Bug 1515419 - fixing ToNewCString (and ToNewUnicode as well) xpcom/string/nsReadableUtils.cpp r=froydnj,necko-reviewers,valentin

Differential Revision: https://phabricator.services.mozilla.com/D17411

devtools/shared/heapsnapshot/HeapSnapshot.cpp

@@ -1535,7 +1535,7 @@ already_AddRefed<HeapSnapshot> ChromeUtils::ReadHeapSnapshot(
     GlobalObject& global, const nsAString& filePath, ErrorResult& rv) {
   auto start = TimeStamp::Now();
 
-  UniquePtr<char[]> path(ToNewCString(filePath));
+  UniquePtr<char[]> path(ToNewCString(filePath, mozilla::fallible));
   if (!path) {
     rv.Throw(NS_ERROR_OUT_OF_MEMORY);
     return nullptr;

docshell/base/nsDocShell.cpp

@@ -9957,7 +9957,7 @@ nsresult nsDocShell::ScrollToAnchor(bool aCurHasRef, bool aNewHasRef,
     }
 
     if (NS_FAILED(rv)) {
-      char* str = ToNewCString(aNewHash);
+      char* str = ToNewCString(aNewHash, mozilla::fallible);
       if (!str) {
         return NS_ERROR_OUT_OF_MEMORY;
       }

dom/jsurl/nsJSProtocolHandler.cpp

@@ -324,7 +324,7 @@ nsresult nsJSThunk::EvaluateScript(
       // For compatibility, if the result is ISO-8859-1, we use
       // windows-1252, so that people can compatibly create images
       // using javascript: URLs.
-      bytes = ToNewCString(result);
+      bytes = ToNewCString(result, mozilla::fallible);
       bytesLen = result.Length();
       charset = &isoCharset;
     } else {

js/xpconnect/loader/mozJSComponentLoader.cpp

@@ -931,7 +931,7 @@ nsresult mozJSComponentLoader::ObjectForLocation(
   }
 
   /* Freed when we remove from the table. */
-  *aLocation = ToNewCString(nativePath);
+  *aLocation = ToNewCString(nativePath, mozilla::fallible);
   if (!*aLocation) {
     aObject.set(nullptr);
     aTableScript.set(nullptr);

layout/style/nsROCSSPrimitiveValue.cpp

@@ -152,7 +152,7 @@ void nsROCSSPrimitiveValue::SetAppUnits(float aValue) {
 
 void nsROCSSPrimitiveValue::SetString(const nsACString& aString) {
   Reset();
-  mValue.mString = ToNewUnicode(aString);
+  mValue.mString = ToNewUnicode(aString, mozilla::fallible);
   if (mValue.mString) {
     mType = CSS_STRING;
   } else {
@@ -163,7 +163,7 @@ void nsROCSSPrimitiveValue::SetString(const nsACString& aString) {
 
 void nsROCSSPrimitiveValue::SetString(const nsAString& aString) {
   Reset();
-  mValue.mString = ToNewUnicode(aString);
+  mValue.mString = ToNewUnicode(aString, mozilla::fallible);
   if (mValue.mString) {
     mType = CSS_STRING;
   } else {

netwerk/base/nsNetUtil.cpp

@@ -586,7 +586,7 @@ nsresult NS_MakeAbsoluteURI(char** result, const char* spec, nsIURI* baseURI) {
   nsAutoCString resultBuf;
   rv = NS_MakeAbsoluteURI(resultBuf, nsDependentCString(spec), baseURI);
   if (NS_SUCCEEDED(rv)) {
-    *result = ToNewCString(resultBuf);
+    *result = ToNewCString(resultBuf, mozilla::fallible);
     if (!*result) rv = NS_ERROR_OUT_OF_MEMORY;
   }
   return rv;

netwerk/base/nsProtocolProxyService.cpp

@@ -1935,7 +1935,7 @@ void nsProtocolProxyService::LoadHostFilters(const nsACString& aFilters) {
       hinfo->name.host_len = host.Length();
 
       hinfo->is_ipaddr = false;
-      hinfo->name.host = ToNewCString(host);
+      hinfo->name.host = ToNewCString(host, mozilla::fallible);
 
       if (!hinfo->name.host) goto loser;
     }

netwerk/mime/nsMIMEHeaderParamImpl.cpp

@@ -532,7 +532,7 @@ nsresult nsMIMEHeaderParamImpl::DoParameterInternal(
       //     line continuation -- jht 4/29/98
       nsAutoCString tempStr(valueStart, valueEnd - valueStart);
       tempStr.StripCRLF();
-      char* res = ToNewCString(tempStr);
+      char* res = ToNewCString(tempStr, mozilla::fallible);
       NS_ENSURE_TRUE(res, NS_ERROR_OUT_OF_MEMORY);
 
       if (isQuotedString) RemoveQuotedStringEscapes(res);

netwerk/protocol/ftp/nsFtpProtocolHandler.cpp

@@ -249,7 +249,7 @@ nsresult nsFtpProtocolHandler::InsertConnection(nsIURI* aKey,
     return rv;
   }
 
-  ts->key = ToNewCString(spec);
+  ts->key = ToNewCString(spec, mozilla::fallible);
   if (!ts->key) {
     delete ts;
     return NS_ERROR_OUT_OF_MEMORY;

netwerk/streamconv/converters/nsDirIndexParser.cpp

@@ -64,7 +64,7 @@ nsDirIndexParser::GetListener(nsIDirIndexListener** aListener) {
 
 NS_IMETHODIMP
 nsDirIndexParser::GetComment(char** aComment) {
-  *aComment = ToNewCString(mComment);
+  *aComment = ToNewCString(mComment, mozilla::fallible);
 
   if (!*aComment) return NS_ERROR_OUT_OF_MEMORY;
 
@@ -79,7 +79,7 @@ nsDirIndexParser::SetEncoding(const char* aEncoding) {
 
 NS_IMETHODIMP
 nsDirIndexParser::GetEncoding(char** aEncoding) {
-  *aEncoding = ToNewCString(mEncoding);
+  *aEncoding = ToNewCString(mEncoding, mozilla::fallible);
 
   if (!*aEncoding) return NS_ERROR_OUT_OF_MEMORY;
 

toolkit/components/resistfingerprinting/nsRFPService.cpp

@@ -822,7 +822,7 @@ void nsRFPService::UpdateRFPPref() {
       }
       // PR_SetEnv() needs the input string been leaked intentionally, so
       // we copy it here.
-      tz = ToNewCString(tzValue);
+      tz = ToNewCString(tzValue, mozilla::fallible);
       if (tz != nullptr) {
         PR_SetEnv(tz);
       }

toolkit/crashreporter/nsExceptionHandler.cpp

@@ -2575,7 +2575,7 @@ nsresult SetRestartArgs(int argc, char** argv) {
 
     // PR_SetEnv() wants the string to be available for the lifetime
     // of the app, so dup it here
-    env = ToNewCString(envVar);
+    env = ToNewCString(envVar, mozilla::fallible);
     if (!env) return NS_ERROR_OUT_OF_MEMORY;
 
     PR_SetEnv(env);
@@ -2588,7 +2588,7 @@ nsresult SetRestartArgs(int argc, char** argv) {
 
   // PR_SetEnv() wants the string to be available for the lifetime
   // of the app, so dup it here
-  env = ToNewCString(envVar);
+  env = ToNewCString(envVar, mozilla::fallible);
   if (!env) return NS_ERROR_OUT_OF_MEMORY;
 
   PR_SetEnv(env);

widget/gtk/nsDragService.cpp

@@ -727,7 +727,7 @@ nsDragService::GetData(nsITransferable* aTransferable, uint32_t aItemIndex) {
           const char* castedText = reinterpret_cast<char*>(mTargetDragData);
           char16_t* convertedText = nullptr;
           NS_ConvertUTF8toUTF16 ucs2string(castedText, mTargetDragDataLen);
-          convertedText = ToNewUnicode(ucs2string);
+          convertedText = ToNewUnicode(ucs2string, mozilla::fallible);
           if (convertedText) {
             MOZ_LOG(sDragLm, LogLevel::Debug,
                     ("successfully converted plain text \

widget/gtk/nsWindow.cpp

@@ -4727,7 +4727,7 @@ void nsWindow::RefreshWindowClass(void) {
 void nsWindow::SetWindowClass(const nsAString& xulWinType) {
   if (!mShell) return;
 
-  char* res_name = ToNewCString(xulWinType);
+  char* res_name = ToNewCString(xulWinType, mozilla::fallible);
   if (!res_name) return;
 
   const char* role = nullptr;

widget/windows/nsDataObj.cpp

@@ -2015,7 +2015,7 @@ nsresult nsDataObj ::BuildPlatformHTML(const char* inOurHTML,
   clipboardString.Append(inHTMLString);
   clipboardString.Append(trailingString);
 
-  *outPlatformHTML = ToNewCString(clipboardString);
+  *outPlatformHTML = ToNewCString(clipboardString, mozilla::fallible);
   if (!*outPlatformHTML) return NS_ERROR_OUT_OF_MEMORY;
 
   return NS_OK;

xpcom/ds/nsSupportsPrimitives.cpp

@@ -42,7 +42,7 @@ nsSupportsCString::GetData(nsACString& aData) {
 
 NS_IMETHODIMP
 nsSupportsCString::ToString(char** aResult) {
-  *aResult = ToNewCString(mData);
+  *aResult = ToNewCString(mData, mozilla::fallible);
   if (!*aResult) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
@@ -81,7 +81,7 @@ nsSupportsString::GetData(nsAString& aData) {
 
 NS_IMETHODIMP
 nsSupportsString::ToString(char16_t** aResult) {
-  *aResult = ToNewUnicode(mData);
+  *aResult = ToNewUnicode(mData, mozilla::fallible);
   if (!*aResult) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
@@ -590,7 +590,7 @@ nsSupportsDependentCString::ToString(char** aResult) {
     return NS_ERROR_INVALID_ARG;
   }
 
-  *aResult = ToNewCString(mData);
+  *aResult = ToNewCString(mData, mozilla::fallible);
   if (!*aResult) {
     return NS_ERROR_OUT_OF_MEMORY;
   }

xpcom/ds/nsVariant.cpp

@@ -31,7 +31,7 @@ static nsresult String2Double(const char* aString, double* aResult) {
 }
 
 static nsresult AString2Double(const nsAString& aString, double* aResult) {
-  char* pChars = ToNewCString(aString);
+  char* pChars = ToNewCString(aString, mozilla::fallible);
   if (!pChars) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
@@ -633,7 +633,7 @@ bool nsDiscriminatedUnion::String2ID(nsID* aPid) const {
       return false;
   }
 
-  char* pChars = ToNewCString(*pString);
+  char* pChars = ToNewCString(*pString, mozilla::fallible);
   if (!pChars) {
     return false;
   }

xpcom/string/nsReadableUtils.cpp

@@ -24,18 +24,25 @@ using mozilla::MakeSpan;
  * enough to hold a copy of the supplied string (plus a zero terminator).
  *
  * @param aSource an string you will eventually be making a copy of
- * @return a new buffer (of the type specified by the second parameter) which
- * you must free with |free|.
+ * @return a new buffer which you must free with |free|.
  *
  */
-template <class FromStringT, class ToCharT>
-inline ToCharT* AllocateStringCopy(const FromStringT& aSource, ToCharT*) {
-  // Can't overflow due to the definition of nsTSubstring<T>::kMaxCapacity
-  return static_cast<ToCharT*>(
-      moz_xmalloc((size_t(aSource.Length()) + 1) * sizeof(ToCharT)));
+template <class FromStringT, class CharT>
+inline CharT* AllocateStringCopy(const FromStringT& aSource, CharT*) {
+  return static_cast<CharT*>(
+      malloc((size_t(aSource.Length()) + 1) * sizeof(CharT)));
 }
 
 char* ToNewCString(const nsAString& aSource) {
+  char* str = ToNewCString(aSource, mozilla::fallible);
+  if (!str) {
+    MOZ_CRASH("Unable to allocate memory");
+  }
+  return str;
+}
+
+char* ToNewCString(const nsAString& aSource,
+                   const mozilla::fallible_t& aFallible) {
   char* dest = AllocateStringCopy(aSource, (char*)nullptr);
   if (!dest) {
     return nullptr;
@@ -47,7 +54,8 @@ char* ToNewCString(const nsAString& aSource) {
   return dest;
 }
 
-char* ToNewUTF8String(const nsAString& aSource, uint32_t* aUTF8Count) {
+char* ToNewUTF8String(const nsAString& aSource, uint32_t* aUTF8Count,
+                      const mozilla::fallible_t& aFallible) {
   auto len = aSource.Length();
   // The uses of this function seem temporary enough that it's not
   // worthwhile to be fancy about the allocation size. Let's just use
@@ -63,7 +71,10 @@ char* ToNewUTF8String(const nsAString& aSource, uint32_t* aUTF8Count) {
     return nullptr;
   }
   size_t destLenVal = destLen.value();
-  char* dest = static_cast<char*>(moz_xmalloc(destLenVal));
+  char* dest = static_cast<char*>(malloc(destLenVal));
+  if (!dest) {
+    return nullptr;
+  }
 
   size_t written = ConvertUtf16toUtf8(aSource, MakeSpan(dest, destLenVal));
   dest[written] = 0;
@@ -75,7 +86,24 @@ char* ToNewUTF8String(const nsAString& aSource, uint32_t* aUTF8Count) {
   return dest;
 }
 
+char* ToNewUTF8String(const nsAString& aSource, uint32_t* aUTF8Count) {
+  char* str = ToNewUTF8String(aSource, aUTF8Count, mozilla::fallible);
+  if (!str) {
+    MOZ_CRASH("Unable to allocate memory");
+  }
+  return str;
+}
+
 char* ToNewCString(const nsACString& aSource) {
+  char* str = ToNewCString(aSource, mozilla::fallible);
+  if (!str) {
+    MOZ_CRASH("Unable to allocate memory");
+  }
+  return str;
+}
+
+char* ToNewCString(const nsACString& aSource,
+                   const mozilla::fallible_t& aFallible) {
   // no conversion needed, just allocate a buffer of the correct length and copy
   // into it
 
@@ -91,6 +119,15 @@ char* ToNewCString(const nsACString& aSource) {
 }
 
 char16_t* ToNewUnicode(const nsAString& aSource) {
+  char16_t* str = ToNewUnicode(aSource, mozilla::fallible);
+  if (!str) {
+    MOZ_CRASH("Unable to allocate memory");
+  }
+  return str;
+}
+
+char16_t* ToNewUnicode(const nsAString& aSource,
+                       const mozilla::fallible_t& aFallible) {
   // no conversion needed, just allocate a buffer of the correct length and copy
   // into it
 
@@ -106,6 +143,15 @@ char16_t* ToNewUnicode(const nsAString& aSource) {
 }
 
 char16_t* ToNewUnicode(const nsACString& aSource) {
+  char16_t* str = ToNewUnicode(aSource, mozilla::fallible);
+  if (!str) {
+    MOZ_CRASH("Unable to allocate memory");
+  }
+  return str;
+}
+
+char16_t* ToNewUnicode(const nsACString& aSource,
+                       const mozilla::fallible_t& aFallible) {
   char16_t* dest = AllocateStringCopy(aSource, (char16_t*)nullptr);
   if (!dest) {
     return nullptr;
@@ -117,7 +163,8 @@ char16_t* ToNewUnicode(const nsACString& aSource) {
   return dest;
 }
 
-char16_t* UTF8ToNewUnicode(const nsACString& aSource, uint32_t* aUTF16Count) {
+char16_t* UTF8ToNewUnicode(const nsACString& aSource, uint32_t* aUTF16Count,
+                           const mozilla::fallible_t& aFallible) {
   // Compute length plus one as required by ConvertUTF8toUTF16
   uint32_t lengthPlusOne = aSource.Length() + 1;  // Can't overflow
 
@@ -131,7 +178,10 @@ char16_t* UTF8ToNewUnicode(const nsACString& aSource, uint32_t* aUTF16Count) {
     return nullptr;
   }
 
-  char16_t* dest = (char16_t*)moz_xmalloc(allocLength.value());
+  char16_t* dest = (char16_t*)malloc(allocLength.value());
+  if (!dest) {
+    return nullptr;
+  }
 
   size_t written = ConvertUtf8toUtf16(aSource, MakeSpan(dest, lengthPlusOne));
   dest[written] = 0;
@@ -143,6 +193,14 @@ char16_t* UTF8ToNewUnicode(const nsACString& aSource, uint32_t* aUTF16Count) {
   return dest;
 }
 
+char16_t* UTF8ToNewUnicode(const nsACString& aSource, uint32_t* aUTF16Count) {
+  char16_t* str = UTF8ToNewUnicode(aSource, aUTF16Count, mozilla::fallible);
+  if (!str) {
+    MOZ_CRASH("Unable to allocate memory");
+  }
+  return str;
+}
+
 char16_t* CopyUnicodeTo(const nsAString& aSource, uint32_t aSrcOffset,
                         char16_t* aDest, uint32_t aLength) {
   MOZ_ASSERT(aSrcOffset + aLength <= aSource.Length());

xpcom/string/nsReadableUtils.h

@@ -266,7 +266,8 @@ inline void LossyAppendUTF8toLatin1(const nsACString& aSource,
 /**
  * Returns a new |char| buffer containing a zero-terminated copy of |aSource|.
  *
- * Allocates and returns a new |char| buffer which you must free with |free|.
+ * Infallibly allocates and returns a new |char| buffer which you must
+ * free with |free|.
  * Performs a conversion with LossyConvertUTF16toLatin1() writing into the
  * newly-allocated buffer.
  *
@@ -278,10 +279,15 @@ inline void LossyAppendUTF8toLatin1(const nsACString& aSource,
  */
 char* ToNewCString(const nsAString& aSource);
 
+/* A fallible version of ToNewCString. Returns nullptr on failure. */
+char* ToNewCString(const nsAString& aSource,
+                   const mozilla::fallible_t& aFallible);
+
 /**
  * Returns a new |char| buffer containing a zero-terminated copy of |aSource|.
  *
- * Allocates and returns a new |char| buffer which you must free with |free|.
+ * Infallibly allocates and returns a new |char| buffer which you must
+ * free with |free|.
  *
  * The new buffer is zero-terminated, but that may not help you if |aSource|
  * contains embedded nulls.
@@ -291,11 +297,15 @@ char* ToNewCString(const nsAString& aSource);
  */
 char* ToNewCString(const nsACString& aSource);
 
+/* A fallible version of ToNewCString. Returns nullptr on failure. */
+char* ToNewCString(const nsACString& aSource,
+                   const mozilla::fallible_t& aFallible);
+
 /**
  * Returns a new |char| buffer containing a zero-terminated copy of |aSource|.
  *
- * Allocates and returns a new |char| buffer which you must free with
- * |free|.
+ * Infallibly allocates and returns a new |char| buffer which you must
+ * free with |free|.
  * Performs an encoding conversion from a UTF-16 string to a UTF-8 string with
  * unpaired surrogates replaced with the REPLACEMENT CHARACTER copying
  * |aSource| to your new buffer.
@@ -307,15 +317,18 @@ char* ToNewCString(const nsACString& aSource);
  * @param aUTF8Count the number of 8-bit units that was returned
  * @return a new |char| buffer you must free with |free|.
  */
-
 char* ToNewUTF8String(const nsAString& aSource, uint32_t* aUTF8Count = nullptr);
 
+/* A fallible version of ToNewUTF8String. Returns nullptr on failure. */
+char* ToNewUTF8String(const nsAString& aSource, uint32_t* aUTF8Count,
+                      const mozilla::fallible_t& aFallible);
+
 /**
- * Returns a new |char16_t| buffer containing a zero-terminated copy of
- * |aSource|.
+ * Returns a new |char16_t| buffer containing a zero-terminated copy
+ * of |aSource|.
  *
- * Allocates and returns a new |char16_t| buffer which you must free with
- * |free|.
+ * Infallibly allocates and returns a new |char16_t| buffer which you must
+ * free with |free|.
  *
  * The new buffer is zero-terminated, but that may not help you if |aSource|
  * contains embedded nulls.
@@ -325,12 +338,16 @@ char* ToNewUTF8String(const nsAString& aSource, uint32_t* aUTF8Count = nullptr);
  */
 char16_t* ToNewUnicode(const nsAString& aSource);
 
+/* A fallible version of ToNewUnicode. Returns nullptr on failure. */
+char16_t* ToNewUnicode(const nsAString& aSource,
+                       const mozilla::fallible_t& aFallible);
+
 /**
- * Returns a new |char16_t| buffer containing a zero-terminated copy of
- * |aSource|.
+ * Returns a new |char16_t| buffer containing a zero-terminated copy
+ * of |aSource|.
  *
- * Allocates and returns a new |char16_t| buffer which you must free with
- * |free|.
+ * Infallibly allocates and returns a new |char16_t| buffer which you must
+ * free with|free|.
  *
  * Performs an encoding conversion by 0-padding 8-bit wide characters up to
  * 16-bits wide (i.e. Latin1 to UTF-16 conversion) while copying |aSource|
@@ -344,12 +361,16 @@ char16_t* ToNewUnicode(const nsAString& aSource);
  */
 char16_t* ToNewUnicode(const nsACString& aSource);
 
+/* A fallible version of ToNewUnicode. Returns nullptr on failure. */
+char16_t* ToNewUnicode(const nsACString& aSource,
+                       const mozilla::fallible_t& aFallible);
+
 /**
  * Returns a new |char16_t| buffer containing a zero-terminated copy
  * of |aSource|.
  *
- * Allocates and returns a new |char| buffer which you must free with
- * |free|.  Performs an encoding conversion from UTF-8 to UTF-16
+ * Infallibly allocates and returns a new |char| buffer which you must
+ * free with |free|.  Performs an encoding conversion from UTF-8 to UTF-16
  * while copying |aSource| to your new buffer.  Malformed byte sequences
  * are replaced with the REPLACEMENT CHARACTER.
  *
@@ -364,6 +385,10 @@ char16_t* ToNewUnicode(const nsACString& aSource);
 char16_t* UTF8ToNewUnicode(const nsACString& aSource,
                            uint32_t* aUTF16Count = nullptr);
 
+/* A fallible version of UTF8ToNewUnicode. Returns nullptr on failure. */
+char16_t* UTF8ToNewUnicode(const nsACString& aSource, uint32_t* aUTF16Count,
+                           const mozilla::fallible_t& aFallible);
+
 /**
  * Copies |aLength| 16-bit code units from the start of |aSource| to the
  * |char16_t| buffer |aDest|.