[wasm] Snapshotting should add code refs

Since snapshotting returns a vector of code pointers, we should add them
so the surrounding {WasmCodeRefScope}, to make sure that they are not
being garbage-collected while the serializer reads them.
This is unlikely to happen, since serialization is only triggered once
top-tier compilation is finished, and we usually do not garbage-collect
top-tier code, but in rare circumstances (e.g. in debugging), it could
theoretically happen.

R=ahaas@chromium.org

Change-Id: Ie1a9654a8a1467c12e42181776cec1dad7366036
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2644944Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72284}

src/wasm/wasm-code-manager.cc

@@ -1208,6 +1208,9 @@ std::vector<WasmCode*> NativeModule::SnapshotCodeTable() const {
   base::MutexGuard lock(&allocation_mutex_);
   WasmCode** start = code_table_.get();
   WasmCode** end = start + module_->num_declared_functions;
+  for (WasmCode* code : VectorOf(start, end - start)) {
+    if (code) WasmCodeRefScope::AddRef(code);
+  }
   return std::vector<WasmCode*>{start, end};
 }
 

src/wasm/wasm-serialization.h

@@ -5,6 +5,7 @@
 #ifndef V8_WASM_WASM_SERIALIZATION_H_
 #define V8_WASM_WASM_SERIALIZATION_H_
 
+#include "src/wasm/wasm-code-manager.h"
 #include "src/wasm/wasm-objects.h"
 
 namespace v8 {
@@ -42,6 +43,8 @@ class V8_EXPORT_PRIVATE WasmSerializer {
 
  private:
   NativeModule* native_module_;
+  // The {WasmCodeRefScope} keeps the pointers in {code_table_} alive.
+  WasmCodeRefScope code_ref_scope_;
   std::vector<WasmCode*> code_table_;
 };