Bug 949220 - Make |js::CloneObject| take a |JSObject*| prototype argument, not a |TaggedProto|. r=jandem

Differential Revision: https://phabricator.services.mozilla.com/D71272

js/src/jsfriendapi.cpp

@@ -572,10 +572,9 @@ JS_FRIEND_API void JS_SetSetUseCounterCallback(
 }
 
 JS_FRIEND_API JSObject* JS_CloneObject(JSContext* cx, HandleObject obj,
-                                       HandleObject protoArg) {
+                                       HandleObject proto) {
   // |obj| might be in a different compartment.
-  cx->check(protoArg);
+  cx->check(proto);
-  Rooted<TaggedProto> proto(cx, TaggedProto(protoArg.get()));
   return CloneObject(cx, obj, proto);
 }
 

js/src/vm/JSObject.cpp

@@ -1180,7 +1180,7 @@ static bool CopyProxyObject(JSContext* cx, Handle<ProxyObject*> from,
 }
 
 JSObject* js::CloneObject(JSContext* cx, HandleObject obj,
-                          Handle<js::TaggedProto> proto) {
+                          Handle<JSObject*> proto) {
   if (!obj->isNative() && !obj->is<ProxyObject>()) {
     JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
                               JSMSG_CANT_CLONE_OBJECT);
@@ -1191,8 +1191,7 @@ JSObject* js::CloneObject(JSContext* cx, HandleObject obj,
   if (obj->isNative()) {
     // CloneObject is used to create the target object for JSObject::swap() and
     // swap() requires its arguments are tenured, so ensure tenure allocation.
-    clone = NewObjectWithGivenTaggedProto(cx, obj->getClass(), proto,
+    clone = NewTenuredObjectWithGivenProto(cx, obj->getClass(), proto);
-                                          NewObjectKind::TenuredObject);
     if (!clone) {
       return nullptr;
     }
@@ -1219,8 +1218,8 @@ JSObject* js::CloneObject(JSContext* cx, HandleObject obj,
       return nullptr;
     }
 
-    clone = ProxyObject::New(cx, handler, JS::NullHandleValue, proto,
+    clone = ProxyObject::New(cx, handler, JS::NullHandleValue,
-                             obj->getClass());
+                             AsTaggedProto(proto), obj->getClass());
     if (!clone) {
       return nullptr;
     }

js/src/vm/JSObject.h

@@ -870,7 +870,7 @@ extern JSObject* CreateThis(JSContext* cx, const JSClass* clasp,
                             js::HandleObject callee);
 
 extern JSObject* CloneObject(JSContext* cx, HandleObject obj,
-                             Handle<js::TaggedProto> proto);
+                             Handle<JSObject*> proto);
 
 extern JSObject* DeepCloneObjectLiteral(JSContext* cx, HandleObject obj);