Revert "[web snapshot] Add support for object with dictionary mode"

This reverts commit 507fa4d7.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20gc%20stress/38308/overview

Original change's description:
> [web snapshot] Add support for object with dictionary mode
>
> This CL adds the serialization support for object properties
> with dictionary map. Shape id is used to distinguish between if the object has dictionary map. And add TODO to support “no map objects” which can have fast map and “objects with map” which needs to be turned to dictionary mode.
>
> Bug: v8:11525
> Change-Id: If3eb4195115a41d4a3f6cc7372924b982ca96fc1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3621593
> Commit-Queue: 王澳 <wangao.james@bytedance.com>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80366}

Bug: v8:11525
Change-Id: I0d236a9937a5942b387553a61991716321b063e6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629541
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80368}

src/web-snapshot/web-snapshot.h

@@ -203,8 +203,6 @@ class V8_EXPORT WebSnapshotSerializer
   void DiscoverArray(Handle<JSArray> array);
   void DiscoverObject(Handle<JSObject> object);
   void DiscoverSource(Handle<JSFunction> function);
-  template <typename T>
-  void DiscoverObjectPropertiesWithDictionaryMap(T dict);
   void ConstructSource();
 
   void SerializeFunctionInfo(ValueSerializer* serializer,
@@ -213,10 +211,6 @@ class V8_EXPORT WebSnapshotSerializer
   void SerializeString(Handle<String> string, ValueSerializer& serializer);
   void SerializeSymbol(Handle<Symbol> symbol);
   void SerializeMap(Handle<Map> map);
-  void SerializeObjectPrototype(Handle<Map> map, ValueSerializer& serializer);
-
-  template <typename T>
-  void SerializeObjectPropertiesWithDictionaryMap(T dict);
   void SerializeFunction(Handle<JSFunction> function);
   void SerializeClass(Handle<JSFunction> function);
   void SerializeContext(Handle<Context> context);
@@ -358,11 +352,6 @@ class V8_EXPORT WebSnapshotDeserializer
   void DeserializeArrays();
   void DeserializeObjects();
   void DeserializeExports(bool skip_exports);
-  void DeserializeObjectPrototype(Handle<Map> map, uint32_t prototype_id);
-
-  template <typename T>
-  void DeserializeObjectPropertiesWithDictionaryMap(
-      T dict, uint32_t property_count, bool has_custom_property_attributes);
 
   Object ReadValue(
       Handle<HeapObject> object_for_deferred_reference = Handle<HeapObject>(),
@@ -382,7 +371,6 @@ class V8_EXPORT WebSnapshotDeserializer
   Object ReadClass(Handle<HeapObject> container, uint32_t container_index);
   Object ReadRegexp();
   Object ReadExternalReference();
-  bool ReadMapType();
 
   void ReadFunctionPrototype(Handle<JSFunction> function);
   bool SetFunctionPrototype(JSFunction function, JSReceiver prototype);

test/mjsunit/web-snapshot/web-snapshot-3.js

@@ -102,20 +102,3 @@ d8.file.execute('test/mjsunit/web-snapshot/web-snapshot-helpers.js');
   assertEquals(1, foo[0].a);
   assertEquals(2, foo[2].b);
 })();
-
-(function TestObjectWithDictionaryMap() {
-  function createObjects() {
-    const obj = {};
-    // Create an object with dictionary map.
-    for (let i = 0; i < 2000; i++){
-      obj[`key${i}`] = `value${i}`;
-    }
-    globalThis.foo = obj;
-  }
-  const { foo } = takeAndUseWebSnapshot(createObjects, ['foo']);
-  assertEquals(2000, Object.keys(foo).length);
-  assertEquals(2000, Object.values(foo).length);
-  for (let i = 0; i < 2000; i++){
-    assertEquals(`value${i}`, foo[`key${i}`]);
-  }
-})();