Issue #2678 - Switch DOMProxyHandler::EnsureExpandoObject to using normal wrapper preservation instead of RegisterDOMExpandoObject.

This commit is contained in:
Moonchild 2025-01-16 22:41:37 +01:00 committed by roytam1
commit 45bb4cb8b4

View file

@ -75,17 +75,9 @@ DOMProxyHandler::ClearExternalRefsForWrapperRelease(JSObject* obj)
{
MOZ_ASSERT(IsDOMProxy(obj), "expected a DOM proxy object");
JS::Value v = js::GetProxyExtra(obj, JSPROXYSLOT_EXPANDO);
if (v.isUndefined()) {
// No expando.
return;
}
// See EnsureExpandoObject for the work we're trying to undo here.
if (v.isObject()) {
// Drop us from the DOM expando hashtable. Don't worry about clearing our
// slot reference to the expando; we're about to die anyway.
xpc::ObjectScope(obj)->RemoveDOMExpandoObject(obj);
if (v.isUndefined() || v.isObject()) {
// No expando, or an expando that we reference from our slot anyway, so
// don't have to clear state for.
return;
}
@ -108,7 +100,6 @@ DOMProxyHandler::GetAndClearExpandoObject(JSObject* obj)
if (v.isObject()) {
js::SetProxyExtra(obj, JSPROXYSLOT_EXPANDO, UndefinedValue());
xpc::ObjectScope(obj)->RemoveDOMExpandoObject(obj);
} else {
js::ExpandoAndGeneration* expandoAndGeneration =
static_cast<js::ExpandoAndGeneration*>(v.toPrivate());
@ -168,19 +159,14 @@ DOMProxyHandler::EnsureExpandoObject(JSContext* cx, JS::Handle<JSObject*> obj)
if (!cache) {
return expando;
}
cache->PreserveWrapper(native);
if (expandoAndGeneration) {
cache->PreserveWrapper(native);
expandoAndGeneration->expando.setObject(*expando);
return expando;
}
if (!xpc::ObjectScope(obj)->RegisterDOMExpandoObject(obj)) {
return nullptr;
}
cache->SetPreservingWrapper(true);
js::SetProxyExtra(obj, JSPROXYSLOT_EXPANDO, ObjectValue(*expando));
return expando;