Bug 853283 - Grab the window directly from the navigator in nsNavigatorSH::NewResolve. r=mrbkap
Bug 658909 - Force |this| computation in SandboxCallableProxyHandler::call when using Xrays. r=bz

Comment says it all.
Bug 658909 - Make isSafeToUnwrap pseudo-dynamic for SOWs. r=mrbkap

This can go away as soon as XBL scopes are no longer behind a pref.
Bug 658909 - Remove unnecessary ccx param. r=mrbkap
Bug 658909 - Initialize the same fields in both XPCCallContext constructors. r=mrbkap

This is a huge footgun. XPCCallContext is hot, but it's not too hot to be safe
here. Garbage XPCWN and JSObject pointers are bad.
Bug 658909 - Set args at XPCCallContext construct time in XPC_WN_GetterSetter. r=mrbkap

It's not clear to me why it's done this way, but it confuses our ability to
determine during wrapper lookup whether we're doing a set or a get. This aligns
the behavior with XPC_WN_CallMethod, including passing JSID_VOID for the name
(which is safe because XPCCallContext explicitly special-cases JSID_VOID and
doesn't call SetName in that case).
Bug 658909 - Implement carefully-checked unwrapping in XPCCallContext. r=mrbkap
Bug 658909 - Use JS_{,Strict}PropertyOp instead of null when defining value props in nsDOMClassInfo. r=mrbkap

Using JSPropertyOp means a null shape getter, whereas null means that the shape
uses the class getter. This means that stuff like window.top, which is defined
as a non-configurable |own| property in nsDOMClassInfo, was getting set up with
XPC_WN_Helper_GetProperty as its get operation. But this confused
SandboxProxyHandler, which explicitly avoids rebinding class getters/setters,
which in turn meant that our sandboxPrototype feature was relying on the crazy
prototype-climbing behavior of GetWrappedNativeOfJSObject to make stuff like
|this.top| work. We're removing this behavior, so we need to fix nsDOMClassInfo
here.

Here are some DefineProperty cases that I left with null getters/setters:
* nsDOMClassInfo::ResolveConstructor
* The child window stuff at the bottom of nsWindowSH::NewResolve
* Named item resolution in nsNamedArraySH::NewResolve
* document.all stuff (scary!)
* nsHTMLDocumentSH::NewResolve
* nsHTMLFormElementSH::NewResolve
* nsStorage2SH::NewResolve
Bug 658909 - Add a hack to support calling nohelper XPCWN methods without the proper |this|. r=mrbkap
Bug 658909 - Stop doing all the crazy stuff in GetWrappedNativeOfJSObject. r=mrbkap
Bug 658909 - Add a new, much simpler API for getting WNs from JS objects. r=mrbkap
Bug 658909 - Remove GWNOJO from MarkWrappedNative. r=mrbkap
Bug 658909 - Remove GWNOJO for helper stubs. r=mrbkap
Bug 658909 - Remove GWNOJO from JSObject2NativeInterface. r=mrbkap
Bug 658909 - Remove GWNOJO from JSValToXPCException. r=mrbkap
Bug 658909 - Remove GWNOJO from XPCJSID. r=mrbkap
Bug 658909 - Remove GWNOJO from XPCVariant. r=mrbkap

The old code seems to be deciding whether we have a double-wrapped object by
checking _either_ the rv of GWNOJO _or_ the potential slim wrapper. This is
nonsensical, because double-wrapped objects are never slim wrappers.
Furthermore, that variable here is named 'proto', which further suggests
that this code is nonsensical. So let's just check for WNs.

Also, it seems pretty wack to be innerizing here before storing the jsval,
but I'm going to leave that for now.
Bug 658909 - Remove GWNOJO from nsXPConnect. r=mrbkap
Bug 658909 - Remove GWNOJO from AccessCheck. r=mrbkap
Bug 658909 - Remove GWNOJO from nsDOMClassInfo. r=mrbkap