1224352 - Change the default hasher for JSObject and derived types to MovableCellHasher

Status: NEW

(Core :: JavaScript: GC, defect)

Description

[Terrence Cole [:terrence]]

Note, it is vitally important that we do not do this until /after/ we have manually switched over and individually audited all users in both SpiderMonkey and Gecko.

While switching to stable hashing means that we no longer need to update the hashtable itself during GC, the pointer contents still need to be updated to point at the moved objects. The important difference with stable hashing is that this can now happen in-place, without changing anything else about the table. This is very good as it means that our normal pointer-handling primitives will "just work" when used inside a hashtable.

Unfortunately, as we did not have any universal primitive before, each table is a unique snowflake that is going to require individual care as we replace the prior ad-hoc solutions with canonically correct pointer handling.

Once we have correct handling with manual use of MovableCellHasher, we can make DefaultHasher a MovableCellHasher for the relevant types, then switch everything back to DefaultHasher, and remove the declaration entirely in cases where the automatic hasher is correct.

I have a patch that does this in a clean way for the tables I've converted so far, but it still, obviously, fails at runtime.