Ignore the HTML parser's borrow flag in GC tracing

Adds some other dynamic checks in debug builds.

2 files changed, 33 insertions, 5 deletions

diff --git a/components/script/dom/bindings/cell.rs b/components/script/dom/bindings/cell.rs
index 4aa993fec45..f15e829c87b 100644
--- a/components/script/dom/bindings/cell.rs
+++ b/components/script/dom/bindings/cell.rs
@@ -6,6 +6,7 @@ use dom::bindings::trace::JSTraceable;
 use js::jsapi::{JSTracer};
 
 use servo_util::task_state;
+use servo_util::task_state::{Script, InGC};
 
 use std::cell::{Cell, UnsafeCell};
 use std::kinds::marker;
@@ -33,6 +34,23 @@ impl<T> DOMRefCell<T> {
         &*self.value.get()
     }
 
+    /// Borrow the contents for the purpose of GC tracing.
+    ///
+    /// This succeeds even if the object is mutably borrowed,
+    /// so you have to be careful in trace code!
+    pub unsafe fn borrow_for_gc_trace<'a>(&'a self) -> &'a T {
+        debug_assert!(task_state::get().contains(Script | InGC));
+        &*self.value.get()
+    }
+
+    /// Is the cell mutably borrowed?
+    ///
+    /// For safety checks in debug builds only.
+    #[cfg(not(ndebug))]
+    pub fn is_mutably_borrowed(&self) -> bool {
+        self.borrow.get() == WRITING
+    }
+
     pub fn try_borrow<'a>(&'a self) -> Option<Ref<'a, T>> {
         debug_assert!(task_state::get().is_script());
         match self.borrow.get() {
diff --git a/components/script/dom/servohtmlparser.rs b/components/script/dom/servohtmlparser.rs
index 6b81ab512c5..88f0c9c8275 100644
--- a/components/script/dom/servohtmlparser.rs
+++ b/components/script/dom/servohtmlparser.rs
@@ -15,6 +15,8 @@ use dom::node::TrustedNodeAddress;
 use dom::document::{Document, DocumentHelpers};
 use parse::html::JSMessage;
 
+use servo_util::task_state;
+
 use std::default::Default;
 use url::Url;
 use js::jsapi::JSTracer;
@@ -91,15 +93,23 @@ impl tree_builder::Tracer<TrustedNodeAddress> for Tracer {
 
 impl JSTraceable for ServoHTMLParser {
     fn trace(&self, trc: *mut JSTracer) {
+        self.reflector_.trace(trc);
+
         let tracer = Tracer {
             trc: trc,
         };
         let tracer = &tracer as &tree_builder::Tracer<TrustedNodeAddress>;
 
-        self.reflector_.trace(trc);
-        let tokenizer = self.tokenizer.borrow();
-        let tree_builder = tokenizer.sink();
-        tree_builder.trace_handles(tracer);
-        tree_builder.sink().trace(trc);
+        unsafe {
+            // Assertion: If the parser is mutably borrowed, we're in the
+            // parsing code paths.
+            debug_assert!(task_state::get().contains(task_state::InHTMLParser)
+                || !self.tokenizer.is_mutably_borrowed());
+
+            let tokenizer = self.tokenizer.borrow_for_gc_trace();
+            let tree_builder = tokenizer.sink();
+            tree_builder.trace_handles(tracer);
+            tree_builder.sink().trace(trc);
+        }
     }
 }