[wasm] Fix streaming compilation prefix hash

The previous code was relying on {compilation_unit_builder_} to check if
a section was after or before the code section. This only works for the
first section after code section, since the compilation unit builder is
then reset. Use an additional field to track this instead.

R=clemensb@chromium.org

Bug: chromium:1051912
Change-Id: Id1dfa803ecde2cf77f206ea781c007fc61168942
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2054099
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66265}

src/wasm/module-compiler.cc

@@ -1547,6 +1547,7 @@ class AsyncStreamingProcessor final : public StreamingProcessor {
   std::unique_ptr<CompilationUnitBuilder> compilation_unit_builder_;
   int num_functions_ = 0;
   bool prefix_cache_hit_ = false;
+  bool before_code_section_ = true;
   std::shared_ptr<Counters> async_counters_;
   AccountingAllocator* allocator_;
 
@@ -2178,7 +2179,8 @@ bool AsyncStreamingProcessor::ProcessSection(SectionCode section_code,
     // compilation_unit_builder_ anymore.
     CommitCompilationUnits();
     compilation_unit_builder_.reset();
-  } else if (!prefix_cache_hit_) {
+  }
+  if (before_code_section_) {
     // Combine section hashes until code section.
     prefix_hash_ = base::hash_combine(prefix_hash_,
                                       NativeModuleCache::WireBytesHash(bytes));
@@ -2209,6 +2211,7 @@ bool AsyncStreamingProcessor::ProcessCodeSectionHeader(
     int num_functions, uint32_t offset,
     std::shared_ptr<WireBytesStorage> wire_bytes_storage,
     int code_section_length) {
+  before_code_section_ = false;
   DCHECK_GE(code_section_length, 0);
   TRACE_STREAMING("Start the code section with %d functions...\n",
                   num_functions);

test/mjsunit/regress/wasm/regress-1051912.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-module-builder.js')
+
+let binary = new Binary();
+binary.emit_header();
+binary.emit_bytes([kTypeSectionCode, 4, 1, kWasmFunctionTypeForm, 0, 0]);
+binary.emit_bytes([kFunctionSectionCode, 2, 1, 0]);
+binary.emit_bytes([kCodeSectionCode, 6, 1, 4]);
+binary.emit_bytes([kUnknownSectionCode, 2, 1, 0]);
+binary.emit_bytes([kUnknownSectionCode, 2, 1, 0]);
+binary.emit_bytes([kUnknownSectionCode, 2, 1, 0]);
+binary.emit_bytes([ kExprEnd]);
+let buffer = binary.trunc_buffer();
+WebAssembly.compile(buffer);