Reland "[heap] Track length for array buffers to avoid free-ing dependency"

src/heap/array-buffer-tracker.cc

Index: src/heap/array-buffer-tracker.cc
diff --git a/src/heap/array-buffer-tracker.cc b/src/heap/array-buffer-tracker.cc
index 65bf3ec61e87322e22bb7aa320d92a4d521ae303..ed09f62962ddfd00ca30b49cea99598b747d3e76 100644
--- a/src/heap/array-buffer-tracker.cc
+++ b/src/heap/array-buffer-tracker.cc
@@ -18,10 +18,10 @@ void LocalArrayBufferTracker::Free() {
   size_t freed_memory = 0;
   for (TrackingData::iterator it = array_buffers_.begin();
        it != array_buffers_.end();) {
-    JSArrayBuffer* buffer = reinterpret_cast<JSArrayBuffer*>(*it);
+    JSArrayBuffer* buffer = reinterpret_cast<JSArrayBuffer*>(it->first);
     if ((free_mode == kFreeAll) ||
         Marking::IsWhite(Marking::MarkBitFrom(buffer))) {
-      const size_t len = NumberToSize(heap_->isolate(), buffer->byte_length());
+      const size_t len = it->second;
       heap_->isolate()->array_buffer_allocator()->Free(buffer->backing_store(),
                                                        len);
       freed_memory += len;
@@ -42,7 +42,7 @@ void LocalArrayBufferTracker::Process(Callback callback) {
   size_t freed_memory = 0;
   for (TrackingData::iterator it = array_buffers_.begin();
        it != array_buffers_.end();) {
-    const CallbackResult result = callback(*it, &new_buffer);
+    const CallbackResult result = callback(it->first, &new_buffer);
     if (result == kKeepEntry) {
       ++it;
     } else if (result == kUpdateEntry) {
@@ -57,13 +57,13 @@ void LocalArrayBufferTracker::Process(Callback callback) {
         tracker = target_page->local_tracker();
       }
       DCHECK_NOT_NULL(tracker);
-      tracker->Add(new_buffer);
+      tracker->Add(new_buffer, it->second);
       if (target_page->InNewSpace()) target_page->mutex()->Unlock();
       it = array_buffers_.erase(it);
     } else if (result == kRemoveEntry) {
-      const size_t len = NumberToSize(heap_->isolate(), (*it)->byte_length());
-      heap_->isolate()->array_buffer_allocator()->Free((*it)->backing_store(),
-                                                       len);
+      const size_t len = it->second;
+      heap_->isolate()->array_buffer_allocator()->Free(
+          it->first->backing_store(), len);
       freed_memory += len;
       it = array_buffers_.erase(it);
     } else {