[web snapshot] Support DataView

Bug: v8:11525
Change-Id: I5a29542032692c106bba14d010605e90954097b8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3706964
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81299}

src/logging/runtime-call-stats.h

@@ -493,6 +493,7 @@ class RuntimeCallTimer final {
   V(WebSnapshotDeserialize_BuiltinObjects)     \
   V(WebSnapshotDeserialize_Classes)            \
   V(WebSnapshotDeserialize_Contexts)           \
+  V(WebSnapshotDeserialize_DataViews)          \
   V(WebSnapshotDeserialize_Exports)            \
   V(WebSnapshotDeserialize_Functions)          \
   V(WebSnapshotDeserialize_Maps)               \

src/web-snapshot/web-snapshot.h

@@ -60,7 +60,8 @@ class WebSnapshotSerializerDeserializer {
     BUILTIN_OBJECT_ID,
     IN_PLACE_STRING_ID,
     ARRAY_BUFFER_ID,
-    TYPED_ARRAY_ID
+    TYPED_ARRAY_ID,
+    DATA_VIEW_ID
   };
 
   enum SymbolType : uint8_t {
@@ -222,6 +223,10 @@ class V8_EXPORT WebSnapshotSerializer
     return static_cast<uint32_t>(typed_array_ids_.size());
   }
 
+  uint32_t data_view_count() const {
+    return static_cast<uint32_t>(data_view_ids_.size());
+  }
+
   uint32_t object_count() const {
     return static_cast<uint32_t>(object_ids_.size());
   }
@@ -265,6 +270,7 @@ class V8_EXPORT WebSnapshotSerializer
   void DiscoverContext(Handle<Context> context);
   void DiscoverArray(Handle<JSArray> array);
   void DiscoverTypedArray(Handle<JSTypedArray> typed_array);
+  void DiscoverDataView(Handle<JSDataView> data_view);
   void DiscoverArrayBuffer(Handle<JSArrayBuffer> array_buffer);
   void DiscoverElements(Handle<JSObject> object);
   void DiscoverObject(Handle<JSObject> object);
@@ -293,8 +299,11 @@ class V8_EXPORT WebSnapshotSerializer
   void SerializeArray(Handle<JSArray> array);
   void SerializeElements(Handle<JSObject> object, ValueSerializer& serializer);
   void SerializeObject(Handle<JSObject> object);
+  void SerializeArrayBufferView(Handle<JSArrayBufferView> array_buffer_view,
+                                ValueSerializer& serializer);
   void SerializeArrayBuffer(Handle<JSArrayBuffer> array_buffer);
   void SerializeTypedArray(Handle<JSTypedArray> typed_array);
+  void SerializeDataView(Handle<JSDataView> data_view);
 
   void SerializeExport(Handle<Object> object, Handle<String> export_name);
   void WriteValue(Handle<Object> object, ValueSerializer& serializer);
@@ -310,6 +319,7 @@ class V8_EXPORT WebSnapshotSerializer
   uint32_t GetContextId(Context context);
   uint32_t GetArrayId(JSArray array);
   uint32_t GetTypedArrayId(JSTypedArray typed_array);
+  uint32_t GetDataViewId(JSDataView data_view);
   uint32_t GetArrayBufferId(JSArrayBuffer array_buffer);
   uint32_t GetObjectId(JSObject object);
   bool GetExternalId(HeapObject object, uint32_t* id = nullptr);
@@ -327,6 +337,7 @@ class V8_EXPORT WebSnapshotSerializer
   ValueSerializer array_serializer_;
   ValueSerializer typed_array_serializer_;
   ValueSerializer array_buffer_serializer_;
+  ValueSerializer data_view_serializer_;
   ValueSerializer object_serializer_;
   ValueSerializer export_serializer_;
 
@@ -340,6 +351,7 @@ class V8_EXPORT WebSnapshotSerializer
   Handle<ArrayList> arrays_;
   Handle<ArrayList> typed_arrays_;
   Handle<ArrayList> array_buffers_;
+  Handle<ArrayList> data_views_;
   Handle<ArrayList> objects_;
 
   // IndexMap to keep track of explicitly blocked external objects and
@@ -359,6 +371,7 @@ class V8_EXPORT WebSnapshotSerializer
   ObjectCacheIndexMap array_ids_;
   ObjectCacheIndexMap typed_array_ids_;
   ObjectCacheIndexMap array_buffer_ids_;
+  ObjectCacheIndexMap data_view_ids_;
   ObjectCacheIndexMap object_ids_;
   uint32_t export_count_ = 0;
 
@@ -469,6 +482,7 @@ class V8_EXPORT WebSnapshotDeserializer
   void DeserializeArrays();
   void DeserializeArrayBuffers();
   void DeserializeTypedArrays();
+  void DeserializeDataViews();
   void DeserializeObjects();
   void DeserializeObjectElements(Handle<JSObject> object,
                                  bool map_from_snapshot);
@@ -507,6 +521,8 @@ class V8_EXPORT WebSnapshotDeserializer
                                            uint32_t container_index);
   std::tuple<Object, bool> ReadTypedArray(Handle<HeapObject> container,
                                           uint32_t container_index);
+  std::tuple<Object, bool> ReadDataView(Handle<HeapObject> container,
+                                        uint32_t container_index);
   std::tuple<Object, bool> ReadObject(Handle<HeapObject> container,
                                       uint32_t container_index);
   std::tuple<Object, bool> ReadFunction(Handle<HeapObject> container,
@@ -566,6 +582,9 @@ class V8_EXPORT WebSnapshotDeserializer
   Handle<FixedArray> typed_arrays_handle_;
   FixedArray typed_arrays_;
 
+  Handle<FixedArray> data_views_handle_;
+  FixedArray data_views_;
+
   Handle<FixedArray> objects_handle_;
   FixedArray objects_;
 
@@ -602,6 +621,8 @@ class V8_EXPORT WebSnapshotDeserializer
   uint32_t current_array_buffer_count_ = 0;
   uint32_t typed_array_count_ = 0;
   uint32_t current_typed_array_count_ = 0;
+  uint32_t data_view_count_ = 0;
+  uint32_t current_data_view_count_ = 0;
   uint32_t object_count_ = 0;
   uint32_t current_object_count_ = 0;
 

test/mjsunit/web-snapshot/web-snapshot-data-view.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-d8-web-snapshot-api --allow-natives-syntax --harmony-rab-gsab
+
+'use strict';
+
+d8.file.execute('test/mjsunit/web-snapshot/web-snapshot-helpers.js');
+
+(function TestDataView() {
+  function createObjects() {
+    const buffer = new ArrayBuffer(10);
+    const array1 = new DataView(buffer, 0, 5);
+    const array2 = new DataView(buffer, 5, 5);
+    const array3 = new DataView(buffer, 2, 5);
+    for (let i = 0; i < 5; i++) {
+      array1.setUint8(i, i);
+      array2.setUint8(i, i);
+    }
+    globalThis.array1 = array1;
+    globalThis.array2 = array2;
+    globalThis.array3 = array3;
+  }
+  const {array1, array2, array3} = takeAndUseWebSnapshot(createObjects, [
+    'array1',
+    'array2',
+    'array3'
+  ]);
+  assertEquals(array1.byteLength, 5);
+  assertEquals(array1.byteOffset, 0);
+  assertEquals(array2.byteLength, 5);
+  assertEquals(array2.byteOffset, 5);
+  assertEquals(array3.byteLength, 5);
+  assertEquals(array3.byteOffset, 2);
+
+  for (let i = 0; i < 5; i++) {
+    assertEquals(array1.getUint8(i), i);
+    assertEquals(array2.getUint8(i), i);
+  }
+  assertSame(array1.buffer, array2.buffer);
+  assertSame(array1.buffer, array3.buffer);
+
+  new DataView(array1.buffer).setUint8(2, 10);
+  assertTrue(array1.getUint8(2) === 10);
+  assertTrue(array3.getUint8(0) === 10);
+})();
+
+(function TestResizableDataView() {
+  function createObjects() {
+    let resizableArrayBuffer = new ArrayBuffer(1024, {
+      maxByteLength: 1024 * 2,
+    });
+    // 0 offset, auto length
+    let array1 = new DataView(resizableArrayBuffer);
+    globalThis.array1 = array1;
+
+    // Non-0 offset, auto length
+    let array2 = new DataView(resizableArrayBuffer, 256);
+    globalThis.array2 = array2;
+
+    // Non-0 offset, fixed length
+    let array3 = new DataView(resizableArrayBuffer, 128, 4);
+    globalThis.array3 = array3;
+  }
+  const {array1, array2, array3} = takeAndUseWebSnapshot(createObjects, [
+    'array1',
+    'array2',
+    'array3',
+  ]);
+  assertTrue(array1.buffer.resizable);
+  assertEquals(array1.buffer.maxByteLength, 2048);
+  assertEquals(array1.byteLength, 1024);
+  assertEquals(array1.byteOffset, 0);
+  assertEquals(array2.byteLength, 768); // 1024 - 256
+  assertEquals(array2.byteOffset, 256);
+  assertEquals(array3.byteLength, 4);
+  assertEquals(array3.byteOffset, 128);
+
+  array1.buffer.resize(1024 * 2);
+  assertEquals(array1.byteLength, 2048);
+  assertEquals(array2.byteLength, 1792);  // 2048 - 256
+  assertEquals(array3.byteLength, 4);
+
+  assertSame(array1.buffer, array2.buffer);
+  assertSame(array1.buffer, array3.buffer);
+})();
+
+(function TestGrowableDataView() {
+  function createObjects() {
+    let resizableArrayBuffer = new SharedArrayBuffer(1024, {
+      maxByteLength: 1024 * 2,
+    });
+    // 0 offset, auto length
+    let array1 = new DataView(resizableArrayBuffer);
+    globalThis.array1 = array1;
+
+    // Non-0 offset, auto length
+    let array2 = new DataView(resizableArrayBuffer, 256);
+    globalThis.array2 = array2;
+
+    // Non-0 offset, fixed length
+    let array3 = new DataView(resizableArrayBuffer, 128, 4);
+    globalThis.array3 = array3;
+  }
+  const {array1, array2, array3} = takeAndUseWebSnapshot(createObjects, [
+    'array1',
+    'array2',
+    'array3',
+  ]);
+  assertTrue(array1.buffer.growable);
+  assertEquals(array1.buffer.maxByteLength, 2048);
+  assertEquals(array1.byteLength, 1024);
+  assertEquals(array1.byteOffset, 0);
+  assertEquals(array2.byteLength, 768); // 1024 - 256
+  assertEquals(array2.byteOffset, 256);
+  assertEquals(array3.byteLength, 4);
+  assertEquals(array3.byteOffset, 128);
+
+  array1.buffer.grow(1024 * 2);
+  assertEquals(array1.byteLength, 2048);
+  assertEquals(array2.byteLength, 1792);  // 2048 - 256
+  assertEquals(array3.byteLength, 4);
+
+  assertSame(array1.buffer, array2.buffer);
+  assertSame(array1.buffer, array3.buffer);
+})();