cppgc: Handle non-gced traceable ephemeron values

On-heap hash maps in blink are limited to Member types and non-traceable
types. The only exception to that is TraceWrapperV8Reference. Thus
ephemerons can have non-gced traceable values. This values should not be
pushed to the marking worklist since we expect everything in the
worklist to be marked and not in construction (but these values don't
have an object header).
Instead, when getting a non-gced value we should immediately trace it.

This is only relevant to ephemerons. Any other case would go through
Trace(const T&) that dispatches to the TraceTrait.

Blink has 1 use case of HeahHashMap from WeakMember<ScriptWrappable> to
TraceWrapperV8Reference.

Bug: chromium:1056170
Change-Id: Ia8f341d6bb1fc8fd3655b2be66b7814896549d1e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2696648Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72763}

include/cppgc/visitor.h

@@ -170,7 +170,7 @@ class V8_EXPORT Visitor {
     if (!k) return;
     TraceDescriptor value_desc = TraceTrait<V>::GetTraceDescriptor(value);
     if (!value_desc.base_object_payload) return;
-    VisitEphemeron(key, value_desc);
+    VisitEphemeron(key, value, value_desc);
   }
 
   /**
@@ -251,7 +251,8 @@ class V8_EXPORT Visitor {
   virtual void VisitRoot(const void*, TraceDescriptor, const SourceLocation&) {}
   virtual void VisitWeakRoot(const void* self, TraceDescriptor, WeakCallback,
                              const void* weak_root, const SourceLocation&) {}
-  virtual void VisitEphemeron(const void* key, TraceDescriptor value_desc) {}
+  virtual void VisitEphemeron(const void* key, const void* value,
+                              TraceDescriptor value_desc) {}
   virtual void VisitWeakContainer(const void* self, TraceDescriptor strong_desc,
                                   TraceDescriptor weak_desc,
                                   WeakCallback callback, const void* data) {}

src/heap/cppgc-js/unified-heap-marking-visitor.cc

@@ -34,8 +34,9 @@ void UnifiedHeapMarkingVisitorBase::VisitWeak(const void* object,
 }
 
 void UnifiedHeapMarkingVisitorBase::VisitEphemeron(const void* key,
+                                                   const void* value,
                                                    TraceDescriptor value_desc) {
-  marking_state_.ProcessEphemeron(key, value_desc);
+  marking_state_.ProcessEphemeron(key, value, value_desc, *this);
 }
 
 void UnifiedHeapMarkingVisitorBase::VisitWeakContainer(

src/heap/cppgc-js/unified-heap-marking-visitor.h

@@ -41,7 +41,7 @@ class V8_EXPORT_PRIVATE UnifiedHeapMarkingVisitorBase : public JSVisitor {
   // C++ handling.
   void Visit(const void*, TraceDescriptor) final;
   void VisitWeak(const void*, TraceDescriptor, WeakCallback, const void*) final;
-  void VisitEphemeron(const void*, TraceDescriptor) final;
+  void VisitEphemeron(const void*, const void*, TraceDescriptor) final;
   void VisitWeakContainer(const void* self, TraceDescriptor strong_desc,
                           TraceDescriptor weak_desc, WeakCallback callback,
                           const void* data) final;

src/heap/cppgc/concurrent-marker.cc

@@ -158,10 +158,11 @@ void ConcurrentMarkingTask::ProcessWorklists(
               concurrent_marker_.incremental_marking_schedule(),
               concurrent_marking_state
                   .ephemeron_pairs_for_processing_worklist(),
-              [&concurrent_marking_state](
+              [&concurrent_marking_state, &concurrent_marking_visitor](
                   const MarkingWorklists::EphemeronPairItem& item) {
-                concurrent_marking_state.ProcessEphemeron(item.key,
-                                                          item.value_desc);
+                concurrent_marking_state.ProcessEphemeron(
+                    item.key, item.value, item.value_desc,
+                    concurrent_marking_visitor);
               })) {
         return;
       }

src/heap/cppgc/marker.cc

@@ -493,8 +493,8 @@ bool MarkerBase::ProcessWorklistsWithDeadline(
               mutator_marking_state_, marked_bytes_deadline, time_deadline,
               mutator_marking_state_.ephemeron_pairs_for_processing_worklist(),
               [this](const MarkingWorklists::EphemeronPairItem& item) {
-                mutator_marking_state_.ProcessEphemeron(item.key,
-                                                        item.value_desc);
+                mutator_marking_state_.ProcessEphemeron(
+                    item.key, item.value, item.value_desc, visitor());
               })) {
         return false;
       }

src/heap/cppgc/marking-state.h

@@ -8,6 +8,7 @@
 #include <algorithm>
 
 #include "include/cppgc/trace-trait.h"
+#include "include/cppgc/visitor.h"
 #include "src/heap/cppgc/compaction-worklists.h"
 #include "src/heap/cppgc/globals.h"
 #include "src/heap/cppgc/heap-object-header.h"
@@ -48,7 +49,8 @@ class MarkingStateBase {
   inline void ProcessWeakContainer(const void*, TraceDescriptor, WeakCallback,
                                    const void*);
 
-  inline void ProcessEphemeron(const void*, TraceDescriptor);
+  inline void ProcessEphemeron(const void*, const void*, TraceDescriptor,
+                               Visitor&);
 
   inline void AccountMarkedBytes(const HeapObjectHeader&);
   inline void AccountMarkedBytes(size_t);
@@ -265,16 +267,23 @@ void MarkingStateBase::ProcessWeakContainer(const void* object,
   if (desc.callback) PushMarked(header, desc);
 }
 
-void MarkingStateBase::ProcessEphemeron(const void* key,
-                                        TraceDescriptor value_desc) {
+void MarkingStateBase::ProcessEphemeron(const void* key, const void* value,
+                                        TraceDescriptor value_desc,
+                                        Visitor& visitor) {
   // Filter out already marked keys. The write barrier for WeakMember
   // ensures that any newly set value after this point is kept alive and does
   // not require the callback.
   if (HeapObjectHeader::FromPayload(key).IsMarked<AccessMode::kAtomic>()) {
-    MarkAndPush(value_desc.base_object_payload, value_desc);
+    if (value_desc.base_object_payload) {
+      MarkAndPush(value_desc.base_object_payload, value_desc);
+    } else {
+      // If value_desc.base_object_payload is nullptr, the value is not GCed and
+      // should be immediately traced.
+      value_desc.callback(&visitor, value);
+    }
     return;
   }
-  discovered_ephemeron_pairs_worklist_.Push({key, value_desc});
+  discovered_ephemeron_pairs_worklist_.Push({key, value, value_desc});
 }
 
 void MarkingStateBase::AccountMarkedBytes(const HeapObjectHeader& header) {

src/heap/cppgc/marking-visitor.cc

@@ -25,9 +25,9 @@ void MarkingVisitorBase::VisitWeak(const void* object, TraceDescriptor desc,
                                                weak_member);
 }
 
-void MarkingVisitorBase::VisitEphemeron(const void* key,
+void MarkingVisitorBase::VisitEphemeron(const void* key, const void* value,
                                         TraceDescriptor value_desc) {
-  marking_state_.ProcessEphemeron(key, value_desc);
+  marking_state_.ProcessEphemeron(key, value, value_desc, *this);
 }
 
 void MarkingVisitorBase::VisitWeakContainer(const void* object,

src/heap/cppgc/marking-visitor.h

@@ -28,7 +28,7 @@ class V8_EXPORT_PRIVATE MarkingVisitorBase : public VisitorBase {
  protected:
   void Visit(const void*, TraceDescriptor) final;
   void VisitWeak(const void*, TraceDescriptor, WeakCallback, const void*) final;
-  void VisitEphemeron(const void*, TraceDescriptor) final;
+  void VisitEphemeron(const void*, const void*, TraceDescriptor) final;
   void VisitWeakContainer(const void* self, TraceDescriptor strong_desc,
                           TraceDescriptor weak_desc, WeakCallback callback,
                           const void* data) final;

src/heap/cppgc/marking-worklists.h

@@ -63,6 +63,7 @@ class MarkingWorklists {
 
   struct EphemeronPairItem {
     const void* key;
+    const void* value;
     TraceDescriptor value_desc;
   };