Fix 2 UBs, and cleanup GcRefCell

.cargo/config.toml

@@ -4,3 +4,6 @@ rustflags = ['--cfg', 'getrandom_backend="wasm_js"']
 # TODO: track https://github.com/rust-lang/rust/issues/141626 for a resolution
 [target.x86_64-pc-windows-msvc]
 rustflags = ['-Csymbol-mangling-version=v0']
+
+[env]
+MIRIFLAGS = "-Zmiri-tree-borrows"

core/engine/src/builtins/array_buffer/mod.rs

@@ -27,7 +27,7 @@ use crate::{
     context::intrinsics::{Intrinsics, StandardConstructor, StandardConstructors},
     error::JsNativeError,
     js_string,
-    object::{JsObject, Object, internal_methods::get_prototype_from_constructor},
+    object::{JsObject, internal_methods::get_prototype_from_constructor},
     property::Attribute,
     realm::Realm,
     string::StaticJsStrings,
@@ -160,10 +160,7 @@ impl BufferObject {
     #[track_caller]
     pub(crate) fn as_buffer_mut(
         &self,
-    ) -> BufferRefMut<
-        GcRefMut<'_, Object<ArrayBuffer>, ArrayBuffer>,
-        GcRefMut<'_, Object<SharedArrayBuffer>, SharedArrayBuffer>,
-    > {
+    ) -> BufferRefMut<GcRefMut<'_, ArrayBuffer>, GcRefMut<'_, SharedArrayBuffer>> {
         match self {
             Self::Buffer(buf) => {
                 BufferRefMut::Buffer(GcRefMut::map(buf.borrow_mut(), |o| o.data_mut()))

core/engine/src/builtins/date/mod.rs

@@ -1599,7 +1599,7 @@ impl Date {
         let tv = this.to_primitive(context, PreferredType::Number)?;
 
         // 3. If Type(tv) is Number and tv is not finite, return null.
-        if tv.as_number().map(f64::is_finite) == Some(false) {
+        if tv.as_number().is_some_and(|x| !f64::is_finite(x)) {
             return Ok(JsValue::null());
         }
 

core/engine/src/context/icu.rs

@@ -84,7 +84,7 @@ impl IntlProvider {
     ///
     /// Returns an error if any of the tools required cannot be constructed.
     pub(crate) fn try_new_buffer(
-        provider: (impl DynamicDryDataProvider<BufferMarker> + 'static),
+        provider: impl DynamicDryDataProvider<BufferMarker> + 'static,
     ) -> IntlProvider {
         Self {
             locale_canonicalizer: OnceCell::new(),

core/engine/src/interop/into_js_arguments.rs

@@ -1,4 +1,3 @@
-use boa_engine::object::Object;
 use boa_engine::value::TryFromJs;
 use boa_engine::{Context, JsNativeError, JsObject, JsResult, JsValue, NativeObject};
 use boa_gc::{GcRef, GcRefMut};
@@ -265,7 +264,7 @@ impl<T: NativeObject> JsClass<T> {
     ///
     /// Panics if the object is currently mutably borrowed.
     #[must_use]
-    pub fn borrow_mut(&self) -> GcRefMut<'_, Object<T>, T> {
+    pub fn borrow_mut(&self) -> GcRefMut<'_, T> {
         GcRefMut::map(self.inner.borrow_mut(), |obj| obj.data_mut())
     }
 }

core/engine/src/object/builtins/jsarraybuffer.rs

@@ -4,7 +4,7 @@ use crate::{
     builtins::array_buffer::ArrayBuffer,
     context::intrinsics::StandardConstructors,
     error::JsNativeError,
-    object::{JsObject, Object, internal_methods::get_prototype_from_constructor},
+    object::{JsObject, internal_methods::get_prototype_from_constructor},
     value::TryFromJs,
 };
 use boa_gc::{Finalize, GcRef, GcRefMut, Trace};
@@ -283,7 +283,7 @@ impl JsArrayBuffer {
     /// ```
     #[inline]
     #[must_use]
-    pub fn data_mut(&self) -> Option<GcRefMut<'_, Object<ArrayBuffer>, [u8]>> {
+    pub fn data_mut(&self) -> Option<GcRefMut<'_, [u8]>> {
         GcRefMut::try_map(self.inner.borrow_mut(), |o| o.data_mut().bytes_mut())
     }
 }

core/engine/src/object/jsobject.rs

@@ -22,7 +22,7 @@ use crate::{
     property::{PropertyDescriptor, PropertyKey},
     value::PreferredType,
 };
-use boa_gc::{self, Finalize, Gc, GcRefCell, Trace};
+use boa_gc::{self, Finalize, Gc, GcRef, GcRefCell, GcRefMut, Trace};
 use core::ptr::fn_addr_eq;
 use std::collections::HashSet;
 use std::{
@@ -42,10 +42,10 @@ use boa_gc::GcBox;
 use std::ptr::NonNull;
 
 /// A wrapper type for an immutably borrowed type T.
-pub type Ref<'a, T> = boa_gc::GcRef<'a, T>;
+pub type Ref<'a, T> = GcRef<'a, T>;
 
 /// A wrapper type for a mutably borrowed type T.
-pub type RefMut<'a, T, U> = boa_gc::GcRefMut<'a, T, U>;
+pub type RefMut<'a, T> = GcRefMut<'a, T>;
 
 pub(crate) type ErasedVTableObject = VTableObject<ErasedObjectData>;
 
@@ -54,7 +54,7 @@ pub type ErasedObject = Object<ErasedObjectData>;
 
 /// A erased object data type that must never be used directly.
 #[derive(Debug, Trace, Finalize)]
-pub enum ErasedObjectData {}
+pub struct ErasedObjectData {}
 
 impl JsData for ErasedObjectData {}
 
@@ -250,7 +250,7 @@ impl JsObject {
             let obj = self.borrow();
 
             // SAFETY: We have verified that the object is of type `T`, so we can safely cast it.
-            let obj = unsafe { obj.cast::<Object<T>>() };
+            let obj = unsafe { GcRef::cast::<Object<T>>(obj) };
 
             return Some(Ref::map(obj, |r| r.data()));
         }
@@ -265,12 +265,12 @@ impl JsObject {
     /// Panics if the object is currently borrowed.
     #[must_use]
     #[track_caller]
-    pub fn downcast_mut<T: NativeObject>(&self) -> Option<RefMut<'_, ErasedObject, T>> {
+    pub fn downcast_mut<T: NativeObject>(&self) -> Option<RefMut<'_, T>> {
         if self.is::<T>() {
             let obj = self.borrow_mut();
 
             // SAFETY: We have verified that the object is of type `T`, so we can safely cast it.
-            let obj = unsafe { obj.cast::<Object<T>>() };
+            let obj = unsafe { GcRefMut::cast::<Object<T>>(obj) };
 
             return Some(RefMut::map(obj, |c| c.data_mut()));
         }
@@ -676,7 +676,7 @@ impl<T: NativeObject> JsObject<T> {
     #[inline]
     #[must_use]
     #[track_caller]
-    pub fn borrow_mut(&self) -> RefMut<'_, Object<T>, Object<T>> {
+    pub fn borrow_mut(&self) -> RefMut<'_, Object<T>> {
         self.try_borrow_mut().expect("Object already borrowed")
     }
 
@@ -698,7 +698,7 @@ impl<T: NativeObject> JsObject<T> {
     ///
     /// This is the non-panicking variant of [`borrow_mut`](#method.borrow_mut).
     #[inline]
-    pub fn try_borrow_mut(&self) -> StdResult<RefMut<'_, Object<T>, Object<T>>, BorrowMutError> {
+    pub fn try_borrow_mut(&self) -> StdResult<RefMut<'_, Object<T>>, BorrowMutError> {
         self.inner
             .object
             .try_borrow_mut()

core/engine/src/value/mod.rs

@@ -776,7 +776,7 @@ impl JsValue {
         }
 
         // 8. If f is odd, return 𝔽(f + 1).
-        if f as u8 % 2 != 0 {
+        if !(f as u8).is_multiple_of(2) {
             return Ok(f as u8 + 1);
         }