[wasm] a grown shared memory should stay SharedArrayBuffer

According to WebAssembly's thread proposal, the memory type is decided
at the Object's creation and don't change over time.

When growing a shared memory and the old buffer was marked as shared;
setup the new buffer as shared as well.

Bug: v8:8564
Change-Id: I7e59071d11b41315429232ae0c90436c6810bd0e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1526012Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Sven Sauleau <ssauleau@igalia.com>
Auto-Submit: Sven Sauleau <ssauleau@igalia.com>
Cr-Commit-Position: refs/heads/master@{#60312}

src/wasm/wasm-objects.cc

@@ -1303,8 +1303,9 @@ int32_t WasmMemoryObject::Grow(Isolate* isolate,
     }
     // SharedArrayBuffer, but not shared across isolates. Setup a new buffer
     // with updated permissions and update the instances.
-    new_buffer = wasm::SetupArrayBuffer(isolate, backing_store, new_size,
-                                        old_buffer->is_external());
+    new_buffer =
+        wasm::SetupArrayBuffer(isolate, backing_store, new_size,
+                               old_buffer->is_external(), SharedFlag::kShared);
     memory_object->update_instances(isolate, new_buffer);
   } else {
     if (!MemoryGrowBuffer(isolate, old_buffer, new_size)

test/mjsunit/wasm/grow-shared-memory.js

@@ -337,3 +337,11 @@ let workerHelpers = assertTrue.toString() + assertIsWasmSharedMemory.toString();
   assertTraps(kTrapMemOutOfBounds,
       () => instance.exports.atomic_load(25 * kPageSize - 3));
 })();
+
+(function TestMemoryBufferTypeAfterGrow() {
+  const memory = new WebAssembly.Memory({
+    "initial": 1, "maximum": 2, "shared": true });
+  assertInstanceof(memory.buffer, SharedArrayBuffer);
+  assertEquals(memory.grow(1), 1);
+  assertInstanceof(memory.buffer, SharedArrayBuffer);
+})();