Bug 1483042 - Remove more ~RefPtr that fire after a Rooted has been unwrapped for a return value, r=janv

--HG--
extra : topic : hazard
extra : rebase_source : 46b3a440775ccac96859ca93ae2d107eb32299cd

dom/indexedDB/IDBObjectStore.cpp

@@ -906,12 +906,10 @@ CopyingStructuredCloneReadCallback(JSContext* aCx,
 
     if (aTag == SCTAG_DOM_BLOB) {
       MOZ_ASSERT(file.mType == StructuredCloneFile::eBlob);
-
-      RefPtr<Blob> blob = file.mBlob;
-      MOZ_ASSERT(!blob->IsFile());
+      MOZ_ASSERT(!file.mBlob->IsFile());
 
       JS::Rooted<JS::Value> wrappedBlob(aCx);
-      if (NS_WARN_IF(!ToJSValue(aCx, blob, &wrappedBlob))) {
+      if (NS_WARN_IF(!ToJSValue(aCx, file.mBlob, &wrappedBlob))) {
         return nullptr;
       }
 
@@ -923,19 +921,23 @@ CopyingStructuredCloneReadCallback(JSContext* aCx,
     if (aTag == SCTAG_DOM_FILE) {
       MOZ_ASSERT(file.mType == StructuredCloneFile::eBlob);
 
-      RefPtr<Blob> blob = file.mBlob;
-      MOZ_ASSERT(blob->IsFile());
+      {
+        // Create a scope so ~RefPtr fires before returning an unwrapped
+        // JS::Value.
+        RefPtr<Blob> blob = file.mBlob;
+        MOZ_ASSERT(blob->IsFile());
 
-      RefPtr<File> file = blob->ToFile();
-      MOZ_ASSERT(file);
+        RefPtr<File> file = blob->ToFile();
+        MOZ_ASSERT(file);
 
-      JS::Rooted<JS::Value> wrappedFile(aCx);
-      if (NS_WARN_IF(!ToJSValue(aCx, file, &wrappedFile))) {
-        return nullptr;
+        JS::Rooted<JS::Value> wrappedFile(aCx);
+        if (NS_WARN_IF(!ToJSValue(aCx, file, &wrappedFile))) {
+          return nullptr;
+        }
+
+        result.set(&wrappedFile.toObject());
       }
 
-      result.set(&wrappedFile.toObject());
-
       return result;
     }