Bug 162115: Make nsCOMArray return nsDeriviedSafes to avoid bad addrefs/releases

r=bz sr=alecf

xpcom/ds/nsCOMArray.cpp

@@ -76,7 +76,7 @@ nsCOMArray_base::InsertObjectsAt(const nsCOMArray_base& aObjects, PRInt32 aIndex
         // need to addref all these
         PRInt32 count = aObjects.Count();
         for (PRInt32 i = 0; i < count; ++i) {
-            NS_IF_ADDREF(aObjects.ObjectAt(i));
+            NS_IF_ADDREF(NS_STATIC_CAST(nsISupports*, aObjects.mArray[i]));
         }
     }
     return result;

xpcom/ds/nsCOMArray.h

@@ -41,6 +41,7 @@
 
 #include "nsVoidArray.h"
 #include "nsISupports.h"
+#include "nsCOMPtr.h"
 
 // See below for the definition of nsCOMArray<T>
 
@@ -90,11 +91,11 @@ public:
         return mArray.Count();
     }
 
-    nsISupports* ObjectAt(PRInt32 aIndex) const {
-        return NS_STATIC_CAST(nsISupports*, mArray.ElementAt(aIndex));
+    nsDerivedSafe<nsISupports>* ObjectAt(PRInt32 aIndex) const {
+        return NS_REINTERPRET_CAST(nsDerivedSafe<nsISupports>*, mArray.ElementAt(aIndex));
     }
     
-    nsISupports* operator[](PRInt32 aIndex) const {
+    nsDerivedSafe<nsISupports>* operator[](PRInt32 aIndex) const {
         return ObjectAt(aIndex);
     }
 
@@ -139,12 +140,12 @@ class nsCOMArray : public nsCOMArray_base
     ~nsCOMArray() {}
 
     // these do NOT refcount on the way out, for speed
-    T* ObjectAt(PRInt32 aIndex) const {
-        return NS_STATIC_CAST(T*,nsCOMArray_base::ObjectAt(aIndex));
+    nsDerivedSafe<T>* ObjectAt(PRInt32 aIndex) const {
+        return NS_REINTERPRET_CAST(nsDerivedSafe<T>*,nsCOMArray_base::ObjectAt(aIndex));
     }
 
     // indexing operator for syntactic sugar
-    T* operator[](PRInt32 aIndex) const {
+    nsDerivedSafe<T>* operator[](PRInt32 aIndex) const {
         return ObjectAt(aIndex);
     }