Fix anyname_finalize to look in the right compartment, to avoid dangling pointer. Likely fix for bug 603270. r=mrbkap over IRC.

--HG--
extra : rebase_source : 234c1412ce5543e32222cfd292ee905634ef6741

js/src/jsxml.cpp

@@ -339,8 +339,8 @@ static void
 anyname_finalize(JSContext* cx, JSObject* obj)
 {
     /* Make sure the next call to js_GetAnyName doesn't try to use obj. */
-    if (cx->compartment->anynameObject == obj)
-        cx->compartment->anynameObject = NULL;
+    if (obj->compartment()->anynameObject == obj)
+        obj->compartment()->anynameObject = NULL;
 }
 
 static JSBool