Trace strong edges if WeakRef stub preffed.

js/src/builtin/FinalizationRegistryObject.cpp

@@ -119,9 +119,9 @@ struct WeakCell {
             if (!target)
                 return;
 
-            if (!enabled) {
+            if (!enabled || IsInsideNursery(target)) {
-              // Do nothing
+                // Weak edges must be tenured.
-            } else if (IsInsideNursery(target)) {
+                // Trace strongly if inside nursery or WeakRef disabled.
                 TraceManuallyBarrieredEdge(trc, object.unsafeGet(), name);
             } else {
                 if (trc->isMarkingTracer() && !target->asTenured().zone()->isCollecting())
@@ -130,10 +130,15 @@ struct WeakCell {
             }
         } else if (kind == WeakCellKind::Symbol) {
             JS::Symbol* target = symbol.unbarrieredGet();
-            if (enabled && target) {
+            if (target) {
-                if (trc->isMarkingTracer() && !target->asTenured().zone()->isCollecting())
+                if (!enabled) {
-                    return;
+                    // Trace strongly if WeakRef disabled.
-                TraceWeakEdge(trc, &symbol, name);
+                    TraceManuallyBarrieredEdge(trc, symbol.unsafeGet(), name);
+                } else {
+                    if (trc->isMarkingTracer() && !target->asTenured().zone()->isCollecting())
+                        return;
+                    TraceWeakEdge(trc, &symbol, name);
+                }
             }
         }
     }

js/src/builtin/WeakRefObject.cpp

@@ -216,20 +216,25 @@ WeakRefObject::trace(JSTracer* trc, JSObject* obj)
             if (!target)
                 return;
 
-            if (!data->enabled) {
+            if (!data->enabled || IsInsideNursery(target)) {
-                // Pref disabled, don't do anything.
+                // Weak edges must be tenured; trace strongly while referent is in
-            } else if (IsInsideNursery(target)) {
+                // the nursery or if WeakRefs are disabled by pref.
-                // Weak edges must be tenured; trace strongly while referent is in the nursery.
                 TraceManuallyBarrieredEdge(trc, data->objectTarget.unsafeGet(),
-                                           "WeakRef nursery referent");
+                                           "WeakRef strong referent");
             } else {
                 TraceWeakEdge(trc, &data->objectTarget, "WeakRef referent");
             }
         } else {
             MOZ_ASSERT(data->isSymbol());
             JS::Symbol* target = data->symbolTarget.unbarrieredGet();
-            if (data->enabled && target)
+            if (target) {
-                TraceWeakEdge(trc, &data->symbolTarget, "WeakRef symbol referent");
+                if (data->enabled) {
+                    TraceWeakEdge(trc, &data->symbolTarget, "WeakRef symbol referent");
+                } else {
+                    TraceManuallyBarrieredEdge(trc, data->symbolTarget.unsafeGet(),
+                                               "WeakRef strong symbol referent");
+                }
+            }
         }
     }
 }