Bug 1775424 - Part 3: Fix GC hazards in ImportMetaResolveImpl. r=jonco

Differential Revision: https://phabricator.services.mozilla.com/D155973

js/loader/ModuleLoaderBase.cpp

@@ -173,6 +173,11 @@ bool ModuleLoaderBase::ImportMetaResolve(JSContext* cx, unsigned argc,
 JSString* ModuleLoaderBase::ImportMetaResolveImpl(
     JSContext* aCx, JS::Handle<JS::Value> aReferencingPrivate,
     JS::Handle<JSString*> aSpecifier) {
+  RootedString urlString(aCx);
+
+  {
+    // ModuleScript should only live in this block, otherwise it will be a GC
+    // hazard
     RefPtr<ModuleScript> script =
         static_cast<ModuleScript*>(aReferencingPrivate.toPrivate());
     MOZ_ASSERT(script->IsModuleScript());
@@ -207,7 +212,11 @@ JSString* ModuleLoaderBase::ImportMetaResolveImpl(
     nsCOMPtr<nsIURI> uri = result.unwrap();
     nsAutoCString url;
     MOZ_ALWAYS_SUCCEEDS(uri->GetAsciiSpec(url));
-  return JS_NewStringCopyZ(aCx, url.get());
+
+    urlString.set(JS_NewStringCopyZ(aCx, url.get()));
+  }
+
+  return urlString;
 }
 
 // static