[wasm] Add off-by-default runtime flag for growing shared memory

Grow memory isn't ready to ship in M75.

Bug: v8:8564, chromium:951795
Change-Id: I75602bce833653b7943f5606236a97ca6dbad5c9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1566239Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60836}

src/flag-definitions.h

@@ -685,6 +685,8 @@ DEFINE_BOOL(wasm_lazy_compilation, false,
             "enable lazy compilation for all wasm modules")
 DEFINE_DEBUG_BOOL(trace_wasm_lazy_compilation, false,
                   "trace lazy compilation of wasm functions")
+DEFINE_BOOL(wasm_grow_shared_memory, false,
+            "Allow growing shared WebAssembly memory objects")
 // wasm-interpret-all resets {asm-,}wasm-lazy-compilation.
 DEFINE_NEG_IMPLICATION(wasm_interpret_all, asm_wasm_lazy_compilation)
 DEFINE_NEG_IMPLICATION(wasm_interpret_all, wasm_lazy_compilation)

src/wasm/wasm-objects.cc

@@ -1255,6 +1255,7 @@ int32_t WasmMemoryObject::Grow(Isolate* isolate,
                                uint32_t pages) {
   TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("v8.wasm"), "GrowMemory");
   Handle<JSArrayBuffer> old_buffer(memory_object->array_buffer(), isolate);
+  if (old_buffer->is_shared() && !FLAG_wasm_grow_shared_memory) return -1;
   auto* memory_tracker = isolate->wasm_engine()->memory_tracker();
   if (!memory_tracker->IsWasmMemoryGrowable(old_buffer)) return -1;
 

test/mjsunit/wasm/grow-shared-memory.js

@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 // TODO(v8:8832): Enable --stress-opt on these tests
+// Flags: --wasm-grow-shared-memory
 // Flags: --experimental-wasm-threads --no-stress-opt
 
 load("test/mjsunit/wasm/wasm-module-builder.js");