Add object hidden properties to heap snapshot

src/heap-snapshot-generator.cc

Index: src/heap-snapshot-generator.cc
diff --git a/src/heap-snapshot-generator.cc b/src/heap-snapshot-generator.cc
index b67aa0f3764ad1c190243c98ec4921c2d1c6454d..2e6590d5497ec50db55619c6b7905271ff4894a6 100644
--- a/src/heap-snapshot-generator.cc
+++ b/src/heap-snapshot-generator.cc
@@ -1090,6 +1090,7 @@ void V8HeapExplorer::ExtractJSObjectReferences(
   ExtractPropertyReferences(js_obj, entry);
   ExtractElementReferences(js_obj, entry);
   ExtractInternalReferences(js_obj, entry);
+  ExtractHiddenPropertyReferences(js_obj, entry);
   SetPropertyReference(
       obj, entry, heap_->proto_string(), js_obj->GetPrototype());
   if (obj->IsJSFunction()) {
@@ -1595,6 +1596,31 @@ void V8HeapExplorer::ExtractPropertyReferences(JSObject* js_obj, int entry) {
 }
 
 
+void V8HeapExplorer::ExtractHiddenPropertyReferences(JSObject* obj, int entry) {
+  if (obj->IsJSGlobalProxy()) {
+    // For a proxy, use the prototype as target object.
+    Object* proxy_parent = obj->GetPrototype();
+    // If the proxy is detached, return undefined.
+    if (proxy_parent->IsNull())
+      return;
+    ASSERT(proxy_parent->IsJSGlobalObject());
+    obj = JSObject::cast(proxy_parent);
+  }
+  ASSERT(!obj->IsJSGlobalProxy());
+  Object* inline_value = obj->GetHiddenPropertiesHashTable();
+  if (!inline_value->IsHashTable())
+    return;
+  ObjectHashTable* hashtable = ObjectHashTable::cast(inline_value);
+  int capacity = hashtable->Capacity();
+  for (int i = 0; i < capacity; i++) {
+    Object* k = hashtable->KeyAt(i);
+    if (!k->IsString()) continue;
+    Object* value = hashtable->Lookup(k);
+    SetPropertyReference(obj, entry, String::cast(k), value);
+  }
+}
+
+
 bool V8HeapExplorer::ExtractAccessorPairProperty(
     JSObject* js_obj, int entry, Object* key, Object* callback_obj) {
   if (!callback_obj->IsAccessorPair()) return false;