Bug 951407 - Fix two hazards introduced by bug 951282; r=sfink

dom/workers/WorkerPrivate.cpp

@@ -2153,7 +2153,7 @@ WorkerPrivateParent<Derived>::WrapObject(JSContext* aCx,
 
   AssertIsOnParentThread();
 
-  JSObject* obj = WorkerBinding::Wrap(aCx, aScope, ParentAsWorkerPrivate());
+  JS::Rooted<JSObject*> obj(aCx, WorkerBinding::Wrap(aCx, aScope, ParentAsWorkerPrivate()));
 
   if (mRooted) {
     PreserveWrapper(this);

js/jsd/jsd_stak.cpp

@@ -485,8 +485,8 @@ jsd_ValToStringInStackFrame(JSDContext* jsdc,
     cx = jsdthreadstate->context;
     JS_ASSERT(cx);
 
-    exceptionState = JS_SaveExceptionState(cx);
     JS::RootedValue v(cx, val);
+    exceptionState = JS_SaveExceptionState(cx);
     retval = JS::ToString(cx, v);
     JS_RestoreExceptionState(cx, exceptionState);