[snapshot] Clear pending_optimize_for_test_bytecode table

...to clear the recompilable code.

Bug: v8:13181
Change-Id: I6b78bbd2f08242fdd4659113ce1b4fa81174f8a2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3829243Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82610}

src/snapshot/snapshot.cc

@@ -297,6 +297,11 @@ void Snapshot::ClearReconstructableDataForSerialization(
     }
 #endif  // DEBUG
   }
+
+  // PendingOptimizeTable also contains BytecodeArray, we need to clear the
+  // recompilable code same as above.
+  ReadOnlyRoots roots(isolate);
+  isolate->heap()->SetPendingOptimizeForTestBytecode(roots.undefined_value());
 }
 
 // static
@@ -331,6 +336,8 @@ void Snapshot::SerializeDeserializeAndVerifyForTesting(
 
   // Test deserialization.
   Isolate* new_isolate = Isolate::New();
+  std::unique_ptr<v8::ArrayBuffer::Allocator> array_buffer_allocator(
+      v8::ArrayBuffer::Allocator::NewDefaultAllocator());
   {
     // Set serializer_enabled() to not install extensions and experimental
     // natives on the new isolate.
@@ -338,8 +345,7 @@ void Snapshot::SerializeDeserializeAndVerifyForTesting(
     new_isolate->enable_serializer();
     new_isolate->Enter();
     new_isolate->set_snapshot_blob(&serialized_data);
-    new_isolate->set_array_buffer_allocator(
-        v8::ArrayBuffer::Allocator::NewDefaultAllocator());
+    new_isolate->set_array_buffer_allocator(array_buffer_allocator.get());
     if (Isolate* shared_isolate = isolate->shared_isolate()) {
       new_isolate->set_shared_isolate(shared_isolate);
     }

test/mjsunit/regress/regress-v8-13181.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --stress-snapshot
+
+function assertEquals(a, b) {
+  return true
+}
+
+function bar(x, y){
+  return [...x, y]
+}
+function foo(x) {
+  return bar`123${x}`
+}
+
+%PrepareFunctionForOptimization(foo);
+assertEquals(["123", "", 1], foo(1));