[web snapshots] Fix empty map handling

Bug: v8:11525
Change-Id: I582f17d6ecfa47394bc29692f788c5119aac5ce9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3516745Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79458}

src/web-snapshot/web-snapshot.cc

@@ -1542,7 +1542,7 @@ void WebSnapshotDeserializer::DeserializeMaps() {
       Map empty_map =
           isolate_->native_context()->object_function().initial_map();
       maps_.set(i, empty_map);
-      return;
+      continue;
     }
 
     Handle<DescriptorArray> descriptors =

test/mjsunit/web-snapshot/web-snapshot-3.js

@@ -93,3 +93,12 @@ d8.file.execute('test/mjsunit/web-snapshot/web-snapshot-helpers.js');
   assertEquals('00', '' + bar[0] + bar[1]);
   assertEquals('value1value2', bar.prop1 + bar.prop2);
 })();
+
+(function TestObjectWithEmptyMap() {
+  function createObjects() {
+    globalThis.foo = [{a:1}, {}, {b: 2}];
+  }
+  const { foo } = takeAndUseWebSnapshot(createObjects, ['foo']);
+  assertEquals(1, foo[0].a);
+  assertEquals(2, foo[2].b);
+})();