Reland "[web snapshot] Add support for object with dictionary mode"

This is a reland of commit 507fa4d7

This CL moves the NewJSObjectFromMap after deserializing object properties with dictionary map and fixes the DCHECK failure in JSReceiver::HasFastProperties when triggering GC.

Original change's description:
> [web snapshot] Add support for object with dictionary mode
>
> This CL adds the serialization support for object properties
> with dictionary map. Shape id is used to distinguish between if the object has dictionary map. And add TODO to support “no map objects” which can have fast map and “objects with map” which needs to be turned to dictionary mode.
>
> Bug: v8:11525
> Change-Id: If3eb4195115a41d4a3f6cc7372924b982ca96fc1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3621593
> Commit-Queue: 王澳 <wangao.james@bytedance.com>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80366}

Bug: v8:11525
Change-Id: I88422d698aa03fb7d3b21b5709eec2d0cf306256
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629738
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80374}

src/web-snapshot/web-snapshot.h

@@ -203,6 +203,8 @@ class V8_EXPORT WebSnapshotSerializer
   void DiscoverArray(Handle<JSArray> array);
   void DiscoverObject(Handle<JSObject> object);
   void DiscoverSource(Handle<JSFunction> function);
+  template <typename T>
+  void DiscoverObjectPropertiesWithDictionaryMap(T dict);
   void ConstructSource();
 
   void SerializeFunctionInfo(ValueSerializer* serializer,
@@ -211,6 +213,10 @@ class V8_EXPORT WebSnapshotSerializer
   void SerializeString(Handle<String> string, ValueSerializer& serializer);
   void SerializeSymbol(Handle<Symbol> symbol);
   void SerializeMap(Handle<Map> map);
+  void SerializeObjectPrototype(Handle<Map> map, ValueSerializer& serializer);
+
+  template <typename T>
+  void SerializeObjectPropertiesWithDictionaryMap(T dict);
   void SerializeFunction(Handle<JSFunction> function);
   void SerializeClass(Handle<JSFunction> function);
   void SerializeContext(Handle<Context> context);
@@ -352,6 +358,11 @@ class V8_EXPORT WebSnapshotDeserializer
   void DeserializeArrays();
   void DeserializeObjects();
   void DeserializeExports(bool skip_exports);
+  void DeserializeObjectPrototype(Handle<Map> map, uint32_t prototype_id);
+
+  template <typename T>
+  void DeserializeObjectPropertiesWithDictionaryMap(
+      T dict, uint32_t property_count, bool has_custom_property_attributes);
 
   Object ReadValue(
       Handle<HeapObject> object_for_deferred_reference = Handle<HeapObject>(),
@@ -371,6 +382,7 @@ class V8_EXPORT WebSnapshotDeserializer
   Object ReadClass(Handle<HeapObject> container, uint32_t container_index);
   Object ReadRegexp();
   Object ReadExternalReference();
+  bool ReadMapType();
 
   void ReadFunctionPrototype(Handle<JSFunction> function);
   bool SetFunctionPrototype(JSFunction function, JSReceiver prototype);

test/mjsunit/web-snapshot/web-snapshot-3.js

@@ -102,3 +102,20 @@ d8.file.execute('test/mjsunit/web-snapshot/web-snapshot-helpers.js');
   assertEquals(1, foo[0].a);
   assertEquals(2, foo[2].b);
 })();
+
+(function TestObjectWithDictionaryMap() {
+  function createObjects() {
+    const obj = {};
+    // Create an object with dictionary map.
+    for (let i = 0; i < 2000; i++){
+      obj[`key${i}`] = `value${i}`;
+    }
+    globalThis.foo = obj;
+  }
+  const { foo } = takeAndUseWebSnapshot(createObjects, ['foo']);
+  assertEquals(2000, Object.keys(foo).length);
+  assertEquals(2000, Object.values(foo).length);
+  for (let i = 0; i < 2000; i++){
+    assertEquals(`value${i}`, foo[`key${i}`]);
+  }
+})();