1746699 - Reduce UB when allocating GC things

Status: RESOLVED FIXED

(Core :: JavaScript Engine, task, P1)

Description

[Steve Fink [:sfink] [:s:]]

Bug 1739321 is no longer a good home for this work.

This is about how we allocate memory from the GC heap, then cast it to the right type, and never actually construct any C++ types in that memory.

Comment 1

[Steve Fink [:sfink] [:s:]]

Attachment: Bug 1746699 - Avoid UB when allocating JSStrings and BigInts

Comment 2

[Steve Fink [:sfink] [:s:]]

Attachment: Bug 1746699 - Avoid pointing to untyped memory with TenuredChunk* pointers (reduces UB)

Comment 3

[Steve Fink [:sfink] [:s:]]

Attachment: Bug 1746699 - Change all callers of js::Allocate<T>() to properly use placement new instead of casting

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/ac7a2cfb2cd0
Avoid UB when allocating JSStrings and BigInts r=tcampbell
https://hg.mozilla.org/integration/autoland/rev/02a4670a672b
Avoid pointing to untyped memory with TenuredChunk* pointers (reduces UB) r=tcampbell
https://hg.mozilla.org/integration/autoland/rev/a423d31d54d9
Change all callers of js::Allocate<T>() to properly use placement new instead of casting r=tcampbell

Comment 5

[Cristina Cozmuta (:CrissCozmuta)]

https://hg.mozilla.org/mozilla-central/rev/ac7a2cfb2cd0
https://hg.mozilla.org/mozilla-central/rev/02a4670a672b
https://hg.mozilla.org/mozilla-central/rev/a423d31d54d9