From 1554c31d8cad7d17c04f4fac2c2327bf823b625d Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Tue, 28 Aug 2018 21:26:50 -0700
Subject: [PATCH] Bug 1487167 - Various DOM rooting issues. r=bz

--HG--
extra : amend_source : dc5bf09193860ac7a3f01071132284ed10423e97
---
 dom/base/ContentFrameMessageManager.cpp       | 14 +++++++++-----
 dom/base/ContentProcessMessageManager.cpp     | 14 +++++++++-----
 dom/base/CustomElementRegistry.cpp            |  2 +-
 dom/bindings/DOMJSProxyHandler.cpp            |  3 +++
 dom/serviceworkers/ServiceWorkerContainer.cpp |  4 ++--
 5 files changed, 24 insertions(+), 13 deletions(-)

diff --git a/dom/base/ContentFrameMessageManager.cpp b/dom/base/ContentFrameMessageManager.cpp
index 2b7d18d70aec..b5de18371796 100644
--- a/dom/base/ContentFrameMessageManager.cpp
+++ b/dom/base/ContentFrameMessageManager.cpp
@@ -5,6 +5,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "ContentFrameMessageManager.h"
+#include "js/RootingAPI.h"
 #include "mozilla/dom/ScriptSettings.h"
 
 using namespace mozilla;
@@ -13,12 +14,15 @@ using namespace mozilla::dom;
 JSObject*
 ContentFrameMessageManager::GetOrCreateWrapper()
 {
-  AutoJSAPI jsapi;
-  jsapi.Init();
+  JS::RootedValue val(RootingCx());
+  {
+    // Scope to run ~AutoJSAPI before working with a raw JSObject*.
+    AutoJSAPI jsapi;
+    jsapi.Init();
 
-  JS::RootedValue val(jsapi.cx());
-  if (!GetOrCreateDOMReflectorNoWrap(jsapi.cx(), this, &val)) {
-    return nullptr;
+    if (!GetOrCreateDOMReflectorNoWrap(jsapi.cx(), this, &val)) {
+      return nullptr;
+    }
   }
   MOZ_ASSERT(val.isObject());
   return &val.toObject();
diff --git a/dom/base/ContentProcessMessageManager.cpp b/dom/base/ContentProcessMessageManager.cpp
index a748bd39318a..2085db19d18b 100644
--- a/dom/base/ContentProcessMessageManager.cpp
+++ b/dom/base/ContentProcessMessageManager.cpp
@@ -114,13 +114,17 @@ ContentProcessMessageManager::WrapObject(JSContext* aCx,
 JSObject*
 ContentProcessMessageManager::GetOrCreateWrapper()
 {
-  AutoJSAPI jsapi;
-  jsapi.Init();
+  JS::RootedValue val(RootingCx());
+  {
+    // Scope to run ~AutoJSAPI before working with a raw JSObject*.
+    AutoJSAPI jsapi;
+    jsapi.Init();
 
-  JS::RootedValue val(jsapi.cx());
-  if (!GetOrCreateDOMReflectorNoWrap(jsapi.cx(), this, &val)) {
-    return nullptr;
+    if (!GetOrCreateDOMReflectorNoWrap(jsapi.cx(), this, &val)) {
+      return nullptr;
+    }
   }
+  MOZ_ASSERT(val.isObject());
   return &val.toObject();
 }
 
diff --git a/dom/base/CustomElementRegistry.cpp b/dom/base/CustomElementRegistry.cpp
index ca8511ac2d9b..143ea71837c9 100644
--- a/dom/base/CustomElementRegistry.cpp
+++ b/dom/base/CustomElementRegistry.cpp
@@ -752,7 +752,7 @@ int32_t
 CustomElementRegistry::InferNamespace(JSContext* aCx,
                                       JS::Handle<JSObject*> constructor)
 {
-  JSObject* XULConstructor = XULElement_Binding::GetConstructorObject(aCx);
+  JS::Rooted<JSObject*> XULConstructor(aCx, XULElement_Binding::GetConstructorObject(aCx));
 
   JS::Rooted<JSObject*> proto(aCx, constructor);
   while (proto) {
diff --git a/dom/bindings/DOMJSProxyHandler.cpp b/dom/bindings/DOMJSProxyHandler.cpp
index ac3d51851dda..01d5c4507df9 100644
--- a/dom/bindings/DOMJSProxyHandler.cpp
+++ b/dom/bindings/DOMJSProxyHandler.cpp
@@ -105,6 +105,9 @@ CheckDOMProxy(JSObject* proxy)
   MOZ_ASSERT(!js::gc::EdgeNeedsSweepUnbarriered(&proxy));
   nsISupports* native = UnwrapDOMObject<nsISupports>(proxy);
   nsWrapperCache* cache;
+  // QI to nsWrapperCache cannot GC for very non-obvious reasons; see
+  // https://searchfox.org/mozilla-central/rev/55da592d85c2baf8d8818010c41d9738c97013d2/js/xpconnect/src/XPCWrappedJSClass.cpp#521,545-548
+  JS::AutoSuppressGCAnalysis nogc;
   CallQueryInterface(native, &cache);
   MOZ_ASSERT(cache->GetWrapperPreserveColor() == proxy);
 #endif
diff --git a/dom/serviceworkers/ServiceWorkerContainer.cpp b/dom/serviceworkers/ServiceWorkerContainer.cpp
index 894ead652ad1..142f29643526 100644
--- a/dom/serviceworkers/ServiceWorkerContainer.cpp
+++ b/dom/serviceworkers/ServiceWorkerContainer.cpp
@@ -87,11 +87,11 @@ ServiceWorkerContainer::IsEnabled(JSContext* aCx, JSObject* aGlobal)
     return false;
   }
 
-  if (IsSecureContextOrObjectIsFromSecureContext(aCx, aGlobal)) {
+  if (IsSecureContextOrObjectIsFromSecureContext(aCx, global)) {
     return true;
   }
 
-  const bool isTestingEnabledInWindow = IsServiceWorkersTestingEnabledInWindow(aGlobal);
+  const bool isTestingEnabledInWindow = IsServiceWorkersTestingEnabledInWindow(global);
   const bool isTestingEnabledByPref = StaticPrefs::dom_serviceWorkers_testing_enabled();
   const bool isTestingEnabled = isTestingEnabledByPref || isTestingEnabledInWindow;