topcrash bug 78442 during xpinstall.

patch thanks to jband@netscape.com, r=syd, sr=dveditz


git-svn-id: svn://10.0.0.236/trunk@108467 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/xpinstall/src/nsXPITriggerInfo.cpp

@@ -133,6 +133,7 @@ void nsXPITriggerInfo::SaveCallback( JSContext *aCx, jsval aVal )
 
 static void  destroyTriggerEvent(XPITriggerEvent* event)
 {
+    JS_RemoveRoot( event->cx, &event->cbval );
     delete event;
 }
 
@@ -194,6 +195,12 @@ void nsXPITriggerInfo::SendStatus(const PRUnichar* URL, PRInt32 status)
                     event->global   = OBJECT_TO_JSVAL(obj);
 
                     event->cbval    = mCbval;
+                    JS_AddNamedRoot( event->cx, &event->cbval,
+                                     "XPITriggerEvent::cbval" );
+
+                    // Hold a strong reference to keep the underlying
+                    // JSContext from dying before we handle this event.
+                    event->ref      = mGlobalWrapper;
 
                     eq->PostEvent(&event->e);
                 }

mozilla/xpinstall/src/nsXPITriggerInfo.h

@@ -47,6 +47,7 @@ typedef struct XPITriggerEvent {
     JSContext*  cx;
     jsval       global;
     jsval       cbval;
+    nsCOMPtr<nsISupports> ref;
 } XPITriggerEvent;