[wasm] Memory.grow(0) should return a new ArrayBuffer when the buffer is empty

R=ahaas@chromium.org

BUG=v8:6546

Change-Id: I2808b78cd047d875d4530c86cc079488a78e5ea1
Reviewed-on: https://chromium-review.googlesource.com/557355
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47088}

src/wasm/wasm-module.cc

@@ -248,8 +248,11 @@ Handle<JSArrayBuffer> wasm::NewArrayBuffer(Isolate* isolate, size_t size,
 
   void* allocation_base = nullptr;  // Set by TryAllocateBackingStore
   size_t allocation_length = 0;     // Set by TryAllocateBackingStore
-  void* memory = TryAllocateBackingStore(isolate, size, enable_guard_regions,
-                                         allocation_base, allocation_length);
+  // Do not reserve memory till non zero memory is encountered.
+  void* memory =
+      (size == 0) ? nullptr
+                  : TryAllocateBackingStore(isolate, size, enable_guard_regions,
+                                            allocation_base, allocation_length);
 
   if (size > 0 && memory == nullptr) {
     return Handle<JSArrayBuffer>::null();
@@ -446,11 +449,6 @@ bool wasm::IsWasmCodegenAllowed(Isolate* isolate, Handle<Context> context) {
 void wasm::DetachWebAssemblyMemoryBuffer(Isolate* isolate,
                                          Handle<JSArrayBuffer> buffer,
                                          bool free_memory) {
-  int64_t byte_length =
-      buffer->byte_length()->IsNumber()
-          ? static_cast<uint32_t>(buffer->byte_length()->Number())
-          : 0;
-  if (buffer.is_null() || byte_length == 0) return;
   const bool is_external = buffer->is_external();
   DCHECK(!buffer->is_neuterable());
   if (!is_external) {

src/wasm/wasm-objects.cc

@@ -365,13 +365,11 @@ int32_t WasmMemoryObject::Grow(Isolate* isolate,
   if (pages == 0) {
     // Even for pages == 0, we need to attach a new JSArrayBuffer with the same
     // backing store and neuter the old one to be spec compliant.
-    if (old_size != 0) {
       new_buffer = SetupArrayBuffer(
           isolate, old_buffer->allocation_base(),
           old_buffer->allocation_length(), old_buffer->backing_store(),
           old_size, old_buffer->is_external(), old_buffer->has_guard_region());
       memory_object->set_array_buffer(*new_buffer);
-    }
     DCHECK_EQ(0, old_size % WasmModule::kPageSize);
     return old_size / WasmModule::kPageSize;
   }

test/mjsunit/wasm/js-api.js

@@ -517,6 +517,13 @@ assertEq(buf.byteLength, 2 * kPageSize);
 assertErrorMessage(() => mem.grow(1), Error, /failed to grow memory/);
 assertEq(buf, mem.buffer);
 
+let empty_mem = new Memory({initial: 0, maximum: 5});
+let empty_buf = empty_mem.buffer;
+assertEq(empty_buf.byteLength, 0);
+assertEq(empty_mem.grow(0), 0);
+assertEq(empty_mem.buffer.byteLength, 0);
+assertTrue(empty_buf !== empty_mem.buffer);
+
 // 'WebAssembly.Table' data property
 let tableDesc = Object.getOwnPropertyDescriptor(WebAssembly, 'Table');
 assertEq(typeof tableDesc.value, 'function');

test/mjsunit/wasm/jsapi-harness.js

@@ -16,8 +16,14 @@ const known_failures = {
     'https://bugs.chromium.org/p/v8/issues/detail?id=5507',
   "'WebAssembly.Instance.prototype.exports' accessor property":
     'https://bugs.chromium.org/p/v8/issues/detail?id=5507',
-  "'WebAssembly.Memory.prototype.grow' method":
-    'https://bugs.chromium.org/p/v8/issues/detail?id=6546'
+  "'WebAssembly.Module.prototype' object":
+    'https://bugs.chromium.org/p/v8/issues/detail?id=6647',
+  "'WebAssembly.Instance.prototype' object":
+    'https://bugs.chromium.org/p/v8/issues/detail?id=6647',
+  "'WebAssembly.Memory.prototype' object":
+    'https://bugs.chromium.org/p/v8/issues/detail?id=6647',
+  "'WebAssembly.Table.prototype' object":
+    'https://bugs.chromium.org/p/v8/issues/detail?id=6647'
 };
 
 let failures = [];
@@ -62,11 +68,37 @@ function promise_test(func, description) {
   });
 }
 
-let assert_equals = assertEquals;
-let assert_not_equals = assertNotEquals;
 let assert_true = assertEquals.bind(null, true);
 let assert_false = assertEquals.bind(null, false);
 
+function same_value(x, y) {
+  if (y !== y) {
+    // NaN case
+    return x!==x;
+  }
+  if (x === 0 && y === 0) {
+    // Distinguish +0 and -0
+    return 1/x === 1/y;
+  }
+  return x === y;
+}
+
+let assert_equals = function(expected, found, description) {
+  if (typeof found != typeof expected) {
+    assert_true(false, "assert_equals", description,
+        "expected (" + typeof expected + ") ${expected} but got (" +
+        typeof found + ") ${found}", {expected:expected, found:found});
+  }
+  assert_true(same_value(found, expected), "assert_equals", description,
+      "expected ${expected} but got ${found}",
+      {expected:expected, found:found});
+}
+
+let assert_not_equals = function(expected, found, description) {
+  assert_true(!same_value(found, expected), "assert_not_equals", description,
+      "got disallowed value ${found}", {found:found});
+}
+
 function assert_unreached(description) {
   throw new Error(`unreachable:\n${description}`);
 }