Bug 1857949 - Move AutoSuppressGCAnalysis to StreamBlobImpl::GetAllocationSize r=smaug

Differential Revision: https://phabricator.services.mozilla.com/D190476

dom/file/Blob.cpp

@@ -20,7 +20,6 @@
 #include "nsPIDOMWindow.h"
 #include "StreamBlobImpl.h"
 #include "StringBlobImpl.h"
-#include "js/GCAPI.h"
 
 namespace mozilla::dom {
 
@@ -251,11 +250,6 @@ void Blob::CreateInputStream(nsIInputStream** aStream, ErrorResult& aRv) const {
 size_t BindingJSObjectMallocBytes(Blob* aBlob) {
   MOZ_ASSERT(aBlob);
 
-  // TODO: The hazard analysis currently can't see that none of the
-  // implementations of the GetAllocationSize virtual method call can GC (see
-  // bug 1531951).
-  JS::AutoSuppressGCAnalysis nogc;
-
   return aBlob->GetAllocationSize();
 }
 

dom/file/StreamBlobImpl.cpp

@@ -16,6 +16,7 @@
 #include "nsICloneableInputStream.h"
 #include "nsIEventTarget.h"
 #include "nsIPipe.h"
+#include "js/GCAPI.h"
 
 namespace mozilla::dom {
 
@@ -206,6 +207,11 @@ StreamBlobImpl::CollectReports(nsIHandleReportCallback* aHandleReport,
 }
 
 size_t StreamBlobImpl::GetAllocationSize() const {
+  // do_QueryInterface may run GC if the object is implemented in JS, but
+  // mInputStream is nsICloneableInputStream which doesn't have a JS
+  // implementation.
+  JS::AutoSuppressGCAnalysis nogc;
+
   nsCOMPtr<nsIStringInputStream> stringInputStream =
       do_QueryInterface(mInputStream);
   if (!stringInputStream) {