[test] Fix a crash in fast API interface types test

This CL hardens the test facility in d8 for interface types for
the fast C API.

Bug: chromium:1201011
Change-Id: Ibfe1bb242f86b4a5edd0d195e049852430f8a2fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843344
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74079}

src/d8/d8-test.cc

@@ -122,6 +122,9 @@ class FastCApiObject {
       return false;
     }
 
+    if (!arg->IsObject()) {
+      return false;
+    }
     Object* object = Object::Cast(arg);
     if (!IsValidApiObject(object)) return false;
 
@@ -150,13 +153,15 @@ class FastCApiObject {
           "is_valid_api_object should be called with 2 arguments");
       return;
     }
-    Object* object = Object::Cast(*args[1]);
-    if (!IsValidApiObject(object)) {
-      result = false;
-    } else {
-      result = PerIsolateData::Get(args.GetIsolate())
-                   ->GetTestApiObjectCtor()
-                   ->IsLeafTemplateForApiObject(object);
+    if (args[1]->IsObject()) {
+      Object* object = Object::Cast(*args[1]);
+      if (!IsValidApiObject(object)) {
+        result = false;
+      } else {
+        result = PerIsolateData::Get(args.GetIsolate())
+                     ->GetTestApiObjectCtor()
+                     ->IsLeafTemplateForApiObject(object);
+      }
     }
 
     args.GetReturnValue().Set(Boolean::New(isolate, result));

test/mjsunit/compiler/regress-crbug-1201011.js

@@ -0,0 +1,11 @@
+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbo-fast-api-calls
+
+const fast_c_api = new d8.test.FastCAPI();
+function foo(obj) {
+  return fast_c_api.is_fast_c_api_object(false, obj);
+}
+foo();

test/mjsunit/compiler/regress-crbug-1201082.js

@@ -0,0 +1,11 @@
+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbo-fast-api-calls
+
+const fast_c_api = new d8.test.FastCAPI();
+function foo(obj) {
+  return fast_c_api.is_fast_c_api_object(false, obj);
+}
+foo(1);