[wasm] Reopen CEntryStub handle in deferred scope when async compiling.

Bug: chromium:734108
Change-Id: I696b104e3b6b9dd71a60c21baa558d4f1fec1dfb
Reviewed-on: https://chromium-review.googlesource.com/541624
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46074}

src/compiler/wasm-compiler.h

@@ -55,6 +55,7 @@ class WasmCompilationUnit final {
 
   int func_index() const { return func_index_; }
 
+  void ReopenCentryStub() { centry_stub_ = handle(*centry_stub_, isolate_); }
   void InitializeHandles();
   void ExecuteCompilation();
   Handle<Code> FinishCompilation(wasm::ErrorThrower* thrower);

src/wasm/module-compiler.cc

@@ -1937,6 +1937,9 @@ void AsyncCompileJob::ReopenHandlesInDeferredScope() {
   signature_tables_ = handle(*signature_tables_, isolate_);
   code_table_ = handle(*code_table_, isolate_);
   temp_instance_->ReopenHandles(isolate_);
+  for (auto& unit : compiler_->compilation_units_) {
+    unit->ReopenCentryStub();
+  }
   deferred_handles_.push_back(deferred.Detach());
 }
 

test/mjsunit/regress/wasm/regression-734108.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-async-compilation
+
+__v_0 = new Uint8Array([
+  0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00, 0x01, 0x05, 0x01,
+  0x60, 0x00, 0x01, 0x7f, 0x03, 0x02, 0x01, 0x00, 0x05, 0x03, 0x01,
+  0x00, 0x01, 0x07, 0x11, 0x02, 0x04, 0x67, 0x72, 0x6f, 0x77, 0x00,
+  0x00, 0x06, 0x6d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x02, 0x00, 0x0a,
+  0x08, 0x01, 0x06, 0x00, 0x41, 0x01, 0x40, 0x00, 0x0b
+]);
+assertPromiseResult(
+  WebAssembly.compile(__v_0)
+);