1 files changed, 537 insertions, 0 deletions
diff --git a/js/src/vm/Compartment.h b/js/src/vm/Compartment.h
new file mode 100644
index 0000000000..6cea7a7c3d
--- /dev/null
+++ b/js/src/vm/Compartment.h
@@ -0,0 +1,537 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * vim: set ts=8 sts=2 et sw=2 tw=80:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef vm_Compartment_h
+#define vm_Compartment_h
+
+#include "mozilla/Maybe.h"
+#include "mozilla/MemoryReporting.h"
+
+#include <stddef.h>
+#include <utility>
+
+#include "gc/NurseryAwareHashMap.h"
+#include "gc/ZoneAllocator.h"
+#include "vm/Iteration.h"
+#include "vm/JSObject.h"
+#include "vm/JSScript.h"
+
+namespace js {
+
+JSString* CopyStringPure(JSContext* cx, JSString* str);
+
+// The data structure use to storing JSObject CCWs for a given source
+// compartment. These are partitioned by target compartment so that we can
+// easily select wrappers by source and target compartment. String CCWs are
+// stored in a per-zone separate map.
+class ObjectWrapperMap {
+  static const size_t InitialInnerMapSize = 4;
+
+  using InnerMap = NurseryAwareHashMap<JSObject*, JSObject*, ZoneAllocPolicy>;
+  using OuterMap = GCHashMap<JS::Compartment*, InnerMap,
+                             DefaultHasher<JS::Compartment*>, ZoneAllocPolicy>;
+
+  OuterMap map;
+  Zone* zone;
+
+ public:
+  class Enum {
+    Enum(const Enum&) = delete;
+    void operator=(const Enum&) = delete;
+
+    void goToNext() {
+      if (outer.isNothing()) {
+        return;
+      }
+      for (; !outer->empty(); outer->popFront()) {
+        JS::Compartment* c = outer->front().key();
+        MOZ_ASSERT(c);
+        if (filter && !filter->match(c)) {
+          continue;
+        }
+        InnerMap& m = outer->front().value();
+        if (!m.empty()) {
+          if (inner.isSome()) {
+            inner.reset();
+          }
+          inner.emplace(m);
+          outer->popFront();
+          return;
+        }
+      }
+    }
+
+    mozilla::Maybe<OuterMap::Enum> outer;
+    mozilla::Maybe<InnerMap::Enum> inner;
+    const CompartmentFilter* filter;
+
+   public:
+    explicit Enum(ObjectWrapperMap& m) : filter(nullptr) {
+      outer.emplace(m.map);
+      goToNext();
+    }
+
+    Enum(ObjectWrapperMap& m, const CompartmentFilter& f) : filter(&f) {
+      outer.emplace(m.map);
+      goToNext();
+    }
+
+    Enum(ObjectWrapperMap& m, JS::Compartment* target) {
+      // Leave the outer map as nothing and only iterate the inner map we
+      // find here.
+      auto p = m.map.lookup(target);
+      if (p) {
+        inner.emplace(p->value());
+      }
+    }
+
+    bool empty() const {
+      return (outer.isNothing() || outer->empty()) &&
+             (inner.isNothing() || inner->empty());
+    }
+
+    InnerMap::Entry& front() const {
+      MOZ_ASSERT(inner.isSome() && !inner->empty());
+      return inner->front();
+    }
+
+    void popFront() {
+      MOZ_ASSERT(!empty());
+      if (!inner->empty()) {
+        inner->popFront();
+        if (!inner->empty()) {
+          return;
+        }
+      }
+      goToNext();
+    }
+
+    void removeFront() {
+      MOZ_ASSERT(inner.isSome());
+      inner->removeFront();
+    }
+  };
+
+  class Ptr : public InnerMap::Ptr {
+    friend class ObjectWrapperMap;
+
+    InnerMap* map;
+
+    Ptr() : map(nullptr) {}
+    Ptr(const InnerMap::Ptr& p, InnerMap& m) : InnerMap::Ptr(p), map(&m) {}
+  };
+
+  // Iterator over compartments that the ObjectWrapperMap has wrappers for.
+  class WrappedCompartmentEnum {
+    OuterMap::Enum iter;
+
+    void settle() {
+      // It's possible for InnerMap to be empty after wrappers have been
+      // removed, e.g. by being nuked.
+      while (!iter.empty() && iter.front().value().empty()) {
+        iter.popFront();
+      }
+    }
+
+   public:
+    explicit WrappedCompartmentEnum(ObjectWrapperMap& map) : iter(map.map) {
+      settle();
+    }
+    bool empty() const { return iter.empty(); }
+    JS::Compartment* front() const { return iter.front().key(); }
+    operator JS::Compartment*() const { return front(); }
+    void popFront() {
+      iter.popFront();
+      settle();
+    }
+  };
+
+  explicit ObjectWrapperMap(Zone* zone) : map(zone), zone(zone) {}
+  ObjectWrapperMap(Zone* zone, size_t aLen) : map(zone, aLen), zone(zone) {}
+
+  bool empty() {
+    if (map.empty()) {
+      return true;
+    }
+    for (OuterMap::Enum e(map); !e.empty(); e.popFront()) {
+      if (!e.front().value().empty()) {
+        return false;
+      }
+    }
+    return true;
+  }
+
+  Ptr lookup(JSObject* obj) const {
+    auto op = map.lookup(obj->compartment());
+    if (op) {
+      auto ip = op->value().lookup(obj);
+      if (ip) {
+        return Ptr(ip, op->value());
+      }
+    }
+    return Ptr();
+  }
+
+  void remove(Ptr p) {
+    if (p) {
+      p.map->remove(p);
+    }
+  }
+
+  [[nodiscard]] bool put(JSObject* key, JSObject* value) {
+    JS::Compartment* comp = key->compartment();
+    auto ptr = map.lookupForAdd(comp);
+    if (!ptr) {
+      InnerMap m(zone, InitialInnerMapSize);
+      if (!map.add(ptr, comp, std::move(m))) {
+        return false;
+      }
+    }
+    return ptr->value().put(key, value);
+  }
+
+  size_t sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf) {
+    size_t size = map.shallowSizeOfExcludingThis(mallocSizeOf);
+    for (OuterMap::Enum e(map); !e.empty(); e.popFront()) {
+      size += e.front().value().sizeOfExcludingThis(mallocSizeOf);
+    }
+    return size;
+  }
+  size_t sizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) {
+    size_t size = map.shallowSizeOfIncludingThis(mallocSizeOf);
+    for (OuterMap::Enum e(map); !e.empty(); e.popFront()) {
+      size += e.front().value().sizeOfIncludingThis(mallocSizeOf);
+    }
+    return size;
+  }
+
+  bool hasNurseryAllocatedWrapperEntries(const CompartmentFilter& f) {
+    for (OuterMap::Enum e(map); !e.empty(); e.popFront()) {
+      JS::Compartment* c = e.front().key();
+      if (c && !f.match(c)) {
+        continue;
+      }
+      InnerMap& m = e.front().value();
+      if (m.hasNurseryEntries()) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  void sweepAfterMinorGC(JSTracer* trc) {
+    for (OuterMap::Enum e(map); !e.empty(); e.popFront()) {
+      InnerMap& m = e.front().value();
+      m.sweepAfterMinorGC(trc);
+      if (m.empty()) {
+        e.removeFront();
+      }
+    }
+  }
+
+  void traceWeak(JSTracer* trc) {
+    for (OuterMap::Enum e(map); !e.empty(); e.popFront()) {
+      InnerMap& m = e.front().value();
+      m.traceWeak(trc);
+      if (m.empty()) {
+        e.removeFront();
+      }
+    }
+  }
+};
+
+using StringWrapperMap =
+    NurseryAwareHashMap<JSString*, JSString*, ZoneAllocPolicy,
+                        DuplicatesPossible>;
+
+}  // namespace js
+
+class JS::Compartment {
+  JS::Zone* zone_;
+  JSRuntime* runtime_;
+  bool invisibleToDebugger_;
+
+  js::ObjectWrapperMap crossCompartmentObjectWrappers;
+
+  using RealmVector = js::Vector<JS::Realm*, 1, js::ZoneAllocPolicy>;
+  RealmVector realms_;
+
+ public:
+  /*
+   * During GC, stores the head of a list of incoming pointers from gray cells.
+   *
+   * The objects in the list are either cross-compartment wrappers, or
+   * debugger wrapper objects.  The list link is either in the second extra
+   * slot for the former, or a special slot for the latter.
+   */
+  JSObject* gcIncomingGrayPointers = nullptr;
+
+  void* data = nullptr;
+
+  // Fields set and used by the GC. Be careful, may be stale after we return
+  // to the mutator.
+  struct {
+    // These flags help us to discover if a compartment that shouldn't be
+    // alive manages to outlive a GC. Note that these flags have to be on
+    // the compartment, not the realm, because same-compartment realms can
+    // have cross-realm pointers without wrappers.
+    bool scheduledForDestruction = false;
+    bool hasMarkedCells = false;
+    bool maybeAlive = true;
+
+    // During GC, we may set this to |true| if we entered a realm in this
+    // compartment. Note that (without a stack walk) we don't know exactly
+    // *which* realms, because Realm::enterRealmDepthIgnoringJit_ does not
+    // account for cross-Realm calls in JIT code updating cx->realm_. See
+    // also the enterRealmDepthIgnoringJit_ comment.
+    bool hasEnteredRealm = false;
+  } gcState;
+
+  // True if all outgoing wrappers have been nuked. This happens when all realms
+  // have been nuked and NukeCrossCompartmentWrappers is called with the
+  // NukeAllReferences option. This prevents us from creating new wrappers for
+  // the compartment.
+  bool nukedOutgoingWrappers = false;
+
+  JS::Zone* zone() { return zone_; }
+  const JS::Zone* zone() const { return zone_; }
+
+  JSRuntime* runtimeFromMainThread() const {
+    MOZ_ASSERT(js::CurrentThreadCanAccessRuntime(runtime_));
+    return runtime_;
+  }
+
+  // Note: Unrestricted access to the zone's runtime from an arbitrary
+  // thread can easily lead to races. Use this method very carefully.
+  JSRuntime* runtimeFromAnyThread() const { return runtime_; }
+
+  // Certain compartments are implementation details of the embedding, and
+  // references to them should never leak out to script. For realms belonging to
+  // this compartment, onNewGlobalObject does not fire, and addDebuggee is a
+  // no-op.
+  bool invisibleToDebugger() const { return invisibleToDebugger_; }
+
+  RealmVector& realms() { return realms_; }
+
+  // Cross-compartment wrappers are shared by all realms in the compartment, but
+  // they still have a per-realm ObjectGroup etc. To prevent us from having
+  // multiple realms, each with some cross-compartment wrappers potentially
+  // keeping the realm alive longer than necessary, we always allocate CCWs in
+  // the first realm.
+  js::GlobalObject& firstGlobal() const;
+  js::GlobalObject& globalForNewCCW() const { return firstGlobal(); }
+
+  void assertNoCrossCompartmentWrappers() {
+    MOZ_ASSERT(crossCompartmentObjectWrappers.empty());
+  }
+
+  void addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf,
+                              size_t* compartmentObjects,
+                              size_t* crossCompartmentWrappersTables,
+                              size_t* compartmentsPrivateData);
+
+#ifdef JSGC_HASH_TABLE_CHECKS
+  void checkObjectWrappersAfterMovingGC();
+#endif
+
+ private:
+  bool getNonWrapperObjectForCurrentCompartment(JSContext* cx,
+                                                js::HandleObject origObj,
+                                                js::MutableHandleObject obj);
+  bool getOrCreateWrapper(JSContext* cx, js::HandleObject existing,
+                          js::MutableHandleObject obj);
+
+ public:
+  explicit Compartment(JS::Zone* zone, bool invisibleToDebugger);
+
+  void destroy(JS::GCContext* gcx);
+
+  [[nodiscard]] inline bool wrap(JSContext* cx, JS::MutableHandleValue vp);
+
+  [[nodiscard]] inline bool wrap(JSContext* cx,
+                                 MutableHandle<mozilla::Maybe<Value>> vp);
+
+  [[nodiscard]] bool wrap(JSContext* cx, js::MutableHandleString strp);
+  [[nodiscard]] bool wrap(JSContext* cx, js::MutableHandle<JS::BigInt*> bi);
+  [[nodiscard]] bool wrap(JSContext* cx, JS::MutableHandleObject obj);
+  [[nodiscard]] bool wrap(JSContext* cx,
+                          JS::MutableHandle<JS::PropertyDescriptor> desc);
+  [[nodiscard]] bool wrap(
+      JSContext* cx,
+      JS::MutableHandle<mozilla::Maybe<JS::PropertyDescriptor>> desc);
+  [[nodiscard]] bool wrap(JSContext* cx,
+                          JS::MutableHandle<JS::GCVector<JS::Value>> vec);
+#ifdef ENABLE_RECORD_TUPLE
+  [[nodiscard]] bool wrapExtendedPrimitive(JSContext* cx,
+                                           JS::MutableHandleObject obj);
+#endif
+  [[nodiscard]] bool rewrap(JSContext* cx, JS::MutableHandleObject obj,
+                            JS::HandleObject existing);
+
+  [[nodiscard]] bool putWrapper(JSContext* cx, JSObject* wrapped,
+                                JSObject* wrapper);
+
+  [[nodiscard]] bool putWrapper(JSContext* cx, JSString* wrapped,
+                                JSString* wrapper);
+
+  js::ObjectWrapperMap::Ptr lookupWrapper(JSObject* obj) const {
+    return crossCompartmentObjectWrappers.lookup(obj);
+  }
+
+  inline js::StringWrapperMap::Ptr lookupWrapper(JSString* str) const;
+
+  void removeWrapper(js::ObjectWrapperMap::Ptr p);
+
+  bool hasNurseryAllocatedObjectWrapperEntries(const js::CompartmentFilter& f) {
+    return crossCompartmentObjectWrappers.hasNurseryAllocatedWrapperEntries(f);
+  }
+
+  // Iterator over |wrapped -> wrapper| entries for object CCWs in a given
+  // compartment. Can be optionally restricted by target compartment.
+  struct ObjectWrapperEnum : public js::ObjectWrapperMap::Enum {
+    explicit ObjectWrapperEnum(Compartment* c)
+        : js::ObjectWrapperMap::Enum(c->crossCompartmentObjectWrappers) {}
+    explicit ObjectWrapperEnum(Compartment* c, const js::CompartmentFilter& f)
+        : js::ObjectWrapperMap::Enum(c->crossCompartmentObjectWrappers, f) {}
+    explicit ObjectWrapperEnum(Compartment* c, Compartment* target)
+        : js::ObjectWrapperMap::Enum(c->crossCompartmentObjectWrappers,
+                                     target) {
+      MOZ_ASSERT(target);
+    }
+  };
+
+  // Iterator over compartments that this compartment has CCWs for.
+  struct WrappedObjectCompartmentEnum
+      : public js::ObjectWrapperMap::WrappedCompartmentEnum {
+    explicit WrappedObjectCompartmentEnum(Compartment* c)
+        : js::ObjectWrapperMap::WrappedCompartmentEnum(
+              c->crossCompartmentObjectWrappers) {}
+  };
+
+  /*
+   * These methods mark pointers that cross compartment boundaries. They are
+   * called in per-zone GCs to prevent the wrappers' outgoing edges from
+   * dangling (full GCs naturally follow pointers across compartments) and
+   * when compacting to update cross-compartment pointers.
+   */
+  enum EdgeSelector { AllEdges, NonGrayEdges, GrayEdges };
+  void traceWrapperTargetsInCollectedZones(JSTracer* trc,
+                                           EdgeSelector whichEdges);
+  static void traceIncomingCrossCompartmentEdgesForZoneGC(
+      JSTracer* trc, EdgeSelector whichEdges);
+
+  void sweepRealms(JS::GCContext* gcx, bool keepAtleastOne,
+                   bool destroyingRuntime);
+  void sweepAfterMinorGC(JSTracer* trc);
+  void traceCrossCompartmentObjectWrapperEdges(JSTracer* trc);
+
+  void fixupCrossCompartmentObjectWrappersAfterMovingGC(JSTracer* trc);
+  void fixupAfterMovingGC(JSTracer* trc);
+
+  [[nodiscard]] bool findSweepGroupEdges();
+
+ private:
+  // Head node of list of active iterators that may need deleted property
+  // suppression.
+  js::NativeIteratorListHead enumerators_;
+
+ public:
+  js::NativeIteratorListHead* enumeratorsAddr() { return &enumerators_; }
+  MOZ_ALWAYS_INLINE bool objectMaybeInIteration(JSObject* obj);
+
+  void traceWeakNativeIterators(JSTracer* trc);
+};
+
+namespace js {
+
+// We only set the hasMarkedCells flag for objects and scripts. It's assumed
+// that, if a compartment is alive, then it will have at least some live object
+// or script it in. Even if we get this wrong, the worst that will happen is
+// that scheduledForDestruction will be set on the compartment, which will cause
+// some extra GC activity to try to free the compartment.
+template <typename T>
+inline void SetCompartmentHasMarkedCells(T* thing) {}
+
+template <>
+inline void SetCompartmentHasMarkedCells(JSObject* thing) {
+  thing->compartment()->gcState.hasMarkedCells = true;
+}
+
+template <>
+inline void SetCompartmentHasMarkedCells(JSScript* thing) {
+  thing->compartment()->gcState.hasMarkedCells = true;
+}
+
+/*
+ * AutoWrapperVector and AutoWrapperRooter can be used to store wrappers that
+ * are obtained from the cross-compartment map. However, these classes should
+ * not be used if the wrapper will escape. For example, it should not be stored
+ * in the heap.
+ *
+ * The AutoWrapper rooters are different from other autorooters because their
+ * wrappers are marked on every GC slice rather than just the first one. If
+ * there's some wrapper that we want to use temporarily without causing it to be
+ * marked, we can use these AutoWrapper classes. If we get unlucky and a GC
+ * slice runs during the code using the wrapper, the GC will mark the wrapper so
+ * that it doesn't get swept out from under us. Otherwise, the wrapper needn't
+ * be marked. This is useful in functions like JS_TransplantObject that
+ * manipulate wrappers in compartments that may no longer be alive.
+ */
+
+/*
+ * This class stores the data for AutoWrapperVector and AutoWrapperRooter. It
+ * should not be used in any other situations.
+ */
+struct WrapperValue {
+  /*
+   * We use unsafeGet() in the constructors to avoid invoking a read barrier
+   * on the wrapper, which may be dead (see the comment about bug 803376 in
+   * gc/GC.cpp regarding this). If there is an incremental GC while the
+   * wrapper is in use, the AutoWrapper rooter will ensure the wrapper gets
+   * marked.
+   */
+  explicit WrapperValue(const ObjectWrapperMap::Ptr& ptr)
+      : value(*ptr->value().unsafeGet()) {}
+
+  explicit WrapperValue(const ObjectWrapperMap::Enum& e)
+      : value(*e.front().value().unsafeGet()) {}
+
+  JSObject*& get() { return value; }
+  JSObject* get() const { return value; }
+  operator JSObject*() const { return value; }
+
+ private:
+  JSObject* value;
+};
+
+class MOZ_RAII AutoWrapperVector : public JS::GCVector<WrapperValue, 8>,
+                                   public JS::AutoGCRooter {
+ public:
+  explicit AutoWrapperVector(JSContext* cx)
+      : JS::GCVector<WrapperValue, 8>(cx),
+        JS::AutoGCRooter(cx, JS::AutoGCRooter::Kind::WrapperVector) {}
+
+  void trace(JSTracer* trc);
+
+ private:
+};
+
+class MOZ_RAII AutoWrapperRooter : public JS::AutoGCRooter {
+ public:
+  AutoWrapperRooter(JSContext* cx, const WrapperValue& v)
+      : JS::AutoGCRooter(cx, JS::AutoGCRooter::Kind::Wrapper), value(v) {}
+
+  operator JSObject*() const { return value; }
+
+  void trace(JSTracer* trc);
+
+ private:
+  WrapperValue value;
+};
+
+} /* namespace js */
+
+#endif /* vm_Compartment_h */