[compiler] Create canonical handles in JSTypedArrayRef::buffer()

Bug: chromium:1177368, chromium:1177369, v8:7790
Change-Id: Ice0b1b3fbc0b15d2b0b80255b7bb4a8c61f855e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2692246Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72702}

src/compiler/js-heap-broker.cc

@@ -3772,7 +3772,8 @@ HeapObjectRef JSTypedArrayRef::buffer() const {
     // Safe to read concurrently because:
     // - immutable after initialization.
     // - host object seen by serializer.
-    Handle<JSArrayBuffer> value(object()->buffer(), broker()->isolate());
+    Handle<JSArrayBuffer> value =
+        broker()->CanonicalPersistentHandle(object()->buffer());
     return JSObjectRef{broker(), value};
   }
   return HeapObjectRef{broker(), data()->AsJSTypedArray()->buffer()};

test/mjsunit/compiler/regress-1177368.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let __v_20 = new Int32Array();
+__v_20.set({
+    get length() {
+      %ArrayBufferDetach(__v_20.buffer);
+    }
+  });
+
+function bar() { return array[0]; }
+var array = new Float32Array(1000);
+%PrepareFunctionForOptimization(bar);
+bar();
+bar();
+%OptimizeFunctionOnNextCall(bar);
+bar();

test/mjsunit/compiler/regress-1177369.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+try {
+  let array = new ArrayBuffer();
+  array.constructor = {
+    get [Symbol.species]() {
+      %ArrayBufferDetach(array);
+    }
+  };
+  array.slice();
+} catch (e) {}
+
+var array = new Int8Array(100);
+function foo() {
+  for (var i = 0; i < 100; i += 4) {
+    array[i] = i;
+  }
+}
+
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();