[rab/gsab] Do not Reallocate 0-lengthed ArrayBuffers

Bug: chromium:1344014
Change-Id: I5009af963d95d96f70785593664a1145ad20c97d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3760975Reviewed-by: Adam Klein <adamk@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81701}

src/objects/backing-store.h

@@ -110,7 +110,7 @@ class V8_EXPORT_PRIVATE BackingStore : public BackingStoreBase {
 
   bool CanReallocate() const {
     return !is_wasm_memory_ && !custom_deleter_ && !globally_registered_ &&
-           free_on_destruct_ && !is_resizable_;
+           free_on_destruct_ && !is_resizable_ && buffer_start_ != nullptr;
   }
 
   // Wrapper around ArrayBuffer::Allocator::Reallocate.

test/mjsunit/harmony/arraybuffer-transfer.js

@@ -48,11 +48,11 @@ TestSameLength(1024, { maxByteLength: 2048 });
 function TestGrow(len, opts) {
   let ab = new ArrayBuffer(len);
   WriteTestData(ab);
-  const newLen = len * 2;
+  const newLen = len * 2 + 128; // +128 to ensure newLen is never 0
   const xfer = ab.transfer(newLen);
   assertEquals(newLen, xfer.byteLength);
   assertFalse(xfer.resizable);
-  AssertBufferContainsTestData(xfer);
+  if (len > 0) AssertBufferContainsTestData(xfer);
   AssertDetached(ab);
 
   // The new memory should be zeroed.
@@ -63,6 +63,8 @@ function TestGrow(len, opts) {
 }
 TestGrow(1024);
 TestGrow(1024, { maxByteLength: 2048 });
+TestGrow(0);
+TestGrow(0, { maxByteLength: 2048 });
 
 function TestNonGrow(len, opts) {
   for (let newLen of [len / 2, // shrink
@@ -73,12 +75,14 @@ function TestNonGrow(len, opts) {
     const xfer = ab.transfer(newLen);
     assertEquals(newLen, xfer.byteLength);
     assertFalse(xfer.resizable);
-    AssertBufferContainsTestData(xfer);
+    if (len > 0) AssertBufferContainsTestData(xfer);
     AssertDetached(ab);
   }
 }
 TestNonGrow(1024);
-TestNonGrow(1024, { maxByteLength: 1024 * 2 });
+TestNonGrow(1024, { maxByteLength: 2048 });
+TestNonGrow(0);
+TestNonGrow(0, { maxByteLength: 2048 });
 
 (function TestParameterConversion() {
   const len = 1024;