LibJS: Add MarkedValueList and use it for argument passing

A MarkedValueList is basically a Vector<JS::Value> that registers with
the Heap and makes sure that the stored values don't get GC'd.

Before this change, we were unsafely keeping Vector<JS::Value> in some
places, which is out-of-reach for the live reference finding logic
since Vector puts its elements on the heap by default.

We now pass all the JavaScript tests even when running with "js -g",
which does a GC on every heap allocation.

Libraries/LibJS/Runtime/ArrayPrototype.cpp

@@ -34,6 +34,7 @@
 #include <LibJS/Runtime/Error.h>
 #include <LibJS/Runtime/Function.h>
 #include <LibJS/Runtime/GlobalObject.h>
+#include <LibJS/Runtime/MarkedValueList.h>
 #include <LibJS/Runtime/Value.h>
 
 namespace JS {
@@ -96,13 +97,18 @@ Value ArrayPrototype::filter(Interpreter& interpreter)
     auto this_value = interpreter.argument(1);
     auto initial_array_size = array->elements().size();
     auto* new_array = Array::create(interpreter.global_object());
+
     for (size_t i = 0; i < initial_array_size; ++i) {
         if (i >= array->elements().size())
             break;
         auto value = array->elements()[i];
         if (value.is_empty())
             continue;
-        auto result = interpreter.call(callback, this_value, { value, Value((i32)i), array });
+        MarkedValueList arguments(interpreter.heap());
+        arguments.append(value);
+        arguments.append(Value((i32)i));
+        arguments.append(array);
+        auto result = interpreter.call(callback, this_value, move(arguments));
         if (interpreter.exception())
             return {};
         if (result.to_boolean())
@@ -127,7 +133,11 @@ Value ArrayPrototype::for_each(Interpreter& interpreter)
         auto value = array->elements()[i];
         if (value.is_empty())
             continue;
-        interpreter.call(callback, this_value, { value, Value((i32)i), array });
+        MarkedValueList arguments(interpreter.heap());
+        arguments.append(value);
+        arguments.append(Value((i32)i));
+        arguments.append(array);
+        interpreter.call(callback, this_value, move(arguments));
         if (interpreter.exception())
             return {};
     }
@@ -151,7 +161,11 @@ Value ArrayPrototype::map(Interpreter& interpreter)
         auto value = array->elements()[i];
         if (value.is_empty())
             continue;
-        auto result = interpreter.call(callback, this_value, { value, Value((i32)i), array });
+        MarkedValueList arguments(interpreter.heap());
+        arguments.append(value);
+        arguments.append(Value((i32)i));
+        arguments.append(array);
+        auto result = interpreter.call(callback, this_value, move(arguments));
         if (interpreter.exception())
             return {};
         new_array->elements().append(result);

Libraries/LibJS/Runtime/FunctionPrototype.cpp

@@ -32,6 +32,7 @@
 #include <LibJS/Runtime/Function.h>
 #include <LibJS/Runtime/FunctionPrototype.h>
 #include <LibJS/Runtime/GlobalObject.h>
+#include <LibJS/Runtime/MarkedValueList.h>
 #include <LibJS/Runtime/ScriptFunction.h>
 
 namespace JS {
@@ -72,10 +73,10 @@ Value FunctionPrototype::apply(Interpreter& interpreter)
     auto length_property = arg_array.as_object().get("length");
     if (length_property.has_value())
         length = length_property.value().to_number().to_i32();
-    Vector<Value> arguments;
+    MarkedValueList arguments(interpreter.heap());
     for (size_t i = 0; i < length; ++i)
         arguments.append(arg_array.as_object().get(String::number(i)).value_or(js_undefined()));
-    return interpreter.call(function, this_arg, arguments);
+    return interpreter.call(function, this_arg, move(arguments));
 }
 
 Value FunctionPrototype::bind(Interpreter& interpreter)
@@ -96,12 +97,12 @@ Value FunctionPrototype::call(Interpreter& interpreter)
         return interpreter.throw_exception<TypeError>("Not a Function object");
     auto function = static_cast<Function*>(this_object);
     auto this_arg = interpreter.argument(0);
-    Vector<Value> arguments;
+    MarkedValueList arguments(interpreter.heap());
     if (interpreter.argument_count() > 1) {
         for (size_t i = 1; i < interpreter.argument_count(); ++i)
             arguments.append(interpreter.argument(i));
     }
-    return interpreter.call(function, this_arg, arguments);
+    return interpreter.call(function, this_arg, move(arguments));
 }
 
 Value FunctionPrototype::to_string(Interpreter& interpreter)

Libraries/LibJS/Runtime/MarkedValueList.cpp

@@ -0,0 +1,55 @@
+/*
+ * Copyright (c) 2020, Andreas Kling <kling@serenityos.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <LibJS/Heap/Heap.h>
+#include <LibJS/Runtime/MarkedValueList.h>
+
+namespace JS {
+
+MarkedValueList::MarkedValueList(Heap& heap)
+    : m_heap(heap)
+{
+    m_heap.did_create_marked_value_list({}, *this);
+}
+
+MarkedValueList:: MarkedValueList(MarkedValueList&& other)
+    : m_heap(other.m_heap)
+    , m_values(move(other.m_values))
+{
+    m_heap.did_create_marked_value_list({}, *this);
+}
+
+MarkedValueList::~MarkedValueList()
+{
+    m_heap.did_destroy_marked_value_list({}, *this);
+}
+
+void MarkedValueList::append(Value value)
+{
+    m_values.append(value);
+}
+
+}

Libraries/LibJS/Runtime/MarkedValueList.h

@@ -0,0 +1,58 @@
+/*
+ * Copyright (c) 2020, Andreas Kling <kling@serenityos.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice, this
+ *    list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ *    this list of conditions and the following disclaimer in the documentation
+ *    and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <AK/Noncopyable.h>
+#include <AK/Vector.h>
+#include <LibJS/Forward.h>
+#include <LibJS/Runtime/Value.h>
+
+namespace JS {
+
+class MarkedValueList {
+    AK_MAKE_NONCOPYABLE(MarkedValueList);
+
+public:
+    explicit MarkedValueList(Heap&);
+    MarkedValueList(MarkedValueList&&);
+    ~MarkedValueList();
+
+    MarkedValueList& operator=(MarkedValueList&&) = delete;
+
+    bool is_empty() const { return m_values.is_empty(); }
+    size_t size() const { return m_values.size(); }
+    void clear() { m_values.clear(); }
+    Vector<Value, 32>& values() { return m_values; }
+
+    void append(Value);
+
+private:
+    Heap& m_heap;
+    Vector<Value, 32> m_values;
+};
+
+}