[web snapshots] Rewrite object discovery in the d8 snapshotter

In order to construct the optimal source code combination for functions
(and especially the positions inside the optimal source code for each
function), we need to know all functions upfront.

Rewrite the d8-based snapshotter so that it discovers all objects first
(+ assigns ids), then does the actual snapshotting.

Bug: v8:11525
Change-Id: I4f4e5589575ee9738e8a83aa6cda2c8164803b4c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3268915Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77794}

src/web-snapshot/web-snapshot.h

@@ -155,6 +155,14 @@ class V8_EXPORT WebSnapshotSerializer
   // Returns true if the object was already in the map, false if it was added.
   bool InsertIntoIndexMap(ObjectCacheIndexMap& map, Handle<HeapObject> object,
                           uint32_t& id);
+
+  void Discovery(Handle<Object> object);
+  void DiscoverFunction(Handle<JSFunction> function);
+  void DiscoverClass(Handle<JSFunction> function);
+  void DiscoverContext(Handle<Context> context);
+  void DiscoverArray(Handle<JSArray> array);
+  void DiscoverObject(Handle<JSObject> object);
+
   void SerializeSource(ValueSerializer* serializer,
                        Handle<JSFunction> function);
   void SerializeFunctionInfo(ValueSerializer* serializer,
@@ -162,16 +170,22 @@ class V8_EXPORT WebSnapshotSerializer
 
   void SerializeString(Handle<String> string, uint32_t& id);
   void SerializeMap(Handle<Map> map, uint32_t& id);
-  void SerializeFunction(Handle<JSFunction> function, uint32_t& id);
-  void SerializeClass(Handle<JSFunction> function, uint32_t& id);
-  void SerializeContext(Handle<Context> context, uint32_t& id);
-  void SerializeArray(Handle<JSArray> array, uint32_t& id);
-  void SerializePendingArray(Handle<JSArray> array);
-  void SerializeObject(Handle<JSObject> object, uint32_t& id);
-  void SerializePendingObject(Handle<JSObject> object);
+
+  void SerializeFunction(Handle<JSFunction> function);
+  void SerializeClass(Handle<JSFunction> function);
+  void SerializeContext(Handle<Context> context);
+  void SerializeArray(Handle<JSArray> array);
+  void SerializeObject(Handle<JSObject> object);
+
   void SerializeExport(Handle<JSObject> object, Handle<String> export_name);
   void WriteValue(Handle<Object> object, ValueSerializer& serializer);
 
+  uint32_t GetFunctionId(Handle<JSFunction> function);
+  uint32_t GetClassId(Handle<JSFunction> function);
+  uint32_t GetContextId(Handle<Context> context);
+  uint32_t GetArrayId(Handle<JSArray> array);
+  uint32_t GetObjectId(Handle<JSObject> object);
+
   ValueSerializer string_serializer_;
   ValueSerializer map_serializer_;
   ValueSerializer context_serializer_;
@@ -181,6 +195,14 @@ class V8_EXPORT WebSnapshotSerializer
   ValueSerializer object_serializer_;
   ValueSerializer export_serializer_;
 
+  // These are needed for being able to serialize items in order.
+  Handle<ArrayList> contexts_;
+  Handle<ArrayList> functions_;
+  Handle<ArrayList> classes_;
+  Handle<ArrayList> arrays_;
+  Handle<ArrayList> objects_;
+
+  // ObjectCacheIndexMap implements fast lookup item -> id.
   ObjectCacheIndexMap string_ids_;
   ObjectCacheIndexMap map_ids_;
   ObjectCacheIndexMap context_ids_;
@@ -190,8 +212,7 @@ class V8_EXPORT WebSnapshotSerializer
   ObjectCacheIndexMap object_ids_;
   uint32_t export_count_ = 0;
 
-  std::queue<Handle<JSObject>> pending_objects_;
-  std::queue<Handle<JSArray>> pending_arrays_;
+  std::queue<Handle<Object>> discovery_queue_;
 };
 
 class V8_EXPORT WebSnapshotDeserializer

test/mjsunit/web-snapshot/web-snapshot.js

@@ -234,7 +234,7 @@ function takeAndUseWebSnapshot(createObjects, exports) {
   assertEquals([5, 6, 7], foo.array);
 })();
 
-(function TestArray() {
+(function TestEmptyArray() {
   function createObjects() {
     globalThis.foo = {
       array: []
@@ -255,7 +255,6 @@ function takeAndUseWebSnapshot(createObjects, exports) {
   assertEquals([[2, 3], [4, 5]], foo.array);
 })();
 
-
 (function TestArrayContainingObject() {
   function createObjects() {
     globalThis.foo = {