[maglev] Properly iterate ML frames during tierup

.. at which time, the standard ML frame is not yet set up. Instead, an
INTERNAL frame with a few fixed tagged stack slots is created in
preparation for the runtime call in GenerateTailCallToReturnedCode.

Bug: v8:7700
Fixed: v8:13192
Change-Id: Icd7adbc25aa6a5446a43a0fb3ee70c65ee33cc5d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3835683
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82533}

src/execution/frames.cc

@@ -715,6 +715,14 @@ StackFrame::Type StackFrame::ComputeType(const StackFrameIteratorBase* iterator,
         case CodeKind::BASELINE:
           return BASELINE;
         case CodeKind::MAGLEV:
+          if (IsTypeMarker(marker)) {
+            // An INTERNAL frame can be set up with an associated Maglev code
+            // object when calling into runtime to handle tiering. In this case,
+            // all stack slots are tagged pointers and should be visited through
+            // the usual logic.
+            DCHECK_EQ(MarkerToType(marker), StackFrame::INTERNAL);
+            return StackFrame::INTERNAL;
+          }
           return MAGLEV;
         case CodeKind::TURBOFAN:
           return TURBOFAN;