Bug 865745 - Stop depending on mCx during frame script execution. r=smaug
Bug 865745 - Rename nsFrameScriptExecutor::DidCreateCx. r=smaug
Bug 865745 - Hold a strong ref to the global for the duration that each nsFrameScriptCx is on the stack. r=smaug

These things currently do a complicated refcounting dance to avoid destroying the
cx until all the consumers of it are gone. That stuff can mostly go away now that
we're just using the SafeJSContext, but DestroyCx also nulls out the global, so
we should make sure to keep that alive for anyone that might be using it.
Bug 865745 - Use an AutoSafeJSContext in nsFrameMessageManager::ReceiveMessage. r=smaug

This function proceeds to push its cx and enters a compartment, so it can't be
depending on any compartment or callstack state of the cx it's using. The only
potential issue would then be reporting the error to the correct DOM window, but
this stuff is used only for chrome, where that doesn't matter. The safe JSContext
uses the same error reporter as JSMs and such, which is probably fine.
Bug 865745 - Remove redundant cx push. r=smaug

AutoSafeJSContext will always push.
Bug 865745 - Use a SafeJSContext in TabChildParent. r=smaug

This is just used for rooting, but happens to be a consumer of
nsFrameMessageManager::GetJSContext, which we're about to remove.
Bug 865745 - Remove mContext from nsFrameMessageManager. r=smaug
Bug 865745 - Check mGlobal instead of mCx to see if we're in a functional state. r=smaug

Their lifetimes should be the same, and the latter is going away.
Bug 865745 - Return the safe JSContext for Tab Children in GetJSContextForEventHandlers. r=smaug
Bug 865745 - Remove mCx from nsFrameScriptExecutor. r=smaug
Bug 865745 - Remove nsFrameScriptExecutor::DestroyCx. r=smaug