path: root/js/src/jit-test/tests/gc/weak-marking-03.js

// |jit-test| allow-unhandlable-oom

// weakmap marking tests that use the testing mark queue to force an ordering
// of marking.

// We are carefully controlling the sequence of GC events.
gczeal(0);

// If a command-line parameter is given, use it as a substring restriction on
// the tests to run.
var testRestriction = scriptArgs[0];
printErr(`testRestriction is ${testRestriction || '(run all tests)'}`);

function runtest(func) {
  if (testRestriction && ! func.name.includes(testRestriction)) {
    print("\Skipping " + func.name);
  } else {
    print("\nRunning " + func.name);
    func();
  }
}

function reportMarks(prefix = "") {
  const marks = getMarks();
  const current = currentgc();
  const markstr = marks.join("/");
  print(`${prefix}[${current.incrementalState}/${current.sweepGroup}@${current.queuePos}] ${markstr}`);
  return markstr;
}

function startGCMarking() {
  startgc(100000);
  while (gcstate() === "Prepare") {
    gcslice(100000);
  }
}

function purgeKey() {
  const m = new WeakMap();
  const vals = {};
  vals.key = Object.create(null);
  vals.val = Object.create(null);
  m.set(vals.key, vals.val);

  minorgc();

  addMarkObservers([m, vals.key, vals.val]);

  enqueueMark(m);
  enqueueMark("yield");

  enqueueMark(vals.key);
  enqueueMark("yield");

  vals.key = vals.val = null;

  startGCMarking();
  // getMarks() returns map/key/value
  assertEq(getMarks().join("/"), "black/unmarked/unmarked",
           "marked the map black");

  gcslice(100000);
  assertEq(getMarks().join("/"), "black/black/unmarked",
           "key is now marked");

  // Trigger purgeWeakKey: the key is in weakkeys (because it was unmarked when
  // the map was marked), and now we're removing it.
  m.delete(nondeterministicGetWeakMapKeys(m)[0]);

  finishgc(); // Finish the GC
  assertEq(getMarks().join("/"), "black/black/black",
           "at end, value is marked too");

  clearMarkQueue();
  clearMarkObservers();
}

if (this.enqueueMark)
  runtest(purgeKey);

function removeKey() {
  reportMarks("removeKey start: ");

  const m = new WeakMap();
  const vals = {};
  vals.key = Object.create(null);
  vals.val = Object.create(null);
  m.set(vals.key, vals.val);

  minorgc();

  addMarkObservers([m, vals.key, vals.val]);

  enqueueMark(m);
  enqueueMark("yield");

  startGCMarking();
  reportMarks("first: ");
  var marks = getMarks();
  assertEq(marks[0], "black", "map is black");
  assertEq(marks[1], "unmarked", "key not marked yet");
  assertEq(marks[2], "unmarked", "value not marked yet");
  m.delete(vals.key);

  finishgc(); // Finish the GC
  reportMarks("done: ");
  marks = getMarks();
  assertEq(marks[0], "black", "map is black");
  assertEq(marks[1], "black", "key is black");
  assertEq(marks[2], "black", "value is black");

  // Do it again, but this time, remove all other roots.
  m.set(vals.key, vals.val);
  vals.key = vals.val = null;
  startgc(10000);
  while (gcstate() !== "Mark") {
    gcslice(100000);
  }
  marks = getMarks();
  assertEq(marks[0], "black", "map is black");
  assertEq(marks[1], "unmarked", "key not marked yet");
  assertEq(marks[2], "unmarked", "value not marked yet");

  // This was meant to test the weakmap deletion barrier, which would remove
  // the key from weakkeys. Unfortunately, JS-exposed WeakMaps now have a read
  // barrier on lookup that marks the key, and deletion requires a lookup.
  m.delete(nondeterministicGetWeakMapKeys(m)[0]);

  finishgc();
  marks = getMarks();
  assertEq(marks[0], "black", "map is black");
  assertEq(marks[1], "black", "key was blackened by lookup read barrier during deletion");
  assertEq(marks[2], "black", "value is black because map and key are black");

  clearMarkQueue();
  clearMarkObservers();
}

if (this.enqueueMark)
  runtest(removeKey);

// Test:
//   1. mark the map
//     - that inserts the delegate into weakKeys
//   2. nuke the CCW key
//     - removes the delegate from weakKeys
//   3. mark the key
//   4. enter weak marking mode
//
// The problem it's attempting to recreate is that entering weak marking mode
// will no longer mark the value, because there's no delegate to trigger it,
// and the key was not added to weakKeys (because at the time the map was
// scanned, the key had a delegate, so it was added to weakKeys instead.)
function nukeMarking() {
  const g1 = newGlobal({newCompartment: true});

  const vals = {};
  vals.map = new WeakMap();
  vals.key = g1.eval("Object.create(null)");
  vals.val = Object.create(null);
  vals.map.set(vals.key, vals.val);
  vals.val = null;
  gc();

  // Set up the sequence of marking events.
  enqueueMark(vals.map);
  enqueueMark("yield");
  // We will nuke the key's delegate here.
  enqueueMark(vals.key);
  enqueueMark("enter-weak-marking-mode");

  // Okay, run through the GC now.
  startgc(1000000);
  while (gcstate() !== "Mark") {
    gcslice(100000);
  }
  assertEq(gcstate(), "Mark", "expected to yield after marking map");
  // We should have marked the map and then yielded back here.
  nukeCCW(vals.key);
  // Finish up the GC.
  gcslice();

  clearMarkQueue();
}

if (this.enqueueMark)
  runtest(nukeMarking);

// Similar to the above, but trying to get a different failure:
//  - start marking
//  - find a map, add its key to ephemeronEdges
//  - nuke the key (and all other CCWs between the key -> delegate zones)
//  - when sweeping, we will no longer have any edges between the key
//    and delegate zones. So they will be placed in separate sweep groups.
//  - for this test, the delegate zone must be swept after the key zone
//  - make sure we don't try to mark back in the key zone (due to an
//    ephemeron edge) while sweeping the delegate zone. In a DEBUG build,
//    this would assert.
function nukeMarkingSweepGroups() {
  // Create g1 before host, because that will result in the right zone
  // ordering to trigger the bug.
  const g1 = newGlobal({newCompartment: true});
  const host = newGlobal({newCompartment: true});
  host.g1 = g1;
  host.eval(`
  const vals = {};
  vals.map = new WeakMap();
  vals.key = g1.eval("Object.create(null)");
  vals.val = Object.create(null);
  vals.map.set(vals.key, vals.val);
  vals.val = null;
  gc();

  // Set up the sequence of marking events.
  enqueueMark(vals.map);
  enqueueMark("yield");
  // We will nuke the key's delegate here.
  enqueueMark(vals.key);
  enqueueMark("enter-weak-marking-mode");

  // Okay, run through the GC now.
  startgc(1);
  while (gcstate() === "Prepare") {
    gcslice(100000);
  }
  assertEq(gcstate(), "Mark", "expected to yield after marking map");
  // We should have marked the map and then yielded back here.
  nukeAllCCWs();
  // Finish up the GC.
  while (gcstate() === "Mark") {
    gcslice(1000);
  }
  gcslice();

  clearMarkQueue();
  `);
}

if (this.enqueueMark)
  runtest(nukeMarkingSweepGroups);

function transplantMarking() {
  const g1 = newGlobal({newCompartment: true});

  const vals = {};
  vals.map = new WeakMap();
  let {object, transplant} = transplantableObject();
  vals.key = object;
  object = null;
  vals.val = Object.create(null);
  vals.map.set(vals.key, vals.val);
  vals.val = null;
  gc();

  // Set up the sequence of marking events.
  enqueueMark(vals.map);
  enqueueMark("yield");
  // We will transplant the key here.
  enqueueMark(vals.key);
  enqueueMark("enter-weak-marking-mode");

  // Okay, run through the GC now.
  startgc(1000000);
  while (gcstate() !== "Mark") {
    gcslice(100000);
  }
  assertEq(gcstate(), "Mark", "expected to yield after marking map");
  // We should have marked the map and then yielded back here.
  transplant(g1);
  // Finish up the GC.
  gcslice();

  clearMarkQueue();
}

if (this.enqueueMark)
  runtest(transplantMarking);

// 1. Mark the map
//   => add delegate to weakKeys
// 2. Mark the delegate black
//   => do nothing because we are not in weak marking mode
// 3. Mark the key gray
//   => mark value gray, not that we really care
// 4. Enter weak marking mode
//   => black delegate darkens the key from gray to black
function grayMarkingMapFirst() {
  const g = newGlobal({newCompartment: true});
  const vals = {};
  vals.map = new WeakMap();
  vals.key = g.eval("Object.create(null)");
  vals.val = Object.create(null);
  vals.map.set(vals.key, vals.val);

  g.delegate = vals.key;
  g.eval("dummy = Object.create(null)");
  g.eval("grayRoot().push(delegate, dummy)");
  addMarkObservers([vals.map, vals.key]);
  g.addMarkObservers([vals.key, g.dummy]);
  addMarkObservers([vals.val]);

  gc();

  enqueueMark(vals.map);
  enqueueMark("yield"); // checkpoint 1

  g.enqueueMark(vals.key);
  enqueueMark("yield"); // checkpoint 2

  vals.val = null;
  vals.key = null;
  g.delegate = null;
  g.dummy = null;

  const showmarks = () => {
    print("[map,key,delegate,graydummy,value] marked " + JSON.stringify(getMarks()));
  };

  print("Starting incremental GC");
  startGCMarking();
  // Checkpoint 1, after marking map
  showmarks();
  var marks = getMarks();
  assertEq(marks[0], "black", "map is black");
  assertEq(marks[1], "unmarked", "key is not marked yet");
  assertEq(marks[2], "unmarked", "delegate is not marked yet");

  gcslice(100000);
  // Checkpoint 2, after marking delegate
  showmarks();
  marks = getMarks();
  assertEq(marks[0], "black", "map is black");
  assertEq(marks[1], "unmarked", "key is not marked yet");
  assertEq(marks[2], "black", "delegate is black");

  gcslice();
  // GC complete. Key was marked black (b/c of delegate), then gray marking saw
  // it was already black and skipped it.
  showmarks();
  marks = getMarks();
  assertEq(marks[0], "black", "map is black");
  assertEq(marks[1], "black", "delegate marked key black because of weakmap");
  assertEq(marks[2], "black", "delegate is still black");
  assertEq(marks[3], "gray", "basic gray marking is working");
  assertEq(marks[4], "black", "black map + black delegate => black value");

  clearMarkQueue();
  clearMarkObservers();
  grayRoot().length = 0;
  g.eval("grayRoot().length = 0");
}

if (this.enqueueMark)
  runtest(grayMarkingMapFirst);

function grayMarkingMapLast() {
  const g = newGlobal({newCompartment: true});
  const vals = {};
  vals.map = new WeakMap();
  vals.key = g.eval("Object.create(null)");
  vals.val = Object.create(null);
  vals.map.set(vals.key, vals.val);

  vals.map2 = new WeakMap();
  vals.key2 = g.eval("Object.create(null)");
  vals.val2 = Object.create(null);
  vals.map2.set(vals.key2, vals.val2);

  g.delegate = vals.key;
  g.eval("grayRoot().push(delegate)");
  addMarkObservers([vals.map, vals.key]);
  g.addMarkObservers([vals.key]);
  addMarkObservers([vals.val]);

  grayRoot().push(vals.key2);
  addMarkObservers([vals.map2, vals.key2]);
  g.addMarkObservers([vals.key2]);
  addMarkObservers([vals.val2]);

  const labels = ["map", "key", "delegate", "value", "map2", "key2", "delegate2", "value2"];

  gc();

  g.enqueueMark(vals.key);
  g.enqueueMark(vals.key2);
  enqueueMark("yield"); // checkpoint 1

  vals.val = null;
  vals.key = null;
  g.delegate = null;

  vals.map2 = null; // Important! Second map is never marked, keeps nothing alive.
  vals.key2 = null;
  vals.val2 = null;
  g.delegate2 = null;

  const labeledMarks = () => {
    const info = {};
    const marks = getMarks();
    for (let i = 0; i < labels.length; i++)
      info[labels[i]] = marks[i];
    return info;
  };

  const showmarks = () => {
    print("Marks:");
    for (const [label, mark] of Object.entries(labeledMarks()))
      print(`  ${label}: ${mark}`);
  };

  print("Starting incremental GC");
  startGCMarking();
  // Checkpoint 1, after marking key
  showmarks();
  var marks = labeledMarks();
  assertEq(marks.map, "unmarked", "map is unmarked");
  assertEq(marks.key, "unmarked", "key is not marked yet");
  assertEq(marks.delegate, "black", "delegate is black");
  assertEq(marks.map2, "unmarked", "map2 is unmarked");
  assertEq(marks.key2, "unmarked", "key2 is not marked yet");
  assertEq(marks.delegate2, "black", "delegate2 is black");

  gcslice();
  // GC complete. When entering weak marking mode, black delegate propagated to
  // key.
  showmarks();
  marks = labeledMarks();
  assertEq(marks.map, "black", "map is black");
  assertEq(marks.key, "black", "delegate marked key black because of weakmap");
  assertEq(marks.delegate, "black", "delegate is still black");
  assertEq(marks.value, "black", "black map + black delegate => black value");
  assertEq(marks.map2, "dead", "map2 is dead");
  assertEq(marks.key2, "gray", "key2 marked gray, map2 had no effect");
  assertEq(marks.delegate2, "black", "delegate artificially marked black via mark queue");
  assertEq(marks.value2, "dead", "dead map + black delegate => dead value");

  clearMarkQueue();
  clearMarkObservers();
  grayRoot().length = 0;
  g.eval("grayRoot().length = 0");

  return vals; // To prevent the JIT from optimizing out vals.
}

if (this.enqueueMark)
  runtest(grayMarkingMapLast);

function grayMapKey() {
  const vals = {};
  vals.m = new WeakMap();
  vals.key = Object.create(null);
  vals.val = Object.create(null);
  vals.m.set(vals.key, vals.val);

  // Maps are allocated black, so we won't be able to mark it gray during the
  // first GC.
  gc();

  addMarkObservers([vals.m, vals.key, vals.val]);

  // Wait until we can mark gray (ie, sweeping). Mark the map gray and yield.
  // This should happen all in one slice.
  enqueueMark("set-color-gray");
  enqueueMark(vals.m);
  enqueueMark("unset-color");
  enqueueMark("yield");

  // Make the weakmap no longer reachable from the roots, so we can mark it
  // gray.
  vals.m = null;

  enqueueMark(vals.key);
  enqueueMark("yield");

  vals.key = vals.val = null;

  startGCMarking();
  assertEq(getMarks().join("/"), "gray/unmarked/unmarked",
           "marked the map gray");

  gcslice(100000);
  assertEq(getMarks().join("/"), "gray/black/unmarked",
           "key is now marked black");

  finishgc(); // Finish the GC

  assertEq(getMarks().join("/"), "gray/black/gray",
           "at end: black/gray => gray");

  clearMarkQueue();
  clearMarkObservers();
}

if (this.enqueueMark)
  runtest(grayMapKey);

function grayKeyMap() {
  const vals = {};
  vals.m = new WeakMap();
  vals.key = Object.create(null);
  vals.val = Object.create(null);
  vals.m.set(vals.key, vals.val);

  addMarkObservers([vals.m, vals.key, vals.val]);

  enqueueMark(vals.key);
  enqueueMark("yield");

  // Wait until we are gray marking.
  enqueueMark("set-color-gray");
  enqueueMark(vals.m);
  enqueueMark("unset-color");
  enqueueMark("yield");

  enqueueMark("set-color-black");
  enqueueMark(vals.m);
  enqueueMark("unset-color");

  // Make the weakmap no longer reachable from the roots, so we can mark it
  // gray.
  vals.m = null;

  vals.key = vals.val = null;

  // Only mark this zone, to avoid interference from other tests that may have
  // created additional zones.
  schedulezone(vals);

  startGCMarking();
  // getMarks() returns map/key/value
  reportMarks("1: ");
  assertEq(getMarks().join("/"), "unmarked/black/unmarked",
           "marked key black");

  // We always yield before sweeping (in the absence of zeal), so we will see
  // the unmarked state another time.
  gcslice(100000);
  reportMarks("2: ");
  assertEq(getMarks().join("/"), "unmarked/black/unmarked",
           "marked key black, yield before sweeping");

  gcslice(100000);
  reportMarks("3: ");
  assertEq(getMarks().join("/"), "gray/black/gray",
           "marked the map gray, which marked the value when map scanned");

  finishgc(); // Finish the GC
  reportMarks("4: ");
  assertEq(getMarks().join("/"), "black/black/black",
           "further marked the map black, so value should also be blackened");

  clearMarkQueue();
  clearMarkObservers();
}

if (this.enqueueMark)
  runtest(grayKeyMap);

// Cause a key to be marked black *during gray marking*, by first marking a
// delegate black, then marking the map and key gray. When the key is scanned,
// it should be seen to be a CCW of a black delegate and so should itself be
// marked black.
//
// The bad behavior being prevented is:
//
//  1. You wrap an object in a CCW and use it as a weakmap key to some
//     information.
//  2. You keep a strong reference to the object (in its compartment).
//  3. The only references to the CCW are gray, and are in fact part of a cycle.
//  4. The CC runs and discards the CCW.
//  5. You look up the object in the weakmap again. This creates a new wrapper
//     to use as a key. It is not in the weakmap, so the information you stored
//     before is not found. (It may have even been collected, if you had no
//     other references to it.)
//
function blackDuringGray() {
  const g = newGlobal({newCompartment: true});
  const vals = {};
  vals.map = new WeakMap();
  vals.key = g.eval("Object.create(null)");
  vals.val = Object.create(null);
  vals.map.set(vals.key, vals.val);

  g.delegate = vals.key;
  addMarkObservers([vals.map, vals.key]);
  g.addMarkObservers([vals.key]);
  addMarkObservers([vals.val]);
  // Mark observers: map, key, delegate, value

  gc();

  g.enqueueMark(vals.key); // Mark the delegate black
  enqueueMark("yield"); // checkpoint 1

  // Mark the map gray. This will scan through all entries, find our key, and
  // mark it black because its delegate is black.
  enqueueMark("set-color-gray");
  enqueueMark(vals.map); // Mark the map gray

  vals.map = null;
  vals.val = null;
  vals.key = null;
  g.delegate = null;

  const showmarks = () => {
    print("[map,key,delegate,value] marked " + JSON.stringify(getMarks()));
  };

  print("Starting incremental GC");
  startGCMarking();
  // Checkpoint 1, after marking delegate black
  showmarks();
  var marks = getMarks();
  assertEq(marks[0], "unmarked", "map is not marked yet");
  assertEq(marks[1], "unmarked", "key is not marked yet");
  assertEq(marks[2], "black", "delegate is black");
  assertEq(marks[3], "unmarked", "values is not marked yet");

  finishgc();
  showmarks();
  marks = getMarks();
  assertEq(marks[0], "gray", "map is gray");
  assertEq(marks[1], "gray", "gray map + black delegate should mark key gray");
  assertEq(marks[2], "black", "delegate is still black");
  assertEq(marks[3], "gray", "gray map + gray key => gray value");

  clearMarkQueue();
  clearMarkObservers();
  grayRoot().length = 0;
  g.eval("grayRoot().length = 0");
}

if (this.enqueueMark)
  runtest(blackDuringGray);

// Same as above, except relying on the implicit edge from delegate -> key.
function blackDuringGrayImplicit() {
  const g = newGlobal({newCompartment: true});
  const vals = {};
  vals.map = new WeakMap();
  vals.key = g.eval("Object.create(null)");
  vals.val = Object.create(null);
  vals.map.set(vals.key, vals.val);

  g.delegate = vals.key;
  addMarkObservers([vals.map, vals.key]);
  g.addMarkObservers([vals.key]);
  addMarkObservers([vals.val]);
  // Mark observers: map, key, delegate, value

  gc();

  // Mark the map gray. This will scan through all entries, find our key, and
  // add implicit edges from delegate -> key and delegate -> value.
  enqueueMark("set-color-gray");
  enqueueMark(vals.map); // Mark the map gray
  enqueueMark("yield"); // checkpoint 1

  enqueueMark("set-color-black");
  g.enqueueMark(vals.key); // Mark the delegate black, propagating to key.

  vals.map = null;
  vals.val = null;
  vals.key = null;
  g.delegate = null;

  const showmarks = () => {
    print("[map,key,delegate,value] marked " + JSON.stringify(getMarks()));
  };

  print("Starting incremental GC");
  startGCMarking();
  // Checkpoint 1, after marking map gray
  showmarks();
  var marks = getMarks();
  assertEq(marks[0], "gray", "map is gray");
  assertEq(marks[1], "unmarked", "key is not marked yet");
  assertEq(marks[2], "unmarked", "delegate is not marked yet");
  assertEq(marks[3], "unmarked", "value is not marked yet");

  finishgc();
  showmarks();
  marks = getMarks();
  assertEq(marks[0], "gray", "map is gray");
  assertEq(marks[1], "gray", "gray map + black delegate should mark key gray");
  assertEq(marks[2], "black", "delegate is black");
  assertEq(marks[3], "gray", "gray map + gray key => gray value via delegate -> value");

  clearMarkQueue();
  clearMarkObservers();
  grayRoot().length = 0;
  g.eval("grayRoot().length = 0");
}

if (this.enqueueMark)
  runtest(blackDuringGrayImplicit);