[wasm] Correctly reset memory size to default instead of 0.

Bug: chromium:731351
Change-Id: I810986cba2f575da9de2c4bb70c250784148eeb5
Reviewed-on: https://chromium-review.googlesource.com/532634
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45918}

src/wasm/wasm-objects.cc

@@ -1016,6 +1016,9 @@ void WasmCompiledModule::Reset(Isolate* isolate,
   Object* fct_obj = compiled_module->ptr_to_code_table();
   if (fct_obj != nullptr && fct_obj != undefined) {
     uint32_t old_mem_size = compiled_module->mem_size();
+    // We use default_mem_size throughout, as the mem size of an uninstantiated
+    // module, because if we can statically prove a memory access is over
+    // bounds, we'll codegen a trap. See {WasmGraphBuilder::BoundsCheckMem}
     uint32_t default_mem_size = compiled_module->default_mem_size();
     Address old_mem_start = compiled_module->GetEmbeddedMemStartOrNull();
 
@@ -1091,7 +1094,7 @@ void WasmCompiledModule::InitId() {
 void WasmCompiledModule::ResetSpecializationMemInfoIfNeeded() {
   DisallowHeapAllocation no_gc;
   if (has_embedded_mem_start()) {
-    set_embedded_mem_size(0);
+    set_embedded_mem_size(default_mem_size());
     set_embedded_mem_start(0);
   }
 }

test/mjsunit/regress/wasm/regression-731351.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --expose-gc --stress-opt
+
+gc();
+function asm(stdlib, foreign, buffer) {
+  "use asm";
+  var HEAP32 = new stdlib.Uint32Array(buffer);
+  function load(a) {
+    a = a | 0;
+    return +(HEAP32[a >> 2] >>> 0);
+  }
+  return {load: load};
+}
+
+function RunAsmJsTest() {
+  buffer = new ArrayBuffer(65536);
+  var asm_module = asm({Uint32Array: Uint32Array}, {}, buffer);
+  asm_module.load(buffer.byteLength);
+}
+RunAsmJsTest();