[wasm] Fix WebAssembly.Table#get for constructed functions.

This fixes the case where a table entry contains a function constructed
via {WebAssembly.Function} and is then read out via a runtime function
from the table.

R=ahaas@chromium.org
TEST=mjsunit/regress/wasm/regress-crbug-1002388
BUG=chromium:1002388

Change-Id: Ic0a9a544baaf37e68cd22eb91f2ef0bdf5fa5842
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1795352Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63709}

src/wasm/wasm-objects.cc

@@ -946,6 +946,7 @@ Handle<Object> WasmTableObject::Get(Isolate* isolate,
 
   // Now we handle the funcref case.
   if (WasmExportedFunction::IsWasmExportedFunction(*entry) ||
+      WasmJSFunction::IsWasmJSFunction(*entry) ||
       WasmCapiFunction::IsWasmCapiFunction(*entry)) {
     return entry;
   }

test/mjsunit/regress/wasm/regress-crbug-1002388.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --experimental-wasm-type-reflection
+
+(function TestTableSetAndGetFunction() {
+  let func = new WebAssembly.Function({ parameters: [], results: [] }, x => x);
+  let table = new WebAssembly.Table({ element: "anyfunc", initial: 1 });
+  table.set(0, func);
+  table.get(0);
+})();

test/mjsunit/wasm/type-reflection-with-anyref.js

@@ -71,17 +71,23 @@ load('test/mjsunit/wasm/wasm-module-builder.js');
 
   // Test table #0 first.
   assertEquals(v1, instance.exports.call0(0));
+  assertSame(f1, table.get(0));
   table.set(1, f2);
   assertEquals(v2, instance.exports.call0(1));
+  assertSame(f2, table.get(1));
   table.set(1, f3);
   assertTraps(kTrapFuncSigMismatch, () => instance.exports.call0(1));
+  assertSame(f3, table.get(1));
 
   // Test table #1 next.
   assertTraps(kTrapFuncSigMismatch, () => instance.exports.call1(0));
   instance.exports.tbl.set(0, f1);
   assertEquals(v1, instance.exports.call1(0));
+  assertSame(f1, instance.exports.tbl.get(0));
   instance.exports.tbl.set(0, f2);
   assertEquals(v2, instance.exports.call1(0));
+  assertSame(f2, instance.exports.tbl.get(0));
   instance.exports.tbl.set(0, f3);
   assertTraps(kTrapFuncSigMismatch, () => instance.exports.call1(0));
+  assertSame(f3, instance.exports.tbl.get(0));
 })();