Remove DCHECK that transferred array buffers are neutered or shared.

While this seems like it should be true, the array buffer is not actually
neutered until the end of cloning. This is so that, if an exception is thrown
during serialization, the original array buffer is not left neutered. As a
result, Blink will not have neutered the buffer.

This fixes some DCHECK failures during layout tests.

BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2466563002
Cr-Commit-Position: refs/heads/master@{#40675}

src/value-serializer.cc

@@ -668,7 +668,6 @@ Maybe<bool> ValueSerializer::WriteJSSet(Handle<JSSet> set) {
 Maybe<bool> ValueSerializer::WriteJSArrayBuffer(JSArrayBuffer* array_buffer) {
   uint32_t* transfer_entry = array_buffer_transfer_map_.Find(array_buffer);
   if (transfer_entry) {
-    DCHECK(array_buffer->was_neutered() || array_buffer->is_shared());
     WriteTag(array_buffer->is_shared()
                  ? SerializationTag::kSharedArrayBufferTransfer
                  : SerializationTag::kArrayBufferTransfer);

test/unittests/value-serializer-unittest.cc

@@ -64,6 +64,7 @@ class ValueSerializerTest : public TestWithIsolate {
   // Overridden in more specific fixtures.
   virtual ValueSerializer::Delegate* GetSerializerDelegate() { return nullptr; }
   virtual void BeforeEncode(ValueSerializer*) {}
+  virtual void AfterEncode() {}
   virtual ValueDeserializer::Delegate* GetDeserializerDelegate() {
     return nullptr;
   }
@@ -109,6 +110,7 @@ class ValueSerializerTest : public TestWithIsolate {
     if (!serializer.WriteValue(context, value).FromMaybe(false)) {
       return Nothing<std::vector<uint8_t>>();
     }
+    AfterEncode();
     return Just(serializer.ReleaseBuffer());
   }
 
@@ -1740,7 +1742,6 @@ class ValueSerializerTestWithArrayBufferTransfer : public ValueSerializerTest {
     {
       Context::Scope scope(serialization_context());
       input_buffer_ = ArrayBuffer::New(isolate(), nullptr, 0);
-      input_buffer_->Neuter();
     }
     {
       Context::Scope scope(deserialization_context());
@@ -1757,6 +1758,8 @@ class ValueSerializerTestWithArrayBufferTransfer : public ValueSerializerTest {
     serializer->TransferArrayBuffer(0, input_buffer_);
   }
 
+  void AfterEncode() override { input_buffer_->Neuter(); }
+
   void BeforeDecode(ValueDeserializer* deserializer) override {
     deserializer->TransferArrayBuffer(0, output_buffer_);
   }