Bug 761695 - Simplify XPCWN Xray holder creation. r=peterv

The major semantic change here is that we parent holders directly to their
global. This should be fine.

js/xpconnect/wrappers/WrapperFactory.cpp

@@ -493,7 +493,7 @@ WrapperFactory::Rewrap(JSContext *cx, JSObject *obj, JSObject *wrappedProto, JSO
     if (!wrapperObj || !usingXray)
         return wrapperObj;
 
-    JSObject *xrayHolder = XrayUtils::createHolder(cx, obj, parent);
+    JSObject *xrayHolder = XrayUtils::createHolder(cx, wrapperObj);
     if (!xrayHolder)
         return nullptr;
     js::SetProxyExtra(wrapperObj, 0, js::ObjectValue(*xrayHolder));
@@ -531,9 +531,6 @@ WrapperFactory::IsLocationObject(JSObject *obj)
 JSObject *
 WrapperFactory::WrapLocationObject(JSContext *cx, JSObject *obj)
 {
-    JSObject *xrayHolder = XrayUtils::createHolder(cx, obj, js::GetObjectParent(obj));
-    if (!xrayHolder)
-        return nullptr;
     JSObject *proto;
     if (!js::GetObjectProto(cx, obj, &proto))
         return nullptr;
@@ -541,6 +538,9 @@ WrapperFactory::WrapLocationObject(JSContext *cx, JSObject *obj)
                                         &LW::singleton);
     if (!wrapperObj)
         return nullptr;
+    JSObject *xrayHolder = XrayUtils::createHolder(cx, wrapperObj);
+    if (!xrayHolder)
+        return nullptr;
     js::SetProxyExtra(wrapperObj, 0, js::ObjectValue(*xrayHolder));
     return wrapperObj;
 }
@@ -634,7 +634,7 @@ WrapperFactory::WrapForSameCompartmentXray(JSContext *cx, JSObject *obj)
     // Make the holder. Note that this is currently for WNs only until we fix
     // bug 761704.
     if (type == XrayForWrappedNative) {
-        JSObject *xrayHolder = XrayUtils::createHolder(cx, obj, parent);
+        JSObject *xrayHolder = XrayUtils::createHolder(cx, wrapperObj);
         if (!xrayHolder)
             return nullptr;
         js::SetProxyExtra(wrapperObj, 0, js::ObjectValue(*xrayHolder));

js/xpconnect/wrappers/XrayWrapper.cpp

@@ -252,13 +252,15 @@ CloneExpandoChain(JSContext *cx, JSObject *dst, JSObject *src)
 }
 
 JSObject *
-createHolder(JSContext *cx, JSObject *wrappedNative, JSObject *parent)
+createHolder(JSContext *cx, JSObject *wrapper)
 {
-    JSObject *holder = JS_NewObjectWithGivenProto(cx, &HolderClass, nullptr, parent);
+    JSObject *global = JS_GetGlobalForObject(cx, wrapper);
+    JSObject *holder = JS_NewObjectWithGivenProto(cx, &HolderClass, nullptr,
+                                                  global);
     if (!holder)
         return nullptr;
 
-    JSObject *inner = JS_ObjectToInnerObject(cx, wrappedNative);
+    JSObject *inner = js::UnwrapObject(wrapper, /* stopAtOuter = */ false);
     XPCWrappedNative *wn = GetWrappedNative(inner);
 
     // A note about ownership: the holder has a direct pointer to the wrapped
@@ -269,8 +271,7 @@ createHolder(JSContext *cx, JSObject *wrappedNative, JSObject *parent)
     // wrapped native alive. Furthermore, the reachability of that object and
     // the associated holder are exactly the same, so we can use that for our
     // strong reference.
-    MOZ_ASSERT(IS_WN_WRAPPER(wrappedNative) ||
-               js::GetObjectClass(wrappedNative)->ext.innerObject);
+    MOZ_ASSERT(IS_WN_WRAPPER(inner));
     js::SetReservedSlot(holder, JSSLOT_WN, PrivateValue(wn));
     js::SetReservedSlot(holder, JSSLOT_RESOLVING, PrivateValue(NULL));
     return holder;

js/xpconnect/wrappers/XrayWrapper.h

@@ -30,7 +30,7 @@ extern JSClass HolderClass;
 
 bool CloneExpandoChain(JSContext *cx, JSObject *src, JSObject *dst);
 
-JSObject *createHolder(JSContext *cx, JSObject *wrappedNative, JSObject *parent);
+JSObject *createHolder(JSContext *cx, JSObject *wrapper);
 
 bool
 IsTransparent(JSContext *cx, JSObject *wrapper);