[cleanup] Iterate WasmFrame and TypedFrame

This CL:
- Separates Wasm frame pointer iteration from TypedFrame iteration
- Introduces the frame StubWithContext that correspond to a TF-optimized
code without JS linkage
- Fixes WasmToJsFrame to be a WasmFrame
- Fixes the hack with JsToWasmFrame that calls TypedFrame when not
the right builtin
- Cleans up TypedFrame::Iterate

Change-Id: Ie238df5188f2e2f081f5353b4538b75b6e79f64a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3859787Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82809}

src/execution/frames-inl.h

@@ -220,6 +220,10 @@ inline Object JavaScriptFrame::function_slot_object() const {
   return Object(base::Memory<Address>(fp() + offset));
 }
 
+inline TurbofanStubWithContextFrame::TurbofanStubWithContextFrame(
+    StackFrameIteratorBase* iterator)
+    : CommonFrame(iterator) {}
+
 inline StubFrame::StubFrame(StackFrameIteratorBase* iterator)
     : TypedFrame(iterator) {}
 
@@ -256,7 +260,7 @@ inline WasmDebugBreakFrame::WasmDebugBreakFrame(
     : TypedFrame(iterator) {}
 
 inline WasmToJsFrame::WasmToJsFrame(StackFrameIteratorBase* iterator)
-    : StubFrame(iterator) {}
+    : WasmFrame(iterator) {}
 
 inline JsToWasmFrame::JsToWasmFrame(StackFrameIteratorBase* iterator)
     : StubFrame(iterator) {}

src/execution/frames.h

@@ -28,6 +28,7 @@
 //       - BuiltinFrame
 //       - JavaScriptBuiltinContinuationFrame
 //         - JavaScriptBuiltinContinuationWithCatchFrame
+//   - TurbofanStubWithContextFrame
 //   - TypedFrame
 //     - NativeFrame
 //     - EntryFrame
@@ -42,6 +43,7 @@
 //       - BuiltinContinuationFrame
 //     - WasmFrame
 //       - WasmExitFrame
+//       - WasmToJsFrame
 //     - WasmDebugBreakFrame
 //     - WasmCompileLazyFrame
 //
@@ -114,6 +116,7 @@ class StackHandler {
   V(MAGLEV, MaglevFrame)                                                  \
   V(TURBOFAN, TurbofanFrame)                                              \
   V(STUB, StubFrame)                                                      \
+  V(TURBOFAN_STUB_WITH_CONTEXT, TurbofanStubWithContextFrame)             \
   V(BUILTIN_CONTINUATION, BuiltinContinuationFrame)                       \
   V(JAVA_SCRIPT_BUILTIN_CONTINUATION, JavaScriptBuiltinContinuationFrame) \
   V(JAVA_SCRIPT_BUILTIN_CONTINUATION_WITH_CATCH,                          \
@@ -503,6 +506,8 @@ class CommonFrame : public StackFrame {
   inline void SetExpression(int index, Object value);
   int ComputeExpressionsCount() const;
 
+  bool HasTaggedOutgoingParams(CodeLookupResult& code_lookup) const;
+
   Address GetCallerStackPointer() const override;
 
   // Build a list with summaries for this frame including all inlined frames.
@@ -536,6 +541,8 @@ class CommonFrame : public StackFrame {
   // and parts of the fixed part including context and code fields.
   void IterateExpressions(RootVisitor* v) const;
 
+  void IterateTurbofanOptimizedFrame(RootVisitor* v) const;
+
   // Returns the address of the n'th expression stack element.
   virtual Address GetExpressionAddress(int n) const;
 
@@ -544,6 +551,23 @@ class CommonFrame : public StackFrame {
   friend class SafeStackFrameIterator;
 };
 
+// This frame is used for TF-optimized code without JS linkage, but
+// contains the context instead of a type marker.
+class TurbofanStubWithContextFrame : public CommonFrame {
+ public:
+  Type type() const override { return TURBOFAN_STUB_WITH_CONTEXT; }
+
+  HeapObject unchecked_code() const override;
+  void Iterate(RootVisitor* v) const override;
+
+ protected:
+  inline explicit TurbofanStubWithContextFrame(
+      StackFrameIteratorBase* iterator);
+
+ private:
+  friend class StackFrameIteratorBase;
+};
+
 class TypedFrame : public CommonFrame {
  public:
   HeapObject unchecked_code() const override { return {}; }
@@ -956,7 +980,6 @@ class TurbofanFrame : public OptimizedFrame {
   Type type() const override { return TURBOFAN; }
 
   int ComputeParametersCount() const override;
-  bool HasTaggedOutgoingParams(CodeLookupResult& code_lookup) const;
 
   void Iterate(RootVisitor* v) const override;
 
@@ -1004,6 +1027,8 @@ class WasmFrame : public TypedFrame {
   // Lookup exception handler for current {pc}, returns -1 if none found.
   int LookupExceptionHandlerInTable();
 
+  void Iterate(RootVisitor* v) const override;
+
   // Accessors.
   V8_EXPORT_PRIVATE WasmInstanceObject wasm_instance() const;
   V8_EXPORT_PRIVATE wasm::NativeModule* native_module() const;
@@ -1067,7 +1092,7 @@ class WasmDebugBreakFrame final : public TypedFrame {
   friend class StackFrameIteratorBase;
 };
 
-class WasmToJsFrame : public StubFrame {
+class WasmToJsFrame : public WasmFrame {
  public:
   Type type() const override { return WASM_TO_JS; }
 

tools/v8heapconst.py

@@ -595,6 +595,7 @@ FRAME_MARKERS = (
   "MAGLEV",
   "TURBOFAN",
   "STUB",
+  "TURBOFAN_STUB_WITH_CONTEXT",
   "BUILTIN_CONTINUATION",
   "JAVA_SCRIPT_BUILTIN_CONTINUATION",
   "JAVA_SCRIPT_BUILTIN_CONTINUATION_WITH_CATCH",