Properly root expando objects.

2 files changed, 27 insertions, 21 deletions

diff --git a/components/script/dom/bindings/codegen/CodegenRust.py b/components/script/dom/bindings/codegen/CodegenRust.py
index b5985027972..79479363acd 100644
--- a/components/script/dom/bindings/codegen/CodegenRust.py
+++ b/components/script/dom/bindings/codegen/CodegenRust.py
@@ -2510,7 +2510,8 @@ def CopyUnforgeablePropertiesToInstance(descriptor):
     # reflector, so we can make sure we don't get confused by named getters.
     if descriptor.proxy:
         copyCode += """\
-rooted!(in(cx) let expando = ensure_expando_object(cx, obj.handle()));
+rooted!(in(cx) let mut expando = ptr::null_mut());
+ensure_expando_object(cx, obj.handle(), expando.handle_mut());
 """
         obj = "expando"
     else:
@@ -4850,7 +4851,8 @@ if RUST_JSID_IS_STRING(id) {
 
         # FIXME(#11868) Should assign to desc.obj, desc.get() is a copy.
         return get + """\
-rooted!(in(cx) let expando = get_expando_object(proxy));
+rooted!(in(cx) let mut expando = ptr::null_mut());
+get_expando_object(proxy, expando.handle_mut());
 //if (!xpc::WrapperFactory::IsXrayWrapper(proxy) && (expando = GetExpandoObject(proxy))) {
 if !expando.is_null() {
     if !JS_GetPropertyDescriptorById(cx, expando.handle(), id, desc) {
@@ -4981,10 +4983,10 @@ class CGDOMJSProxyHandler_ownPropertyKeys(CGAbstractExternMethod):
 
         body += dedent(
             """
-            let expando = get_expando_object(proxy);
+            rooted!(in(cx) let mut expando = ptr::null_mut());
+            get_expando_object(proxy, expando.handle_mut());
             if !expando.is_null() {
-                rooted!(in(cx) let rooted_expando = expando);
-                GetPropertyKeys(cx, rooted_expando.handle(), JSITER_OWNONLY | JSITER_HIDDEN | JSITER_SYMBOLS, props);
+                GetPropertyKeys(cx, expando.handle(), JSITER_OWNONLY | JSITER_HIDDEN | JSITER_SYMBOLS, props);
             }
 
             return true;
@@ -5024,10 +5026,10 @@ class CGDOMJSProxyHandler_getOwnEnumerablePropertyKeys(CGAbstractExternMethod):
 
         body += dedent(
             """
-            let expando = get_expando_object(proxy);
+            rooted!(in(cx) let mut expando = ptr::null_mut());
+            get_expando_object(proxy, expando.handle_mut());
             if !expando.is_null() {
-                rooted!(in(cx) let rooted_expando = expando);
-                GetPropertyKeys(cx, rooted_expando.handle(), JSITER_OWNONLY | JSITER_HIDDEN | JSITER_SYMBOLS, props);
+                GetPropertyKeys(cx, expando.handle(), JSITER_OWNONLY | JSITER_HIDDEN | JSITER_SYMBOLS, props);
             }
 
             return true;
@@ -5080,7 +5082,8 @@ if RUST_JSID_IS_STRING(id) {
             named = ""
 
         return indexed + """\
-rooted!(in(cx) let expando = get_expando_object(proxy));
+rooted!(in(cx) let mut expando = ptr::null_mut());
+get_expando_object(proxy, expando.handle_mut());
 if !expando.is_null() {
     let ok = JS_HasPropertyById(cx, expando.handle(), id, bp);
     if !ok || *bp {
@@ -5105,7 +5108,8 @@ class CGDOMJSProxyHandler_get(CGAbstractExternMethod):
 
     def getBody(self):
         getFromExpando = """\
-rooted!(in(cx) let expando = get_expando_object(proxy));
+rooted!(in(cx) let mut expando = ptr::null_mut());
+get_expando_object(proxy, expando.handle_mut());
 if !expando.is_null() {
     let mut hasProp = false;
     if !JS_HasPropertyById(cx, expando.handle(), id, &mut hasProp) {
diff --git a/components/script/dom/bindings/proxyhandler.rs b/components/script/dom/bindings/proxyhandler.rs
index cc4e535e4f2..d7155b34909 100644
--- a/components/script/dom/bindings/proxyhandler.rs
+++ b/components/script/dom/bindings/proxyhandler.rs
@@ -33,7 +33,8 @@ pub unsafe extern "C" fn shadow_check_callback(cx: *mut JSContext,
                                                -> DOMProxyShadowsResult {
     // TODO: support OverrideBuiltins when #12978 is fixed.
 
-    rooted!(in(cx) let expando = get_expando_object(object));
+    rooted!(in(cx) let mut expando = ptr::null_mut());
+    get_expando_object(object, expando.handle_mut());
     if !expando.get().is_null() {
         let mut has_own = false;
         if !JS_AlreadyHasOwnPropertyById(cx, expando.handle(), id, &mut has_own) {
@@ -99,7 +100,8 @@ pub unsafe extern "C" fn define_property(cx: *mut JSContext,
         return true;
     }
 
-    rooted!(in(cx) let expando = ensure_expando_object(cx, proxy));
+    rooted!(in(cx) let mut expando = ptr::null_mut());
+    ensure_expando_object(cx, proxy, expando.handle_mut());
     JS_DefinePropertyById(cx, expando.handle(), id, desc, result)
 }
 
@@ -109,7 +111,8 @@ pub unsafe extern "C" fn delete(cx: *mut JSContext,
                                 id: HandleId,
                                 bp: *mut ObjectOpResult)
                                 -> bool {
-    rooted!(in(cx) let expando = get_expando_object(proxy));
+    rooted!(in(cx) let mut expando = ptr::null_mut());
+    get_expando_object(proxy, expando.handle_mut());
     if expando.is_null() {
         (*bp).code_ = 0 /* OkCode */;
         return true;
@@ -156,31 +159,30 @@ pub unsafe extern "C" fn get_prototype_if_ordinary(_: *mut JSContext,
 }
 
 /// Get the expando object, or null if there is none.
-pub fn get_expando_object(obj: HandleObject) -> *mut JSObject {
+pub fn get_expando_object(obj: HandleObject, expando: MutableHandleObject) {
     unsafe {
         assert!(is_dom_proxy(obj.get()));
         let val = GetProxyExtra(obj.get(), JSPROXYSLOT_EXPANDO);
-        if val.is_undefined() {
+        expando.set(if val.is_undefined() {
             ptr::null_mut()
         } else {
             val.to_object()
-        }
+        });
     }
 }
 
 /// Get the expando object, or create it if it doesn't exist yet.
 /// Fails on JSAPI failure.
-pub fn ensure_expando_object(cx: *mut JSContext, obj: HandleObject) -> *mut JSObject {
+pub fn ensure_expando_object(cx: *mut JSContext, obj: HandleObject, expando: MutableHandleObject) {
     unsafe {
         assert!(is_dom_proxy(obj.get()));
-        let mut expando = get_expando_object(obj);
+        get_expando_object(obj, expando);
         if expando.is_null() {
-            expando = JS_NewObjectWithGivenProto(cx, ptr::null_mut(), HandleObject::null());
+            expando.set(JS_NewObjectWithGivenProto(cx, ptr::null_mut(), HandleObject::null()));
             assert!(!expando.is_null());
 
-            SetProxyExtra(obj.get(), JSPROXYSLOT_EXPANDO, &ObjectValue(expando));
+            SetProxyExtra(obj.get(), JSPROXYSLOT_EXPANDO, &ObjectValue(expando.get()));
         }
-        expando
     }
 }