Revert "[Atomics.waitAsync] Fix removing multiple nodes when Isolate deinits"

This reverts commit 28ead054.

Reason for revert: mjsunit/compiler/serializer-transition-propagation
failure seems to bisect to this (despite looking unrelated):
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/32532

Original change's description:
> [Atomics.waitAsync] Fix removing multiple nodes when Isolate deinits
> 
> RemoveNode already nullifies the next_ pointer of FutexWaitListNode,
> and DeleteAsyncNode was trying to retrieve it.
> 
> Bug: v8:10239
> Change-Id: I595885de87f433d263eeacfc825a689efd467f5e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2332812
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69259}

TBR=ulan@chromium.org,marja@chromium.org,syg@chromium.org

Change-Id: I5db179aec5a04f59770903b17d059a7150c7efbd
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10239
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339466Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69271}

src/d8/d8.cc

@@ -1809,19 +1809,6 @@ void Shell::WorkerTerminate(const v8::FunctionCallbackInfo<v8::Value>& args) {
   worker->Terminate();
 }
 
-void Shell::WorkerTerminateAndWait(
-    const v8::FunctionCallbackInfo<v8::Value>& args) {
-  Isolate* isolate = args.GetIsolate();
-  HandleScope handle_scope(isolate);
-  std::shared_ptr<Worker> worker =
-      GetWorkerFromInternalField(isolate, args.Holder());
-  if (!worker.get()) {
-    return;
-  }
-
-  worker->TerminateAndWaitForThread();
-}
-
 void Shell::QuitOnce(v8::FunctionCallbackInfo<v8::Value>* args) {
   int exit_code = (*args)[0]
                       ->Int32Value(args->GetIsolate()->GetCurrentContext())
@@ -2151,10 +2138,6 @@ Local<ObjectTemplate> Shell::CreateGlobalTemplate(Isolate* isolate) {
       isolate, "terminate",
       FunctionTemplate::New(isolate, WorkerTerminate, Local<Value>(),
                             worker_signature));
-  worker_fun_template->PrototypeTemplate()->Set(
-      isolate, "terminateAndWait",
-      FunctionTemplate::New(isolate, WorkerTerminateAndWait, Local<Value>(),
-                            worker_signature));
   worker_fun_template->PrototypeTemplate()->Set(
       isolate, "postMessage",
       FunctionTemplate::New(isolate, WorkerPostMessage, Local<Value>(),
@@ -3073,7 +3056,7 @@ void Worker::Terminate() {
   task_runner_->PostTask(std::move(task));
 }
 
-void Worker::TerminateAndWaitForThread() {
+void Worker::WaitForThread() {
   Terminate();
   thread_->Join();
 }
@@ -3934,7 +3917,7 @@ void Shell::WaitForRunningWorkers() {
   }
 
   for (auto& worker : workers_copy) {
-    worker->TerminateAndWaitForThread();
+    worker->WaitForThread();
   }
 
   // Now that all workers are terminated, we can re-enable Worker creation.

src/d8/d8.h

@@ -183,7 +183,7 @@ class Worker : public std::enable_shared_from_this<Worker> {
   void Terminate();
   // Terminate and join the thread.
   // This function can be called by any thread.
-  void TerminateAndWaitForThread();
+  void WaitForThread();
 
   // Start running the given worker in another thread.
   static bool StartWorkerThread(std::shared_ptr<Worker> worker);
@@ -429,8 +429,6 @@ class Shell : public i::AllStatic {
       const v8::FunctionCallbackInfo<v8::Value>& args);
   static void WorkerGetMessage(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void WorkerTerminate(const v8::FunctionCallbackInfo<v8::Value>& args);
-  static void WorkerTerminateAndWait(
-      const v8::FunctionCallbackInfo<v8::Value>& args);
   // The OS object on the global object contains methods for performing
   // operating system calls:
   //

src/execution/futex-emulation.cc

@@ -774,10 +774,8 @@ void FutexEmulation::IsolateDeinit(Isolate* isolate) {
       // NativeContext. Also we don't need to cancel the timeout task, since it
       // will be cancelled by Isolate::Deinit.
       node->timeout_task_id_ = CancelableTaskManager::kInvalidTaskId;
-      auto next = node->next_;
       g_wait_list.Pointer()->RemoveNode(node);
-      delete node;
-      node = next;
+      node = DeleteAsyncWaiterNode(node);
     } else {
       node = node->next_;
     }

test/mjsunit/harmony/atomics-waitasync-worker-shutdown-before-wait-finished-2-waits.js

-// Copyright 2020 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax --harmony-sharedarraybuffer --harmony-atomics-waitasync
-
-(function test() {
-  const sab = new SharedArrayBuffer(16);
-  const i32a = new Int32Array(sab);
-  const location = 0;
-
-  (function createWorker() {
-    const script = `onmessage = function(msg) {
-      if (msg.sab) {
-        const i32a = new Int32Array(msg.sab);
-        // Start 2 async waits in the same location.
-        const result1 = Atomics.waitAsync(i32a, ${location}, 0);
-        const result2 = Atomics.waitAsync(i32a, ${location}, 0);
-        postMessage('worker waiting');
-      }
-    }`;
-    const w = new Worker(script, {type : 'string'});
-    w.postMessage({sab: sab});
-    const m = w.getMessage();
-    assertEquals('worker waiting', m);
-    w.terminateAndWait();
-  })();
-
-  const notify_return_value = Atomics.notify(i32a, location, 2);
-  // No waiters got notified, since they got cleaned up before it.
-  assertEquals(0, notify_return_value);
-})();

test/mjsunit/harmony/atomics-waitasync-worker-shutdown-before-wait-finished-2-workers.js

-// Copyright 2020 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax --harmony-sharedarraybuffer --harmony-atomics-waitasync
-
-(function test() {
-  const sab = new SharedArrayBuffer(16);
-  const i32a = new Int32Array(sab);
-  const location = 0;
-
-  (function createWorker() {
-    const script = `onmessage = function(msg) {
-      if (msg.sab) {
-        const i32a = new Int32Array(msg.sab);
-        Atomics.waitAsync(i32a, ${location}, 0);
-        postMessage('worker waiting');
-      }
-    }`;
-    // Create 2 workers which wait on the same location.
-    let workers = [];
-    const worker_count = 2;
-    for (let i = 0; i < worker_count; ++i) {
-      workers[i] = new Worker(script, {type : 'string'});
-      workers[i].postMessage({sab: sab});
-      const m = workers[i].getMessage();
-      assertEquals('worker waiting', m);
-    }
-    for (let i = 0; i < worker_count; ++i) {
-      workers[i].terminateAndWait();
-    }
-  })();
-
-  const notify_return_value = Atomics.notify(i32a, location, 2);
-  // No waiters got notified, since they got cleaned up before it.
-  assertEquals(0, notify_return_value);
-})();