feat(script): enable js::ProxyOptions::setLazyProto for maybe-cross-origin objects

Setting the lazy proto option allows proxy handlers to provide dynamic
prototype objects. This is necessary for the customization of
`ProxyTraps::{get,set}PrototypeOf` to actually take effect.

Cargo.lock

@@ -3808,7 +3808,7 @@ dependencies = [
 [[package]]
 name = "mozjs"
 version = "0.14.1"
-source = "git+https://github.com/servo/rust-mozjs#2e4c6a82c9f94210da7c452bb29de210fb658c1a"
+source = "git+https://github.com/servo/rust-mozjs#09edacd032fadc861b0cb3a70711a5c8a9bd7f8e"
 dependencies = [
  "cc",
  "lazy_static",

components/script/dom/bindings/codegen/CodegenRust.py

@@ -2874,6 +2874,13 @@ class CGWrapMethod(CGAbstractMethod):
     def definition_body(self):
         unforgeable = CopyUnforgeablePropertiesToInstance(self.descriptor)
         if self.descriptor.proxy:
+            if self.descriptor.isMaybeCrossOriginObject():
+                proto = "ptr::null_mut()"
+                lazyProto = "true"  # Our proxy handler will manage the prototype
+            else:
+                proto = "proto.get()"
+                lazyProto = "false"
+
             create = """
 let handler: *const libc::c_void =
     RegisterBindings::proxy_handlers::%(concreteType)s
@@ -2882,8 +2889,9 @@ rooted!(in(*cx) let obj = NewProxyObject(
     *cx,
     handler,
     Handle::from_raw(UndefinedHandleValue),
-    proto.get(),
+    %(proto)s,
     ptr::null(),
+    %(lazyProto)s,
 ));
 assert!(!obj.is_null());
 SetProxyReservedSlot(
@@ -2892,7 +2900,11 @@ SetProxyReservedSlot(
     &PrivateValue(raw.as_ptr() as *const %(concreteType)s as *const libc::c_void),
 );
 """
+            create = create % {"concreteType": self.descriptor.concreteType,
+                               "proto": proto,
+                               "lazyProto": lazyProto}
         else:
+            lazyProto = None
             create = """
 rooted!(in(*cx) let obj = JS_NewObjectWithGivenProto(
     *cx,