[wasm] Fix {IsWebAssemblyCompiledModule} predicate.

This makes sure the aforementioned predicate is independent of the
current context (aka. Realm) and only uses the instance type of the
given object to determine whether it is a WebAssembly module object.

R=titzer@chromium.org
TEST=mjsunit/regress/wasm/regress-8059
BUG=v8:8059

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Icc8e400f8412483f2a3883ca65c58b7ef938ef23
Reviewed-on: https://chromium-review.googlesource.com/1180886Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55205}

src/api.cc

@@ -3610,14 +3610,6 @@ bool Value::IsBigInt() const { return Utils::OpenHandle(this)->IsBigInt(); }
 
 bool Value::IsProxy() const { return Utils::OpenHandle(this)->IsJSProxy(); }
 
-bool Value::IsWebAssemblyCompiledModule() const {
-  i::Handle<i::Object> obj = Utils::OpenHandle(this);
-  if (!obj->IsJSObject()) return false;
-  i::Handle<i::JSObject> js_obj = i::Handle<i::JSObject>::cast(obj);
-  return js_obj->GetIsolate()->native_context()->wasm_module_constructor() ==
-         js_obj->map()->GetConstructor();
-}
-
 #define VALUE_IS_SPECIFIC_TYPE(Type, Check)             \
   bool Value::Is##Type() const {                        \
     i::Handle<i::Object> obj = Utils::OpenHandle(this); \
@@ -3635,6 +3627,7 @@ VALUE_IS_SPECIFIC_TYPE(Map, JSMap)
 VALUE_IS_SPECIFIC_TYPE(Set, JSSet)
 VALUE_IS_SPECIFIC_TYPE(WeakMap, JSWeakMap)
 VALUE_IS_SPECIFIC_TYPE(WeakSet, JSWeakSet)
+VALUE_IS_SPECIFIC_TYPE(WebAssemblyCompiledModule, WasmModuleObject)
 
 #undef VALUE_IS_SPECIFIC_TYPE
 

test/mjsunit/regress/wasm/regress-8059.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-wasm-disable-structured-cloning
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function TestPostModule() {
+  let builder = new WasmModuleBuilder();
+  builder.addFunction("add", kSig_i_ii)
+    .addBody([kExprGetLocal, 0, kExprGetLocal, 1, kExprI32Add])
+    .exportFunc();
+
+  let module = builder.toModule();
+
+  let workerScript = `
+    onmessage = function(module) {
+      try {
+        let instance = new WebAssembly.Instance(module);
+        let result = instance.exports.add(40, 2);
+        postMessage(result);
+      } catch(e) {
+        postMessage('ERROR: ' + e);
+      }
+    }
+  `;
+
+  let realm = Realm.create();
+  Realm.shared = { m:module, s:workerScript };
+
+  let realmScript = `
+    let worker = new Worker(Realm.shared.s);
+    worker.postMessage(Realm.shared.m);
+    let message = worker.getMessage();
+    worker.terminate();
+    message;
+  `;
+  let message = Realm.eval(realm, realmScript);
+  assertEquals(42, message);
+})();