From d9eed341b02b6248b349d66de5c14152653f1f24 Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Tue, 17 Jul 2018 14:30:24 +0100
Subject: [PATCH] Bug 1475228 - Allocate script loader source buffers on the JS
 heap and pass ownership when compiling r=baku

---
 dom/script/ScriptLoadRequest.cpp |  4 ++--
 dom/script/ScriptLoadRequest.h   | 25 ++++++++++++++++---------
 dom/script/ScriptLoader.cpp      | 10 +++++-----
 3 files changed, 23 insertions(+), 16 deletions(-)

diff --git a/dom/script/ScriptLoadRequest.cpp b/dom/script/ScriptLoadRequest.cpp
index 58d49e6e189a..211d97082098 100644
--- a/dom/script/ScriptLoadRequest.cpp
+++ b/dom/script/ScriptLoadRequest.cpp
@@ -166,7 +166,7 @@ ScriptLoadRequest::SetTextSource()
 {
   MOZ_ASSERT(IsUnknownDataType());
   mDataType = DataType::eTextSource;
-  mScriptData.emplace(VariantType<Vector<char16_t>>());
+  mScriptData.emplace(VariantType<ScriptTextBuffer>());
 }
 
 void
@@ -175,7 +175,7 @@ ScriptLoadRequest::SetBinASTSource()
 #ifdef JS_BUILD_BINAST
   MOZ_ASSERT(IsUnknownDataType());
   mDataType = DataType::eBinASTSource;
-  mScriptData.emplace(VariantType<Vector<uint8_t>>());
+  mScriptData.emplace(VariantType<BinASTSourceBuffer>());
 #else
   MOZ_CRASH("BinAST not supported");
 #endif
diff --git a/dom/script/ScriptLoadRequest.h b/dom/script/ScriptLoadRequest.h
index 2466e4c0cd0e..6b429ad51228 100644
--- a/dom/script/ScriptLoadRequest.h
+++ b/dom/script/ScriptLoadRequest.h
@@ -171,21 +171,28 @@ public:
   void SetBinASTSource();
   void SetBytecode();
 
-  const Vector<char16_t>& ScriptText() const {
+  using ScriptTextBuffer = Vector<char16_t, 0, JSMallocAllocPolicy>;
+  using BinASTSourceBuffer = Vector<uint8_t>;
+
+  const ScriptTextBuffer& ScriptText() const
+  {
     MOZ_ASSERT(IsTextSource());
-    return mScriptData->as<Vector<char16_t>>();
+    return mScriptData->as<ScriptTextBuffer>();
   }
-  Vector<char16_t>& ScriptText() {
+  ScriptTextBuffer& ScriptText()
+  {
     MOZ_ASSERT(IsTextSource());
-    return mScriptData->as<Vector<char16_t>>();
+    return mScriptData->as<ScriptTextBuffer>();
   }
-  const Vector<uint8_t>& ScriptBinASTData() const {
+  const BinASTSourceBuffer& ScriptBinASTData() const
+  {
     MOZ_ASSERT(IsBinASTSource());
-    return mScriptData->as<Vector<uint8_t>>();
+    return mScriptData->as<BinASTSourceBuffer>();
   }
-  Vector<uint8_t>& ScriptBinASTData() {
+  BinASTSourceBuffer& ScriptBinASTData()
+  {
     MOZ_ASSERT(IsBinASTSource());
-    return mScriptData->as<Vector<uint8_t>>();
+    return mScriptData->as<BinASTSourceBuffer>();
   }
 
   enum class ScriptMode : uint8_t {
@@ -252,7 +259,7 @@ public:
   // Holds script source data for non-inline scripts. Don't use nsString so we
   // can give ownership to jsapi. Holds either char16_t source text characters
   // or BinAST encoded bytes depending on mSourceEncoding.
-  Maybe<Variant<Vector<char16_t>, Vector<uint8_t>>> mScriptData;
+  Maybe<Variant<ScriptTextBuffer, BinASTSourceBuffer>> mScriptData;
 
   // Holds the SRI serialized hash and the script bytecode for non-inline
   // scripts.
diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
index afb0977eb342..24c449d658d9 100644
--- a/dom/script/ScriptLoader.cpp
+++ b/dom/script/ScriptLoader.cpp
@@ -1899,14 +1899,13 @@ SourceBufferHolder
 ScriptLoader::GetScriptSource(JSContext* aCx, ScriptLoadRequest* aRequest)
 {
   // Return a SourceBufferHolder object holding the script's source text.
+  // Ownership of the buffer is transferred to the resulting SourceBufferHolder.
 
   // If there's no script text, we try to get it from the element
   if (aRequest->mIsInline) {
     nsAutoString inlineData;
     aRequest->mElement->GetScriptText(inlineData);
 
-    // Copy string to JS allocated buffer and transfer ownership to
-    // SourceBufferHolder result.
     size_t nbytes = inlineData.Length() * sizeof(char16_t);
     JS::UniqueTwoByteChars chars(static_cast<char16_t*>(JS_malloc(aCx, nbytes)));
     MOZ_RELEASE_ASSERT(chars);
@@ -1914,9 +1913,10 @@ ScriptLoader::GetScriptSource(JSContext* aCx, ScriptLoadRequest* aRequest)
     return SourceBufferHolder(std::move(chars), inlineData.Length());
   }
 
-  return SourceBufferHolder(aRequest->ScriptText().begin(),
-                            aRequest->ScriptText().length(),
-                            SourceBufferHolder::NoOwnership);
+  size_t length = aRequest->ScriptText().length();
+  return SourceBufferHolder(aRequest->ScriptText().extractOrCopyRawBuffer(),
+                            length,
+                            SourceBufferHolder::GiveOwnership);
 }
 
 nsresult