[cleanup] Fix frame mismatch for WasmToJs functions

There are 2 kinds of WasmToJs code: one uses a WasmFrame and the other
a simple TypedFrame TF frame. This CL introduces WasmToJsFunctionFrame
(as a simple TypedFrame) to dfferentiate from the WasmFrame counterpart.

This was not an issue before
https://crrev.com/c9c490891ab3d63fc790770cb1c76f8013ba963f
since we used to use a single master function for pointer iteration.

No-Tree-Checks: true
Bug: v8:13243
Change-Id: I97f7e8c897159ca3cafa65ff6ddf836c5ef7b76e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3865969Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82856}

src/execution/frames-inl.h

@@ -262,6 +262,10 @@ inline WasmDebugBreakFrame::WasmDebugBreakFrame(
 inline WasmToJsFrame::WasmToJsFrame(StackFrameIteratorBase* iterator)
     : WasmFrame(iterator) {}
 
+inline WasmToJsFunctionFrame::WasmToJsFunctionFrame(
+    StackFrameIteratorBase* iterator)
+    : TypedFrame(iterator) {}
+
 inline JsToWasmFrame::JsToWasmFrame(StackFrameIteratorBase* iterator)
     : StubFrame(iterator) {}
 

src/execution/frames.cc

@@ -741,7 +741,7 @@ StackFrame::Type StackFrame::ComputeType(const StackFrameIteratorBase* iterator,
         case CodeKind::C_WASM_ENTRY:
           return C_WASM_ENTRY;
         case CodeKind::WASM_TO_JS_FUNCTION:
-          return WASM_TO_JS;
+          return WASM_TO_JS_FUNCTION;
         case CodeKind::WASM_FUNCTION:
         case CodeKind::WASM_TO_CAPI_FUNCTION:
           // Never appear as on-heap {Code} objects.

src/execution/frames.h

@@ -105,6 +105,7 @@ class StackHandler {
   V(EXIT, ExitFrame)                                                      \
   IF_WASM(V, WASM, WasmFrame)                                             \
   IF_WASM(V, WASM_TO_JS, WasmToJsFrame)                                   \
+  IF_WASM(V, WASM_TO_JS_FUNCTION, WasmToJsFunctionFrame)                  \
   IF_WASM(V, JS_TO_WASM, JsToWasmFrame)                                   \
   IF_WASM(V, STACK_SWITCH, StackSwitchFrame)                              \
   IF_WASM(V, WASM_DEBUG_BREAK, WasmDebugBreakFrame)                       \
@@ -236,7 +237,9 @@ class StackFrame {
   bool is_c_wasm_entry() const { return type() == C_WASM_ENTRY; }
   bool is_wasm_compile_lazy() const { return type() == WASM_COMPILE_LAZY; }
   bool is_wasm_debug_break() const { return type() == WASM_DEBUG_BREAK; }
-  bool is_wasm_to_js() const { return type() == WASM_TO_JS; }
+  bool is_wasm_to_js() const {
+    return type() == WASM_TO_JS || type() == WASM_TO_JS_FUNCTION;
+  }
   bool is_js_to_wasm() const { return type() == JS_TO_WASM; }
 #endif  // V8_ENABLE_WEBASSEMBLY
   bool is_builtin() const { return type() == BUILTIN; }
@@ -1105,6 +1108,17 @@ class WasmToJsFrame : public WasmFrame {
   friend class StackFrameIteratorBase;
 };
 
+class WasmToJsFunctionFrame : public TypedFrame {
+ public:
+  Type type() const override { return WASM_TO_JS_FUNCTION; }
+
+ protected:
+  inline explicit WasmToJsFunctionFrame(StackFrameIteratorBase* iterator);
+
+ private:
+  friend class StackFrameIteratorBase;
+};
+
 class JsToWasmFrame : public StubFrame {
  public:
   Type type() const override { return JS_TO_WASM; }

tools/v8heapconst.py

@@ -584,6 +584,7 @@ FRAME_MARKERS = (
   "EXIT",
   "WASM",
   "WASM_TO_JS",
+  "WASM_TO_JS_FUNCTION",
   "JS_TO_WASM",
   "STACK_SWITCH",
   "WASM_DEBUG_BREAK",