Protect vp from garbage collection, since GC could nest under several of the calls here. bug 390222, r+sr=jst

js/src/xpconnect/src/XPCCrossOriginWrapper.cpp

@@ -525,6 +525,13 @@ XPC_XOW_GetOrSetProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp,
     return JS_TRUE;
   }
 
+  XPCCallContext ccx(JS_CALLER, cx);
+  if (!ccx.IsValid()) {
+    return ThrowException(NS_ERROR_FAILURE, cx);
+  }
+
+  AUTO_MARK_JSVAL(ccx, vp);
+
   JSObject *wrappedObj = GetWrappedObject(cx, obj);
   if (!wrappedObj) {
     return ThrowException(NS_ERROR_ILLEGAL_VALUE, cx);