Fix up the virtual method unsoundness.

src/components/script/dom/attr.rs

@@ -65,8 +65,8 @@ impl Attr {
     }
 
     pub fn set_value(&mut self, set_type: AttrSettingType, value: DOMString) {
-        let owner = self.owner.root();
-        let node: &JSRef<Node> = NodeCast::from_ref(&*owner);
+        let mut owner = self.owner.root();
+        let node: &mut JSRef<Node> = NodeCast::from_mut_ref(&mut *owner);
         let namespace_is_null = self.namespace == namespace::Null;
 
         match set_type {

src/components/script/dom/element.rs

@@ -301,13 +301,14 @@ impl<'a> AttributeHandlers for JSRef<'a, Element> {
             None => (),
             Some(idx) => {
                 {
-                    let node: &JSRef<Node> = NodeCast::from_ref(self);
+                    let node: &mut JSRef<Node> = NodeCast::from_mut_ref(self);
                     node.wait_until_safe_to_modify_dom();
                 }
 
                 if namespace == namespace::Null {
                     let removed_raw_value = self.get().attrs.get(idx).root().Value();
-                    vtable_for(NodeCast::from_ref(self)).before_remove_attr(local_name.clone(), removed_raw_value);
+                    vtable_for(NodeCast::from_mut_ref(self))
+                        .before_remove_attr(local_name.clone(), removed_raw_value);
                 }
 
                 self.get_mut().attrs.remove(idx);

src/components/script/dom/node.rs

@@ -244,24 +244,25 @@ impl<'a> PrivateNodeHelpers for JSRef<'a, Node> {
         let document = document_from_node(self).root();
 
         if self.is_in_doc() {
-            for node in self.traverse_preorder() {
-                vtable_for(&node).bind_to_tree();
+            for mut node in self.traverse_preorder() {
+                vtable_for(&mut node).bind_to_tree();
             }
         }
 
-        self.parent_node().root().map(|parent| vtable_for(&*parent).child_inserted(self));
+        let mut parent = self.parent_node().root();
+        parent.as_mut().map(|parent| vtable_for(&mut **parent).child_inserted(self));
 
         document.deref().content_changed();
     }
 
-    // http://dom.spec.whatwg.org/#node-is-removed
+    // http://spec.whatwg.org/#node-is-removed
     fn node_removed(&self) {
         assert!(self.parent_node().is_none());
         let document = document_from_node(self).root();
 
-        for node in self.traverse_preorder() {
+        for mut node in self.traverse_preorder() {
             // XXX how about if the node wasn't in the tree in the first place?
-            vtable_for(&node).unbind_from_tree();
+            vtable_for(&mut node).unbind_from_tree();
         }
 
         document.deref().content_changed();

src/components/script/dom/virtualmethods.rs

@@ -74,34 +74,34 @@ pub trait VirtualMethods {
 /// method call on the trait object will invoke the corresponding method on the
 /// concrete type, propagating up the parent hierarchy unless otherwise
 /// interrupted.
-pub fn vtable_for<'a>(node: &JSRef<Node>) -> ~VirtualMethods: {
+pub fn vtable_for<'a>(node: &'a mut JSRef<Node>) -> &'a mut VirtualMethods: {
     match node.get().type_id {
         ElementNodeTypeId(HTMLImageElementTypeId) => {
-            let element: &JSRef<HTMLImageElement> = HTMLImageElementCast::to_ref(node).unwrap();
-            ~element.clone() as ~VirtualMethods:
+            let element: &mut JSRef<HTMLImageElement> = HTMLImageElementCast::to_mut_ref(node).unwrap();
+            element as &mut VirtualMethods:
         }
         ElementNodeTypeId(HTMLIFrameElementTypeId) => {
-            let element: &JSRef<HTMLIFrameElement> = HTMLIFrameElementCast::to_ref(node).unwrap();
-            ~element.clone() as ~VirtualMethods:
+            let element: &mut JSRef<HTMLIFrameElement> = HTMLIFrameElementCast::to_mut_ref(node).unwrap();
+            element as &mut VirtualMethods:
         }
         ElementNodeTypeId(HTMLObjectElementTypeId) => {
-            let element: &JSRef<HTMLObjectElement> = HTMLObjectElementCast::to_ref(node).unwrap();
-            ~element.clone() as ~VirtualMethods:
+            let element: &mut JSRef<HTMLObjectElement> = HTMLObjectElementCast::to_mut_ref(node).unwrap();
+            element as &mut VirtualMethods:
         }
         ElementNodeTypeId(HTMLStyleElementTypeId) => {
-            let element: &JSRef<HTMLStyleElement> = HTMLStyleElementCast::to_ref(node).unwrap();
-            ~element.clone() as ~VirtualMethods:
+            let element: &mut JSRef<HTMLStyleElement> = HTMLStyleElementCast::to_mut_ref(node).unwrap();
+            element as &mut VirtualMethods:
         }
         ElementNodeTypeId(ElementTypeId) => {
-            let element: &JSRef<Element> = ElementCast::to_ref(node).unwrap();
-            ~element.clone() as ~VirtualMethods:
+            let element: &mut JSRef<Element> = ElementCast::to_mut_ref(node).unwrap();
+            element as &mut VirtualMethods:
         }
         ElementNodeTypeId(_) => {
-            let element: &JSRef<HTMLElement> = HTMLElementCast::to_ref(node).unwrap();
-            ~element.clone() as ~VirtualMethods:
+            let element: &mut JSRef<HTMLElement> = HTMLElementCast::to_mut_ref(node).unwrap();
+            element as &mut VirtualMethods:
         }
         _ => {
-            ~node.clone() as ~VirtualMethods:
+            node as &mut VirtualMethods:
         }
     }
 }