test: the uint8-array in inspect-scenario sometimes gets neutered

[joyeecheung]

ok 13 addr of `Object` should match
[TEST] [LINE]     [0]=0x0000134ccad82201:<null>,
[TEST] [LINE]     [4]=0x0000134ccad822d1:<undefined>,
[TEST] [LINE]     [23]=0x0000134c51ddf5d9:<JSRegExp source=/regexp/>,
[TEST] [LINE]     [25]=0x0000134cce90b1c9:<function: c.hashmap.(anonymous function) at /Users/joyee/projects/llnode/test/fixtures/inspect-scenario.js:63:19>}
[TEST] [LINE]   properties {
[TEST] [LINE]     .some-key=<Smi: 42>,
[TEST] [LINE]     .other-key=0x0000134cce907fd1:<String: "ohai">,
[TEST] [LINE]     .cons-string=0x0000134c51dde779:<String: "this could be a ...">,
[TEST] [LINE]     .internalized-string=0x0000134cce908099:<String: "foobar">,
[TEST] [LINE]     .thin-string=0x0000134c51dde821:<String: "foobar">,
[TEST] [LINE]     .externalized-string=0x0000134cce908151:<String: "(external)">,
[TEST] [LINE]     .sliced-externalized-string=0x0000134c51dde9e9:<String: "(external)">,
[TEST] [LINE]     .array=0x0000134c51ddeb19:<Array: length=6>,
[TEST] [LINE]     .long-array=0x0000134c51ddeca9:<Array: length=20>,
[TEST] [LINE]     .array-buffer=0x0000134c51ddeff1:<ArrayBuffer: backingStore=0x0000000102700ef0, byteLength=5>,
[TEST] [LINE]     .uint8-array=0x0000134c51ddf0b9:<ArrayBufferView [neutered]>,
[TEST] [LINE]     .buffer=0x0000134c51ddf431:<ArrayBufferView: backingStore=0x000000010280d600, byteOffset=2048, byteLength=6>,
[TEST] [LINE]     .scoped=<unknown field type>}>
ok 14 [0] null element
ok 15 [4] undefined element
ok 16 [23] RegExp element
ok 17 [25] Arrow Function element
ok 18 .some-key property
ok 19 .other-key property
ok 20 .array JSArray property
ok 21 .array JSArray property
ok 22 .array-buffer JSArrayBuffer property
not ok 23 .uint8-array JSArrayBufferView property
  ---
    operator: ok
    expected: true
    actual:   null
    at: sess.linesUntil (/Users/joyee/projects/llnode/test/inspect-test.js:103:7)
  ...
/Users/joyee/projects/llnode/test/inspect-test.js:104
    uint8Array = uint8ArrayMatch[1];

Discovered during investigation of https://github.com/nodejs/llnode/pull/144

[joyeecheung]

I think this is always the case on v8.9.1, but it is not on v8.9.0 or v9.x.

Refs: https://github.com/nodejs/node/pull/16704

[joyeecheung]

A simple reproduction:

'use strict';

function run(a) {
  throw new Error();
}

const arr = new Uint8Array([0x01, 0x40, 0x60, 0x80, 0xf0, 0xff]);
run(arr);

a is not neutered when running this with lldb -- node --abort_on_uncaught_exception --turbo_inline_array_builtins, but is neutered if --turbo_inline_array_builtins is not passed.

If throw new Error(); is changed to while(true) {} and we trigger the break manually to inspect the heap, then a won't be neutered. This should be related to how V8 handles aborts..