Bug 411747: latent GC hazard in one of the routines in js.c (npotb), r/a=brendan

js/src/js.c

@@ -1943,6 +1943,12 @@ GetPDA(JSContext *cx, uintN argc, jsval *vp)
             break;
         }
 
+        /* Protect pdobj from GC by setting it as an element of aobj now */
+        v = OBJECT_TO_JSVAL(pdobj);
+        ok = JS_SetElement(cx, aobj, i, &v);
+        if (!ok)
+            break;
+
         ok = JS_SetProperty(cx, pdobj, "id", &pd->id) &&
              JS_SetProperty(cx, pdobj, "value", &pd->value) &&
              (v = INT_TO_JSVAL(pd->flags),
@@ -1952,11 +1958,6 @@ GetPDA(JSContext *cx, uintN argc, jsval *vp)
              JS_SetProperty(cx, pdobj, "alias", &pd->alias);
         if (!ok)
             break;
-
-        v = OBJECT_TO_JSVAL(pdobj);
-        ok = JS_SetElement(cx, aobj, i, &v);
-        if (!ok)
-            break;
     }
     JS_PutPropertyDescArray(cx, &pda);
     return ok;