Move more bindings code to script_bindings (#35578)

* Move JSContext wrapper to script_bindings.

Signed-off-by: Josh Matthews <josh@joshmatthews.net>

* Move webidl constant bindings to script_bindings.

Signed-off-by: Josh Matthews <josh@joshmatthews.net>

* Move CanGc to script_bindings.

Signed-off-by: Josh Matthews <josh@joshmatthews.net>

* Move Dom<T> and Root<T> types to script_bindings.

Signed-off-by: Josh Matthews <josh@joshmatthews.net>

* Formatting.

Signed-off-by: Josh Matthews <josh@joshmatthews.net>

* Extra docs for new traits.

Signed-off-by: Josh Matthews <josh@joshmatthews.net>

* Fix clippy warnings.

Signed-off-by: Josh Matthews <josh@joshmatthews.net>

---------

Signed-off-by: Josh Matthews <josh@joshmatthews.net>

components/script_bindings/constant.rs

@@ -0,0 +1,70 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+//! WebIDL constants.
+
+use std::ffi::CStr;
+
+use js::jsapi::{JSPROP_ENUMERATE, JSPROP_PERMANENT, JSPROP_READONLY};
+use js::jsval::{BooleanValue, DoubleValue, Int32Value, JSVal, NullValue, UInt32Value};
+use js::rooted;
+use js::rust::wrappers::JS_DefineProperty;
+use js::rust::HandleObject;
+
+use crate::script_runtime::JSContext;
+
+/// Representation of an IDL constant.
+#[derive(Clone)]
+pub struct ConstantSpec {
+    /// name of the constant.
+    pub name: &'static CStr,
+    /// value of the constant.
+    pub value: ConstantVal,
+}
+
+/// Representation of an IDL constant value.
+#[derive(Clone)]
+#[allow(dead_code)]
+pub enum ConstantVal {
+    /// `long` constant.
+    Int(i32),
+    /// `unsigned long` constant.
+    Uint(u32),
+    /// `double` constant.
+    Double(f64),
+    /// `boolean` constant.
+    Bool(bool),
+    /// `null` constant.
+    Null,
+}
+
+impl ConstantSpec {
+    /// Returns a `JSVal` that represents the value of this `ConstantSpec`.
+    pub fn get_value(&self) -> JSVal {
+        match self.value {
+            ConstantVal::Null => NullValue(),
+            ConstantVal::Int(i) => Int32Value(i),
+            ConstantVal::Uint(u) => UInt32Value(u),
+            ConstantVal::Double(d) => DoubleValue(d),
+            ConstantVal::Bool(b) => BooleanValue(b),
+        }
+    }
+}
+
+/// Defines constants on `obj`.
+/// Fails on JSAPI failure.
+pub fn define_constants(cx: JSContext, obj: HandleObject, constants: &[ConstantSpec]) {
+    for spec in constants {
+        rooted!(in(*cx) let value = spec.get_value());
+        unsafe {
+            assert!(JS_DefineProperty(
+                *cx,
+                obj,
+                spec.name.as_ptr(),
+                value.handle(),
+                (JSPROP_ENUMERATE | JSPROP_READONLY | JSPROP_PERMANENT) as u32
+            ));
+        }
+    }
+}

components/script_bindings/conversions.rs

@@ -8,18 +8,23 @@ use js::conversions::{
     latin1_to_string, ConversionResult, FromJSValConvertible, ToJSValConvertible,
 };
 use js::error::throw_type_error;
-use js::glue::{GetProxyHandlerExtra, IsProxyHandlerFamily};
+use js::glue::{
+    GetProxyHandlerExtra, GetProxyReservedSlot, IsProxyHandlerFamily, IsWrapper,
+    JS_GetReservedSlot, UnwrapObjectDynamic,
+};
 use js::jsapi::{
     JSContext, JSObject, JSString, JS_DeprecatedStringHasLatin1Chars,
     JS_GetLatin1StringCharsAndLength, JS_GetTwoByteStringCharsAndLength, JS_NewStringCopyN,
 };
-use js::jsval::{ObjectValue, StringValue};
+use js::jsval::{ObjectValue, StringValue, UndefinedValue};
 use js::rust::{
-    get_object_class, is_dom_class, maybe_wrap_value, HandleValue, MutableHandleValue, ToString,
+    get_object_class, is_dom_class, is_dom_object, maybe_wrap_value, HandleValue,
+    MutableHandleValue, ToString,
 };
 
 use crate::inheritance::Castable;
-use crate::reflector::Reflector;
+use crate::reflector::{DomObject, Reflector};
+use crate::root::DomRoot;
 use crate::str::{ByteString, DOMString, USVString};
 use crate::utils::{DOMClass, DOMJSClass};
 
@@ -199,6 +204,27 @@ impl ToJSValConvertible for Reflector {
     }
 }
 
+impl<T: DomObject + IDLInterface> FromJSValConvertible for DomRoot<T> {
+    type Config = ();
+
+    unsafe fn from_jsval(
+        cx: *mut JSContext,
+        value: HandleValue,
+        _config: Self::Config,
+    ) -> Result<ConversionResult<DomRoot<T>>, ()> {
+        Ok(match root_from_handlevalue(value, cx) {
+            Ok(result) => ConversionResult::Success(result),
+            Err(()) => ConversionResult::Failure("value is not an object".into()),
+        })
+    }
+}
+
+impl<T: DomObject> ToJSValConvertible for DomRoot<T> {
+    unsafe fn to_jsval(&self, cx: *mut JSContext, rval: MutableHandleValue) {
+        self.reflector().to_jsval(cx, rval);
+    }
+}
+
 /// Get the `DOMClass` from `obj`, or `Err(())` if `obj` is not a DOM object.
 ///
 /// # Safety
@@ -230,3 +256,134 @@ pub unsafe fn is_dom_proxy(obj: *mut JSObject) -> bool {
         ((*clasp).flags & js::JSCLASS_IS_PROXY) != 0 && IsProxyHandlerFamily(obj)
     }
 }
+
+/// The index of the slot wherein a pointer to the reflected DOM object is
+/// stored for non-proxy bindings.
+// We use slot 0 for holding the raw object.  This is safe for both
+// globals and non-globals.
+pub const DOM_OBJECT_SLOT: u32 = 0;
+
+/// Get the private pointer of a DOM object from a given reflector.
+///
+/// # Safety
+/// obj must point to a valid non-null JS object.
+pub unsafe fn private_from_object(obj: *mut JSObject) -> *const libc::c_void {
+    let mut value = UndefinedValue();
+    if is_dom_object(obj) {
+        JS_GetReservedSlot(obj, DOM_OBJECT_SLOT, &mut value);
+    } else {
+        debug_assert!(is_dom_proxy(obj));
+        GetProxyReservedSlot(obj, 0, &mut value);
+    };
+    if value.is_undefined() {
+        ptr::null()
+    } else {
+        value.to_private()
+    }
+}
+
+pub enum PrototypeCheck {
+    Derive(fn(&'static DOMClass) -> bool),
+    Depth { depth: usize, proto_id: u16 },
+}
+
+/// Get a `*const libc::c_void` for the given DOM object, unwrapping any
+/// wrapper around it first, and checking if the object is of the correct type.
+///
+/// Returns Err(()) if `obj` is an opaque security wrapper or if the object is
+/// not an object for a DOM object of the given type (as defined by the
+/// proto_id and proto_depth).
+///
+/// # Safety
+/// obj must point to a valid, non-null JS object.
+/// cx must point to a valid, non-null JS context.
+#[inline]
+#[allow(clippy::result_unit_err)]
+pub unsafe fn private_from_proto_check(
+    mut obj: *mut JSObject,
+    cx: *mut JSContext,
+    proto_check: PrototypeCheck,
+) -> Result<*const libc::c_void, ()> {
+    let dom_class = get_dom_class(obj).or_else(|_| {
+        if IsWrapper(obj) {
+            trace!("found wrapper");
+            obj = UnwrapObjectDynamic(obj, cx, /* stopAtWindowProxy = */ false);
+            if obj.is_null() {
+                trace!("unwrapping security wrapper failed");
+                Err(())
+            } else {
+                assert!(!IsWrapper(obj));
+                trace!("unwrapped successfully");
+                get_dom_class(obj)
+            }
+        } else {
+            trace!("not a dom wrapper");
+            Err(())
+        }
+    })?;
+
+    let prototype_matches = match proto_check {
+        PrototypeCheck::Derive(f) => (f)(dom_class),
+        PrototypeCheck::Depth { depth, proto_id } => {
+            dom_class.interface_chain[depth] as u16 == proto_id
+        },
+    };
+
+    if prototype_matches {
+        trace!("good prototype");
+        Ok(private_from_object(obj))
+    } else {
+        trace!("bad prototype");
+        Err(())
+    }
+}
+
+/// Get a `*const T` for a DOM object accessible from a `JSObject`.
+///
+/// # Safety
+/// obj must point to a valid, non-null JS object.
+/// cx must point to a valid, non-null JS context.
+#[allow(clippy::result_unit_err)]
+pub unsafe fn native_from_object<T>(obj: *mut JSObject, cx: *mut JSContext) -> Result<*const T, ()>
+where
+    T: DomObject + IDLInterface,
+{
+    unsafe {
+        private_from_proto_check(obj, cx, PrototypeCheck::Derive(T::derives))
+            .map(|ptr| ptr as *const T)
+    }
+}
+
+/// Get a `DomRoot<T>` for the given DOM object, unwrapping any wrapper
+/// around it first, and checking if the object is of the correct type.
+///
+/// Returns Err(()) if `obj` is an opaque security wrapper or if the object is
+/// not a reflector for a DOM object of the given type (as defined by the
+/// proto_id and proto_depth).
+///
+/// # Safety
+/// obj must point to a valid, non-null JS object.
+/// cx must point to a valid, non-null JS context.
+#[allow(clippy::result_unit_err)]
+pub unsafe fn root_from_object<T>(obj: *mut JSObject, cx: *mut JSContext) -> Result<DomRoot<T>, ()>
+where
+    T: DomObject + IDLInterface,
+{
+    native_from_object(obj, cx).map(|ptr| unsafe { DomRoot::from_ref(&*ptr) })
+}
+
+/// Get a `DomRoot<T>` for a DOM object accessible from a `HandleValue`.
+/// Caller is responsible for throwing a JS exception if needed in case of error.
+///
+/// # Safety
+/// cx must point to a valid, non-null JS context.
+#[allow(clippy::result_unit_err)]
+pub unsafe fn root_from_handlevalue<T>(v: HandleValue, cx: *mut JSContext) -> Result<DomRoot<T>, ()>
+where
+    T: DomObject + IDLInterface,
+{
+    if !v.get().is_object() {
+        return Err(());
+    }
+    root_from_object(v.get().to_object(), cx)
+}

components/script_bindings/lib.rs

@@ -18,12 +18,14 @@ extern crate log;
 extern crate malloc_size_of_derive;
 
 pub mod callback;
+pub mod constant;
 pub mod conversions;
 pub mod inheritance;
 pub mod reflector;
+pub mod root;
 pub mod script_runtime;
 pub mod str;
-mod trace;
+pub mod trace;
 pub mod utils;
 
 #[allow(non_snake_case)]

components/script_bindings/root.rs

@@ -0,0 +1,432 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+use std::cell::{Cell, UnsafeCell};
+use std::hash::{Hash, Hasher};
+use std::ops::Deref;
+use std::{fmt, mem, ptr};
+
+use js::gc::Traceable as JSTraceable;
+use js::jsapi::{JSObject, JSTracer};
+use malloc_size_of::{MallocSizeOf, MallocSizeOfOps};
+use style::thread_state;
+
+use crate::conversions::DerivedFrom;
+use crate::inheritance::Castable;
+use crate::reflector::{DomObject, MutDomObject, Reflector};
+use crate::trace::trace_reflector;
+
+/// A rooted value.
+#[cfg_attr(crown, crown::unrooted_must_root_lint::allow_unrooted_interior)]
+pub struct Root<T: StableTraceObject> {
+    /// The value to root.
+    value: T,
+    /// List that ensures correct dynamic root ordering
+    root_list: *const RootCollection,
+}
+
+impl<T> Root<T>
+where
+    T: StableTraceObject + 'static,
+{
+    /// Create a new stack-bounded root for the provided value.
+    /// It gives out references which cannot outlive this new `Root`.
+    ///
+    /// # Safety
+    /// It must not outlive its associated `RootCollection`.
+    #[cfg_attr(crown, allow(crown::unrooted_must_root))]
+    pub unsafe fn new(value: T) -> Self {
+        unsafe fn add_to_root_list(object: *const dyn JSTraceable) -> *const RootCollection {
+            assert_in_script();
+            STACK_ROOTS.with(|root_list| {
+                let root_list = &*root_list.get().unwrap();
+                root_list.root(object);
+                root_list
+            })
+        }
+
+        let root_list = add_to_root_list(value.stable_trace_object());
+        Root { value, root_list }
+    }
+}
+
+/// `StableTraceObject` represents values that can be rooted through a stable address that will
+/// not change for their whole lifetime.
+/// It is an unsafe trait that requires implementors to ensure certain safety guarantees.
+///
+/// # Safety
+///
+/// Implementors of this trait must ensure that the `trace` method correctly accounts for all
+/// owned and referenced objects, so that the garbage collector can accurately determine which
+/// objects are still in use. Failing to adhere to this contract may result in undefined behavior,
+/// such as use-after-free errors.
+pub unsafe trait StableTraceObject {
+    /// Returns a stable trace object which address won't change for the whole
+    /// lifetime of the value.
+    fn stable_trace_object(&self) -> *const dyn JSTraceable;
+}
+
+unsafe impl<T> StableTraceObject for Dom<T>
+where
+    T: DomObject,
+{
+    fn stable_trace_object(&self) -> *const dyn JSTraceable {
+        // The JSTraceable impl for Reflector doesn't actually do anything,
+        // so we need this shenanigan to actually trace the reflector of the
+        // T pointer in Dom<T>.
+        #[cfg_attr(crown, allow(crown::unrooted_must_root))]
+        struct ReflectorStackRoot(Reflector);
+        unsafe impl JSTraceable for ReflectorStackRoot {
+            unsafe fn trace(&self, tracer: *mut JSTracer) {
+                trace_reflector(tracer, "on stack", &self.0);
+            }
+        }
+        unsafe { &*(self.reflector() as *const Reflector as *const ReflectorStackRoot) }
+    }
+}
+
+unsafe impl<T> StableTraceObject for MaybeUnreflectedDom<T>
+where
+    T: DomObject,
+{
+    fn stable_trace_object(&self) -> *const dyn JSTraceable {
+        // The JSTraceable impl for Reflector doesn't actually do anything,
+        // so we need this shenanigan to actually trace the reflector of the
+        // T pointer in Dom<T>.
+        #[cfg_attr(crown, allow(crown::unrooted_must_root))]
+        struct MaybeUnreflectedStackRoot<T>(T);
+        unsafe impl<T> JSTraceable for MaybeUnreflectedStackRoot<T>
+        where
+            T: DomObject,
+        {
+            unsafe fn trace(&self, tracer: *mut JSTracer) {
+                if self.0.reflector().get_jsobject().is_null() {
+                    self.0.trace(tracer);
+                } else {
+                    trace_reflector(tracer, "on stack", self.0.reflector());
+                }
+            }
+        }
+        unsafe { &*(self.ptr.as_ptr() as *const T as *const MaybeUnreflectedStackRoot<T>) }
+    }
+}
+
+impl<T> Deref for Root<T>
+where
+    T: Deref + StableTraceObject,
+{
+    type Target = <T as Deref>::Target;
+
+    fn deref(&self) -> &Self::Target {
+        assert_in_script();
+        &self.value
+    }
+}
+
+impl<T> Drop for Root<T>
+where
+    T: StableTraceObject,
+{
+    fn drop(&mut self) {
+        unsafe {
+            (*self.root_list).unroot(self.value.stable_trace_object());
+        }
+    }
+}
+
+impl<T: fmt::Debug + StableTraceObject> fmt::Debug for Root<T> {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        self.value.fmt(f)
+    }
+}
+
+impl<T: fmt::Debug + DomObject> fmt::Debug for Dom<T> {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        (**self).fmt(f)
+    }
+}
+
+/// A traced reference to a DOM object
+///
+/// This type is critical to making garbage collection work with the DOM,
+/// but it is very dangerous; if garbage collection happens with a `Dom<T>`
+/// on the stack, the `Dom<T>` can point to freed memory.
+///
+/// This should only be used as a field in other DOM objects.
+#[cfg_attr(crown, crown::unrooted_must_root_lint::must_root)]
+#[repr(transparent)]
+pub struct Dom<T> {
+    ptr: ptr::NonNull<T>,
+}
+
+// Dom<T> is similar to Rc<T>, in that it's not always clear how to avoid double-counting.
+// For now, we choose not to follow any such pointers.
+impl<T> MallocSizeOf for Dom<T> {
+    fn size_of(&self, _ops: &mut MallocSizeOfOps) -> usize {
+        0
+    }
+}
+
+impl<T> PartialEq for Dom<T> {
+    fn eq(&self, other: &Dom<T>) -> bool {
+        self.ptr.as_ptr() == other.ptr.as_ptr()
+    }
+}
+
+impl<'a, T: DomObject> PartialEq<&'a T> for Dom<T> {
+    fn eq(&self, other: &&'a T) -> bool {
+        *self == Dom::from_ref(*other)
+    }
+}
+
+impl<T> Eq for Dom<T> {}
+
+impl<T> Hash for Dom<T> {
+    fn hash<H: Hasher>(&self, state: &mut H) {
+        self.ptr.as_ptr().hash(state)
+    }
+}
+
+impl<T> Clone for Dom<T> {
+    #[inline]
+    #[cfg_attr(crown, allow(crown::unrooted_must_root))]
+    fn clone(&self) -> Self {
+        assert_in_script();
+        Dom { ptr: self.ptr }
+    }
+}
+
+impl<T: DomObject> Dom<T> {
+    /// Create a `Dom<T>` from a `&T`
+    #[cfg_attr(crown, allow(crown::unrooted_must_root))]
+    pub fn from_ref(obj: &T) -> Dom<T> {
+        assert_in_script();
+        Dom {
+            ptr: ptr::NonNull::from(obj),
+        }
+    }
+
+    /// Return a rooted version of this DOM object ([`DomRoot<T>`]) suitable for use on the stack.
+    pub fn as_rooted(&self) -> DomRoot<T> {
+        DomRoot::from_ref(self)
+    }
+
+    pub fn as_ptr(&self) -> *const T {
+        self.ptr.as_ptr()
+    }
+}
+
+impl<T: DomObject> Deref for Dom<T> {
+    type Target = T;
+
+    fn deref(&self) -> &T {
+        assert_in_script();
+        // We can only have &Dom<T> from a rooted thing, so it's safe to deref
+        // it to &T.
+        unsafe { &*self.ptr.as_ptr() }
+    }
+}
+
+unsafe impl<T: DomObject> JSTraceable for Dom<T> {
+    unsafe fn trace(&self, trc: *mut JSTracer) {
+        let trace_string;
+        let trace_info = if cfg!(debug_assertions) {
+            trace_string = format!("for {} on heap", ::std::any::type_name::<T>());
+            &trace_string[..]
+        } else {
+            "for DOM object on heap"
+        };
+        trace_reflector(trc, trace_info, (*self.ptr.as_ptr()).reflector());
+    }
+}
+
+/// A traced reference to a DOM object that may not be reflected yet.
+#[cfg_attr(crown, crown::unrooted_must_root_lint::must_root)]
+pub struct MaybeUnreflectedDom<T> {
+    ptr: ptr::NonNull<T>,
+}
+
+impl<T> MaybeUnreflectedDom<T>
+where
+    T: DomObject,
+{
+    /// Create a new MaybeUnreflectedDom value from the given boxed DOM object.
+    ///
+    /// # Safety
+    /// TODO: unclear why this is marked unsafe.
+    #[cfg_attr(crown, allow(crown::unrooted_must_root))]
+    pub unsafe fn from_box(value: Box<T>) -> Self {
+        Self {
+            ptr: Box::leak(value).into(),
+        }
+    }
+}
+
+impl<T> Root<MaybeUnreflectedDom<T>>
+where
+    T: DomObject,
+{
+    pub fn as_ptr(&self) -> *const T {
+        self.value.ptr.as_ptr()
+    }
+}
+
+impl<T> Root<MaybeUnreflectedDom<T>>
+where
+    T: MutDomObject,
+{
+    /// Treat the given JS object as the reflector of this unreflected object.
+    ///
+    /// # Safety
+    /// obj must point to a valid, non-null JS object.
+    pub unsafe fn reflect_with(self, obj: *mut JSObject) -> DomRoot<T> {
+        let ptr = self.as_ptr();
+        drop(self);
+        let root = DomRoot::from_ref(&*ptr);
+        root.init_reflector(obj);
+        root
+    }
+}
+
+/// A rooted reference to a DOM object.
+pub type DomRoot<T> = Root<Dom<T>>;
+
+impl<T: Castable> DomRoot<T> {
+    /// Cast a DOM object root upwards to one of the interfaces it derives from.
+    pub fn upcast<U>(root: DomRoot<T>) -> DomRoot<U>
+    where
+        U: Castable,
+        T: DerivedFrom<U>,
+    {
+        unsafe { mem::transmute::<DomRoot<T>, DomRoot<U>>(root) }
+    }
+
+    /// Cast a DOM object root downwards to one of the interfaces it might implement.
+    pub fn downcast<U>(root: DomRoot<T>) -> Option<DomRoot<U>>
+    where
+        U: DerivedFrom<T>,
+    {
+        if root.is::<U>() {
+            Some(unsafe { mem::transmute::<DomRoot<T>, DomRoot<U>>(root) })
+        } else {
+            None
+        }
+    }
+}
+
+impl<T: DomObject> DomRoot<T> {
+    /// Generate a new root from a reference
+    pub fn from_ref(unrooted: &T) -> DomRoot<T> {
+        unsafe { DomRoot::new(Dom::from_ref(unrooted)) }
+    }
+
+    /// Create a traced version of this rooted object.
+    ///
+    /// # Safety
+    ///
+    /// This should never be used to create on-stack values. Instead these values should always
+    /// end up as members of other DOM objects.
+    #[cfg_attr(crown, allow(crown::unrooted_must_root))]
+    pub fn as_traced(&self) -> Dom<T> {
+        Dom::from_ref(self)
+    }
+}
+
+impl<T> MallocSizeOf for DomRoot<T>
+where
+    T: DomObject + MallocSizeOf,
+{
+    fn size_of(&self, ops: &mut MallocSizeOfOps) -> usize {
+        (**self).size_of(ops)
+    }
+}
+
+impl<T> PartialEq for DomRoot<T>
+where
+    T: DomObject,
+{
+    fn eq(&self, other: &Self) -> bool {
+        self.value == other.value
+    }
+}
+
+impl<T> Clone for DomRoot<T>
+where
+    T: DomObject,
+{
+    fn clone(&self) -> DomRoot<T> {
+        DomRoot::from_ref(self)
+    }
+}
+
+unsafe impl<T> JSTraceable for DomRoot<T>
+where
+    T: DomObject,
+{
+    unsafe fn trace(&self, _: *mut JSTracer) {
+        // Already traced.
+    }
+}
+
+/// A rooting mechanism for reflectors on the stack.
+/// LIFO is not required.
+///
+/// See also [*Exact Stack Rooting - Storing a GCPointer on the CStack*][cstack].
+///
+/// [cstack]: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey/Internals/GC/Exact_Stack_Rooting
+pub struct RootCollection {
+    roots: UnsafeCell<Vec<*const dyn JSTraceable>>,
+}
+
+impl RootCollection {
+    /// Create an empty collection of roots
+    #[allow(clippy::new_without_default)]
+    pub fn new() -> RootCollection {
+        assert_in_script();
+        RootCollection {
+            roots: UnsafeCell::new(vec![]),
+        }
+    }
+
+    /// Starts tracking a trace object.
+    unsafe fn root(&self, object: *const dyn JSTraceable) {
+        assert_in_script();
+        (*self.roots.get()).push(object);
+    }
+
+    /// Stops tracking a trace object, asserting if it isn't found.
+    unsafe fn unroot(&self, object: *const dyn JSTraceable) {
+        assert_in_script();
+        let roots = &mut *self.roots.get();
+        match roots
+            .iter()
+            .rposition(|r| std::ptr::addr_eq(*r as *const (), object as *const ()))
+        {
+            Some(idx) => {
+                roots.remove(idx);
+            },
+            None => panic!("Can't remove a root that was never rooted!"),
+        }
+    }
+}
+
+thread_local!(pub static STACK_ROOTS: Cell<Option<*const RootCollection>> = const { Cell::new(None) });
+
+/// SM Callback that traces the rooted reflectors
+///
+/// # Safety
+/// tracer must point to a valid, non-null JS tracer object.
+pub unsafe fn trace_roots(tracer: *mut JSTracer) {
+    trace!("tracing stack roots");
+    STACK_ROOTS.with(|collection| {
+        let collection = &*(*collection.get().unwrap()).roots.get();
+        for root in collection {
+            (**root).trace(tracer);
+        }
+    });
+}
+
+pub fn assert_in_script() {
+    debug_assert!(thread_state::get().is_script());
+}

components/script_bindings/script_runtime.rs

@@ -3,6 +3,35 @@
  * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
 
 use std::cell::Cell;
+use std::marker::PhantomData;
+use std::ops::Deref;
+
+use js::jsapi::JSContext as RawJSContext;
+
+#[derive(Clone, Copy)]
+#[repr(transparent)]
+pub struct JSContext(*mut RawJSContext);
+
+#[allow(unsafe_code)]
+impl JSContext {
+    /// Create a new [`JSContext`] object from the given raw pointer.
+    ///
+    /// # Safety
+    ///
+    /// The `RawJSContext` argument must point to a valid `RawJSContext` in memory.
+    pub unsafe fn from_ptr(raw_js_context: *mut RawJSContext) -> Self {
+        JSContext(raw_js_context)
+    }
+}
+
+#[allow(unsafe_code)]
+impl Deref for JSContext {
+    type Target = *mut RawJSContext;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
 
 thread_local!(
     static THREAD_ACTIVE: Cell<bool> = const { Cell::new(true) };
@@ -15,3 +44,19 @@ pub fn runtime_is_alive() -> bool {
 pub fn mark_runtime_dead() {
     THREAD_ACTIVE.with(|t| t.set(false));
 }
+
+#[derive(Clone, Copy, Debug)]
+/// A compile-time marker that there are operations that could trigger a JS garbage collection
+/// operation within the current stack frame. It is trivially copyable, so it should be passed
+/// as a function argument and reused when calling other functions whenever possible. Since it
+/// is only meaningful within the current stack frame, it is impossible to move it to a different
+/// thread or into a task that will execute asynchronously.
+pub struct CanGc(PhantomData<*mut ()>);
+
+impl CanGc {
+    /// Create a new CanGc value, representing that a GC operation is possible within the
+    /// current stack frame.
+    pub fn note() -> CanGc {
+        CanGc(PhantomData)
+    }
+}

components/script_bindings/trace.rs

@@ -2,8 +2,37 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
 
+use js::glue::CallObjectTracer;
+use js::jsapi::{GCTraceKindToAscii, Heap, JSObject, JSTracer, TraceKind};
+
+use crate::reflector::Reflector;
 use crate::str::{DOMString, USVString};
 
+/// Trace the `JSObject` held by `reflector`.
+///
+/// # Safety
+/// tracer must point to a valid, non-null JS tracer.
+#[cfg_attr(crown, allow(crown::unrooted_must_root))]
+pub unsafe fn trace_reflector(tracer: *mut JSTracer, description: &str, reflector: &Reflector) {
+    trace!("tracing reflector {}", description);
+    trace_object(tracer, description, reflector.rootable())
+}
+
+/// Trace a `JSObject`.
+///
+/// # Safety
+/// tracer must point to a valid, non-null JS tracer.
+pub unsafe fn trace_object(tracer: *mut JSTracer, description: &str, obj: &Heap<*mut JSObject>) {
+    unsafe {
+        trace!("tracing {}", description);
+        CallObjectTracer(
+            tracer,
+            obj.ptr.get() as *mut _,
+            GCTraceKindToAscii(TraceKind::Object),
+        );
+    }
+}
+
 /// For use on non-jsmanaged types
 /// Use #[derive(JSTraceable)] on JS managed types
 macro_rules! unsafe_no_jsmanaged_fields(