[wasm] Create module object in async compilation earlier.

This makes sure that the {WasmModuleObject} has been allocated before
any debug events are fired. Since {WasmScript} objects reference the
module object, it needs to be allocated earlier by now.

R=ahaas@chromium.org
TEST=debugger/regress/regress-crbug-840288
BUG=chromium:840288

Change-Id: I02783ce126c463ac953eb2192acb65f3a5d420a1
Reviewed-on: https://chromium-review.googlesource.com/1050246Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53084}

src/wasm/module-compiler.cc

@@ -2852,9 +2852,16 @@ void AsyncCompileJob::FinishCompile() {
   compiled_module_->set_shared(*shared);
   compiled_module_->GetNativeModule()->SetSharedModuleData(shared);
 
+  // Create the module object.
+  module_object_ = WasmModuleObject::New(isolate_, compiled_module_);
+  {
+    DeferredHandleScope deferred(isolate_);
+    module_object_ = handle(*module_object_, isolate_);
+    deferred_handles_.push_back(deferred.Detach());
+  }
+
   // Finish the wasm script now and make it public to the debugger.
-  isolate_->debug()->OnAfterCompile(
-      handle(compiled_module_->shared()->script()));
+  isolate_->debug()->OnAfterCompile(script);
 
   // TODO(wasm): compiling wrappers should be made async as well.
   DoSync<CompileWrappers>();
@@ -3180,9 +3187,7 @@ class AsyncCompileJob::CompileWrappers : public CompileStep {
 class AsyncCompileJob::FinishModule : public CompileStep {
   void RunInForeground() override {
     TRACE_COMPILE("(6) Finish module...\n");
-    Handle<WasmModuleObject> result =
-        WasmModuleObject::New(job_->isolate_, job_->compiled_module_);
-    job_->AsyncCompileSucceeded(result);
+    job_->AsyncCompileSucceeded(job_->module_object_);
 
     WasmModule* module = job_->compiled_module_->shared()->module();
     size_t num_functions =

src/wasm/module-compiler.h

@@ -153,6 +153,7 @@ class AsyncCompileJob {
 
   std::vector<DeferredHandles*> deferred_handles_;
   Handle<WasmCompiledModule> compiled_module_;
+  Handle<WasmModuleObject> module_object_;
 
   std::unique_ptr<CompileStep> step_;
   CancelableTaskManager background_task_manager_;

test/debugger/regress/regress-crbug-840288.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+Debug = debug.Debug
+
+function listener(event, exec_state, event_data, data) {
+  if (event == Debug.DebugEvent.AfterCompile) {
+    // The actual source doesn't matter, just don't crash.
+    assertEquals("func $main\nend\n", event_data.script().source());
+  }
+};
+
+// Add the debug event listener.
+Debug.setListener(listener);
+
+var builder = new WasmModuleBuilder();
+builder.addFunction('main', kSig_v_v).addBody([]).exportFunc();
+var promise = WebAssembly.compile(builder.toBuffer());
+
+// Clear the debug listener only after the event fired.
+promise.then(() => Debug.setListener(null), assertUnreachable);

test/mjsunit/wasm/async-compile.js

@@ -11,12 +11,12 @@ function assertCompiles(buffer) {
   return assertPromiseResult(
       WebAssembly.compile(buffer),
       module => assertTrue(module instanceof WebAssembly.Module),
-      ex => assertUnreachable);
+      ex => assertUnreachable());
 }
 
 function assertCompileError(buffer) {
   return assertPromiseResult(
-      WebAssembly.compile(buffer), module => assertUnreachable,
+      WebAssembly.compile(buffer), module => assertUnreachable(),
       ex => assertTrue(ex instanceof WebAssembly.CompileError));
 }