Bug 717637. Stop using non-global parent objects for everything that's not an element, since having a mix of parent objects makes us fail shape guards in the JIT. r=peterv

dom/bindings/BindingUtils.h

@@ -1111,6 +1111,22 @@ WrapNativeParent(JSContext* cx, JS::Handle<JSObject*> scope, const T& p)
   return WrapNativeParent(cx, scope, GetParentPointer(p), GetWrapperCache(p));
 }
 
+// A way to differentiate between nodes, which use the parent object
+// returned by native->GetParentObject(), and all other objects, which
+// just use the parent's global.
+static inline JSObject*
+GetRealParentObject(void* aParent, JSObject* aParentObject)
+{
+  return aParentObject ?
+    js::GetGlobalForObjectCrossCompartment(aParentObject) : nullptr;
+}
+
+static inline JSObject*
+GetRealParentObject(Element* aParent, JSObject* aParentObject)
+{
+  return aParentObject;
+}
+
 HAS_MEMBER(GetParentObject)
 
 template<typename T, bool WrapperCached=HasGetParentObjectMember<T>::Value>
@@ -1119,7 +1135,9 @@ struct GetParentObject
   static JSObject* Get(JSContext* cx, JS::Handle<JSObject*> obj)
   {
     T* native = UnwrapDOMObject<T>(obj);
-    return WrapNativeParent(cx, obj, native->GetParentObject());
+    return
+      GetRealParentObject(native,
+                          WrapNativeParent(cx, obj, native->GetParentObject()));
   }
 };
 

dom/bindings/Codegen.py

@@ -2046,7 +2046,8 @@ class CGWrapWithCacheMethod(CGAbstractMethod):
         return """%s
 %s
   JS::Rooted<JSObject*> parent(aCx,
-                               WrapNativeParent(aCx, aScope, aObject->GetParentObject()));
+    GetRealParentObject(aObject,
+                        WrapNativeParent(aCx, aScope, aObject->GetParentObject())));
   if (!parent) {
     return NULL;
   }