[runtime] set AsyncFunctionNext/Throw to adapt arguments

Prevent crash/UB during stack frame iteration through functions, which occurs
when debugging, when building stacktraces, etc.

Also prevents these functions from appearing in stacktraces, by unsetting the "native" flag.

BUG=v8:4483, v8:5025
R=yangguo@chromium.org, littledan@chromium.org, adamk@chromium.org

Review-Url: https://codereview.chromium.org/1990803005
Cr-Commit-Position: refs/heads/master@{#36339}

src/bootstrapper.cc

@@ -2466,12 +2466,12 @@ void Bootstrapper::ExportFromRuntime(Isolate* isolate,
 
       Handle<JSFunction> async_function_next =
           SimpleInstallFunction(container, "AsyncFunctionNext",
-                                Builtins::kGeneratorPrototypeNext, 2, false);
+                                Builtins::kGeneratorPrototypeNext, 1, true);
       Handle<JSFunction> async_function_throw =
           SimpleInstallFunction(container, "AsyncFunctionThrow",
-                                Builtins::kGeneratorPrototypeThrow, 2, false);
-      async_function_next->shared()->set_native(true);
-      async_function_throw->shared()->set_native(true);
+                                Builtins::kGeneratorPrototypeThrow, 1, true);
+      async_function_next->shared()->set_native(false);
+      async_function_throw->shared()->set_native(false);
     }
   }
 }

test/mjsunit/harmony/async-debug-basic.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags:  --harmony-async-await --allow-natives-syntax --expose-debug-as debug
+
+// Get the Debug object exposed from the debug context global object.
+Debug = debug.Debug
+
+listenerComplete = false;
+breakPointCount = 0;
+
+async function f() {
+  await (async function() { var a = "a"; await 1; debugger; })();
+
+  var b = "b";
+
+  assertTrue(listenerDone);
+  assertFalse(exception);
+  assertEquals(1, breakpointCount);
+}
+
+function listener(event, exec_state, event_data, data) {
+  try {
+    if (event != Debug.DebugEvent.Break) return;
+
+    breakpointCount++;
+    listenerDone = true;
+    assertEquals("a", exec_state.frame(0).evaluate("a"));
+    assertEquals("b", exec_state.frame(1).evaluate("b"));
+    assertEquals("c", exec_state.frame(2).evaluate("c"));
+  } catch (e) {
+    exception = e;
+  };
+};
+
+Debug.setListener(listener);
+
+var c = "c";
+f();