revert last rev (7faa37b7) and revert rev b7e45308 and 9824659d instead.

because crash still happens. crash log:

RegExpShared::finalize(FreeOp* fop)
{
    for (auto& comp : compilationArray)
        js_free(comp.byteCode);
    for (size_t i = 0; i < tables.length(); i++)
        js_free(tables[i]);
    tables.~JitCodeTables(); // <----
}

Stack trace:
 	mozglue.dll!arena_dalloc(void * ptr, unsigned int offset) Line 4209	C
 	mozglue.dll!je_free(void * ptr) Line 6099	C
>	xul.dll!js::RegExpShared::finalize(js::FreeOp * fop) Line 982	C++
 	xul.dll!js::gc::Arena::finalize<js::RegExpShared>(js::FreeOp * fop, js::gc::AllocKind thingKind, unsigned int thingSize) Line 460	C++
 	xul.dll!FinalizeTypedArenas<js::RegExpShared>(js::FreeOp * fop, js::gc::Arena * * src, js::gc::SortedArenaList & dest, js::gc::AllocKind thingKind, js::SliceBudget & budget, js::gc::ArenaLists::KeepArenasEnum keepArenas) Line 521	C++
 	xul.dll!js::gc::ArenaLists::backgroundFinalize(js::FreeOp * fop, js::gc::Arena * listHead, js::gc::Arena * * empty) Line 2597	C++
 	xul.dll!js::gc::GCRuntime::sweepBackgroundThings(js::gc::ZoneList & zones, js::LifoAlloc & freeBlocks) Line 2982	C++
 	xul.dll!js::GCHelperState::doSweep(js::AutoLockGC & lock) Line 3183	C++
 	xul.dll!js::GCHelperState::work() Line 3103	C++
 	xul.dll!js::HelperThread::handleGCHelperWorkload(js::AutoLockHelperThreadState & locked) Line 1823	C++
 	xul.dll!js::HelperThread::threadLoop() Line 1888	C++
 	xul.dll!js::detail::ThreadTrampoline<void (__cdecl&)(void *),js::HelperThread *>::Start(void * aPack) Line 227	C++
 	[External Code]
 	[Frames below may be incorrect and/or missing, no symbols loaded for ucrtbase.dll]

js/src/gc/Heap.h

@@ -340,6 +340,9 @@ class TenuredCell : public Cell
     static MOZ_ALWAYS_INLINE void writeBarrierPost(void* cellp, TenuredCell* prior,
                                                    TenuredCell* next);
 
+    // Default implementation for kinds that don't require finalization.
+    void finalize(FreeOp* fop) {}
+
     // Default implementation for kinds that don't require fixup.
     void fixupAfterMovingGC() {}
 

js/src/vm/RegExpObject.cpp

@@ -952,6 +952,12 @@ RegExpShared::RegExpShared(JSAtom* source, RegExpFlag flags)
     numNamedCaptures_(0), groupsTemplate_(nullptr)
 {}
 
+RegExpShared::~RegExpShared()
+{
+    for (size_t i = 0; i < tables.length(); i++)
+        js_delete(tables[i]);
+}
+
 void
 RegExpShared::traceChildren(JSTracer* trc)
 {
@@ -972,16 +978,6 @@ RegExpShared::discardJitCode()
         comp.jitCode = nullptr;
 }
 
-void
-RegExpShared::finalize(FreeOp* fop)
-{
-    for (auto& comp : compilationArray)
-        js_free(comp.byteCode);
-    for (size_t i = 0; i < tables.length(); i++)
-        js_free(tables[i]);
-    tables.~JitCodeTables();
-}
-
 /* static */ bool
 RegExpShared::compile(JSContext* cx, MutableHandleRegExpShared re, HandleLinearString input,
                       CompilationMode mode, ForceByteCodeEnum force)

js/src/vm/RegExpObject.h

@@ -121,6 +121,7 @@ class RegExpShared : public gc::TenuredCell
         uint8_t* byteCode;
 
         RegExpCompilation() : byteCode(nullptr) {}
+        ~RegExpCompilation() { js_free(byteCode); }
 
         bool compiled(ForceByteCodeEnum force = DontForceByteCode) const {
             return byteCode || (force == DontForceByteCode && jitCode);
@@ -128,14 +129,14 @@ class RegExpShared : public gc::TenuredCell
     };
 
     /* Source to the RegExp, for lazy compilation. */
-    HeapPtr<JSAtom*>   source;
+    GCPtr<JSAtom*>     source;
 
     RegExpFlag         flags;
     bool               canStringMatch;
     size_t             parenCount;
 
-    uint32_t              numNamedCaptures_;
+    uint32_t            numNamedCaptures_;
-    HeapPtr<PlainObject*> groupsTemplate_;
+    GCPtr<PlainObject*> groupsTemplate_;
 
     RegExpCompilation  compilationArray[4];
 
@@ -148,8 +149,7 @@ class RegExpShared : public gc::TenuredCell
     }
 
     // Tables referenced by JIT code.
-    using JitCodeTables = Vector<uint8_t*, 0, SystemAllocPolicy>;
+    Vector<uint8_t*, 0, SystemAllocPolicy> tables;
-    JitCodeTables tables;
 
     /* Internal functions. */
     RegExpShared(JSAtom* source, RegExpFlag flags);
@@ -172,7 +172,7 @@ class RegExpShared : public gc::TenuredCell
     }
 
   public:
-    ~RegExpShared() = delete;
+    ~RegExpShared();
 
     // Execute this RegExp on input starting from searchIndex, filling in
     // matches if specified and otherwise only determining if there is a match.
@@ -222,7 +222,6 @@ class RegExpShared : public gc::TenuredCell
 
     void traceChildren(JSTracer* trc);
     void discardJitCode();
-    void finalize(FreeOp* fop);
 
     static size_t offsetOfSource() {
         return offsetof(RegExpShared, source);