To be consistent with TraceWeakEdge this should use |true| for null edges.

These functions have been changed recently to split TraceWeakEdge and TraceOrClearWeakEdge. I think that this one should have 'OrClear' in the name since you are expecting it to clear the dead edge.

super nit: you could static_cast this to gc::Cell* and you wouldn't need to reinterpret_cast below.

How often does this happen? TraceManuallyBarrieredWeakEdge doesn't clear the edge any more. This will need an 'OrClear' version.

It primarily comes from CacheIRCompiler::emitGuardHasGetterSetter(), but can also come from CacheIRCompiler::emitCheckWeakValueResultForFixedSlot() and emitCheckWeakValueResultForDynamicSlot().

IonCacheIRCompiler::emitUncheckedLoadWeakObjectResult() (as patched by D308631) also could create weak Value relocations, but it doesn't seem to be used.

Do you know what this does for weak pointers to GC cells that are dead? Do weak Shape* pointers in JIT code become nullptr? I think the safest option would be to use this only for Ion IC stubs, similar to the Baseline stubs, and not for the transpiler.

Nit: weakDataRelocations_.length()

This is very similar to TraceDataRelocations, except for the Trace*Edge call. I think it would be simpler to add a bool weak argument and then call the strong vs weak Trace*Edge based on that. The extra branch is fine and predictable for the CPU.

When a weak relocation gets cleared, nothing invalidates, unlinks or discards the JitCode. TraceDataRelocations returns void, and traceWeakChildren / IonIC::traceWeak / IonScript::traceWeak / BaselineScript::traceWeak ignore the outcome. The code stays live and keeps running with nullptr baked in (or UndefinedValue() for punboxed Values). A guard that compares a Value operand against the cleared immediate now matches undefined, which is a wrong-behaviour bug. Make the trace routines report whether anything was cleared, and use that to unlink the IC stub or invalidate the Ion/Baseline script.

assertNoGCThings() checks weakDataRelocations_ only on x86/x64. Add MOZ_ASSERT(weakDataRelocations_.length() == 0) to assertNoGCThings() on ARM, ARM64, MIPS, LoongArch64 and RISC-V64 too. Otherwise a weak GC pointer emitted into code that must not contain GC things goes unnoticed on those platforms.

Several new lines break the clang-format style. Examples: static_cast<gc::Cell *> / reinterpret_cast<gc::Cell **> (the existing code used gc::Cell*), if (weak){ in Assembler-arm.cpp, the leading || in Assembler-arm64.h's oom(), and many signatures and bytesNeeded() bodies longer than 80 columns. Run ./mach clang-format on the patch.

On nunbox32 (x86 and ARM), only the payload is recorded as a weak relocation. The tag is emitted as a plain Imm32. Clearing the weak edge zeroes the payload but keeps the GC-thing tag (e.g. JSVAL_TAG_OBJECT), so the generated code builds an object/string Value with a null payload, which is invalid. On punbox64 the same clear gives UndefinedValue(), so the platforms also disagree. Fix this so a cleared weak Value turns into a consistent, valid Value on every platform, or forbid weak moveValue on nunbox until the code is guaranteed to be discarded. The same applies to MacroAssembler-arm.cpp.