[web snapshot] Store function formal parameter count

In the final version, we might parse the parameters when deserializing
instead, but this approach is more suitable for prototyping.

Bug: v8:11525
Change-Id: I000869877b03fd1909acf602ab5190951b1939e5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3295456Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78065}

src/web-snapshot/web-snapshot.cc

@@ -497,7 +497,8 @@ void WebSnapshotSerializer::SerializeFunctionInfo(ValueSerializer* serializer,
   }
 
   SerializeSource(serializer, function);
-
+  serializer->WriteUint32(
+      function->shared().internal_formal_parameter_count_without_receiver());
   serializer->WriteUint32(
       FunctionKindToFunctionFlags(function->shared().kind()));
 }
@@ -662,9 +663,9 @@ void WebSnapshotSerializer::DiscoverObject(Handle<JSObject> object) {
 // - String id (source snippet)
 // - Start position in the source snippet
 // - Length in the source snippet
+// - Formal parameter count
 // - Flags (see FunctionFlags)
 // TODO(v8:11525): Investigate whether the length is really needed.
-// TODO(v8:11525): Serialize the formal parameter count.
 void WebSnapshotSerializer::SerializeFunction(Handle<JSFunction> function) {
   SerializeFunctionInfo(&function_serializer_, function);
 
@@ -679,6 +680,7 @@ void WebSnapshotSerializer::SerializeFunction(Handle<JSFunction> function) {
 // - String id (source snippet)
 // - Start position in the source snippet
 // - Length in the source snippet
+// - Formal parameter count
 // - Flags (see FunctionFlags)
 // - Object id (function prototype)
 void WebSnapshotSerializer::SerializeClass(Handle<JSFunction> function) {
@@ -1380,7 +1382,7 @@ Handle<ScopeInfo> WebSnapshotDeserializer::CreateScopeInfo(
 
 Handle<JSFunction> WebSnapshotDeserializer::CreateJSFunction(
     int shared_function_info_index, uint32_t start_position, uint32_t length,
-    uint32_t flags, uint32_t context_id) {
+    uint32_t parameter_count, uint32_t flags, uint32_t context_id) {
   // TODO(v8:11525): Deduplicate the SFIs for class methods.
   FunctionKind kind = FunctionFlagsToFunctionKind(flags);
   Handle<SharedFunctionInfo> shared =
@@ -1392,6 +1394,8 @@ Handle<JSFunction> WebSnapshotDeserializer::CreateJSFunction(
   }
   shared->set_script(*script_);
   shared->set_function_literal_id(shared_function_info_index);
+  shared->set_internal_formal_parameter_count(
+      JSParameterCount(parameter_count));
   // TODO(v8:11525): Decide how to handle language modes.
   shared->set_language_mode(LanguageMode::kStrict);
   shared->set_uncompiled_data(
@@ -1460,9 +1464,11 @@ void WebSnapshotDeserializer::DeserializeFunctions() {
 
     uint32_t start_position;
     uint32_t length;
+    uint32_t parameter_count;
     uint32_t flags;
     if (!deserializer_->ReadUint32(&start_position) ||
         !deserializer_->ReadUint32(&length) ||
+        !deserializer_->ReadUint32(&parameter_count) ||
         !deserializer_->ReadUint32(&flags)) {
       Throw("Malformed function");
       return;
@@ -1470,8 +1476,9 @@ void WebSnapshotDeserializer::DeserializeFunctions() {
 
     // Index 0 is reserved for top-level shared function info (which web
     // snapshot scripts don't have).
-    Handle<JSFunction> function = CreateJSFunction(
-        current_function_count_ + 1, start_position, length, flags, context_id);
+    Handle<JSFunction> function =
+        CreateJSFunction(current_function_count_ + 1, start_position, length,
+                         parameter_count, flags, context_id);
     functions_->set(current_function_count_, *function);
   }
 }
@@ -1511,9 +1518,11 @@ void WebSnapshotDeserializer::DeserializeClasses() {
 
     uint32_t start_position;
     uint32_t length;
+    uint32_t parameter_count;
     uint32_t flags;
     if (!deserializer_->ReadUint32(&start_position) ||
         !deserializer_->ReadUint32(&length) ||
+        !deserializer_->ReadUint32(&parameter_count) ||
         !deserializer_->ReadUint32(&flags)) {
       Throw("Malformed class");
       return;
@@ -1521,9 +1530,9 @@ void WebSnapshotDeserializer::DeserializeClasses() {
 
     // Index 0 is reserved for top-level shared function info (which web
     // snapshot scripts don't have).
-    Handle<JSFunction> function =
-        CreateJSFunction(function_count_ + current_class_count_ + 1,
-                         start_position, length, flags, context_id);
+    Handle<JSFunction> function = CreateJSFunction(
+        function_count_ + current_class_count_ + 1, start_position, length,
+        parameter_count, flags, context_id);
     classes_->set(current_class_count_, *function);
 
     uint32_t function_prototype;

src/web-snapshot/web-snapshot.h

@@ -247,8 +247,8 @@ class V8_EXPORT WebSnapshotDeserializer
   Handle<ScopeInfo> CreateScopeInfo(uint32_t variable_count, bool has_parent,
                                     ContextType context_type);
   Handle<JSFunction> CreateJSFunction(int index, uint32_t start,
-                                      uint32_t length, uint32_t flags,
-                                      uint32_t context_id);
+                                      uint32_t length, uint32_t parameter_count,
+                                      uint32_t flags, uint32_t context_id);
   void DeserializeFunctionData(uint32_t count, uint32_t current_count);
   void DeserializeFunctions();
   void DeserializeClasses();

test/mjsunit/web-snapshot/web-snapshot.js

@@ -2,7 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --experimental-d8-web-snapshot-api
+// Flags: --experimental-d8-web-snapshot-api --allow-natives-syntax
+
 
 function use(exports) {
   const result = Object.create(null);
@@ -343,3 +344,29 @@ function takeAndUseWebSnapshot(createObjects, exports) {
   assertEquals(1, one.x);
   assertEquals(2, two.x);
 })();
+
+(function TestOptimizingFunctionFromSnapshot() {
+  function createObjects() {
+    globalThis.f = function(a, b) { return a + b; }
+  }
+  const { f } = takeAndUseWebSnapshot(createObjects, ['f']);
+  %PrepareFunctionForOptimization(f);
+  assertEquals(3, f(1, 2));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(4, f(1, 3));
+})();
+
+(function TestOptimizingConstructorFromSnapshot() {
+  function createObjects() {
+    globalThis.C = class {
+      constructor(a, b) {
+        this.x = a + b;
+      }
+    }
+  }
+  const { C } = takeAndUseWebSnapshot(createObjects, ['C']);
+  %PrepareFunctionForOptimization(C);
+  assertEquals(3, new C(1, 2).x);
+  %OptimizeFunctionOnNextCall(C);
+  assertEquals(4, new C(1, 3).x);
+})();