Currently when have a cache miss on a [Cached] value, we call the C++ getter, then JS-wrap into rval in the caller compartment, then make a copy of rval, JS_WrapValue into the reflector compartment, and store in the slot. So if you have a [Cached] sequence-valued attribute that is first accessed via Xray, we will create rval in the xray compartment, then store a COW in the slot. Then when content gets the attribute later it gets a COW and needs to try to milk it. Patch coming up that makes sure to always js-wrap in the reflector compartment in the [Cached] case, store that in the slot, then JS_WrapValue the rval into the caller compartment. This is a stopgap measure; I will be filing another bug on a more foolproof, but more complicated, setup.

The followup is bug 946906.

Comment on attachment 8343264 [details] [diff] [review] Make sure to not accidentally store COWs in the slot for [Cached] properties. Review of attachment 8343264 [details] [diff] [review]: ----------------------------------------------------------------- The do-while makes me a bit sad, but I don't see a clean way around it.