Properly set function index in CallSite constructor

BUG=632965
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2199673002
Cr-Commit-Position: refs/heads/master@{#38208}

src/builtins/builtins-callsite.cc

@@ -58,12 +58,11 @@ BUILTIN(CallSiteConstructor) {
   }
 
   if (is_wasm_object) {
-    DCHECK(!fun->IsJSFunction());
-    SET_CALLSITE_PROPERTY(obj, call_site_wasm_obj_symbol, receiver);
+    DCHECK(fun->IsSmi());
+    DCHECK(wasm::GetNumberOfFunctions(JSObject::cast(*receiver)) >
+           Smi::cast(*fun)->value());
 
-    Handle<Object> fun_index;
-    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, fun_index,
-                                       Object::ToUint32(isolate, fun));
+    SET_CALLSITE_PROPERTY(obj, call_site_wasm_obj_symbol, receiver);
     SET_CALLSITE_PROPERTY(obj, call_site_wasm_func_index_symbol, fun);
   } else {
     DCHECK(fun->IsJSFunction());
@@ -71,10 +70,8 @@ BUILTIN(CallSiteConstructor) {
     SET_CALLSITE_PROPERTY(obj, call_site_function_symbol, fun);
   }
 
-  Handle<Object> pos_int32;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, pos_int32,
-                                     Object::ToInt32(isolate, pos));
-  SET_CALLSITE_PROPERTY(obj, call_site_position_symbol, pos_int32);
+  DCHECK(pos->IsSmi());
+  SET_CALLSITE_PROPERTY(obj, call_site_position_symbol, pos);
   SET_CALLSITE_PROPERTY(
       obj, call_site_strict_symbol,
       isolate->factory()->ToBoolean(strict_mode->BooleanValue()));

test/mjsunit/callsite.js

-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-Error.prepareStackTrace = (e,s) => s;
-var constructor = Error().stack[0].constructor;
-
-// Second argument needs to be a function.
-assertThrows(()=>constructor({}, {}, 1, false), TypeError);
-
-var receiver = {};
-function f() {}
-
-var site = constructor.call(null, receiver, f, {valueOf() { return 0 }}, false);
-assertEquals(receiver, site.getThis());
-assertEquals(1, site.getLineNumber());
-assertEquals(1, site.getColumnNumber());

test/mjsunit/regress/regress-crbug-570651.js

-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-Error.prepareStackTrace = (e,s) => s;
-var __v_3 = Error().stack[0].constructor;
-var __v_4 = {};
-function __f_3() {}
-var __v_5 = __v_3.call(null, __v_4, __f_3, {valueOf() { return 1611877293 }});
- __v_5.getColumnNumber();