LibJS+js+test-js: Add GC debug mode that keeps cells "alive" as zombies

This patch adds a `-z` option to js and test-js. When run in this mode,
garbage cells are never actually destroyed. We instead keep them around
in a special zombie state.

This allows us to validate that zombies don't get marked in future GC
scans (since there were not supposed to be any more references!) :^)

Cells get notified when they become a zombie (via did_become_zombie())
and this is used by WeakContainer cells to deregister themselves from
the heap.

1 files changed, 13 insertions, 1 deletions

diff --git a/Userland/Libraries/LibJS/Heap/Heap.cpp b/Userland/Libraries/LibJS/Heap/Heap.cpp
index 4c5b9292d0..4e7ccdf6fb 100644
--- a/Userland/Libraries/LibJS/Heap/Heap.cpp
+++ b/Userland/Libraries/LibJS/Heap/Heap.cpp
@@ -183,6 +183,13 @@ public:
         if (cell.is_marked())
             return;
         dbgln_if(HEAP_DEBUG, "  ! {}", &cell);
+
+        if (cell.state() == Cell::State::Zombie) {
+            dbgln("BUG! Marking a zombie cell, {} @ {:p}", cell.class_name(), &cell);
+            cell.vm().dump_backtrace();
+            VERIFY_NOT_REACHED();
+        }
+
         cell.set_marked(true);
         cell.visit_edges(*this);
     }
@@ -223,7 +230,12 @@ void Heap::sweep_dead_cells(bool print_report, const Core::ElapsedTimer& measure
                 dbgln_if(HEAP_DEBUG, "  ~ {}", cell);
                 if (should_store_swept_cells)
                     swept_cells.append(cell);
-                block.deallocate(cell);
+                if (m_zombify_dead_cells) {
+                    cell->set_state(Cell::State::Zombie);
+                    cell->did_become_zombie();
+                } else {
+                    block.deallocate(cell);
+                }
                 ++collected_cells;
                 collected_cell_bytes += block.cell_size();
             } else {