Bug 1309552 - Specify buffer size when freeing data in AllocPolicy, r=waldo.

--HG--
extra : rebase_source : f4e2d9f8831cf41c19d592ce252e87161f32250b

js/public/AllocPolicy.h

@@ -40,7 +40,7 @@ class SystemAllocPolicy
     template <typename T> T* pod_realloc(T* p, size_t oldSize, size_t newSize) {
         return maybe_pod_realloc<T>(p, oldSize, newSize);
     }
-    void free_(void* p) { js_free(p); }
+    template <typename T> void free_(T* p, size_t numElems = 0) { js_free(p); }
     void reportAllocOverflow() const {}
     bool checkSimulatedOOM() const {
         return !js::oom::ShouldFailWithOOM();
@@ -119,7 +119,8 @@ class TempAllocPolicy
         return p2;
     }
 
-    void free_(void* p) {
+    template <typename T>
+    void free_(T* p, size_t numElems = 0) {
         js_free(p);
     }
 
@@ -161,7 +162,7 @@ class ZoneAllocPolicy
     template <typename T> inline T* pod_calloc(size_t numElems);
     template <typename T> inline T* pod_realloc(T* p, size_t oldSize, size_t newSize);
 
-    void free_(void* p) { js_free(p); }
+    template <typename T> void free_(T* p, size_t numElems = 0) { js_free(p); }
     void reportAllocOverflow() const {}
 
     MOZ_MUST_USE bool checkSimulatedOOM() const {

js/public/HashTable.h

@@ -1319,7 +1319,7 @@ class HashTable : private AllocPolicy
         Entry* end = oldTable + capacity;
         for (Entry* e = oldTable; e < end; ++e)
             e->~Entry();
-        alloc.free_(oldTable);
+        alloc.free_(oldTable, capacity);
     }
 
   public:
@@ -1587,7 +1587,7 @@ class HashTable : private AllocPolicy
         }
 
         // All entries have been destroyed, no need to destroyTable.
-        this->free_(oldTable);
+        this->free_(oldTable, oldCap);
         return Rehashed;
     }
 

js/src/ds/LifoAlloc.h

@@ -1033,7 +1033,8 @@ class LifoAllocPolicy
     T* pod_realloc(T* p, size_t oldSize, size_t newSize) {
         return maybe_pod_realloc<T>(p, oldSize, newSize);
     }
-    void free_(void* p) {
+    template <typename T>
+    void free_(T* p, size_t numElems) {
     }
     void reportAllocOverflow() const {
     }

js/src/ds/OrderedHashTable.h

@@ -124,7 +124,7 @@ class OrderedHashTable
         uint32_t capacity = uint32_t(buckets * fillFactor());
         Data* dataAlloc = alloc.template pod_malloc<Data>(capacity);
         if (!dataAlloc) {
-            alloc.free_(tableAlloc);
+            alloc.free_(tableAlloc, buckets);
             return false;
         }
 
@@ -142,8 +142,8 @@ class OrderedHashTable
 
     ~OrderedHashTable() {
         forEachRange<Range::onTableDestroyed>();
-        alloc.free_(hashTable);
-        freeData(data, dataLength);
+        alloc.free_(hashTable, hashBuckets());
+        freeData(data, dataLength, dataCapacity);
     }
 
     /* Return the number of elements in the table. */
@@ -248,7 +248,9 @@ class OrderedHashTable
         if (dataLength != 0) {
             Data** oldHashTable = hashTable;
             Data* oldData = data;
+            uint32_t oldHashBuckets = hashBuckets();
             uint32_t oldDataLength = dataLength;
+            uint32_t oldDataCapacity = dataCapacity;
 
             hashTable = nullptr;
             if (!init()) {
@@ -257,8 +259,8 @@ class OrderedHashTable
                 return false;
             }
 
-            alloc.free_(oldHashTable);
-            freeData(oldData, oldDataLength);
+            alloc.free_(oldHashTable, oldHashBuckets);
+            freeData(oldData, oldDataLength, oldDataCapacity);
             forEachRange<&Range::onClear>();
         }
 
@@ -630,9 +632,9 @@ class OrderedHashTable
             (--p)->~Data();
     }
 
-    void freeData(Data* data, uint32_t length) {
+    void freeData(Data* data, uint32_t length, uint32_t capacity) {
         destroyData(data, length);
-        alloc.free_(data);
+        alloc.free_(data, capacity);
     }
 
     Data* lookup(const Lookup& l, HashNumber h) {
@@ -704,7 +706,7 @@ class OrderedHashTable
         uint32_t newCapacity = uint32_t(newHashBuckets * fillFactor());
         Data* newData = alloc.template pod_malloc<Data>(newCapacity);
         if (!newData) {
-            alloc.free_(newHashTable);
+            alloc.free_(newHashTable, newHashBuckets);
             return false;
         }
 
@@ -720,8 +722,8 @@ class OrderedHashTable
         }
         MOZ_ASSERT(wp == newData + liveCount);
 
-        alloc.free_(hashTable);
-        freeData(data, dataLength);
+        alloc.free_(hashTable, hashBuckets());
+        freeData(data, dataLength, dataCapacity);
 
         hashTable = newHashTable;
         data = newData;

js/src/jit/JitAllocPolicy.h

@@ -124,7 +124,8 @@ class JitAllocPolicy
     T* pod_realloc(T* ptr, size_t oldSize, size_t newSize) {
         return maybe_pod_realloc<T>(ptr, oldSize, newSize);
     }
-    void free_(void* p) {
+    template <typename T>
+    void free_(T* p, size_t numElems = 0) {
     }
     void reportAllocOverflow() const {
     }

memory/mozalloc/mozalloc.h

@@ -244,7 +244,8 @@ public:
         return static_cast<T*>(moz_xrealloc(aPtr, aNewSize * sizeof(T)));
     }
 
-    void free_(void* aPtr)
+    template <typename T>
+    void free_(T* aPtr, size_t aNumElems = 0)
     {
         free_impl(aPtr);
     }

memory/replace/dmd/DMD.cpp

@@ -186,7 +186,8 @@ public:
     return p;
   }
 
-  static void free_(void* aPtr) { gMallocTable.free(aPtr); }
+  template <typename T>
+  static void free_(T* aPtr, size_t aSize = 0) { gMallocTable.free(aPtr); }
 
   static char* strdup_(const char* aStr)
   {

mfbt/AllocPolicy.h

@@ -42,7 +42,11 @@ namespace mozilla {
  *  - template <typename T> T* pod_realloc(T*, size_t, size_t)
  *      Responsible for OOM reporting when null is returned.  The old allocation
  *      size is passed in, in addition to the new allocation size requested.
- *  - void free_(void*)
+ *  - template <typename T> void free_(T*, size_t)
+ *      The capacity passed in must match the old allocation size.
+ *  - template <typename T> void free_(T*)
+ *      Frees a buffer without knowing its allocated size. This might not be
+ *      implemented by allocation policies that need the allocation size.
  *  - void reportAllocOverflow() const
  *      Called on allocation overflow (that is, an allocation implicitly tried
  *      to allocate more than the available memory space -- think allocating an
@@ -114,7 +118,8 @@ public:
     return maybe_pod_realloc<T>(aPtr, aOldSize, aNewSize);
   }
 
-  void free_(void* aPtr)
+  template <typename T>
+  void free_(T* aPtr, size_t aNumElems = 0)
   {
     free(aPtr);
   }
@@ -175,7 +180,8 @@ public:
     MOZ_CRASH("NeverAllocPolicy::pod_realloc");
   }
 
-  void free_(void* aPtr)
+  template <typename T>
+  void free_(T* aPtr, size_t aNumElems = 0)
   {
     MOZ_CRASH("NeverAllocPolicy::free_");
   }

mfbt/BufferList.h

@@ -151,7 +151,7 @@ class BufferList : private AllocPolicy
   {
     if (mOwning) {
       for (Segment& segment : mSegments) {
-        this->free_(segment.mData);
+        this->free_(segment.mData, segment.mCapacity);
       }
     }
     mSegments.clear();
@@ -367,7 +367,7 @@ class BufferList : private AllocPolicy
     MOZ_ASSERT(mOwning);
 
     if (!mSegments.append(Segment(aData, aSize, aCapacity))) {
-      this->free_(aData);
+      this->free_(aData, aCapacity);
       return nullptr;
     }
     mSize += aSize;
@@ -394,7 +394,7 @@ private:
       return nullptr;
     }
     if (!mSegments.append(Segment(data, aSize, aCapacity))) {
-      this->free_(data);
+      this->free_(data, aCapacity);
       return nullptr;
     }
     mSize += aSize;

mfbt/SegmentedVector.h

@@ -192,7 +192,7 @@ public:
     Segment* segment;
     while ((segment = mSegments.popFirst())) {
       segment->~Segment();
-      this->free_(segment);
+      this->free_(segment, 1);
     }
   }
 
@@ -218,7 +218,7 @@ public:
     if (!last->Length()) {
       mSegments.popLast();
       last->~Segment();
-      this->free_(last);
+      this->free_(last, 1);
     }
   }
 
@@ -251,7 +251,7 @@ public:
       // Destroying the segment destroys all elements contained therein.
       mSegments.popLast();
       last->~Segment();
-      this->free_(last);
+      this->free_(last, 1);
 
       MOZ_ASSERT(aNumElements >= segmentLen);
       aNumElements -= segmentLen;

mfbt/Vector.h

@@ -144,7 +144,7 @@ struct VectorImpl
       new_(dst, std::move(*src));
     }
     VectorImpl::destroy(aV.beginNoCheck(), aV.endNoCheck());
-    aV.free_(aV.mBegin);
+    aV.free_(aV.mBegin, aV.mTail.mCapacity);
     aV.mBegin = newbuf;
     /* aV.mLength is unchanged. */
     aV.mTail.mCapacity = aNewCap;
@@ -244,7 +244,7 @@ struct VectorImpl<T, N, AP, true>
       return;
     }
     if (!aV.mLength) {
-      aV.free_(aV.mBegin);
+      aV.free_(aV.mBegin, aV.mTail.mCapacity);
       aV.mBegin = aV.inlineStorage();
       aV.mTail.mCapacity = aV.kInlineCapacity;
 #ifdef DEBUG
@@ -927,7 +927,7 @@ Vector<T, N, AP>::~Vector()
   MOZ_REENTRANCY_GUARD_ET_AL;
   Impl::destroy(beginNoCheck(), endNoCheck());
   if (!usingInlineStorage()) {
-    this->free_(beginNoCheck());
+    this->free_(beginNoCheck(), mTail.mCapacity);
   }
 }
 
@@ -1238,7 +1238,7 @@ Vector<T, N, AP>::clearAndFree()
   if (usingInlineStorage()) {
     return;
   }
-  this->free_(beginNoCheck());
+  this->free_(beginNoCheck(), mTail.mCapacity);
   mBegin = inlineStorage();
   mTail.mCapacity = kInlineCapacity;
 #ifdef DEBUG
@@ -1511,7 +1511,7 @@ Vector<T, N, AP>::replaceRawBuffer(T* aP, size_t aLength, size_t aCapacity)
   /* Destroy what we have. */
   Impl::destroy(beginNoCheck(), endNoCheck());
   if (!usingInlineStorage()) {
-    this->free_(beginNoCheck());
+    this->free_(beginNoCheck(), mTail.mCapacity);
   }
 
   /* Take in the new buffer. */
@@ -1526,7 +1526,7 @@ Vector<T, N, AP>::replaceRawBuffer(T* aP, size_t aLength, size_t aCapacity)
     mTail.mCapacity = kInlineCapacity;
     Impl::moveConstruct(mBegin, aP, aP + aLength);
     Impl::destroy(aP, aP + aLength);
-    this->free_(aP);
+    this->free_(aP, aCapacity);
   } else {
     mBegin = aP;
     mLength = aLength;

mfbt/tests/TestBufferList.cpp

@@ -26,7 +26,8 @@ public:
     return rv;
   }
 
-  void free_(void* aPtr) { free(aPtr); }
+  template <typename T>
+  void free_(T* aPtr, size_t aNumElems = 0) { free(aPtr); }
 
   void reportAllocOverflow() const {}
 

mfbt/tests/TestSegmentedVector.cpp

@@ -31,7 +31,8 @@ public:
     return rv;
   }
 
-  void free_(void* aPtr) { free(aPtr); }
+  template <typename T>
+  void free_(T* aPtr, size_t aNumElems = 0) { free(aPtr); }
 };
 
 // We want to test Append(), which is fallible and marked with

mozglue/misc/Printf.h

@@ -165,11 +165,13 @@ class MOZ_STACK_CLASS SprintfState final : private mozilla::PrintfTarget, privat
         if (off + len >= mMaxlen) {
             /* Grow the buffer */
             newlen = mMaxlen + ((len > 32) ? len : 32);
-            newbase = static_cast<char*>(this->maybe_pod_realloc(mBase, mMaxlen, newlen));
+            newbase = this->template maybe_pod_malloc<char>(newlen);
             if (!newbase) {
                 /* Ran out of memory */
                 return false;
             }
+            memcpy(newbase, mBase, mMaxlen);
+            this->free_(mBase);
             mBase = newbase;
             mMaxlen = newlen;
             mCur = mBase + off;