layout: Stop racing on the JSManaged borrow flags

src/components/script/dom/bindings/js.rs

@@ -89,6 +89,13 @@ impl<T> JS<T> {
             &mut (**borrowed.get())
         }
     }
+
+    /// Returns an unsafe pointer to the interior of this JS object without touching the borrow
+    /// flags. This is the only method that be safely accessed from layout. (The fact that this
+    /// is unsafe is what necessitates the layout wrappers.)
+    pub unsafe fn unsafe_get(&self) -> *mut T {
+        cast::transmute_copy(&self.ptr)
+    }
 }
 
 impl<From, To> JS<From> {
@@ -96,4 +103,8 @@ impl<From, To> JS<From> {
     pub unsafe fn transmute(self) -> JS<To> {
         cast::transmute(self)
     }
+
+    pub unsafe fn transmute_copy(&self) -> JS<To> {
+        cast::transmute_copy(self)
+    }
 }

src/components/script/dom/node.rs

@@ -332,7 +332,7 @@ impl NodeHelpers for JS<Node> {
     fn parent_node(&self) -> Option<JS<Node>> {
         self.get().parent_node.clone()
     }
-
+    
     fn first_child(&self) -> Option<JS<Node>> {
         self.get().first_child.clone()
     }
@@ -1590,6 +1590,31 @@ impl Node {
     pub fn set_hover_state(&mut self, state: bool) {
         self.flags.set_is_in_hover_state(state);
     }
+
+    #[inline]
+    pub fn parent_node_ref<'a>(&'a self) -> Option<&'a JS<Node>> {
+        self.parent_node.as_ref()
+    }
+
+    #[inline]
+    pub fn first_child_ref<'a>(&'a self) -> Option<&'a JS<Node>> {
+        self.first_child.as_ref()
+    }
+
+    #[inline]
+    pub fn last_child_ref<'a>(&'a self) -> Option<&'a JS<Node>> {
+        self.last_child.as_ref()
+    }
+
+    #[inline]
+    pub fn prev_sibling_ref<'a>(&'a self) -> Option<&'a JS<Node>> {
+        self.prev_sibling.as_ref()
+    }
+
+    #[inline]
+    pub fn next_sibling_ref<'a>(&'a self) -> Option<&'a JS<Node>> {
+        self.next_sibling.as_ref()
+    }
 }
 
 impl Reflectable for Node {