Bug 1269319 - Make AlignedStorage/AlignedStorage2 non-copyable to fix strict aliasing issues. r=Waldo

dom/plugins/base/nsJSNPRuntime.h

@@ -38,8 +38,17 @@ public:
       JS::TraceEdge(trc, &mJSObj, "nsJSObjWrapperKey");
   }
 
+  nsJSObjWrapperKey(const nsJSObjWrapperKey& other)
+    : mJSObj(other.mJSObj),
+      mNpp(other.mNpp)
+  {}
+  void operator=(const nsJSObjWrapperKey& other) {
+    mJSObj = other.mJSObj;
+    mNpp = other.mNpp;
+  }
+
   JS::Heap<JSObject*> mJSObj;
-  const NPP mNpp;
+  NPP mNpp;
 };
 
 class nsJSObjWrapper : public NPObject

js/public/HashTable.h

@@ -704,6 +704,11 @@ class HashMapEntry
         value_(mozilla::Move(rhs.value_))
     {}
 
+    void operator=(HashMapEntry&& rhs) {
+        key_ = mozilla::Move(rhs.key_);
+        value_ = mozilla::Move(rhs.value_);
+    }
+
     typedef Key KeyType;
     typedef Value ValueType;
 
@@ -774,8 +779,14 @@ class HashTableEntry
     }
 
     void swap(HashTableEntry* other) {
+        MOZ_ASSERT(isLive());
+        if (other->isLive()) {
+            mozilla::Swap(*mem.addr(), *other->mem.addr());
+        } else {
+            *other->mem.addr() = mozilla::Move(*mem.addr());
+            destroy();
+        }
         mozilla::Swap(keyHash, other->keyHash);
-        mozilla::Swap(mem, other->mem);
     }
 
     T& get() { MOZ_ASSERT(isLive()); return *mem.addr(); }

js/src/jit/JitCompartment.h

@@ -403,6 +403,10 @@ struct CacheIRStubKey : public DefaultHasher<CacheIRStubKey> {
 
     explicit CacheIRStubKey(CacheIRStubInfo* info) : stubInfo(info) {}
     CacheIRStubKey(CacheIRStubKey&& other) : stubInfo(Move(other.stubInfo)) { }
+
+    void operator=(CacheIRStubKey&& other) {
+        stubInfo = Move(other.stubInfo);
+    }
 };
 
 class JitCompartment

js/src/jit/Snapshots.h

@@ -504,7 +504,25 @@ class SnapshotReader
     }
 };
 
-typedef mozilla::AlignedStorage<4 * sizeof(uint32_t)> RInstructionStorage;
+class RInstructionStorage
+{
+    static const size_t Size = 4 * sizeof(uint32_t);
+    mozilla::AlignedStorage<Size> mem;
+
+  public:
+    const void* addr() const { return mem.addr(); }
+    void* addr() { return mem.addr(); }
+
+    RInstructionStorage() = default;
+
+    RInstructionStorage(const RInstructionStorage& other) {
+        memcpy(addr(), other.addr(), Size);
+    }
+    void operator=(const RInstructionStorage& other) {
+        memcpy(addr(), other.addr(), Size);
+    }
+};
+
 class RInstruction;
 
 class RecoverReader

js/src/vm/ObjectGroup.cpp

@@ -1354,6 +1354,13 @@ struct ObjectGroupCompartment::AllocationSiteKey : public DefaultHasher<Allocati
         MOZ_ASSERT(offset_ < OFFSET_LIMIT);
     }
 
+    AllocationSiteKey(const AllocationSiteKey& key)
+      : script(key.script),
+        offset(key.offset),
+        kind(key.kind),
+        proto(key.proto)
+    { }
+
     AllocationSiteKey(AllocationSiteKey&& key)
       : script(mozilla::Move(key.script)),
         offset(key.offset),
@@ -1361,12 +1368,12 @@ struct ObjectGroupCompartment::AllocationSiteKey : public DefaultHasher<Allocati
         proto(mozilla::Move(key.proto))
     { }
 
-    AllocationSiteKey(const AllocationSiteKey& key)
-      : script(key.script),
-        offset(key.offset),
-        kind(key.kind),
-        proto(key.proto)
-    { }
+    void operator=(AllocationSiteKey&& key) {
+        script = mozilla::Move(key.script);
+        offset = key.offset;
+        kind = key.kind;
+        proto = mozilla::Move(key.proto);
+    }
 
     static inline uint32_t hash(AllocationSiteKey key) {
         return uint32_t(size_t(key.script->offsetToPC(key.offset)) ^ key.kind ^

mfbt/Alignment.h

@@ -120,6 +120,13 @@ struct AlignedStorage
 
   const void* addr() const { return u.mBytes; }
   void* addr() { return u.mBytes; }
+
+  AlignedStorage() = default;
+
+  // AlignedStorage is non-copyable: the default copy constructor violates
+  // strict aliasing rules, per bug 1269319.
+  AlignedStorage(const AlignedStorage&) = delete;
+  void operator=(const AlignedStorage&) = delete;
 };
 
 template<typename T>
@@ -133,6 +140,13 @@ struct MOZ_INHERIT_TYPE_ANNOTATIONS_FROM_TEMPLATE_ARGS AlignedStorage2
 
   const T* addr() const { return reinterpret_cast<const T*>(u.mBytes); }
   T* addr() { return static_cast<T*>(static_cast<void*>(u.mBytes)); }
+
+  AlignedStorage2() = default;
+
+  // AlignedStorage2 is non-copyable: the default copy constructor violates
+  // strict aliasing rules, per bug 1269319.
+  AlignedStorage2(const AlignedStorage2&) = delete;
+  void operator=(const AlignedStorage2&) = delete;
 };
 
 } /* namespace mozilla */