[web snapshot] Support properties in function

This CL adds the serialization and deserialization
for properties in function. And we only support fast
properties in property array now.

Bug: v8:11525
Change-Id: If0bb3fee400ca957009d046ed74b92d8192c2514
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650675
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80858}

src/web-snapshot/web-snapshot.h

@@ -208,7 +208,8 @@ class V8_EXPORT WebSnapshotSerializer
   void DiscoverString(Handle<String> string,
                       AllowInPlace can_be_in_place = AllowInPlace::No);
   void DiscoverSymbol(Handle<Symbol> symbol);
-  void DiscoverMap(Handle<Map> map);
+  void DiscoverMap(Handle<Map> map, bool allow_property_in_descriptor = false);
+  void DiscoverPropertyKey(Handle<Name> key);
   void DiscoverFunction(Handle<JSFunction> function);
   void DiscoverClass(Handle<JSFunction> function);
   void DiscoverContextAndPrototype(Handle<JSFunction> function);
@@ -224,7 +225,7 @@ class V8_EXPORT WebSnapshotSerializer
 
   void SerializeFunctionInfo(Handle<JSFunction> function,
                              ValueSerializer& serializer);
-
+  void SerializeFunctionProperties(Handle<JSFunction> function);
   void SerializeString(Handle<String> string, ValueSerializer& serializer);
   void SerializeSymbol(Handle<Symbol> symbol);
   void SerializeMap(Handle<Map> map);
@@ -412,10 +413,15 @@ class V8_EXPORT WebSnapshotDeserializer
   void DeserializeObjectPrototypeForFunction(Handle<JSFunction> function);
   void SetPrototype(Handle<Map> map, Handle<Object> prototype);
 
+  bool IsInitialFunctionPrototype(Object prototype);
+
   template <typename T>
   void DeserializeObjectPropertiesWithDictionaryMap(
       T dict, uint32_t property_count, bool has_custom_property_attributes);
 
+  Handle<PropertyArray> DeserializePropertyArray(
+      Handle<DescriptorArray> descriptors, int no_properties);
+
   // Return value: (object, was_deferred)
   std::tuple<Object, bool> ReadValue(
       Handle<HeapObject> object_for_deferred_reference = Handle<HeapObject>(),
@@ -470,6 +476,7 @@ class V8_EXPORT WebSnapshotDeserializer
 
   Handle<FixedArray> maps_handle_;
   FixedArray maps_;
+  std::map<int, Handle<Map>> deserialized_function_maps_;
 
   Handle<FixedArray> contexts_handle_;
   FixedArray contexts_;

test/mjsunit/web-snapshot/web-snapshot-function.js

@@ -147,3 +147,123 @@ d8.file.execute('test/mjsunit/web-snapshot/web-snapshot-helpers.js');
   assertSame(newAsyncGeneratorFunction.prototype.__proto__,
              asyncGeneratorFunction.prototype.__proto__);
 })();
+
+(function TestFunctionWithProperties() {
+  function createObjects() {
+    function bar() { return 'bar'; };
+    bar.key1 = "value1";
+    bar.key2 = 1;
+    bar.key3 = 2.2;
+    bar.key4 = function key4() {
+      return "key4";
+    }
+    bar.key5 = [1, 2];
+    bar.key6 = {"key":"value"}
+    globalThis.foo = {
+      bar: bar,
+    };
+  }
+  const { foo } = takeAndUseWebSnapshot(createObjects, ['foo']);
+  assertEquals('bar', foo.bar());
+  assertEquals('value1', foo.bar.key1);
+  assertEquals(1, foo.bar.key2);
+  assertEquals(2.2, foo.bar.key3);
+  assertEquals('key4', foo.bar.key4());
+  assertEquals([1, 2], foo.bar.key5);
+  assertEquals({ "key": "value" }, foo.bar.key6 );
+})();
+
+(function TestAsyncFunctionWithProperties() {
+  function createObjects() {
+    async function bar() { return 'bar'; };
+    bar.key1 = "value1";
+    bar.key2 = 1;
+    bar.key3 = 2.2;
+    bar.key4 = function key4() {
+      return "key4";
+    }
+    bar.key5 = [1, 2];
+    bar.key6 = {"key":"value"}
+    globalThis.foo = {
+      bar: bar,
+    };
+  }
+  const { foo } = takeAndUseWebSnapshot(createObjects, ['foo']);
+  assertEquals('value1', foo.bar.key1);
+  assertEquals(1, foo.bar.key2);
+  assertEquals(2.2, foo.bar.key3);
+  assertEquals('key4', foo.bar.key4());
+  assertEquals([1, 2], foo.bar.key5);
+  assertEquals({ "key": "value" }, foo.bar.key6 );
+})();
+
+(function TestGeneratorFunctionWithProperties() {
+  function createObjects() {
+    function *bar() { return 'bar'; };
+    bar.key1 = "value1";
+    bar.key2 = 1;
+    bar.key3 = 2.2;
+    bar.key4 = function key4() {
+      return "key4";
+    }
+    bar.key5 = [1, 2];
+    bar.key6 = {"key":"value"}
+    globalThis.foo = {
+      bar: bar,
+    };
+  }
+  const { foo } = takeAndUseWebSnapshot(createObjects, ['foo']);
+  assertEquals('value1', foo.bar.key1);
+  assertEquals(1, foo.bar.key2);
+  assertEquals(2.2, foo.bar.key3);
+  assertEquals('key4', foo.bar.key4());
+  assertEquals([1, 2], foo.bar.key5);
+  assertEquals({ "key": "value" }, foo.bar.key6 );
+})();
+
+(function TestAsyncGeneratorFunctionWithProperties() {
+  function createObjects() {
+    async function *bar() { return 'bar'; };
+    bar.key1 = "value1";
+    bar.key2 = 1;
+    bar.key3 = 2.2;
+    bar.key4 = function key4() {
+      return "key4";
+    }
+    bar.key5 = [1, 2];
+    bar.key6 = {"key":"value"}
+    globalThis.foo = {
+      bar: bar,
+    };
+  }
+  const { foo } = takeAndUseWebSnapshot(createObjects, ['foo']);
+  assertEquals('value1', foo.bar.key1);
+  assertEquals(1, foo.bar.key2);
+  assertEquals(2.2, foo.bar.key3);
+  assertEquals('key4', foo.bar.key4());
+  assertEquals([1, 2], foo.bar.key5);
+  assertEquals({ "key": "value" }, foo.bar.key6 );
+})();
+
+(function TestFunctionsWithSameMap() {
+  function createObjects() {
+    function bar1() { return 'bar1'; };
+    bar1.key = "value";
+
+    function bar2() {
+      return "bar2";
+    }
+    bar2.key = "value";
+
+    globalThis.foo = {
+      bar1: bar1,
+      bar2: bar2
+    };
+  }
+  const { foo } = takeAndUseWebSnapshot(createObjects, ['foo']);
+  assertEquals('bar1', foo.bar1());
+  assertEquals('value', foo.bar1.key);
+  assertEquals('bar2', foo.bar2());
+  assertEquals('value', foo.bar2.key);
+  assertTrue(%HaveSameMap(foo.bar1, foo.bar2))
+})();