Bug 1294732 - Back out all of bug 1271165 as it has served its purpos…

…e. r=glandium

js/public/Utility.h

@@ -48,12 +48,6 @@ JS_Assert(const char* s, const char* file, int ln);
 # include "jscustomallocator.h"
 #else
 
-#include "mozilla/Types.h"
-MOZ_BEGIN_EXTERN_C
-MFBT_API void malloc_protect(void* ptr, uint32_t* id);
-MFBT_API void malloc_unprotect(void* ptr, uint32_t* id);
-MOZ_END_EXTERN_C
-
 namespace js {
 namespace oom {
 
@@ -263,63 +257,6 @@ static inline void js_free(void* p)
     free(p);
 }
 
-/*
- * js_malloc_protect marks the region referenced by |ptr| as protected in
- * jemalloc by a unique ID. As a result, the region cannot be modified through
- * calls to allocation functions (realloc and free). Note that this only
- * protects against access through jemalloc - the memory can still be written
- * to by anyone.
- */
-static inline void js_malloc_protect(void* ptr, uint32_t* id)
-{
-    malloc_protect(ptr, id);
-}
-
-/*
- * js_malloc_unprotect must be called with the correct ID to release a
- * protected region before anyone can modify it. The |_protected| allocation
- * functions below automate this process of protecting and unprotecting memory.
- */
-static inline void js_malloc_unprotect(void* ptr, uint32_t* id)
-{
-    malloc_unprotect(ptr, id);
-}
-
-static inline void* js_malloc_protected(size_t bytes, uint32_t* id)
-{
-    void* ret = js_malloc(bytes);
-    js_malloc_protect(ret, id);
-    return ret;
-}
-
-static inline void* js_calloc_protected(size_t bytes, uint32_t* id)
-{
-    void* ret = js_calloc(bytes);
-    js_malloc_protect(ret, id);
-    return ret;
-}
-
-static inline void* js_calloc_protected(size_t nmemb, size_t size, uint32_t* id)
-{
-    void* ret = js_calloc(nmemb, size);
-    js_malloc_protect(ret, id);
-    return ret;
-}
-
-static inline void* js_realloc_protected(void* p, size_t bytes, uint32_t* id)
-{
-    js_malloc_unprotect(p, id);
-    void* ret = js_realloc(p, bytes);
-    js_malloc_protect(ret ? ret : p, id);
-    return ret;
-}
-
-static inline void js_free_protected(void* p, uint32_t* id)
-{
-    js_malloc_unprotect(p, id);
-    js_free(p);
-}
-
 static inline char* js_strdup(const char* s)
 {
     JS_OOM_POSSIBLY_FAIL();
@@ -504,34 +441,6 @@ js_pod_realloc(T* prior, size_t oldSize, size_t newSize)
     return static_cast<T*>(js_realloc(prior, bytes));
 }
 
-template <class T>
-static MOZ_ALWAYS_INLINE T*
-js_pod_malloc_protected(size_t numElems, uint32_t* id)
-{
-    T* ret = js_pod_malloc<T>(numElems);
-    js_malloc_protect(ret, id);
-    return ret;
-}
-
-template <class T>
-static MOZ_ALWAYS_INLINE T*
-js_pod_calloc_protected(size_t numElems, uint32_t* id)
-{
-    T* ret = js_pod_calloc<T>(numElems);
-    js_malloc_protect(ret, id);
-    return ret;
-}
-
-template <class T>
-static MOZ_ALWAYS_INLINE T*
-js_pod_realloc_protected(T* prior, size_t oldSize, size_t newSize, uint32_t* id)
-{
-    js_malloc_unprotect(prior, id);
-    T* ret = js_pod_realloc<T>(prior, oldSize, newSize);
-    js_malloc_protect(ret ? ret : prior, id);
-    return ret;
-}
-
 namespace js {
 
 template<typename T>

js/src/jit/JitAllocPolicy.h

@@ -14,11 +14,9 @@
 
 #include "jscntxt.h"
 
-#include "ds/InlineTable.h"
 #include "ds/LifoAlloc.h"
 #include "jit/InlineList.h"
 #include "jit/Ion.h"
-#include "js/Utility.h"
 
 namespace js {
 namespace jit {
@@ -134,89 +132,6 @@ class JitAllocPolicy
     }
 };
 
-/*
- * A policy for using system memory functions that protects against
- * realloc-after-free and free-after-free from unrelated locations.
- */
-class ProtectedSystemAllocPolicy
-{
-    InlineMap<void*, uint32_t, 2, DefaultHasher<void*>, SystemAllocPolicy> allocIDs;
-
-  public:
-    ProtectedSystemAllocPolicy() {}
-
-    /*
-     * While possible, copying protected allocations would defeat the purpose
-     * of this policy, so we only allow copy-constructing from vanilla policies.
-     */
-    ProtectedSystemAllocPolicy(const ProtectedSystemAllocPolicy& that) {
-        MOZ_RELEASE_ASSERT(that.allocIDs.empty());
-    }
-
-    ~ProtectedSystemAllocPolicy() { MOZ_RELEASE_ASSERT(allocIDs.empty()); }
-
-    template <typename T> T* maybe_pod_malloc(size_t numElems) {
-        uint32_t allocID;
-        T* ret = js_pod_malloc_protected<T>(numElems, &allocID);
-        if (ret) {
-            AutoEnterOOMUnsafeRegion oomUnsafe;
-            if (!allocIDs.put(ret, allocID))
-                oomUnsafe.crash("Failed to store allocation ID.");
-        }
-        return ret;
-    }
-
-    template <typename T> T* maybe_pod_calloc(size_t numElems) {
-        uint32_t allocID;
-        T* ret = js_pod_calloc_protected<T>(numElems, &allocID);
-        if (ret) {
-            AutoEnterOOMUnsafeRegion oomUnsafe;
-            if (!allocIDs.put(ret, allocID))
-                oomUnsafe.crash("Failed to store allocation ID.");
-        }
-        return ret;
-    }
-
-    template <typename T> T* maybe_pod_realloc(T* p, size_t oldSize, size_t newSize) {
-        uint32_t allocID = 0;
-        if (p) {
-            auto entry = allocIDs.lookup(p);
-            MOZ_RELEASE_ASSERT(entry.found());
-            allocID = entry->value();
-            allocIDs.remove(entry);
-        }
-        T* ret = js_pod_realloc_protected<T>(p, oldSize, newSize, &allocID);
-        if (ret || p) {
-            AutoEnterOOMUnsafeRegion oomUnsafe;
-            if (!allocIDs.put(ret ? ret : p, allocID))
-                oomUnsafe.crash("Failed to store allocation ID.");
-        }
-        return ret;
-    }
-
-    template <typename T> T* pod_malloc(size_t numElems) { return maybe_pod_malloc<T>(numElems); }
-    template <typename T> T* pod_calloc(size_t numElems) { return maybe_pod_calloc<T>(numElems); }
-    template <typename T> T* pod_realloc(T* p, size_t oldSize, size_t newSize) {
-        return maybe_pod_realloc<T>(p, oldSize, newSize);
-    }
-
-    void free_(void* p) {
-        uint32_t allocID = 0;
-        if (p) {
-            auto entry = allocIDs.lookup(p);
-            MOZ_RELEASE_ASSERT(entry.found());
-            allocID = entry->value();
-            allocIDs.remove(entry);
-        }
-        js_free_protected(p, &allocID);
-    }
-
-    void reportAllocOverflow() const {}
-    MOZ_MUST_USE bool checkSimulatedOOM() const {
-        return !js::oom::ShouldFailWithOOM();
-    }
-};
-
 class AutoJitContextAlloc
 {
     TempAllocator tempAlloc_;

js/src/jit/x86-shared/AssemblerBuffer-x86-shared.h

@@ -35,7 +35,6 @@
 
 #include "ds/PageProtectingVector.h"
 #include "jit/ExecutableAllocator.h"
-#include "jit/JitAllocPolicy.h"
 #include "jit/JitSpewer.h"
 
 // Spew formatting helpers.
@@ -170,7 +169,7 @@ namespace jit {
             m_buffer.clear();
         }
 
-        PageProtectingVector<unsigned char, 256, ProtectedSystemAllocPolicy> m_buffer;
+        PageProtectingVector<unsigned char, 256, SystemAllocPolicy> m_buffer;
         bool m_oom;
     };
 

memory/build/malloc_decls.h

@@ -25,16 +25,13 @@ typedef MALLOC_USABLE_SIZE_CONST_PTR void * usable_ptr_t;
 #  define MALLOC_FUNCS_JEMALLOC 2
 #  define MALLOC_FUNCS_INIT 4
 #  define MALLOC_FUNCS_BRIDGE 8
-#  define MALLOC_FUNCS_EXTRA 16
 #  define MALLOC_FUNCS_ALL (MALLOC_FUNCS_INIT | MALLOC_FUNCS_BRIDGE | \
-                            MALLOC_FUNCS_MALLOC | MALLOC_FUNCS_JEMALLOC | \
-                            MALLOC_FUNCS_EXTRA)
+                            MALLOC_FUNCS_MALLOC | MALLOC_FUNCS_JEMALLOC)
 
 #endif /* malloc_decls_h */
 
 #ifndef MALLOC_FUNCS
-#  define MALLOC_FUNCS (MALLOC_FUNCS_MALLOC | MALLOC_FUNCS_JEMALLOC | \
-                        MALLOC_FUNCS_EXTRA)
+#  define MALLOC_FUNCS (MALLOC_FUNCS_MALLOC | MALLOC_FUNCS_JEMALLOC)
 #endif
 
 #ifdef MALLOC_DECL
@@ -60,10 +57,6 @@ MALLOC_DECL(valloc, void *, size_t)
 MALLOC_DECL(malloc_usable_size, size_t, usable_ptr_t)
 MALLOC_DECL(malloc_good_size, size_t, size_t)
 #  endif
-#  if MALLOC_FUNCS & MALLOC_FUNCS_EXTRA
-MALLOC_DECL_VOID(malloc_protect, void *, uint32_t *)
-MALLOC_DECL_VOID(malloc_unprotect, void *, uint32_t *)
-#  endif
 #  if MALLOC_FUNCS & MALLOC_FUNCS_JEMALLOC
 MALLOC_DECL_VOID(jemalloc_stats, jemalloc_stats_t *)
 MALLOC_DECL_VOID(jemalloc_purge_freed_pages, void)

memory/build/mozjemalloc_compat.c

@@ -71,25 +71,7 @@
 #  define VARIABLE_ARRAY(type, name, count) type name[(count)]
 #endif
 
-MFBT_API void
-malloc_protect_impl(void *ptr, uint32_t *id)
-{
-  if (ptr)
-    *id = 1;
-}
-
-MFBT_API void
-malloc_unprotect_impl(void *ptr, uint32_t *id)
-{
-  *id = 0;
-}
-
-#if defined(MOZ_MEMORY_DARWIN) && !defined(MOZ_REPLACE_MALLOC)
-static inline
-#else
-MOZ_MEMORY_API
-#endif
-size_t
+MOZ_MEMORY_API size_t
 malloc_good_size_impl(size_t size)
 {
   /* je_nallocx crashes when given a size of 0. As

memory/build/mozmemory_wrap.c

@@ -12,20 +12,6 @@
   MOZ_MEMORY_API return_type name ## _impl(__VA_ARGS__);
 #include "malloc_decls.h"
 
-#ifdef XP_DARWIN
-MFBT_API void
-malloc_protect(void* ptr, uint32_t* id)
-{
-  malloc_protect_impl(ptr, id);
-}
-
-MFBT_API void
-malloc_unprotect(void* ptr, uint32_t* id)
-{
-  malloc_unprotect_impl(ptr, id);
-}
-#endif
-
 #ifdef MOZ_WRAP_NEW_DELETE
 /* operator new(unsigned int) */
 MOZ_MEMORY_API void *

memory/build/mozmemory_wrap.h

@@ -21,8 +21,6 @@
  *   - free
  *   - memalign
  *   - valloc
- *   - malloc_protect
- *   - malloc_unprotect
  *   - malloc_usable_size
  *   - malloc_good_size
  *   Some of these functions are specific to some systems, but for
@@ -194,20 +192,9 @@
 #define free_impl                mozmem_malloc_impl(free)
 #define memalign_impl            mozmem_malloc_impl(memalign)
 #define valloc_impl              mozmem_malloc_impl(valloc)
-#define malloc_protect_impl      mozmem_malloc_impl(malloc_protect)
-#define malloc_unprotect_impl    mozmem_malloc_impl(malloc_unprotect)
 #define malloc_usable_size_impl  mozmem_malloc_impl(malloc_usable_size)
 #define malloc_good_size_impl    mozmem_malloc_impl(malloc_good_size)
 
-#ifdef XP_DARWIN
-MOZ_BEGIN_EXTERN_C
-
-MFBT_API void malloc_protect(void* ptr, uint32_t* id);
-MFBT_API void malloc_unprotect(void* ptr, uint32_t* id);
-
-MOZ_END_EXTERN_C
-#endif
-
 /* Duplication functions */
 #define strndup_impl   mozmem_dup_impl(strndup)
 #define strdup_impl    mozmem_dup_impl(strdup)

memory/build/replace_malloc.c

@@ -113,11 +113,6 @@ replace_malloc_init_funcs()
 #define MALLOC_FUNCS MALLOC_FUNCS_MALLOC
 #include "malloc_decls.h"
 
-#define MALLOC_DECL(name, return_type, ...) \
-  MFBT_API return_type name ## _impl(__VA_ARGS__);
-#define MALLOC_FUNCS MALLOC_FUNCS_EXTRA
-#include "malloc_decls.h"
-
 #define MALLOC_DECL(name, return_type, ...) \
   MOZ_JEMALLOC_API return_type name ## _impl(__VA_ARGS__);
 #define MALLOC_FUNCS MALLOC_FUNCS_JEMALLOC
@@ -228,28 +223,6 @@ valloc_impl(size_t size)
   return replace_valloc(size);
 }
 
-void
-malloc_protect_impl(void* ptr, uint32_t* id)
-{
-  if (MOZ_UNLIKELY(!replace_malloc_initialized))
-    init();
-  if (MOZ_LIKELY(!replace_malloc_protect))
-    je_malloc_protect(ptr, id);
-  else
-    replace_malloc_protect(ptr, id);
-}
-
-void
-malloc_unprotect_impl(void* ptr, uint32_t* id)
-{
-  if (MOZ_UNLIKELY(!replace_malloc_initialized))
-    init();
-  if (MOZ_LIKELY(!replace_malloc_unprotect))
-    je_malloc_unprotect(ptr, id);
-  else
-    replace_malloc_unprotect(ptr, id);
-}
-
 size_t
 malloc_usable_size_impl(usable_ptr_t ptr)
 {