Bug 757667 - Clean up Proxy tracing (r=terrence)

js/src/jscompartment.cpp

@@ -364,6 +364,10 @@ JSCompartment::markCrossCompartmentWrappers(JSTracer *trc)
             Value referent = GetProxyPrivate(&v.toObject());
             MarkValueRoot(trc, &referent, "cross-compartment wrapper");
             JS_ASSERT(referent == GetProxyPrivate(&v.toObject()));
+
+            Value call = GetProxyCall(&v.toObject());
+            MarkValueRoot(trc, &call, "cross-compartment wrapper");
+            JS_ASSERT(call == GetProxyCall(&v.toObject()));
         } else {
             /*
              * Strings don't have a private pointer to mark, so we use the

js/src/jsproxy.cpp

@@ -355,11 +355,6 @@ BaseProxyHandler::finalize(JSFreeOp *fop, JSObject *proxy)
 {
 }
 
-void
-BaseProxyHandler::trace(JSTracer *trc, JSObject *proxy)
-{
-}
-
 IndirectProxyHandler::IndirectProxyHandler(void *family) : BaseProxyHandler(family)
 {
 }
@@ -535,12 +530,6 @@ IndirectProxyHandler::iteratorNext(JSContext *cx, JSObject *proxy, Value *vp)
     return true;
 }
 
-void
-IndirectProxyHandler::trace(JSTracer *trc, JSObject *proxy)
-{
-    MarkSlot(trc, &proxy->getReservedSlotRef(JSSLOT_PROXY_PRIVATE), "targetObject");
-}
-
 DirectProxyHandler::DirectProxyHandler(void *family) :
         IndirectProxyHandler(family)
 {
@@ -1491,10 +1480,9 @@ proxy_TraceObject(JSTracer *trc, JSObject *obj)
 
     // NB: If you add new slots here, make sure to change
     // js::NukeChromeCrossCompartmentWrappers to cope.
-    GetProxyHandler(obj)->trace(trc, obj);
     MarkCrossCompartmentSlot(trc, &obj->getReservedSlotRef(JSSLOT_PROXY_PRIVATE), "private");
-    MarkCrossCompartmentSlot(trc, &obj->getReservedSlotRef(JSSLOT_PROXY_EXTRA + 0), "extra0");
-    MarkCrossCompartmentSlot(trc, &obj->getReservedSlotRef(JSSLOT_PROXY_EXTRA + 1), "extra1");
+    MarkSlot(trc, &obj->getReservedSlotRef(JSSLOT_PROXY_EXTRA + 0), "extra0");
+    MarkSlot(trc, &obj->getReservedSlotRef(JSSLOT_PROXY_EXTRA + 1), "extra1");
 }
 
 static void
@@ -1503,7 +1491,7 @@ proxy_TraceFunction(JSTracer *trc, JSObject *obj)
     // NB: If you add new slots here, make sure to change
     // js::NukeChromeCrossCompartmentWrappers to cope.
     MarkCrossCompartmentSlot(trc, &GetCall(obj), "call");
-    MarkCrossCompartmentSlot(trc, &GetFunctionProxyConstruct(obj), "construct");
+    MarkSlot(trc, &GetFunctionProxyConstruct(obj), "construct");
     proxy_TraceObject(trc, obj);
 }
 
@@ -1730,6 +1718,7 @@ js::NewProxyObject(JSContext *cx, BaseProxyHandler *handler, const Value &priv_,
 
     JS_ASSERT_IF(proto, cx->compartment == proto->compartment());
     JS_ASSERT_IF(parent, cx->compartment == parent->compartment());
+    JS_ASSERT_IF(construct, cx->compartment == construct->compartment());
     bool fun = call || construct;
     Class *clasp;
     if (fun)

js/src/jsproxy.h

@@ -53,7 +53,6 @@ class JS_FRIEND_API(BaseProxyHandler) {
     virtual bool defaultValue(JSContext *cx, JSObject *obj, JSType hint, Value *vp);
     virtual bool iteratorNext(JSContext *cx, JSObject *proxy, Value *vp);
     virtual void finalize(JSFreeOp *fop, JSObject *proxy);
-    virtual void trace(JSTracer *trc, JSObject *proxy);
     virtual bool getElementIfPresent(JSContext *cx, JSObject *obj, JSObject *receiver,
                                      uint32_t index, Value *vp, bool *present);
 
@@ -109,7 +108,6 @@ class JS_PUBLIC_API(IndirectProxyHandler) : public BaseProxyHandler {
                               Value *vp) MOZ_OVERRIDE;
     virtual bool iteratorNext(JSContext *cx, JSObject *proxy,
                               Value *vp) MOZ_OVERRIDE;
-    virtual void trace(JSTracer *trc, JSObject *proxy) MOZ_OVERRIDE;
 };
 
 class JS_PUBLIC_API(DirectProxyHandler) : public IndirectProxyHandler {
@@ -228,6 +226,13 @@ GetProxyTargetObject(const JSObject *obj)
     return GetProxyPrivate(obj).toObjectOrNull();
 }
 
+inline const Value &
+GetProxyCall(const JSObject *obj)
+{
+    JS_ASSERT(IsFunctionProxy(obj));
+    return GetReservedSlot(obj, JSSLOT_PROXY_CALL);
+}
+
 inline const Value &
 GetProxyExtra(const JSObject *obj, size_t n)
 {

js/src/jswrapper.cpp

@@ -784,13 +784,6 @@ CrossCompartmentWrapper::iteratorNext(JSContext *cx, JSObject *wrapper, Value *v
            call.origin->wrap(cx, vp));
 }
 
-void
-CrossCompartmentWrapper::trace(JSTracer *trc, JSObject *wrapper)
-{
-    MarkCrossCompartmentSlot(trc, &wrapper->getReservedSlotRef(JSSLOT_PROXY_PRIVATE),
-                             "targetObject");
-}
-
 CrossCompartmentWrapper CrossCompartmentWrapper::singleton(0u);
 
 /* Security wrappers. */

js/src/jswrapper.h

@@ -159,7 +159,6 @@ class JS_FRIEND_API(CrossCompartmentWrapper) : public Wrapper
     virtual JSString *fun_toString(JSContext *cx, JSObject *wrapper, unsigned indent) MOZ_OVERRIDE;
     virtual bool defaultValue(JSContext *cx, JSObject *wrapper, JSType hint, Value *vp) MOZ_OVERRIDE;
     virtual bool iteratorNext(JSContext *cx, JSObject *wrapper, Value *vp);
-    virtual void trace(JSTracer *trc, JSObject *wrapper) MOZ_OVERRIDE;
 
     static CrossCompartmentWrapper singleton;
 };