From 0bfc6e37812d3984bc3214dbda79e30903435172 Mon Sep 17 00:00:00 2001
From: roytam1 <roytam@gmail.com>
Date: Wed, 15 Mar 2023 22:51:51 +0800
Subject: [PATCH] Revert "Reverting rev b7e45308 and 9824659d again as I can
 still get a crash in `RegExpShared::finalize(FreeOp* fop)`"

This reverts commit bb547a1b557471ca6535fa258b520c6074b1cc56 for landing
upstream fixes.
---
 js/src/gc/Heap.h           |  3 ---
 js/src/vm/RegExpObject.cpp | 16 ++++++++++------
 js/src/vm/RegExpObject.h   |  7 ++++---
 3 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/js/src/gc/Heap.h b/js/src/gc/Heap.h
index 14604d3bbe..9f030135e7 100644
--- a/js/src/gc/Heap.h
+++ b/js/src/gc/Heap.h
@@ -340,9 +340,6 @@ class TenuredCell : public Cell
     static MOZ_ALWAYS_INLINE void writeBarrierPost(void* cellp, TenuredCell* prior,
                                                    TenuredCell* next);
 
-    // Default implementation for kinds that don't require finalization.
-    void finalize(FreeOp* fop) {}
-
     // Default implementation for kinds that don't require fixup.
     void fixupAfterMovingGC() {}
 
diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
index 556b2e4413..61baadef81 100644
--- a/js/src/vm/RegExpObject.cpp
+++ b/js/src/vm/RegExpObject.cpp
@@ -952,12 +952,6 @@ RegExpShared::RegExpShared(JSAtom* source, RegExpFlag flags)
     numNamedCaptures_(0), groupsTemplate_(nullptr)
 {}
 
-RegExpShared::~RegExpShared()
-{
-    for (size_t i = 0; i < tables.length(); i++)
-        js_delete(tables[i]);
-}
-
 void
 RegExpShared::traceChildren(JSTracer* trc)
 {
@@ -978,6 +972,16 @@ RegExpShared::discardJitCode()
         comp.jitCode = nullptr;
 }
 
+void
+RegExpShared::finalize(FreeOp* fop)
+{
+    for (auto& comp : compilationArray)
+        js_free(comp.byteCode);
+    for (size_t i = 0; i < tables.length(); i++)
+        js_free(tables[i]);
+    tables.~JitCodeTables();
+}
+
 /* static */ bool
 RegExpShared::compile(JSContext* cx, MutableHandleRegExpShared re, HandleLinearString input,
                       CompilationMode mode, ForceByteCodeEnum force)
diff --git a/js/src/vm/RegExpObject.h b/js/src/vm/RegExpObject.h
index 9a4cc01c5f..4f35908087 100644
--- a/js/src/vm/RegExpObject.h
+++ b/js/src/vm/RegExpObject.h
@@ -121,7 +121,6 @@ class RegExpShared : public gc::TenuredCell
         uint8_t* byteCode;
 
         RegExpCompilation() : byteCode(nullptr) {}
-        ~RegExpCompilation() { js_free(byteCode); }
 
         bool compiled(ForceByteCodeEnum force = DontForceByteCode) const {
             return byteCode || (force == DontForceByteCode && jitCode);
@@ -149,7 +148,8 @@ class RegExpShared : public gc::TenuredCell
     }
 
     // Tables referenced by JIT code.
-    Vector<uint8_t*, 0, SystemAllocPolicy> tables;
+    using JitCodeTables = Vector<uint8_t*, 0, SystemAllocPolicy>;
+    JitCodeTables tables;
 
     /* Internal functions. */
     RegExpShared(JSAtom* source, RegExpFlag flags);
@@ -172,7 +172,7 @@ class RegExpShared : public gc::TenuredCell
     }
 
   public:
-    ~RegExpShared();
+    ~RegExpShared() = delete;
 
     // Execute this RegExp on input starting from searchIndex, filling in
     // matches if specified and otherwise only determining if there is a match.
@@ -222,6 +222,7 @@ class RegExpShared : public gc::TenuredCell
 
     void traceChildren(JSTracer* trc);
     void discardJitCode();
+    void finalize(FreeOp* fop);
 
     static size_t offsetOfSource() {
         return offsetof(RegExpShared, source);