[web snapshot] Add support for object with dictionary mode

This CL adds the serialization support for object properties
with dictionary map. Shape id is used to distinguish between if the object has dictionary map. And add TODO to support “no map objects” which can have fast map and “objects with map” which needs to be turned to dictionary mode.

Bug: v8:11525
Change-Id: If3eb4195115a41d4a3f6cc7372924b982ca96fc1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3621593
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80366}

src/web-snapshot/web-snapshot.h

@@ -203,6 +203,8 @@ class V8_EXPORT WebSnapshotSerializer
   void DiscoverArray(Handle<JSArray> array);
   void DiscoverObject(Handle<JSObject> object);
   void DiscoverSource(Handle<JSFunction> function);
+  template <typename T>
+  void DiscoverObjectPropertiesWithDictionaryMap(T dict);
   void ConstructSource();
 
   void SerializeFunctionInfo(ValueSerializer* serializer,
@@ -211,6 +213,10 @@ class V8_EXPORT WebSnapshotSerializer
   void SerializeString(Handle<String> string, ValueSerializer& serializer);
   void SerializeSymbol(Handle<Symbol> symbol);
   void SerializeMap(Handle<Map> map);
+  void SerializeObjectPrototype(Handle<Map> map, ValueSerializer& serializer);
+
+  template <typename T>
+  void SerializeObjectPropertiesWithDictionaryMap(T dict);
   void SerializeFunction(Handle<JSFunction> function);
   void SerializeClass(Handle<JSFunction> function);
   void SerializeContext(Handle<Context> context);
@@ -352,6 +358,11 @@ class V8_EXPORT WebSnapshotDeserializer
   void DeserializeArrays();
   void DeserializeObjects();
   void DeserializeExports(bool skip_exports);
+  void DeserializeObjectPrototype(Handle<Map> map, uint32_t prototype_id);
+
+  template <typename T>
+  void DeserializeObjectPropertiesWithDictionaryMap(
+      T dict, uint32_t property_count, bool has_custom_property_attributes);
 
   Object ReadValue(
       Handle<HeapObject> object_for_deferred_reference = Handle<HeapObject>(),
@@ -371,6 +382,7 @@ class V8_EXPORT WebSnapshotDeserializer
   Object ReadClass(Handle<HeapObject> container, uint32_t container_index);
   Object ReadRegexp();
   Object ReadExternalReference();
+  bool ReadMapType();
 
   void ReadFunctionPrototype(Handle<JSFunction> function);
   bool SetFunctionPrototype(JSFunction function, JSReceiver prototype);

test/mjsunit/web-snapshot/web-snapshot-3.js

@@ -102,3 +102,20 @@ d8.file.execute('test/mjsunit/web-snapshot/web-snapshot-helpers.js');
   assertEquals(1, foo[0].a);
   assertEquals(2, foo[2].b);
 })();
+
+(function TestObjectWithDictionaryMap() {
+  function createObjects() {
+    const obj = {};
+    // Create an object with dictionary map.
+    for (let i = 0; i < 2000; i++){
+      obj[`key${i}`] = `value${i}`;
+    }
+    globalThis.foo = obj;
+  }
+  const { foo } = takeAndUseWebSnapshot(createObjects, ['foo']);
+  assertEquals(2000, Object.keys(foo).length);
+  assertEquals(2000, Object.values(foo).length);
+  for (let i = 0; i < 2000; i++){
+    assertEquals(`value${i}`, foo[`key${i}`]);
+  }
+})();