Fixing crash regression bug 234626. Add kungFuDeathGrips to functions in nsJSContext that execute JS (some already had them) to avoid having JSContexts die on us while they're still on the stack. r=caillon@aillon.org, sr=dbaron@dbaron.org, a=chofmann@mozilla.org

dom/src/base/nsJSEnvironment.cpp

@@ -702,6 +702,10 @@ nsJSContext::EvaluateStringWithValue(const nsAString& aScript,
     return NS_ERROR_FAILURE;
   }
 
+  // This context can be deleted unexpectedly if the JS closes the
+  // owning window.
+  nsCOMPtr<nsIScriptContext> kungFuDeathGrip(this);
+
   // The result of evaluation, used only if there were no errors.  This need
   // not be a GC root currently, provided we run the GC only from the branch
   // callback or from ScriptEvaluated.  TODO: use JS_Begin/EndRequest to keep
@@ -846,10 +850,8 @@ nsJSContext::EvaluateString(const nsAString& aScript,
     aPrincipal->GetJSPrincipals(mContext, &jsprin);
   }
   else {
-    nsIScriptGlobalObject *global = GetGlobalObject();
-    if (!global)
-      return NS_ERROR_FAILURE;
-    nsCOMPtr<nsIScriptObjectPrincipal> objPrincipal = do_QueryInterface(global, &rv);
+    nsCOMPtr<nsIScriptObjectPrincipal> objPrincipal =
+      do_QueryInterface(GetGlobalObject(), &rv);
     if (NS_FAILED(rv))
       return NS_ERROR_FAILURE;
     rv = objPrincipal->GetPrincipal(getter_AddRefs(principal));
@@ -857,6 +859,11 @@ nsJSContext::EvaluateString(const nsAString& aScript,
       return NS_ERROR_FAILURE;
     principal->GetJSPrincipals(mContext, &jsprin);
   }
+
+  // this context can be deleted unexpectedly if the JS closes the
+  // owning window.
+  nsCOMPtr<nsIScriptContext> kungFuDeathGrip(this);
+
   // From here on, we must JSPRINCIPALS_DROP(jsprin) before returning...
 
   PRBool ok = PR_FALSE;