[wasm] Do not unregister an ArrayBuffer if it is already external

test/cctest/wasm/test-run-wasm-module.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdlib.h>
 #include <string.h>
 
 #include "src/objects-inl.h"
 #include "src/snapshot/code-serializer.h"
 #include "src/version.h"
@@ skipping 1094 matching lines @@
 
     // TODO(eholk): Skipping calls to externalize when guard pages are enabled
     // for now. This will have to be dealt with when turning on guard pages as
     // currently gin assumes that it can take ownership of the ArrayBuffer.
     // Potential for crashes as this might lead to externalizing an already
     // externalized buffer.
     if (!memory->has_guard_region()) v8::Utils::ToLocal(memory)->Externalize();
     void* backing_store = memory->backing_store();
     uint64_t byte_length = NumberToSize(memory->byte_length());
     uint32_t result = WasmMemoryObject::Grow(isolate, mem_obj, 4);
+    wasm::DetachWebAssemblyMemoryBuffer(isolate, memory, true);
     CHECK_EQ(16, result);
     if (!memory->has_guard_region()) {
       isolate->array_buffer_allocator()->Free(backing_store, byte_length);
     }
     memory = handle(mem_obj->buffer());
     byte_length = NumberToSize(memory->byte_length());
     instance->set_memory_buffer(*memory);
     // Externalize should make no difference without the JS API as in this case
     // the buffer is not detached.
     if (!memory->has_guard_region()) v8::Utils::ToLocal(memory)->Externalize();
     result = testing::RunWasmModuleForTesting(isolate, instance, 0, nullptr,
                                               ModuleOrigin::kWasmOrigin);
     CHECK_EQ(kExpectedValue, result);
     // Free the buffer as the tracker does not know about it.
     if (!memory->has_guard_region()) {
       isolate->array_buffer_allocator()->Free(
           memory->backing_store(), NumberToSize(memory->byte_length()));
     }
   }
   Cleanup();
 }
+
+TEST(Run_WasmModule_Buffer_Externalized_GrowMemMemSize) {
+  {
+    Isolate* isolate = CcTest::InitIsolateOnce();
+    HandleScope scope(isolate);
+    void* backing_store =
+        isolate->array_buffer_allocator()->Allocate(16 * WasmModule::kPageSize);
+    Handle<JSArrayBuffer> buffer = wasm::SetupArrayBuffer(
+        isolate, backing_store, 16 * WasmModule::kPageSize, false, false);
+    Handle<WasmMemoryObject> mem_obj =
+        WasmMemoryObject::New(isolate, buffer, 100);
+    v8::Utils::ToLocal(buffer)->Externalize();
+    int32_t result = WasmMemoryObject::Grow(isolate, mem_obj, 0);
+    wasm::DetachWebAssemblyMemoryBuffer(isolate, buffer, false);
+    CHECK_EQ(16, result);
+
+    isolate->array_buffer_allocator()->Free(backing_store,
+                                            16 * WasmModule::kPageSize);
+  }
+  Cleanup();
+}