Bug 1518202 - Make RemoteObjectProxies add the edge to the native object to the CC. r=bzbarsky

Depends on D15848

Differential Revision: https://phabricator.services.mozilla.com/D21497

--HG--
extra : moz-landing-system : lando

docshell/base/BrowsingContext.cpp

@@ -555,6 +555,14 @@ class RemoteLocationProxy
 
   constexpr RemoteLocationProxy()
       : RemoteObjectProxy(prototypes::id::Location) {}
+
+  void NoteChildren(JSObject* aProxy,
+                    nsCycleCollectionTraversalCallback& aCb) const override {
+    auto location =
+        static_cast<BrowsingContext::LocationProxy*>(GetNative(aProxy));
+    CycleCollectionNoteChild(aCb, location->GetBrowsingContext(),
+                             "js::GetObjectPrivate(obj)->GetBrowsingContext()");
+  }
 };
 
 static const RemoteLocationProxy sSingleton;

docshell/base/BrowsingContext.h

@@ -350,6 +350,7 @@ class BrowsingContext : public nsWrapperCache,
                  ErrorResult& aError);
 
    private:
+    friend class RemoteLocationProxy;
     BrowsingContext* GetBrowsingContext() {
       return reinterpret_cast<BrowsingContext*>(
           uintptr_t(this) - offsetof(BrowsingContext, mLocation));

dom/base/RemoteOuterWindowProxy.cpp

@@ -47,6 +47,13 @@ class RemoteOuterWindowProxy
   // SpiderMonkey extensions
   bool getOwnEnumerablePropertyKeys(JSContext* cx, JS::Handle<JSObject*> proxy,
                                     JS::AutoIdVector& props) const final;
+
+  void NoteChildren(JSObject* aProxy,
+                    nsCycleCollectionTraversalCallback& aCb) const override {
+    CycleCollectionNoteChild(aCb,
+                             static_cast<BrowsingContext*>(GetNative(aProxy)),
+                             "js::GetObjectPrivate(obj)");
+  }
 };
 
 static const RemoteOuterWindowProxy sSingleton;

dom/bindings/RemoteObjectProxy.h

@@ -76,6 +76,9 @@ class RemoteObjectProxyBase : public js::BaseProxyHandler,
   bool isCallable(JSObject* aObj) const final { return false; }
   bool isConstructor(JSObject* aObj) const final { return false; }
 
+  virtual void NoteChildren(JSObject* aProxy,
+                            nsCycleCollectionTraversalCallback& aCb) const = 0;
+
   static void* GetNative(JSObject* aProxy) {
     return js::GetProxyPrivate(aProxy).toPrivate();
   }

xpcom/base/CycleCollectedJSRuntime.cpp

@@ -638,7 +638,7 @@ void CycleCollectedJSRuntime::NoteGCThingXPCOMChildren(
     return;
   }
 
-  const DOMJSClass* domClass = GetDOMClass(aObj);
+  const DOMJSClass* domClass = GetDOMClass(aClasp);
   if (domClass) {
     NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(aCb, "UnwrapDOMObject(obj)");
     // It's possible that our object is an unforgeable holder object, in
@@ -655,6 +655,12 @@ void CycleCollectedJSRuntime::NoteGCThingXPCOMChildren(
     return;
   }
 
+  if (IsRemoteObjectProxy(aObj)) {
+    auto handler =
+        static_cast<const RemoteObjectProxyBase*>(js::GetProxyHandler(aObj));
+    return handler->NoteChildren(aObj, aCb);
+  }
+
   JS::Value value = js::MaybeGetScriptPrivate(aObj);
   if (!value.isUndefined()) {
     aCb.NoteXPCOMChild(static_cast<nsISupports*>(value.toPrivate()));