[web snap] Enable context referring to function

Bug: v8:11525,v8:12820
Change-Id: Ic4cd3172a4d6884b8234ca6b6463dfc405e10ba1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3652793
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80672}

src/web-snapshot/web-snapshot.cc

@@ -3071,8 +3071,7 @@ std::tuple<Object, bool> WebSnapshotDeserializer::ReadObject(
 std::tuple<Object, bool> WebSnapshotDeserializer::ReadFunction(
     Handle<HeapObject> container, uint32_t index) {
   uint32_t function_id;
-  if (!deserializer_.ReadUint32(&function_id) ||
-      function_id >= function_count_) {
+  if (!deserializer_.ReadUint32(&function_id)) {
     Throw("Malformed object property");
     return std::make_tuple(Smi::zero(), false);
   }

test/mjsunit/web-snapshot/web-snapshot-5.js

@@ -143,3 +143,14 @@ d8.file.execute('test/mjsunit/web-snapshot/web-snapshot-helpers.js');
   assertEquals(35, f1());
   assertEquals(-20, f2());
 })();
+
+(function TestContextReferringToFunction() {
+  function createObjects() {
+    (function outer() {
+      let a = function() { return 10; }
+      globalThis.f = function() { return a(); };
+    })();
+  }
+  const {f} = takeAndUseWebSnapshot(createObjects, ['f']);
+  assertEquals(10, f());
+})();