Bug 1254893 - Followup: read barrier wasm modules exposed via Debugger.findScript. (r=luke)

js/src/asmjs/Wasm.cpp

@@ -1454,7 +1454,6 @@ DecodeModule(JSContext* cx, UniqueChars file, const uint8_t* bytes, uint32_t len
     if (!moduleObj->init(cx->new_<Module>(Move(module))))
         return false;
 
-    cx->compartment()->wasmModules.insertBack(&moduleObj->module());
     return moduleObj->module().staticallyLink(cx, *staticLink);
 }
 

js/src/asmjs/WasmModule.cpp

@@ -905,6 +905,12 @@ Module::trace(JSTracer* trc)
     TraceEdge(trc, &ownerObject_, "wasm owner object");
 }
 
+/* virtual */ void
+Module::readBarrier()
+{
+    InternalBarrierMethods<JSObject*>::readBarrier(owner());
+}
+
 /* virtual */ void
 Module::addSizeOfMisc(MallocSizeOf mallocSizeOf, size_t* code, size_t* data)
 {

js/src/asmjs/WasmModule.h

@@ -514,6 +514,7 @@ class Module : public mozilla::LinkedListElement<Module>
     explicit Module(UniqueModuleData module);
     virtual ~Module();
     virtual void trace(JSTracer* trc);
+    virtual void readBarrier();
     virtual void addSizeOfMisc(MallocSizeOf mallocSizeOf, size_t* code, size_t* data);
 
     void setOwner(WasmModuleObject* owner) { MOZ_ASSERT(!ownerObject_); ownerObject_ = owner; }

js/src/jscompartment.h

@@ -470,8 +470,10 @@ struct JSCompartment
     // All unboxed layouts in the compartment.
     mozilla::LinkedList<js::UnboxedLayout> unboxedLayouts;
 
-    // All wasm modules in the compartment.
-    mozilla::LinkedList<js::wasm::Module> wasmModules;
+    // All wasm modules in the compartment. Weakly held.
+    //
+    // The caller needs to call wasm::Module::readBarrier() manually!
+    mozilla::LinkedList<js::wasm::Module> wasmModuleWeakList;
 
   private:
     // All non-syntactic lexical scopes in the compartment. These are kept in

js/src/vm/Debugger-inl.h

@@ -92,6 +92,9 @@ js::Debugger::onIonCompilation(JSContext* cx, Handle<ScriptVector> scripts, LSpr
 /* static */ void
 js::Debugger::onNewWasmModule(JSContext* cx, Handle<WasmModuleObject*> wasmModule)
 {
+    // Insert the wasm::Module into a compartment-wide list for discovery
+    // later without a heap walk.
+    cx->compartment()->wasmModuleWeakList.insertBack(&wasmModule->module());
     if (cx->compartment()->isDebuggee())
         slowPathOnNewWasmModule(cx, wasmModule);
 }

js/src/vm/Debugger.cpp

@@ -4071,8 +4071,8 @@ class MOZ_STACK_CLASS Debugger::ScriptQuery
         // TODOshu: Until such time that wasm modules are real ES6 modules,
         // unconditionally consider all wasm toplevel module scripts.
         for (WeakGlobalObjectSet::Range r = debugger->allDebuggees(); !r.empty(); r.popFront()) {
-            for (wasm::Module* module : r.front()->compartment()->wasmModules)
-                consider(module->owner());
+            for (wasm::Module* module : r.front()->compartment()->wasmModuleWeakList)
+                consider(module);
         }
 
         return true;
@@ -4304,14 +4304,19 @@ class MOZ_STACK_CLASS Debugger::ScriptQuery
      * If |wasmModule| matches this query, append it to |wasmModuleVector|.
      * Set |oom| if an out of memory condition occurred.
      */
-    void consider(WasmModuleObject* wasmModule) {
+    void consider(wasm::Module* wasmModule) {
         if (oom)
             return;
 
-        if (hasSource && source != AsVariant(wasmModule))
+        WasmModuleObject* moduleObject = wasmModule->owner();
+        if (hasSource && source != AsVariant(moduleObject))
             return;
 
-        if (!wasmModuleVector.append(wasmModule))
+        // The compartment-wide wasm::Module list is held weakly. Read barrier
+        // the ones we intend to expose.
+        wasmModule->readBarrier();
+
+        if (!wasmModuleVector.append(moduleObject))
             oom = true;
     }
 };