Bug 1279746 - Optimize xpc_TryUnmarkWrappedGrayObject, r=mccr8

js/xpconnect/idl/nsIXPConnect.idl

@@ -129,6 +129,14 @@ interface nsIXPConnectWrappedJS : nsIXPConnectJSObjectHolder
 
 };
 
+// Special interface to unmark the internal JSObject.
+// QIing to nsIXPConnectWrappedJSUnmarkGray does *not* addref, it only unmarks,
+// and QIing to nsIXPConnectWrappedJSUnmarkGray is always supposed to fail.
+[builtinclass, uuid(c02a0ce6-275f-4ea1-9c23-08494898b070)]
+interface nsIXPConnectWrappedJSUnmarkGray : nsIXPConnectWrappedJS
+{
+};
+
 /***************************************************************************/
 
 /**

js/xpconnect/src/XPCWrappedJS.cpp

@@ -204,6 +204,18 @@ nsXPCWrappedJS::QueryInterface(REFNSIID aIID, void** aInstancePtr)
     if (!IsValid())
         return NS_ERROR_UNEXPECTED;
 
+    if (aIID.Equals(NS_GET_IID(nsIXPConnectWrappedJSUnmarkGray))) {
+        *aInstancePtr = nullptr;
+
+        // No need to null check mJSObj because IsValid() call above did
+        // that already.
+        JS::ExposeObjectToActiveJS(mJSObj);
+
+        // Just return some error value since one isn't supposed to use
+        // nsIXPConnectWrappedJSUnmarkGray objects for anything.
+        return NS_ERROR_FAILURE;
+    }
+
     // Always check for this first so that our 'outer' can get this interface
     // from us without recurring into a call to the outer's QI!
     if (aIID.Equals(NS_GET_IID(nsIXPConnectWrappedJS))) {

js/xpconnect/src/nsXPConnect.cpp

@@ -341,11 +341,10 @@ xpc_MarkInCCGeneration(nsISupports* aVariant, uint32_t aGeneration)
 void
 xpc_TryUnmarkWrappedGrayObject(nsISupports* aWrappedJS)
 {
-    nsCOMPtr<nsIXPConnectWrappedJS> wjs = do_QueryInterface(aWrappedJS);
+    nsCOMPtr<nsIXPConnectWrappedJSUnmarkGray> wjsug =
-    if (wjs) {
+      do_QueryInterface(aWrappedJS);
-        // Unmarks gray JSObject.
+    MOZ_ASSERT(!wjsug, "One should never be able to QI to "
-        static_cast<nsXPCWrappedJS*>(wjs.get())->GetJSObject();
+                       "nsIXPConnectWrappedJSUnmarkGray successfully!");
-    }
 }
 
 /***************************************************************************/

js/xpconnect/src/xpcprivate.h

@@ -2329,7 +2329,7 @@ private:
 // interface on the single underlying (possibly aggregate) JSObject.
 
 class nsXPCWrappedJS final : protected nsAutoXPTCStub,
-                             public nsIXPConnectWrappedJS,
+                             public nsIXPConnectWrappedJSUnmarkGray,
                              public nsSupportsWeakReference,
                              public nsIPropertyBag,
                              public XPCRootSetElem
@@ -2338,6 +2338,7 @@ public:
     NS_DECL_CYCLE_COLLECTING_ISUPPORTS
     NS_DECL_NSIXPCONNECTJSOBJECTHOLDER
     NS_DECL_NSIXPCONNECTWRAPPEDJS
+    NS_DECL_NSIXPCONNECTWRAPPEDJSUNMARKGRAY
     NS_DECL_NSISUPPORTSWEAKREFERENCE
     NS_DECL_NSIPROPERTYBAG