Fix debugger's frame inspection for optimized Array.forEach.

Bug: chromium:736758
Change-Id: If49fda42618c27be1472a98399e440ad26b7f199
Reviewed-on: https://chromium-review.googlesource.com/548401
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46241}

src/deoptimizer.cc

@@ -117,7 +117,8 @@ DeoptimizedFrameInfo* Deoptimizer::DebuggerInspectableFrame(
   int counter = jsframe_index;
   for (auto it = translated_values.begin(); it != translated_values.end();
        it++) {
-    if (it->kind() == TranslatedFrame::kInterpretedFunction) {
+    if (it->kind() == TranslatedFrame::kInterpretedFunction ||
+        it->kind() == TranslatedFrame::kJavaScriptBuiltinContinuation) {
       if (counter == 0) {
         frame_it = it;
         break;
@@ -126,6 +127,9 @@ DeoptimizedFrameInfo* Deoptimizer::DebuggerInspectableFrame(
     }
   }
   CHECK(frame_it != translated_values.end());
+  // We only include kJavaScriptBuiltinContinuation frames above to get the
+  // counting right.
+  CHECK_EQ(frame_it->kind(), TranslatedFrame::kInterpretedFunction);
 
   DeoptimizedFrameInfo* info =
       new DeoptimizedFrameInfo(&translated_values, frame_it, isolate);

test/debugger/debug/debug-scopes.js

@@ -722,6 +722,33 @@ closure_9();
 EndTest();
 
 
+BeginTest("Closure passed to optimized Array.prototype.forEach");
+function closure_10(a) {
+  var x = a + 2;
+  function closure_11(b) {
+    debugger;
+    return a + b + x;
+  }
+  [42].forEach(closure_11);
+}
+
+listener_delegate = function(exec_state) {
+  CheckScopeChain([debug.ScopeType.Local,
+                   debug.ScopeType.Closure,
+                   debug.ScopeType.Script,
+                   debug.ScopeType.Global], exec_state);
+  CheckScopeContent({b:42}, 0, exec_state);
+  CheckScopeContent({a:5, x:7}, 1, exec_state);
+  CheckScopeChainNames(
+      ["closure_11", "closure_10", undefined, undefined], exec_state);
+};
+begin_test_count++; closure_10(5); end_test_count++;
+begin_test_count++; closure_10(5); end_test_count++;
+%OptimizeFunctionOnNextCall(closure_10);
+closure_10(5);
+EndTest();
+
+
 // Test a mixture of scopes.
 BeginTest("The full monty");
 function the_full_monty(a, b) {

test/debugger/regress/regress-crbug-736758.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var Debug = debug.Debug;
+
+function listener() {}
+function f() { [1,2,3].forEach(g) }
+function g() { debugger }
+
+f();
+f();
+Debug.setListener(listener);
+%OptimizeFunctionOnNextCall(f)
+f();