Bug 1465470 Part 3 - Preserve iteration order for structured clone transferable object table, r=jorendorff.

--HG--
extra : rebase_source : 33380e77e4c0fc7014f79b6252b073eab07b5a78

js/src/vm/StructuredClone.cpp

@@ -482,7 +482,7 @@ struct JSStructuredCloneWriter {
           counts(out.context()), entries(out.context()),
           memory(out.context()),
           transferable(out.context(), tVal),
-          transferableObjects(out.context(), GCHashSet<JSObject*>(cx)),
+          transferableObjects(out.context(), TransferableObjectsSet(cx)),
           cloneDataPolicy(cloneDataPolicy)
     {
         out.setCallbacks(cb, cbClosure, OwnTransferablePolicy::NoTransferables);
@@ -566,9 +566,23 @@ struct JSStructuredCloneWriter {
                                   SystemAllocPolicy>;
     Rooted<CloneMemory> memory;
 
+    struct TransferableObjectsHasher : public DefaultHasher<JSObject*>
+    {
+        static inline HashNumber hash(const Lookup& l) {
+            // Iteration order of the transferable objects table must be
+            // preserved during recording/replaying, as the callbacks used
+            // during transfer may interact with the recording. Just use the
+            // same hash number for all elements to ensure this.
+            if (mozilla::recordreplay::IsRecordingOrReplaying())
+                return 0;
+            return DefaultHasher<JSObject*>::hash(l);
+        }
+    };
+
     // Set of transferable objects
     RootedValue transferable;
-    Rooted<GCHashSet<JSObject*>> transferableObjects;
+    typedef GCHashSet<JSObject*, TransferableObjectsHasher> TransferableObjectsSet;
+    Rooted<TransferableObjectsSet> transferableObjects;
 
     const JS::CloneDataPolicy cloneDataPolicy;