[web snapshot] Fix the case with several exported objects

Bug: v8:11525
Change-Id: I4e4ba332611e3feedc70b32c39f4270cdb0e11cd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3295446Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78016}

src/web-snapshot/web-snapshot.cc

@@ -219,6 +219,13 @@ bool WebSnapshotSerializer::TakeSnapshot(v8::Local<v8::Context> context,
     return false;
   }
   v8::Isolate* v8_isolate = reinterpret_cast<v8::Isolate*>(isolate_);
+
+  contexts_ = ArrayList::New(isolate_, 30);
+  functions_ = ArrayList::New(isolate_, 30);
+  classes_ = ArrayList::New(isolate_, 30);
+  arrays_ = ArrayList::New(isolate_, 30);
+  objects_ = ArrayList::New(isolate_, 30);
+
   std::unique_ptr<Handle<JSObject>[]> export_objects(
       new Handle<JSObject>[exports->Length()]);
   for (int i = 0, length = exports->Length(); i < length; ++i) {
@@ -498,12 +505,6 @@ void WebSnapshotSerializer::Discovery(Handle<Object> start_object) {
 
   // TODO(v8:11525): Serialize leaf objects first.
 
-  contexts_ = ArrayList::New(isolate_, 30);
-  functions_ = ArrayList::New(isolate_, 30);
-  classes_ = ArrayList::New(isolate_, 30);
-  arrays_ = ArrayList::New(isolate_, 30);
-  objects_ = ArrayList::New(isolate_, 30);
-
   discovery_queue_.push(start_object);
 
   while (!discovery_queue_.empty()) {

test/mjsunit/web-snapshot/web-snapshot.js

@@ -333,3 +333,13 @@ function takeAndUseWebSnapshot(createObjects, exports) {
   const x = new Foo();
   assertEquals(6, await x.g());
 })();
+
+(function TwoExportedObjects() {
+  function createObjects() {
+    globalThis.one = {x: 1};
+    globalThis.two = {x: 2};
+  }
+  const { one, two } = takeAndUseWebSnapshot(createObjects, ['one', 'two']);
+  assertEquals(1, one.x);
+  assertEquals(2, two.x);
+})();