[wasm] Fix WasmInstanceWrapper allocation.

src/wasm/wasm-objects.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/wasm/wasm-objects.h"
 
 #include "src/wasm/module-decoder.h"
 #include "src/wasm/wasm-module.h"
 #include "src/wasm/wasm-text.h"
 
@@ skipping 189 matching lines @@
 }
 
 WasmMemoryObject* WasmMemoryObject::cast(Object* object) {
   DCHECK(object && object->IsJSObject());
   // TODO(titzer): brand check for WasmMemoryObject.
   return reinterpret_cast<WasmMemoryObject*>(object);
 }
 
 void WasmMemoryObject::AddInstance(Isolate* isolate,
                                    Handle<WasmInstanceObject> instance) {
-  Handle<WasmInstanceWrapper> instance_wrapper;
+  Handle<WasmInstanceWrapper> instance_wrapper =
+      handle(instance->get_instance_wrapper());
   if (has_instances_link()) {
     Handle<WasmInstanceWrapper> current_wrapper(get_instances_link());
     DCHECK(WasmInstanceWrapper::IsWasmInstanceWrapper(*current_wrapper));
     DCHECK(!current_wrapper->has_previous());
-    instance_wrapper = WasmInstanceWrapper::New(isolate, instance);
     instance_wrapper->set_next_wrapper(*current_wrapper);
     current_wrapper->set_previous_wrapper(*instance_wrapper);
-  } else {
-    instance_wrapper = WasmInstanceWrapper::New(isolate, instance);
   }
   set_instances_link(*instance_wrapper);
-  instance->set_instance_wrapper(*instance_wrapper);
 }
 
 void WasmMemoryObject::ResetInstancesLink(Isolate* isolate) {
   Handle<Object> undefined = isolate->factory()->undefined_value();
   SetInternalField(kInstancesLink, *undefined);
 }
 
 DEFINE_ACCESSORS(WasmInstanceObject, compiled_module, kCompiledModule,
                  WasmCompiledModule)
 DEFINE_OPTIONAL_ACCESSORS(WasmInstanceObject, globals_buffer,
@@ skipping 47 matching lines @@
     Isolate* isolate, Handle<WasmCompiledModule> compiled_module) {
   Handle<Map> map = isolate->factory()->NewMap(
       JS_OBJECT_TYPE, JSObject::kHeaderSize + kFieldCount * kPointerSize);
   Handle<WasmInstanceObject> instance(
       reinterpret_cast<WasmInstanceObject*>(
           *isolate->factory()->NewJSObjectFromMap(map, TENURED)),
       isolate);
 
   instance->SetInternalField(kCompiledModule, *compiled_module);
   instance->SetInternalField(kMemoryObject, isolate->heap()->undefined_value());
+  Handle<WasmInstanceWrapper> instance_wrapper =
+      WasmInstanceWrapper::New(isolate, instance);
+  instance->SetInternalField(kWasmMemInstanceWrapper, *instance_wrapper);
   return instance;
 }
 
 WasmInstanceObject* WasmExportedFunction::instance() {
   return WasmInstanceObject::cast(GetInternalField(kInstance));
 }
 
 int WasmExportedFunction::function_index() {
   return SafeInt32(GetInternalField(kIndex));
 }
@@ skipping 284 matching lines @@
       !array->get(kPreviousInstanceWrapper)->IsFixedArray())
     return false;
   return true;
 }
 
 void WasmInstanceWrapper::set_instance_object(Handle<JSObject> instance,
                                               Isolate* isolate) {
   Handle<WeakCell> cell = isolate->factory()->NewWeakCell(instance);
   set(kWrapperInstanceObject, *cell);
 }