[snapshot] print reference stack for JSFunctions in the isolate snapshot

This helps debugging incorrect usage of the SnapshotCreator API in
debug mode.

Change-Id: Ibd9db76a5f460cdf7ea6d14e865592ebaf69aeef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648240Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62095}

src/snapshot/serializer.cc

@@ -115,10 +115,12 @@ void Serializer::SerializeRootObject(Object object) {
 }
 
 #ifdef DEBUG
-void Serializer::PrintStack() {
+void Serializer::PrintStack() { PrintStack(std::cout); }
+
+void Serializer::PrintStack(std::ostream& out) {
   for (const auto o : stack_) {
-    o.Print();
-    PrintF("\n");
+    o.Print(out);
+    out << "\n";
   }
 }
 #endif  // DEBUG

src/snapshot/serializer.h

@@ -250,6 +250,7 @@ class Serializer : public SerializerDeserializer {
   void PushStack(HeapObject o) { stack_.push_back(o); }
   void PopStack() { stack_.pop_back(); }
   void PrintStack();
+  void PrintStack(std::ostream&);
 #endif  // DEBUG
 
   SerializerReferenceMap* reference_map() { return &reference_map_; }

src/snapshot/startup-serializer.cc

@@ -71,7 +71,16 @@ bool IsUnexpectedCodeObject(Isolate* isolate, HeapObject obj) {
 #endif  // DEBUG
 
 void StartupSerializer::SerializeObject(HeapObject obj) {
-  DCHECK(!obj.IsJSFunction());
+#ifdef DEBUG
+  if (obj.IsJSFunction()) {
+    v8::base::OS::PrintError("Reference stack:\n");
+    PrintStack(std::cerr);
+    obj.Print(std::cerr);
+    FATAL(
+        "JSFunction should be added through the context snapshot instead of "
+        "the isolate snapshot");
+  }
+#endif  // DEBUG
   DCHECK(!IsUnexpectedCodeObject(isolate(), obj));
 
   if (SerializeHotObject(obj)) return;