Bug 21643. Temporary hack to avoid leaking root wrapper when creating both, and root != wrapper. Note that the fix is 'sloppy', as there are flows-of-control that could potentially leak the NS_ADDREF(); however, since jband is rewriting this stuff RSN, and that stuff doesn't really ever fail too often, we'll let i slide. r=jband

git-svn-id: svn://10.0.0.236/trunk@56112 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/js/src/xpconnect/src/xpcwrappednative.cpp

@@ -47,9 +47,7 @@ nsXPCWrappedNative::AddRef(void)
     XPCContext* xpcc;
     ++mRefCnt;
     NS_LOG_ADDREF(this, mRefCnt, "nsXPCWrappedNative", sizeof(*this));
-    if(1 == mRefCnt && mRoot != this)
-        NS_ADDREF(mRoot);
-    else if(2 == mRefCnt && nsnull != (xpcc = mClass->GetXPCContext()))
+    if(2 == mRefCnt && nsnull != (xpcc = mClass->GetXPCContext()))
         JS_AddNamedRoot(xpcc->GetJSContext(), &mJSObj,
                         "nsXPCWrappedNative::mJSObj");
     return mRefCnt;
@@ -137,6 +135,8 @@ nsXPCWrappedNative::GetNewOrUsedWrapper(XPCContext* xpcc,
             NS_ADDREF(wrapper);
             goto return_wrapper;
         }
+
+        NS_ADDREF(root);
     }
 
     // do a QI to make sure the object passed in really supports the
@@ -232,6 +232,8 @@ nsXPCWrappedNative::GetNewOrUsedWrapper(XPCContext* xpcc,
     wrapper->mNext = root->mNext;
     root->mNext = wrapper;
 
+    NS_RELEASE(root);
+
 return_wrapper:
     if(rootObj)
         NS_RELEASE(rootObj);
@@ -284,6 +286,10 @@ nsXPCWrappedNative::nsXPCWrappedNative(nsISupports* aObj,
             mDynamicScriptable = ds;
         }
     }
+    else
+    {
+        NS_ADDREF(mRoot);
+    }
 
     mJSObj = aClass->NewInstanceJSObject(this);
     if(mJSObj)