Bug 761695 - Stop stashing a raw WN pointer in XPCWN Xray holders. r=peterv

We might as well do this dynamically, which simplifies the code. Note that we
could avoid the reserved slot by parenting the holder to the wrapper. But the
JS parent API is deprecated, and we need to move away from it to reserved slots
anyhow. We might as well start here, with the added advantage that parenting
to the global makes us consistent with the other Xray types.

js/xpconnect/wrappers/XrayWrapper.cpp

@@ -28,7 +28,7 @@ namespace xpc {
 
 using namespace js;
 
-static const uint32_t JSSLOT_WN = 0;
+static const uint32_t JSSLOT_WRAPPER = 0;
 static const uint32_t JSSLOT_RESOLVING = 1;
 
 static XPCWrappedNative *GetWrappedNative(JSObject *obj);
@@ -260,19 +260,7 @@ createHolder(JSContext *cx, JSObject *wrapper)
     if (!holder)
         return nullptr;
 
-    JSObject *inner = js::UnwrapObject(wrapper, /* stopAtOuter = */ false);
-    XPCWrappedNative *wn = GetWrappedNative(inner);
-
-    // A note about ownership: the holder has a direct pointer to the wrapped
-    // native that we're wrapping. Normally, we'd have to AddRef the pointer
-    // so that it doesn't have to be collected, but then we'd have to tell the
-    // cycle collector. Fortunately for us, we know that the Xray wrapper
-    // itself has a reference to the flat JS object which will hold the
-    // wrapped native alive. Furthermore, the reachability of that object and
-    // the associated holder are exactly the same, so we can use that for our
-    // strong reference.
-    MOZ_ASSERT(IS_WN_WRAPPER(inner));
-    js::SetReservedSlot(holder, JSSLOT_WN, PrivateValue(wn));
+    js::SetReservedSlot(holder, JSSLOT_WRAPPER, ObjectValue(*wrapper));
     js::SetReservedSlot(holder, JSSLOT_RESOLVING, PrivateValue(NULL));
     return holder;
 }
@@ -481,7 +469,8 @@ static XPCWrappedNative *
 GetWrappedNativeFromHolder(JSObject *holder)
 {
     MOZ_ASSERT(js::GetObjectJSClass(holder) == &HolderClass);
-    return static_cast<XPCWrappedNative *>(js::GetReservedSlot(holder, JSSLOT_WN).toPrivate());
+    JSObject *wrapper = &js::GetReservedSlot(holder, JSSLOT_WRAPPER).toObject();
+    return GetWrappedNative(js::UnwrapObject(wrapper, /* stopAtOuter = */ false));
 }
 
 static JSObject *