[wasm] Identify interpreter entry as direct call target

This fixes a bug where an exported function is being specialized, but
the callsite inside the JS_TO_WASM function was patched to call an
interpreter entry instead. We would not identify the call site as the
one to be patched during specialization, and would thus fail a DCHECK.

R=ahaas@chromium.org
BUG=v8:5822, chromium:702839

Change-Id: I148d98333051c399a4cb11bd9620b396f4eb261d
Reviewed-on: https://chromium-review.googlesource.com/456282
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43942}

src/wasm/wasm-code-specialization.cc

@@ -61,6 +61,7 @@ bool IsAtWasmDirectCallTarget(RelocIterator& it) {
   Code* code = Code::GetCodeFromTargetAddress(it.rinfo()->target_address());
   return code->kind() == Code::WASM_FUNCTION ||
          code->kind() == Code::WASM_TO_JS_FUNCTION ||
+         code->kind() == Code::WASM_INTERPRETER_ENTRY ||
          code->builtin_index() == Builtins::kIllegal ||
          code->builtin_index() == Builtins::kWasmCompileLazy;
 }

test/mjsunit/regress/wasm/regression-702839.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function __f_0() {
+  "use asm";
+  function __f_1() { }
+  return {__f_1: __f_1};
+}
+__f_0();
+__f_0();