Bug 871321 - Fix rooting hazards in the SMS code; r=till

dom/mobilemessage/src/MobileMessageCallback.cpp

@@ -132,7 +132,7 @@ MobileMessageCallback::NotifyMessageDeleted(bool *aDeleted, uint32_t aSize)
   AutoPushJSContext cx(sc->GetNativeContext());
   NS_ENSURE_TRUE(cx, NS_ERROR_FAILURE);
 
-  JSObject *deleteArrayObj = JS_NewArrayObject(cx, aSize, NULL);
+  JS::Rooted<JSObject*> deleteArrayObj(cx, JS_NewArrayObject(cx, aSize, NULL));
   JS::Value jsValTrue = BOOLEAN_TO_JSVAL(1);
   JS::Value jsValFalse = BOOLEAN_TO_JSVAL(0);
   for (uint32_t i = 0; i < aSize; i++) {

dom/mobilemessage/src/SmsManager.cpp

@@ -295,20 +295,20 @@ SmsManager::Delete(const JS::Value& aParam, nsIDOMDOMRequest** aRequest)
     idArray = &id;
   } else {
     // Int32[] or SmsMessage[]
-    JSObject& ids = aParam.toObject();
+    JS::Rooted<JSObject*> ids(cx, &aParam.toObject());
 
-    JS_ALWAYS_TRUE(JS_GetArrayLength(cx, &ids, &size));
+    JS_ALWAYS_TRUE(JS_GetArrayLength(cx, ids, &size));
     nsAutoArrayPtr<int32_t> idAutoArray(new int32_t[size]);
 
-    JS::Value idJsValue;
+    JS::Rooted<JS::Value> idJsValue(cx);
     for (uint32_t i = 0; i < size; i++) {
-      if (!JS_GetElement(cx, &ids, i, &idJsValue)) {
+      if (!JS_GetElement(cx, ids, i, idJsValue.address())) {
         return NS_ERROR_INVALID_ARG;
       }
 
-      if (idJsValue.isInt32()) {
-        idAutoArray[i] = idJsValue.toInt32();
-      } else if (idJsValue.isObject()) {
+      if (idJsValue.get().isInt32()) {
+        idAutoArray[i] = idJsValue.get().toInt32();
+      } else if (idJsValue.get().isObject()) {
         rv = GetSmsMessageId(cx, idJsValue, id);
         NS_ENSURE_SUCCESS(rv, rv);