_template_object(
+  Handle<CachedTemplateObject> cached_template = CachedTemplateObject::New(
-        HeapObjectReference::Weak(*template_object));
+      isolate, slot_id, template_object, previous_cached_templates);
-    // The existing cached template is already in the weakmap, so don't add it
+  template_weakmap = EphemeronHashTable::Put(
-    // again.
+      isolate, template_weakmap, shared_info, cached_template, hash);
-  } else {
+  native_context->set_template_weakmap(*template_weakmap);
-    cached_template = isolate->factory()->NewCachedTemplateObject(
-        function_literal_id, slot_id, cached_templates_head, template_object);
-
-    // Add the new cached template to the weakmap as the new linked list head.
-    template_weakmap = EphemeronHashTable::Put(isolate, template_weakmap,
-                                               script, cached_template, hash);
-    native_context->set_template_weakmap(*template_weakmap);
-  }
 
   return template_object;
 }
 
+Handle<CachedTemplateObject> CachedTemplateObject::New(
+    Isolate* isolate, int slot_id, Handle<JSArray> template_object,
+    Handle<HeapObject> next) {
+  DCHECK(next->IsCachedTemplateObject() || next->IsTheHole());
+  Handle<CachedTemplateObject> result_handle =
+      Handle<CachedTemplateObject>::cast(isolate->factory()->NewStruct(
+          CACHED_TEMPLATE_OBJECT_TYPE, AllocationType::kOld));
+  {
+    DisallowGarbageCollection no_gc;
+    auto result = *result_handle;
+    result.set_slot_id(slot_id);
+    result.set_template_object(*template_object);
+    result.set_next(*next);
+  }
+  return result_handle;
+}
+
 }  // namespace internal
 }  // namespace v8

src/objects/template-objects.h

@@ -23,10 +23,13 @@ class StructBodyDescriptor;
 // created. All the CachedTemplateObject's for a given SharedFunctionInfo form a
 // linked list via the next fields.
 class CachedTemplateObject final
-    : public TorqueGeneratedCachedTemplateObject<CachedTemplateObject,
+    : public TorqueGeneratedCachedTemplateObject<CachedTemplateObject, Struct> {
-                                                 HeapObject> {
  public:
-  class BodyDescriptor;
+  static Handle<CachedTemplateObject> New(Isolate* isolate, int slot_id,
+                                          Handle<JSArray> template_object,
+                                          Handle<HeapObject> next);
+
+  using BodyDescriptor = StructBodyDescriptor;
 
   TQ_OBJECT_CONSTRUCTORS(CachedTemplateObject)
 };

src/objects/template-objects.tq

@@ -2,13 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-@generateBodyDescriptor
+extern class CachedTemplateObject extends Struct {
-@generateUniqueMap
-extern class CachedTemplateObject extends HeapObject {
-  function_literal_id: Smi;
   slot_id: Smi;
+  template_object: JSArray;
   next: CachedTemplateObject|TheHole;
-  template_object: Weak<JSArray>;
 }
 
 extern class TemplateObjectDescription extends Struct {

src/runtime/runtime-test.cc

@@ -847,9 +847,6 @@ RUNTIME_FUNCTION(Runtime_GetOptimizationStatus) {
   if (function->ActiveTierIsIgnition()) {
     status |= static_cast<int>(OptimizationStatus::kInterpreted);
   }
-  if (!function->is_compiled()) {
-    status |= static_cast<int>(OptimizationStatus::kIsLazy);
-  }
 
   // Additionally, detect activations of this frame on the stack, and report the
   // status of the topmost frame.
@@ -910,20 +907,6 @@ RUNTIME_FUNCTION(Runtime_FinalizeOptimization) {
   return ReadOnlyRoots(isolate).undefined_value();
 }
 
-RUNTIME_FUNCTION(Runtime_ForceFlush) {
-  HandleScope scope(isolate);
-  if (args.length() != 1) return CrashUnlessFuzzing(isolate);
-
-  Handle<Object> function_object = args.at(0);
-  if (!function_object->IsJSFunction()) return CrashUnlessFuzzing(isolate);
-  Handle<JSFunction> function = Handle<JSFunction>::cast(function_object);
-
-  SharedFunctionInfo::DiscardCompiled(
-      isolate, handle(function->shared(isolate), isolate));
-  function->ResetIfCodeFlushed();
-  return ReadOnlyRoots(isolate).undefined_value();
-}
-
 static void ReturnNull(const v8::FunctionCallbackInfo<v8::Value>& args) {
   args.GetReturnValue().SetNull();
 }

src/runtime/runtime.h

@@ -508,7 +508,6 @@ namespace internal {
   F(EnableCodeLoggingForTesting, 0, 1)        \
   F(EnsureFeedbackVectorForFunction, 1, 1)    \
   F(FinalizeOptimization, 0, 1)               \
-  F(ForceFlush, 1, 1)                         \
   F(GetCallable, 0, 1)                        \
   F(GetInitializerFunction, 1, 1)             \
   F(GetOptimizationStatus, 1, 1)              \
@@ -941,7 +940,6 @@ enum class OptimizationStatus {
   kBaseline = 1 << 15,
   kTopmostFrameIsInterpreted = 1 << 16,
   kTopmostFrameIsBaseline = 1 << 17,
-  kIsLazy = 1 << 18,
 };
 
 }  // namespace internal

src/snapshot/context-serializer.cc

@@ -203,11 +203,12 @@ void ContextSerializer::SerializeObjectImpl(Handle<HeapObject> obj) {
 }
 
 bool ContextSerializer::ShouldBeInTheStartupObjectCache(HeapObject o) {
-  // We can't allow scripts to be part of the context snapshot because they
+  // Scripts should be referred only through shared function infos.  We can't
-  // contain a unique ID, and deserializing several context snapshots containing
+  // allow them to be part of the context snapshot because they contain a
-  // script would cause dupes.
+  // unique ID, and deserializing several context snapshots containing script
-  return o.IsName() || o.IsScript() || o.IsSharedFunctionInfo() ||
+  // would cause dupes.
-         o.IsHeapNumber() ||
+  DCHECK(!o.IsScript());
+  return o.IsName() || o.IsSharedFunctionInfo() || o.IsHeapNumber() ||
          (V8_EXTERNAL_CODE_SPACE_BOOL && o.IsCodeDataContainer()) ||
          o.IsCode() || o.IsScopeInfo() || o.IsAccessorInfo() ||
          o.IsTemplateInfo() || o.IsClassPositions() ||

test/mjsunit/mjsunit.js

@@ -188,7 +188,6 @@ var V8OptimizationStatus = {
   kBaseline: 1 << 15,
   kTopmostFrameIsInterpreted: 1 << 16,
   kTopmostFrameIsBaseline: 1 << 17,
-  kIsLazy: 1 << 18,
 };
 
 // Returns true if --lite-mode is on and we can't ever turn on optimization.
@@ -200,9 +199,6 @@ var isNeverOptimize;
 // Returns true if --always-turbofan mode is on.
 var isAlwaysOptimize;
 
-// Returns true if given function in lazily compiled.
-var isLazy;
-
 // Returns true if given function in interpreted.
 var isInterpreted;
 
@@ -766,13 +762,6 @@ var prettyPrinted;
     return (opt_status & V8OptimizationStatus.kAlwaysOptimize) !== 0;
   }
 
-  isLazy = function isLazy(fun) {
-    var opt_status = OptimizationStatus(fun, '');
-    assertTrue((opt_status & V8OptimizationStatus.kIsFunction) !== 0,
-               "not a function");
-    return (opt_status & V8OptimizationStatus.kIsLazy) !== 0;
-  }
-
   isInterpreted = function isInterpreted(fun) {
     var opt_status = OptimizationStatus(fun, "");
     assertTrue((opt_status & V8OptimizationStatus.kIsFunction) !== 0,

test/mjsunit/regress/regress-1364429.js

@@ -1,20 +0,0 @@
-// Copyright 2022 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-//
-// Flags: --expose-gc
-
-function get_template_object(x) {
-  return x;
-}
-function foo() {
-  return get_template_object``;
-}
-function bar() {
-  return get_template_object``;
-}
-foo();
-gc();
-var cached_bar = bar();
-assertNotSame(foo() === cached_bar);
-assertSame(bar(), cached_bar);

test/mjsunit/regress/regress-v8-13190.js

@@ -1,48 +0,0 @@
-// Copyright 2022 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-//
-// Flags: --allow-natives-syntax --expose-gc
-// Flags: --no-sparkplug --no-maglev --no-turbofan
-// Flags: --lazy --flush-bytecode
-
-// Helper that, given a template object, simply returns it.
-function get_template_object(obj) {
-  return obj;
-}
-
-function foo_factory() {
-  // The SFI for foo is held by the bytecode array of foo_factory, so will be
-  // collected if foo_factory's bytecode is flushed.
-  return function foo() {
-    return get_template_object``
-  }
-}
-
-// Create foo in another function to avoid it leaking on the global object or
-// top-level script locals, and accidentally being kept alive.
-function get_foo_template_object() {
-  let foo = foo_factory();
-  return foo();
-}
-
-assertTrue(isLazy(foo_factory));
-
-let inital_template_object = get_foo_template_object();
-assertEquals(inital_template_object, get_foo_template_object(),
-             "Template object identity should be preserved");
-
-// Force a flush of foo_factory, so that the SharedFunctionInfo of foo can be
-// collected.
-%ForceFlush(foo_factory);
-assertTrue(isLazy(foo_factory));
-
-// Do a few more GCs to allow weak maps to be cleared.
-gc();
-gc();
-gc();
-
-// Flushing foo_factory and GCing foo should not affect the persisted reference
-// identity of the template object inside foo.
-assertSame(inital_template_object, get_foo_template_object(),
-           "Template object identity should be preserved");

tools/v8heapconst.py

@@ -59,59 +59,59 @@ INSTANCE_TYPES = {
   148: "ASYNC_GENERATOR_REQUEST_TYPE",
   149: "BREAK_POINT_TYPE",
   150: "BREAK_POINT_INFO_TYPE",
-  151: "CALL_SITE_INFO_TYPE",
+  151: "CACHED_TEMPLATE_OBJECT_TYPE",
-  152: "CLASS_POSITIONS_TYPE",
+  152: "CALL_SITE_INFO_TYPE",
-  153: "DEBUG_INFO_TYPE",
+  153: "CLASS_POSITIONS_TYPE",
-  154: "ENUM_CACHE_TYPE",
+  154: "DEBUG_INFO_TYPE",
-  155: "ERROR_STACK_DATA_TYPE",
+  155: "ENUM_CACHE_TYPE",
-  156: "FEEDBACK_CELL_TYPE",
+  156: "ERROR_STACK_DATA_TYPE",
-  157: "FUNCTION_TEMPLATE_RARE_DATA_TYPE",
+  157: "FEEDBACK_CELL_TYPE",
-  158: "INTERCEPTOR_INFO_TYPE",
+  158: "FUNCTION_TEMPLATE_RARE_DATA_TYPE",
-  159: "INTERPRETER_DATA_TYPE",
+  159: "INTERCEPTOR_INFO_TYPE",
-  160: "MODULE_REQUEST_TYPE",
+  160: "INTERPRETER_DATA_TYPE",
-  161: "PROMISE_CAPABILITY_TYPE",
+  161: "MODULE_REQUEST_TYPE",
-  162: "PROMISE_ON_STACK_TYPE",
+  162: "PROMISE_CAPABILITY_TYPE",
-  163: "PROMISE_REACTION_TYPE",
+  163: "PROMISE_ON_STACK_TYPE",
-  164: "PROPERTY_DESCRIPTOR_OBJECT_TYPE",
+  164: "PROMISE_REACTION_TYPE",
-  165: "PROTOTYPE_INFO_TYPE",
+  165: "PROPERTY_DESCRIPTOR_OBJECT_TYPE",
-  166: "REG_EXP_BOILERPLATE_DESCRIPTION_TYPE",
+  166: "PROTOTYPE_INFO_TYPE",
-  167: "SCRIPT_TYPE",
+  167: "REG_EXP_BOILERPLATE_DESCRIPTION_TYPE",
-  168: "SCRIPT_OR_MODULE_TYPE",
+  168: "SCRIPT_TYPE",
-  169: "SOURCE_TEXT_MODULE_INFO_ENTRY_TYPE",
+  169: "SCRIPT_OR_MODULE_TYPE",
-  170: "STACK_FRAME_INFO_TYPE",
+  170: "SOURCE_TEXT_MODULE_INFO_ENTRY_TYPE",
-  171: "TEMPLATE_OBJECT_DESCRIPTION_TYPE",
+  171: "STACK_FRAME_INFO_TYPE",
-  172: "TUPLE2_TYPE",
+  172: "TEMPLATE_OBJECT_DESCRIPTION_TYPE",
-  173: "WASM_EXCEPTION_TAG_TYPE",
+  173: "TUPLE2_TYPE",
-  174: "WASM_INDIRECT_FUNCTION_TABLE_TYPE",
+  174: "WASM_EXCEPTION_TAG_TYPE",
-  175: "FIXED_ARRAY_TYPE",
+  175: "WASM_INDIRECT_FUNCTION_TABLE_TYPE",
-  176: "HASH_TABLE_TYPE",
+  176: "FIXED_ARRAY_TYPE",
-  177: "EPHEMERON_HASH_TABLE_TYPE",
+  177: "HASH_TABLE_TYPE",
-  178: "GLOBAL_DICTIONARY_TYPE",
+  178: "EPHEMERON_HASH_TABLE_TYPE",
-  179: "NAME_DICTIONARY_TYPE",
+  179: "GLOBAL_DICTIONARY_TYPE",
-  180: "NAME_TO_INDEX_HASH_TABLE_TYPE",
+  180: "NAME_DICTIONARY_TYPE",
-  181: "NUMBER_DICTIONARY_TYPE",
+  181: "NAME_TO_INDEX_HASH_TABLE_TYPE",
-  182: "ORDERED_HASH_MAP_TYPE",
+  182: "NUMBER_DICTIONARY_TYPE",
-  183: "ORDERED_HASH_SET_TYPE",
+  183: "ORDERED_HASH_MAP_TYPE",
-  184: "ORDERED_NAME_DICTIONARY_TYPE",
+  184: "ORDERED_HASH_SET_TYPE",
-  185: "REGISTERED_SYMBOL_TABLE_TYPE",
+  185: "ORDERED_NAME_DICTIONARY_TYPE",
-  186: "SIMPLE_NUMBER_DICTIONARY_TYPE",
+  186: "REGISTERED_SYMBOL_TABLE_TYPE",
-  187: "CLOSURE_FEEDBACK_CELL_ARRAY_TYPE",
+  187: "SIMPLE_NUMBER_DICTIONARY_TYPE",
-  188: "OBJECT_BOILERPLATE_DESCRIPTION_TYPE",
+  188: "CLOSURE_FEEDBACK_CELL_ARRAY_TYPE",
-  189: "SCRIPT_CONTEXT_TABLE_TYPE",
+  189: "OBJECT_BOILERPLATE_DESCRIPTION_TYPE",
-  190: "BYTE_ARRAY_TYPE",
+  190: "SCRIPT_CONTEXT_TABLE_TYPE",
-  191: "BYTECODE_ARRAY_TYPE",
+  191: "BYTE_ARRAY_TYPE",
-  192: "FIXED_DOUBLE_ARRAY_TYPE",
+  192: "BYTECODE_ARRAY_TYPE",
-  193: "INTERNAL_CLASS_WITH_SMI_ELEMENTS_TYPE",
+  193: "FIXED_DOUBLE_ARRAY_TYPE",
-  194: "SLOPPY_ARGUMENTS_ELEMENTS_TYPE",
+  194: "INTERNAL_CLASS_WITH_SMI_ELEMENTS_TYPE",
-  195: "TURBOFAN_BITSET_TYPE_TYPE",
+  195: "SLOPPY_ARGUMENTS_ELEMENTS_TYPE",
-  196: "TURBOFAN_HEAP_CONSTANT_TYPE_TYPE",
+  196: "TURBOFAN_BITSET_TYPE_TYPE",
-  197: "TURBOFAN_OTHER_NUMBER_CONSTANT_TYPE_TYPE",
+  197: "TURBOFAN_HEAP_CONSTANT_TYPE_TYPE",
-  198: "TURBOFAN_RANGE_TYPE_TYPE",
+  198: "TURBOFAN_OTHER_NUMBER_CONSTANT_TYPE_TYPE",
-  199: "TURBOFAN_UNION_TYPE_TYPE",
+  199: "TURBOFAN_RANGE_TYPE_TYPE",
-  200: "UNCOMPILED_DATA_WITH_PREPARSE_DATA_TYPE",
+  200: "TURBOFAN_UNION_TYPE_TYPE",
-  201: "UNCOMPILED_DATA_WITH_PREPARSE_DATA_AND_JOB_TYPE",
+  201: "EXPORTED_SUB_CLASS_BASE_TYPE",
-  202: "UNCOMPILED_DATA_WITHOUT_PREPARSE_DATA_TYPE",
+  202: "EXPORTED_SUB_CLASS_TYPE",
-  203: "UNCOMPILED_DATA_WITHOUT_PREPARSE_DATA_WITH_JOB_TYPE",
+  203: "EXPORTED_SUB_CLASS2_TYPE",
   204: "FOREIGN_TYPE",
   205: "AWAIT_CONTEXT_TYPE",
   206: "BLOCK_CONTEXT_TYPE",
@@ -123,26 +123,26 @@ INSTANCE_TYPES = {
   212: "NATIVE_CONTEXT_TYPE",
   213: "SCRIPT_CONTEXT_TYPE",
   214: "WITH_CONTEXT_TYPE",
-  215: "WASM_FUNCTION_DATA_TYPE",
+  215: "UNCOMPILED_DATA_WITH_PREPARSE_DATA_TYPE",
-  216: "WASM_CAPI_FUNCTION_DATA_TYPE",
+  216: "UNCOMPILED_DATA_WITH_PREPARSE_DATA_AND_JOB_TYPE",
-  217: "WASM_EXPORTED_FUNCTION_DATA_TYPE",
+  217: "UNCOMPILED_DATA_WITHOUT_PREPARSE_DATA_TYPE",
-  218: "WASM_JS_FUNCTION_DATA_TYPE",
+  218: "UNCOMPILED_DATA_WITHOUT_PREPARSE_DATA_WITH_JOB_TYPE",
-  219: "EXPORTED_SUB_CLASS_BASE_TYPE",
+  219: "WASM_FUNCTION_DATA_TYPE",
-  220: "EXPORTED_SUB_CLASS_TYPE",
+  220: "WASM_CAPI_FUNCTION_DATA_TYPE",
-  221: "EXPORTED_SUB_CLASS2_TYPE",
+  221: "WASM_EXPORTED_FUNCTION_DATA_TYPE",
-  222: "SMALL_ORDERED_HASH_MAP_TYPE",
+  222: "WASM_JS_FUNCTION_DATA_TYPE",
-  223: "SMALL_ORDERED_HASH_SET_TYPE",
+  223: "SMALL_ORDERED_HASH_MAP_TYPE",
-  224: "SMALL_ORDERED_NAME_DICTIONARY_TYPE",
+  224: "SMALL_ORDERED_HASH_SET_TYPE",
-  225: "ABSTRACT_INTERNAL_CLASS_SUBCLASS1_TYPE",
+  225: "SMALL_ORDERED_NAME_DICTIONARY_TYPE",
-  226: "ABSTRACT_INTERNAL_CLASS_SUBCLASS2_TYPE",
+  226: "ABSTRACT_INTERNAL_CLASS_SUBCLASS1_TYPE",
-  227: "DESCRIPTOR_ARRAY_TYPE",
+  227: "ABSTRACT_INTERNAL_CLASS_SUBCLASS2_TYPE",
-  228: "STRONG_DESCRIPTOR_ARRAY_TYPE",
+  228: "DESCRIPTOR_ARRAY_TYPE",
-  229: "SOURCE_TEXT_MODULE_TYPE",
+  229: "STRONG_DESCRIPTOR_ARRAY_TYPE",
-  230: "SYNTHETIC_MODULE_TYPE",
+  230: "SOURCE_TEXT_MODULE_TYPE",
-  231: "WEAK_FIXED_ARRAY_TYPE",
+  231: "SYNTHETIC_MODULE_TYPE",
-  232: "TRANSITION_ARRAY_TYPE",
+  232: "WEAK_FIXED_ARRAY_TYPE",
-  233: "ACCESSOR_INFO_TYPE",
+  233: "TRANSITION_ARRAY_TYPE",
-  234: "CACHED_TEMPLATE_OBJECT_TYPE",
+  234: "ACCESSOR_INFO_TYPE",
   235: "CALL_HANDLER_INFO_TYPE",
   236: "CELL_TYPE",
   237: "CODE_TYPE",
@@ -286,10 +286,10 @@ INSTANCE_TYPES = {
 KNOWN_MAPS = {
     ("read_only_space", 0x02139): (247, "MetaMap"),
     ("read_only_space", 0x02161): (131, "NullMap"),
-    ("read_only_space", 0x02189): (228, "StrongDescriptorArrayMap"),
+    ("read_only_space", 0x02189): (229, "StrongDescriptorArrayMap"),
     ("read_only_space", 0x021b1): (265, "WeakArrayListMap"),
-    ("read_only_space", 0x021f5): (154, "EnumCacheMap"),
+    ("read_only_space", 0x021f5): (155, "EnumCacheMap"),
-    ("read_only_space", 0x02229): (175, "FixedArrayMap"),
+    ("read_only_space", 0x02229): (176, "FixedArrayMap"),
     ("read_only_space", 0x02275): (8, "OneByteInternalizedStringMap"),
     ("read_only_space", 0x022c1): (244, "FreeSpaceMap"),
     ("read_only_space", 0x022e9): (243, "OnePointerFillerMap"),
@@ -299,9 +299,9 @@ KNOWN_MAPS = {
     ("read_only_space", 0x023f5): (130, "HeapNumberMap"),
     ("read_only_space", 0x02429): (131, "TheHoleMap"),
     ("read_only_space", 0x02489): (131, "BooleanMap"),
-    ("read_only_space", 0x0252d): (190, "ByteArrayMap"),
+    ("read_only_space", 0x0252d): (191, "ByteArrayMap"),
-    ("read_only_space", 0x02555): (175, "FixedCOWArrayMap"),
+    ("read_only_space", 0x02555): (176, "FixedCOWArrayMap"),
-    ("read_only_space", 0x0257d): (176, "HashTableMap"),
+    ("read_only_space", 0x0257d): (177, "HashTableMap"),
     ("read_only_space", 0x025a5): (128, "SymbolMap"),
     ("read_only_space", 0x025cd): (40, "OneByteStringMap"),
     ("read_only_space", 0x025f5): (253, "ScopeInfoMap"),
@@ -310,7 +310,7 @@ KNOWN_MAPS = {
     ("read_only_space", 0x0266d): (236, "CellMap"),
     ("read_only_space", 0x02695): (252, "GlobalPropertyCellMap"),
     ("read_only_space", 0x026bd): (204, "ForeignMap"),
-    ("read_only_space", 0x026e5): (232, "TransitionArrayMap"),
+    ("read_only_space", 0x026e5): (233, "TransitionArrayMap"),
     ("read_only_space", 0x0270d): (45, "ThinOneByteStringMap"),
     ("read_only_space", 0x02735): (242, "FeedbackVectorMap"),
     ("read_only_space", 0x0276d): (131, "ArgumentsMarkerMap"),
@@ -318,52 +318,52 @@ KNOWN_MAPS = {
     ("read_only_space", 0x02829): (131, "TerminationExceptionMap"),
     ("read_only_space", 0x02891): (131, "OptimizedOutMap"),
     ("read_only_space", 0x028f1): (131, "StaleRegisterMap"),
-    ("read_only_space", 0x02951): (189, "ScriptContextTableMap"),
+    ("read_only_space", 0x02951): (190, "ScriptContextTableMap"),
-    ("read_only_space", 0x02979): (187, "ClosureFeedbackCellArrayMap"),
+    ("read_only_space", 0x02979): (188, "ClosureFeedbackCellArrayMap"),
     ("read_only_space", 0x029a1): (241, "FeedbackMetadataArrayMap"),
-    ("read_only_space", 0x029c9): (175, "ArrayListMap"),
+    ("read_only_space", 0x029c9): (176, "ArrayListMap"),
     ("read_only_space", 0x029f1): (129, "BigIntMap"),
-    ("read_only_space", 0x02a19): (188, "ObjectBoilerplateDescriptionMap"),
+    ("read_only_space", 0x02a19): (189, "ObjectBoilerplateDescriptionMap"),
-    ("read_only_space", 0x02a41): (191, "BytecodeArrayMap"),
+    ("read_only_space", 0x02a41): (192, "BytecodeArrayMap"),
     ("read_only_space", 0x02a69): (238, "CodeDataContainerMap"),
     ("read_only_space", 0x02a91): (239, "CoverageInfoMap"),
-    ("read_only_space", 0x02ab9): (192, "FixedDoubleArrayMap"),
+    ("read_only_space", 0x02ab9): (193, "FixedDoubleArrayMap"),
-    ("read_only_space", 0x02ae1): (178, "GlobalDictionaryMap"),
+    ("read_only_space", 0x02ae1): (179, "GlobalDictionaryMap"),
-    ("read_only_space", 0x02b09): (156, "ManyClosuresCellMap"),
+    ("read_only_space", 0x02b09): (157, "ManyClosuresCellMap"),
     ("read_only_space", 0x02b31): (248, "MegaDomHandlerMap"),
-    ("read_only_space", 0x02b59): (175, "ModuleInfoMap"),
+    ("read_only_space", 0x02b59): (176, "ModuleInfoMap"),
-    ("read_only_space", 0x02b81): (179, "NameDictionaryMap"),
+    ("read_only_space", 0x02b81): (180, "NameDictionaryMap"),
-    ("read_only_space", 0x02ba9): (156, "NoClosuresCellMap"),
+    ("read_only_space", 0x02ba9): (157, "NoClosuresCellMap"),
-    ("read_only_space", 0x02bd1): (181, "NumberDictionaryMap"),
+    ("read_only_space", 0x02bd1): (182, "NumberDictionaryMap"),
-    ("read_only_space", 0x02bf9): (156, "OneClosureCellMap"),
+    ("read_only_space", 0x02bf9): (157, "OneClosureCellMap"),
-    ("read_only_space", 0x02c21): (182, "OrderedHashMapMap"),
+    ("read_only_space", 0x02c21): (183, "OrderedHashMapMap"),
-    ("read_only_space", 0x02c49): (183, "OrderedHashSetMap"),
+    ("read_only_space", 0x02c49): (184, "OrderedHashSetMap"),
-    ("read_only_space", 0x02c71): (180, "NameToIndexHashTableMap"),
+    ("read_only_space", 0x02c71): (181, "NameToIndexHashTableMap"),
-    ("read_only_space", 0x02c99): (185, "RegisteredSymbolTableMap"),
+    ("read_only_space", 0x02c99): (186, "RegisteredSymbolTableMap"),
-    ("read_only_space", 0x02cc1): (184, "OrderedNameDictionaryMap"),
+    ("read_only_space", 0x02cc1): (185, "OrderedNameDictionaryMap"),
     ("read_only_space", 0x02ce9): (250, "PreparseDataMap"),
     ("read_only_space", 0x02d11): (251, "PropertyArrayMap"),
-    ("read_only_space", 0x02d39): (233, "AccessorInfoMap"),
+    ("read_only_space", 0x02d39): (234, "AccessorInfoMap"),
     ("read_only_space", 0x02d61): (235, "SideEffectCallHandlerInfoMap"),
     ("read_only_space", 0x02d89): (235, "SideEffectFreeCallHandlerInfoMap"),
     ("read_only_space", 0x02db1): (235, "NextCallSideEffectFreeCallHandlerInfoMap"),
-    ("read_only_space", 0x02dd9): (186, "SimpleNumberDictionaryMap"),
+    ("read_only_space", 0x02dd9): (187, "SimpleNumberDictionaryMap"),
-    ("read_only_space", 0x02e01): (222, "SmallOrderedHashMapMap"),
+    ("read_only_space", 0x02e01): (223, "SmallOrderedHashMapMap"),
-    ("read_only_space", 0x02e29): (223, "SmallOrderedHashSetMap"),
+    ("read_only_space", 0x02e29): (224, "SmallOrderedHashSetMap"),
-    ("read_only_space", 0x02e51): (224, "SmallOrderedNameDictionaryMap"),
+    ("read_only_space", 0x02e51): (225, "SmallOrderedNameDictionaryMap"),
-    ("read_only_space", 0x02e79): (229, "SourceTextModuleMap"),
+    ("read_only_space", 0x02e79): (230, "SourceTextModuleMap"),
     ("read_only_space", 0x02ea1): (258, "SwissNameDictionaryMap"),
-    ("read_only_space", 0x02ec9): (230, "SyntheticModuleMap"),
+    ("read_only_space", 0x02ec9): (231, "SyntheticModuleMap"),
     ("read_only_space", 0x02ef1): (259, "WasmApiFunctionRefMap"),
-    ("read_only_space", 0x02f19): (216, "WasmCapiFunctionDataMap"),
+    ("read_only_space", 0x02f19): (220, "WasmCapiFunctionDataMap"),
-    ("read_only_space", 0x02f41): (217, "WasmExportedFunctionDataMap"),
+    ("read_only_space", 0x02f41): (221, "WasmExportedFunctionDataMap"),
     ("read_only_space", 0x02f69): (261, "WasmInternalFunctionMap"),
-    ("read_only_space", 0x02f91): (218, "WasmJSFunctionDataMap"),
+    ("read_only_space", 0x02f91): (222, "WasmJSFunctionDataMap"),
     ("read_only_space", 0x02fb9): (262, "WasmResumeDataMap"),
     ("read_only_space", 0x02fe1): (264, "WasmTypeInfoMap"),
     ("read_only_space", 0x03009): (260, "WasmContinuationObjectMap"),
-    ("read_only_space", 0x03031): (231, "WeakFixedArrayMap"),
+    ("read_only_space", 0x03031): (232, "WeakFixedArrayMap"),
-    ("read_only_space", 0x03059): (177, "EphemeronHashTableMap"),
+    ("read_only_space", 0x03059): (178, "EphemeronHashTableMap"),
     ("read_only_space", 0x03081): (240, "EmbedderDataArrayMap"),
     ("read_only_space", 0x030a9): (266, "WeakCellMap"),
     ("read_only_space", 0x030d1): (32, "StringMap"),
@@ -392,7 +392,7 @@ KNOWN_MAPS = {
     ("read_only_space", 0x03469): (131, "SelfReferenceMarkerMap"),
     ("read_only_space", 0x03491): (131, "BasicBlockCountersMarkerMap"),
     ("read_only_space", 0x034d5): (146, "ArrayBoilerplateDescriptionMap"),
-    ("read_only_space", 0x035d5): (158, "InterceptorInfoMap"),
+    ("read_only_space", 0x035d5): (159, "InterceptorInfoMap"),
     ("read_only_space", 0x07455): (132, "PromiseFulfillReactionJobTaskMap"),
     ("read_only_space", 0x0747d): (133, "PromiseRejectReactionJobTaskMap"),
     ("read_only_space", 0x074a5): (134, "CallableTaskMap"),
@@ -408,50 +408,50 @@ KNOWN_MAPS = {
     ("read_only_space", 0x07635): (148, "AsyncGeneratorRequestMap"),
     ("read_only_space", 0x0765d): (149, "BreakPointMap"),
     ("read_only_space", 0x07685): (150, "BreakPointInfoMap"),
-    ("read_only_space", 0x076ad): (151, "CallSiteInfoMap"),
+    ("read_only_space", 0x076ad): (151, "CachedTemplateObjectMap"),
-    ("read_only_space", 0x076d5): (152, "ClassPositionsMap"),
+    ("read_only_space", 0x076d5): (152, "CallSiteInfoMap"),
-    ("read_only_space", 0x076fd): (153, "DebugInfoMap"),
+    ("read_only_space", 0x076fd): (153, "ClassPositionsMap"),
-    ("read_only_space", 0x07725): (155, "ErrorStackDataMap"),
+    ("read_only_space", 0x07725): (154, "DebugInfoMap"),
-    ("read_only_space", 0x0774d): (157, "FunctionTemplateRareDataMap"),
+    ("read_only_space", 0x0774d): (156, "ErrorStackDataMap"),
-    ("read_only_space", 0x07775): (159, "InterpreterDataMap"),
+    ("read_only_space", 0x07775): (158, "FunctionTemplateRareDataMap"),
-    ("read_only_space", 0x0779d): (160, "ModuleRequestMap"),
+    ("read_only_space", 0x0779d): (160, "InterpreterDataMap"),
-    ("read_only_space", 0x077c5): (161, "PromiseCapabilityMap"),
+    ("read_only_space", 0x077c5): (161, "ModuleRequestMap"),
-    ("read_only_space", 0x077ed): (162, "PromiseOnStackMap"),
+    ("read_only_space", 0x077ed): (162, "PromiseCapabilityMap"),
-    ("read_only_space", 0x07815): (163, "PromiseReactionMap"),
+    ("read_only_space", 0x07815): (163, "PromiseOnStackMap"),
-    ("read_only_space", 0x0783d): (164, "PropertyDescriptorObjectMap"),
+    ("read_only_space", 0x0783d): (164, "PromiseReactionMap"),
-    ("read_only_space", 0x07865): (165, "PrototypeInfoMap"),
+    ("read_only_space", 0x07865): (165, "PropertyDescriptorObjectMap"),
-    ("read_only_space", 0x0788d): (166, "RegExpBoilerplateDescriptionMap"),
+    ("read_only_space", 0x0788d): (166, "PrototypeInfoMap"),
-    ("read_only_space", 0x078b5): (167, "ScriptMap"),
+    ("read_only_space", 0x078b5): (167, "RegExpBoilerplateDescriptionMap"),
-    ("read_only_space", 0x078dd): (168, "ScriptOrModuleMap"),
+    ("read_only_space", 0x078dd): (168, "ScriptMap"),
-    ("read_only_space", 0x07905): (169, "SourceTextModuleInfoEntryMap"),
+    ("read_only_space", 0x07905): (169, "ScriptOrModuleMap"),
-    ("read_only_space", 0x0792d): (170, "StackFrameInfoMap"),
+    ("read_only_space", 0x0792d): (170, "SourceTextModuleInfoEntryMap"),
-    ("read_only_space", 0x07955): (171, "TemplateObjectDescriptionMap"),
+    ("read_only_space", 0x07955): (171, "StackFrameInfoMap"),
-    ("read_only_space", 0x0797d): (172, "Tuple2Map"),
+    ("read_only_space", 0x0797d): (172, "TemplateObjectDescriptionMap"),
-    ("read_only_space", 0x079a5): (173, "WasmExceptionTagMap"),
+    ("read_only_space", 0x079a5): (173, "Tuple2Map"),
-    ("read_only_space", 0x079cd): (174, "WasmIndirectFunctionTableMap"),
+    ("read_only_space", 0x079cd): (174, "WasmExceptionTagMap"),
-    ("read_only_space", 0x079f5): (194, "SloppyArgumentsElementsMap"),
+    ("read_only_space", 0x079f5): (175, "WasmIndirectFunctionTableMap"),
-    ("read_only_space", 0x07a1d): (227, "DescriptorArrayMap"),
+    ("read_only_space", 0x07a1d): (195, "SloppyArgumentsElementsMap"),
-    ("read_only_space", 0x07a45): (202, "UncompiledDataWithoutPreparseDataMap"),
+    ("read_only_space", 0x07a45): (228, "DescriptorArrayMap"),
-    ("read_only_space", 0x07a6d): (200, "UncompiledDataWithPreparseDataMap"),
+    ("read_only_space", 0x07a6d): (217, "UncompiledDataWithoutPreparseDataMap"),
-    ("read_only_space", 0x07a95): (203, "UncompiledDataWithoutPreparseDataWithJobMap"),
+    ("read_only_space", 0x07a95): (215, "UncompiledDataWithPreparseDataMap"),
-    ("read_only_space", 0x07abd): (201, "UncompiledDataWithPreparseDataAndJobMap"),
+    ("read_only_space", 0x07abd): (218, "UncompiledDataWithoutPreparseDataWithJobMap"),
-    ("read_only_space", 0x07ae5): (249, "OnHeapBasicBlockProfilerDataMap"),
+    ("read_only_space", 0x07ae5): (216, "UncompiledDataWithPreparseDataAndJobMap"),
-    ("read_only_space", 0x07b0d): (234, "CachedTemplateObjectMap"),
+    ("read_only_space", 0x07b0d): (249, "OnHeapBasicBlockProfilerDataMap"),
-    ("read_only_space", 0x07b35): (195, "TurbofanBitsetTypeMap"),
+    ("read_only_space", 0x07b35): (196, "TurbofanBitsetTypeMap"),
-    ("read_only_space", 0x07b5d): (199, "TurbofanUnionTypeMap"),
+    ("read_only_space", 0x07b5d): (200, "TurbofanUnionTypeMap"),
-    ("read_only_space", 0x07b85): (198, "TurbofanRangeTypeMap"),
+    ("read_only_space", 0x07b85): (199, "TurbofanRangeTypeMap"),
-    ("read_only_space", 0x07bad): (196, "TurbofanHeapConstantTypeMap"),
+    ("read_only_space", 0x07bad): (197, "TurbofanHeapConstantTypeMap"),
-    ("read_only_space", 0x07bd5): (197, "TurbofanOtherNumberConstantTypeMap"),
+    ("read_only_space", 0x07bd5): (198, "TurbofanOtherNumberConstantTypeMap"),
     ("read_only_space", 0x07bfd): (245, "InternalClassMap"),
     ("read_only_space", 0x07c25): (256, "SmiPairMap"),
     ("read_only_space", 0x07c4d): (255, "SmiBoxMap"),
-    ("read_only_space", 0x07c75): (219, "ExportedSubClassBaseMap"),
+    ("read_only_space", 0x07c75): (201, "ExportedSubClassBaseMap"),
-    ("read_only_space", 0x07c9d): (220, "ExportedSubClassMap"),
+    ("read_only_space", 0x07c9d): (202, "ExportedSubClassMap"),
-    ("read_only_space", 0x07cc5): (225, "AbstractInternalClassSubclass1Map"),
+    ("read_only_space", 0x07cc5): (226, "AbstractInternalClassSubclass1Map"),
-    ("read_only_space", 0x07ced): (226, "AbstractInternalClassSubclass2Map"),
+    ("read_only_space", 0x07ced): (227, "AbstractInternalClassSubclass2Map"),
-    ("read_only_space", 0x07d15): (193, "InternalClassWithSmiElementsMap"),
+    ("read_only_space", 0x07d15): (194, "InternalClassWithSmiElementsMap"),
     ("read_only_space", 0x07d3d): (246, "InternalClassWithStructElementsMap"),
-    ("read_only_space", 0x07d65): (221, "ExportedSubClass2Map"),
+    ("read_only_space", 0x07d65): (203, "ExportedSubClass2Map"),
     ("read_only_space", 0x07d8d): (257, "SortStateMap"),
     ("read_only_space", 0x07db5): (263, "WasmStringViewIterMap"),
     ("read_only_space", 0x07ddd): (145, "AllocationSiteWithWeakNextMap"),