From 0121aefb6177dbba66a50128a91d729851cd9633 Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Thu, 16 Jan 2025 23:01:00 +0100
Subject: [PATCH] Issue #2678 - Remove now-unnecessary
 ClearExternalRefsForWrapperRelease.

All DOMProxyHandler::ClearExternalRefsForWrapperRelease now does is clear
a backpointer to the expando, and that's handled during reflector
finalization already, making it redundant.
---
 dom/base/nsWrapperCache.cpp        |  8 --------
 dom/bindings/DOMJSProxyHandler.cpp | 19 -------------------
 dom/bindings/DOMJSProxyHandler.h   | 10 ----------
 3 files changed, 37 deletions(-)

diff --git a/dom/base/nsWrapperCache.cpp b/dom/base/nsWrapperCache.cpp
index bd1acf3187..7a3a760560 100644
--- a/dom/base/nsWrapperCache.cpp
+++ b/dom/base/nsWrapperCache.cpp
@@ -7,7 +7,6 @@
 
 #include "js/Class.h"
 #include "js/Proxy.h"
-#include "mozilla/dom/DOMJSProxyHandler.h"
 #include "mozilla/CycleCollectedJSContext.h"
 #include "mozilla/HoldDropJSObjects.h"
 #include "nsCycleCollectionTraversalCallback.h"
@@ -49,13 +48,6 @@ void
 nsWrapperCache::ReleaseWrapper(void* aScriptObjectHolder)
 {
   if (PreservingWrapper()) {
-    // PreserveWrapper puts new DOM bindings in the JS holders hash, but they
-    // can also be in the DOM expando hash, so we need to try to remove them
-    // from both here.
-    JSObject* obj = GetWrapperPreserveColor();
-    if (IsDOMBinding() && obj && js::IsProxy(obj)) {
-      DOMProxyHandler::ClearExternalRefsForWrapperRelease(obj);
-    }
     SetPreservingWrapper(false);
     cyclecollector::DropJSObjectsImpl(aScriptObjectHolder);
   }
diff --git a/dom/bindings/DOMJSProxyHandler.cpp b/dom/bindings/DOMJSProxyHandler.cpp
index c0e0662601..9466789918 100644
--- a/dom/bindings/DOMJSProxyHandler.cpp
+++ b/dom/bindings/DOMJSProxyHandler.cpp
@@ -69,25 +69,6 @@ struct SetDOMProxyInformation
 
 SetDOMProxyInformation gSetDOMProxyInformation;
 
-// static
-void
-DOMProxyHandler::ClearExternalRefsForWrapperRelease(JSObject* obj)
-{
-  MOZ_ASSERT(IsDOMProxy(obj), "expected a DOM proxy object");
-  JS::Value v = js::GetProxyExtra(obj, JSPROXYSLOT_EXPANDO);
-  if (v.isUndefined() || v.isObject()) {
-    // No expando, or an expando that we reference from our slot anyway, so
-    // don't have to clear state for.
-    return;
-  }
-
-  // Prevent having a dangling pointer to our expando from the
-  // ExpandoAndGeneration.
-  js::ExpandoAndGeneration* expandoAndGeneration =
-    static_cast<js::ExpandoAndGeneration*>(v.toPrivate());
-  expandoAndGeneration->expando = UndefinedValue();
-}
-
 // static
 JSObject*
 DOMProxyHandler::GetAndClearExpandoObject(JSObject* obj)
diff --git a/dom/bindings/DOMJSProxyHandler.h b/dom/bindings/DOMJSProxyHandler.h
index cd6e664974..86cc70555b 100644
--- a/dom/bindings/DOMJSProxyHandler.h
+++ b/dom/bindings/DOMJSProxyHandler.h
@@ -131,16 +131,6 @@ public:
    */
   static JSObject* GetExpandoObject(JSObject* obj);
 
-  /*
-   * Clear the "external references" to this object.  If you are not
-   * nsWrapperCAche::ReleaseWrapper, you do NOT want to be calling this method.
-   *
-   * XXXbz if we nixed the DOM expando hash and just had a finalizer that
-   * cleared out the value in the ExpandoAndGeneration in the shadowing case,
-   * could we just get rid of this function altogether?
-   */
-  static void ClearExternalRefsForWrapperRelease(JSObject* obj);
-
   /*
    * Clear the expando object for the given DOM proxy and return it.  This
    * function will ensure that the returned object is exposed to active JS if