[web snap] Support objects with dictionary elements

Bug: v8:11525
Change-Id: I0196169d5bfe80df23179414f37c418db775cefb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3663341
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80838}

src/web-snapshot/web-snapshot.h

@@ -67,7 +67,7 @@ class WebSnapshotSerializerDeserializer {
     kGlobal = 2
   };
 
-  enum ArrayType : uint8_t { kDense = 0, kSparse = 1 };
+  enum ElementsType : uint8_t { kDense = 0, kSparse = 1 };
 
   static constexpr uint8_t kMagicNumber[4] = {'+', '+', '+', ';'};
 
@@ -214,6 +214,7 @@ class V8_EXPORT WebSnapshotSerializer
   void DiscoverContextAndPrototype(Handle<JSFunction> function);
   void DiscoverContext(Handle<Context> context);
   void DiscoverArray(Handle<JSArray> array);
+  void DiscoverElements(Handle<JSObject> object);
   void DiscoverObject(Handle<JSObject> object);
   bool DiscoverIfBuiltinObject(Handle<HeapObject> object);
   void DiscoverSource(Handle<JSFunction> function);
@@ -236,6 +237,7 @@ class V8_EXPORT WebSnapshotSerializer
   void SerializeClass(Handle<JSFunction> function);
   void SerializeContext(Handle<Context> context, uint32_t id);
   void SerializeArray(Handle<JSArray> array);
+  void SerializeElements(Handle<JSObject> object, ValueSerializer& serializer);
   void SerializeObject(Handle<JSObject> object);
 
   void SerializeExport(Handle<Object> object, Handle<String> export_name);
@@ -401,6 +403,8 @@ class V8_EXPORT WebSnapshotDeserializer
   void DeserializeClasses();
   void DeserializeArrays();
   void DeserializeObjects();
+  void DeserializeObjectElements(Handle<JSObject> object,
+                                 bool map_from_snapshot);
   void DeserializeExports(bool skip_exports);
   void DeserializeObjectPrototype(Handle<Map> map);
   Handle<Map> DeserializeObjectPrototypeAndCreateEmptyMap();
@@ -436,9 +440,13 @@ class V8_EXPORT WebSnapshotDeserializer
   Object ReadBuiltinObjectReference();
   Object ReadExternalReference();
   bool ReadMapType();
-  ArrayType ReadArrayType();
-  Handle<JSArray> ReadDenseArrayElements(uint32_t length);
-  Handle<JSArray> ReadSparseArrayElements(uint32_t length);
+  std::tuple<Handle<FixedArrayBase>, ElementsKind, uint32_t>
+  DeserializeElements();
+  ElementsType ReadElementsType();
+  std::tuple<Handle<FixedArrayBase>, ElementsKind, uint32_t> ReadDenseElements(
+      uint32_t length);
+  std::tuple<Handle<FixedArrayBase>, ElementsKind, uint32_t> ReadSparseElements(
+      uint32_t length);
 
   void ReadFunctionPrototype(Handle<JSFunction> function);
   bool SetFunctionPrototype(JSFunction function, JSReceiver prototype);

test/mjsunit/web-snapshot/web-snapshot-object.js

@@ -159,3 +159,30 @@ d8.file.execute('test/mjsunit/web-snapshot/web-snapshot-helpers.js');
   assertEquals(1, one.x);
   assertEquals(2, two.x);
 })();
+
+(function TestObjectWithDictionaryElements() {
+  function createObjects() {
+    globalThis.obj = {
+      10: 1,
+      100: 2,
+      1000: 3,
+      10000: 4
+    };
+  }
+  const { obj } = takeAndUseWebSnapshot(createObjects, ['obj']);
+  assertEquals(['10', '100', '1000', '10000'], Object.getOwnPropertyNames(obj));
+  assertEquals[1, obj[10]];
+  assertEquals[2, obj[100]];
+  assertEquals[3, obj[1000]];
+  assertEquals[4, obj[10000]];
+})();
+
+(function TestObjectWithDictionaryElementsWithLargeIndex() {
+  function createObjects() {
+    globalThis.obj = {};
+    globalThis.obj[4394967296] = 'lol';
+  }
+  const { obj } = takeAndUseWebSnapshot(createObjects, ['obj']);
+  assertEquals(['4394967296'], Object.getOwnPropertyNames(obj));
+  assertEquals['lol', obj[4394967296]];
+})();