Root across calls to JS_SetElement and JS_SetProperty. b=331667 r=jst,dbradley sr=brendan

js/src/xpconnect/src/XPCDispConvert.cpp

@@ -402,7 +402,8 @@ JSBool XPCDispConvert::COMArrayToJSArray(XPCCallContext& ccx,
         err = NS_ERROR_OUT_OF_MEMORY;
         return JS_FALSE;
     }
-    // Devine the type of our array
+    AUTO_MARK_JSVAL(ccx, OBJECT_TO_JSVAL(array));
+    // Divine the type of our array
     VARTYPE vartype;
     if((src.vt & VT_ARRAY) != 0)
     {
@@ -413,7 +414,8 @@ JSBool XPCDispConvert::COMArrayToJSArray(XPCCallContext& ccx,
         if(FAILED(SafeArrayGetVartype(src.parray, &vartype)))
             return JS_FALSE;
     }
-    jsval val;
+    jsval val = JSVAL_NULL;
+    AUTO_MARK_JSVAL(ccx, &val);
     for(long index = lbound; index <= ubound; ++index)
     {
         HRESULT hr;

js/src/xpconnect/src/XPCDispTearOff.cpp

@@ -302,6 +302,7 @@ STDMETHODIMP XPCDispatchTearOff::Invoke(DISPID dispIdMember, REFIID riid,
                 msg += name;
                 return Error(E_FAIL, msg.get());
             }
+            AUTO_MARK_JSVAL(ccx, &val);
             obj = GetJSObject();
             if(!obj)
                 return Error(E_FAIL, "The JS wrapper did not return a JS object");

js/src/xpconnect/src/xpcconvert.cpp

@@ -1623,7 +1623,8 @@ XPCConvert::NativeArray2JS(XPCCallContext& ccx,
         *pErr = NS_ERROR_XPC_BAD_CONVERT_NATIVE;
 
     JSUint32 i;
-    jsval current;
+    jsval current = JSVAL_NULL;
+    AUTO_MARK_JSVAL(ccx, &current);
 
 #define POPULATE(_t)                                                         \
     PR_BEGIN_MACRO                                                           \

js/src/xpconnect/src/xpcprivate.h

@@ -3455,8 +3455,13 @@ DEFINE_AUTO_MARKING_ARRAY_PTR_TYPE(AutoMarkingNativeInterfacePtrArrayPtr,
 // these and bind them to rooted things so immediately that this just is not
 // needed.
 
-#define AUTO_MARK_JSVAL(ccx, val) \
-    XPCMarkableJSVal _val(val); AutoMarkingJSVal _automarker(ccx, &_val)
+#define AUTO_MARK_JSVAL_HELPER2(tok, line) tok##line
+#define AUTO_MARK_JSVAL_HELPER(tok, line) AUTO_MARK_JSVAL_HELPER2(tok, line)
+
+#define AUTO_MARK_JSVAL(ccx, val)                                            \
+    XPCMarkableJSVal AUTO_MARK_JSVAL_HELPER(_val_,__LINE__)(val);            \
+    AutoMarkingJSVal AUTO_MARK_JSVAL_HELPER(_automarker_,__LINE__)           \
+    (ccx, &AUTO_MARK_JSVAL_HELPER(_val_,__LINE__))
 
 #ifdef XPC_USE_SECURITY_CHECKED_COMPONENT
 /***************************************************************************/

js/src/xpconnect/src/xpcwrappedjsclass.cpp

@@ -1196,7 +1196,8 @@ nsXPCWrappedJSClass::CallMethod(nsXPCWrappedJS* wrapper, uint16 methodIndex,
         nsXPTType datum_type;
         JSUint32 array_count;
         PRBool isArray = type.IsArray();
-        jsval val;
+        jsval val = JSVAL_NULL;
+        AUTO_MARK_JSVAL(ccx, &val);
         PRBool isSizedString = isArray ?
                 JS_FALSE :
                 type.TagPart() == nsXPTType::T_PSTRING_SIZE_IS ||

js/src/xpconnect/src/xpcwrappednative.cpp

@@ -2176,7 +2176,8 @@ XPCWrappedNative::CallMethod(XPCCallContext& ccx,
 
         const nsXPTType& type = paramInfo.GetType();
         nsXPTCVariant* dp = &dispatchParams[i];
-        jsval v;
+        jsval v = JSVAL_NULL;
+        AUTO_MARK_JSVAL(ccx, &v);
         JSUint32 array_count;
         nsXPTType datum_type;
         PRBool isArray = type.IsArray();