Bug 871315 - Fix some rooting hazards in content/; r=till,bzbarsky

content/events/src/nsEventListenerManager.cpp

@@ -858,11 +858,11 @@ nsEventListenerManager::CompileEventHandlerInternal(nsListenerStruct *aListenerS
     options.setFileAndLine(url.get(), lineNo)
            .setVersion(SCRIPTVERSION_DEFAULT);
 
-    JS::RootedObject rootedNull(cx, nullptr); // See bug 781070.
-    JSObject *handlerFun = nullptr;
-    result = nsJSUtils::CompileFunction(cx, rootedNull, options,
+    JS::Rooted<JSObject*> rootedNull(cx, nullptr); // See bug 781070.
+    JS::Rooted<JSObject*> handlerFun(cx);
+    result = nsJSUtils::CompileFunction(cx, JS::NullPtr(), options,
                                         nsAtomCString(aListenerStruct->mTypeAtom),
-                                        argCount, argNames, *body, &handlerFun);
+                                        argCount, argNames, *body, handlerFun.address());
     NS_ENSURE_SUCCESS(result, result);
     handler = handlerFun;
     NS_ENSURE_TRUE(handler, NS_ERROR_FAILURE);

content/events/src/nsEventListenerService.cpp

@@ -95,7 +95,7 @@ nsEventListenerInfo::GetJSVal(JSContext* aCx,
 
   nsCOMPtr<nsIJSEventListener> jsl = do_QueryInterface(mListener);
   if (jsl) {
-    JSObject *handler = jsl->GetHandler().Ptr()->Callable();
+    JS::Handle<JSObject*> handler(jsl->GetHandler().Ptr()->Callable());
     if (handler) {
       aAc.construct(aCx, handler);
       *aJSVal = OBJECT_TO_JSVAL(handler);

content/html/content/src/HTMLMediaElement.cpp

@@ -1566,9 +1566,9 @@ HTMLMediaElement::GetMozSampleRate(uint32_t* aMozSampleRate)
 }
 
 // Helper struct with arguments for our hash iterator.
-typedef struct {
+typedef struct MOZ_STACK_CLASS {
   JSContext* cx;
-  JSObject*  tags;
+  JS::HandleObject  tags;
   bool error;
 } MetadataIterCx;
 

content/html/content/src/UndoManager.cpp

@@ -1163,8 +1163,8 @@ UndoManager::DispatchTransactionEvent(JSContext* aCx, const nsAString& aType,
   nsCOMArray<nsIVariant> keepAlive;
   nsTArray<nsIVariant*> transactionItems;
   for (uint32_t i = 0; i < items.Length(); i++) {
-    JS::Value txVal = JS::ObjectValue(*items[i]->Callback());
-    if (!JS_WrapValue(aCx, &txVal)) {
+    JS::Rooted<JS::Value> txVal(aCx, JS::ObjectValue(*items[i]->Callback()));
+    if (!JS_WrapValue(aCx, txVal.address())) {
       aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
       return;
     }

content/html/content/src/nsGenericHTMLElement.cpp

@@ -3122,8 +3122,8 @@ nsGenericHTMLElement::GetItemValue(JSContext* aCx, JSObject* aScope,
   }
 
   if (ItemScope()) {
-    JS::Value v;
-    if (!mozilla::dom::WrapObject(aCx, scope, this, &v)) {
+    JS::Rooted<JS::Value> v(aCx);
+    if (!mozilla::dom::WrapObject(aCx, scope, this, v.address())) {
       aError.Throw(NS_ERROR_FAILURE);
       return JS::UndefinedValue();
     }

content/xbl/src/nsXBLProtoImpl.cpp

@@ -177,8 +177,8 @@ nsXBLProtoImpl::InitTargetObjects(nsXBLPrototypeBinding* aBinding,
   AutoPushJSContext cx(aContext->GetNativeContext());
   JS::Rooted<JSObject*> global(cx, sgo->GetGlobalJSObject());
   nsCOMPtr<nsIXPConnectJSObjectHolder> wrapper;
-  JS::Value v;
-  rv = nsContentUtils::WrapNative(cx, global, aBoundElement, &v,
+  JS::Rooted<JS::Value> v(cx);
+  rv = nsContentUtils::WrapNative(cx, global, aBoundElement, v.address(),
                                   getter_AddRefs(wrapper));
   NS_ENSURE_SUCCESS(rv, rv);
 

content/xul/document/src/XULDocument.cpp

@@ -3653,8 +3653,9 @@ XULDocument::ExecuteScript(nsIScriptContext * aContext, JSScript* aScriptObject)
     NS_ENSURE_TRUE(mScriptGlobalObject, NS_ERROR_NOT_INITIALIZED);
 
     // Execute the precompiled script with the given version
+    JS::Rooted<JSScript*> script(aContext->GetNativeContext(), aScriptObject);
     JSObject* global = mScriptGlobalObject->GetGlobalJSObject();
-    return aContext->ExecuteScript(aScriptObject, global);
+    return aContext->ExecuteScript(script, global);
 }
 
 nsresult

content/xul/templates/src/nsXULTemplateBuilder.cpp

@@ -1397,14 +1397,14 @@ nsXULTemplateBuilder::InitHTMLTemplateRoot()
 
     if (mDB) {
         // database
-        JS::Value jsdatabase;
+        JS::Rooted<JS::Value> jsdatabase(jscontext);
         rv = nsContentUtils::WrapNative(jscontext, scope, mDB,
                                         &NS_GET_IID(nsIRDFCompositeDataSource),
-                                        &jsdatabase, getter_AddRefs(wrapper));
+                                        jsdatabase.address(), getter_AddRefs(wrapper));
         NS_ENSURE_SUCCESS(rv, rv);
 
         bool ok;
-        ok = JS_SetProperty(jscontext, jselement, "database", &jsdatabase);
+        ok = JS_SetProperty(jscontext, jselement, "database", jsdatabase.address());
         NS_ASSERTION(ok, "unable to set database property");
         if (! ok)
             return NS_ERROR_FAILURE;
@@ -1412,16 +1412,16 @@ nsXULTemplateBuilder::InitHTMLTemplateRoot()
 
     {
         // builder
-        JS::Value jsbuilder;
+        JS::Rooted<JS::Value> jsbuilder(jscontext);
         nsCOMPtr<nsIXPConnectJSObjectHolder> wrapper;
         rv = nsContentUtils::WrapNative(jscontext, jselement,
                                         static_cast<nsIXULTemplateBuilder*>(this),
                                         &NS_GET_IID(nsIXULTemplateBuilder),
-                                        &jsbuilder, getter_AddRefs(wrapper));
+                                        jsbuilder.address(), getter_AddRefs(wrapper));
         NS_ENSURE_SUCCESS(rv, rv);
 
         bool ok;
-        ok = JS_SetProperty(jscontext, jselement, "builder", &jsbuilder);
+        ok = JS_SetProperty(jscontext, jselement, "builder", jsbuilder.address());
         if (! ok)
             return NS_ERROR_FAILURE;
     }

dom/base/nsGlobalWindow.cpp

@@ -1754,8 +1754,8 @@ nsGlobalWindow::UnmarkGrayTimers()
       Function* f = timeout->mScriptHandler->GetCallback();
       if (f) {
         // Callable() already does xpc_UnmarkGrayObject.
-        DebugOnly<JSObject*> o = f->Callable();
-        MOZ_ASSERT(!xpc_IsGrayGCThing(o), "Should have been unmarked");
+        DebugOnly<JS::Handle<JSObject*> > o = f->Callable();
+        MOZ_ASSERT(!xpc_IsGrayGCThing(o.value), "Should have been unmarked");
       }
     }
   }

dom/bindings/CallbackFunction.h

@@ -31,7 +31,7 @@ public:
     MOZ_ASSERT(JS_ObjectIsCallable(nullptr, aCallable));
   }
 
-  JSObject* Callable() const
+  JS::Handle<JSObject*> Callable() const
   {
     return Callback();
   }