Bug 947336, part 1 - Make nsXPCWrappedJS::mOuter into a smart pointer. r=bholley

js/xpconnect/src/XPCWrappedJS.cpp

@@ -424,8 +424,7 @@ nsXPCWrappedJS::nsXPCWrappedJS(JSContext* cx,
     : mJSObj(aJSObj),
       mClass(aClass),
       mRoot(root ? root : MOZ_THIS_IN_INITIALIZER_LIST()),
-      mNext(nullptr),
-      mOuter(nullptr)
+      mNext(nullptr)
 {
     InitStub(GetClass()->GetIID());
 
@@ -501,10 +500,9 @@ nsXPCWrappedJS::Unlink()
     if (mOuter) {
         XPCJSRuntime* rt = nsXPConnect::GetRuntimeInstance();
         if (rt->GCIsRunning()) {
-            nsContentUtils::DeferredFinalize(mOuter);
-            mOuter = nullptr;
+            nsContentUtils::DeferredFinalize(mOuter.forget().get());
         } else {
-            NS_RELEASE(mOuter);
+            mOuter = nullptr;
         }
     }
 }

js/xpconnect/src/xpcprivate.h

@@ -2515,7 +2515,7 @@ public:
                        "Only one aggregated native can be set");
             return;
         }
-        NS_ADDREF(mRoot->mOuter = aNative);
+        mRoot->mOuter = aNative;
     }
 
     void TraceJS(JSTracer* trc);
@@ -2538,7 +2538,7 @@ private:
     nsXPCWrappedJSClass* mClass;
     nsXPCWrappedJS* mRoot;
     nsXPCWrappedJS* mNext;
-    nsISupports* mOuter;    // only set in root
+    nsCOMPtr<nsISupports> mOuter;    // only set in root
 };
 
 /***************************************************************************/