[wasm] Copy the signature when compiling an imported function.

src/wasm/wasm-module.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/base/atomic-utils.h"
 #include "src/macro-assembler.h"
 #include "src/objects.h"
 #include "src/property-descriptor.h"
 #include "src/v8.h"
 
@@ skipping 630 matching lines @@
       CHECK(ret_count >= 0);
       Handle<ByteArray> sig_data = data->GetValueChecked<ByteArray>(kSignature);
       int sig_data_size = sig_data->length();
       int param_count = sig_data_size - ret_count;
       CHECK(param_count >= 0);
 
       MaybeHandle<JSFunction> function = LookupFunction(
           *thrower, isolate->factory(), ffi, index, module_name, function_name);
       if (function.is_null()) return false;
 
-      FunctionSig sig(
-          ret_count, param_count,
-          reinterpret_cast<const MachineRepresentation*>(sig_data->data()));
+      {
+        // Copy the signature to avoid a raw pointer into a heap object when
+        // GC can happen.
+        Zone zone(isolate->allocator());
+        MachineRepresentation* reps =
+            zone.NewArray<MachineRepresentation>(sig_data_size);
+        memcpy(reps, sig_data->data(),
+               sizeof(MachineRepresentation) * sig_data_size);
+        FunctionSig sig(ret_count, param_count, reps);
 
-      Handle<Code> code = compiler::CompileWasmToJSWrapper(
-          isolate, function.ToHandleChecked(), &sig, index, module_name,
-          function_name);
+        Handle<Code> code = compiler::CompileWasmToJSWrapper(
+            isolate, function.ToHandleChecked(), &sig, index, module_name,
+            function_name);
 
-      imports.push_back(code);
+        imports.push_back(code);
+      }
     }
   }
   return true;
 }
 
 void InitializeParallelCompilation(
     Isolate* isolate, const std::vector<WasmFunction>& functions,
     std::vector<compiler::WasmCompilationUnit*>& compilation_units,
     ModuleEnv& module_env, ErrorThrower& thrower) {
   for (uint32_t i = FLAG_skip_compiling_wasm_funcs; i < functions.size(); ++i) {
@@ skipping 716 matching lines @@
     return static_cast<int32_t>(HeapNumber::cast(*result)->value());
   }
   thrower.Error("WASM.compileRun() failed: Return value should be number");
   return -1;
 }
 
 }  // namespace testing
 }  // namespace wasm
 }  // namespace internal
 }  // namespace v8