[serializer] restore array buffer backing store after serializing

This was a bug found while working on https://crrev.com/c/850550

Change-Id: I92b04d1814e75f0a1817f8409496612a3597cd20
Reviewed-on: https://chromium-review.googlesource.com/966997
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52078}

src/snapshot/serializer.cc

@@ -451,6 +451,7 @@ void Serializer<AllocatorT>::ObjectSerializer::SerializeJSArrayBuffer() {
     buffer->set_backing_store(Smi::FromInt(ref));
   }
   SerializeObject();
+  buffer->set_backing_store(backing_store);
 }
 
 template <class AllocatorT>