RootedGuard<T> construction related unsoundness

mozjs-sys/src/jsimpls.rs

@@ -404,12 +404,12 @@ impl JSNativeWrapper {
 }
 
 impl RootedBase {
-    unsafe fn add_to_root_stack(&mut self, cx: *mut JSContext, kind: JS::RootKind) {
+    unsafe fn add_to_root_stack(this: *mut Self, cx: *mut JSContext, kind: JS::RootKind) {
         let stack = Self::get_root_stack(cx, kind);
-        self.stack = stack;
-        self.prev = *stack;
+        (*this).stack = stack;
+        (*this).prev = *stack;
 
-        *stack = self as *mut _ as usize as _;
+        *stack = this as usize as _;
     }
 
     unsafe fn remove_from_root_stack(&mut self) {
@@ -440,8 +440,9 @@ impl<T: RootKind> JS::Rooted<T> {
         }
     }
 
-    pub unsafe fn add_to_root_stack(&mut self, cx: *mut JSContext) {
-        self.base.add_to_root_stack(cx, T::KIND)
+    pub unsafe fn add_to_root_stack(this: *mut Self, cx: *mut JSContext) {
+        let base = unsafe { &raw mut (*this).base };
+        RootedBase::add_to_root_stack(base, cx, T::KIND)
     }
 
     pub unsafe fn remove_from_root_stack(&mut self) {

mozjs/src/conversions.rs

@@ -45,6 +45,7 @@ use crate::rust::{HandleValue, MutableHandleValue};
 use crate::rust::{ToBoolean, ToInt32, ToInt64, ToNumber, ToUint16, ToUint32, ToUint64};
 use libc;
 use log::debug;
+use mozjs_sys::jsgc::Rooted;
 use std::borrow::Cow;
 use std::mem;
 use std::rc::Rc;
@@ -664,7 +665,7 @@ struct ForOfIteratorGuard<'a> {
 impl<'a> ForOfIteratorGuard<'a> {
     fn new(cx: *mut JSContext, root: &'a mut ForOfIterator) -> Self {
         unsafe {
-            root.iterator.add_to_root_stack(cx);
+            Rooted::add_to_root_stack(&raw mut root.iterator, cx);
         }
         ForOfIteratorGuard { root }
     }

mozjs/src/gc/root.rs

@@ -21,16 +21,21 @@ use mozjs_sys::jsgc::ValueArray;
     crown::unrooted_must_root_lint::allow_unrooted_interior
 )]
 pub struct RootedGuard<'a, T: 'a + RootKind> {
-    root: &'a mut Rooted<T>,
+    root: *mut Rooted<T>,
+    anchor: PhantomData<&'a mut Rooted<T>>,
 }
 
 impl<'a, T: 'a + RootKind> RootedGuard<'a, T> {
     pub fn new(cx: *mut JSContext, root: &'a mut Rooted<T>, initial: T) -> Self {
         root.ptr.write(initial);
         unsafe {
-            root.add_to_root_stack(cx);
+            let root: *mut Rooted<T> = root;
+            Rooted::add_to_root_stack(root, cx);
+            RootedGuard {
+                root,
+                anchor: PhantomData,
+            }
         }
-        RootedGuard { root }
     }
 
     pub fn handle(&'a self) -> Handle<'a, T> {
@@ -46,31 +51,31 @@ impl<'a, T: 'a + RootKind> RootedGuard<'a, T> {
         T: Copy,
     {
         // SAFETY: The rooted value is initialized as long as we exist
-        unsafe { self.root.ptr.assume_init() }
+        unsafe { (*self.root).ptr.assume_init() }
     }
 
     pub fn set(&mut self, v: T) {
         // SAFETY: The rooted value is initialized as long as we exist
         unsafe {
             // Make sure the drop impl for T is called
-            self.root.ptr.assume_init_drop()
+            (*self.root).ptr.assume_init_drop();
+            (*self.root).ptr.write(v);
         }
-        self.root.ptr.write(v);
     }
 }
 
 impl<'a, T: 'a + RootKind> Deref for RootedGuard<'a, T> {
     type Target = T;
     fn deref(&self) -> &T {
         // SAFETY: The rooted value is initialized as long as we exist
-        unsafe { self.root.ptr.assume_init_ref() }
+        unsafe { (*self.root).ptr.assume_init_ref() }
     }
 }
 
 impl<'a, T: 'a + RootKind> DerefMut for RootedGuard<'a, T> {
     fn deref_mut(&mut self) -> &mut T {
         // SAFETY: The rooted value is initialized as long as we exist
-        unsafe { self.root.ptr.assume_init_mut() }
+        unsafe { (*self.root).ptr.assume_init_mut() }
     }
 }
 
@@ -79,19 +84,19 @@ impl<'a, T: 'a + RootKind> Drop for RootedGuard<'a, T> {
         // SAFETY: The rooted value is initialized as long as we exist
         unsafe {
             // Make sure the drop impl for T is called
-            self.root.ptr.assume_init_drop()
+            (*self.root).ptr.assume_init_drop();
+            (*self.root).ptr = MaybeUninit::zeroed();
         }
-        self.root.ptr = MaybeUninit::zeroed();
 
         unsafe {
-            self.root.remove_from_root_stack();
+            (*self.root).remove_from_root_stack();
         }
     }
 }
 
 impl<'a, const N: usize> From<&RootedGuard<'a, ValueArray<N>>> for JS::HandleValueArray {
     fn from(array: &RootedGuard<'a, ValueArray<N>>) -> JS::HandleValueArray {
-        JS::HandleValueArray::from(&*array.root)
+        JS::HandleValueArray::from(unsafe { &*array.root })
     }
 }