Fix the sandbox use case and add a test. (#269)

Summary of changes:

- Add a new PAL that doesn't allocate memory, which can be used with a
  memory provider that is pre-initialised with a range of memory.
- Add a `NoAllocation` PAL property so that the methods on a PAL that 
  doesn't support dynamically reserving address space will never be
  called and therefore don't need to be implemented.
- Slightly refactor the memory provider class so that it has a narrower
  interface with LargeAlloc and is easier to proxy.
- Allow the address space manager and the memory provider to be
  initialised with a range of memory.

This may eventually also remove the need for (or, at least, simplify)
the Open Enclave PAL.

This commit also ends up with a few other cleanups:

 - The `malloc_useable_size` CMake test that checks whether the
   parameter is const qualified was failing on FreeBSD where this
   function is declared in `malloc_np.h` but where including
   `malloc.h` raises an error.  This should now be more robust.
 - The BSD aligned PAL inherited from the BSD PAL, which does not
   expose aligned allocation. This meant that it exposed both the
   aligned and non-aligned allocation interfaces and so happily
   accepted incorrect `constexpr` if blocks that expected one or 
   the other but accidentally required both to exist. The unaligned
   function is now deleted so the same failures that appear in CI should
   appear locally for anyone using this PAL.

src/pal/pal.h

@@ -16,6 +16,7 @@
 #  include "pal_haiku.h"
 #  include "pal_linux.h"
 #  include "pal_netbsd.h"
+#  include "pal_noalloc.h"
 #  include "pal_openbsd.h"
 #  include "pal_solaris.h"
 #  include "pal_windows.h"

src/pal/pal_bsd_aligned.h

@@ -50,5 +50,17 @@ namespace snmalloc
 
       return p;
     }
+
+    /**
+     * Explicitly deleted method for returning non-aligned memory.  This causes
+     * incorrect use of `constexpr if` to fail on platforms with aligned
+     * allocation.  Without this, this PAL and its subclasses exported both
+     * allocation functions and so callers would type-check if they called
+     * either in `constexpr if` branches and then fail on platforms such as
+     * Linux or Windows, which expose only unaligned or aligned allocations,
+     * respectively.
+     */
+    static std::pair<void*, size_t>
+    reserve_at_least(size_t size) noexcept = delete;
   };
 } // namespace snmalloc

src/pal/pal_concept.h

@@ -92,10 +92,11 @@ namespace snmalloc
     ConceptPAL_memops<PAL> &&
     (!(PAL::pal_features & LowMemoryNotification) ||
       ConceptPAL_mem_low_notify<PAL>) &&
+	(!(PAL::pal_features & NoAllocation) && (
     (!!(PAL::pal_features & AlignedAllocation) ||
       ConceptPAL_reserve_at_least<PAL>) &&
     (!(PAL::pal_features & AlignedAllocation) ||
-      ConceptPAL_reserve_aligned<PAL>);
+      ConceptPAL_reserve_aligned<PAL>)));
 
 } // namespace snmalloc
 #endif

src/pal/pal_consts.h

@@ -36,6 +36,11 @@ namespace snmalloc
      * exposed in the Pal.
      */
     LazyCommit = (1 << 2),
+    /**
+     * This Pal does not support allocation.  All memory used with this Pal
+     * should be pre-allocated.
+     */
+    NoAllocation = (1 << 3),
   };
   /**
    * Flag indicating whether requested memory should be zeroed.

src/pal/pal_noalloc.h

@@ -0,0 +1,80 @@
+#pragma once
+
+namespace snmalloc
+{
+  /**
+   * Platform abstraction layer that does not allow allocation.
+   *
+   * This is a minimal PAL for pre-reserved memory regions, where the
+   * address-space manager is initialised with all of the memory that it will
+   * ever use.
+   *
+   * It takes an error handler delegate as a template argument. This is
+   * expected to forward to the default PAL in most cases.
+   */
+  template<typename ErrorHandler>
+  struct PALNoAlloc
+  {
+    /**
+     * Bitmap of PalFeatures flags indicating the optional features that this
+     * PAL supports.
+     */
+    static constexpr uint64_t pal_features = NoAllocation;
+
+    static constexpr size_t page_size = Aal::smallest_page_size;
+
+    /**
+     * Print a stack trace.
+     */
+    static void print_stack_trace()
+    {
+      ErrorHandler::print_stack_trace();
+    }
+
+    /**
+     * Report a fatal error an exit.
+     */
+    [[noreturn]] static void error(const char* const str) noexcept
+    {
+      ErrorHandler::error(str);
+    }
+
+    /**
+     * Notify platform that we will not be using these pages.
+     *
+     * This is a no-op in this stub.
+     */
+    static void notify_not_using(void*, size_t) noexcept {}
+
+    /**
+     * Notify platform that we will be using these pages.
+     *
+     * This is a no-op in this stub, except for zeroing memory if required.
+     */
+    template<ZeroMem zero_mem>
+    static void notify_using(void* p, size_t size) noexcept
+    {
+      if constexpr (zero_mem == YesZero)
+      {
+        zero<true>(p, size);
+      }
+      else
+      {
+        UNUSED(p);
+        UNUSED(size);
+      }
+    }
+
+    /**
+     * OS specific function for zeroing memory.
+     *
+     * This just calls memset - we don't assume that we have access to any
+     * virtual-memory functions.
+     */
+    template<bool page_aligned = false>
+    static void zero(void* p, size_t size) noexcept
+    {
+      memset(p, 0, size);
+    }
+  };
+} // namespace snmalloc