Bug 717762: Proliferate js_memcpy and PodCopy, take 2. (r=luke)

--HG--
extra : rebase_source : 73083063f32036d037b34f0ec96d06192f2ae649

js/src/ds/LifoAlloc.cpp

@@ -223,5 +223,5 @@ LifoAlloc::reallocUnaligned(void *origPtr, size_t origSize, size_t incr)
     /* Otherwise, memcpy. */
     size_t newSize = origSize + incr;
     void *newPtr = allocUnaligned(newSize);
-    return newPtr ? memcpy(newPtr, origPtr, origSize) : NULL;
+    return newPtr ? js_memcpy(newPtr, origPtr, origSize) : NULL;
 }

js/src/frontend/BytecodeEmitter.cpp

@@ -7053,8 +7053,8 @@ frontend::FinishTakingSrcNotes(JSContext *cx, BytecodeEmitter *bce, jssrcnote *n
     mainCount = bce->main.noteCount;
     totalCount = prologCount + mainCount;
     if (prologCount)
-        memcpy(notes, bce->prolog.notes, SRCNOTE_SIZE(prologCount));
+        PodCopy(notes, bce->prolog.notes, prologCount);
-    memcpy(notes + prologCount, bce->main.notes, SRCNOTE_SIZE(mainCount));
+    PodCopy(notes + prologCount, bce->main.notes, mainCount);
     SN_MAKE_TERMINATOR(&notes[totalCount]);
 
     return true;

js/src/frontend/Parser.h

@@ -164,7 +164,7 @@ struct Parser : private AutoGCRooter
         ParseNode *node = allocParseNode(sizeof(ParseNode));
         if (!node)
             return NULL;
-        memcpy(node, &other, sizeof(*node));
+        PodAssign(node, &other);
         return node;
     }
 

js/src/frontend/TokenStream.cpp

@@ -485,7 +485,7 @@ TokenStream::reportCompileErrorNumberVA(ParseNode *pn, uintN flags, uintN errorN
             warning = false;
             goto out;
         }
-        memcpy(linechars, linebase, linelength * sizeof(jschar));
+        PodCopy(linechars, linebase, linelength);
         linechars[linelength] = 0;
         linebytes = DeflateString(cx, linechars, linelength);
         if (!linebytes) {

js/src/jsapi-tests/testConservativeGC.cpp

@@ -8,7 +8,7 @@ BEGIN_TEST(testConservativeGC)
     EVAL("({foo: 'bar'});", &v2);
     CHECK(JSVAL_IS_OBJECT(v2));
     char objCopy[sizeof(JSObject)];
-    memcpy(&objCopy, JSVAL_TO_OBJECT(v2), sizeof(JSObject));
+    js_memcpy(&objCopy, JSVAL_TO_OBJECT(v2), sizeof(JSObject));
 
     jsval v3;
     EVAL("String(Math.PI);", &v3);
@@ -20,7 +20,7 @@ BEGIN_TEST(testConservativeGC)
     CHECK(JSVAL_IS_OBJECT(tmp));
     JSObject *obj2 = JSVAL_TO_OBJECT(tmp);
     char obj2Copy[sizeof(JSObject)];
-    memcpy(&obj2Copy, obj2, sizeof(JSObject));
+    js_memcpy(&obj2Copy, obj2, sizeof(JSObject));
 
     EVAL("String(Math.sqrt(3));", &tmp);
     CHECK(JSVAL_IS_STRING(tmp));

js/src/jsapi-tests/testXDR.cpp

@@ -28,7 +28,7 @@ BEGIN_TEST(testXDR_bug506491)
     CHECK(p);
     void *frozen = JS_malloc(cx, nbytes);
     CHECK(frozen);
-    memcpy(frozen, p, nbytes);
+    js_memcpy(frozen, p, nbytes);
     JS_XDRDestroy(w);
 
     // thaw
@@ -68,7 +68,7 @@ BEGIN_TEST(testXDR_bug516827)
     CHECK(p);
     void *frozen = JS_malloc(cx, nbytes);
     CHECK(frozen);
-    memcpy(frozen, p, nbytes);
+    js_memcpy(frozen, p, nbytes);
     JS_XDRDestroy(w);
 
     // thaw

js/src/jsapi.cpp

@@ -2204,15 +2204,12 @@ JS_updateMallocCounter(JSContext *cx, size_t nbytes)
 JS_PUBLIC_API(char *)
 JS_strdup(JSContext *cx, const char *s)
 {
-    size_t n;
-    void *p;
-
     AssertNoGC(cx);
-    n = strlen(s) + 1;
+    size_t n = strlen(s) + 1;
-    p = cx->malloc_(n);
+    void *p = cx->malloc_(n);
     if (!p)
         return NULL;
-    return (char *)memcpy(p, s, n);
+    return (char *)js_memcpy(p, s, n);
 }
 
 JS_PUBLIC_API(JSBool)
@@ -2500,7 +2497,7 @@ JS_PrintTraceThingInfo(char *buf, size_t bufsize, JSTracer *trc, void *thing,
     n = strlen(name);
     if (n > bufsize - 1)
         n = bufsize - 1;
-    memcpy(buf, name, n + 1);
+    js_memcpy(buf, name, n + 1);
     buf += n;
     bufsize -= n;
 
@@ -2614,9 +2611,6 @@ DumpNotify(JSTracer *trc, void *thing, JSGCTraceKind kind)
     JSDumpingTracer *dtrc;
     JSContext *cx;
     JSDHashEntryStub *entry;
-    JSHeapDumpNode *node;
-    const char *edgeName;
-    size_t edgeNameSize;
 
     JS_ASSERT(trc->callback == DumpNotify);
     dtrc = (JSDumpingTracer *)trc;
@@ -2655,10 +2649,10 @@ DumpNotify(JSTracer *trc, void *thing, JSGCTraceKind kind)
         entry->key = thing;
     }
 
-    edgeName = JS_GetTraceEdgeName(&dtrc->base, dtrc->buffer, sizeof(dtrc->buffer));
+    const char *edgeName = JS_GetTraceEdgeName(&dtrc->base, dtrc->buffer, sizeof(dtrc->buffer));
-    edgeNameSize = strlen(edgeName) + 1;
+    size_t edgeNameSize = strlen(edgeName) + 1;
     size_t bytes = offsetof(JSHeapDumpNode, edgeName) + edgeNameSize;
-    node = (JSHeapDumpNode *) OffTheBooks::malloc_(bytes);
+    JSHeapDumpNode *node = (JSHeapDumpNode *) OffTheBooks::malloc_(bytes);
     if (!node) {
         dtrc->ok = JS_FALSE;
         return;
@@ -2668,7 +2662,7 @@ DumpNotify(JSTracer *trc, void *thing, JSGCTraceKind kind)
     node->kind = kind;
     node->next = NULL;
     node->parent = dtrc->parentNode;
-    memcpy(node->edgeName, edgeName, edgeNameSize);
+    js_memcpy(node->edgeName, edgeName, edgeNameSize);
 
     JS_ASSERT(!*dtrc->lastNodep);
     *dtrc->lastNodep = node;
@@ -5484,7 +5478,7 @@ JS_New(JSContext *cx, JSObject *ctor, uintN argc, jsval *argv)
 
     args.calleev().setObject(*ctor);
     args.thisv().setNull();
-    memcpy(args.array(), argv, argc * sizeof(jsval));
+    PodCopy(args.array(), argv, argc);
 
     if (!InvokeConstructor(cx, args))
         return NULL;
@@ -6049,7 +6043,7 @@ JSAutoStructuredCloneBuffer::copy(const uint64_t *srcData, size_t nbytes, uint32
     if (!newData)
         return false;
 
-    memcpy(newData, srcData, nbytes);
+    js_memcpy(newData, srcData, nbytes);
 
     clear();
     data_ = newData;

js/src/jsclone.cpp

@@ -219,7 +219,7 @@ SCInput::readArray(T *p, size_t nelems)
         return eof();
 
     if (sizeof(T) == 1) {
-        memcpy(p, point, nelems);
+        js_memcpy(p, point, nelems);
     } else {
         const T *q = (const T *) point;
         const T *qend = q + nelems;
@@ -329,7 +329,7 @@ SCOutput::writeArray(const T *p, size_t nelems)
 
     T *q = (T *) &buf[start];
     if (sizeof(T) == 1) {
-        memcpy(q, p, nelems);
+        js_memcpy(q, p, nelems);
     } else {
         const T *pend = p + nelems;
         while (p != pend)

js/src/jscrashreport.cpp

@@ -106,7 +106,7 @@ GetStack(uint64_t *stack, uint64_t *stack_len, CrashRegisters *regs, char *buffe
 #endif
 #endif
 
-    memcpy(buffer, (void *)p, len);
+    js_memcpy(buffer, (void *)p, len);
 
     return true;
 }
@@ -157,7 +157,7 @@ GetStack(uint64_t *stack, uint64_t *stack_len, CrashRegisters *regs, char *buffe
     regs->ip = (uint64_t)context.uc_mcontext.gregs[REG_EIP];
 #endif
 
-    memcpy(buffer, (void *)p, len);
+    js_memcpy(buffer, (void *)p, len);
 
     return true;
 }
@@ -230,11 +230,11 @@ Ring::copyBytes(void *data, size_t size)
     if (offset + size > bufferSize()) {
         size_t first = bufferSize() - offset;
         size_t second = size - first;
-        memcpy(&buffer[offset], data, first);
+        js_memcpy(&buffer[offset], data, first);
-        memcpy(buffer, (char *)data + first, second);
+        js_memcpy(buffer, (char *)data + first, second);
         offset = second;
     } else {
-        memcpy(&buffer[offset], data, size);
+        js_memcpy(&buffer[offset], data, size);
         offset += size;
     }
 }

js/src/jsdbgapi.cpp

@@ -448,7 +448,8 @@ JS_GetFunctionLocalNameArray(JSContext *cx, JSFunction *fun, void **markp)
         return NULL;
     }
 
-    memcpy(names, localNames.begin(), localNames.length() * sizeof(uintptr_t));
+    JS_ASSERT(sizeof(*names) == sizeof(*localNames.begin()));
+    js_memcpy(names, localNames.begin(), localNames.length() * sizeof(*names));
     return names;
 }
 

js/src/jsdhash.cpp

@@ -169,7 +169,7 @@ JS_DHashMoveEntryStub(JSDHashTable *table,
                       const JSDHashEntryHdr *from,
                       JSDHashEntryHdr *to)
 {
-    memcpy(to, from, table->entrySize);
+    js_memcpy(to, from, table->entrySize);
 }
 
 JS_PUBLIC_API(void)

js/src/jsdtoa.cpp

@@ -142,7 +142,7 @@ js_dtostr(DtoaState *state, char *buffer, size_t bufferSize, JSDToStrMode mode,
         return NULL;
     }
 
-    memcpy(buffer + 2, numBegin, nDigits);
+    js_memcpy(buffer + 2, numBegin, nDigits);
     freedtoa(PASS_STATE numBegin);
     numBegin = buffer + 2; /* +2 leaves space for sign and/or decimal point */
     numEnd = numBegin + nDigits;

js/src/jsexn.cpp

@@ -203,7 +203,7 @@ CopyErrorReport(JSContext *cx, JSErrorReport *report)
         for (i = 0; report->messageArgs[i]; ++i) {
             copy->messageArgs[i] = (const jschar *)cursor;
             argSize = JS_CHARS_SIZE(report->messageArgs[i]);
-            memcpy(cursor, report->messageArgs[i], argSize);
+            js_memcpy(cursor, report->messageArgs[i], argSize);
             cursor += argSize;
         }
         copy->messageArgs[i] = NULL;
@@ -212,13 +212,13 @@ CopyErrorReport(JSContext *cx, JSErrorReport *report)
 
     if (report->ucmessage) {
         copy->ucmessage = (const jschar *)cursor;
-        memcpy(cursor, report->ucmessage, ucmessageSize);
+        js_memcpy(cursor, report->ucmessage, ucmessageSize);
         cursor += ucmessageSize;
     }
 
     if (report->uclinebuf) {
         copy->uclinebuf = (const jschar *)cursor;
-        memcpy(cursor, report->uclinebuf, uclinebufSize);
+        js_memcpy(cursor, report->uclinebuf, uclinebufSize);
         cursor += uclinebufSize;
         if (report->uctokenptr) {
             copy->uctokenptr = copy->uclinebuf + (report->uctokenptr -
@@ -228,7 +228,7 @@ CopyErrorReport(JSContext *cx, JSErrorReport *report)
 
     if (report->linebuf) {
         copy->linebuf = (const char *)cursor;
-        memcpy(cursor, report->linebuf, linebufSize);
+        js_memcpy(cursor, report->linebuf, linebufSize);
         cursor += linebufSize;
         if (report->tokenptr) {
             copy->tokenptr = copy->linebuf + (report->tokenptr -
@@ -238,7 +238,7 @@ CopyErrorReport(JSContext *cx, JSErrorReport *report)
 
     if (report->filename) {
         copy->filename = (const char *)cursor;
-        memcpy(cursor, report->filename, filenameSize);
+        js_memcpy(cursor, report->filename, filenameSize);
     }
     JS_ASSERT(cursor + filenameSize == (uint8_t *)copy + mallocSize);
 

js/src/jsfun.cpp

@@ -1607,7 +1607,7 @@ js_fun_call(JSContext *cx, uintN argc, Value *vp)
     /* Push fval, thisv, and the args. */
     args.calleev() = fval;
     args.thisv() = thisv;
-    memcpy(args.array(), argv, argc * sizeof *argv);
+    PodCopy(args.array(), argv, argc);
 
     bool ok = Invoke(cx, args);
     *vp = args.rval();
@@ -1781,7 +1781,7 @@ CallOrConstructBoundFunction(JSContext *cx, uintN argc, Value *vp)
     /* 15.3.4.5.1, 15.3.4.5.2 step 4. */
     for (uintN i = 0; i < argslen; i++)
         args[i] = fun->getBoundFunctionArgument(i);
-    memcpy(args.array() + argslen, vp + 2, argc * sizeof(Value));
+    PodCopy(args.array() + argslen, vp + 2, argc);
 
     /* 15.3.4.5.1, 15.3.4.5.2 step 5. */
     args.calleev().setObject(*target);

js/src/jsinfer.cpp

@@ -2128,7 +2128,7 @@ TypeCompartment::growPendingArray(JSContext *cx)
         return false;
     }
 
-    memcpy(newArray, pendingArray, pendingCount * sizeof(PendingWork));
+    PodCopy(newArray, pendingArray, pendingCount);
     cx->free_(pendingArray);
 
     pendingArray = newArray;

js/src/jsinterp.cpp

@@ -554,7 +554,7 @@ js::Invoke(JSContext *cx, const Value &thisv, const Value &fval, uintN argc, Val
 
     args.calleev() = fval;
     args.thisv() = thisv;
-    memcpy(args.array(), argv, argc * sizeof(Value));
+    PodCopy(args.array(), argv, argc);
 
     if (args.thisv().isObject()) {
         /*
@@ -623,7 +623,7 @@ js::InvokeConstructor(JSContext *cx, const Value &fval, uintN argc, Value *argv,
 
     args.calleev() = fval;
     args.thisv().setMagic(JS_THIS_POISON);
-    memcpy(args.array(), argv, argc * sizeof(Value));
+    PodCopy(args.array(), argv, argc);
 
     if (!InvokeConstructor(cx, args))
         return false;

js/src/jsiter.cpp

@@ -41,8 +41,6 @@
 /*
  * JavaScript iterators.
  */
-#include <string.h>     /* for memcpy */
-
 #include "mozilla/Util.h"
 
 #include "jstypes.h"

js/src/jsnum.cpp

@@ -736,7 +736,7 @@ num_toLocaleString(JSContext *cx, uintN argc, Value *vp)
         strcpy(tmpDest, rt->thousandsSeparator);
         tmpDest += thousandsLength;
         JS_ASSERT(tmpDest - buf + *tmpGroup <= buflen);
-        memcpy(tmpDest, tmpSrc, *tmpGroup);
+        js_memcpy(tmpDest, tmpSrc, *tmpGroup);
         tmpDest += *tmpGroup;
         tmpSrc += *tmpGroup;
         if (--nrepeat < 0)
@@ -978,15 +978,15 @@ InitRuntimeNumberState(JSRuntime *rt)
     if (!storage)
         return false;
 
-    memcpy(storage, thousandsSeparator, thousandsSeparatorSize);
+    js_memcpy(storage, thousandsSeparator, thousandsSeparatorSize);
     rt->thousandsSeparator = storage;
     storage += thousandsSeparatorSize;
 
-    memcpy(storage, decimalPoint, decimalPointSize);
+    js_memcpy(storage, decimalPoint, decimalPointSize);
     rt->decimalSeparator = storage;
     storage += decimalPointSize;
 
-    memcpy(storage, grouping, groupingSize);
+    js_memcpy(storage, grouping, groupingSize);
     rt->numGrouping = grouping;
     return true;
 }

js/src/jsobj.cpp

@@ -3624,9 +3624,9 @@ JSObject::TradeGuts(JSContext *cx, JSObject *a, JSObject *b, TradeGutsReserved &
         char tmp[tl::Max<sizeof(JSFunction), sizeof(JSObject_Slots16)>::result];
         JS_ASSERT(size <= sizeof(tmp));
 
-        memcpy(tmp, a, size);
+        js_memcpy(tmp, a, size);
-        memcpy(a, b, size);
+        js_memcpy(a, b, size);
-        memcpy(b, tmp, size);
+        js_memcpy(b, tmp, size);
     } else {
         /*
          * If the objects are of differing sizes, use the space we reserved
@@ -3653,9 +3653,9 @@ JSObject::TradeGuts(JSContext *cx, JSObject *a, JSObject *b, TradeGutsReserved &
         void *bpriv = b->hasPrivate() ? b->getPrivate() : NULL;
 
         char tmp[sizeof(JSObject)];
-        memcpy(&tmp, a, sizeof tmp);
+        js_memcpy(&tmp, a, sizeof tmp);
-        memcpy(a, b, sizeof tmp);
+        js_memcpy(a, b, sizeof tmp);
-        memcpy(b, &tmp, sizeof tmp);
+        js_memcpy(b, &tmp, sizeof tmp);
 
         if (a->isNative())
             a->shape_->setNumFixedSlots(reserved.newafixed);
@@ -4318,8 +4318,8 @@ JSObject::growElements(JSContext *cx, uintN newcap)
         newheader = (ObjectElements *) cx->malloc_(newAllocated * sizeof(Value));
         if (!newheader)
             return false;  /* Ditto. */
-        memcpy(newheader, getElementsHeader(),
+        js_memcpy(newheader, getElementsHeader(),
-               (ObjectElements::VALUES_PER_HEADER + initlen) * sizeof(Value));
+                  (ObjectElements::VALUES_PER_HEADER + initlen) * sizeof(Value));
     }
 
     newheader->capacity = actualCapacity;

js/src/jsobjinlines.h

@@ -1565,7 +1565,7 @@ NewObjectCache::fill(EntryIndex entry_, Class *clasp, gc::Cell *key, gc::AllocKi
     entry->kind = kind;
 
     entry->nbytes = obj->structSize();
-    memcpy(&entry->templateObject, obj, entry->nbytes);
+    js_memcpy(&entry->templateObject, obj, entry->nbytes);
 }
 
 inline void
@@ -1598,7 +1598,7 @@ NewObjectCache::newObjectFromHit(JSContext *cx, EntryIndex entry_)
 
     JSObject *obj = js_TryNewGCObject(cx, entry->kind);
     if (obj) {
-        memcpy(obj, &entry->templateObject, entry->nbytes);
+        js_memcpy(obj, &entry->templateObject, entry->nbytes);
         Probes::createObject(cx, obj);
         return obj;
     }
@@ -1607,7 +1607,7 @@ NewObjectCache::newObjectFromHit(JSContext *cx, EntryIndex entry_)
     size_t nbytes = entry->nbytes;
     char stackObject[sizeof(JSObject_Slots16)];
     JS_ASSERT(nbytes <= sizeof(stackObject));
-    memcpy(&stackObject, &entry->templateObject, nbytes);
+    js_memcpy(&stackObject, &entry->templateObject, nbytes);
 
     JSObject *baseobj = (JSObject *) stackObject;
     RootShape shapeRoot(cx, (Shape **) baseobj->addressOfShape());
@@ -1615,7 +1615,7 @@ NewObjectCache::newObjectFromHit(JSContext *cx, EntryIndex entry_)
 
     obj = js_NewGCObject(cx, entry->kind);
     if (obj) {
-        memcpy(obj, baseobj, nbytes);
+        js_memcpy(obj, baseobj, nbytes);
         Probes::createObject(cx, obj);
         return obj;
     }

js/src/jsopcode.cpp

@@ -1148,14 +1148,14 @@ UpdateDecompiledText(SprintStack *ss, jsbytecode *pc, ptrdiff_t todo)
         const char *text = OFF2STR(&ss->sprinter, todo);
         size_t len = strlen(text) + 1;
 
-        const char *ntext = ss->printer->pool.newArrayUninitialized<char>(len);
+        char *ntext = ss->printer->pool.newArrayUninitialized<char>(len);
         if (!ntext) {
             js_ReportOutOfMemory(ss->sprinter.context);
             return false;
         }
 
-        memcpy((char *) ntext, text, len);
+        js_memcpy(ntext, text, len);
-        jp->decompiled(pc).text = ntext;
+        jp->decompiled(pc).text = const_cast<const char *>(ntext);
     }
 
     return true;
@@ -1168,7 +1168,7 @@ SprintDupeStr(SprintStack *ss, const char *str)
 
     const char *nstr = ss->printer->pool.newArrayUninitialized<char>(len);
     if (nstr) {
-        memcpy((char *) nstr, str, len);
+        js_memcpy((char *) nstr, str, len);
     } else {
         js_ReportOutOfMemory(ss->sprinter.context);
         nstr = "";

js/src/jsprf.cpp

@@ -344,7 +344,7 @@ static int cvt_f(SprintfState *ss, double d, const char *fmt0, const char *fmt1)
         /* Totally bogus % command to sprintf. Just ignore it */
         return 0;
     }
-    memcpy(fin, fmt0, (size_t)amount);
+    js_memcpy(fin, fmt0, (size_t)amount);
     fin[amount] = 0;
 
     /* Convert floating point using the native sprintf code */
@@ -918,7 +918,7 @@ static int dosprintf(SprintfState *ss, const char *fmt, va_list ap)
                 i = fmt - dolPt;
                 if( i < (int)sizeof( pattern ) ){
                     pattern[0] = '%';
-                    memcpy( &pattern[1], dolPt, (size_t)i );
+                    js_memcpy( &pattern[1], dolPt, (size_t)i );
                     rv = cvt_f(ss, u.d, pattern, &pattern[i+1] );
                 }
             } else

js/src/jsscript.cpp

@@ -1141,8 +1141,8 @@ JSScript::NewScriptFromEmitter(JSContext *cx, BytecodeEmitter *bce)
 
     JS_ASSERT(script->mainOffset == 0);
     script->mainOffset = prologLength;
-    memcpy(script->code, bce->prologBase(), prologLength * sizeof(jsbytecode));
+    PodCopy<jsbytecode>(script->code, bce->prologBase(), prologLength);
-    memcpy(script->main(), bce->base(), mainLength * sizeof(jsbytecode));
+    PodCopy<jsbytecode>(script->main(), bce->base(), mainLength);
     nfixed = bce->inFunction()
              ? bce->bindings.countVars()
              : bce->sharpSlots();
@@ -1209,22 +1209,22 @@ JSScript::NewScriptFromEmitter(JSContext *cx, BytecodeEmitter *bce)
 
     if (bce->hasUpvarIndices()) {
         JS_ASSERT(bce->upvarIndices->count() <= bce->upvarMap.length());
-        memcpy(script->upvars()->vector, bce->upvarMap.begin(),
+        PodCopy<UpvarCookie>(script->upvars()->vector, bce->upvarMap.begin(),
-               bce->upvarIndices->count() * sizeof(bce->upvarMap[0]));
+                             bce->upvarIndices->count());
         bce->upvarIndices->clear();
         bce->upvarMap.clear();
     }
 
     if (bce->globalUses.length()) {
-        memcpy(script->globals()->vector, &bce->globalUses[0],
+        PodCopy<GlobalSlotArray::Entry>(script->globals()->vector, &bce->globalUses[0],
-               bce->globalUses.length() * sizeof(GlobalSlotArray::Entry));
+                                        bce->globalUses.length());
     }
 
     if (script->nClosedArgs)
-        memcpy(script->closedSlots, &bce->closedArgs[0], script->nClosedArgs * sizeof(uint32_t));
+        PodCopy<uint32_t>(script->closedSlots, &bce->closedArgs[0], script->nClosedArgs);
     if (script->nClosedVars) {
-        memcpy(&script->closedSlots[script->nClosedArgs], &bce->closedVars[0],
+        PodCopy<uint32_t>(&script->closedSlots[script->nClosedArgs], &bce->closedVars[0],
-               script->nClosedVars * sizeof(uint32_t));
+                          script->nClosedVars);
     }
 
     script->bindings.transfer(cx, &bce->bindings);
@@ -1715,7 +1715,7 @@ js_CloneScript(JSContext *cx, JSScript *script)
 void
 JSScript::copyClosedSlotsTo(JSScript *other)
 {
-    memcpy(other->closedSlots, closedSlots, nClosedArgs + nClosedVars);
+    js_memcpy(other->closedSlots, closedSlots, nClosedArgs + nClosedVars);
 }
 
 bool

js/src/jsstr.cpp

@@ -3268,7 +3268,7 @@ js_NewStringCopyZ(JSContext *cx, const jschar *s)
     jschar *news = (jschar *) cx->malloc_(m);
     if (!news)
         return NULL;
-    memcpy(news, s, m);
+    js_memcpy(news, s, m);
     JSFixedString *str = js_NewString(cx, news, n);
     if (!str)
         cx->free_(news);

js/src/jsstr.h

@@ -46,6 +46,7 @@
 #include "jsprvtd.h"
 #include "jslock.h"
 #include "jscell.h"
+#include "jsutil.h"
 
 #include "js/HashTable.h"
 #include "vm/Unicode.h"
@@ -215,7 +216,11 @@ js_strchr(const jschar *s, jschar c);
 extern jschar *
 js_strchr_limit(const jschar *s, jschar c, const jschar *limit);
 
-#define js_strncpy(t, s, n)     memcpy((t), (s), (n) * sizeof(jschar))
+static JS_ALWAYS_INLINE void
+js_strncpy(jschar *dst, const jschar *src, size_t nelem)
+{
+    return js::PodCopy(dst, src, nelem);
+}
 
 namespace js {
 

js/src/jstypedarray.cpp

@@ -1799,7 +1799,7 @@ class TypedArrayTemplate
         NativeType *dest = static_cast<NativeType*>((void*)getDataOffset(thisTypedArrayObj)) + offset;
 
         if (getType(tarray) == getType(thisTypedArrayObj)) {
-            memcpy(dest, getDataOffset(tarray), getByteLength(tarray));
+            js_memcpy(dest, getDataOffset(tarray), getByteLength(tarray));
             return true;
         }
 
@@ -1879,7 +1879,7 @@ class TypedArrayTemplate
         void *srcbuf = cx->malloc_(getLength(tarray));
         if (!srcbuf)
             return false;
-        memcpy(srcbuf, getDataOffset(tarray), getByteLength(tarray));
+        js_memcpy(srcbuf, getDataOffset(tarray), getByteLength(tarray));
 
         switch (getType(tarray)) {
           case TypedArray::TYPE_INT8: {

js/src/jsutil.cpp

@@ -183,7 +183,7 @@ JS_BasicStatsAccum(JSBasicStats *bs, uint32_t val)
                     newbin = ValToBin(newscale, BinToVal(oldscale, bin));
                     newhist[newbin] += bs->hist[bin];
                 }
-                memcpy(bs->hist, newhist, sizeof bs->hist);
+                js_memcpy(bs->hist, newhist, sizeof bs->hist);
                 bs->logscale = newscale;
             }
         }

js/src/jsutil.h

@@ -51,6 +51,17 @@
 /* Forward declarations. */
 struct JSContext;
 
+static JS_ALWAYS_INLINE void *
+js_memcpy(void *dst_, const void *src_, size_t len)
+{
+    char *dst = (char *) dst_;
+    const char *src = (const char *) src_;
+    JS_ASSERT_IF(dst >= src, (size_t) (dst - src) >= len);
+    JS_ASSERT_IF(src >= dst, (size_t) (src - dst) >= len);
+
+    return memcpy(dst, src, len);
+}
+
 #ifdef __cplusplus
 namespace js {
 
@@ -288,7 +299,7 @@ PodZero(T *t, size_t nelem)
      * length.  The compiler should inline the memset call with constant
      * size, though.
      */
-    for (size_t i = 0; i < nelem; ++i, ++t)
+    for (T *end = t + nelem; t != end; ++t)
         memset(t, 0, sizeof(T));
 }
 
@@ -309,6 +320,13 @@ PodArrayZero(T (&t)[N])
     memset(t, 0, N * sizeof(T));
 }
 
+template <class T>
+JS_ALWAYS_INLINE static void
+PodAssign(T *dst, const T *src)
+{
+    js_memcpy((char *) dst, (const char *) src, sizeof(T));
+}
+
 template <class T>
 JS_ALWAYS_INLINE static void
 PodCopy(T *dst, const T *src, size_t nelem)
@@ -318,8 +336,12 @@ PodCopy(T *dst, const T *src, size_t nelem)
     JS_ASSERT_IF(src >= dst, size_t(src - dst) >= nelem);
 
     if (nelem < 128) {
+        /*
+         * Avoid using operator= in this loop, as it may have been
+         * intentionally deleted by the POD type.
+         */
         for (const T *srcend = src + nelem; src != srcend; ++src, ++dst)
-            *dst = *src;
+            PodAssign(dst, src);
     } else {
         memcpy(dst, src, nelem * sizeof(T));
     }

js/src/jsxdrapi.cpp

@@ -135,7 +135,7 @@ static JSBool
 mem_getbytes(JSXDRState *xdr, char *bytes, uint32_t len)
 {
     MEM_LEFT(xdr, len);
-    memcpy(bytes, MEM_DATA(xdr), len);
+    js_memcpy(bytes, MEM_DATA(xdr), len);
     MEM_INCR(xdr, len);
     return JS_TRUE;
 }
@@ -144,7 +144,7 @@ static JSBool
 mem_setbytes(JSXDRState *xdr, char *bytes, uint32_t len)
 {
     MEM_NEED(xdr, len);
-    memcpy(MEM_DATA(xdr), bytes, len);
+    js_memcpy(MEM_DATA(xdr), bytes, len);
     MEM_INCR(xdr, len);
     return JS_TRUE;
 }

js/src/shell/js.cpp

@@ -3768,7 +3768,7 @@ Serialize(JSContext *cx, uintN argc, jsval *vp)
     }
     JSObject *array = TypedArray::getTypedArray(arrayobj);
     JS_ASSERT((uintptr_t(TypedArray::getDataOffset(array)) & 7) == 0);
-    memcpy(TypedArray::getDataOffset(array), datap, nbytes);
+    js_memcpy(TypedArray::getDataOffset(array), datap, nbytes);
     JS_free(cx, datap);
     JS_SET_RVAL(cx, vp, OBJECT_TO_JSVAL(arrayobj));
     return true;