fix bug 76102. Only vend weak references from the root of a wrappedJS wrapper chain. r=dbaron sr=brendan

js/src/xpconnect/src/xpcprivate.h

@@ -772,6 +772,7 @@ public:
     NS_DECL_ISUPPORTS
     NS_DECL_NSIXPCONNECTJSOBJECTHOLDER
     NS_DECL_NSIXPCONNECTWRAPPEDJS
+    NS_DECL_NSISUPPORTSWEAKREFERENCE
 
     // Note that both nsXPTCStubBase and nsIXPConnectWrappedJS declare
     // GetInterfaceInfo methods with the same sig. So, the declaration

js/src/xpconnect/src/xpcwrappedjs.cpp

@@ -161,14 +161,25 @@ do_decrement:
                 JS_RemoveRootRT(rt->GetJSRuntime(), &mJSObj);
         }
 
-        // If we are not being used from a weak reference, then this extra
-        // ref is not needed and we can let ourself be deleted.
-        if(!mRoot->HasWeakReferences())
+        // If we are not the root wrapper or if we are not being used from a 
+        // weak reference, then this extra ref is not needed and we can let 
+        // ourself be deleted.
+        // Note: HasWeakReferences() could only return true for the root.
+        if(!HasWeakReferences())
             goto do_decrement;
     }
     return cnt;
 }
 
+NS_IMETHODIMP
+nsXPCWrappedJS::GetWeakReference(nsIWeakReference** aInstancePtr)
+{
+    if(mRoot != this)
+        return mRoot->GetWeakReference(aInstancePtr);
+
+    return nsSupportsWeakReference::GetWeakReference(aInstancePtr);
+}
+
 NS_IMETHODIMP
 nsXPCWrappedJS::GetJSObject(JSObject** aJSObj)
 {