[compiler] Skip interpreter trampoline copy for asm.js

Bug: chromium:1078913
Change-Id: Ibdd87455797ea2ed4aa6072523352a0c3fbaf844
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2190412
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67677}

src/codegen/compiler.cc

@@ -393,7 +393,10 @@ bool UseAsmWasm(FunctionLiteral* literal, bool asm_wasm_broken) {
 void InstallInterpreterTrampolineCopy(Isolate* isolate,
                                       Handle<SharedFunctionInfo> shared_info) {
   DCHECK(FLAG_interpreted_frames_native_stack);
-  DCHECK(shared_info->function_data().IsBytecodeArray());
+  if (!shared_info->function_data().IsBytecodeArray()) {
+    DCHECK(!shared_info->HasBytecodeArray());
+    return;
+  }
   Handle<BytecodeArray> bytecode_array(shared_info->GetBytecodeArray(),
                                        isolate);
 
@@ -1002,8 +1005,6 @@ void FinalizeUnoptimizedCompilation(
   bool need_source_positions = FLAG_stress_lazy_source_positions ||
                                (!flags.collect_source_positions() &&
                                 isolate->NeedsSourcePositionsForProfiling());
-  bool need_interpreter_trampoline_copies =
-      FLAG_interpreted_frames_native_stack;
 
   for (const auto& finalize_data : finalize_unoptimized_compilation_data_list) {
     Handle<SharedFunctionInfo> shared_info =
@@ -1013,7 +1014,7 @@ void FinalizeUnoptimizedCompilation(
     if (need_source_positions) {
       SharedFunctionInfo::EnsureSourcePositionsAvailable(isolate, shared_info);
     }
-    if (need_interpreter_trampoline_copies) {
+    if (FLAG_interpreted_frames_native_stack) {
       InstallInterpreterTrampolineCopy(isolate, shared_info);
     }
 

test/mjsunit/mjsunit.status

@@ -391,6 +391,7 @@
 
   # Flag --interpreted-frames-native-stack incompatible with jitless
   'regress/regress-10138': [SKIP],
+  'regress/regress-1078913': [SKIP],
 }],  # 'lite_mode or variant == jitless'
 
 ##############################################################################

test/mjsunit/regress/regress-1078913.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --interpreted-frames-native-stack
+
+// Make sure that the interpreted trampoline copy (for native interpreter frames
+// in stack traces) works for interperted functions but doesn't crash for asm.js
+
+function func() {
+  return;
+}
+
+function asm_func() {
+  "use asm";
+  function f(){}
+  return {f:f};
+}
+
+function failed_asm_func() {
+  "use asm";
+  // This should fail validation
+  [x,y,z] = [1,2,3];
+  return;
+}
+
+func();
+asm_func();
+failed_asm_func();