Bug 1582568 - Nuke CCWs for waivers for remote window proxies. r=peterv

Xray waivers for remote window proxies don't make much sense, so we nuke any
waiver when a window proxy navigates from local to remote. However, this xray
waiver can be the target of a CCW, and dead wrappers are not supposed to the
target of a CCW, so we need to find and nuke any CCWs targetting the waiver.

This requires fixing js::RemapWrapper so that it can be used to fix CCWs to
dead wrappers.

Hopefully this will fix a bunch of intermittent failures in
browser_windowProxy_transplant.js.

Differential Revision: https://phabricator.services.mozilla.com/D66459

--HG--
extra : moz-landing-system : lando

dom/tests/browser/browser.ini

@@ -106,6 +106,5 @@ support-files =
 [browser_keypressTelemetry.js]
 skip-if = webrender
 [browser_windowProxy_transplant.js]
-skip-if = (!fission && (os == 'linux' || os == 'mac')) || (fission && os == 'linux' && bits == 64 && os_version == '18.04') # Bug 1582568; Bug 1581862, bug 1608600 
 support-files =
   file_postMessage_parent.html

js/src/proxy/CrossCompartmentWrapper.cpp

@@ -526,8 +526,6 @@ void js::RemapWrapper(JSContext* cx, JSObject* wobjArg,
   MOZ_ASSERT(!newTarget->is<CrossCompartmentWrapperObject>());
   JSObject* origTarget = Wrapper::wrappedObject(wobj);
   MOZ_ASSERT(origTarget);
-  MOZ_ASSERT(!JS_IsDeadWrapper(origTarget),
-             "We don't want a dead proxy in the wrapper map");
   JS::Compartment* wcompartment = wobj->compartment();
   MOZ_ASSERT(wcompartment != newTarget->compartment());
 
@@ -548,6 +546,14 @@ void js::RemapWrapper(JSContext* cx, JSObject* wobjArg,
   // When we remove origv from the wrapper map, its wrapper, wobj, must
   // immediately cease to be a cross-compartment wrapper. Nuke it.
   NukeCrossCompartmentWrapper(cx, wobj);
+
+  // If the target is a dead wrapper, and we're just fixing wrappers for
+  // it, then we're done now that the CCW is a dead wrapper.
+  if (JS_IsDeadWrapper(origTarget)) {
+    MOZ_RELEASE_ASSERT(origTarget == newTarget);
+    return;
+  }
+
   js::RemapDeadWrapper(cx, wobj, newTarget);
 }
 

js/xpconnect/wrappers/WrapperFactory.cpp

@@ -826,6 +826,11 @@ static void NukeXrayWaiver(JSContext* cx, JS::HandleObject obj) {
   scope->mWaiverWrapperMap->Remove(key);
 
   js::NukeNonCCWProxy(cx, waiver);
+
+  // Get rid of any CCWs the waiver may have had.
+  if (!JS_RefreshCrossCompartmentWrappers(cx, waiver)) {
+    MOZ_CRASH();
+  }
 }
 
 JSObject* TransplantObjectNukingXrayWaiver(JSContext* cx,