[web snapshot] Support empty objects

This CL fixes the deserialization of the map for empty objects, so that
the initial empty map is used.

Bug: chromium:1213851, v8:11525, v8:11706
Change-Id: I37de0b147b9c89ead9c96f776e5fbf88da4630cc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928192
Commit-Queue: Vicky Kontoura <vkont@google.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74880}

src/web-snapshot/web-snapshot.cc

@@ -574,6 +574,14 @@ void WebSnapshotDeserializer::DeserializeMaps() {
       return;
     }
 
+    if (property_count == 0) {
+      DisallowGarbageCollection no_gc;
+      Map empty_map =
+          isolate_->native_context()->object_function().initial_map();
+      maps_->set(i, empty_map);
+      return;
+    }
+
     Handle<DescriptorArray> descriptors =
         isolate_->factory()->NewDescriptorArray(0, property_count);
     for (uint32_t p = 0; p < property_count; ++p) {

test/cctest/test-web-snapshots.cc

@@ -86,6 +86,27 @@ TEST(Minimal) {
                   kMapCount, kContextCount, kFunctionCount, kObjectCount);
 }
 
+TEST(EmptyObject) {
+  const char* snapshot_source = "var foo = {}";
+  const char* test_source = "foo";
+  uint32_t kStringCount = 1;  // 'foo'
+  uint32_t kMapCount = 1;
+  uint32_t kContextCount = 0;
+  uint32_t kFunctionCount = 0;
+  uint32_t kObjectCount = 1;
+  std::function<void(v8::Isolate*, v8::Local<v8::Context>)> tester =
+      [test_source](v8::Isolate* isolate, v8::Local<v8::Context> new_context) {
+        v8::Local<v8::Object> result = CompileRun(test_source).As<v8::Object>();
+        Handle<JSReceiver> foo(v8::Utils::OpenHandle(*result));
+        Isolate* i_isolate = reinterpret_cast<Isolate*>(isolate);
+        CHECK_EQ(foo->map(),
+                 i_isolate->native_context()->object_function().initial_map());
+      };
+  TestWebSnapshotExtensive(snapshot_source, test_source, tester, kStringCount,
+                           kMapCount, kContextCount, kFunctionCount,
+                           kObjectCount);
+}
+
 TEST(Numbers) {
   const char* snapshot_source =
       "var foo = {'a': 6,\n"

test/mjsunit/web-snapshot/web-snapshot.js

@@ -39,3 +39,11 @@ function takeAndUseWebSnapshot(createObjects, exports) {
   assertEquals(exports.foo.str, 'hello');
   assertEquals(exports.foo.n, 42);
 })();
+
+(function TestEmptyObject() {
+  function createObjects() {
+    globalThis.foo = {};
+  }
+  const exports = takeAndUseWebSnapshot(createObjects, ['foo']);
+  assertEquals(Object.keys(exports.foo), []);
+})();