[wasm] Update WasmMemoryObject correctly when module memory is exported.

BUG=chromium:670683

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2548223002
Cr-Commit-Position: refs/heads/master@{#41603}

src/wasm/wasm-module.cc

@@ -1221,11 +1221,6 @@ class WasmInstanceBuilder {
       LoadDataSegments(nullptr, 0);
     }
 
-    DCHECK(wasm::IsWasmInstance(*instance));
-    if (instance->has_memory_object()) {
-      instance->get_memory_object()->AddInstance(isolate_, instance);
-    }
-
     //--------------------------------------------------------------------------
     // Set up the runtime support for the new instance.
     //--------------------------------------------------------------------------
@@ -1248,6 +1243,14 @@ class WasmInstanceBuilder {
     //--------------------------------------------------------------------------
     ProcessExports(code_table, instance);
 
+    //--------------------------------------------------------------------------
+    // Add instance to Memory object
+    //--------------------------------------------------------------------------
+    DCHECK(wasm::IsWasmInstance(*instance));
+    if (instance->has_memory_object()) {
+      instance->get_memory_object()->AddInstance(isolate_, instance);
+    }
+
     //--------------------------------------------------------------------------
     // Set up the indirect function tables for the new instance.
     //--------------------------------------------------------------------------
@@ -1293,6 +1296,7 @@ class WasmInstanceBuilder {
       }
     }
 
+    //--------------------------------------------------------------------------
     // Set up and link the new instance.
     //--------------------------------------------------------------------------
     {

test/mjsunit/regress/wasm/regression-670683.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+const bytes = new Uint8Array([
+  0x00, 0x61, 0x73, 0x6d, 0x0d, 0x00, 0x00, 0x00,
+  0x01, 0x05, 0x01, 0x60, 0x00, 0x01, 0x7f, 0x03,
+  0x02, 0x01, 0x00, 0x05, 0x03, 0x01, 0x00, 0x01,
+  0x07, 0x11, 0x02, 0x04, 0x67, 0x72, 0x6f, 0x77,
+  0x00, 0x00, 0x06, 0x6d, 0x65, 0x6d, 0x6f, 0x72,
+  0x79, 0x02, 0x00, 0x0a, 0x07, 0x01, 0x05, 0x00,
+  0x41, 0x01, 0x40, 0x00]);
+
+WebAssembly.compile(bytes).then(
+    m => new WebAssembly.Instance(m).exports.grow());

test/mjsunit/wasm/import-memory.js

@@ -366,3 +366,21 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
     verify_mem_size(++current_mem_size);
   }
 })();
+
+(function TestExportGrow() {
+  print("TestExportGrow");
+  let builder = new WasmModuleBuilder();
+  builder.addMemory(1, 5, true);
+  builder.exportMemoryAs("exported_mem");
+  builder.addFunction("mem_size", kSig_i_v)
+    .addBody([kExprMemorySize, kMemoryZero])
+    .exportFunc();
+  builder.addFunction("grow", kSig_i_i)
+    .addBody([kExprGetLocal, 0, kExprGrowMemory, kMemoryZero])
+    .exportFunc();
+  instance = builder.instantiate();
+  assertEquals(kPageSize, instance.exports.exported_mem.buffer.byteLength);
+  assertEquals(1, instance.exports.grow(2));
+  assertEquals(3, instance.exports.mem_size());
+  assertEquals(3*kPageSize, instance.exports.exported_mem.buffer.byteLength);
+})();