[meta] Safety from ground up

[sagudev]

Meta issue based on plan outlined in #638

• use known list of GC functions Add safe JSContext wrapper with strict safety rules #638 (comment): Rewrite wrapper generators file to python and mark noGC functions using artifacts from hazard analysis reports #649
• Create safe realm wrappers #650
• start using and passing down this new JSContext everywhere in servo (this will also replace can_gc effort) and use wrappers2
• write some more wrappers mainly we need one for js_str stuff, to_jsval, RootingGuard, ...
• Handles/Roots would use NoGC to create & of inner data
• DomRefCell would also take NoGC on borrow, borrow_mut to prevent borrows across GC.
• I think we could also write part of unrooted with this, when creating unrooted value it would have 'cx lifetime (bounded to cx) and rooting would erase the lifetime (make it 'static thus unbound it from cx).
  • Something like this is already presented in https://github.com/asajeffrey/josephine
  • The biggest problems are return values, which also need to be bounded. This will require some additional work in mozjs

[sagudev]

though: What if we disable GC in some sections of code (and forbid providing &mut JSContext)? This would allow us to use &mut in more places in servo (and thus) avoid interior mut. The only problematic part is reenterancy, but anything that can trigger reeneterant needs to take &mut JSContext anyway, so there is no real problem. The question is do we really want to decide on our own when to run GC (because we would reduce amount of opportunities it could run)? Probably not, and let's just keep this SMs problem.

Anyway this brings me to my second though: every lambda in gecko is marked as can gc. For us we can say that each lambda is effectively NoGC, except if it takes &mut JSContext as argument. We need to somehow more rigidly approach/enforce this.