Bug 918373 - GC: Handlify various public APIs r=sfink r=bholley r=smaug

caps/src/nsScriptSecurityManager.cpp

@@ -480,7 +480,7 @@ nsScriptSecurityManager::ContentSecurityPolicyPermitsJSAction(JSContext *cx)
         unsigned lineNum = 0;
         NS_NAMED_LITERAL_STRING(scriptSample, "call to eval() or related function blocked by CSP");
 
-        JSScript *script;
+        JS::RootedScript script(cx);
         if (JS_DescribeScriptedCaller(cx, &script, &lineNum)) {
             if (const char *file = JS_GetScriptFilename(cx, script)) {
                 CopyUTF8toUTF16(nsDependentCString(file), fileName);

content/base/src/WebSocket.cpp

@@ -671,7 +671,7 @@ WebSocket::Init(JSContext* aCx,
   NS_ENSURE_SUCCESS(rv, rv);
 
   unsigned lineno;
-  JSScript* script;
+  JS::RootedScript script(aCx);
   if (JS_DescribeScriptedCaller(aCx, &script, &lineno)) {
     mScriptFile = JS_GetScriptFilename(aCx, script);
     mScriptLine = lineno;

dom/base/nsGlobalWindow.cpp

@@ -9437,7 +9437,7 @@ nsGlobalWindow::ShowSlowScriptDialog()
   // Check if we should offer the option to debug
   JS::RootedScript script(cx);
   unsigned lineno;
-  bool hasFrame = JS_DescribeScriptedCaller(cx, script.address(), &lineno);
+  bool hasFrame = JS_DescribeScriptedCaller(cx, &script, &lineno);
 
   bool debugPossible = hasFrame && js::CanCallContextDebugHandler(cx);
 #ifdef MOZ_JSDEBUGGER

dom/base/nsJSEnvironment.cpp

@@ -509,7 +509,8 @@ NS_ScriptErrorReporter(JSContext *cx,
   // absence of werror are swallowed whole, so report those now.
   if (!JSREPORT_IS_WARNING(report->flags)) {
     nsIXPConnect* xpc = nsContentUtils::XPConnect();
-    if (JS_DescribeScriptedCaller(cx, nullptr, nullptr)) {
+    JS::RootedScript script(cx);
+    if (JS_DescribeScriptedCaller(cx, &script, nullptr)) {
       xpc->MarkErrorUnreported(cx);
       return;
     }

dom/base/nsJSUtils.cpp

@@ -31,7 +31,7 @@ bool
 nsJSUtils::GetCallingLocation(JSContext* aContext, const char* *aFilename,
                               uint32_t* aLineno)
 {
-  JSScript* script = nullptr;
+  JS::RootedScript script(aContext);
   unsigned lineno = 0;
 
   if (!JS_DescribeScriptedCaller(aContext, &script, &lineno)) {

dom/workers/EventListenerManager.cpp

@@ -387,7 +387,7 @@ EventListenerManager::DispatchEvent(JSContext* aCx, const EventTarget& aTarget,
     JS::Rooted<JS::Value> listenerVal(aCx, listeners[index]);
 
     JS::Rooted<JSObject*> listenerObj(aCx);
-    if (!JS_ValueToObject(aCx, listenerVal, listenerObj.address())) {
+    if (!JS_ValueToObject(aCx, listenerVal, &listenerObj)) {
       if (!JS_ReportPendingException(aCx)) {
         aRv.Throw(NS_ERROR_FAILURE);
         return false;

dom/workers/RuntimeService.cpp

@@ -698,7 +698,7 @@ ContentSecurityPolicyAllows(JSContext* aCx)
     nsString fileName;
     uint32_t lineNum = 0;
 
-    JSScript* script;
+    JS::RootedScript script(aCx);
     const char* file;
     if (JS_DescribeScriptedCaller(aCx, &script, &lineNum) &&
         (file = JS_GetScriptFilename(aCx, script))) {

dom/workers/Worker.cpp

@@ -232,7 +232,7 @@ private:
     MOZ_ASSERT(worker);
 
     JS::Rooted<JSObject*> listener(aCx);
-    if (!JS_ValueToObject(aCx, aArgs.get(0), listener.address())) {
+    if (!JS_ValueToObject(aCx, aArgs.get(0), &listener)) {
       return false;
     }
 

dom/workers/WorkerPrivate.cpp

@@ -2687,7 +2687,7 @@ WorkerPrivate::Create(JSContext* aCx, JS::Handle<JSObject*> aObj, WorkerPrivate*
 
       // We're being created outside of a window. Need to figure out the script
       // that is creating us in order for us to use relative URIs later on.
-      JSScript *script;
+      JS::RootedScript script(aCx);
       if (JS_DescribeScriptedCaller(aCx, &script, nullptr)) {
         if (NS_FAILED(NS_NewURI(getter_AddRefs(baseURI),
                                 JS_GetScriptFilename(aCx, script)))) {

js/jsd/jsd_val.cpp

@@ -572,7 +572,8 @@ jsd_GetValueFunction(JSDContext* jsdc, JSDValue* jsdval)
 
     obj = js::UncheckedUnwrap(JSVAL_TO_OBJECT(jsdval->val));
     JSAutoCompartment ac(cx, obj);
-    fun = JS_ValueToFunction(cx, OBJECT_TO_JSVAL(obj));
+    JS::RootedValue funval(cx, JS::ObjectValue(*obj));
+    fun = JS_ValueToFunction(cx, funval);
 
     return fun;
 }

js/src/ctypes/CTypes.cpp

@@ -3974,7 +3974,7 @@ PointerType::ConstructData(JSContext* cx,
       thisObj = NULL;
     } else if (!JSVAL_IS_PRIMITIVE(args[1])) {
       thisObj = &args[1].toObject();
-    } else if (!JS_ValueToObject(cx, args[1], thisObj.address())) {
+    } else if (!JS_ValueToObject(cx, args[1], &thisObj)) {
       return false;
     }
   }

js/src/jsapi-tests/testCloneScript.cpp

@@ -122,7 +122,8 @@ BEGIN_TEST(test_cloneScriptWithPrincipals)
         CHECK(cloned = JS_CloneFunctionObject(cx, obj, B));
 
         JSFunction *fun;
-        CHECK(fun = JS_ValueToFunction(cx, JS::ObjectValue(*cloned)));
+        JS::RootedValue clonedValue(cx, JS::ObjectValue(*cloned));
+        CHECK(fun = JS_ValueToFunction(cx, clonedValue));
 
         JSScript *script;
         CHECK(script = JS_GetFunctionScript(cx, fun));

js/src/jsapi-tests/testDebugger.cpp

@@ -254,7 +254,7 @@ BEGIN_TEST(testDebugger_singleStepThrow)
     static bool
     setStepMode(JSContext *cx, unsigned argc, jsval *vp)
     {
-        JSScript *script;
+        JS::RootedScript script(cx);
         JS_DescribeScriptedCaller(cx, &script, NULL);
         JS_ASSERT(script);
 

js/src/jsapi.cpp

@@ -312,9 +312,8 @@ JS_ConvertArgumentsVA(JSContext *cx, unsigned argc, jsval *argv, const char *for
 }
 
 JS_PUBLIC_API(bool)
-JS_ConvertValue(JSContext *cx, jsval valueArg, JSType type, jsval *vp)
+JS_ConvertValue(JSContext *cx, HandleValue value, JSType type, MutableHandleValue vp)
 {
-    RootedValue value(cx, valueArg);
     bool ok;
     RootedObject obj(cx);
     JSString *str;
@@ -325,32 +324,32 @@ JS_ConvertValue(JSContext *cx, jsval valueArg, JSType type, jsval *vp)
     assertSameCompartment(cx, value);
     switch (type) {
       case JSTYPE_VOID:
-        *vp = JSVAL_VOID;
+        vp.setUndefined();
         ok = true;
         break;
       case JSTYPE_OBJECT:
         ok = js_ValueToObjectOrNull(cx, value, &obj);
         if (ok)
-            *vp = OBJECT_TO_JSVAL(obj);
+            vp.setObjectOrNull(obj);
         break;
       case JSTYPE_FUNCTION:
-        *vp = value;
+        vp.set(value);
-        obj = ReportIfNotFunction(cx, *vp);
+        obj = ReportIfNotFunction(cx, vp);
         ok = (obj != NULL);
         break;
       case JSTYPE_STRING:
         str = ToString<CanGC>(cx, value);
         ok = (str != NULL);
         if (ok)
-            *vp = STRING_TO_JSVAL(str);
+            vp.setString(str);
         break;
       case JSTYPE_NUMBER:
         ok = JS_ValueToNumber(cx, value, &d);
         if (ok)
-            *vp = DOUBLE_TO_JSVAL(d);
+            vp.setDouble(d);
         break;
       case JSTYPE_BOOLEAN:
-        *vp = BooleanValue(ToBoolean(value));
+        vp.setBoolean(ToBoolean(value));
         return true;
       default: {
         char numBuf[12];
@@ -364,23 +363,17 @@ JS_ConvertValue(JSContext *cx, jsval valueArg, JSType type, jsval *vp)
 }
 
 JS_PUBLIC_API(bool)
-JS_ValueToObject(JSContext *cx, jsval valueArg, JSObject **objpArg)
+JS_ValueToObject(JSContext *cx, HandleValue value, MutableHandleObject objp)
 {
-    RootedValue value(cx, valueArg);
-    RootedObject objp(cx, *objpArg);
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, value);
-    if (!js_ValueToObjectOrNull(cx, value, &objp))
+    return js_ValueToObjectOrNull(cx, value, objp);
-        return false;
-    *objpArg = objp;
-    return true;
 }
 
 JS_PUBLIC_API(JSFunction *)
-JS_ValueToFunction(JSContext *cx, jsval valueArg)
+JS_ValueToFunction(JSContext *cx, HandleValue value)
 {
-    RootedValue value(cx, valueArg);
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, value);
@@ -388,9 +381,8 @@ JS_ValueToFunction(JSContext *cx, jsval valueArg)
 }
 
 JS_PUBLIC_API(JSFunction *)
-JS_ValueToConstructor(JSContext *cx, jsval valueArg)
+JS_ValueToConstructor(JSContext *cx, HandleValue value)
 {
-    RootedValue value(cx, valueArg);
     AssertHeapIsIdle(cx);
     CHECK_REQUEST(cx);
     assertSameCompartment(cx, value);
@@ -6159,10 +6151,9 @@ JS_IsIdentifier(JSContext *cx, HandleString str, bool *isIdentifier)
 }
 
 JS_PUBLIC_API(bool)
-JS_DescribeScriptedCaller(JSContext *cx, JSScript **script, unsigned *lineno)
+JS_DescribeScriptedCaller(JSContext *cx, MutableHandleScript script, unsigned *lineno)
 {
-    if (script)
+    script.set(NULL);
-        *script = NULL;
     if (lineno)
         *lineno = 0;
 
@@ -6170,8 +6161,7 @@ JS_DescribeScriptedCaller(JSContext *cx, JSScript **script, unsigned *lineno)
     if (i.done())
         return false;
 
-    if (script)
+    script.set(i.script());
-        *script = i.script();
     if (lineno)
         *lineno = js::PCToLineNumber(i.script(), i.pc());
     return true;
@@ -6230,7 +6220,7 @@ JS::AssertArgumentsAreSane(JSContext *cx, HandleValue value)
 #endif /* DEBUG */
 
 JS_PUBLIC_API(void *)
-JS_EncodeScript(JSContext *cx, JSScript *scriptArg, uint32_t *lengthp)
+JS_EncodeScript(JSContext *cx, HandleScript scriptArg, uint32_t *lengthp)
 {
     XDREncoder encoder(cx);
     RootedScript script(cx, scriptArg);
@@ -6240,7 +6230,7 @@ JS_EncodeScript(JSContext *cx, JSScript *scriptArg, uint32_t *lengthp)
 }
 
 JS_PUBLIC_API(void *)
-JS_EncodeInterpretedFunction(JSContext *cx, JSObject *funobjArg, uint32_t *lengthp)
+JS_EncodeInterpretedFunction(JSContext *cx, HandleObject funobjArg, uint32_t *lengthp)
 {
     XDREncoder encoder(cx);
     RootedObject funobj(cx, funobjArg);

js/src/jsapi.h

@@ -1024,16 +1024,16 @@ JS_ConvertArgumentsVA(JSContext *cx, unsigned argc, jsval *argv,
 #endif
 
 extern JS_PUBLIC_API(bool)
-JS_ConvertValue(JSContext *cx, jsval v, JSType type, jsval *vp);
+JS_ConvertValue(JSContext *cx, JS::HandleValue v, JSType type, JS::MutableHandleValue vp);
 
 extern JS_PUBLIC_API(bool)
-JS_ValueToObject(JSContext *cx, jsval v, JSObject **objp);
+JS_ValueToObject(JSContext *cx, JS::HandleValue v, JS::MutableHandleObject objp);
 
 extern JS_PUBLIC_API(JSFunction *)
-JS_ValueToFunction(JSContext *cx, jsval v);
+JS_ValueToFunction(JSContext *cx, JS::HandleValue v);
 
 extern JS_PUBLIC_API(JSFunction *)
-JS_ValueToConstructor(JSContext *cx, jsval v);
+JS_ValueToConstructor(JSContext *cx, JS::HandleValue v);
 
 extern JS_PUBLIC_API(JSString *)
 JS_ValueToString(JSContext *cx, jsval v);
@@ -4214,7 +4214,8 @@ JS_IsConstructing(JSContext *cx, const jsval *vp)
 #ifdef DEBUG
     JSObject *callee = JSVAL_TO_OBJECT(JS_CALLEE(cx, vp));
     if (JS_ObjectIsFunction(cx, callee)) {
-        JSFunction *fun = JS_ValueToFunction(cx, JS_CALLEE(cx, vp));
+        JS::RootedValue calleeValue(cx, JS_CALLEE(cx, vp));
+        JSFunction *fun = JS_ValueToFunction(cx, calleeValue);
         JS_ASSERT(JS_IsConstructor(fun));
     } else {
         JS_ASSERT(JS_GetClass(callee)->construct != NULL);
@@ -4294,7 +4295,7 @@ JS_IsIdentifier(JSContext *cx, JS::HandleString str, bool *isIdentifier);
  * frame. Returns true if a scripted frame was found, false otherwise.
  */
 extern JS_PUBLIC_API(bool)
-JS_DescribeScriptedCaller(JSContext *cx, JSScript **script, unsigned *lineno);
+JS_DescribeScriptedCaller(JSContext *cx, JS::MutableHandleScript script, unsigned *lineno);
 
 
 /*
@@ -4302,10 +4303,10 @@ JS_DescribeScriptedCaller(JSContext *cx, JSScript **script, unsigned *lineno);
  */
 
 extern JS_PUBLIC_API(void *)
-JS_EncodeScript(JSContext *cx, JSScript *script, uint32_t *lengthp);
+JS_EncodeScript(JSContext *cx, JS::HandleScript script, uint32_t *lengthp);
 
 extern JS_PUBLIC_API(void *)
-JS_EncodeInterpretedFunction(JSContext *cx, JSObject *funobj, uint32_t *lengthp);
+JS_EncodeInterpretedFunction(JSContext *cx, JS::HandleObject funobj, uint32_t *lengthp);
 
 extern JS_PUBLIC_API(JSScript *)
 JS_DecodeScript(JSContext *cx, const void *data, uint32_t length,

js/src/shell/js-gdb.gdb

@@ -1,4 +1,4 @@
-define hookpost-run
+afe9b1f9b180define hookpost-run
     if ($sigaction)
         call free($sigaction)
         set $sigaction = 0

js/src/shell/js.cpp

@@ -645,7 +645,7 @@ static JSScript *
 GetTopScript(JSContext *cx)
 {
     RootedScript script(cx);
-    JS_DescribeScriptedCaller(cx, script.address(), NULL);
+    JS_DescribeScriptedCaller(cx, &script, NULL);
     return script;
 }
 
@@ -1417,8 +1417,9 @@ AssertEq(JSContext *cx, unsigned argc, jsval *vp)
 }
 
 static JSScript *
-ValueToScript(JSContext *cx, jsval v, JSFunction **funp = NULL)
+ValueToScript(JSContext *cx, jsval vArg, JSFunction **funp = NULL)
 {
+    RootedValue v(cx, vArg);
     RootedFunction fun(cx, JS_ValueToFunction(cx, v));
     if (!fun)
         return NULL;
@@ -2332,7 +2333,7 @@ Clone(JSContext *cx, unsigned argc, jsval *vp)
     }
 
     if (argc > 1) {
-        if (!JS_ValueToObject(cx, args[1], parent.address()))
+        if (!JS_ValueToObject(cx, args[1], &parent))
             return false;
     } else {
         parent = JS_GetParent(JSVAL_TO_OBJECT(JS_CALLEE(cx, vp)));
@@ -2353,17 +2354,18 @@ GetPDA(JSContext *cx, unsigned argc, jsval *vp)
     JSPropertyDescArray pda;
     JSPropertyDesc *pd;
 
-    if (!JS_ValueToObject(cx, argc == 0 ? UndefinedValue() : vp[2], vobj.address()))
+    CallArgs args = CallArgsFromVp(argc, vp);
+    if (!JS_ValueToObject(cx, args[0], &vobj))
         return false;
     if (!vobj) {
-        JS_SET_RVAL(cx, vp, UndefinedValue());
+        args.rval().setUndefined();
         return true;
     }
 
     RootedObject aobj(cx, JS_NewArrayObject(cx, 0, NULL));
     if (!aobj)
         return false;
-    JS_SET_RVAL(cx, vp, OBJECT_TO_JSVAL(aobj));
+    args.rval().setObject(*aobj);
 
     ok = !!JS_GetPropertyDescArray(cx, vobj, &pda);
     if (!ok)
@@ -2552,7 +2554,7 @@ EvalInContext(JSContext *cx, unsigned argc, jsval *vp)
     RootedScript script(cx);
     unsigned lineno;
 
-    JS_DescribeScriptedCaller(cx, script.address(), &lineno);
+    JS_DescribeScriptedCaller(cx, &script, &lineno);
     RootedValue rval(cx);
     {
         Maybe<JSAutoCompartment> ac;
@@ -3464,7 +3466,7 @@ DecompileThisScript(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     RootedScript script (cx);
-    if (!JS_DescribeScriptedCaller(cx, script.address(), NULL)) {
+    if (!JS_DescribeScriptedCaller(cx, &script, NULL)) {
         args.rval().setString(cx->runtime()->emptyString);
         return true;
     }
@@ -3480,7 +3482,7 @@ ThisFilename(JSContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     RootedScript script (cx);
-    if (!JS_DescribeScriptedCaller(cx, script.address(), NULL) || !script->filename()) {
+    if (!JS_DescribeScriptedCaller(cx, &script, NULL) || !script->filename()) {
         args.rval().setString(cx->runtime()->emptyString);
         return true;
     }
@@ -4170,7 +4172,8 @@ Exec(JSContext *cx, unsigned argc, jsval *vp)
 
     JS_SET_RVAL(cx, vp, UndefinedValue());
 
-    fun = JS_ValueToFunction(cx, vp[0]);
+    RootedValue arg(cx, vp[0]);
+    fun = JS_ValueToFunction(cx, arg);
     if (!fun)
         return false;
     if (!fun->atom)

js/xpconnect/loader/mozJSComponentLoader.cpp

@@ -513,7 +513,7 @@ mozJSComponentLoader::LoadModule(FileLocation &aFile)
     }
 
     RootedObject jsGetFactoryObj(cx);
-    if (!JS_ValueToObject(cx, NSGetFactory_val, jsGetFactoryObj.address()) ||
+    if (!JS_ValueToObject(cx, NSGetFactory_val, &jsGetFactoryObj) ||
         !jsGetFactoryObj) {
         /* XXX report error properly */
         return NULL;
@@ -776,8 +776,7 @@ mozJSComponentLoader::ObjectForLocation(nsIFile *aComponentFile,
 
     if (cache) {
         if (!mReuseLoaderGlobal) {
-            rv = ReadCachedScript(cache, cachePath, cx, mSystemPrincipal,
+            rv = ReadCachedScript(cache, cachePath, cx, mSystemPrincipal, &script);
-                                  script.address());
         } else {
             rv = ReadCachedFunction(cache, cachePath, cx, mSystemPrincipal,
                                     function.address());

js/xpconnect/loader/mozJSLoaderUtils.cpp

@@ -11,6 +11,7 @@
 
 #include "mozilla/scache/StartupCache.h"
 
+using namespace JS;
 using namespace mozilla::scache;
 
 // We only serialize scripts with system principals. So we don't serialize the
@@ -18,7 +19,7 @@ using namespace mozilla::scache;
 // principals to the system principals.
 nsresult
 ReadCachedScript(StartupCache* cache, nsACString &uri, JSContext *cx,
-                 nsIPrincipal *systemPrincipal, JSScript **scriptp)
+                 nsIPrincipal *systemPrincipal, MutableHandleScript scriptp)
 {
     nsAutoArrayPtr<char> buf;
     uint32_t len;
@@ -27,10 +28,9 @@ ReadCachedScript(StartupCache* cache, nsACString &uri, JSContext *cx,
     if (NS_FAILED(rv))
         return rv; // don't warn since NOT_AVAILABLE is an ok error
 
-    JSScript *script = JS_DecodeScript(cx, buf, len, nsJSPrincipals::get(systemPrincipal), nullptr);
+    scriptp.set(JS_DecodeScript(cx, buf, len, nsJSPrincipals::get(systemPrincipal), nullptr));
-    if (!script)
+    if (!scriptp)
         return NS_ERROR_OUT_OF_MEMORY;
-    *scriptp = script;
     return NS_OK;
 }
 
@@ -57,7 +57,7 @@ ReadCachedFunction(StartupCache* cache, nsACString &uri, JSContext *cx,
 
 nsresult
 WriteCachedScript(StartupCache* cache, nsACString &uri, JSContext *cx,
-                  nsIPrincipal *systemPrincipal, JSScript *script)
+                  nsIPrincipal *systemPrincipal, HandleScript script)
 {
     MOZ_ASSERT(JS_GetScriptPrincipals(script) == nsJSPrincipals::get(systemPrincipal));
     MOZ_ASSERT(JS_GetScriptOriginPrincipals(script) == nsJSPrincipals::get(systemPrincipal));

js/xpconnect/loader/mozJSLoaderUtils.h

@@ -19,7 +19,7 @@ class StartupCache;
 nsresult
 ReadCachedScript(mozilla::scache::StartupCache* cache, nsACString &uri,
                  JSContext *cx, nsIPrincipal *systemPrincipal,
-                 JSScript **script);
+                 JS::MutableHandleScript scriptp);
 
 nsresult
 ReadCachedFunction(mozilla::scache::StartupCache* cache, nsACString &uri,
@@ -29,7 +29,7 @@ ReadCachedFunction(mozilla::scache::StartupCache* cache, nsACString &uri,
 nsresult
 WriteCachedScript(mozilla::scache::StartupCache* cache, nsACString &uri,
                   JSContext *cx, nsIPrincipal *systemPrincipal,
-                  JSScript *script);
+                  JS::HandleScript script);
 nsresult
 WriteCachedFunction(mozilla::scache::StartupCache* cache, nsACString &uri,
                     JSContext *cx, nsIPrincipal *systemPrincipal,

js/xpconnect/loader/mozJSSubScriptLoader.cpp

@@ -160,10 +160,10 @@ mozJSSubScriptLoader::ReadScript(nsIURI *uri, JSContext *cx, JSObject *targetObj
 
 NS_IMETHODIMP
 mozJSSubScriptLoader::LoadSubScript(const nsAString& url,
-                                    const JS::Value& target,
+                                    const Value& targetArg,
                                     const nsAString& charset,
                                     JSContext* cx,
-                                    JS::Value* retval)
+                                    Value* retval)
 {
     /*
      * Loads a local url and evals it into the current cx
@@ -199,8 +199,9 @@ mozJSSubScriptLoader::LoadSubScript(const nsAString& url,
 
     // We base reusingGlobal off of what the loader told us, but we may not
     // actually be using that object.
+    RootedValue target(cx, targetArg);
     RootedObject passedObj(cx);
-    if (!JS_ValueToObject(cx, target, passedObj.address()))
+    if (!JS_ValueToObject(cx, target, &passedObj))
         return NS_ERROR_ILLEGAL_VALUE;
 
     if (passedObj)
@@ -235,7 +236,7 @@ mozJSSubScriptLoader::LoadSubScript(const nsAString& url,
     RootedScript script(cx);
 
     // Figure out who's calling us
-    if (!JS_DescribeScriptedCaller(cx, script.address(), nullptr)) {
+    if (!JS_DescribeScriptedCaller(cx, &script, nullptr)) {
         // No scripted frame means we don't know who's calling, bail.
         return NS_ERROR_FAILURE;
     }
@@ -292,7 +293,7 @@ mozJSSubScriptLoader::LoadSubScript(const nsAString& url,
     RootedFunction function(cx);
     script = nullptr;
     if (cache)
-        rv = ReadCachedScript(cache, cachePath, cx, mSystemPrincipal, script.address());
+        rv = ReadCachedScript(cache, cachePath, cx, mSystemPrincipal, &script);
     if (!script) {
         rv = ReadScript(uri, cx, targetObj, charset,
                         static_cast<const char*>(uriStr.get()), serv,

js/xpconnect/shell/xpcshell.cpp

@@ -143,7 +143,7 @@ GetLocationProperty(JSContext *cx, HandleObject obj, HandleId id, MutableHandleV
     //XXX: your platform should really implement this
     return false;
 #else
-    JSScript *script;
+    JS::RootedScript script(cx);
     JS_DescribeScriptedCaller(cx, &script, NULL);
     const char *filename = JS_GetScriptFilename(cx, script);
 

js/xpconnect/src/Sandbox.cpp

@@ -147,7 +147,8 @@ SandboxImport(JSContext *cx, unsigned argc, Value *vp)
 
         JSAutoCompartment ac(cx, funobj);
 
-        JSFunction *fun = JS_ValueToFunction(cx, ObjectValue(*funobj));
+        RootedValue funval(cx, ObjectValue(*funobj));
+        JSFunction *fun = JS_ValueToFunction(cx, funval);
         if (!fun) {
             XPCThrower::Throw(NS_ERROR_INVALID_ARG, cx);
             return false;
@@ -308,7 +309,7 @@ ExportFunction(JSContext *cx, unsigned argc, jsval *vp)
 static bool
 GetFilenameAndLineNumber(JSContext *cx, nsACString &filename, unsigned &lineno)
 {
-    JSScript *script;
+    JS::RootedScript script(cx);
     if (JS_DescribeScriptedCaller(cx, &script, &lineno)) {
         if (const char *cfilename = JS_GetScriptFilename(cx, script)) {
             filename.Assign(nsDependentCString(cfilename));

js/xpconnect/src/XPCComponents.cpp

@@ -2697,7 +2697,7 @@ nsXPCComponents_Utils::ReportError(const JS::Value &errorArg, JSContext *cx)
 /* void evalInSandbox(in AString source, in nativeobj sandbox); */
 NS_IMETHODIMP
 nsXPCComponents_Utils::EvalInSandbox(const nsAString& source,
-                                     const JS::Value& sandboxVal,
+                                     const JS::Value& sandboxValArg,
                                      const JS::Value& version,
                                      const JS::Value& filenameVal,
                                      int32_t lineNumber,
@@ -2705,8 +2705,9 @@ nsXPCComponents_Utils::EvalInSandbox(const nsAString& source,
                                      uint8_t optionalArgc,
                                      JS::Value *retval)
 {
+    RootedValue sandboxVal(cx, sandboxValArg);
     RootedObject sandbox(cx);
-    if (!JS_ValueToObject(cx, sandboxVal, sandbox.address()) || !sandbox)
+    if (!JS_ValueToObject(cx, sandboxVal, &sandbox) || !sandbox)
         return NS_ERROR_INVALID_ARG;
 
     // Optional third argument: JS version, as a string.

js/xpconnect/src/XPCWrappedJSClass.cpp

@@ -293,7 +293,7 @@ nsXPCWrappedJSClass::CallQueryInterfaceOnJSObject(JSContext* cx,
     }
 
     if (success)
-        success = JS_ValueToObject(cx, retval, retObj.address());
+        success = JS_ValueToObject(cx, retval, &retObj);
 
     return success ? retObj.get() : nullptr;
 }
@@ -978,7 +978,8 @@ nsXPCWrappedJSClass::CheckForException(XPCCallContext & ccx,
                 // Finally, check to see if this is the last JS frame on the
                 // stack. If so then we always want to report it.
                 if (!reportable) {
-                    reportable = !JS_DescribeScriptedCaller(cx, nullptr, nullptr);
+                    RootedScript ignored(cx);
+                    reportable = !JS_DescribeScriptedCaller(cx, &ignored, nullptr);
                 }
 
                 // Ugly special case for GetInterface. It's "special" in the