lib,src: reset zero fill flag on exception

Exceptions thrown from the Uint8Array constructor would leave it
disabled.

Regression introduced in commit 27e84dd ("lib,src: clean up
ArrayBufferAllocator") from two days ago.  A follow-up commit
will add a regression test.

PR-URL: https://github.com/nodejs/node/pull/7093
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Trevor Norris <trev.norris@gmail.com>

lib/buffer.js

@@ -65,8 +65,15 @@ const zeroFill = bindingObj.zeroFill || [0];
 
 function createBuffer(size, noZeroFill) {
   if (noZeroFill)
-    zeroFill[0] = 0;  // Reset by the runtime.
-  const ui8 = new Uint8Array(size);
+    zeroFill[0] = 0;
+
+  try {
+    var ui8 = new Uint8Array(size);
+  } finally {
+    if (noZeroFill)
+      zeroFill[0] = 1;
+  }
+
   Object.setPrototypeOf(ui8, Buffer.prototype);
   return ui8;
 }

src/node.cc

@@ -973,8 +973,8 @@ Local<Value> WinapiErrnoException(Isolate* isolate,
 void* ArrayBufferAllocator::Allocate(size_t size) {
   if (zero_fill_field_ || zero_fill_all_buffers)
     return calloc(size, 1);
-  zero_fill_field_ = 1;
-  return malloc(size);
+  else
+    return malloc(size);
 }
 
 static bool DomainHasErrorHandler(const Environment* env,