Don't allocate links on the heap. bug 410223, r+sr=brendan a=schrep

js/src/xpconnect/src/xpcmaps.cpp

@@ -653,7 +653,16 @@ XPCNativeWrapperMap::~XPCNativeWrapperMap()
 // implement WrappedNative2WrapperMap...
 
 struct JSDHashTableOps
-WrappedNative2WrapperMap::sOps = { nsnull };
+WrappedNative2WrapperMap::sOps = {
+    JS_DHashAllocTable,
+    JS_DHashFreeTable,
+    JS_DHashVoidPtrKeyStub,
+    JS_DHashMatchEntryStub,
+    CopyLink,
+    ClearLink,
+    JS_DHashFinalizeStub,
+    nsnull
+};
 
 // static
 void
@@ -662,12 +671,25 @@ WrappedNative2WrapperMap::ClearLink(JSDHashTable* table,
 {
     Entry* e = static_cast<Entry*>(entry);
     e->key = nsnull;
-    if(e->value)
-    {
-        PR_REMOVE_LINK(e->value);
-        delete e->value;
-        e->value = nsnull;
-    }
+    PR_REMOVE_LINK(&e->value);
+    memset(e, 0, sizeof(*e));
+}
+
+// static
+void
+WrappedNative2WrapperMap::CopyLink(JSDHashTable* table,
+                                   const JSDHashEntryHdr* from,
+                                   JSDHashEntryHdr* to)
+{
+    const Entry* oldEntry = static_cast<const Entry*>(from);
+    Entry* newEntry = static_cast<Entry*>(to);
+
+    newEntry->key = oldEntry->key;
+    newEntry->value = oldEntry->value;
+
+    // Now update the list.
+    newEntry->value.next->prev = &newEntry->value;
+    newEntry->value.prev->next = &newEntry->value;
 }
 
 // static
@@ -683,12 +705,6 @@ WrappedNative2WrapperMap::newMap(int size)
 
 WrappedNative2WrapperMap::WrappedNative2WrapperMap(int size)
 {
-    if(!sOps.allocTable)
-    {
-        sOps = *JS_DHashGetStubOps();
-        sOps.clearEntry = WrappedNative2WrapperMap::ClearLink;
-    }
-
     mTable = JS_NewDHashTable(&sOps, nsnull, sizeof(Entry), size);
 }
 
@@ -710,9 +726,7 @@ WrappedNative2WrapperMap::Add(WrappedNative2WrapperMap* head,
         return nsnull;
     NS_ASSERTION(!entry->key || this == head, "dangling pointer?");
     entry->key = wrappedObject;
-    Link* l = new Link;
-    if(!l)
-        return nsnull;
+    Link* l = &entry->value;
     PR_INIT_CLIST(l);
     l->obj = wrapper;
 
@@ -724,12 +738,7 @@ WrappedNative2WrapperMap::Add(WrappedNative2WrapperMap* head,
             Entry* dummy = (Entry*)
                 JS_DHashTableOperate(head->mTable, wrappedObject, JS_DHASH_ADD);
             dummy->key = wrappedObject;
-            headLink = dummy->value = new Link;
-            if(!headLink)
-            {
-                Remove(wrappedObject);
-                return nsnull;
-            }
+            headLink = &dummy->value;
             PR_INIT_CLIST(headLink);
             headLink->obj = nsnull;
         }
@@ -737,7 +746,6 @@ WrappedNative2WrapperMap::Add(WrappedNative2WrapperMap* head,
         PR_INSERT_BEFORE(l, headLink);
     }
 
-    entry->value = l;
     return wrapper;
 }
 
@@ -750,12 +758,7 @@ WrappedNative2WrapperMap::AddLink(JSObject* wrappedObject, Link* oldLink)
         return PR_FALSE;
     NS_ASSERTION(!entry->key, "Eh? What's happening?");
     entry->key = wrappedObject;
-    Link* newLink = entry->value = new Link;
-    if(!newLink)
-    {
-        Remove(wrappedObject);
-        return PR_FALSE;
-    }
+    Link* newLink = &entry->value;
 
     PR_INSERT_LINK(newLink, oldLink);
     PR_REMOVE_AND_INIT_LINK(oldLink);

js/src/xpconnect/src/xpcmaps.h

@@ -689,6 +689,8 @@ class WrappedNative2WrapperMap
     static struct JSDHashTableOps sOps;
 
     static void ClearLink(JSDHashTable* table, JSDHashEntryHdr* entry);
+    static void CopyLink(JSDHashTable* table, const JSDHashEntryHdr* from,
+                         JSDHashEntryHdr* to);
 
 public:
     struct Link : public PRCList
@@ -700,7 +702,7 @@ public:
     {
         // Note: key must be the flat JSObject for a wrapped native.
         JSObject*         key;
-        Link*             value;
+        Link              value;
     };
 
     static WrappedNative2WrapperMap* newMap(int size);
@@ -712,7 +714,7 @@ public:
             JS_DHashTableOperate(mTable, wrapper, JS_DHASH_LOOKUP);
         if(JS_DHASH_ENTRY_IS_FREE(entry))
             return nsnull;
-        return entry->value->obj;
+        return entry->value.obj;
     }
 
     // Note: If the entry already exists, then this will overwrite the
@@ -727,7 +729,7 @@ public:
         Entry* entry = (Entry*)
             JS_DHashTableOperate(mTable, wrappedObject, JS_DHASH_LOOKUP);
         if(JS_DHASH_ENTRY_IS_BUSY(entry))
-            return entry->value;
+            return &entry->value;
         return nsnull;
     }