Bug 921448 - Implement sane default behavior for fun_toString for all proxies. r=ejpbruel
Bug 921448 - Use callability rather than object classes when determining how to toSource(). r=ejpbruel
Bug 921448 - Get rid of weird demultiplexing NewProxyObject overload. r=ejpbruel

Function proxies are going away with these patches. First, let's stop pretending
like they're equal citizens with regular proxies.
Bug 921448 - Stop creating a FunctionObjectProxy when a scripted direct proxy has a callable target. r=ejpbruel

There's no reason to store the target's [[Call]] in the reserved slot. If
there's no scripted call trap on the handler, DirectProxyHandler::call will
forward to the target, and we'll get that for free.
Bug 921448 - Stop using FunctionObjectProxies for ScriptedIndirectProxies. r=ejpbruel
Bug 921448 - Remove FunctionProxyObjects. r=ejpbruel

\o/
Bug 921448 - Move ProxyObject::New to vm/ProxyObject.cpp. r=ejpbruel
Bug 921454 - Allow chromeOnlyContent to work for non-chrome XBL documents. r=smaug

Given that we turn off XBL for the web, this just affects remote XUL/XBL, in
particular our tests. And it's expedient for NAC testing to be able to test
with an in-content XBL binding.
Bug 921454 - Skip unwrap safety assertion for cross-compartment SOWs. r=mrbkap

Currently this stuff just asserts when you pass NAC across compartments. And
the logic for this stuff is complicated enough that we don't gain a whole
lot from duplicating it.
Bug 921454 - Refactor proxy creation to use an options object. r=jonco
Bug 921454 - Add an option for explicitly forcing foreground finalization. r=jonco
Bug 921454 - Match the background-finalize-ity of the DeadObjectProxy with that of origobj in js_TransplantObjectWithWrapper. r=jonco
Bug 921454 - Use background-finalize-ity forwarding for all wrappers, not just CCWs. r=jonco

The current setup allows mismatches for same compartment wrappers, which causes
us to assert when transplanting them.
Bug 921454 - Invert faulty assertion. r=jonco

This assertion is pretty clearly bogus, and only exists because, as it turns
out, we never had any test coverage for transplanting SCSW objects with
waivers. Even in the world when this stuff landed (bug 773962, which was well
before the removal of Location SCSWs in bug 808608 and the conversion of Nodes
to new bindings), we apparently never tested the waiver path. :-(
Bug 921454 - Tests for NAC. r=jonco