fix(liveslots): retain WeakRefs to voAware collections

A lingering source of GC sensitivity is when a FinalizationRegistry is
watching an object that userspace might drop, and that FR callback
might perform syscalls, or simply consume more computrons when GC
happens than when it does not. While we expect all instances of a
consensus kernel to perform GC at the same time, any tolerance we can
maintain against divergent GC schedules will help us with
upgrade (replaying a transcript with a slightly different version of
XS).

To help this, in XS, WeakRefs are treated as strong references during
"organic" GC, and are only actually weak during the forced GC we do
inside bringOutYourDead. We'd like this improvement for objects
tracked by FinalizationRegistries too. Liveslots has two FRs,
`vreffedObjectRegistry` (whose entries all have WeakRefs in slotToVal,
so they're covered), and `droppedCollectionRegistry` (in the VRM).

The VRM's `droppedCollectionRegistry` tracks the VO-aware replacements
for WeakMap/Set that we impose on userspace, and these do not have
vref identities, so they will never appear in slotToVal or valToSlot,
so we need to create new WeakRefs to trigger the organic-GC-retention
behavior.

These WeakRefs are stored in the FR's "context"/heldValue data, which
will be passed to the callback when the VO-aware collection is
dropped, collected, and finalized. The WeakRef will be kept alive
through that entry until the finalizer runs.

The net result is that userspace dropping their VO-aware collection
objects should not result in the FinalizationRegistry callback running
until a bringOutYourDead delivery, which happens on a fixed
(within-consensus) schedule.

closes #7371

packages/swingset-liveslots/src/virtualReferences.js

@@ -39,9 +39,16 @@ export function makeVirtualReferenceManager(
   const droppedCollectionRegistry = new FinalizationRegistry(
     finalizeDroppedCollection,
   );
+  // Our JS engine is configured to treat WeakRefs as strong during
+  // organic (non-forced GC), to minimize execution variation. To
+  // prevent FinalizationRegistry callbacks from varying this way, we
+  // must maintain WeakRefs to everything therein. The WeakRef is
+  // retained by the FR "heldValue" context record, next to the
+  // descriptor, and is thus released when the FR fires.
 
   function registerDroppedCollection(target, descriptor) {
-    droppedCollectionRegistry.register(target, descriptor);
+    const wr = new WeakRef(target);
+    droppedCollectionRegistry.register(target, { descriptor, wr });
   }
 
   /**
@@ -643,7 +650,13 @@ export function makeVirtualReferenceManager(
     }
   }
 
-  function finalizeDroppedCollection(descriptor) {
+  function finalizeDroppedCollection({ descriptor }) {
+    // the 'wr' WeakRef will be dropped about now
+    //
+    // note: technically, the engine is allowed to inspect this
+    // callback, observe that 'wr' is not extracted, and then not
+    // retain it in the first place (back in
+    // registerDroppedCollection), but no engine goes that far
     descriptor.collectionDeleter(descriptor);
   }
 
@@ -673,6 +686,8 @@ export function makeVirtualReferenceManager(
     getReachableRefCount,
     countCollectionsForWeakKey,
 
+    // don't harden() the mock FR, that will break it
+    getDroppedCollectionRegistry: () => droppedCollectionRegistry,
     remotableRefCounts,
     vrefRecognizers,
     kindInfoTable,

packages/swingset-liveslots/test/test-dropped-collection-weakrefs.js

@@ -0,0 +1,61 @@
+import test from 'ava';
+import '@endo/init/debug.js';
+import { Far } from '@endo/marshal';
+import { makeLiveSlots } from '../src/liveslots.js';
+import { kser } from './kmarshal.js';
+import { buildSyscall } from './liveslots-helpers.js';
+import { makeStartVat } from './util.js';
+import { makeMockGC } from './mock-gc.js';
+
+test('droppedCollectionWeakRefs', async t => {
+  const { syscall } = buildSyscall();
+  const gcTools = makeMockGC();
+  let myVOAwareWeakMap;
+  let myVOAwareWeakSet;
+
+  // In XS, WeakRefs are treated as strong references except for
+  // forced GC, which reduces our sensitivity to GC timing (which is
+  // more likely to change under small upgrades of the engine). We'd
+  // like this improvement for objects tracked by
+  // FinalizationRegistries too. Liveslots has two FRs,
+  // `vreffedObjectRegistry` (whose entries all have WeakRefs in
+  // slotToVal), and `droppedCollectionRegistry` (in the VRM).
+  //
+  // `droppedCollectionRegistry` tracks the VO-aware replacements for
+  // WeakMap/Set that we impose on userspace, and these do not have
+  // vref identities, so they will never appear in slotToVal or
+  // valToSlot, so we need to create new WeakRefs to trigger the
+  // retain-under-organic-GC behavior. Those WeakRefs are held in the
+  // FR context/"heldValue" until it fires.
+
+  function buildRootObject(vatPowers) {
+    const { WeakMap, WeakSet } = vatPowers;
+    // creating a WeakMap/Set should put it in droppedCollectionWeakRefs
+    myVOAwareWeakMap = new WeakMap();
+    myVOAwareWeakSet = new WeakSet();
+    return Far('root', {});
+  }
+
+  const makeNS = () => ({ buildRootObject });
+  const ls = makeLiveSlots(syscall, 'vatA', {}, {}, gcTools, undefined, makeNS);
+  const { dispatch, testHooks } = ls;
+  await dispatch(makeStartVat(kser()));
+
+  const wmWeakRef = gcTools.weakRefFor(myVOAwareWeakMap);
+  const wsWeakRef = gcTools.weakRefFor(myVOAwareWeakSet);
+
+  // we snoop inside our mock FinalizationRegistry to get the context
+  const fr = testHooks.getDroppedCollectionRegistry();
+  t.is(fr.registry.get(myVOAwareWeakMap).wr, wmWeakRef);
+  t.is(fr.registry.get(myVOAwareWeakSet).wr, wsWeakRef);
+
+  gcTools.kill(myVOAwareWeakMap);
+  gcTools.flushAllFRs();
+  t.falsy(fr.registry.has(myVOAwareWeakMap));
+  t.truthy(fr.registry.has(myVOAwareWeakSet)); // not dead yet
+
+  gcTools.kill(myVOAwareWeakSet);
+  gcTools.flushAllFRs();
+  t.falsy(fr.registry.has(myVOAwareWeakMap));
+  t.falsy(fr.registry.has(myVOAwareWeakSet)); // dead now
+});