Bug 1904011 - Ignore finalized scripts when iterating code covarage t…

…ables r=iain

Differential Revision: https://phabricator.services.mozilla.com/D214799

js/src/gc/Zone.cpp

@@ -906,7 +906,13 @@ void Zone::clearScriptCounts(Realm* realm) {
   // Clear all hasScriptCounts_ flags of BaseScript, in order to release all
   // ScriptCounts entries of the given realm.
   for (auto i = scriptCountsMap->modIter(); !i.done(); i.next()) {
-    BaseScript* script = i.get().key();
+    const HeapPtr<BaseScript*>& script = i.get().key();
+    if (IsAboutToBeFinalized(script)) {
+      // Dead scripts may be present during incremental GC until script
+      // finalizers have been run.
+      continue;
+    }
+
     if (script->realm() != realm) {
       continue;
     }
@@ -927,7 +933,13 @@ void Zone::clearScriptLCov(Realm* realm) {
   }
 
   for (auto i = scriptLCovMap->modIter(); !i.done(); i.next()) {
-    BaseScript* script = i.get().key();
+    const HeapPtr<BaseScript*>& script = i.get().key();
+    if (IsAboutToBeFinalized(script)) {
+      // Dead scripts may be present during incremental GC until script
+      // finalizers have been run.
+      continue;
+    }
+
     if (script->realm() == realm) {
       i.remove();
     }

js/src/jit-test/tests/debug/bug-1904011.js

@@ -0,0 +1,15 @@
+// |jit-test| --fuzzing-safe; --ion-offthread-compile=off
+gczeal(0);
+
+let g = newGlobal({newCompartment: true});
+let dbg = new Debugger(g);
+
+dbg.collectCoverageInfo = true;
+g.eval("0");
+
+// Start a GC in the debugger's zone and yield after sweeping objects.
+schedulezone(g);
+gczeal(22);
+startgc(100);
+
+dbg.collectCoverageInfo = false;