icecat: add release icecat-140.7.0-1gnu1 for ecne

icecat/js/src/debugger/Debugger.cpp

@@ -453,7 +453,10 @@ Breakpoint::Breakpoint(Debugger* debugger, HandleObject wrappedDebugger,
 }
 
 void Breakpoint::trace(JSTracer* trc) {
+  MOZ_ASSERT_IF(trc->kind() != JS::TracerKind::Moving,
+                !IsDeadProxyObject(wrappedDebugger));
   TraceEdge(trc, &wrappedDebugger, "breakpoint owner");
+
   TraceEdge(trc, &handler, "breakpoint handler");
 }
 

icecat/js/src/gc/BufferAllocator.cpp

@@ -1210,6 +1210,13 @@ void BufferAllocator::abortMajorSweeping(const AutoLock& lock) {
 
   clearAllocatedDuringCollectionState(lock);
 
+  if (minorState == State::Sweeping) {
+    // If we are minor sweeping then chunks with allocatedDuringCollection set
+    // may be present in |mixedChunksToSweep|. Set a flag so these are cleared
+    // when they are merged later.
+    majorFinishedWhileMinorSweeping = true;
+  }
+
   for (BufferChunk* chunk : mediumTenuredChunksToSweep.ref()) {
     chunk->markBits.ref().clear();
   }

icecat/js/src/jit-test/tests/debug/bug-1995637.js

@@ -0,0 +1,66 @@
+// |jit-test| error: TypeError
+gczeal(9,16);
+function F1() {
+    if (!new.target) { throw 'must be called with new'; }
+    this.b = null;
+}
+new F1();
+new F1();
+function f5() {}
+new BigUint64Array(3474);
+function f14() {}
+function f25(a26, a27) {
+    for (let i30 = 0, i31 = true; i31; i31--) {
+        function f37() {
+            function F38() {}
+            for (let i44 = 0, i45 = SharedArrayBuffer; i45;
+                (() => {
+                    i45--;
+                    Int8Array.principal = BigUint64Array;
+                    function F50() {}
+                    Int8Array.sameZoneAs = /wp(?:a?)+/imu;
+                    const v54 = this.newGlobal(Int8Array);
+                    const t7 = ({ __proto__: v54 }).Debugger;
+                    const v57 = t7(F50);
+                    const v59 = v57.getNewestFrame(i30, i45, i45, f25, v57).older;
+                    v59.script.setBreakpoint(16, v59);
+                })()) {}
+            for (let [i134, i135] = (() => {
+                    for (let i84 = 0, i85 = 10; i85;
+                        (() => {
+                            i85--;
+                            for (let [i102, i103] = (() => {
+                                    for (let [i95, i96] = (() => {
+                                            new Uint8Array();
+                                            return [0, 10];
+                                        })(); i96; i96--) {
+                                    }
+                                    return [0, SharedArrayBuffer];
+                                })();
+                                i103; i103--) {}
+                            for (let i113 = -4, i114 = 10; i114; i114--) {}
+                            for (let i122 = 4, i123 = 10; i123--, i123; i123--) {
+                                i123++;
+                            }
+                        })()) {}
+                    return [0, SharedArrayBuffer];
+                })();
+                i135; i135--) {            }
+            for (let i143 = 0, i144 = 10; i144; i144--) {}
+        }
+        f37.apply();
+    }
+    for (let i153 = 0, i154 = 10; i154; i154--) {}
+    function F160(a162, a163) {
+        if (!new.target) { throw 'must be called with new'; }
+        this.c = a27;
+        this.h = a162;
+    }
+    new F160(234, a27);
+    const v167 = this.nukeAllCCWs();
+    for (let i170 = 0, i171 = 10; i171; i171--) {}
+    try {
+        f25();
+    } catch(e178) {}
+}
+f25(f25, f25);

icecat/js/src/jit-test/tests/debug/bug-1999464.js

@@ -0,0 +1,6 @@
+fullcompartmentchecks(1);
+var x = newGlobal({ newCompartment: true });
+Debugger(x).onEnterFrame = function (y) {
+  y.script.setBreakpoint(0, {});
+};
+x.eval("(function(){})()");

icecat/js/src/jit-test/tests/debug/bug-2002646.js

@@ -0,0 +1,8 @@
+var x = newGlobal({ newCompartment: true });
+Debugger(x).onDebuggerStatement = function (y) {
+  y.script.setBreakpoint(y.script.getLineOffsets(1)[0], {
+    hit: function () {},
+  });
+};
+x.eval("function* g() { debugger; return; };g().next()");
+relazifyFunctions();

icecat/js/src/jit-test/tests/debug/bug-2003588.js

@@ -0,0 +1,9 @@
+var x = newGlobal({ newCompartment: true });
+var y = Debugger(x);
+y.x = y;
+y.onDebuggerStatement = function(w) {
+  nukeAllCCWs();
+  w.environment.getVariable("x");
+}
+x.eval('function f(z) { with(z) { debugger } }');
+x.f(y);

icecat/js/src/jit-test/tests/debug/bug-2003809.js

@@ -0,0 +1,8 @@
+var x = newGlobal({ newCompartment: true });
+Debugger(x).onNewScript = function f(z) { m = z };
+x.eval("function g(){}");
+m.setBreakpoint(0, {});
+nukeAllCCWs();
+recomputeWrappers();
+gc();
+

icecat/js/src/jit-test/tests/gc/bug-2003100.js

@@ -0,0 +1,9 @@
+var dbgA = new Debugger;
+var g1 = newGlobal({newCompartment: true});
+g1.eval('function g1f() { print("Weltuntergang"); }');
+var DOAg1 = dbgA.addDebuggee(g1);
+var DOAg1f = DOAg1.getOwnPropertyDescriptor('g1f').value;
+DOAg1f.script.setBreakpoint(0, { hit: () => { logA += '1'; } });
+gczeal(2,1)
+class Base { }
+recomputeWrappers();

icecat/js/src/proxy/CrossCompartmentWrapper.cpp

@@ -5,6 +5,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "builtin/FinalizationRegistryObject.h"
+#include "debugger/Debugger.h"
 #include "gc/GC.h"
 #include "gc/PublicIterators.h"
 #include "js/friend/WindowProxy.h"  // js::IsWindow, js::IsWindowProxy
@@ -449,6 +450,12 @@ JS_PUBLIC_API bool js::NukeCrossCompartmentWrappers(
         continue;
       }
 
+      // Don't nuke wrappers for debugger objects. These are used in Breakpoints
+      // and nuking them breaks debugger invariants.
+      if (MOZ_UNLIKELY(wrapped->is<DebuggerInstanceObject>())) {
+        continue;
+      }
+
       // We only skip nuking window references that point to a target
       // compartment, not the ones that belong to it.
       if (nukeReferencesToWindow == DontNukeWindowReferences &&
@@ -471,6 +478,12 @@ JS_PUBLIC_API bool js::AllowNewWrapper(JS::Compartment* target, JSObject* obj) {
 
   MOZ_ASSERT(obj->compartment() != target);
 
+  // Wrappers for debugger objects are not nuked and we must continue to allow
+  // them to be created or we will break the invariants in Compartment::wrap.
+  if (MOZ_UNLIKELY(obj->is<DebuggerInstanceObject>())) {
+    return true;
+  }
+
   if (target->nukedOutgoingWrappers ||
       obj->nonCCWRealm()->nukedIncomingWrappers) {
     return false;
@@ -501,6 +514,9 @@ void js::RemapWrapper(JSContext* cx, JSObject* wobjArg,
 
   AutoDisableProxyCheck adpc;
 
+  // This can't GC (and RemapDeadWrapper suppresses it).
+  JS::AutoAssertNoGC nogc(cx);
+
   // If we're mapping to a different target (as opposed to just recomputing
   // for the same target), we must not have an existing wrapper for the new
   // target, otherwise this will break.
@@ -542,6 +558,10 @@ void js::RemapDeadWrapper(JSContext* cx, HandleObject wobj,
 
   AutoDisableProxyCheck adpc;
 
+  // Suppress GC while we manipulate the wrapper map so that it can't observe
+  // intervening state.
+  gc::AutoSuppressGC nogc(cx);
+
   // wobj is not a cross-compartment wrapper, so we can use nonCCWRealm.
   Realm* wrealm = wobj->nonCCWRealm();
 

icecat/js/xpconnect/loader/ScriptPreloader.cpp

@@ -673,6 +673,36 @@ void ScriptPreloader::PrepareCacheWrite() {
   PrepareCacheWriteInternal();
 }
 
+// A struct to hold reference to a CachedStencil and the snapshot of the
+// CachedStencil::mLoadTime field.
+// CachedStencil::mLoadTime field can be modified concurrently, and we need
+// to create a snapshot, in order to sort scripts.
+struct CachedStencilRefAndTime {
+  using CachedStencil = ScriptPreloader::CachedStencil;
+  CachedStencil* mStencil;
+  TimeStamp mLoadTime;
+
+  explicit CachedStencilRefAndTime(CachedStencil* aStencil)
+      : mStencil(aStencil), mLoadTime(aStencil->mLoadTime) {}
+
+  // For use with nsTArray::Sort.
+  //
+  // Orders scripts by script load time, so that scripts which are needed
+  // earlier are stored earlier, and scripts needed at approximately the
+  // same time are stored approximately contiguously.
+  struct Comparator {
+    bool Equals(const CachedStencilRefAndTime& a,
+                const CachedStencilRefAndTime& b) const {
+      return a.mLoadTime == b.mLoadTime;
+    }
+
+    bool LessThan(const CachedStencilRefAndTime& a,
+                  const CachedStencilRefAndTime& b) const {
+      return a.mLoadTime < b.mLoadTime;
+    }
+  };
+} JS_HAZ_NON_GC_POINTER;
+
 // Writes out a script cache file for the scripts accessed during early
 // startup in this session. The cache file is a little-endian binary file with
 // the following format:
@@ -726,19 +756,20 @@ Result<Ok, nsresult> ScriptPreloader::WriteCache() {
     mMonitor.AssertNotCurrentThreadOwns();
     MonitorAutoLock mal(mMonitor);
 
-    nsTArray<CachedStencil*> scripts;
+    nsTArray<CachedStencilRefAndTime> scriptRefs;
     for (auto& script : IterHash(mScripts, Match<ScriptStatus::Saved>())) {
-      scripts.AppendElement(script);
+      scriptRefs.AppendElement(CachedStencilRefAndTime(script));
     }
 
     // Sort scripts by load time, with async loaded scripts before sync scripts.
     // Since async scripts are always loaded immediately at startup, it helps to
     // have them stored contiguously.
-    scripts.Sort(CachedStencil::Comparator());
+    scriptRefs.Sort(CachedStencilRefAndTime::Comparator());
 
     OutputBuffer buf;
     size_t offset = 0;
-    for (auto script : scripts) {
+    for (auto& scriptRef : scriptRefs) {
+      auto* script = scriptRef.mStencil;
       script->mOffset = offset;
       MOZ_DIAGNOSTIC_ASSERT(
           JS::IsTranscodingBytecodeOffsetAligned(script->mOffset));
@@ -768,7 +799,8 @@ Result<Ok, nsresult> ScriptPreloader::WriteCache() {
       written += padding;
     }
 
-    for (auto script : scripts) {
+    for (auto& scriptRef : scriptRefs) {
+      auto* script = scriptRef.mStencil;
       MOZ_DIAGNOSTIC_ASSERT(JS::IsTranscodingBytecodeOffsetAligned(written));
       MOZ_TRY(Write(fd, script->Range().begin().get(), script->mSize));
 

icecat/js/xpconnect/loader/ScriptPreloader.h

@@ -67,6 +67,8 @@ struct Matcher {
 
 using namespace mozilla::loader;
 
+struct CachedStencilRefAndTime;
+
 class ScriptPreloader : public nsIObserver,
                         public nsIMemoryReporter,
                         public nsIRunnable,
@@ -216,21 +218,6 @@ class ScriptPreloader : public nsIObserver,
                                      : ScriptStatus::Saved;
     }
 
-    // For use with nsTArray::Sort.
-    //
-    // Orders scripts by script load time, so that scripts which are needed
-    // earlier are stored earlier, and scripts needed at approximately the
-    // same time are stored approximately contiguously.
-    struct Comparator {
-      bool Equals(const CachedStencil* a, const CachedStencil* b) const {
-        return a->mLoadTime == b->mLoadTime;
-      }
-
-      bool LessThan(const CachedStencil* a, const CachedStencil* b) const {
-        return a->mLoadTime < b->mLoadTime;
-      }
-    };
-
     struct StatusMatcher final : public Matcher<CachedStencil*> {
       explicit StatusMatcher(ScriptStatus status) : mStatus(status) {}
 
@@ -388,6 +375,8 @@ class ScriptPreloader : public nsIObserver,
     MaybeOneOf<JS::TranscodeBuffer, nsTArray<uint8_t>> mXDRData;
   } JS_HAZ_NON_GC_POINTER;
 
+  friend struct CachedStencilRefAndTime;
+
   template <ScriptStatus status>
   static Matcher<CachedStencil*>* Match() {
     static CachedStencil::StatusMatcher matcher{status};