[wasm] Mark C_WASM_ENTRY as no tagged_params

The C_WASM_ENTRY only calls wasm code, so (outgoing) parameters of this
code are always untagged.

R=ahaas@chromium.org

Bug: v8:7049
Change-Id: I989908eea668bd56aa88f3f1744105d218584ef1
Reviewed-on: https://chromium-review.googlesource.com/758245
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49221}

src/factory.cc

@@ -1883,6 +1883,7 @@ Handle<Code> Factory::NewCode(
       code->set_marked_for_deoptimization(false);
       break;
     case Code::JS_TO_WASM_FUNCTION:
+    case Code::C_WASM_ENTRY:
     case Code::WASM_FUNCTION:
       code->set_has_tagged_params(false);
       break;

test/mjsunit/mjsunit.status

@@ -263,10 +263,7 @@
   'wasm/js-api': [SKIP],
 
   # BUG(chromium:773631): Crashes flakily.
-  'wasm/streaming-trap-location': [SKIP],
-
-  # BUG(v8:7049).
-  'wasm/interpreter-mixed': [PASS, ['arch == arm64', SKIP]],
+  'wasm/streaming-trap-location': [SKIP]
 }],  # 'gc_stress == True'
 
 ##############################################################################

test/mjsunit/regress/wasm/regress-7049.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+// Build two instances, instance 2 is interpreted, and calls instance 1 (via
+// C_WASM_ENTRY), instance 1 then calls JS, which triggers GC.
+
+let builder1 = new WasmModuleBuilder();
+
+function call_gc() {
+  print('Triggering GC.');
+  gc();
+  print('Survived GC.');
+}
+let func1_sig = makeSig(new Array(8).fill(kWasmI32), [kWasmI32]);
+let imp = builder1.addImport('q', 'gc', kSig_v_v);
+let func1 = builder1.addFunction('func1', func1_sig)
+                .addBody([
+                  kExprGetLocal, 0,  // -
+                  kExprCallFunction, imp
+                ])
+                .exportFunc();
+let instance1 = builder1.instantiate({q: {gc: call_gc}});
+
+let builder2 = new WasmModuleBuilder();
+
+let func1_imp = builder2.addImport('q', 'func1', func1_sig);
+let func2 = builder2.addFunction('func2', kSig_i_i)
+                .addBody([
+                  kExprGetLocal, 0,  // 1
+                  kExprGetLocal, 0,  // 2
+                  kExprGetLocal, 0,  // 3
+                  kExprGetLocal, 0,  // 4
+                  kExprGetLocal, 0,  // 5
+                  kExprGetLocal, 0,  // 6
+                  kExprGetLocal, 0,  // 7
+                  kExprGetLocal, 0,  // 8
+                  kExprCallFunction, func1_imp
+                ])
+                .exportFunc();
+
+let instance2 = builder2.instantiate({q: {func1: instance1.exports.func1}});
+
+%RedirectToWasmInterpreter(
+        instance2, parseInt(instance2.exports.func2.name));
+
+// Call with 1. This will be passed by the C_WASM_ENTRY via the stack, and the
+// GC will try to dereference it (before the bug fix).
+instance2.exports.func2(1);