Bug 1022773 - Return value rooting for content/, r=smaug

--HG--
extra : rebase_source : 02c70ac4a9830f686d03e1f7503a8fa6cb50bed3

content/base/src/Element.cpp

@@ -478,16 +478,19 @@ Element::WrapObject(JSContext *aCx)
     return nullptr;
   }
 
-  nsRefPtr<nsXBLBinding> binding;
-  xblService->LoadBindings(this, uri, principal, getter_AddRefs(binding), &dummy);
-  
-  if (binding) {
-    if (nsContentUtils::IsSafeToRunScript()) {
-      binding->ExecuteAttachedHandler();
-    }
-    else {
-      nsContentUtils::AddScriptRunner(
-        NS_NewRunnableMethod(binding, &nsXBLBinding::ExecuteAttachedHandler));
+  {
+    // Make a scope so that ~nsRefPtr can GC before returning obj.
+    nsRefPtr<nsXBLBinding> binding;
+    xblService->LoadBindings(this, uri, principal, getter_AddRefs(binding), &dummy);
+
+    if (binding) {
+      if (nsContentUtils::IsSafeToRunScript()) {
+        binding->ExecuteAttachedHandler();
+      }
+      else {
+        nsContentUtils::AddScriptRunner(
+          NS_NewRunnableMethod(binding, &nsXBLBinding::ExecuteAttachedHandler));
+      }
     }
   }