Use unsafe Heap::handle wherever needed

3 files changed, 12 insertions, 3 deletions

diff --git a/components/script/dom/bindings/reflector.rs b/components/script/dom/bindings/reflector.rs
index 0fef0a30678..97d88cb4357 100644
--- a/components/script/dom/bindings/reflector.rs
+++ b/components/script/dom/bindings/reflector.rs
@@ -46,7 +46,8 @@ impl Reflector {
     /// Get the reflector.
     #[inline]
     pub fn get_jsobject(&self) -> HandleObject {
-        self.object.handle()
+        // We're rooted, so it's safe to hand out a handle to object in Heap
+        unsafe { self.object.handle() }
     }
 
     /// Initialize the reflector. (May be called only once.)
diff --git a/components/script/dom/customelementregistry.rs b/components/script/dom/customelementregistry.rs
index a208f99def6..123b0bef2cb 100644
--- a/components/script/dom/customelementregistry.rs
+++ b/components/script/dom/customelementregistry.rs
@@ -604,7 +604,8 @@ impl CustomElementReaction {
         match *self {
             CustomElementReaction::Upgrade(ref definition) => upgrade_element(definition.clone(), element),
             CustomElementReaction::Callback(ref callback, ref arguments) => {
-                let arguments = arguments.iter().map(|arg| arg.handle()).collect();
+                // We're rooted, so it's safe to hand out a handle to objects in Heap
+                let arguments = arguments.iter().map(|arg| unsafe { arg.handle() }).collect();
                 let _ = callback.Call_(&*element, arguments, ExceptionHandling::Report);
             }
         }
diff --git a/components/script/timers.rs b/components/script/timers.rs
index 4bc4bf37fff..a5e7020095f 100644
--- a/components/script/timers.rs
+++ b/components/script/timers.rs
@@ -500,7 +500,7 @@ impl JsTimerTask {
                     code_str, rval.handle_mut());
             },
             InternalTimerCallback::FunctionTimerCallback(ref function, ref arguments) => {
-                let arguments = arguments.iter().map(|arg| arg.handle()).collect();
+                let arguments = self.collect_heap_args(arguments);
                 let _ = function.Call_(this, arguments, Report);
             },
         };
@@ -516,4 +516,11 @@ impl JsTimerTask {
             timers.initialize_and_schedule(&this.global(), self);
         }
     }
+
+    // Returning Handles directly from Heap values is inherently unsafe, but here it's
+    // always done via rooted JsTimers, which is safe.
+    #[allow(unsafe_code)]
+    fn collect_heap_args(&self, args: &[Heap<JSVal>]) -> Vec<HandleValue> {
+        args.iter().map(|arg| unsafe { arg.handle() }).collect()
+    }
 }