Normative: When an object dies, all references die at once

This patch rephrases that logic path into an imperative algorithm,
which is described to behave atomically. The PR attempts to resolve
the issue documented in
#121 (comment)
Related issue: #105

spec/abstract-jobs.html

@@ -130,25 +130,19 @@ <h1>Liveness</h1>
     <emu-clause id="sec-weakref-execution">
       <h1>Execution</h1>
 
-      <p>
-        At any time, an ECMAScript implementation may perform any of the three
-        following actions. They may be triggered interspersed with ECMAScript
-        code execution, or, e.g., from a separate parallel thread.
-      </p>
-
-      <ul>
-        <li>
-          If an object is not live, then the implementation may replace any
-          reference to the object from the [[Target]] field of a
-          FinalizationGroup's [[Cells]] List, or the [[Target]] internal slot
-          of a WeakRef, to the value ~empty~.
-        </li>
-        <li>
-          When there is a FinalizationGroup _fg_ such that
-          CheckForEmptyCells(_fg_) is *true*, the implementation may perform
-          HostCleanupFinalizationGroup(_fg_).
-        </li>
-      </ul>
+        At any time, if an object _obj_ is not live, an ECMAScript implementation may perform the following steps atomically:
+
+      <emu-alg>
+        1. For each WeakRef _ref_ such that _ref_.[[Target]] is _obj_,
+          1. Set _ref_.[[Target]] to ~empty~.
+        1. For each FinalizationGroup _fg_ such that _fg_.[[Cells]] contains _cell_, such that _cell_.[[Target]] is _obj_,
+          1. Set _cell_.[[Target]] to ~empty~.
+          1. Optionally, perform ! HostCleanupFinalizationGroup(_fg_).
+        1. For each WeakMap _map_ such that _map_.[[WeakMapData]] contains a record _r_ such that _r_.[[Key]] is _obj_,
+          1. Remove _r_ from _map_.[[WeakMapData]].
+        1. For each WeakSet _set_ such that _set_.[[WeakSetData]] contains _obj_,
+          1. Remove _obj_ from _set_.[[WeakSetData]].
+      </emu-alg>
     </emu-clause>
 
     <emu-clause id="sec-weakref-host-hooks">

spec/weak-ref.html

@@ -158,11 +158,11 @@ <h1>Modifications to collection type definitions</h1>
 
   <emu-clause id="sec-weakmap">
     <h1>WeakMap Objects</h1>
-    <p>WeakMap objects are collections of key/value pairs where the keys are objects and values may be arbitrary ECMAScript language values. A WeakMap may be queried to see if it contains a key/value pair with a specific key, but no mechanism is provided for enumerating the objects it holds as keys. <ins>There is no way for ECMAScript programs to observe the presence of a key in a WeakMap without a reference to that key. This implies that, if an object is not live, and it is present as a WeakMap key, then the implementation may unobservably remove the key-value pair from the WeakMap.</ins> <del>If an object that is being used as the key of a WeakMap key/value pair is only reachable by following a chain of references that start within that WeakMap, then that key/value pair is inaccessible and is automatically removed from the WeakMap. WeakMap implementations must detect and remove such key/value pairs and any associated resources.</del></p>
+    <p>WeakMap objects are collections of key/value pairs where the keys are objects and values may be arbitrary ECMAScript language values. A WeakMap may be queried to see if it contains a key/value pair with a specific key, but no mechanism is provided for enumerating the objects it holds as keys. <ins>In certain conditions, objects which are not live are removed as WeakMap keys, as described in <emu-xref href="#sec-weakref-execution"></emu-xref>.</ins> <del>If an object that is being used as the key of a WeakMap key/value pair is only reachable by following a chain of references that start within that WeakMap, then that key/value pair is inaccessible and is automatically removed from the WeakMap. WeakMap implementations must detect and remove such key/value pairs and any associated resources.</del></p>
   </emu-clause>
 
   <emu-clause id="sec-weakset">
     <h1>WeakSet Objects</h1>
-    <p>WeakSet objects are collections of objects. A distinct object may only occur once as an element of a WeakSet's collection. A WeakSet may be queried to see if it contains a specific object, but no mechanism is provided for enumerating the objects it holds. <ins>There is no way for ECMAScript programs to observe the presence of an object held in a WeakSet without a reference to that object. This implies that, if an object is not live, and it is held in a WeakSet, then the implementation may unobservably remove the object from the WeakSet.</ins> <del>If an object that is contained by a WeakSet is only reachable by following a chain of references that start within that WeakSet, then that object is inaccessible and is automatically removed from the WeakSet. WeakSet implementations must detect and remove such objects and any associated resources.</del></p>
+    <p>WeakSet objects are collections of objects. A distinct object may only occur once as an element of a WeakSet's collection. A WeakSet may be queried to see if it contains a specific object, but no mechanism is provided for enumerating the objects it holds. <ins>In certain conditions, objects which are not live are removed as WeakSet elements, as described in <emu-xref href="#sec-weakref-execution"></emu-xref>.</ins> <del>If an object that is contained by a WeakSet is only reachable by following a chain of references that start within that WeakSet, then that object is inaccessible and is automatically removed from the WeakSet. WeakSet implementations must detect and remove such objects and any associated resources.</del></p>
   </emu-clause>
 </emu-clause>