[runtime] Fix call-site rendering for inlined calls.

This makes sure call-site rendering for certain {TypeError} messages is
based on the correct underlying {JSFunction}, even when inlined frames
are present. Only the {FrameSummary} knows the exact function.

R=verwaest@chromium.org
TEST=message/regress/regress-crbug-661579
BUG=chromium:661579

Review-Url: https://codereview.chromium.org/2521103005
Cr-Commit-Position: refs/heads/master@{#41264}

src/runtime/runtime-internal.cc

@@ -365,20 +365,19 @@ namespace {
 bool ComputeLocation(Isolate* isolate, MessageLocation* target) {
   JavaScriptFrameIterator it(isolate);
   if (!it.done()) {
-    JavaScriptFrame* frame = it.frame();
-    JSFunction* fun = frame->function();
-    Object* script = fun->shared()->script();
-    if (script->IsScript() &&
-        !(Script::cast(script)->source()->IsUndefined(isolate))) {
-      Handle<Script> casted_script(Script::cast(script), isolate);
     // Compute the location from the function and the relocation info of the
     // baseline code. For optimized code this will use the deoptimization
     // information to get canonical location information.
     List<FrameSummary> frames(FLAG_max_inlining_levels + 1);
     it.frame()->Summarize(&frames);
     FrameSummary& summary = frames.last();
+    Handle<JSFunction> function = summary.function();
+    Handle<Object> script(function->shared()->script(), isolate);
     int pos = summary.abstract_code()->SourcePosition(summary.code_offset());
-      *target = MessageLocation(casted_script, pos, pos + 1, handle(fun));
+    if (script->IsScript() &&
+        !(Handle<Script>::cast(script)->source()->IsUndefined(isolate))) {
+      Handle<Script> casted_script = Handle<Script>::cast(script);
+      *target = MessageLocation(casted_script, pos, pos + 1, function);
       return true;
     }
   }

test/message/regress/regress-crbug-661579.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = {};
+function foo() {
+  a.push();
+}
+function bar() {
+  foo();
+}
+bar();

test/message/regress/regress-crbug-661579.out

+# Copyright 2016 the V8 project authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+*%(basename)s:7: TypeError: a.push is not a function
+  a.push();
+    ^
+TypeError: a.push is not a function
+    at foo (*%(basename)s:7:5)
+    at bar (*%(basename)s:10:3)
+    at *%(basename)s:12:1