[web snapshot] Add arrays

Drive-by: Also add deferred function references.

Bug: v8:11525
Change-Id: If546f2e6c5a991372f1b99dac149504941a24b3e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2951731
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75110}

src/logging/runtime-call-stats.h

@@ -470,6 +470,7 @@ class RuntimeCallTimer final {
   V(TestCounter2)                              \
   V(TestCounter3)                              \
   V(WebSnapshotDeserialize)                    \
+  V(WebSnapshotDeserialize_Arrays)             \
   V(WebSnapshotDeserialize_Contexts)           \
   V(WebSnapshotDeserialize_Exports)            \
   V(WebSnapshotDeserialize_Functions)          \

src/objects/fixed-array.h

@@ -446,7 +446,7 @@ class ArrayList : public TorqueGeneratedArrayList<ArrayList, FixedArray> {
   V8_EXPORT_PRIVATE static Handle<ArrayList> Add(Isolate* isolate,
                                                  Handle<ArrayList> array,
                                                  Handle<Object> obj1, Smi obj2,
-                                                 Smi obj3);
+                                                 Smi obj3, Smi obj4);
   static Handle<ArrayList> New(Isolate* isolate, int size);
 
   // Returns the number of elements in the list, not the allocated size, which

src/objects/objects.cc

@@ -4045,9 +4045,10 @@ Handle<ArrayList> ArrayList::Add(Isolate* isolate, Handle<ArrayList> array,
 }
 
 Handle<ArrayList> ArrayList::Add(Isolate* isolate, Handle<ArrayList> array,
-                                 Handle<Object> obj1, Smi obj2, Smi obj3) {
+                                 Handle<Object> obj1, Smi obj2, Smi obj3,
+                                 Smi obj4) {
   int length = array->Length();
-  array = EnsureSpace(isolate, array, length + 3);
+  array = EnsureSpace(isolate, array, length + 4);
   // Check that GC didn't remove elements from the array.
   DCHECK_EQ(array->Length(), length);
   {
@@ -4056,7 +4057,8 @@ Handle<ArrayList> ArrayList::Add(Isolate* isolate, Handle<ArrayList> array,
     raw_array.Set(length, *obj1);
     raw_array.Set(length + 1, obj2);
     raw_array.Set(length + 2, obj3);
-    raw_array.SetLength(length + 3);
+    raw_array.Set(length + 3, obj4);
+    raw_array.SetLength(length + 4);
   }
   return array;
 }

src/web-snapshot/web-snapshot.h

@@ -49,6 +49,7 @@ class WebSnapshotSerializerDeserializer {
     INTEGER,
     DOUBLE,
     STRING_ID,
+    ARRAY_ID,
     OBJECT_ID,
     FUNCTION_ID,
     REGEXP
@@ -110,6 +111,10 @@ class V8_EXPORT WebSnapshotSerializer
     return static_cast<uint32_t>(function_ids_.size());
   }
 
+  uint32_t array_count() const {
+    return static_cast<uint32_t>(array_ids_.size());
+  }
+
   uint32_t object_count() const {
     return static_cast<uint32_t>(object_ids_.size());
   }
@@ -118,6 +123,7 @@ class V8_EXPORT WebSnapshotSerializer
   WebSnapshotSerializer(const WebSnapshotSerializer&) = delete;
   WebSnapshotSerializer& operator=(const WebSnapshotSerializer&) = delete;
 
+  void SerializePendingItems();
   void WriteSnapshot(uint8_t*& buffer, size_t& buffer_size);
 
   // Returns true if the object was already in the map, false if it was added.
@@ -128,6 +134,8 @@ class V8_EXPORT WebSnapshotSerializer
   void SerializeMap(Handle<Map> map, uint32_t& id);
   void SerializeFunction(Handle<JSFunction> function, uint32_t& id);
   void SerializeContext(Handle<Context> context, uint32_t& id);
+  void SerializeArray(Handle<JSArray> array, uint32_t& id);
+  void SerializePendingArray(Handle<JSArray> array);
   void SerializeObject(Handle<JSObject> object, uint32_t& id);
   void SerializePendingObject(Handle<JSObject> object);
   void SerializeExport(Handle<JSObject> object, Handle<String> export_name);
@@ -137,6 +145,7 @@ class V8_EXPORT WebSnapshotSerializer
   ValueSerializer map_serializer_;
   ValueSerializer context_serializer_;
   ValueSerializer function_serializer_;
+  ValueSerializer array_serializer_;
   ValueSerializer object_serializer_;
   ValueSerializer export_serializer_;
 
@@ -144,10 +153,12 @@ class V8_EXPORT WebSnapshotSerializer
   ObjectCacheIndexMap map_ids_;
   ObjectCacheIndexMap context_ids_;
   ObjectCacheIndexMap function_ids_;
+  ObjectCacheIndexMap array_ids_;
   ObjectCacheIndexMap object_ids_;
   uint32_t export_count_ = 0;
 
   std::queue<Handle<JSObject>> pending_objects_;
+  std::queue<Handle<JSArray>> pending_arrays_;
 };
 
 class V8_EXPORT WebSnapshotDeserializer
@@ -162,6 +173,7 @@ class V8_EXPORT WebSnapshotDeserializer
   uint32_t map_count() const { return map_count_; }
   uint32_t context_count() const { return context_count_; }
   uint32_t function_count() const { return function_count_; }
+  uint32_t array_count() const { return array_count_; }
   uint32_t object_count() const { return object_count_; }
 
  private:
@@ -174,6 +186,7 @@ class V8_EXPORT WebSnapshotDeserializer
   void DeserializeContexts();
   Handle<ScopeInfo> CreateScopeInfo(uint32_t variable_count, bool has_parent);
   void DeserializeFunctions();
+  void DeserializeArrays();
   void DeserializeObjects();
   void DeserializeExports();
   void ReadValue(
@@ -182,6 +195,7 @@ class V8_EXPORT WebSnapshotDeserializer
       uint32_t index_for_deferred_reference = 0);
 
   void AddDeferredReference(Handle<Object> container, uint32_t index,
+                            ValueType target_type,
                             uint32_t target_object_index);
   void ProcessDeferredReferences();
   // Not virtual, on purpose (because it doesn't need to be).
@@ -191,6 +205,7 @@ class V8_EXPORT WebSnapshotDeserializer
   Handle<FixedArray> maps_;
   Handle<FixedArray> contexts_;
   Handle<FixedArray> functions_;
+  Handle<FixedArray> arrays_;
   Handle<FixedArray> objects_;
   Handle<ArrayList> deferred_references_;
 
@@ -198,6 +213,9 @@ class V8_EXPORT WebSnapshotDeserializer
   uint32_t map_count_ = 0;
   uint32_t context_count_ = 0;
   uint32_t function_count_ = 0;
+  uint32_t current_function_count_ = 0;
+  uint32_t array_count_ = 0;
+  uint32_t current_array_count_ = 0;
   uint32_t object_count_ = 0;
   uint32_t current_object_count_ = 0;
 

test/mjsunit/web-snapshot/web-snapshot.js

@@ -223,3 +223,72 @@ function takeAndUseWebSnapshot(createObjects, exports) {
   const { foo } = takeAndUseWebSnapshot(createObjects, ['foo']);
   assertSame(foo, foo.bar.circular);
 })();
+
+(function TestArray() {
+  function createObjects() {
+    globalThis.foo = {
+      array: [5, 6, 7]
+    };
+  }
+  const { foo } = takeAndUseWebSnapshot(createObjects, ['foo']);
+  assertEquals([5, 6, 7], foo.array);
+})();
+
+(function TestArray() {
+  function createObjects() {
+    globalThis.foo = {
+      array: []
+    };
+  }
+  const { foo } = takeAndUseWebSnapshot(createObjects, ['foo']);
+  assertEquals(0, foo.array.length);
+  assertEquals([], foo.array);
+})();
+
+(function TestArrayContainingArray() {
+  function createObjects() {
+    globalThis.foo = {
+      array: [[2, 3], [4, 5]]
+    };
+  }
+  const { foo } = takeAndUseWebSnapshot(createObjects, ['foo']);
+  assertEquals([[2, 3], [4, 5]], foo.array);
+})();
+
+
+(function TestArrayContainingObject() {
+  function createObjects() {
+    globalThis.foo = {
+      array: [{a: 1}, {b: 2}]
+    };
+  }
+  const { foo } = takeAndUseWebSnapshot(createObjects, ['foo']);
+  assertEquals(1, foo.array[0].a);
+  assertEquals(2, foo.array[1].b);
+})();
+
+(function TestArrayContainingFunction() {
+  function createObjects() {
+    globalThis.foo = {
+      array: [function() { return 5; }]
+    };
+  }
+  const { foo } = takeAndUseWebSnapshot(createObjects, ['foo']);
+  assertEquals(5, foo.array[0]());
+})();
+
+
+(function TestContextReferencingArray() {
+  function createObjects() {
+    function outer() {
+      let o = [11525];
+      function inner() { return o; }
+      return inner;
+    }
+    globalThis.foo = {
+      func: outer()
+    };
+  }
+  const { foo } = takeAndUseWebSnapshot(createObjects, ['foo']);
+  assertEquals(11525, foo.func()[0]);
+})();