[rab / gsab] Fix .maxByteLength for wasm memory buffers

Bug: v8:11111,v8:12746,chromium:1307480
Change-Id: I7775776ae98c3727b435aca4f269400ff8e31c53
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3560440Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79705}

src/builtins/arraybuffer.tq

@@ -47,8 +47,11 @@ transitioning javascript builtin ArrayBufferPrototypeGetMaxByteLength(
   // 6. Else,
   //   a. Let length be O.[[ArrayBufferByteLength]].
   // 7. Return F(length);
-  dcheck(IsResizableArrayBuffer(o) || o.max_byte_length == o.byte_length);
-  return Convert<Number>(o.max_byte_length);
+
+  if (IsResizableArrayBuffer(o)) {
+    return Convert<Number>(o.max_byte_length);
+  }
+  return Convert<Number>(o.byte_length);
 }
 
 // #sec-get-arraybuffer.prototype.resizable

src/builtins/builtins-arraybuffer.cc

@@ -416,7 +416,7 @@ static Object ResizeHelper(BuiltinArguments args, Isolate* isolate,
   // [GSAB] Let hostHandled be ? HostGrowArrayBuffer(O, newByteLength).
   // If hostHandled is handled, return undefined.
 
-  // TODO(v8:11111): Wasm integration.
+  // TODO(v8:11111, v8:12746): Wasm integration.
 
   if (!is_shared) {
     // [RAB] Let oldBlock be O.[[ArrayBufferData]].

test/mjsunit/wasm/resizablearraybuffer-growablesharedarraybuffer-wasm.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-rab-gsab
+
+(function TestMemoryBufferNotResizable() {
+  const m = new WebAssembly.Memory({
+    initial: 128
+  });
+
+  assertFalse(m.buffer.resizable);
+  // For non-resizable buffers, maxByteLength returns byteLength.
+  assertEquals(m.buffer.maxByteLength, m.buffer.byteLength);
+})();