Bug 941784 - Fix an exact rooting hazard false positive in XMLHttpRequest::Send; r=bent

--HG--
extra : rebase_source : d27bf81bb50528c49ad1036e19fcef6040ae4575

dom/workers/XMLHttpRequest.cpp

@@ -1965,8 +1965,12 @@ XMLHttpRequest::Send(const nsAString& aBody, ErrorResult& aRv)
 void
 XMLHttpRequest::Send(JSObject* aBody, ErrorResult& aRv)
 {
-  mWorkerPrivate->AssertIsOnWorkerThread();
+  JSContext* cx = mWorkerPrivate->GetJSContext();
+
   MOZ_ASSERT(aBody);
+  JS::Rooted<JSObject*> body(cx, aBody);
+
+  mWorkerPrivate->AssertIsOnWorkerThread();
 
   if (mCanceled) {
     aRv.Throw(UNCATCHABLE_EXCEPTION);
@@ -1978,15 +1982,13 @@ XMLHttpRequest::Send(JSObject* aBody, ErrorResult& aRv)
     return;
   }
 
-  JSContext* cx = mWorkerPrivate->GetJSContext();
-
   JS::Rooted<JS::Value> valToClone(cx);
-  if (JS_IsArrayBufferObject(aBody) || JS_IsArrayBufferViewObject(aBody) ||
+  if (JS_IsArrayBufferObject(body) || JS_IsArrayBufferViewObject(body) ||
-      file::GetDOMBlobFromJSObject(aBody)) {
+      file::GetDOMBlobFromJSObject(body)) {
-    valToClone.setObject(*aBody);
+    valToClone.setObject(*body);
   }
   else {
-    JS::Rooted<JS::Value> obj(cx, JS::ObjectValue(*aBody));
+    JS::Rooted<JS::Value> obj(cx, JS::ObjectValue(*body));
     JSString* bodyStr = JS::ToString(cx, obj);
     if (!bodyStr) {
       aRv.Throw(NS_ERROR_OUT_OF_MEMORY);