Bug 1620654 - Defer init of FunctionScope::Data::canonicalFunction. r=mgaudet

Defer initializing the canonicalFunction while the FunctionScope::Data is
owned by the ScopeCreationData. When the data is released to create the
concrete js::Scope, we fill in the canonicalFunction.

Depends on D73765

Differential Revision: https://phabricator.services.mozilla.com/D73772

js/src/frontend/Stencil.h

@@ -360,10 +360,7 @@ class ScopeCreationData {
 
   // Transfer ownership into a new UniquePtr.
   template <typename SpecificScopeType>
-  UniquePtr<typename SpecificScopeType::Data> releaseData() {
-    return UniquePtr<typename SpecificScopeType::Data>(
-        static_cast<typename SpecificScopeType::Data*>(data_.release()));
-  }
+  UniquePtr<typename SpecificScopeType::Data> releaseData();
 
   template <typename SpecificScopeType>
   Scope* createSpecificScope(JSContext* cx);

js/src/gc/Marking.cpp

@@ -1368,7 +1368,9 @@ inline void js::GCMarker::eagerlyMarkChildren(Scope* scope) {
     switch (scope->kind()) {
       case ScopeKind::Function: {
         FunctionScope::Data& data = scope->as<FunctionScope>().data();
-        traverseObjectEdge(scope, data.canonicalFunction);
+        if (data.canonicalFunction) {
+          traverseObjectEdge(scope, data.canonicalFunction);
+        }
         names = &data.trailingNames;
         length = data.length;
         break;

js/src/vm/Scope.cpp

@@ -1921,7 +1921,10 @@ bool ScopeCreationData::create(JSContext* cx,
     return false;
   }
 
-  RootedFunction fun(cx, funbox->function());
+  // We do not initialize the canonical function while the data is owned by the
+  // ScopeCreationData. It gets set in ScopeCreationData::releaseData.
+  RootedFunction fun(cx, nullptr);
+
   Rooted<frontend::EnvironmentShapeCreationData> envShape(cx);
   if (!FunctionScope::prepareForScopeCreation(
           cx, &data, hasParameterExprs,
@@ -2100,6 +2103,21 @@ Scope* ScopeCreationData::createSpecificScope<WithScope>(JSContext* cx) {
   return scope;
 }
 
+template <typename SpecificScopeType>
+UniquePtr<typename SpecificScopeType::Data> ScopeCreationData::releaseData() {
+  return UniquePtr<typename SpecificScopeType::Data>(
+      static_cast<typename SpecificScopeType::Data*>(data_.release()));
+}
+
+template <>
+UniquePtr<FunctionScope::Data> ScopeCreationData::releaseData<FunctionScope>() {
+  // Initialize the GCPtrs in the Scope::Data.
+  data<FunctionScope>().canonicalFunction = funbox_->function();
+
+  return UniquePtr<FunctionScope::Data>(
+      static_cast<FunctionScope::Data*>(data_.release()));
+}
+
 template <class SpecificScopeType>
 Scope* ScopeCreationData::createSpecificScope(JSContext* cx) {
   Rooted<UniquePtr<typename SpecificScopeType::Data>> rootedData(