Assign CoverageInfo an instance type

This allows CoverageInfo to be distinguished from other kinds of
FixedArray at runtime. I also updated it to use untagged data since it
only stores ints, since that seems like the generally right thing to do
(even though I doubt anybody allocates enough of these to notice the
reduced GC work).

Related Torque changes:
- Allow structs containing untagged data to be used as class fields.
  This requires classifying them into the tagged or untagged sections of
  the class layout, and checking that their alignment requirements are
  met when stored in a packed array.
- Generate a struct containing struct field offsets, so we can ensure
  that the layouts defined in Torque and C++ code match. Of course it
  would be nice to generate a lot more (indexed accessors, synchronized
  accessors, GC visitors, etc.), but we can't do it all at once.

Change-Id: I29e2a2afe37e4805cd80e3a84ef9edfe7ca7bb6b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2047399
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#66318}

src/builtins/cast.tq

@@ -624,8 +624,7 @@ Cast<DebugInfo>(implicit context: Context)(o: HeapObject): DebugInfo
 extern macro IsCoverageInfo(HeapObject): bool;
 Cast<CoverageInfo>(implicit context: Context)(o: HeapObject): CoverageInfo
     labels CastError {
-  // TODO(jgruber): Assign an instance type.
+  if (IsCoverageInfo(o)) return %RawDownCast<CoverageInfo>(o);
-  if (IsFixedArray(o)) return %RawDownCast<CoverageInfo>(o);
   goto CastError;
 }
 

src/builtins/internal-coverage.tq

@@ -6,15 +6,6 @@
 
 namespace internal_coverage {
 
-  const kFirstSlotIndex:
-      constexpr int31 generates 'CoverageInfo::kFirstSlotIndex';
-  const kSlotBlockCountIndex:
-      constexpr int31 generates 'CoverageInfo::kSlotBlockCountIndex';
-  const kSlotIndexCountLog2:
-      constexpr int31 generates 'CoverageInfo::kSlotIndexCountLog2';
-  const kSlotIndexCountMask:
-      constexpr int31 generates 'CoverageInfo::kSlotIndexCountMask';
-
   macro GetCoverageInfo(implicit context: Context)(function: JSFunction):
       CoverageInfo labels IfNoCoverageInfo {
     const shared: SharedFunctionInfo = function.shared_function_info;
@@ -25,24 +16,10 @@ namespace internal_coverage {
     return UnsafeCast<CoverageInfo>(debugInfo.coverage_info);
   }
 
-  macro SlotCount(coverageInfo: CoverageInfo): Smi {
-    assert(kFirstSlotIndex == 0);  // Otherwise we'd have to consider it below.
-    assert(kFirstSlotIndex == (coverageInfo.length & kSlotIndexCountMask));
-    return coverageInfo.length >> kSlotIndexCountLog2;
-  }
-
-  macro FirstIndexForSlot(implicit context: Context)(slot: Smi): Smi {
-    assert(kFirstSlotIndex == 0);  // Otherwise we'd have to consider it below.
-    return slot << kSlotIndexCountLog2;
-  }
-
   macro IncrementBlockCount(implicit context: Context)(
       coverageInfo: CoverageInfo, slot: Smi) {
-    assert(slot < SlotCount(coverageInfo));
+    assert(Convert<int32>(slot) < coverageInfo.slot_count);
-    const slotStart: Smi = FirstIndexForSlot(slot);
+    ++coverageInfo.slots[slot].block_count;
-    const index: Smi = slotStart + kSlotBlockCountIndex;
-    coverageInfo.objects[index] =
-        UnsafeCast<Smi>(coverageInfo.objects[index]) + 1;
   }
 
   builtin IncBlockCounter(implicit context: Context)(

src/codegen/code-stub-assembler.cc

@@ -5624,6 +5624,10 @@ TNode<BoolT> CodeStubAssembler::IsCallableMap(SloppyTNode<Map> map) {
   return IsSetWord32<Map::Bits1::IsCallableBit>(LoadMapBitField(map));
 }
 
+TNode<BoolT> CodeStubAssembler::IsCoverageInfo(TNode<HeapObject> object) {
+  return IsCoverageInfoMap(LoadMap(object));
+}
+
 TNode<BoolT> CodeStubAssembler::IsDebugInfo(TNode<HeapObject> object) {
   return HasInstanceType(object, DEBUG_INFO_TYPE);
 }

src/codegen/code-stub-assembler.h

@@ -72,6 +72,7 @@ enum class PrimitiveType { kBoolean, kNumber, kString, kSymbol };
   V(ConsOneByteStringMap, cons_one_byte_string_map, ConsOneByteStringMap)      \
   V(ConsStringMap, cons_string_map, ConsStringMap)                             \
   V(constructor_string, constructor_string, ConstructorString)                 \
+  V(CoverageInfoMap, coverage_info_map, CoverageInfoMap)                       \
   V(date_to_string, date_to_string, DateToString)                              \
   V(default_string, default_string, DefaultString)                             \
   V(EmptyByteArray, empty_byte_array, EmptyByteArray)                          \
@@ -2479,6 +2480,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<BoolT> IsConsStringInstanceType(SloppyTNode<Int32T> instance_type);
   TNode<BoolT> IsConstructorMap(SloppyTNode<Map> map);
   TNode<BoolT> IsConstructor(SloppyTNode<HeapObject> object);
+  TNode<BoolT> IsCoverageInfo(TNode<HeapObject> object);
   TNode<BoolT> IsDebugInfo(TNode<HeapObject> object);
   TNode<BoolT> IsDeprecatedMap(SloppyTNode<Map> map);
   TNode<BoolT> IsNameDictionary(SloppyTNode<HeapObject> object);

src/compiler/types.cc

@@ -322,6 +322,7 @@ Type::bitset BitsetType::Lub(const MapRefLike& map) {
     case PREPARSE_DATA_TYPE:
     case UNCOMPILED_DATA_WITHOUT_PREPARSE_DATA_TYPE:
     case UNCOMPILED_DATA_WITH_PREPARSE_DATA_TYPE:
+    case COVERAGE_INFO_TYPE:
       return kOtherInternal;
 
     // Remaining instance types are unsupported for now. If any of them do

src/debug/debug-coverage.cc

@@ -74,9 +74,9 @@ std::vector<CoverageBlock> GetSortedBlockData(SharedFunctionInfo shared) {
       CoverageInfo::cast(shared.GetDebugInfo().coverage_info());
 
   std::vector<CoverageBlock> result;
-  if (coverage_info.SlotCount() == 0) return result;
+  if (coverage_info.slot_count() == 0) return result;
 
-  for (int i = 0; i < coverage_info.SlotCount(); i++) {
+  for (int i = 0; i < coverage_info.slot_count(); i++) {
     const int start_pos = coverage_info.StartSourcePosition(i);
     const int until_pos = coverage_info.EndSourcePosition(i);
     const int count = coverage_info.BlockCount(i);
@@ -385,7 +385,7 @@ void ResetAllBlockCounts(SharedFunctionInfo shared) {
   CoverageInfo coverage_info =
       CoverageInfo::cast(shared.GetDebugInfo().coverage_info());
 
-  for (int i = 0; i < coverage_info.SlotCount(); i++) {
+  for (int i = 0; i < coverage_info.slot_count(); i++) {
     coverage_info.ResetBlockCount(i);
   }
 }

src/heap/factory.cc

@@ -3122,10 +3122,13 @@ Handle<CoverageInfo> Factory::NewCoverageInfo(
     const ZoneVector<SourceRange>& slots) {
   const int slot_count = static_cast<int>(slots.size());
 
-  const int length = CoverageInfo::FixedArrayLengthForSlotCount(slot_count);
+  int size = CoverageInfo::SizeFor(slot_count);
-  Handle<CoverageInfo> info =
+  Map map = read_only_roots().coverage_info_map();
-      Handle<CoverageInfo>::cast(NewUninitializedFixedArray(length));
+  HeapObject result =
+      AllocateRawWithImmortalMap(size, AllocationType::kYoung, map);
+  Handle<CoverageInfo> info(CoverageInfo::cast(result), isolate());
 
+  info->set_slot_count(slot_count);
   for (int i = 0; i < slot_count; i++) {
     SourceRange range = slots[i];
     info->InitializeSlot(i, range.start, range.end);

src/heap/objects-visiting.h

@@ -23,6 +23,7 @@ namespace internal {
   V(CodeDataContainer)                 \
   V(ConsString)                        \
   V(Context)                           \
+  V(CoverageInfo)                      \
   V(DataHandler)                       \
   V(DescriptorArray)                   \
   V(EmbedderDataArray)                 \

src/heap/setup-heap-internal.cc

@@ -455,6 +455,8 @@ bool Heap::CreateInitialMaps() {
     ALLOCATE_VARSIZE_MAP(OBJECT_BOILERPLATE_DESCRIPTION_TYPE,
                          object_boilerplate_description)
 
+    ALLOCATE_VARSIZE_MAP(COVERAGE_INFO_TYPE, coverage_info);
+
     ALLOCATE_MAP(CALL_HANDLER_INFO_TYPE, CallHandlerInfo::kSize,
                  side_effect_call_handler_info)
     ALLOCATE_MAP(CALL_HANDLER_INFO_TYPE, CallHandlerInfo::kSize,

src/interpreter/bytecode-generator.cc

@@ -24,6 +24,7 @@
 #include "src/objects/template-objects-inl.h"
 #include "src/parsing/parse-info.h"
 #include "src/parsing/token.h"
+#include "src/utils/ostreams.h"
 
 namespace v8 {
 namespace internal {
@@ -1063,7 +1064,9 @@ Handle<BytecodeArray> BytecodeGenerator::FinalizeBytecode(
     info()->set_coverage_info(
         isolate->factory()->NewCoverageInfo(block_coverage_builder_->slots()));
     if (FLAG_trace_block_coverage) {
-      info()->coverage_info()->Print(info()->literal()->GetDebugName());
+      StdoutStream os;
+      info()->coverage_info()->CoverageInfoPrint(
+          os, info()->literal()->GetDebugName());
     }
   }
 

src/objects/debug-objects-inl.h

@@ -20,13 +20,11 @@ namespace internal {
 
 TQ_OBJECT_CONSTRUCTORS_IMPL(BreakPoint)
 TQ_OBJECT_CONSTRUCTORS_IMPL(BreakPointInfo)
-OBJECT_CONSTRUCTORS_IMPL(CoverageInfo, FixedArray)
+TQ_OBJECT_CONSTRUCTORS_IMPL(CoverageInfo)
 TQ_OBJECT_CONSTRUCTORS_IMPL(DebugInfo)
 
 NEVER_READ_ONLY_SPACE_IMPL(DebugInfo)
 
-CAST_ACCESSOR(CoverageInfo)
-
 TQ_SMI_ACCESSORS(DebugInfo, flags)
 TQ_SMI_ACCESSORS(DebugInfo, debugger_hints)
 

src/objects/debug-objects.cc

@@ -357,64 +357,56 @@ int BreakPointInfo::GetBreakPointCount(Isolate* isolate) {
   return FixedArray::cast(break_points()).length();
 }
 
-int CoverageInfo::SlotCount() const {
+int CoverageInfo::SlotFieldOffset(int slot_index, int field_offset) const {
-  DCHECK_EQ(kFirstSlotIndex, length() % kSlotIndexCount);
+  DCHECK_LT(field_offset, Slot::kSize);
-  return (length() - kFirstSlotIndex) / kSlotIndexCount;
+  DCHECK_LT(slot_index, slot_count());
+  return kSlotsOffset + slot_index * Slot::kSize + field_offset;
 }
 
 int CoverageInfo::StartSourcePosition(int slot_index) const {
-  DCHECK_LT(slot_index, SlotCount());
+  return ReadField<int32_t>(
-  const int slot_start = CoverageInfo::FirstIndexForSlot(slot_index);
+      SlotFieldOffset(slot_index, Slot::kStartSourcePositionOffset));
-  return Smi::ToInt(get(slot_start + kSlotStartSourcePositionIndex));
 }
 
 int CoverageInfo::EndSourcePosition(int slot_index) const {
-  DCHECK_LT(slot_index, SlotCount());
+  return ReadField<int32_t>(
-  const int slot_start = CoverageInfo::FirstIndexForSlot(slot_index);
+      SlotFieldOffset(slot_index, Slot::kEndSourcePositionOffset));
-  return Smi::ToInt(get(slot_start + kSlotEndSourcePositionIndex));
 }
 
 int CoverageInfo::BlockCount(int slot_index) const {
-  DCHECK_LT(slot_index, SlotCount());
+  return ReadField<int32_t>(
-  const int slot_start = CoverageInfo::FirstIndexForSlot(slot_index);
+      SlotFieldOffset(slot_index, Slot::kBlockCountOffset));
-  return Smi::ToInt(get(slot_start + kSlotBlockCountIndex));
 }
 
 void CoverageInfo::InitializeSlot(int slot_index, int from_pos, int to_pos) {
-  DCHECK_LT(slot_index, SlotCount());
+  WriteField<int32_t>(
-  const int slot_start = CoverageInfo::FirstIndexForSlot(slot_index);
+      SlotFieldOffset(slot_index, Slot::kStartSourcePositionOffset), from_pos);
-  set(slot_start + kSlotStartSourcePositionIndex, Smi::FromInt(from_pos));
+  WriteField<int32_t>(
-  set(slot_start + kSlotEndSourcePositionIndex, Smi::FromInt(to_pos));
+      SlotFieldOffset(slot_index, Slot::kEndSourcePositionOffset), to_pos);
-  set(slot_start + kSlotBlockCountIndex, Smi::zero());
+  ResetBlockCount(slot_index);
-}
+  WriteField<int32_t>(SlotFieldOffset(slot_index, Slot::kPaddingOffset), 0);
-
-void CoverageInfo::IncrementBlockCount(int slot_index) {
-  DCHECK_LT(slot_index, SlotCount());
-  const int slot_start = CoverageInfo::FirstIndexForSlot(slot_index);
-  const int old_count = BlockCount(slot_index);
-  set(slot_start + kSlotBlockCountIndex, Smi::FromInt(old_count + 1));
 }
 
 void CoverageInfo::ResetBlockCount(int slot_index) {
-  DCHECK_LT(slot_index, SlotCount());
+  WriteField<int32_t>(SlotFieldOffset(slot_index, Slot::kBlockCountOffset), 0);
-  const int slot_start = CoverageInfo::FirstIndexForSlot(slot_index);
-  set(slot_start + kSlotBlockCountIndex, Smi::zero());
 }
 
-void CoverageInfo::Print(std::unique_ptr<char[]> function_name) {
+void CoverageInfo::CoverageInfoPrint(std::ostream& os,
+                                     std::unique_ptr<char[]> function_name) {
   DCHECK(FLAG_trace_block_coverage);
   DisallowHeapAllocation no_gc;
 
-  StdoutStream os;
   os << "Coverage info (";
-  if (strlen(function_name.get()) > 0) {
+  if (function_name == nullptr) {
+    os << "{unknown}";
+  } else if (strlen(function_name.get()) > 0) {
     os << function_name.get();
   } else {
     os << "{anonymous}";
   }
   os << "):" << std::endl;
 
-  for (int i = 0; i < SlotCount(); i++) {
+  for (int i = 0; i < slot_count(); i++) {
     os << "{" << StartSourcePosition(i) << "," << EndSourcePosition(i) << "}"
        << std::endl;
   }

src/objects/debug-objects.h

@@ -182,47 +182,34 @@ class BreakPointInfo
 };
 
 // Holds information related to block code coverage.
-class CoverageInfo : public FixedArray {
+class CoverageInfo
+    : public TorqueGeneratedCoverageInfo<CoverageInfo, HeapObject> {
  public:
-  int SlotCount() const;
-
   int StartSourcePosition(int slot_index) const;
   int EndSourcePosition(int slot_index) const;
   int BlockCount(int slot_index) const;
 
   void InitializeSlot(int slot_index, int start_pos, int end_pos);
-  void IncrementBlockCount(int slot_index);
   void ResetBlockCount(int slot_index);
 
-  static int FixedArrayLengthForSlotCount(int slot_count) {
+  // Computes the size for a CoverageInfo instance of a given length.
-    return slot_count * kSlotIndexCount + kFirstSlotIndex;
+  static int SizeFor(int slot_count) {
+    return OBJECT_POINTER_ALIGN(kHeaderSize + slot_count * Slot::kSize);
   }
 
-  DECL_CAST(CoverageInfo)
-
   // Print debug info.
-  void Print(std::unique_ptr<char[]> function_name);
+  void CoverageInfoPrint(std::ostream& os,
+                         std::unique_ptr<char[]> function_name = nullptr);
 
-  static const int kFirstSlotIndex = 0;
+  class BodyDescriptor;  // GC visitor.
 
-  // Each slot is assigned a group of indices starting at kFirstSlotIndex.
+  // Description of layout within each slot.
-  // Within this group, semantics are as follows:
+  using Slot = TorqueGeneratedCoverageInfoSlotOffsets;
-  static const int kSlotStartSourcePositionIndex = 0;
-  static const int kSlotEndSourcePositionIndex = 1;
-  static const int kSlotBlockCountIndex = 2;
-  static const int kSlotPaddingIndex = 3;  // Padding to make the index count 4.
-  static const int kSlotIndexCount = 4;
-
-  static const int kSlotIndexCountLog2 = 2;
-  static const int kSlotIndexCountMask = (kSlotIndexCount - 1);
-  STATIC_ASSERT(1 << kSlotIndexCountLog2 == kSlotIndexCount);
 
  private:
-  static int FirstIndexForSlot(int slot_index) {
+  int SlotFieldOffset(int slot_index, int field_offset) const;
-    return kFirstSlotIndex + slot_index * kSlotIndexCount;
-  }
 
-  OBJECT_CONSTRUCTORS(CoverageInfo, FixedArray);
+  TQ_OBJECT_CONSTRUCTORS(CoverageInfo)
 };
 
 // Holds breakpoint related information. This object is used by inspector.

src/objects/debug-objects.tq

@@ -18,8 +18,6 @@ extern class BreakPointInfo extends Struct {
   break_points: FixedArray|BreakPoint|Undefined;
 }
 
-type CoverageInfo extends FixedArray;
-
 bitfield struct DebugInfoFlags extends uint31 {
   has_break_info: bool: 1 bit;
   prepared_for_debug_execution: bool: 1 bit;
@@ -46,3 +44,19 @@ extern class DebugInfo extends Struct {
   flags: SmiTagged<DebugInfoFlags>;
   coverage_info: CoverageInfo|Undefined;
 }
+
+@export
+struct CoverageInfoSlot {
+  start_source_position: int32;
+  end_source_position: int32;
+  block_count: int32;
+  padding: int32;  // Padding to make the index count 4.
+}
+
+// CoverageInfo's visitor is included in DATA_ONLY_VISITOR_ID_LIST, so it must
+// not contain any HeapObject fields.
+@generateCppClass
+extern class CoverageInfo extends HeapObject {
+  slot_count: int32;
+  slots[slot_count]: CoverageInfoSlot;
+}

src/objects/instance-type.h

@@ -214,7 +214,6 @@ V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream& os,
   TORQUE_INSTANCE_CHECKERS_SINGLE_FULLY_DEFINED(V) \
   TORQUE_INSTANCE_CHECKERS_SINGLE_ONLY_DECLARED(V) \
   V(BigInt, BIGINT_TYPE)                           \
-  V(CoverageInfo, FIXED_ARRAY_TYPE)                \
   V(FixedArrayExact, FIXED_ARRAY_TYPE)
 
 #define INSTANCE_TYPE_CHECKERS_RANGE(V)           \

src/objects/map.cc

@@ -260,6 +260,9 @@ VisitorId Map::GetVisitorId(Map map) {
     case UNCOMPILED_DATA_WITH_PREPARSE_DATA_TYPE:
       return kVisitUncompiledDataWithPreparseData;
 
+    case COVERAGE_INFO_TYPE:
+      return kVisitCoverageInfo;
+
     case JS_OBJECT_TYPE:
     case JS_ERROR_TYPE:
     case JS_ARGUMENTS_OBJECT_TYPE:

src/objects/map.h

@@ -25,6 +25,7 @@ enum InstanceType : uint16_t;
 #define DATA_ONLY_VISITOR_ID_LIST(V) \
   V(BigInt)                          \
   V(ByteArray)                       \
+  V(CoverageInfo)                    \
   V(DataObject)                      \
   V(FeedbackMetadata)                \
   V(FixedDoubleArray)                \

src/objects/objects-body-descriptors-inl.h

@@ -423,7 +423,7 @@ class V8_EXPORT_PRIVATE SmallOrderedHashTable<Derived>::BodyDescriptor final
 
   static inline int SizeOf(Map map, HeapObject obj) {
     Derived table = Derived::cast(obj);
-    return table.SizeFor(table.Capacity());
+    return Derived::SizeFor(table.Capacity());
   }
 };
 
@@ -621,6 +621,20 @@ class ExternalTwoByteString::BodyDescriptor final : public BodyDescriptorBase {
   static inline int SizeOf(Map map, HeapObject object) { return kSize; }
 };
 
+class CoverageInfo::BodyDescriptor final : public BodyDescriptorBase {
+ public:
+  static bool IsValidSlot(Map map, HeapObject obj, int offset) { return false; }
+
+  template <typename ObjectVisitor>
+  static inline void IterateBody(Map map, HeapObject obj, int object_size,
+                                 ObjectVisitor* v) {}
+
+  static inline int SizeOf(Map map, HeapObject object) {
+    CoverageInfo info = CoverageInfo::cast(object);
+    return CoverageInfo::SizeFor(info.slot_count());
+  }
+};
+
 class Code::BodyDescriptor final : public BodyDescriptorBase {
  public:
   STATIC_ASSERT(kRelocationInfoOffset + kTaggedSize ==
@@ -677,7 +691,7 @@ class SeqOneByteString::BodyDescriptor final : public BodyDescriptorBase {
 
   static inline int SizeOf(Map map, HeapObject obj) {
     SeqOneByteString string = SeqOneByteString::cast(obj);
-    return string.SizeFor(string.synchronized_length());
+    return SeqOneByteString::SizeFor(string.synchronized_length());
   }
 };
 
@@ -691,7 +705,7 @@ class SeqTwoByteString::BodyDescriptor final : public BodyDescriptorBase {
 
   static inline int SizeOf(Map map, HeapObject obj) {
     SeqTwoByteString string = SeqTwoByteString::cast(obj);
-    return string.SizeFor(string.synchronized_length());
+    return SeqTwoByteString::SizeFor(string.synchronized_length());
   }
 };
 
@@ -933,6 +947,8 @@ ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3, T4 p4) {
       return Op::template apply<FeedbackCell::BodyDescriptor>(p1, p2, p3, p4);
     case FEEDBACK_VECTOR_TYPE:
       return Op::template apply<FeedbackVector::BodyDescriptor>(p1, p2, p3, p4);
+    case COVERAGE_INFO_TYPE:
+      return Op::template apply<CoverageInfo::BodyDescriptor>(p1, p2, p3, p4);
     case JS_OBJECT_TYPE:
     case JS_ERROR_TYPE:
     case JS_ARGUMENTS_OBJECT_TYPE:

src/objects/objects.cc

@@ -2275,6 +2275,10 @@ int HeapObject::SizeFromMap(Map map) const {
   if (instance_type == CODE_TYPE) {
     return Code::unchecked_cast(*this).CodeSize();
   }
+  if (instance_type == COVERAGE_INFO_TYPE) {
+    return CoverageInfo::SizeFor(
+        CoverageInfo::unchecked_cast(*this).slot_count());
+  }
   DCHECK_EQ(instance_type, EMBEDDER_DATA_ARRAY_TYPE);
   return EmbedderDataArray::SizeFor(
       EmbedderDataArray::unchecked_cast(*this).length());

src/roots/roots.h

@@ -84,6 +84,7 @@ class Symbol;
   V(Map, object_boilerplate_description_map, ObjectBoilerplateDescriptionMap)  \
   V(Map, bytecode_array_map, BytecodeArrayMap)                                 \
   V(Map, code_data_container_map, CodeDataContainerMap)                        \
+  V(Map, coverage_info_map, CoverageInfoMap)                                   \
   V(Map, descriptor_array_map, DescriptorArrayMap)                             \
   V(Map, fixed_double_array_map, FixedDoubleArrayMap)                          \
   V(Map, global_dictionary_map, GlobalDictionaryMap)                           \

src/torque/implementation-visitor.cc

@@ -3104,14 +3104,29 @@ class FieldOffsetsGenerator {
 
  private:
   FieldSectionType GetSectionFor(const Field& f) {
-    if (f.name_and_type.type == TypeOracle::GetVoidType()) {
+    const Type* field_type = f.name_and_type.type;
+    if (field_type == TypeOracle::GetVoidType()) {
       // Allow void type for marker constants of size zero.
       return current_section_;
     }
+    StructType::Classification struct_contents =
+        StructType::ClassificationFlag::kEmpty;
+    if (const StructType* field_as_struct =
+            StructType::DynamicCast(field_type)) {
+      struct_contents = field_as_struct->ClassifyContents();
+    }
+    if (struct_contents == StructType::ClassificationFlag::kMixed) {
+      // We can't declare what section a struct goes in if it has multiple
+      // categories of data within.
+      Error(
+          "Classes do not support fields which are structs containing both "
+          "tagged and untagged data.")
+          .Position(f.pos);
+    }
     // Currently struct-valued fields are only allowed to have tagged data; see
     // TypeVisitor::VisitClassFieldsAndMethods.
-    if (f.name_and_type.type->IsSubtypeOf(TypeOracle::GetTaggedType()) ||
+    if (field_type->IsSubtypeOf(TypeOracle::GetTaggedType()) ||
-        f.name_and_type.type->IsStructType()) {
+        struct_contents == StructType::ClassificationFlag::kTagged) {
       if (f.is_weak) {
         return FieldSectionType::kWeakSection;
       } else {
@@ -3568,6 +3583,19 @@ void CppClassGenerator::GenerateFieldAccessorForObject(const Field& f) {
   inl_ << "}\n\n";
 }
 
+void GenerateStructLayoutDescription(std::ostream& header,
+                                     const StructType* type) {
+  header << "struct TorqueGenerated" << CamelifyString(type->name())
+         << "Offsets {\n";
+  for (const Field& field : type->fields()) {
+    header << "  static constexpr int k"
+           << CamelifyString(field.name_and_type.name)
+           << "Offset = " << *field.offset << ";\n";
+  }
+  header << "  static constexpr int kSize = " << type->PackedSize() << ";\n";
+  header << "};\n\n";
+}
+
 }  // namespace
 
 void ImplementationVisitor::GenerateClassDefinitions(
@@ -3631,12 +3659,27 @@ void ImplementationVisitor::GenerateClassDefinitions(
       header << "class " << type->GetGeneratedTNodeTypeName() << ";\n";
     }
 
+    std::unordered_set<const StructType*> structs_used_in_classes;
+
     for (const TypeAlias* alias : GlobalContext::GetClasses()) {
       const ClassType* type = ClassType::DynamicCast(alias->type());
       if (type->GenerateCppClassDefinitions()) {
         CppClassGenerator g(type, header, inline_header, implementation);
         g.GenerateClass();
       }
+      for (const Field& f : type->fields()) {
+        const Type* field_type = f.name_and_type.type;
+        if (const StructType* field_as_struct =
+                StructType::DynamicCast(field_type)) {
+          structs_used_in_classes.insert(field_as_struct);
+        }
+      }
+    }
+
+    for (const StructType* type : structs_used_in_classes) {
+      if (type != TypeOracle::GetFloat64OrHoleType()) {
+        GenerateStructLayoutDescription(header, type);
+      }
     }
   }
   WriteFile(file_basename + ".h", header.str());
@@ -3826,9 +3869,11 @@ void GenerateClassFieldVerifier(const std::string& class_name,
 
   if (const StructType* struct_type = StructType::DynamicCast(field_type)) {
     for (const Field& field : struct_type->fields()) {
-      GenerateFieldValueVerifier(class_name, f, field, *field.offset,
+      if (field_type->IsSubtypeOf(TypeOracle::GetTaggedType())) {
-                                 std::to_string(struct_type->PackedSize()),
+        GenerateFieldValueVerifier(class_name, f, field, *field.offset,
-                                 cc_contents);
+                                   std::to_string(struct_type->PackedSize()),
+                                   cc_contents);
+      }
     }
   } else {
     GenerateFieldValueVerifier(class_name, f, f, 0, "kTaggedSize", cc_contents);

src/torque/type-visitor.cc

@@ -417,22 +417,6 @@ void TypeVisitor::VisitClassFieldsAndMethods(
         ReportError("non-extern classes do not support weak fields");
       }
     }
-    const StructType* struct_type = StructType::DynamicCast(field_type);
-    if (struct_type && struct_type != TypeOracle::GetFloat64OrHoleType()) {
-      for (const Field& struct_field : struct_type->fields()) {
-        if (!struct_field.name_and_type.type->IsSubtypeOf(
-                TypeOracle::GetTaggedType())) {
-          // If we ever actually need different sizes of struct fields, then we
-          // can define the packing and alignment rules. Until then, let's keep
-          // it simple. This restriction also helps keep the tagged and untagged
-          // regions separate in the class layout (see also
-          // FieldOffsetsGenerator::GetSectionFor).
-          Error(
-              "Classes do not support fields which are structs containing "
-              "untagged data.");
-        }
-      }
-    }
     base::Optional<Expression*> array_length = field_expression.index;
     const Field& field = class_type->RegisterField(
         {field_expression.name_and_type.name->pos,
@@ -445,6 +429,12 @@ void TypeVisitor::VisitClassFieldsAndMethods(
          field_expression.generate_verify});
     ResidueClass field_size = std::get<0>(field.GetFieldSizeInformation());
     if (field.index) {
+      // Validate that a value at any index in a packed array is aligned
+      // correctly, since it is possible to define a struct whose size is not a
+      // multiple of its alignment.
+      field.ValidateAlignment(class_offset +
+                              field_size * ResidueClass::Unknown());
+
       if (auto literal = NumberLiteralExpression::DynamicCast(*field.index)) {
         size_t value = static_cast<size_t>(literal->number);
         if (value != literal->number) {

src/torque/types.cc

@@ -371,6 +371,22 @@ size_t StructType::PackedSize() const {
   return result;
 }
 
+StructType::Classification StructType::ClassifyContents() const {
+  Classification result = ClassificationFlag::kEmpty;
+  for (const Field& struct_field : fields()) {
+    const Type* field_type = struct_field.name_and_type.type;
+    if (field_type->IsSubtypeOf(TypeOracle::GetTaggedType())) {
+      result |= ClassificationFlag::kTagged;
+    } else if (const StructType* field_as_struct =
+                   StructType::DynamicCast(field_type)) {
+      result |= field_as_struct->ClassifyContents();
+    } else {
+      result |= ClassificationFlag::kUntagged;
+    }
+  }
+  return result;
+}
+
 // static
 std::string Type::ComputeName(const std::string& basename,
                               MaybeSpecializationKey specialized_from) {

src/torque/types.h

@@ -575,6 +575,17 @@ class StructType final : public AggregateType {
 
   size_t AlignmentLog2() const override;
 
+  enum class ClassificationFlag {
+    kEmpty = 0,
+    kTagged = 1 << 0,
+    kUntagged = 1 << 1,
+    kMixed = kTagged | kUntagged,
+  };
+  using Classification = base::Flags<ClassificationFlag>;
+
+  // Classifies a struct as containing tagged data, untagged data, or both.
+  Classification ClassifyContents() const;
+
  private:
   friend class TypeOracle;
   StructType(Namespace* nspace, const StructDeclaration* decl,

tools/v8heapconst.py

@@ -119,24 +119,25 @@ INSTANCE_TYPES = {
   155: "CELL_TYPE",
   156: "CODE_TYPE",
   157: "CODE_DATA_CONTAINER_TYPE",
-  158: "DESCRIPTOR_ARRAY_TYPE",
+  158: "COVERAGE_INFO_TYPE",
-  159: "EMBEDDER_DATA_ARRAY_TYPE",
+  159: "DESCRIPTOR_ARRAY_TYPE",
-  160: "FEEDBACK_METADATA_TYPE",
+  160: "EMBEDDER_DATA_ARRAY_TYPE",
-  161: "FEEDBACK_VECTOR_TYPE",
+  161: "FEEDBACK_METADATA_TYPE",
-  162: "FILLER_TYPE",
+  162: "FEEDBACK_VECTOR_TYPE",
-  163: "FREE_SPACE_TYPE",
+  163: "FILLER_TYPE",
-  164: "MAP_TYPE",
+  164: "FREE_SPACE_TYPE",
-  165: "PREPARSE_DATA_TYPE",
+  165: "MAP_TYPE",
-  166: "PROPERTY_ARRAY_TYPE",
+  166: "PREPARSE_DATA_TYPE",
-  167: "PROPERTY_CELL_TYPE",
+  167: "PROPERTY_ARRAY_TYPE",
-  168: "SHARED_FUNCTION_INFO_TYPE",
+  168: "PROPERTY_CELL_TYPE",
-  169: "WEAK_ARRAY_LIST_TYPE",
+  169: "SHARED_FUNCTION_INFO_TYPE",
-  170: "WEAK_CELL_TYPE",
+  170: "WEAK_ARRAY_LIST_TYPE",
-  171: "JS_PROXY_TYPE",
+  171: "WEAK_CELL_TYPE",
+  172: "JS_PROXY_TYPE",
   1057: "JS_OBJECT_TYPE",
-  172: "JS_GLOBAL_OBJECT_TYPE",
+  173: "JS_GLOBAL_OBJECT_TYPE",
-  173: "JS_GLOBAL_PROXY_TYPE",
+  174: "JS_GLOBAL_PROXY_TYPE",
-  174: "JS_MODULE_NAMESPACE_TYPE",
+  175: "JS_MODULE_NAMESPACE_TYPE",
   1040: "JS_SPECIAL_API_OBJECT_TYPE",
   1041: "JS_PRIMITIVE_WRAPPER_TYPE",
   1042: "JS_MAP_KEY_ITERATOR_TYPE",
@@ -193,13 +194,13 @@ INSTANCE_TYPES = {
 
 # List of known V8 maps.
 KNOWN_MAPS = {
-  ("read_only_space", 0x00121): (163, "FreeSpaceMap"),
+  ("read_only_space", 0x00121): (164, "FreeSpaceMap"),
-  ("read_only_space", 0x00149): (164, "MetaMap"),
+  ("read_only_space", 0x00149): (165, "MetaMap"),
   ("read_only_space", 0x0018d): (67, "NullMap"),
-  ("read_only_space", 0x001c5): (158, "DescriptorArrayMap"),
+  ("read_only_space", 0x001c5): (159, "DescriptorArrayMap"),
   ("read_only_space", 0x001f5): (153, "WeakFixedArrayMap"),
-  ("read_only_space", 0x0021d): (162, "OnePointerFillerMap"),
+  ("read_only_space", 0x0021d): (163, "OnePointerFillerMap"),
-  ("read_only_space", 0x00245): (162, "TwoPointerFillerMap"),
+  ("read_only_space", 0x00245): (163, "TwoPointerFillerMap"),
   ("read_only_space", 0x00289): (67, "UninitializedMap"),
   ("read_only_space", 0x002cd): (8, "OneByteInternalizedStringMap"),
   ("read_only_space", 0x00329): (67, "UndefinedMap"),
@@ -213,14 +214,14 @@ KNOWN_MAPS = {
   ("read_only_space", 0x00529): (64, "SymbolMap"),
   ("read_only_space", 0x00551): (40, "OneByteStringMap"),
   ("read_only_space", 0x00579): (133, "ScopeInfoMap"),
-  ("read_only_space", 0x005a1): (168, "SharedFunctionInfoMap"),
+  ("read_only_space", 0x005a1): (169, "SharedFunctionInfoMap"),
   ("read_only_space", 0x005c9): (156, "CodeMap"),
   ("read_only_space", 0x005f1): (155, "CellMap"),
-  ("read_only_space", 0x00619): (167, "GlobalPropertyCellMap"),
+  ("read_only_space", 0x00619): (168, "GlobalPropertyCellMap"),
   ("read_only_space", 0x00641): (70, "ForeignMap"),
   ("read_only_space", 0x00669): (154, "TransitionArrayMap"),
   ("read_only_space", 0x00691): (45, "ThinOneByteStringMap"),
-  ("read_only_space", 0x006b9): (161, "FeedbackVectorMap"),
+  ("read_only_space", 0x006b9): (162, "FeedbackVectorMap"),
   ("read_only_space", 0x0070d): (67, "ArgumentsMarkerMap"),
   ("read_only_space", 0x0076d): (67, "ExceptionMap"),
   ("read_only_space", 0x007c9): (67, "TerminationExceptionMap"),
@@ -228,111 +229,112 @@ KNOWN_MAPS = {
   ("read_only_space", 0x00891): (67, "StaleRegisterMap"),
   ("read_only_space", 0x008d5): (134, "ScriptContextTableMap"),
   ("read_only_space", 0x008fd): (131, "ClosureFeedbackCellArrayMap"),
-  ("read_only_space", 0x00925): (160, "FeedbackMetadataArrayMap"),
+  ("read_only_space", 0x00925): (161, "FeedbackMetadataArrayMap"),
   ("read_only_space", 0x0094d): (120, "ArrayListMap"),
   ("read_only_space", 0x00975): (65, "BigIntMap"),
   ("read_only_space", 0x0099d): (132, "ObjectBoilerplateDescriptionMap"),
   ("read_only_space", 0x009c5): (136, "BytecodeArrayMap"),
   ("read_only_space", 0x009ed): (157, "CodeDataContainerMap"),
-  ("read_only_space", 0x00a15): (137, "FixedDoubleArrayMap"),
+  ("read_only_space", 0x00a15): (158, "CoverageInfoMap"),
-  ("read_only_space", 0x00a3d): (123, "GlobalDictionaryMap"),
+  ("read_only_space", 0x00a3d): (137, "FixedDoubleArrayMap"),
-  ("read_only_space", 0x00a65): (96, "ManyClosuresCellMap"),
+  ("read_only_space", 0x00a65): (123, "GlobalDictionaryMap"),
-  ("read_only_space", 0x00a8d): (120, "ModuleInfoMap"),
+  ("read_only_space", 0x00a8d): (96, "ManyClosuresCellMap"),
-  ("read_only_space", 0x00ab5): (124, "NameDictionaryMap"),
+  ("read_only_space", 0x00ab5): (120, "ModuleInfoMap"),
-  ("read_only_space", 0x00add): (96, "NoClosuresCellMap"),
+  ("read_only_space", 0x00add): (124, "NameDictionaryMap"),
-  ("read_only_space", 0x00b05): (125, "NumberDictionaryMap"),
+  ("read_only_space", 0x00b05): (96, "NoClosuresCellMap"),
-  ("read_only_space", 0x00b2d): (96, "OneClosureCellMap"),
+  ("read_only_space", 0x00b2d): (125, "NumberDictionaryMap"),
-  ("read_only_space", 0x00b55): (126, "OrderedHashMapMap"),
+  ("read_only_space", 0x00b55): (96, "OneClosureCellMap"),
-  ("read_only_space", 0x00b7d): (127, "OrderedHashSetMap"),
+  ("read_only_space", 0x00b7d): (126, "OrderedHashMapMap"),
-  ("read_only_space", 0x00ba5): (128, "OrderedNameDictionaryMap"),
+  ("read_only_space", 0x00ba5): (127, "OrderedHashSetMap"),
-  ("read_only_space", 0x00bcd): (165, "PreparseDataMap"),
+  ("read_only_space", 0x00bcd): (128, "OrderedNameDictionaryMap"),
-  ("read_only_space", 0x00bf5): (166, "PropertyArrayMap"),
+  ("read_only_space", 0x00bf5): (166, "PreparseDataMap"),
-  ("read_only_space", 0x00c1d): (92, "SideEffectCallHandlerInfoMap"),
+  ("read_only_space", 0x00c1d): (167, "PropertyArrayMap"),
-  ("read_only_space", 0x00c45): (92, "SideEffectFreeCallHandlerInfoMap"),
+  ("read_only_space", 0x00c45): (92, "SideEffectCallHandlerInfoMap"),
-  ("read_only_space", 0x00c6d): (92, "NextCallSideEffectFreeCallHandlerInfoMap"),
+  ("read_only_space", 0x00c6d): (92, "SideEffectFreeCallHandlerInfoMap"),
-  ("read_only_space", 0x00c95): (129, "SimpleNumberDictionaryMap"),
+  ("read_only_space", 0x00c95): (92, "NextCallSideEffectFreeCallHandlerInfoMap"),
-  ("read_only_space", 0x00cbd): (120, "SloppyArgumentsElementsMap"),
+  ("read_only_space", 0x00cbd): (129, "SimpleNumberDictionaryMap"),
-  ("read_only_space", 0x00ce5): (148, "SmallOrderedHashMapMap"),
+  ("read_only_space", 0x00ce5): (120, "SloppyArgumentsElementsMap"),
-  ("read_only_space", 0x00d0d): (149, "SmallOrderedHashSetMap"),
+  ("read_only_space", 0x00d0d): (148, "SmallOrderedHashMapMap"),
-  ("read_only_space", 0x00d35): (150, "SmallOrderedNameDictionaryMap"),
+  ("read_only_space", 0x00d35): (149, "SmallOrderedHashSetMap"),
-  ("read_only_space", 0x00d5d): (68, "SourceTextModuleMap"),
+  ("read_only_space", 0x00d5d): (150, "SmallOrderedNameDictionaryMap"),
-  ("read_only_space", 0x00d85): (130, "StringTableMap"),
+  ("read_only_space", 0x00d85): (68, "SourceTextModuleMap"),
-  ("read_only_space", 0x00dad): (69, "SyntheticModuleMap"),
+  ("read_only_space", 0x00dad): (130, "StringTableMap"),
-  ("read_only_space", 0x00dd5): (152, "UncompiledDataWithoutPreparseDataMap"),
+  ("read_only_space", 0x00dd5): (69, "SyntheticModuleMap"),
-  ("read_only_space", 0x00dfd): (151, "UncompiledDataWithPreparseDataMap"),
+  ("read_only_space", 0x00dfd): (152, "UncompiledDataWithoutPreparseDataMap"),
-  ("read_only_space", 0x00e25): (169, "WeakArrayListMap"),
+  ("read_only_space", 0x00e25): (151, "UncompiledDataWithPreparseDataMap"),
-  ("read_only_space", 0x00e4d): (122, "EphemeronHashTableMap"),
+  ("read_only_space", 0x00e4d): (170, "WeakArrayListMap"),
-  ("read_only_space", 0x00e75): (159, "EmbedderDataArrayMap"),
+  ("read_only_space", 0x00e75): (122, "EphemeronHashTableMap"),
-  ("read_only_space", 0x00e9d): (170, "WeakCellMap"),
+  ("read_only_space", 0x00e9d): (160, "EmbedderDataArrayMap"),
-  ("read_only_space", 0x00ec5): (32, "StringMap"),
+  ("read_only_space", 0x00ec5): (171, "WeakCellMap"),
-  ("read_only_space", 0x00eed): (41, "ConsOneByteStringMap"),
+  ("read_only_space", 0x00eed): (32, "StringMap"),
-  ("read_only_space", 0x00f15): (33, "ConsStringMap"),
+  ("read_only_space", 0x00f15): (41, "ConsOneByteStringMap"),
-  ("read_only_space", 0x00f3d): (37, "ThinStringMap"),
+  ("read_only_space", 0x00f3d): (33, "ConsStringMap"),
-  ("read_only_space", 0x00f65): (35, "SlicedStringMap"),
+  ("read_only_space", 0x00f65): (37, "ThinStringMap"),
-  ("read_only_space", 0x00f8d): (43, "SlicedOneByteStringMap"),
+  ("read_only_space", 0x00f8d): (35, "SlicedStringMap"),
-  ("read_only_space", 0x00fb5): (34, "ExternalStringMap"),
+  ("read_only_space", 0x00fb5): (43, "SlicedOneByteStringMap"),
-  ("read_only_space", 0x00fdd): (42, "ExternalOneByteStringMap"),
+  ("read_only_space", 0x00fdd): (34, "ExternalStringMap"),
-  ("read_only_space", 0x01005): (50, "UncachedExternalStringMap"),
+  ("read_only_space", 0x01005): (42, "ExternalOneByteStringMap"),
-  ("read_only_space", 0x0102d): (0, "InternalizedStringMap"),
+  ("read_only_space", 0x0102d): (50, "UncachedExternalStringMap"),
-  ("read_only_space", 0x01055): (2, "ExternalInternalizedStringMap"),
+  ("read_only_space", 0x01055): (0, "InternalizedStringMap"),
-  ("read_only_space", 0x0107d): (10, "ExternalOneByteInternalizedStringMap"),
+  ("read_only_space", 0x0107d): (2, "ExternalInternalizedStringMap"),
-  ("read_only_space", 0x010a5): (18, "UncachedExternalInternalizedStringMap"),
+  ("read_only_space", 0x010a5): (10, "ExternalOneByteInternalizedStringMap"),
-  ("read_only_space", 0x010cd): (26, "UncachedExternalOneByteInternalizedStringMap"),
+  ("read_only_space", 0x010cd): (18, "UncachedExternalInternalizedStringMap"),
-  ("read_only_space", 0x010f5): (58, "UncachedExternalOneByteStringMap"),
+  ("read_only_space", 0x010f5): (26, "UncachedExternalOneByteInternalizedStringMap"),
-  ("read_only_space", 0x0111d): (67, "SelfReferenceMarkerMap"),
+  ("read_only_space", 0x0111d): (58, "UncachedExternalOneByteStringMap"),
-  ("read_only_space", 0x01151): (95, "EnumCacheMap"),
+  ("read_only_space", 0x01145): (67, "SelfReferenceMarkerMap"),
-  ("read_only_space", 0x011a1): (86, "ArrayBoilerplateDescriptionMap"),
+  ("read_only_space", 0x01179): (95, "EnumCacheMap"),
-  ("read_only_space", 0x0129d): (98, "InterceptorInfoMap"),
+  ("read_only_space", 0x011c9): (86, "ArrayBoilerplateDescriptionMap"),
-  ("read_only_space", 0x032ad): (71, "PromiseFulfillReactionJobTaskMap"),
+  ("read_only_space", 0x012c5): (98, "InterceptorInfoMap"),
-  ("read_only_space", 0x032d5): (72, "PromiseRejectReactionJobTaskMap"),
+  ("read_only_space", 0x032d5): (71, "PromiseFulfillReactionJobTaskMap"),
-  ("read_only_space", 0x032fd): (73, "CallableTaskMap"),
+  ("read_only_space", 0x032fd): (72, "PromiseRejectReactionJobTaskMap"),
-  ("read_only_space", 0x03325): (74, "CallbackTaskMap"),
+  ("read_only_space", 0x03325): (73, "CallableTaskMap"),
-  ("read_only_space", 0x0334d): (75, "PromiseResolveThenableJobTaskMap"),
+  ("read_only_space", 0x0334d): (74, "CallbackTaskMap"),
-  ("read_only_space", 0x03375): (78, "FunctionTemplateInfoMap"),
+  ("read_only_space", 0x03375): (75, "PromiseResolveThenableJobTaskMap"),
-  ("read_only_space", 0x0339d): (79, "ObjectTemplateInfoMap"),
+  ("read_only_space", 0x0339d): (78, "FunctionTemplateInfoMap"),
-  ("read_only_space", 0x033c5): (80, "AccessCheckInfoMap"),
+  ("read_only_space", 0x033c5): (79, "ObjectTemplateInfoMap"),
-  ("read_only_space", 0x033ed): (81, "AccessorInfoMap"),
+  ("read_only_space", 0x033ed): (80, "AccessCheckInfoMap"),
-  ("read_only_space", 0x03415): (82, "AccessorPairMap"),
+  ("read_only_space", 0x03415): (81, "AccessorInfoMap"),
-  ("read_only_space", 0x0343d): (83, "AliasedArgumentsEntryMap"),
+  ("read_only_space", 0x0343d): (82, "AccessorPairMap"),
-  ("read_only_space", 0x03465): (84, "AllocationMementoMap"),
+  ("read_only_space", 0x03465): (83, "AliasedArgumentsEntryMap"),
-  ("read_only_space", 0x0348d): (87, "AsmWasmDataMap"),
+  ("read_only_space", 0x0348d): (84, "AllocationMementoMap"),
-  ("read_only_space", 0x034b5): (88, "AsyncGeneratorRequestMap"),
+  ("read_only_space", 0x034b5): (87, "AsmWasmDataMap"),
-  ("read_only_space", 0x034dd): (89, "BreakPointMap"),
+  ("read_only_space", 0x034dd): (88, "AsyncGeneratorRequestMap"),
-  ("read_only_space", 0x03505): (90, "BreakPointInfoMap"),
+  ("read_only_space", 0x03505): (89, "BreakPointMap"),
-  ("read_only_space", 0x0352d): (91, "CachedTemplateObjectMap"),
+  ("read_only_space", 0x0352d): (90, "BreakPointInfoMap"),
-  ("read_only_space", 0x03555): (93, "ClassPositionsMap"),
+  ("read_only_space", 0x03555): (91, "CachedTemplateObjectMap"),
-  ("read_only_space", 0x0357d): (94, "DebugInfoMap"),
+  ("read_only_space", 0x0357d): (93, "ClassPositionsMap"),
-  ("read_only_space", 0x035a5): (97, "FunctionTemplateRareDataMap"),
+  ("read_only_space", 0x035a5): (94, "DebugInfoMap"),
-  ("read_only_space", 0x035cd): (100, "InterpreterDataMap"),
+  ("read_only_space", 0x035cd): (97, "FunctionTemplateRareDataMap"),
-  ("read_only_space", 0x035f5): (101, "PromiseCapabilityMap"),
+  ("read_only_space", 0x035f5): (100, "InterpreterDataMap"),
-  ("read_only_space", 0x0361d): (102, "PromiseReactionMap"),
+  ("read_only_space", 0x0361d): (101, "PromiseCapabilityMap"),
-  ("read_only_space", 0x03645): (103, "PropertyDescriptorObjectMap"),
+  ("read_only_space", 0x03645): (102, "PromiseReactionMap"),
-  ("read_only_space", 0x0366d): (104, "PrototypeInfoMap"),
+  ("read_only_space", 0x0366d): (103, "PropertyDescriptorObjectMap"),
-  ("read_only_space", 0x03695): (105, "ScriptMap"),
+  ("read_only_space", 0x03695): (104, "PrototypeInfoMap"),
-  ("read_only_space", 0x036bd): (109, "SourceTextModuleInfoEntryMap"),
+  ("read_only_space", 0x036bd): (105, "ScriptMap"),
-  ("read_only_space", 0x036e5): (110, "StackFrameInfoMap"),
+  ("read_only_space", 0x036e5): (109, "SourceTextModuleInfoEntryMap"),
-  ("read_only_space", 0x0370d): (111, "StackTraceFrameMap"),
+  ("read_only_space", 0x0370d): (110, "StackFrameInfoMap"),
-  ("read_only_space", 0x03735): (112, "TemplateObjectDescriptionMap"),
+  ("read_only_space", 0x03735): (111, "StackTraceFrameMap"),
-  ("read_only_space", 0x0375d): (113, "Tuple2Map"),
+  ("read_only_space", 0x0375d): (112, "TemplateObjectDescriptionMap"),
-  ("read_only_space", 0x03785): (114, "WasmCapiFunctionDataMap"),
+  ("read_only_space", 0x03785): (113, "Tuple2Map"),
-  ("read_only_space", 0x037ad): (115, "WasmDebugInfoMap"),
+  ("read_only_space", 0x037ad): (114, "WasmCapiFunctionDataMap"),
-  ("read_only_space", 0x037d5): (116, "WasmExceptionTagMap"),
+  ("read_only_space", 0x037d5): (115, "WasmDebugInfoMap"),
-  ("read_only_space", 0x037fd): (117, "WasmExportedFunctionDataMap"),
+  ("read_only_space", 0x037fd): (116, "WasmExceptionTagMap"),
-  ("read_only_space", 0x03825): (118, "WasmIndirectFunctionTableMap"),
+  ("read_only_space", 0x03825): (117, "WasmExportedFunctionDataMap"),
-  ("read_only_space", 0x0384d): (119, "WasmJSFunctionDataMap"),
+  ("read_only_space", 0x0384d): (118, "WasmIndirectFunctionTableMap"),
-  ("read_only_space", 0x03875): (99, "InternalClassMap"),
+  ("read_only_space", 0x03875): (119, "WasmJSFunctionDataMap"),
-  ("read_only_space", 0x0389d): (107, "SmiPairMap"),
+  ("read_only_space", 0x0389d): (99, "InternalClassMap"),
-  ("read_only_space", 0x038c5): (106, "SmiBoxMap"),
+  ("read_only_space", 0x038c5): (107, "SmiPairMap"),
-  ("read_only_space", 0x038ed): (108, "SortStateMap"),
+  ("read_only_space", 0x038ed): (106, "SmiBoxMap"),
-  ("read_only_space", 0x03915): (85, "AllocationSiteWithWeakNextMap"),
+  ("read_only_space", 0x03915): (108, "SortStateMap"),
-  ("read_only_space", 0x0393d): (85, "AllocationSiteWithoutWeakNextMap"),
+  ("read_only_space", 0x0393d): (85, "AllocationSiteWithWeakNextMap"),
-  ("read_only_space", 0x03965): (76, "LoadHandler1Map"),
+  ("read_only_space", 0x03965): (85, "AllocationSiteWithoutWeakNextMap"),
-  ("read_only_space", 0x0398d): (76, "LoadHandler2Map"),
+  ("read_only_space", 0x0398d): (76, "LoadHandler1Map"),
-  ("read_only_space", 0x039b5): (76, "LoadHandler3Map"),
+  ("read_only_space", 0x039b5): (76, "LoadHandler2Map"),
-  ("read_only_space", 0x039dd): (77, "StoreHandler0Map"),
+  ("read_only_space", 0x039dd): (76, "LoadHandler3Map"),
-  ("read_only_space", 0x03a05): (77, "StoreHandler1Map"),
+  ("read_only_space", 0x03a05): (77, "StoreHandler0Map"),
-  ("read_only_space", 0x03a2d): (77, "StoreHandler2Map"),
+  ("read_only_space", 0x03a2d): (77, "StoreHandler1Map"),
-  ("read_only_space", 0x03a55): (77, "StoreHandler3Map"),
+  ("read_only_space", 0x03a55): (77, "StoreHandler2Map"),
+  ("read_only_space", 0x03a7d): (77, "StoreHandler3Map"),
   ("map_space", 0x00121): (1057, "ExternalMap"),
   ("map_space", 0x00149): (1073, "JSMessageObjectMap"),
 }
@@ -357,32 +359,32 @@ KNOWN_OBJECTS = {
   ("read_only_space", 0x007ad): "TerminationException",
   ("read_only_space", 0x00815): "OptimizedOut",
   ("read_only_space", 0x00875): "StaleRegister",
-  ("read_only_space", 0x01145): "EmptyEnumCache",
+  ("read_only_space", 0x0116d): "EmptyEnumCache",
-  ("read_only_space", 0x01179): "EmptyPropertyArray",
+  ("read_only_space", 0x011a1): "EmptyPropertyArray",
-  ("read_only_space", 0x01181): "EmptyByteArray",
+  ("read_only_space", 0x011a9): "EmptyByteArray",
-  ("read_only_space", 0x01189): "EmptyObjectBoilerplateDescription",
+  ("read_only_space", 0x011b1): "EmptyObjectBoilerplateDescription",
-  ("read_only_space", 0x01195): "EmptyArrayBoilerplateDescription",
+  ("read_only_space", 0x011bd): "EmptyArrayBoilerplateDescription",
-  ("read_only_space", 0x011c9): "EmptyClosureFeedbackCellArray",
+  ("read_only_space", 0x011f1): "EmptyClosureFeedbackCellArray",
-  ("read_only_space", 0x011d1): "EmptySloppyArgumentsElements",
+  ("read_only_space", 0x011f9): "EmptySloppyArgumentsElements",
-  ("read_only_space", 0x011e1): "EmptySlowElementDictionary",
+  ("read_only_space", 0x01209): "EmptySlowElementDictionary",
-  ("read_only_space", 0x01205): "EmptyOrderedHashMap",
+  ("read_only_space", 0x0122d): "EmptyOrderedHashMap",
-  ("read_only_space", 0x01219): "EmptyOrderedHashSet",
+  ("read_only_space", 0x01241): "EmptyOrderedHashSet",
-  ("read_only_space", 0x0122d): "EmptyFeedbackMetadata",
+  ("read_only_space", 0x01255): "EmptyFeedbackMetadata",
-  ("read_only_space", 0x01239): "EmptyPropertyCell",
+  ("read_only_space", 0x01261): "EmptyPropertyCell",
-  ("read_only_space", 0x0124d): "EmptyPropertyDictionary",
+  ("read_only_space", 0x01275): "EmptyPropertyDictionary",
-  ("read_only_space", 0x01275): "NoOpInterceptorInfo",
+  ("read_only_space", 0x0129d): "NoOpInterceptorInfo",
-  ("read_only_space", 0x012c5): "EmptyWeakArrayList",
+  ("read_only_space", 0x012ed): "EmptyWeakArrayList",
-  ("read_only_space", 0x012d1): "InfinityValue",
+  ("read_only_space", 0x012f9): "InfinityValue",
-  ("read_only_space", 0x012dd): "MinusZeroValue",
+  ("read_only_space", 0x01305): "MinusZeroValue",
-  ("read_only_space", 0x012e9): "MinusInfinityValue",
+  ("read_only_space", 0x01311): "MinusInfinityValue",
-  ("read_only_space", 0x012f5): "SelfReferenceMarker",
+  ("read_only_space", 0x0131d): "SelfReferenceMarker",
-  ("read_only_space", 0x01335): "OffHeapTrampolineRelocationInfo",
+  ("read_only_space", 0x0135d): "OffHeapTrampolineRelocationInfo",
-  ("read_only_space", 0x01341): "TrampolineTrivialCodeDataContainer",
+  ("read_only_space", 0x01369): "TrampolineTrivialCodeDataContainer",
-  ("read_only_space", 0x0134d): "TrampolinePromiseRejectionCodeDataContainer",
+  ("read_only_space", 0x01375): "TrampolinePromiseRejectionCodeDataContainer",
-  ("read_only_space", 0x01359): "GlobalThisBindingScopeInfo",
+  ("read_only_space", 0x01381): "GlobalThisBindingScopeInfo",
-  ("read_only_space", 0x01391): "EmptyFunctionScopeInfo",
+  ("read_only_space", 0x013b9): "EmptyFunctionScopeInfo",
-  ("read_only_space", 0x013b9): "NativeScopeInfo",
+  ("read_only_space", 0x013e1): "NativeScopeInfo",
-  ("read_only_space", 0x013d5): "HashSeed",
+  ("read_only_space", 0x013fd): "HashSeed",
   ("old_space", 0x00121): "ArgumentsIteratorAccessor",
   ("old_space", 0x00165): "ArrayLengthAccessor",
   ("old_space", 0x001a9): "BoundFunctionLengthAccessor",