Mark neteured ArrayBuffers as not neuterable

Bug: chromium:821368
Change-Id: I4e7032d76a0ac0e291b9dab2f7bcb58ce84827cf
Reviewed-on: https://chromium-review.googlesource.com/963601Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51971}

src/objects.cc

@@ -19046,6 +19046,7 @@ void JSArrayBuffer::Neuter() {
   set_allocation_base(nullptr);
   set_allocation_length(0);
   set_was_neutered(true);
+  set_is_neuterable(false);
   // Invalidate the neutering protector.
   Isolate* const isolate = GetIsolate();
   if (isolate->IsArrayBufferNeuteringIntact()) {

test/mjsunit/regress/regress-821368.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const worker = new Worker("onmessage = function(){}");
+const buffer = new ArrayBuffer();
+worker.postMessage(buffer, [buffer]);
+try {
+  worker.postMessage(buffer, [buffer]);
+} catch (e) {
+  if (e != "ArrayBuffer could not be transferred") {
+    throw e;
+  }
+}