diff --git a/dom/bindings/DOMJSProxyHandler.cpp b/dom/bindings/DOMJSProxyHandler.cpp index a21ac28a1b..c0e0662601 100644 --- a/dom/bindings/DOMJSProxyHandler.cpp +++ b/dom/bindings/DOMJSProxyHandler.cpp @@ -75,17 +75,9 @@ DOMProxyHandler::ClearExternalRefsForWrapperRelease(JSObject* obj) { MOZ_ASSERT(IsDOMProxy(obj), "expected a DOM proxy object"); JS::Value v = js::GetProxyExtra(obj, JSPROXYSLOT_EXPANDO); - if (v.isUndefined()) { - // No expando. - return; - } - - // See EnsureExpandoObject for the work we're trying to undo here. - - if (v.isObject()) { - // Drop us from the DOM expando hashtable. Don't worry about clearing our - // slot reference to the expando; we're about to die anyway. - xpc::ObjectScope(obj)->RemoveDOMExpandoObject(obj); + if (v.isUndefined() || v.isObject()) { + // No expando, or an expando that we reference from our slot anyway, so + // don't have to clear state for. return; } @@ -108,7 +100,6 @@ DOMProxyHandler::GetAndClearExpandoObject(JSObject* obj) if (v.isObject()) { js::SetProxyExtra(obj, JSPROXYSLOT_EXPANDO, UndefinedValue()); - xpc::ObjectScope(obj)->RemoveDOMExpandoObject(obj); } else { js::ExpandoAndGeneration* expandoAndGeneration = static_cast(v.toPrivate()); @@ -168,19 +159,14 @@ DOMProxyHandler::EnsureExpandoObject(JSContext* cx, JS::Handle obj) if (!cache) { return expando; } + cache->PreserveWrapper(native); if (expandoAndGeneration) { - cache->PreserveWrapper(native); expandoAndGeneration->expando.setObject(*expando); return expando; } - if (!xpc::ObjectScope(obj)->RegisterDOMExpandoObject(obj)) { - return nullptr; - } - - cache->SetPreservingWrapper(true); js::SetProxyExtra(obj, JSPROXYSLOT_EXPANDO, ObjectValue(*expando)); return expando;