Bug 867844 part 3. Fix rooting issues in canvas 2d code. r=smaug

content/canvas/src/CanvasRenderingContext2D.cpp

@@ -1154,11 +1154,12 @@ MatrixToJSObject(JSContext* cx, const Matrix& matrix, ErrorResult& error)
   return obj;
 }
 
-bool
-ObjectToMatrix(JSContext* cx, JSObject& obj, Matrix& matrix, ErrorResult& error)
+static bool
+ObjectToMatrix(JSContext* cx, JS::Handle<JSObject*> obj, Matrix& matrix,
+               ErrorResult& error)
 {
   uint32_t length;
-  if (!JS_GetArrayLength(cx, &obj, &length) || length != 6) {
+  if (!JS_GetArrayLength(cx, obj, &length) || length != 6) {
     // Not an array-like thing or wrong size
     error.Throw(NS_ERROR_INVALID_ARG);
     return false;
@@ -1167,9 +1168,9 @@ ObjectToMatrix(JSContext* cx, JSObject& obj, Matrix& matrix, ErrorResult& error)
   Float* elts[] = { &matrix._11, &matrix._12, &matrix._21, &matrix._22,
                     &matrix._31, &matrix._32 };
   for (uint32_t i = 0; i < 6; ++i) {
-    JS::Value elt;
+    JS::Rooted<JS::Value> elt(cx);
     double d;
-    if (!JS_GetElement(cx, &obj, i, &elt)) {
+    if (!JS_GetElement(cx, obj, i, elt.address())) {
       error.Throw(NS_ERROR_FAILURE);
       return false;
     }
@@ -1188,9 +1189,10 @@ ObjectToMatrix(JSContext* cx, JSObject& obj, Matrix& matrix, ErrorResult& error)
 
 void
 CanvasRenderingContext2D::SetMozCurrentTransform(JSContext* cx,
-                                                 JSObject& currentTransform,
+                                                 JSObject& currentTransform_,
                                                  ErrorResult& error)
 {
+  JS::Rooted<JSObject*> currentTransform(cx, &currentTransform_);
   EnsureTarget();
   if (!IsTargetValid()) {
     error.Throw(NS_ERROR_FAILURE);
@@ -1212,9 +1214,10 @@ CanvasRenderingContext2D::GetMozCurrentTransform(JSContext* cx,
 
 void
 CanvasRenderingContext2D::SetMozCurrentTransformInverse(JSContext* cx,
-                                                        JSObject& currentTransform,
+                                                        JSObject& currentTransform_,
                                                         ErrorResult& error)
 {
+  JS::Rooted<JSObject*> currentTransform(cx, &currentTransform_);
   EnsureTarget();
   if (!IsTargetValid()) {
     error.Throw(NS_ERROR_FAILURE);
@@ -1296,19 +1299,19 @@ WrapStyle(JSContext* cx, JSObject* objArg,
           CanvasRenderingContext2D::CanvasMultiGetterType type,
           nsAString& str, nsISupports* supports, ErrorResult& error)
 {
-  JS::Value v;
+  JS::Rooted<JS::Value> v(cx);
   bool ok;
   switch (type) {
     case CanvasRenderingContext2D::CMG_STYLE_STRING:
     {
-      ok = xpc::StringToJsval(cx, str, &v);
+      ok = xpc::StringToJsval(cx, str, v.address());
       break;
     }
     case CanvasRenderingContext2D::CMG_STYLE_PATTERN:
     case CanvasRenderingContext2D::CMG_STYLE_GRADIENT:
     {
       JS::Rooted<JSObject*> obj(cx, objArg);
-      ok = dom::WrapObject(cx, obj, supports, &v);
+      ok = dom::WrapObject(cx, obj, supports, v.address());
       break;
     }
     default:
@@ -3376,8 +3379,8 @@ CanvasRenderingContext2D::GetImageData(JSContext* aCx, double aSx,
     h = 1;
   }
 
-  JSObject* array;
-  error = GetImageDataArray(aCx, x, y, w, h, &array);
+  JS::Rooted<JSObject*> array(aCx);
+  error = GetImageDataArray(aCx, x, y, w, h, array.address());
   if (error.Failed()) {
     return nullptr;
   }

content/canvas/src/CanvasUtils.h

@@ -117,9 +117,9 @@ JSValToDashArray(JSContext* cx, const JS::Value& patternArray,
 
         bool haveNonzeroElement = false;
         for (uint32_t i = 0; i < length; ++i) {
-            JS::Value elt;
+            JS::Rooted<JS::Value> elt(cx);
             double d;
-            if (!JS_GetElement(cx, obj, i, &elt)) {
+            if (!JS_GetElement(cx, obj, i, elt.address())) {
                 return NS_ERROR_FAILURE;
             }
             if (!(CoerceDouble(elt, &d) &&