Bug 1415721 - Update outdated comment about when to sweep shared script data r=sfink Differential Revision: https://phabricator.services.mozilla.com/D150461

Bug 1776833 - Part 2: Remove use of GC lock when accessing GC tunables r=sfink Depends on D150458 Differential Revision: https://phabricator.services.mozilla.com/D150460

Bug 1776833 - Part 1: Make GC tunables MainThreadData or move them to GCRuntime r=sfink The chunk settings move to GCRuntime where they are made GCLockData. Almost all tunable settings become MainThreadData with the exception of mallocThresholdBase which is accessed off-thread during sweeping since resizing contains can cause allocation. Differential Revision: https://phabricator.services.mozilla.com/D150458

Bug 1774941 - Add Error tests to structured-clone-battery-of-tests.js. r=sfink Differential Revision: https://phabricator.services.mozilla.com/D149695

Bug 1769451 - Part 1: Fix missing include in js/public. r=sfink Differential Revision: https://phabricator.services.mozilla.com/D146611

Bug 1772597: Fix TenuringTracer::moveToTenuredSlow() to update tenuredSize correctly when tenuring a Tuple r=sfink The case in `moveToTenuredSlow()` that previously only applied to arrays should also apply to tuples. Because this case wasn't handling tuples, tuple elements were getting double-counted (first when computing the destination size based on the destination alloc kind; then when adding the return value of `moveElementsToTenured()`). This in turn caused the value reported by the GC for the number of tenured bytes to be inaccurately high, causing an assertion failure in `Nursery::collect()` because the reported amount of tenured data is greater than the size of the nursery from the previous collection. Differential Revision: https://phabricator.services.mozilla.com/D148427

Bug 1772597: Use tighter upper bound for tenured bytes in GC assertion r=sfink The calculation for the previous GC's used nursery space should exclude the space used for chunk headers, since this space is not available for heap data and thus can't be promoted to the tenured heap. Making this assertion stricter doesn't cause any pre-existing tests to fail, but is necessary to minimize the test case for this bug. Differential Revision: https://phabricator.services.mozilla.com/D148426

Bug 1772393 - Allow 'mach jstests' in --disable-tests builds r=iain,sfink Similar to 'mach jit-tests', we now can allow 'mach jstests' to work with just the normal build artifacts. Differential Revision: https://phabricator.services.mozilla.com/D148152

Bug 1771747 - Part 5: Assert that we don't underflow the retained size r=sfink Finally we can add the assertion. Differential Revision: https://phabricator.services.mozilla.com/D147850

Bug 1771747 - Part 4: Add CellAllocPolicy to track memory associated with a single GC cell r=sfink One hurdle for this set of changes is distinguishing which memory is associated with a single GC cell and which is associated with the system as a whole. The former should be tracked against retained size and the latter cannot. To fix this we must split the current ZoneAllocPolicy since it is used for both cases. This introduces a TrackedAllocPolicy which performs common operations and is templated to specify whether the memory is associated with a cell or which the zone as a whole. ZoneAllocPolicy and a new CellAllocPolicy are then instantiations of this template. This converts uses of ZoneAllocPolicy to CellAllocPolicy where possible. Notably weak maps are left as ZoneAllocPolicy even though they may be associated with a cell since some of them are associated with the system. Differential Revision: https://phabricator.services.mozilla.com/D147849

Bug 1771747 - Part 3: Remove the 'wasSwept' parameter from js::RemoveCellMemory r=sfink Finalizers should use GCContext::removeCellMemory for this which will do the right thing. No existing uses of RemoveCellMemory supply this parameter. Differential Revision: https://phabricator.services.mozilla.com/D147848

Bug 1771747 - Part 2: Give GCContext GCUse in release builds r=sfink Previously GCContext had a 'collecting' flag and a debug mode field indicating what part of the collecctor was using that thread. This makes the latter unconditional so we can can see when a thread is finalizing. This can be used to tell when we need to count freed memory against the retained size. The collecting flag and AutoSetThreadIsPerformingGC are removed. Assert that the context's GC use is finalizing when calling finalizers and freeing arenas. Differential Revision: https://phabricator.services.mozilla.com/D147847

Bug 1771747 - Part 1: Update jit heap size data on GC start r=sfink Add missing update for JIT heap size at the start of GC. Differential Revision: https://phabricator.services.mozilla.com/D147846

Bug 1772082 - Add current heap size to JS_GC_PROFILE output r=sfink Differential Revision: https://phabricator.services.mozilla.com/D147841

Bug 1771315 - Add a command line option to the shell to set GC parameters r=sfink This moves the parameter names and other data to a header file and adds a command line option --gc-param. Differential Revision: https://phabricator.services.mozilla.com/D147428

Bug 1771314 - Remove unused methods to track 'adopted' memory r=sfink Differential Revision: https://phabricator.services.mozilla.com/D147427

Bug 1770769 - Remove heap limit factor to discourage atoms GCs during pageload r=sfink These don't block off-thread parsing any more so we should be able to remove this heuristic. Differential Revision: https://phabricator.services.mozilla.com/D147096

Bug 1770266 - Don't recompute wrappers to finalization registry records r=sfink Something I didn't realise is that remapping a wrapper can make the wrapper point at the original target again after nuking it. The code assumed that nuked wrappers stayed dead. Wrappers to finalization record objects (not registries) are not exposed so I think we can skip recomputing wrappers to these. Our assertions were a little over-eager here too. We shouldn't expect to see an entry in the cross-zone records table for records that have their 'in map' flag cleard, even if the entry hasn't been removed by sweeping yet. Differential Revision: https://phabricator.services.mozilla.com/D147090

Bug 1770082 - Reduce recursion depth for test case to fix failures on win32 builds r=sfink I checked that the reduced depth does still reproduce the issue. Differential Revision: https://phabricator.services.mozilla.com/D146802

Bug 1659025 - Implement [Transferable] for ReadableStream r=smaug,sfink Differential Revision: https://phabricator.services.mozilla.com/D139525

Bug 1768813 - Don't clear mark state for all zones in incremental marking verification r=sfink The mark state of uncollected zones influences the final mark state because incoming cross compartment edges from uncollected zones are conditionally marked depending on whether the source of the edge is gray in Compartment::traceWrapperTargetsInCollectedZones. I left in some extra debug output to help debug future problems. Differential Revision: https://phabricator.services.mozilla.com/D146690

Bug 1659025 - Implement [Transferable] for ReadableStream r=smaug,sfink Differential Revision: https://phabricator.services.mozilla.com/D139525

Bug 1659025 - Implement [Transferable] for ReadableStream r=smaug,sfink Differential Revision: https://phabricator.services.mozilla.com/D139525

Bug 1769239 - Upload js.wasm binary for SM(wasi) tasks. r=sfink Also add --disable-debug-symbols to shrink this from 140+ MB to about 8.5 MB. Differential Revision: https://phabricator.services.mozilla.com/D146296

Bug 1766038 - Prefer full qualified types over typedefs for JS::Handle/Rooted r=andi,sfink Differential Revision: https://phabricator.services.mozilla.com/D145802

Bug 1766038 - Prefer full qualified types over typedefs for JS::Handle/Rooted r=andi,sfink Differential Revision: https://phabricator.services.mozilla.com/D145802

Bug 1767224 - don't guard struct CCIntervalMarker by MOZ_GECKO_PROFILER r=sfink Differential Revision: https://phabricator.services.mozilla.com/D145238

Bug 1766647 - Check readString result in JS_ReadString r=sfink Differential Revision: https://phabricator.services.mozilla.com/D144887

Bug 1752332: Suppress Hazard warnings due to hash table function pointers r=sfink Differential Revision: https://phabricator.services.mozilla.com/D144437

Bug 1752332: Suppress Hazard warnings due to hash table function pointers r=sfink Differential Revision: https://phabricator.services.mozilla.com/D144437

Bug 1561357 - Implement [Serializable] for DOMException r=smaug,sfink Skipping stack serialization here as * it's optional per the spec * no WPT test exists * Chrome doesn't support it either * not sure how it's usable when transferred to other domain. Differential Revision: https://phabricator.services.mozilla.com/D143625

Bug 1763874 - Handle tuples properly in compacting GC r=sfink Like arrays, tuples have fixed elements. The GC previously assumed that only arrays can have fixed elements, and so tuple elements weren't being traced properly. Differential Revision: https://phabricator.services.mozilla.com/D143307

Bug 1763874 - Handle tuples properly in compacting GC r=sfink Like arrays, tuples have fixed elements. The GC previously assumed that only arrays can have fixed elements, and so tuple elements weren't being traced properly. Differential Revision: https://phabricator.services.mozilla.com/D143307

Bug 1762661 - Part 1: Add Promise::ThenWithCycleCollectedArgsJS r=smaug,mgaudet,sfink Differential Revision: https://phabricator.services.mozilla.com/D142151

Bug 1759174 - Part 5: Tidy up marking assertion related to shared GC things r=sfink Depends on D140868 Differential Revision: https://phabricator.services.mozilla.com/D140869

Bug 1759174 - Part 4: Optimise internal barriers by removing checks for shared GC things r=sfink These barriers already go on to check the mark state of the GC thing so we don't need to also check whether it's shared first. Depends on D140867 Differential Revision: https://phabricator.services.mozilla.com/D140868

Bug 1759174 - Part 3: Optimise expose and read barrier APIs by removing check for shared GC things r=sfink Depends on D140866 Differential Revision: https://phabricator.services.mozilla.com/D140867

Bug 1759174 - Part 2: Optimize GCThingIsMarkedGray APIs by removing check for shared GC things r=sfink,mccr8 This splits the API into two, one that does a bunch of checks and calls into the JS engine, and one for use by the CC where all preconditions are assumed to be satisfied and can be inlined entirely. Depends on D140865 Differential Revision: https://phabricator.services.mozilla.com/D140866

Bug 1759174 - Part 1: Don't trigger barriers when updating a JSFunction's script during GC r=sfink This was triggering the post barrier which ran into an assertion failure with later patches because it happens off the main thread. We don't need any barriers when the GC is updating the pointer. Differential Revision: https://phabricator.services.mozilla.com/D140865

Bug 1743098 - Dump object internals on cross compartment assertion failure r=sfink Not a fix. This seems to be happening infrequently on infra and dumping some information about the objects concerned might point us in the right direction. Differential Revision: https://phabricator.services.mozilla.com/D140829

Bug 1752861 - [profiler] Expose GC and CC operations to the JS view r=sfink,smaug Differential Revision: https://phabricator.services.mozilla.com/D140390

Bug 1757573 - Use the correct zone when looking up nuked WeakRef CCWs r=sfink WeakRefs are exposed to the user so anyone can create CCWs to WeakRefs. Don't assume that a nuked WeakRef CCW is one that we created but get it's target to find which zone to look it up in. Differential Revision: https://phabricator.services.mozilla.com/D140044

Bug 1755725 - Part 4: Add WeakRef tests where the weak ref and its target are in different zones r=sfink Depends on D139837 Differential Revision: https://phabricator.services.mozilla.com/D139838

Bug 1755725 - Part 3: Add cross-zone WeakRef wrappers to a weak set to keep them alive r=sfink This fixes weak ref behaviour with cross zone targets. Previously the wrapper died because there was nothing to keep it alive and the weak ref target was cleared, even if the target was still alive. Depends on D139836 Differential Revision: https://phabricator.services.mozilla.com/D139837

Bug 1755725 - Part 2: Refactor FinalizationObservers in preparation to add a weak set for weak refs r=sfink This renames crossZoneWarppers to crossZoneRecordWrappers and makes add/RemoveCrossZoneWarpper take the set as an argument. Depends on D139835 Differential Revision: https://phabricator.services.mozilla.com/D139836

Bug 1755725 - Part 1: Factor out crossZoneWrappers checks and do them before we calculate sweep groups r=sfink Differential Revision: https://phabricator.services.mozilla.com/D139835

Bug 1756568 - Part 4: Merge WeakRef support data structures into FinalizationObservers r=sfink Depends on D139693 Differential Revision: https://phabricator.services.mozilla.com/D139694

Bug 1756568 - Part 3: Rename source files containing FinalizationRegistry GC implementation to FinalizationObservers.cpp r=sfink Depends on D139692 Differential Revision: https://phabricator.services.mozilla.com/D139693

Bug 1756568 - Part 2: Rename FinalizationRegistry support data structures to FinalizationObservers r=sfink Depends on D139691 Differential Revision: https://phabricator.services.mozilla.com/D139692

Bug 1756568 - Part 1: Simplify WeakRef sweeping a little by using GCVector::mutableEraseIf r=sfink Differential Revision: https://phabricator.services.mozilla.com/D139691