Landing patch from mrbkap: Fix GC hazards in the plugin code. Add a "close friend" API for JSTempValueRooters for use from C++. bug 347054, r=brendan sr=dbaron a=schrep

git-svn-id: svn://10.0.0.236/branches/MOZILLA_1_8_BRANCH@206783 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/modules/plugin/base/src/ns4xPlugin.cpp

@@ -63,6 +63,8 @@
 #include "nsIScriptGlobalObject.h"
 #include "nsIScriptContext.h"
 
+#include "jscntxt.h"
+
 #include "nsIXPConnect.h"
 
 #if defined(XP_MACOSX)
@@ -1730,6 +1732,11 @@ _evaluate(NPP npp, NPObject* npobj, NPString *script, NPVariant *result)
     return false;
   }
 
+  // Root obj and the rval (below).
+  jsval vec[] = { OBJECT_TO_JSVAL(obj), JSVAL_NULL };
+  JSAutoTempValueRooter tvr(cx, NS_ARRAY_LENGTH(vec), vec);
+  jsval *rval = &vec[1];
+
   if (result) {
     // Initialize the out param to void
     VOID_TO_NPVARIANT(*result);
@@ -1750,20 +1757,11 @@ _evaluate(NPP npp, NPObject* npobj, NPString *script, NPVariant *result)
   nsIPrincipal *principal = nsnull;
   // XXX: Get the principal from the security stack (TBD)
 
-  jsval rval = JSVAL_NULL;
-  if (!::JS_AddNamedRoot(cx, &rval, "NPN_evaluate")) {
-    return false;
-  }
-    
   nsresult rv = scx->EvaluateStringWithValue(utf16script, obj, principal,
-                                             nsnull, 0, nsnull, &rval, nsnull);
+                                             nsnull, 0, nsnull, rval, nsnull);
 
-  bool retval = NS_SUCCEEDED(rv) &&
-    (!result || JSValToNPVariant(npp, cx, rval, result));
-  
-  ::JS_RemoveRoot(cx, &rval);
-  
-  return retval;
+  return NS_SUCCEEDED(rv) &&
+         (!result || JSValToNPVariant(npp, cx, *rval, result));
 }
 
 bool NP_EXPORT

mozilla/modules/plugin/base/src/nsJSNPRuntime.cpp

@@ -50,6 +50,9 @@
 #include "prmem.h"
 #include "nsIContent.h"
 
+// FIXME(bug 332648): Give me a real API please!
+#include "jscntxt.h"
+
 // Hash of JSObject wrappers that wraps JSObjects as NPObjects. There
 // will be one wrapper per JSObject per plugin instance, i.e. if two
 // plugins access the JSObject x, two wrappers for x will be
@@ -552,15 +555,21 @@ doInvoke(NPObject *npobj, NPIdentifier method, const NPVariant *args,
     }
   }
 
+  JSTempValueRooter tvr;
+  JS_PUSH_TEMP_ROOT(cx, 0, jsargs, &tvr);
+
   // Convert args
   for (PRUint32 i = 0; i < argCount; ++i) {
     jsargs[i] = NPVariantToJSVal(npp, cx, args + i);
+    ++tvr.count;
   }
 
   jsval v;
   JSBool ok = ::JS_CallFunctionValue(cx, npjsobj->mJSObj, fv, argCount, jsargs,
                                      &v);
 
+  JS_POP_TEMP_ROOT(cx, &tvr);
+
   if (jsargs != jsargs_buf)
     PR_Free(jsargs);
 
@@ -662,6 +671,7 @@ nsJSObjWrapper::NP_SetProperty(NPObject *npobj, NPIdentifier identifier,
   AutoCXPusher pusher(cx);
 
   jsval v = NPVariantToJSVal(npp, cx, value);
+  JSAutoTempValueRooter tvr(cx, v);
 
   if (JSVAL_IS_STRING(id)) {
     JSString *str = JSVAL_TO_STRING(id);