Attachment 372046 Details for Bug 198710 – Patch

[patch] Patch

bug-198710-20190613144444.patch (text/plain), 56.48 KB, created by Keith Miller on 2019-06-13 05:44:48 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Keith Miller

Created: 2019-06-13 05:44:48 PDT

Size: 56.48 KB

patch

obsolete

>Subversion Revision: 246238
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 6b0d019eefb09d55c061850a76a8a94954011b77..ac1191db934e7d388c275f86152080f621634ba0 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,63 @@
>+2019-06-12  Keith Miller  <keith_miller@apple.com>
>+
>+        Add support for WeakRef
>+        https://bugs.webkit.org/show_bug.cgi?id=198710
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Add support for WeakRefs which are now at stage 3
>+        (https://tc39.es/proposal-weakrefs). This patch doesn't add
>+        support for FinalizationGroups, which I'll add in another patch.
>+
>+        Some other things of interest. Per the spec, we cannot collect a
>+        weak refs target unless it has not been dereffed (or created) in
>+        the current microtask turn. i.e. WeakRefs are only allowed to be
>+        collected at the end of a drain of the Microtask queue. My
>+        understanding for this behavior is to reduce implementation
>+        dependence on specific GC behavior in a given browser.
>+
>+        We track if a WeakRef is retaining its target by using a version
>+        number on each WeakRef as well as on the VM. Whenever a WeakRef is
>+        derefed we update its version number to match the VM's then
>+        WriteBarrier ourselves. During marking if the VM and the WeakRef
>+        have the same version number, the target is visited.
>+
>+        * JavaScriptCore.xcodeproj/project.pbxproj:
>+        * Sources.txt:
>+        * heap/Heap.cpp:
>+        (JSC::Heap::finalizeUnconditionalFinalizers):
>+        * jsc.cpp:
>+        (GlobalObject::finishCreation):
>+        (functionReleaseWeakRefs):
>+        * runtime/CommonIdentifiers.h:
>+        * runtime/JSGlobalObject.cpp:
>+        * runtime/JSGlobalObject.h:
>+        * runtime/JSWeakObjectRef.cpp: Added.
>+        (JSC::JSWeakObjectRef::finishCreation):
>+        (JSC::JSWeakObjectRef::visitChildren):
>+        (JSC::JSWeakObjectRef::finalizeUnconditionally):
>+        (JSC::JSWeakObjectRef::toStringName):
>+        * runtime/JSWeakObjectRef.h: Added.
>+        * runtime/VM.cpp:
>+        (JSC::VM::drainMicrotasks):
>+        * runtime/VM.h:
>+        (JSC::VM::setOnEachMicrotaskTick):
>+        (JSC::VM::finalizeSynchronousJSExecution):
>+        (JSC::VM::currentWeakRefVersion const):
>+        * runtime/WeakObjectRefConstructor.cpp: Added.
>+        (JSC::WeakObjectRefConstructor::finishCreation):
>+        (JSC::WeakObjectRefConstructor::WeakObjectRefConstructor):
>+        (JSC::callWeakRef):
>+        (JSC::constructWeakRef):
>+        * runtime/WeakObjectRefConstructor.h: Added.
>+        (JSC::WeakObjectRefConstructor::create):
>+        (JSC::WeakObjectRefConstructor::createStructure):
>+        * runtime/WeakObjectRefPrototype.cpp: Added.
>+        (JSC::WeakObjectRefPrototype::finishCreation):
>+        (JSC::getWeakRef):
>+        (JSC::protoFuncWeakRefDeref):
>+        * runtime/WeakObjectRefPrototype.h: Added.
>+
> 2019-06-09  Yusuke Suzuki  <ysuzuki@apple.com>
> 
>         [JSC] Use mergePrediction in ValuePow prediction propagation
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index fb5b50dea19d1d58f201b1c632e9e03b1cc9432c..9e958d39d2289906e3b019006f525933d8bd2696 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,32 @@
>+2019-06-12  Keith Miller  <keith_miller@apple.com>
>+
>+        Add support for WeakRef
>+        https://bugs.webkit.org/show_bug.cgi?id=198710
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        We need to make sure the Web MicrotaskQueue notifies the JSC VM
>+        that it has finished performing a microtask checkpoint. This lets
>+        the JSC VM know it is safe to collect referenced WeakRefs. Since
>+        there was no way to get the VM from the MicrotaskQueue I have
>+        added a RefPtr to the queue's VM. For the main thread the VM lives
>+        forever so is fine. For workers the queue and the VM share an
>+        owner so this shouldn't matter either.
>+
>+        Tests: js/weakref-async-is-collected.html
>+               js/weakref-eventually-collects-values.html
>+               js/weakref-microtasks-dont-collect.html
>+               js/weakref-weakset-consistency.html
>+
>+        * dom/Microtasks.cpp:
>+        (WebCore::MicrotaskQueue::MicrotaskQueue):
>+        (WebCore::MicrotaskQueue::mainThreadQueue):
>+        (WebCore::MicrotaskQueue::performMicrotaskCheckpoint):
>+        * dom/Microtasks.h:
>+        (WebCore::MicrotaskQueue::vm const):
>+        * workers/WorkerGlobalScope.cpp:
>+        (WebCore::WorkerGlobalScope::WorkerGlobalScope):
>+
> 2019-06-09  Rob Buis  <rbuis@igalia.com>
> 
>         Add wildcard to Access-Control-Allow-Methods and Access-Control-Allow-Headers
>diff --git a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>index 6750a65b6e3a908f339b211ab3410b4d6039991d..b405a2a8a8257114a91333a57e6b4f7642f1603d 100644
>--- a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>+++ b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
>@@ -1076,6 +1076,9 @@
> 		5370B4F61BF26205005C40FC /* AdaptiveInferredPropertyValueWatchpointBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 5370B4F41BF25EA2005C40FC /* AdaptiveInferredPropertyValueWatchpointBase.h */; };
> 		5381B9391E60E97D0090F794 /* WasmFaultSignalHandler.h in Headers */ = {isa = PBXBuildFile; fileRef = 5381B9381E60E97D0090F794 /* WasmFaultSignalHandler.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		53917E7B1B7906FA000EBD33 /* JSGenericTypedArrayViewPrototypeFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = 53917E7A1B7906E4000EBD33 /* JSGenericTypedArrayViewPrototypeFunctions.h */; };
>+		539930C822AD3B9A0051CDE2 /* WeakObjectRefConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 539930C722AD3B9A0051CDE2 /* WeakObjectRefConstructor.h */; };
>+		539BFBAE22AD3C3A0023F4C0 /* WeakObjectRefPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = 539BFBAD22AD3C3A0023F4C0 /* WeakObjectRefPrototype.h */; };
>+		539BFBB022AD3CDC0023F4C0 /* JSWeakObjectRef.h in Headers */ = {isa = PBXBuildFile; fileRef = 539BFBAF22AD3CDC0023F4C0 /* JSWeakObjectRef.h */; };
> 		539FB8BA1C99DA7C00940FA1 /* JSArrayInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = 539FB8B91C99DA7C00940FA1 /* JSArrayInlines.h */; };
> 		53B4BD121F68B32500D2BEA3 /* WasmOps.h in Headers */ = {isa = PBXBuildFile; fileRef = 533B15DE1DC7F463004D500A /* WasmOps.h */; settings = {ATTRIBUTES = (Private, ); }; };
> 		53B601EC2034B8C5006BE667 /* JSCast.h in Headers */ = {isa = PBXBuildFile; fileRef = 53B601EB2034B8C5006BE667 /* JSCast.h */; settings = {ATTRIBUTES = (Private, ); }; };
>@@ -3639,12 +3642,18 @@
> 		536B319F1F7369BD0037FC33 /* glib */ = {isa = PBXFileReference; lastKnownFileType = folder; path = glib; sourceTree = "<group>"; };
> 		5370B4F31BF25EA2005C40FC /* AdaptiveInferredPropertyValueWatchpointBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AdaptiveInferredPropertyValueWatchpointBase.cpp; sourceTree = "<group>"; };
> 		5370B4F41BF25EA2005C40FC /* AdaptiveInferredPropertyValueWatchpointBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AdaptiveInferredPropertyValueWatchpointBase.h; sourceTree = "<group>"; };
>+		5373B4D322AD8BF700803572 /* WeakObjectRefPrototype.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = WeakObjectRefPrototype.cpp; sourceTree = "<group>"; };
>+		5373B4D422ADB31400803572 /* WeakObjectRefConstructor.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = WeakObjectRefConstructor.cpp; sourceTree = "<group>"; };
> 		5381B9361E60E9660090F794 /* WasmFaultSignalHandler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WasmFaultSignalHandler.cpp; sourceTree = "<group>"; };
> 		5381B9381E60E97D0090F794 /* WasmFaultSignalHandler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WasmFaultSignalHandler.h; sourceTree = "<group>"; };
> 		5383AA2F1E65E8A100A532FC /* JSWebAssemblyCodeBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = JSWebAssemblyCodeBlock.cpp; path = js/JSWebAssemblyCodeBlock.cpp; sourceTree = "<group>"; };
> 		53917E7A1B7906E4000EBD33 /* JSGenericTypedArrayViewPrototypeFunctions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGenericTypedArrayViewPrototypeFunctions.h; sourceTree = "<group>"; };
> 		53917E7C1B791106000EBD33 /* JSTypedArrayViewPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSTypedArrayViewPrototype.h; sourceTree = "<group>"; };
> 		53917E831B791CB8000EBD33 /* TypedArrayPrototype.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; name = TypedArrayPrototype.js; path = builtins/TypedArrayPrototype.js; sourceTree = SOURCE_ROOT; };
>+		539930C722AD3B9A0051CDE2 /* WeakObjectRefConstructor.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = WeakObjectRefConstructor.h; sourceTree = "<group>"; };
>+		539BFBAD22AD3C3A0023F4C0 /* WeakObjectRefPrototype.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = WeakObjectRefPrototype.h; sourceTree = "<group>"; };
>+		539BFBAF22AD3CDC0023F4C0 /* JSWeakObjectRef.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = JSWeakObjectRef.h; sourceTree = "<group>"; };
>+		539BFBB122AD3D8C0023F4C0 /* JSWeakObjectRef.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = JSWeakObjectRef.cpp; sourceTree = "<group>"; };
> 		539FB8B91C99DA7C00940FA1 /* JSArrayInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSArrayInlines.h; sourceTree = "<group>"; };
> 		53B0BE331E561AC900A8FC29 /* GetterSetterAccessCase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GetterSetterAccessCase.cpp; sourceTree = "<group>"; };
> 		53B0BE351E561B0900A8FC29 /* ProxyableAccessCase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ProxyableAccessCase.cpp; sourceTree = "<group>"; };
>@@ -7128,6 +7137,8 @@
> 				0F2B66D317B6B5AB00A7AE3F /* JSUint8ClampedArray.h */,
> 				A7CA3AE117DA41AE006538AF /* JSWeakMap.cpp */,
> 				A7CA3AE217DA41AE006538AF /* JSWeakMap.h */,
>+				539BFBB122AD3D8C0023F4C0 /* JSWeakObjectRef.cpp */,
>+				539BFBAF22AD3CDC0023F4C0 /* JSWeakObjectRef.h */,
> 				709FB8611AE335C60039D069 /* JSWeakSet.cpp */,
> 				709FB8621AE335C60039D069 /* JSWeakSet.h */,
> 				1442565F15EDE98D0066A49B /* JSWithScope.cpp */,
>@@ -7372,6 +7383,10 @@
> 				E393ADD71FE702CC0022D681 /* WeakMapImplInlines.h */,
> 				A7CA3ADF17DA41AE006538AF /* WeakMapPrototype.cpp */,
> 				A7CA3AE017DA41AE006538AF /* WeakMapPrototype.h */,
>+				5373B4D422ADB31400803572 /* WeakObjectRefConstructor.cpp */,
>+				539930C722AD3B9A0051CDE2 /* WeakObjectRefConstructor.h */,
>+				5373B4D322AD8BF700803572 /* WeakObjectRefPrototype.cpp */,
>+				539BFBAD22AD3C3A0023F4C0 /* WeakObjectRefPrototype.h */,
> 				709FB8631AE335C60039D069 /* WeakSetConstructor.cpp */,
> 				709FB8641AE335C60039D069 /* WeakSetConstructor.h */,
> 				709FB8651AE335C60039D069 /* WeakSetPrototype.cpp */,
>@@ -9561,6 +9576,7 @@
> 				A7CA3AE817DA41AE006538AF /* JSWeakMap.h in Headers */,
> 				A7482E93116A7CAD003B0712 /* JSWeakObjectMapRefInternal.h in Headers */,
> 				A7482B9311671147003B0712 /* JSWeakObjectMapRefPrivate.h in Headers */,
>+				539BFBB022AD3CDC0023F4C0 /* JSWeakObjectRef.h in Headers */,
> 				0F0B286B1EB8E6CF000EB5D2 /* JSWeakPrivate.h in Headers */,
> 				709FB8681AE335C60039D069 /* JSWeakSet.h in Headers */,
> 				7A9774A8206B82E4008D03D0 /* JSWeakValue.h in Headers */,
>@@ -10010,6 +10026,8 @@
> 				E3A32BC71FC83147007D7E76 /* WeakMapImpl.h in Headers */,
> 				E393ADD81FE702D00022D681 /* WeakMapImplInlines.h in Headers */,
> 				A7CA3AE617DA41AE006538AF /* WeakMapPrototype.h in Headers */,
>+				539930C822AD3B9A0051CDE2 /* WeakObjectRefConstructor.h in Headers */,
>+				539BFBAE22AD3C3A0023F4C0 /* WeakObjectRefPrototype.h in Headers */,
> 				14E84FA114EE1ACC00D6D5D4 /* WeakSet.h in Headers */,
> 				709FB86A1AE335C60039D069 /* WeakSetConstructor.h in Headers */,
> 				14150133154BB13F005D8C98 /* WeakSetInlines.h in Headers */,
>diff --git a/Source/JavaScriptCore/Sources.txt b/Source/JavaScriptCore/Sources.txt
>index b8893ba8fcbc617d5381b5e6ea2434e905bec1e5..ecc21a25eafaf79c0759bea6200bb5209a6c2d2f 100644
>--- a/Source/JavaScriptCore/Sources.txt
>+++ b/Source/JavaScriptCore/Sources.txt
>@@ -873,6 +873,7 @@ runtime/JSTypedArrayViewConstructor.cpp
> runtime/JSTypedArrayViewPrototype.cpp
> runtime/JSTypedArrays.cpp
> runtime/JSWeakMap.cpp
>+runtime/JSWeakObjectRef.cpp
> runtime/JSWeakSet.cpp
> runtime/JSWithScope.cpp
> runtime/JSWrapperObject.cpp
>@@ -969,6 +970,8 @@ runtime/Watchdog.cpp
> runtime/WeakMapConstructor.cpp
> runtime/WeakMapImpl.cpp
> runtime/WeakMapPrototype.cpp
>+runtime/WeakObjectRefConstructor.cpp
>+runtime/WeakObjectRefPrototype.cpp
> runtime/WeakSetConstructor.cpp
> runtime/WeakSetPrototype.cpp
> 
>diff --git a/Source/JavaScriptCore/heap/Heap.cpp b/Source/JavaScriptCore/heap/Heap.cpp
>index 6663b4f0d39ebbef9d270de03d2b5fc5e33d6482..f131bcb4d1219609d621f1bb4f795c70bf241b27 100644
>--- a/Source/JavaScriptCore/heap/Heap.cpp
>+++ b/Source/JavaScriptCore/heap/Heap.cpp
>@@ -53,6 +53,7 @@
> #include "JSLock.h"
> #include "JSVirtualMachineInternal.h"
> #include "JSWeakMap.h"
>+#include "JSWeakObjectRef.h"
> #include "JSWeakSet.h"
> #include "JSWebAssemblyCodeBlock.h"
> #include "MachineStackMarker.h"
>@@ -610,6 +611,8 @@ void Heap::finalizeUnconditionalFinalizers()
>         finalizeMarkedUnconditionalFinalizers<JSWeakSet>(*vm()->m_weakSetSpace);
>     if (vm()->m_weakMapSpace)
>         finalizeMarkedUnconditionalFinalizers<JSWeakMap>(*vm()->m_weakMapSpace);
>+    if (vm()->m_weakObjectRefSpace)
>+        finalizeMarkedUnconditionalFinalizers<JSWeakObjectRef>(*vm()->m_weakObjectRefSpace);
>     if (vm()->m_errorInstanceSpace)
>         finalizeMarkedUnconditionalFinalizers<ErrorInstance>(*vm()->m_errorInstanceSpace);
> 
>diff --git a/Source/JavaScriptCore/jsc.cpp b/Source/JavaScriptCore/jsc.cpp
>index e1818a13f01f60517206d71b0691c6583ed030ba..d4fa222c721cf4a7e71ad4786f984111241e1852 100644
>--- a/Source/JavaScriptCore/jsc.cpp
>+++ b/Source/JavaScriptCore/jsc.cpp
>@@ -329,6 +329,7 @@ static EncodedJSValue JSC_HOST_CALL functionMakeMasquerader(ExecState*);
> static EncodedJSValue JSC_HOST_CALL functionHasCustomProperties(ExecState*);
> static EncodedJSValue JSC_HOST_CALL functionDumpTypesForAllVariables(ExecState*);
> static EncodedJSValue JSC_HOST_CALL functionDrainMicrotasks(ExecState*);
>+static EncodedJSValue JSC_HOST_CALL functionReleaseWeakRefs(ExecState*);
> static EncodedJSValue JSC_HOST_CALL functionIs32BitPlatform(ExecState*);
> static EncodedJSValue JSC_HOST_CALL functionCheckModuleSyntax(ExecState*);
> static EncodedJSValue JSC_HOST_CALL functionPlatformSupportsSamplingProfiler(ExecState*);
>@@ -557,6 +558,7 @@ protected:
>         addFunction(vm, "dumpTypesForAllVariables", functionDumpTypesForAllVariables , 0);
> 
>         addFunction(vm, "drainMicrotasks", functionDrainMicrotasks, 0);
>+        addFunction(vm, "releaseWeakRefs", functionReleaseWeakRefs, 0);
> 
>         addFunction(vm, "getRandomSeed", functionGetRandomSeed, 0);
>         addFunction(vm, "setRandomSeed", functionSetRandomSeed, 1);
>@@ -2209,6 +2211,13 @@ EncodedJSValue JSC_HOST_CALL functionDrainMicrotasks(ExecState* exec)
>     return JSValue::encode(jsUndefined());
> }
> 
>+EncodedJSValue JSC_HOST_CALL functionReleaseWeakRefs(ExecState* exec)
>+{
>+    VM& vm = exec->vm();
>+    vm.finalizeSynchronousJSExecution();
>+    return JSValue::encode(jsUndefined());
>+}
>+
> EncodedJSValue JSC_HOST_CALL functionIs32BitPlatform(ExecState*)
> {
> #if USE(JSVALUE64)
>diff --git a/Source/JavaScriptCore/runtime/CommonIdentifiers.h b/Source/JavaScriptCore/runtime/CommonIdentifiers.h
>index c06f7ec75c88bb99be64f498cce719917fca424a..ab203b506275f3adbcfcb3c2541d426f957c0a77 100644
>--- a/Source/JavaScriptCore/runtime/CommonIdentifiers.h
>+++ b/Source/JavaScriptCore/runtime/CommonIdentifiers.h
>@@ -88,6 +88,7 @@
>     macro(counters) \
>     macro(day) \
>     macro(defineProperty) \
>+    macro(deref) \
>     macro(description) \
>     macro(descriptions) \
>     macro(detail) \
>diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
>index d2aab783e361d89555e7ccf05b6ec3e547d91fe5..3c98dfbaa7dd75393908c89ef4acc4d625fcff81 100644
>--- a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
>+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
>@@ -122,6 +122,7 @@
> #include "JSTypedArrayViewPrototype.h"
> #include "JSTypedArrays.h"
> #include "JSWeakMap.h"
>+#include "JSWeakObjectRef.h"
> #include "JSWeakSet.h"
> #include "JSWebAssembly.h"
> #include "JSWithScope.h"
>@@ -172,6 +173,8 @@
> #include "WeakGCMapInlines.h"
> #include "WeakMapConstructor.h"
> #include "WeakMapPrototype.h"
>+#include "WeakObjectRefConstructor.h"
>+#include "WeakObjectRefPrototype.h"
> #include "WeakSetConstructor.h"
> #include "WeakSetPrototype.h"
> #include "WebAssemblyPrototype.h"
>@@ -359,6 +362,7 @@ const GlobalObjectMethodTable JSGlobalObject::s_globalObjectMethodTable = {
>   Number                JSGlobalObject::m_numberObjectStructure      DontEnum|ClassStructure
>   Symbol                JSGlobalObject::m_symbolObjectStructure      DontEnum|ClassStructure
>   WeakMap               JSGlobalObject::m_weakMapStructure           DontEnum|ClassStructure
>+  WeakRef               JSGlobalObject::m_weakObjectRefStructure     DontEnum|ClassStructure
>   WeakSet               JSGlobalObject::m_weakSetStructure           DontEnum|ClassStructure
> @end
> */
>diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.h b/Source/JavaScriptCore/runtime/JSGlobalObject.h
>index 451719568002f6baf69650b146afc125f180b1bf..02607c92748096b81399db4ebdec2e0b6bbc7974 100644
>--- a/Source/JavaScriptCore/runtime/JSGlobalObject.h
>+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.h
>@@ -149,6 +149,7 @@ template<typename Watchpoint> class ObjectPropertyChangeAdaptiveWatchpoint;
>     macro(Error, error, error, ErrorInstance, Error, object) \
>     macro(Number, number, numberObject, NumberObject, Number, object) \
>     macro(Symbol, symbol, symbolObject, SymbolObject, Symbol, object) \
>+    macro(WeakObjectRef, weakObjectRef, weakObjectRef, JSWeakObjectRef, WeakRef, object) \
>     DEFINE_STANDARD_BUILTIN(macro, WeakMap, weakMap) \
>     DEFINE_STANDARD_BUILTIN(macro, WeakSet, weakSet) \
> 
>diff --git a/Source/JavaScriptCore/runtime/JSWeakObjectRef.cpp b/Source/JavaScriptCore/runtime/JSWeakObjectRef.cpp
>new file mode 100644
>index 0000000000000000000000000000000000000000..75165b3b799f6c4b3925f585c90cedcc314db1d7
>--- /dev/null
>+++ b/Source/JavaScriptCore/runtime/JSWeakObjectRef.cpp
>@@ -0,0 +1,66 @@
>+/*
>+ * Copyright (C) 2019 Apple, Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>+ */
>+
>+#include "config.h"
>+#include "JSWeakObjectRef.h"
>+
>+#include "JSCInlines.h"
>+
>+namespace JSC {
>+
>+const ClassInfo JSWeakObjectRef::s_info = { "WeakRef", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSWeakObjectRef) };
>+
>+void JSWeakObjectRef::finishCreation(VM& vm, JSObject* value)
>+{
>+    m_lastAccessVersion = vm.currentWeakRefVersion();
>+    m_value.set(vm, this, value);
>+    Base::finishCreation(vm);
>+}
>+
>+void JSWeakObjectRef::visitChildren(JSCell* cell, SlotVisitor& visitor)
>+{
>+    auto* thisObject = jsCast<JSWeakObjectRef*>(cell);
>+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
>+    Base::visitChildren(thisObject, visitor);
>+    // This doesn't need to be atomic because if we are out of date we will get write barriered and revisit ourselves.
>+    if (visitor.vm().currentWeakRefVersion() == thisObject->m_lastAccessVersion) {
>+        ASSERT(thisObject->m_value);
>+        visitor.append(thisObject->m_value);
>+    }
>+}
>+
>+void JSWeakObjectRef::finalizeUnconditionally(VM& vm)
>+{
>+    if (m_value && !vm.heap.isMarked(m_value.get()))
>+        m_value.clear();
>+}
>+
>+String JSWeakObjectRef::toStringName(const JSC::JSObject*, ExecState*)
>+{
>+    return "Object"_s;
>+}
>+
>+}
>+
>diff --git a/Source/JavaScriptCore/runtime/JSWeakObjectRef.h b/Source/JavaScriptCore/runtime/JSWeakObjectRef.h
>new file mode 100644
>index 0000000000000000000000000000000000000000..ec730df835fd18afb5cfce1fe2428ce0e6cef7f6
>--- /dev/null
>+++ b/Source/JavaScriptCore/runtime/JSWeakObjectRef.h
>@@ -0,0 +1,85 @@
>+/*
>+ * Copyright (C) 2019 Apple, Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>+ */
>+
>+#pragma once
>+
>+#include "JSObject.h"
>+
>+namespace JSC {
>+
>+class JSWeakObjectRef final : public JSObject {
>+public:
>+    using Base = JSObject;
>+
>+    DECLARE_EXPORT_INFO;
>+
>+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
>+    {
>+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
>+    }
>+
>+    static JSWeakObjectRef* create(VM& vm, Structure* structure, JSObject* target)
>+    {
>+        JSWeakObjectRef* instance = new (NotNull, allocateCell<JSWeakObjectRef>(vm.heap)) JSWeakObjectRef(vm, structure);
>+        instance->finishCreation(vm, target);
>+        return instance;
>+    }
>+
>+    JSObject* deref(VM& vm)
>+    {
>+        if (m_value && vm.currentWeakRefVersion() != m_lastAccessVersion) {
>+            m_lastAccessVersion = vm.currentWeakRefVersion();
>+            // Perform a GC barrier here so we rescan this object and keep the object alive if we wouldn't otherwise.
>+            vm.heap.writeBarrier(this);
>+        }
>+
>+        return m_value.get();
>+    }
>+
>+    template<typename CellType, SubspaceAccess mode>
>+    static IsoSubspace* subspaceFor(VM& vm)
>+    {
>+        return vm.weakObjectRefSpace<mode>();
>+    }
>+
>+    void finalizeUnconditionally(VM&);
>+    static void visitChildren(JSCell*, SlotVisitor&);
>+
>+private:
>+    JSWeakObjectRef(VM& vm, Structure* structure)
>+        : Base(vm, structure)
>+    {
>+    }
>+
>+    JS_EXPORT_PRIVATE void finishCreation(VM&, JSObject* value);
>+
>+    static String toStringName(const JSObject*, ExecState*);
>+
>+    uintptr_t m_lastAccessVersion;
>+    WriteBarrier<JSObject> m_value;
>+};
>+
>+} // namespace JSC
>+
>diff --git a/Source/JavaScriptCore/runtime/VM.cpp b/Source/JavaScriptCore/runtime/VM.cpp
>index 45fa20269215afeb7fa896575d65479fd3e70b8b..0744a08f89577859191aabe093855e9d4df61d36 100644
>--- a/Source/JavaScriptCore/runtime/VM.cpp
>+++ b/Source/JavaScriptCore/runtime/VM.cpp
>@@ -99,6 +99,7 @@
> #include "JSStringHeapCellType.h"
> #include "JSTemplateObjectDescriptor.h"
> #include "JSWeakMap.h"
>+#include "JSWeakObjectRef.h"
> #include "JSWeakSet.h"
> #include "JSWebAssembly.h"
> #include "JSWebAssemblyCodeBlock.h"
>@@ -1100,6 +1101,7 @@ void VM::drainMicrotasks()
>         if (m_onEachMicrotaskTick)
>             m_onEachMicrotaskTick(*this);
>     }
>+    finalizeSynchronousJSExecution();
> }
> 
> void QueuedTask::run()
>@@ -1254,6 +1256,7 @@ DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(nativeStdFunctionSpace, cellHeapCellType
> DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(proxyRevokeSpace, destructibleObjectHeapCellType.get(), ProxyRevoke)
> DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakMapSpace, destructibleObjectHeapCellType.get(), JSWeakMap)
> DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakSetSpace, destructibleObjectHeapCellType.get(), JSWeakSet)
>+DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(weakObjectRefSpace, cellHeapCellType.get(), JSWeakObjectRef)
> #if JSC_OBJC_API_ENABLED
> DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER_SLOW(objCCallbackFunctionSpace, destructibleObjectHeapCellType.get(), ObjCCallbackFunction)
> #endif
>diff --git a/Source/JavaScriptCore/runtime/VM.h b/Source/JavaScriptCore/runtime/VM.h
>index 11c87dfc74498f456e1f393a832625d260edefa1..84d14a06f663fe735020385198e3fba0abdcaf2e 100644
>--- a/Source/JavaScriptCore/runtime/VM.h
>+++ b/Source/JavaScriptCore/runtime/VM.h
>@@ -403,6 +403,7 @@ public:
>     DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(errorInstanceSpace)
>     DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(nativeStdFunctionSpace)
>     DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(proxyRevokeSpace)
>+    DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(weakObjectRefSpace)
>     DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(weakSetSpace)
>     DYNAMIC_ISO_SUBSPACE_DEFINE_MEMBER(weakMapSpace)
> #if ENABLE(WEBASSEMBLY)
>@@ -879,7 +880,10 @@ public:
> 
>     void queueMicrotask(JSGlobalObject&, Ref<Microtask>&&);
>     JS_EXPORT_PRIVATE void drainMicrotasks();
>-    ALWAYS_INLINE void setOnEachMicrotaskTick(WTF::Function<void(VM&)>&& func) { m_onEachMicrotaskTick = WTFMove(func); }
>+    void setOnEachMicrotaskTick(WTF::Function<void(VM&)>&& func) { m_onEachMicrotaskTick = WTFMove(func); }
>+    void finalizeSynchronousJSExecution() { ASSERT(currentThreadIsHoldingAPILock()); m_currentWeakRefVersion++; }
>+    uint64_t currentWeakRefVersion() const { return m_currentWeakRefVersion; }
>+
>     void setGlobalConstRedeclarationShouldThrow(bool globalConstRedeclarationThrow) { m_globalConstRedeclarationShouldThrow = globalConstRedeclarationThrow; }
>     ALWAYS_INLINE bool globalConstRedeclarationShouldThrow() const { return m_globalConstRedeclarationShouldThrow; }
> 
>@@ -1049,6 +1053,7 @@ private:
>     std::unique_ptr<BytecodeIntrinsicRegistry> m_bytecodeIntrinsicRegistry;
> 
>     WTF::Function<void(VM&)> m_onEachMicrotaskTick;
>+    uintptr_t m_currentWeakRefVersion { 0 };
> 
> #if ENABLE(JIT)
> #if !ASSERT_DISABLED
>diff --git a/Source/JavaScriptCore/runtime/WeakObjectRefConstructor.cpp b/Source/JavaScriptCore/runtime/WeakObjectRefConstructor.cpp
>new file mode 100644
>index 0000000000000000000000000000000000000000..4b6b75e461e717560a90a0068396fc5baeeadc84
>--- /dev/null
>+++ b/Source/JavaScriptCore/runtime/WeakObjectRefConstructor.cpp
>@@ -0,0 +1,80 @@
>+/*
>+ * Copyright (C) 2019 Apple, Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>+ */
>+
>+#include "config.h"
>+#include "WeakObjectRefConstructor.h"
>+
>+#include "Error.h"
>+#include "IteratorOperations.h"
>+#include "JSCInlines.h"
>+#include "JSGlobalObject.h"
>+#include "JSObjectInlines.h"
>+#include "JSWeakObjectRef.h"
>+#include "WeakObjectRefPrototype.h"
>+
>+namespace JSC {
>+
>+const ClassInfo WeakObjectRefConstructor::s_info = { "Function", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(WeakObjectRefConstructor) };
>+
>+void WeakObjectRefConstructor::finishCreation(VM& vm, WeakObjectRefPrototype* prototype)
>+{
>+    Base::finishCreation(vm, "WeakRef"_s, NameVisibility::Visible, NameAdditionMode::WithoutStructureTransition);
>+    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
>+    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
>+}
>+
>+static EncodedJSValue JSC_HOST_CALL callWeakRef(ExecState*);
>+static EncodedJSValue JSC_HOST_CALL constructWeakRef(ExecState*);
>+
>+WeakObjectRefConstructor::WeakObjectRefConstructor(VM& vm, Structure* structure)
>+    : Base(vm, structure, callWeakRef, constructWeakRef)
>+{
>+}
>+
>+static EncodedJSValue JSC_HOST_CALL callWeakRef(ExecState* exec)
>+{
>+    VM& vm = exec->vm();
>+    auto scope = DECLARE_THROW_SCOPE(vm);
>+    return JSValue::encode(throwConstructorCannotBeCalledAsFunctionTypeError(exec, scope, "WeakRef"));
>+}
>+
>+static EncodedJSValue JSC_HOST_CALL constructWeakRef(ExecState* exec)
>+{
>+    VM& vm = exec->vm();
>+    auto scope = DECLARE_THROW_SCOPE(vm);
>+
>+    if (!exec->argument(0).isObject())
>+        return throwVMTypeError(exec, scope, "First argument to WeakRef should be an object"_s);
>+
>+    JSGlobalObject* globalObject = jsCast<InternalFunction*>(exec->jsCallee())->globalObject(vm);
>+    Structure* WeakObjectRefStructure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), globalObject->weakObjectRefStructure());
>+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
>+    JSWeakObjectRef* WeakObjectRef = JSWeakObjectRef::create(vm, WeakObjectRefStructure, exec->uncheckedArgument(0).getObject());
>+    RETURN_IF_EXCEPTION(scope, encodedJSValue());
>+    return JSValue::encode(WeakObjectRef);
>+}
>+
>+}
>+
>diff --git a/Source/JavaScriptCore/runtime/WeakObjectRefConstructor.h b/Source/JavaScriptCore/runtime/WeakObjectRefConstructor.h
>new file mode 100644
>index 0000000000000000000000000000000000000000..e9eadad1963c6eced776f806b0061df2c18b9eb2
>--- /dev/null
>+++ b/Source/JavaScriptCore/runtime/WeakObjectRefConstructor.h
>@@ -0,0 +1,53 @@
>+/*
>+ * Copyright (C) 2019 Apple, Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>+ */
>+
>+#pragma once
>+
>+namespace JSC {
>+
>+class WeakObjectRefConstructor : public InternalFunction {
>+public:
>+    typedef InternalFunction Base;
>+
>+    static WeakObjectRefConstructor* create(VM& vm, Structure* structure, WeakObjectRefPrototype* prototype, GetterSetter*)
>+    {
>+        WeakObjectRefConstructor* constructor = new (NotNull, allocateCell<WeakObjectRefConstructor>(vm.heap)) WeakObjectRefConstructor(vm, structure);
>+        constructor->finishCreation(vm, prototype);
>+        return constructor;
>+    }
>+
>+    DECLARE_INFO;
>+
>+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
>+    {
>+        return Structure::create(vm, globalObject, prototype, TypeInfo(InternalFunctionType, StructureFlags), info());
>+    }
>+
>+private:
>+    WeakObjectRefConstructor(VM&, Structure*);
>+    void finishCreation(VM&, WeakObjectRefPrototype*);
>+};
>+
>+}
>diff --git a/Source/JavaScriptCore/runtime/WeakObjectRefPrototype.cpp b/Source/JavaScriptCore/runtime/WeakObjectRefPrototype.cpp
>new file mode 100644
>index 0000000000000000000000000000000000000000..035ceb2dde5d5e3f90763551ba94c2b8aa62d079
>--- /dev/null
>+++ b/Source/JavaScriptCore/runtime/WeakObjectRefPrototype.cpp
>@@ -0,0 +1,80 @@
>+/*
>+ * Copyright (C) 2019 Apple, Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>+ */
>+
>+#include "config.h"
>+#include "WeakObjectRefPrototype.h"
>+
>+#include "Error.h"
>+#include "JSCInlines.h"
>+#include "JSWeakObjectRef.h"
>+
>+namespace JSC {
>+
>+const ClassInfo WeakObjectRefPrototype::s_info = { "WeakRef", &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(WeakObjectRefPrototype) };
>+
>+static EncodedJSValue JSC_HOST_CALL protoFuncWeakRefDeref(ExecState*);
>+
>+void WeakObjectRefPrototype::finishCreation(VM& vm, JSGlobalObject* globalObject)
>+{
>+    Base::finishCreation(vm);
>+    ASSERT(inherits(vm, info()));
>+    didBecomePrototype();
>+
>+    // FIXME: It wouldn't be hard to make this an intrinsic.
>+    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->deref, protoFuncWeakRefDeref, static_cast<unsigned>(PropertyAttribute::DontEnum), 0);
>+
>+    putDirectWithoutTransition(vm, vm.propertyNames->toStringTagSymbol, jsString(&vm, "WeakRef"), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
>+}
>+
>+ALWAYS_INLINE static JSWeakObjectRef* getWeakRef(CallFrame* callFrame, JSValue value)
>+{
>+    VM& vm = callFrame->vm();
>+    auto scope = DECLARE_THROW_SCOPE(vm);
>+
>+    if (UNLIKELY(!value.isObject())) {
>+        throwTypeError(callFrame, scope, "Called WeakRef function on non-object"_s);
>+        return nullptr;
>+    }
>+
>+    auto* ref = jsDynamicCast<JSWeakObjectRef*>(vm, asObject(value));
>+    if (LIKELY(ref))
>+        return ref;
>+
>+    throwTypeError(callFrame, scope, "Called WeakRef function on a non-WeakRef object"_s);
>+    return nullptr;
>+}
>+
>+EncodedJSValue JSC_HOST_CALL protoFuncWeakRefDeref(CallFrame* callFrame)
>+{
>+    VM& vm = callFrame->vm();
>+    auto* ref = getWeakRef(callFrame, callFrame->thisValue());
>+    if (!ref)
>+        return JSValue::encode(jsUndefined());
>+
>+    auto* value = ref->deref(vm);
>+    return value ? JSValue::encode(value) : JSValue::encode(jsNull());
>+}
>+
>+}
>diff --git a/Source/JavaScriptCore/runtime/WeakObjectRefPrototype.h b/Source/JavaScriptCore/runtime/WeakObjectRefPrototype.h
>new file mode 100644
>index 0000000000000000000000000000000000000000..b14941bc195cc6b5b67c5fdc738ebb4f109ab5e9
>--- /dev/null
>+++ b/Source/JavaScriptCore/runtime/WeakObjectRefPrototype.h
>@@ -0,0 +1,59 @@
>+/*
>+ * Copyright (C) 2019 Apple, Inc. All rights reserved.
>+ *
>+ * Redistribution and use in source and binary forms, with or without
>+ * modification, are permitted provided that the following conditions
>+ * are met:
>+ * 1. Redistributions of source code must retain the above copyright
>+ *    notice, this list of conditions and the following disclaimer.
>+ * 2. Redistributions in binary form must reproduce the above copyright
>+ *    notice, this list of conditions and the following disclaimer in the
>+ *    documentation and/or other materials provided with the distribution.
>+ *
>+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
>+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
>+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
>+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
>+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
>+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
>+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
>+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
>+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
>+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
>+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
>+ */
>+
>+#pragma once
>+
>+#include "JSObject.h"
>+
>+namespace JSC {
>+
>+class WeakObjectRefPrototype final : public JSNonFinalObject {
>+public:
>+    typedef JSNonFinalObject Base;
>+
>+    static WeakObjectRefPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
>+    {
>+        WeakObjectRefPrototype* prototype = new (NotNull, allocateCell<WeakObjectRefPrototype>(vm.heap)) WeakObjectRefPrototype(vm, structure);
>+        prototype->finishCreation(vm, globalObject);
>+        return prototype;
>+    }
>+
>+    DECLARE_INFO;
>+
>+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
>+    {
>+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
>+    }
>+
>+private:
>+    WeakObjectRefPrototype(VM& vm, Structure* structure)
>+        : Base(vm, structure)
>+    {
>+    }
>+    void finishCreation(VM&, JSGlobalObject*);
>+};
>+
>+}
>+
>diff --git a/Source/WebCore/dom/Microtasks.cpp b/Source/WebCore/dom/Microtasks.cpp
>index 2cccf0b22c077421701b1c6f1669f290af9ddb24..a2b96e9e873db006f59b23501eb5ccaddb4c56fe 100644
>--- a/Source/WebCore/dom/Microtasks.cpp
>+++ b/Source/WebCore/dom/Microtasks.cpp
>@@ -22,6 +22,7 @@
> #include "config.h"
> #include "Microtasks.h"
> 
>+#include "CommonVM.h"
> #include "WorkerGlobalScope.h"
> #include <wtf/MainThread.h>
> #include <wtf/NeverDestroyed.h>
>@@ -34,8 +35,9 @@ void Microtask::removeSelfFromQueue(MicrotaskQueue& queue)
>     queue.remove(*this);
> }
> 
>-MicrotaskQueue::MicrotaskQueue()
>-    : m_timer(*this, &MicrotaskQueue::timerFired)
>+MicrotaskQueue::MicrotaskQueue(JSC::VM& vm)
>+    : m_vm(makeRef(vm))
>+    , m_timer(*this, &MicrotaskQueue::timerFired)
> {
> }
> 
>@@ -44,7 +46,7 @@ MicrotaskQueue::~MicrotaskQueue() = default;
> MicrotaskQueue& MicrotaskQueue::mainThreadQueue()
> {
>     ASSERT(isMainThread());
>-    static NeverDestroyed<MicrotaskQueue> queue;
>+    static NeverDestroyed<MicrotaskQueue> queue(commonVM());
>     return queue;
> }
> 
>@@ -87,6 +89,7 @@ void MicrotaskQueue::performMicrotaskCheckpoint()
>         return;
> 
>     SetForScope<bool> change(m_performingMicrotaskCheckpoint, true);
>+    JSC::JSLockHolder locker(vm());
> 
>     Vector<std::unique_ptr<Microtask>> toKeep;
>     while (!m_microtaskQueue.isEmpty()) {
>@@ -103,6 +106,7 @@ void MicrotaskQueue::performMicrotaskCheckpoint()
>         }
>     }
> 
>+    vm().finalizeSynchronousJSExecution();
>     m_microtaskQueue = WTFMove(toKeep);
> }
> 
>diff --git a/Source/WebCore/dom/Microtasks.h b/Source/WebCore/dom/Microtasks.h
>index 9e0d96c7fbc60d8a90032a287c89eeaf83017bc6..27d7e7a8144d74e2d74bd730eb1998ce3c9718aa 100644
>--- a/Source/WebCore/dom/Microtasks.h
>+++ b/Source/WebCore/dom/Microtasks.h
>@@ -72,19 +72,23 @@ public:
>     WEBCORE_EXPORT static MicrotaskQueue& mainThreadQueue();
>     WEBCORE_EXPORT static MicrotaskQueue& contextQueue(ScriptExecutionContext&);
> 
>-    WEBCORE_EXPORT MicrotaskQueue();
>+    WEBCORE_EXPORT MicrotaskQueue(JSC::VM&);
>     WEBCORE_EXPORT ~MicrotaskQueue();
> 
>     WEBCORE_EXPORT void append(std::unique_ptr<Microtask>&&);
>     WEBCORE_EXPORT void performMicrotaskCheckpoint();
> 
>+    JSC::VM& vm() const { return m_vm.get(); }
>+
> private:
>     WEBCORE_EXPORT void remove(const Microtask&);
> 
>     void timerFired();
> 
>-    bool m_performingMicrotaskCheckpoint = false;
>+    bool m_performingMicrotaskCheckpoint { false };
>     Vector<std::unique_ptr<Microtask>> m_microtaskQueue;
>+    // For the main thread the VM lives forever. For workers it's lifetime is tied to our owning WorkerGlobalScope. Regardless, we retain the VM here to be safe.
>+    Ref<JSC::VM> m_vm;
> 
>     // FIXME: Instead of a Timer, we should have a centralized Event Loop that calls performMicrotaskCheckpoint()
>     // on every iteration, implementing https://html.spec.whatwg.org/multipage/webappapis.html#processing-model-9
>diff --git a/Source/WebCore/workers/WorkerGlobalScope.cpp b/Source/WebCore/workers/WorkerGlobalScope.cpp
>index 8c06eaaabdfae9a6be608b04ed1bc4ced867ee57..7493e031f7ab618c46edeba06950e6204f76010e 100644
>--- a/Source/WebCore/workers/WorkerGlobalScope.cpp
>+++ b/Source/WebCore/workers/WorkerGlobalScope.cpp
>@@ -64,7 +64,7 @@ WorkerGlobalScope::WorkerGlobalScope(const URL& url, Ref<SecurityOrigin>&& origi
>     , m_thread(thread)
>     , m_script(std::make_unique<WorkerScriptController>(this))
>     , m_inspectorController(std::make_unique<WorkerInspectorController>(*this))
>-    , m_microtaskQueue(std::make_unique<MicrotaskQueue>())
>+    , m_microtaskQueue(std::make_unique<MicrotaskQueue>(m_script->vm()))
>     , m_isOnline(isOnline)
>     , m_shouldBypassMainWorldContentSecurityPolicy(shouldBypassMainWorldContentSecurityPolicy)
>     , m_eventQueue(*this)
>diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
>index 74e8b9e7e994f9d394b7b52853d074c087313e8a..f9e7110ba2afc84f4a0555e7aa76352a157e0648 100644
>--- a/LayoutTests/ChangeLog
>+++ b/LayoutTests/ChangeLog
>@@ -1,3 +1,45 @@
>+2019-06-12  Keith Miller  <keith_miller@apple.com>
>+
>+        Add support for WeakRef
>+        https://bugs.webkit.org/show_bug.cgi?id=198710
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Add an asyncTestStart that mirrors the asyncTestStart behavior in
>+        the JSC cli.
>+
>+        * http/tests/resources/js-test-pre.js:
>+        (asyncTestStart):
>+        * js/script-tests/weakref-async-is-collected.js: Added.
>+        (makeWeakRef):
>+        (turnEventLoop):
>+        (async.foo):
>+        (async.test):
>+        * js/script-tests/weakref-eventually-collects-values.js: Added.
>+        (makeWeakRef):
>+        (turnEventLoop):
>+        (let.weakRefs.async.test):
>+        * js/script-tests/weakref-microtasks-dont-collect.js: Added.
>+        (asyncTestStart.1.makeWeakRef):
>+        (turnEventLoop):
>+        (async.foo):
>+        (async.test):
>+        * js/script-tests/weakref-weakset-consistency.js: Added.
>+        (makeWeakRef):
>+        (turnEventLoop):
>+        (async.foo):
>+        (async.test):
>+        * js/weakref-async-is-collected-expected.txt: Added.
>+        * js/weakref-async-is-collected.html: Added.
>+        * js/weakref-eventually-collects-values-expected.txt: Added.
>+        * js/weakref-eventually-collects-values.html: Added.
>+        * js/weakref-microtasks-dont-collect-expected.txt: Added.
>+        * js/weakref-microtasks-dont-collect.html: Added.
>+        * js/weakref-weakset-consistency-expected.txt: Added.
>+        * js/weakref-weakset-consistency.html: Added.
>+        * resources/js-test-pre.js:
>+        (asyncTestStart):
>+
> 2019-06-08  Cathie Chen  <cathiechen@igalia.com>
> 
>         resize-observer/element-leak.html fails on Windows platform
>diff --git a/LayoutTests/http/tests/resources/js-test-pre.js b/LayoutTests/http/tests/resources/js-test-pre.js
>index b488de948664a9e875bd4d29aae81c6c3c8f2565..9a6dea32a22e2fb4a04c5957471330a8c7554462 100644
>--- a/LayoutTests/http/tests/resources/js-test-pre.js
>+++ b/LayoutTests/http/tests/resources/js-test-pre.js
>@@ -757,6 +757,16 @@ function isSuccessfullyParsed()
>     debug('<br /><span class="pass">TEST COMPLETE</span>');
> }
> 
>+function asyncTestStart() {
>+    if (self.testRunner)
>+        testRunner.waitUntilDone();
>+}
>+
>+function asyncTestPassed() {
>+    if (self.testRunner)
>+        testRunner.notifyDone();
>+}
>+
> // It's possible for an async test to call finishJSTest() before js-test-post.js
> // has been parsed.
> function finishJSTest()
>diff --git a/LayoutTests/js/script-tests/weakref-async-is-collected.js b/LayoutTests/js/script-tests/weakref-async-is-collected.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..3cec80398d6239b743004b02b00cc3927ee363b6
>--- /dev/null
>+++ b/LayoutTests/js/script-tests/weakref-async-is-collected.js
>@@ -0,0 +1,45 @@
>+asyncTestStart(1);
>+function makeWeakRef() { return new WeakRef({foo: 1 }); }
>+noInline(makeWeakRef);
>+
>+let loopCount = 10000;
>+function turnEventLoop() {
>+    return new Promise(function(resolve, reject) {
>+        if (globalThis.window) {
>+            // Turns out the test times out if we turn the event loop 10000 times...
>+            loopCount = 1000;
>+            window.setTimeout(() => {
>+                resolve();
>+            }, 0);
>+        } else {
>+            releaseWeakRefs();
>+            resolve();
>+        }
>+    });
>+}
>+
>+let weakRefs = [];
>+
>+async function* foo() {
>+    let weak = makeWeakRef();
>+    await 2;
>+    if (weak.deref().foo !== 1)
>+        throw new Error("Weak ref was collected too early");
>+    await turnEventLoop();
>+    weakRefs.push(weak);
>+}
>+
>+async function test() {
>+    for (let i = 0; i < loopCount; i++) {
>+        for await (value of foo()) { }
>+        if (i % 100 === 0)
>+            gc();
>+    }
>+    gc();
>+
>+    if (weakRefs.find((weak) => weak.deref() === null) === undefined)
>+        throw new Error("No weak ref value was collected");
>+    asyncTestPassed();
>+}
>+
>+test().catch(e => debug(e));
>diff --git a/LayoutTests/js/script-tests/weakref-eventually-collects-values.js b/LayoutTests/js/script-tests/weakref-eventually-collects-values.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..8cf03945a14cce12d223e0f76f81b017c80eda61
>--- /dev/null
>+++ b/LayoutTests/js/script-tests/weakref-eventually-collects-values.js
>@@ -0,0 +1,40 @@
>+asyncTestStart(1);
>+
>+function makeWeakRef() { return new WeakRef({foo: 1}); }
>+noInline(makeWeakRef);
>+
>+let loopCount = 10000;
>+function turnEventLoop() {
>+    return new Promise(function(resolve, reject) {
>+        if (globalThis.window) {
>+            // Turns out the test times out if we turn the event loop 10000 times...
>+            loopCount = 1000;
>+            window.setTimeout(() => {
>+                resolve();
>+            }, 0);
>+        } else {
>+            releaseWeakRefs();
>+            resolve();
>+        }
>+    });
>+}
>+
>+let weakRefs = []
>+
>+async function test() {
>+
>+    for (let i = 0; i < loopCount; i++) {
>+        let weak = makeWeakRef();
>+        if (weak.deref().foo != 1)
>+            throw new Error("weak ref was freed too early.");
>+        weakRefs.push(weak);
>+    }
>+    await turnEventLoop();
>+    gc();
>+
>+    if (!weakRefs.find((weak) => weak.deref() === null))
>+        throw new Error("no weak ref was collected");
>+    asyncTestPassed();
>+}
>+
>+test().catch(e => debug(e));
>diff --git a/LayoutTests/js/script-tests/weakref-microtasks-dont-collect.js b/LayoutTests/js/script-tests/weakref-microtasks-dont-collect.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..dd7e9afdcd2dff03caa353981162604482c5d864
>--- /dev/null
>+++ b/LayoutTests/js/script-tests/weakref-microtasks-dont-collect.js
>@@ -0,0 +1,48 @@
>+asyncTestStart(1);
>+
>+function makeWeakRef() { return new WeakRef({foo: 1 }); }
>+noInline(makeWeakRef);
>+
>+let loopCount = 10000;
>+
>+function turnEventLoop() {
>+    return new Promise(function(resolve, reject) {
>+        if (globalThis.window) {
>+            // Turns out the test times out if we turn the event loop 10000 times...
>+            loopCount = 1000;
>+            window.setTimeout(() => {
>+                resolve();
>+            }, 0);
>+        } else {
>+            releaseWeakRefs();
>+            resolve();
>+        }
>+    });
>+}
>+
>+let weakRefs = [];
>+
>+async function* foo() {
>+    let weak = makeWeakRef();
>+    let object = weak.deref();
>+    yield await 1;
>+    if (weak.deref() !== object)
>+        throw new Error("Object appears to have been collected incorrectly");
>+    object = null;
>+    yield await turnEventLoop();
>+    weakRefs.push(weak);
>+}
>+
>+async function test() {
>+    for (let i = 0; i < loopCount; i++) {
>+        for await (value of foo()) { }
>+    }
>+    gc();
>+
>+    if (weakRefs.find((weak) => weak.deref() === null) === undefined)
>+        throw new Error("No weak ref value was collected");
>+    asyncTestPassed();
>+}
>+
>+
>+test().catch(e => debug(e));
>diff --git a/LayoutTests/js/script-tests/weakref-weakset-consistency.js b/LayoutTests/js/script-tests/weakref-weakset-consistency.js
>new file mode 100644
>index 0000000000000000000000000000000000000000..57941e99d998b4914fa3f98241d035907a2688fc
>--- /dev/null
>+++ b/LayoutTests/js/script-tests/weakref-weakset-consistency.js
>@@ -0,0 +1,42 @@
>+asyncTestStart(1);
>+function makeWeakRef() { return new WeakRef({foo: 1 }); }
>+noInline(makeWeakRef);
>+
>+let loopCount = 10000;
>+function turnEventLoop() {
>+    return new Promise(function(resolve, reject) {
>+        if (globalThis.window) {
>+            // Turns out the test times out if we turn the event loop 10000 times...
>+            loopCount = 1000;
>+            window.setTimeout(() => {
>+                resolve();
>+            }, 0);
>+        } else {
>+            releaseWeakRefs();
>+            resolve();
>+        }
>+    });
>+}
>+
>+let weakSet = new WeakSet();
>+let weakRefs = [];
>+
>+async function* foo() {
>+    let weak = makeWeakRef();
>+    weakSet.add(weak.deref());
>+    await turnEventLoop();
>+    weakRefs.push(weak);
>+}
>+
>+async function test() {
>+    for (let i = 0; i < loopCount; i++) {
>+        for await (value of foo()) { }
>+    }
>+    gc();
>+
>+    if (weakRefs.find((weak) => weak.deref() && !weakSet.has(weak.deref())))
>+        throw new Error("Weak ref has target but weak set lost reference." )
>+    asyncTestPassed();
>+}
>+
>+test().catch(e => debug(e));
>diff --git a/LayoutTests/js/weakref-async-is-collected-expected.txt b/LayoutTests/js/weakref-async-is-collected-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..43e5eeedbf1b435f96c3a20bf81401aee4331981
>--- /dev/null
>+++ b/LayoutTests/js/weakref-async-is-collected-expected.txt
>@@ -0,0 +1,4 @@
>+PASS successfullyParsed is true
>+
>+TEST COMPLETE
>+
>diff --git a/LayoutTests/js/weakref-async-is-collected.html b/LayoutTests/js/weakref-async-is-collected.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..f50cfda5c8fb7bea3b5097b878cdd1a3c968e8cc
>--- /dev/null
>+++ b/LayoutTests/js/weakref-async-is-collected.html
>@@ -0,0 +1,10 @@
>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
>+<html>
>+<head>
>+<script src="../resources/js-test-pre.js"></script>
>+</head>
>+<body>
>+<script src="script-tests/weakref-async-is-collected.js"></script>
>+<script src="../resources/js-test-post.js"></script>
>+</body>
>+</html>
>diff --git a/LayoutTests/js/weakref-eventually-collects-values-expected.txt b/LayoutTests/js/weakref-eventually-collects-values-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..43e5eeedbf1b435f96c3a20bf81401aee4331981
>--- /dev/null
>+++ b/LayoutTests/js/weakref-eventually-collects-values-expected.txt
>@@ -0,0 +1,4 @@
>+PASS successfullyParsed is true
>+
>+TEST COMPLETE
>+
>diff --git a/LayoutTests/js/weakref-eventually-collects-values.html b/LayoutTests/js/weakref-eventually-collects-values.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..f36d7d741afab9d93a948c5a425b66a8cb1124fb
>--- /dev/null
>+++ b/LayoutTests/js/weakref-eventually-collects-values.html
>@@ -0,0 +1,10 @@
>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
>+<html>
>+<head>
>+<script src="../resources/js-test-pre.js"></script>
>+</head>
>+<body>
>+<script src="script-tests/weakref-eventually-collects-values.js"></script>
>+<script src="../resources/js-test-post.js"></script>
>+</body>
>+</html>
>diff --git a/LayoutTests/js/weakref-microtasks-dont-collect-expected.txt b/LayoutTests/js/weakref-microtasks-dont-collect-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..43e5eeedbf1b435f96c3a20bf81401aee4331981
>--- /dev/null
>+++ b/LayoutTests/js/weakref-microtasks-dont-collect-expected.txt
>@@ -0,0 +1,4 @@
>+PASS successfullyParsed is true
>+
>+TEST COMPLETE
>+
>diff --git a/LayoutTests/js/weakref-microtasks-dont-collect.html b/LayoutTests/js/weakref-microtasks-dont-collect.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..2c4853cd8f27c7fc8f7f4dd98a76fc0829fb6e7b
>--- /dev/null
>+++ b/LayoutTests/js/weakref-microtasks-dont-collect.html
>@@ -0,0 +1,10 @@
>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
>+<html>
>+<head>
>+<script src="../resources/js-test-pre.js"></script>
>+</head>
>+<body>
>+<script src="script-tests/weakref-microtasks-dont-collect.js"></script>
>+<script src="../resources/js-test-post.js"></script>
>+</body>
>+</html>
>diff --git a/LayoutTests/js/weakref-weakset-consistency-expected.txt b/LayoutTests/js/weakref-weakset-consistency-expected.txt
>new file mode 100644
>index 0000000000000000000000000000000000000000..43e5eeedbf1b435f96c3a20bf81401aee4331981
>--- /dev/null
>+++ b/LayoutTests/js/weakref-weakset-consistency-expected.txt
>@@ -0,0 +1,4 @@
>+PASS successfullyParsed is true
>+
>+TEST COMPLETE
>+
>diff --git a/LayoutTests/js/weakref-weakset-consistency.html b/LayoutTests/js/weakref-weakset-consistency.html
>new file mode 100644
>index 0000000000000000000000000000000000000000..c3ae9b608f3d3df7c4ca3c2ca45f79cfd672dcf3
>--- /dev/null
>+++ b/LayoutTests/js/weakref-weakset-consistency.html
>@@ -0,0 +1,10 @@
>+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
>+<html>
>+<head>
>+<script src="../resources/js-test-pre.js"></script>
>+</head>
>+<body>
>+<script src="script-tests/weakref-weakset-consistency.js"></script>
>+<script src="../resources/js-test-post.js"></script>
>+</body>
>+</html>
>diff --git a/LayoutTests/resources/js-test-pre.js b/LayoutTests/resources/js-test-pre.js
>index b488de948664a9e875bd4d29aae81c6c3c8f2565..9a6dea32a22e2fb4a04c5957471330a8c7554462 100644
>--- a/LayoutTests/resources/js-test-pre.js
>+++ b/LayoutTests/resources/js-test-pre.js
>@@ -757,6 +757,16 @@ function isSuccessfullyParsed()
>     debug('<br /><span class="pass">TEST COMPLETE</span>');
> }
> 
>+function asyncTestStart() {
>+    if (self.testRunner)
>+        testRunner.waitUntilDone();
>+}
>+
>+function asyncTestPassed() {
>+    if (self.testRunner)
>+        testRunner.notifyDone();
>+}
>+
> // It's possible for an async test to call finishJSTest() before js-test-post.js
> // has been parsed.
> function finishJSTest()

Actions: View | Formatted Diff | Diff

Attachments on bug 198710: 371736 | 371952 | 371958 | 371959 | 371960 | 371961 | 371970 | 372038 | 372044 | 372046 | 372370