Bug 854614 - Root xpc_qsUnwrapThis. r=terrence,bholley

js/xpconnect/src/XPCQuickStubs.h

@@ -392,7 +392,7 @@ castNative(JSContext *cx,
 template <class T>
 inline JSBool
 xpc_qsUnwrapThis(JSContext *cx,
-                 JSObject *obj,
+                 JS::HandleObject obj,
                  T **ppThis,
                  nsISupports **pThisRef,
                  jsval *pThisVal,
@@ -401,9 +401,10 @@ xpc_qsUnwrapThis(JSContext *cx,
 {
     XPCWrappedNative *wrapper;
     XPCWrappedNativeTearOff *tearoff;
-    nsresult rv = getWrapper(cx, obj, &wrapper, &obj, &tearoff);
+    JS::RootedObject current(cx);
+    nsresult rv = getWrapper(cx, obj, &wrapper, current.address(), &tearoff);
     if (NS_SUCCEEDED(rv))
-        rv = castNative(cx, wrapper, obj, tearoff, NS_GET_TEMPLATE_IID(T),
+        rv = castNative(cx, wrapper, current, tearoff, NS_GET_TEMPLATE_IID(T),
                         reinterpret_cast<void **>(ppThis), pThisRef, pThisVal,
                         lccx);
 

js/xpconnect/src/nsDOMQS.h

@@ -57,7 +57,7 @@ NEW_BINDING(nsDOMEvent, Event);
 template <>                                                                   \
 MOZ_ALWAYS_INLINE JSBool                                                      \
 xpc_qsUnwrapThis<_interface>(JSContext *cx,                                   \
-                             JSObject *obj,                                   \
+                             JS::HandleObject obj,                            \
                              _interface **ppThis,                             \
                              nsISupports **pThisRef,                          \
                              jsval *pThisVal,                                 \

js/xpconnect/src/qsgen.py

@@ -833,7 +833,7 @@ def writeQuickStub(f, customMethodCalls, stringtable, member, stubName,
     f.write("    XPC_QS_ASSERT_CONTEXT_OK(cx);\n")
 
     # Compute "this".
-    f.write("    JSObject *obj = JS_THIS_OBJECT(cx, vp);\n"
+    f.write("    JS::RootedObject obj(cx, JS_THIS_OBJECT(cx, vp));\n"
             "    if (!obj)\n"
             "        return JS_FALSE;\n")