Bug 1600488 - Allow FinalizationGroup targets to be unregistered after they have been queued for cleanup, in accordance with the spec r=sfink

The fix is to queue pointers to finalization records rather than just holdings when the target dies.  These are still in the resgistration map and so can be cleared by unregister().  We detect this in the iterator's next() method and skip any such records.

Differential Revision: https://phabricator.services.mozilla.com/D55808

--HG--
extra : moz-landing-system : lando

Bug 1600238 - Finalize FinalizationGroup objects in the foreground to avoid depdendency on when holdings objects are finalized r=sfink

The holdings objects can be foreground or background finalized, but HeapPtr's destructor depends on the referent's arena to have not been released. Making FinalizationGroups foreground finalized achieves this.

Differential Revision: https://phabricator.services.mozilla.com/D55302

--HG--
extra : moz-landing-system : lando

Depends on D55089

Differential Revision: https://phabricator.services.mozilla.com/D55090

--HG--
extra : moz-landing-system : lando

`js::Call` avoids copying the arguments into a separate `InvokeArgs` struct,
therefore it's generally preferred for calls within SpiderMonkey.

Depends on D55088

Differential Revision: https://phabricator.services.mozilla.com/D55089

--HG--
extra : moz-landing-system : lando

Bug 1600019 - Part 3: Use NewObjectWithGivenProto when |prototype| argument is guaranteed to be non-null. r=jonco

`NewObjectWithClassProto` when called with a non-null prototype calls `NewObjectWithGivenTaggedProto`,
but that function can be called more directly through `NewObjectWithGivenProto`.

Depends on D55087

Differential Revision: https://phabricator.services.mozilla.com/D55088

--HG--
extra : moz-landing-system : lando

Bug 1600019 - Part 2: Handle the case when FinalizationRecordVectorObject's records slot is uninitialised. r=jonco

Depends on D55086

Differential Revision: https://phabricator.services.mozilla.com/D55087

--HG--
extra : moz-landing-system : lando

Bug 1600017 - Fix assertion in FinalizationGroupObject::cleanupQueuedHoldings to take account of the fact that holdings can be added during cleanup r=anba

Differential Revision: https://phabricator.services.mozilla.com/D55114

--HG--
extra : moz-landing-system : lando

Differential Revision: https://phabricator.services.mozilla.com/D54689

--HG--
extra : moz-landing-system : lando

Bug 1597970 - Allow for the possiblity of FinalizationGroupObject's slots being uninitialized r=sfink

The problem is that object metadata builder API can trigger GC after the object has been allocated but before its slots have been initialized. The fix is to take account that some slots may be undefined and handle this appropriately.

Differential Revision: https://phabricator.services.mozilla.com/D54111

--HG--
extra : moz-landing-system : lando

Differential Revision: https://phabricator.services.mozilla.com/D52021

--HG--
extra : moz-landing-system : lando

Backed out 3 changesets (bug 1593329) for causing spidermonkey bustages in js/src/builtin/FinalizationGroupObject.cpp:229 CLOSED TREE

Backed out changeset 6daf24d641d9 (bug 1593329)
Backed out changeset 382341353d0d (bug 1593329)
Backed out changeset 139cd5e4f7db (bug 1593329)

Differential Revision: https://phabricator.services.mozilla.com/D52021

--HG--
extra : moz-landing-system : lando

Differential Revision: https://phabricator.services.mozilla.com/D51856

--HG--
extra : moz-landing-system : lando

Differential Revision: https://phabricator.services.mozilla.com/D49946

--HG--
extra : moz-landing-system : lando

Differential Revision: https://phabricator.services.mozilla.com/D49943

--HG--
extra : moz-landing-system : lando