Serializer: correctly deal with internal references.

test/cctest/test-serialize.cc

 // Copyright 2007-2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1485 matching lines @@
     {
       DisallowCompilation no_compile(reinterpret_cast<Isolate*>(isolate2));
       script = v8::ScriptCompiler::CompileUnbound(
           isolate2, &source, v8::ScriptCompiler::kConsumeCodeCache);
     }
     v8::Local<v8::Value> result = script->BindToCurrentContext()->Run();
     CHECK(result->ToString(isolate2)->Equals(v8_str("XY")));
   }
   isolate2->Dispose();
 }
+
+
+TEST(SerializeInternalReference) {
+  // Disable experimental natives that are loaded after deserialization.
+  FLAG_harmony_shipping = false;
+  FLAG_turbo_asm = true;
+  FLAG_turbo_deoptimization = false;
+  FLAG_context_specialization = false;
+  FLAG_allow_natives_syntax = true;
+  FlagList::EnforceFlagImplications();
+
+  const char* source =
+      "var foo = (function(stdlib, foreign, heap) {"
+      "  'use asm';"

[Michael Starzinger, 2015/03/04 13:43:50]

As discussed offline: I don't think we want to trigger TurboFan with this
directive, because what we want to test here is not serialization of asm code
but is serialization of non-context-specialized TurboFan code. So we should try
to use the regular --turbo-filter=foo approach here.

+      "  function foo(i) {"
+      "    i = i|0;"
+      "    var j = 0;"
+      "    switch (i) {"
+      "      case 0:"
+      "      case 1: j = 1; break;"
+      "      case 2:"
+      "      case 3: j = 2; break;"
+      "      case 4:"
+      "      case 5: j = 3; break;"
+      "      default: j = 0; break;"
+      "    }"
+      "    return j|0;"
+      "  }"
+      "  return { foo: foo };"
+      "})(this, {}, undefined).foo;"
+      "foo(1);"
+      "%DebugPrint(foo);";
+
+  v8::StartupData data = v8::V8::CreateSnapshotDataBlob(source);
+  CHECK(data.data);
+
+  v8::Isolate::CreateParams params;
+  params.snapshot_blob = &data;
+  v8::Isolate* isolate = v8::Isolate::New(params);
+  {
+    v8::Isolate::Scope i_scope(isolate);
+    v8::HandleScope h_scope(isolate);
+    v8::Local<v8::Context> context = v8::Context::New(isolate);
+    delete[] data.data;  // We can dispose of the snapshot blob now.
+    v8::Context::Scope c_scope(context);
+    CHECK_EQ(3, CompileRun("foo(4)")->ToInt32(isolate)->Int32Value());
+  }
+  isolate->Dispose();
+}