[heap] Fix external bytes accounting when promoting large objects

Unlike other spaces we didn't update external bytes counters when
adding or removing pages from large spaces.

Bug: chromium:1329766
Change-Id: I5fbc8703964f9e4e846d986c32c5d57ed4f0c0c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3681118
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80877}

src/heap/large-spaces.cc

@@ -267,6 +267,10 @@ void LargeObjectSpace::AddPage(LargePage* page, size_t object_size) {
   page->set_owner(this);
   page->SetOldGenerationPageFlags(!is_off_thread() &&
                                   heap()->incremental_marking()->IsMarking());
+  for (size_t i = 0; i < ExternalBackingStoreType::kNumTypes; i++) {
+    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
+    IncrementExternalBackingStoreBytes(t, page->ExternalBackingStoreBytes(t));
+  }
 }
 void LargeObjectSpace::RemovePage(LargePage* page) {
   size_ -= static_cast<int>(page->size());
@@ -274,6 +278,10 @@ void LargeObjectSpace::RemovePage(LargePage* page) {
   page_count_--;
   memory_chunk_list_.Remove(page);
   page->set_owner(nullptr);
+  for (size_t i = 0; i < ExternalBackingStoreType::kNumTypes; i++) {
+    ExternalBackingStoreType t = static_cast<ExternalBackingStoreType>(i);
+    DecrementExternalBackingStoreBytes(t, page->ExternalBackingStoreBytes(t));
+  }
 }
 
 namespace {

test/mjsunit/large-external-string.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --expose-externalize-string --verify-heap
+
+const LENGTH = 100 * 1000;
+const data = new Array();
+
+for (var i = 0; i < LENGTH; ++i) {
+  data.push('do ');
+}
+
+const largeText = data.join();
+externalizeString(largeText);
+gc();