[wasm] Do not unregister an ArrayBuffer if it is already external

src/wasm/wasm-module.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <memory>
 
 #include "src/asmjs/asm-js.h"
 #include "src/assembler-inl.h"
 #include "src/base/atomic-utils.h"
 #include "src/code-stubs.h"
@@ skipping 837 matching lines @@
                                              void* backing_store, size_t size,
                                              bool is_external,
                                              bool enable_guard_regions) {
   Handle<JSArrayBuffer> buffer = isolate->factory()->NewJSArrayBuffer();
   JSArrayBuffer::Setup(buffer, isolate, is_external, backing_store,
                        static_cast<int>(size));
   buffer->set_is_neuterable(false);
   buffer->set_is_wasm_buffer(true);
   buffer->set_has_guard_region(enable_guard_regions);
 
-  if (is_external) {
+  if (enable_guard_regions) {
     // We mark the buffer as external if we allocated it here with guard
     // pages. That means we need to arrange for it to be freed.
 
     // TODO(eholk): Finalizers may not run when the main thread is shutting
     // down, which means we may leak memory here.
     Handle<Object> global_handle = isolate->global_handles()->Create(*buffer);
     GlobalHandles::MakeWeak(global_handle.location(), global_handle.location(),
                             &MemoryFinalizer, v8::WeakCallbackType::kFinalizer);
   }
   return buffer;
@@ skipping 1355 matching lines @@
       WasmInstanceObject::cast(*instance)->compiled_module();
   return handle(compiled_module->script());
 }
 
 bool wasm::IsWasmCodegenAllowed(Isolate* isolate, Handle<Context> context) {
   return isolate->allow_code_gen_callback() == nullptr ||
          isolate->allow_code_gen_callback()(v8::Utils::ToLocal(context));
 }
 
 void wasm::DetachWebAssemblyMemoryBuffer(Isolate* isolate,
-                                         Handle<JSArrayBuffer> buffer) {
+                                         Handle<JSArrayBuffer> buffer,
+                                         bool free_memory) {
   int64_t byte_length =
       buffer->byte_length()->IsNumber()
           ? static_cast<uint32_t>(buffer->byte_length()->Number())
           : 0;
   if (buffer.is_null() || byte_length == 0) return;
   const bool has_guard_regions = buffer->has_guard_region();
   const bool is_external = buffer->is_external();
   void* backing_store = buffer->backing_store();
   DCHECK(!buffer->is_neuterable());
   if (!has_guard_regions && !is_external) {
     buffer->set_is_external(true);
     isolate->heap()->UnregisterArrayBuffer(*buffer);
   }
   buffer->set_is_neuterable(true);
   buffer->Neuter();
+  // Neuter but do not free, as when pages == 0, the backing store is being used
+  // by the new buffer.
+  if (!free_memory) return;
   if (has_guard_regions) {
     base::OS::Free(backing_store, RoundUp(i::wasm::kWasmMaxHeapOffset,
                                           base::OS::CommitPageSize()));
     reinterpret_cast<v8::Isolate*>(isolate)
         ->AdjustAmountOfExternalAllocatedMemory(-byte_length);
   } else if (!has_guard_regions && !is_external) {
     isolate->array_buffer_allocator()->Free(backing_store, byte_length);
   }
 }
 
@@ skipping 1094 matching lines @@
                                      callee_compiled->instruction_start());
     }
     DCHECK_EQ(non_compiled_functions.size(), idx);
   }
 
   Code* ret =
       Code::cast(compiled_module->code_table()->get(func_to_return_idx));
   DCHECK_EQ(Code::WASM_FUNCTION, ret->kind());
   return handle(ret, isolate);
 }