Bug 866450 Part 7: Root some additional JS::Values found during review r=bz
authorDavid Zbarsky <dzbarsky@gmail.com>
Thu, 02 May 2013 05:12:47 -0400
changeset 130670 478105be6e91d2608c1a784ec96e3407589e4205
parent 130669 ae0aac5ce54ef54a24a97737c50466aa88e33f96
child 130671 a303955db0b5aa7a3405f06fc8fba879e81ed0f5
push id1579
push userphilringnalda@gmail.com
push dateSat, 04 May 2013 04:38:04 +0000
treeherderfx-team@a56432a42a41 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbz
bugs866450
milestone23.0a1
Bug 866450 Part 7: Root some additional JS::Values found during review r=bz
content/base/src/nsFrameMessageManager.cpp
content/base/src/nsObjectLoadingContent.cpp
content/base/src/nsXMLHttpRequest.cpp
content/canvas/src/CanvasUtils.h
content/events/src/nsDOMMessageEvent.cpp
content/html/content/src/HTMLOptionsCollection.cpp
content/html/content/src/HTMLTableElement.cpp
content/html/content/src/nsHTMLFormElement.cpp
content/html/document/src/nsHTMLDocument.cpp
content/xul/templates/src/nsXULTemplateBuilder.cpp
dom/base/nsJSEnvironment.cpp
dom/devicestorage/nsDeviceStorage.cpp
dom/file/ArchiveRequest.cpp
dom/indexedDB/IDBObjectStore.cpp
dom/ipc/StructuredCloneUtils.cpp
dom/mobilemessage/src/MobileMessageCallback.cpp
dom/mobilemessage/src/MobileMessageCursorCallback.cpp
dom/workers/WorkerPrivate.cpp
--- a/content/base/src/nsFrameMessageManager.cpp
+++ b/content/base/src/nsFrameMessageManager.cpp
@@ -655,20 +655,20 @@ nsFrameMessageManager::ReceiveMessage(ns
         JSAutoRequest ar(ctx);
         JSAutoCompartment ac(ctx, object);
 
         // The parameter for the listener function.
         JS::Rooted<JSObject*> param(ctx,
           JS_NewObject(ctx, nullptr, nullptr, nullptr));
         NS_ENSURE_TRUE(param, NS_ERROR_OUT_OF_MEMORY);
 
-        JS::Value targetv;
+        JS::Rooted<JS::Value> targetv(ctx);
         JS::Rooted<JSObject*> global(ctx, JS_GetGlobalForObject(ctx, object));
-        nsContentUtils::WrapNative(ctx, global, aTarget, &targetv, nullptr,
-                                   true);
+        nsContentUtils::WrapNative(ctx, global, aTarget, targetv.address(),
+                                   nullptr, true);
 
         // To keep compatibility with e10s message manager,
         // define empty objects array.
         if (!aObjectsArray) {
           // Because we want JS messages to have always the same properties,
           // create array even if len == 0.
           aObjectsArray = JS_NewArrayObject(ctx, 0, nullptr);
           if (!aObjectsArray) {
@@ -695,19 +695,19 @@ nsFrameMessageManager::ReceiveMessage(ns
         JS_DefineProperty(ctx, param, "name",
                           STRING_TO_JSVAL(jsMessage), nullptr, nullptr, JSPROP_ENUMERATE);
         JS_DefineProperty(ctx, param, "sync",
                           BOOLEAN_TO_JSVAL(aSync), nullptr, nullptr, JSPROP_ENUMERATE);
         JS_DefineProperty(ctx, param, "json", json, nullptr, nullptr, JSPROP_ENUMERATE); // deprecated
         JS_DefineProperty(ctx, param, "data", json, nullptr, nullptr, JSPROP_ENUMERATE);
         JS_DefineProperty(ctx, param, "objects", objectsv, nullptr, nullptr, JSPROP_ENUMERATE);
 
-        JS::Rooted<JS::Value> thisValue(ctx, JSVAL_VOID);
+        JS::Rooted<JS::Value> thisValue(ctx, JS::UndefinedValue());
 
-        JS::Value funval;
+        JS::Rooted<JS::Value> funval(ctx);
         if (JS_ObjectIsCallable(ctx, object)) {
           // If the listener is a JS function:
           funval.setObject(*object);
 
           // A small hack to get 'this' value right on content side where
           // messageManager is wrapped in TabChildGlobal.
           nsCOMPtr<nsISupports> defaultThisValue;
           if (mChrome) {
@@ -715,17 +715,18 @@ nsFrameMessageManager::ReceiveMessage(ns
           } else {
             defaultThisValue = aTarget;
           }
           JS::Rooted<JSObject*> global(ctx, JS_GetGlobalForObject(ctx, object));
           nsContentUtils::WrapNative(ctx, global, defaultThisValue,
                                      thisValue.address(), nullptr, true);
         } else {
           // If the listener is a JS object which has receiveMessage function:
-          if (!JS_GetProperty(ctx, object, "receiveMessage", &funval) ||
+          if (!JS_GetProperty(ctx, object, "receiveMessage",
+                              funval.address()) ||
               !funval.isObject())
             return NS_ERROR_UNEXPECTED;
 
           // Check if the object is even callable.
           NS_ENSURE_STATE(JS_ObjectIsCallable(ctx, &funval.toObject()));
           thisValue.setObject(*object);
         }
 
--- a/content/base/src/nsObjectLoadingContent.cpp
+++ b/content/base/src/nsObjectLoadingContent.cpp
@@ -3085,36 +3085,35 @@ nsObjectLoadingContent::TeardownProtoCha
     do_QueryInterface(static_cast<nsIImageLoadingContent*>(this));
 
   // Use the safe JSContext here as we're not always able to find the
   // JSContext associated with the NPP any more.
   JSContext *cx = nsContentUtils::GetSafeJSContext();
   JS::Rooted<JSObject*> obj(cx, thisContent->GetWrapper());
   NS_ENSURE_TRUE(obj, /* void */);
 
+  JS::Rooted<JSObject*> proto(cx);
   JSAutoRequest ar(cx);
   JSAutoCompartment ac(cx, obj);
 
-  JSObject *proto;
-
   // Loop over the DOM element's JS object prototype chain and remove
   // all JS objects of the class sNPObjectJSWrapperClass
   bool removed = false;
   while (obj) {
-    if (!::JS_GetPrototype(cx, obj, &proto)) {
+    if (!::JS_GetPrototype(cx, obj, proto.address())) {
       return;
     }
     if (!proto) {
       break;
     }
     // Unwrap while checking the jsclass - if the prototype is a wrapper for
     // an NP object, that counts too.
     if (JS_GetClass(js::UncheckedUnwrap(proto)) == &sNPObjectJSWrapperClass) {
       // We found an NPObject on the proto chain, get its prototype...
-      if (!::JS_GetPrototype(cx, proto, &proto)) {
+      if (!::JS_GetPrototype(cx, proto, proto.address())) {
         return;
       }
 
       MOZ_ASSERT(!removed, "more than one NPObject in prototype chain");
       removed = true;
 
       // ... and pull it out of the chain.
       ::JS_SetPrototype(cx, obj, proto);
--- a/content/base/src/nsXMLHttpRequest.cpp
+++ b/content/base/src/nsXMLHttpRequest.cpp
@@ -3625,24 +3625,24 @@ nsXMLHttpRequest::GetInterface(const nsI
   return QueryInterface(aIID, aResult);
 }
 
 JS::Value
 nsXMLHttpRequest::GetInterface(JSContext* aCx, nsIJSID* aIID, ErrorResult& aRv)
 {
   const nsID* iid = aIID->GetID();
   nsCOMPtr<nsISupports> result;
-  JS::Value v = JSVAL_NULL;
+  JS::Rooted<JS::Value> v(aCx, JSVAL_NULL);
   aRv = GetInterface(*iid, getter_AddRefs(result));
   NS_ENSURE_FALSE(aRv.Failed(), JSVAL_NULL);
 
   JS::Rooted<JSObject*> wrapper(aCx, GetWrapper());
   JSAutoCompartment ac(aCx, wrapper);
   JS::Rooted<JSObject*> global(aCx, JS_GetGlobalForObject(aCx, wrapper));
-  aRv = nsContentUtils::WrapNative(aCx, global, result, iid, &v);
+  aRv = nsContentUtils::WrapNative(aCx, global, result, iid, v.address());
   return aRv.Failed() ? JSVAL_NULL : v;
 }
 
 nsXMLHttpRequestUpload*
 nsXMLHttpRequest::Upload()
 {
   if (!mUpload) {
     mUpload = new nsXMLHttpRequestUpload(this);
--- a/content/canvas/src/CanvasUtils.h
+++ b/content/canvas/src/CanvasUtils.h
@@ -160,17 +160,17 @@ DashArrayToJSVal(FallibleTArray<T>& dash
         JS_NewArrayObject(cx, dashes.Length(), nullptr));
     if (!obj) {
         rv.Throw(NS_ERROR_OUT_OF_MEMORY);
         return JSVAL_NULL;
     }
     for (uint32_t i = 0; i < dashes.Length(); ++i) {
         double d = dashes[i];
         JS::Value elt = DOUBLE_TO_JSVAL(d);
-        if (!JS_SetElement(cx, obj, i, &elt)) {
+        if (!JS_DefineElement(cx, obj, i, elt, nullptr, nullptr, 0)) {
             rv.Throw(NS_ERROR_FAILURE);
             return JSVAL_NULL;
         }
     }
     return OBJECT_TO_JSVAL(obj);
 }
 
 }
--- a/content/events/src/nsDOMMessageEvent.cpp
+++ b/content/events/src/nsDOMMessageEvent.cpp
@@ -55,18 +55,18 @@ nsDOMMessageEvent::GetData(JSContext* aC
   ErrorResult rv;
   *aData = GetData(aCx, rv);
   return rv.ErrorCode();
 }
 
 JS::Value
 nsDOMMessageEvent::GetData(JSContext* aCx, ErrorResult& aRv)
 {
-  JS::Value data = mData;
-  if (!JS_WrapValue(aCx, &data)) {
+  JS::Rooted<JS::Value> data(aCx, mData);
+  if (!JS_WrapValue(aCx, data.address())) {
     aRv.Throw(NS_ERROR_FAILURE);
   }
   return data;
 }
 
 NS_IMETHODIMP
 nsDOMMessageEvent::GetOrigin(nsAString& aOrigin)
 {
--- a/content/html/content/src/HTMLOptionsCollection.cpp
+++ b/content/html/content/src/HTMLOptionsCollection.cpp
@@ -286,18 +286,19 @@ HTMLOptionsCollection::NamedItem(JSConte
                                  ErrorResult& error)
 {
   nsINode* item = GetNamedItemHelper(mElements, name);
   if (!item) {
     return nullptr;
   }
   JS::Rooted<JSObject*> wrapper(cx, nsWrapperCache::GetWrapper());
   JSAutoCompartment ac(cx, wrapper);
-  JS::Value v;
-  if (!mozilla::dom::WrapObject(cx, wrapper, item, item, nullptr, &v)) {
+  JS::Rooted<JS::Value> v(cx);
+  if (!mozilla::dom::WrapObject(cx, wrapper, item, item, nullptr,
+                                v.address())) {
     error.Throw(NS_ERROR_FAILURE);
     return nullptr;
   }
   return &v.toObject();
 }
 
 void
 HTMLOptionsCollection::GetSupportedNames(nsTArray<nsString>& aNames)
--- a/content/html/content/src/HTMLTableElement.cpp
+++ b/content/html/content/src/HTMLTableElement.cpp
@@ -229,18 +229,18 @@ TableRowsCollection::NamedItem(JSContext
       nsCOMPtr<nsIDOMNode> item;
       error = collection->NamedItem(name, getter_AddRefs(item));
       if (error.Failed()) {
         return nullptr;
       }
       if (item) {
         JS::Rooted<JSObject*> wrapper(cx, nsWrapperCache::GetWrapper());
         JSAutoCompartment ac(cx, wrapper);
-        JS::Value v;
-        if (!mozilla::dom::WrapObject(cx, wrapper, item, &v)) {
+        JS::Rooted<JS::Value> v(cx);
+        if (!mozilla::dom::WrapObject(cx, wrapper, item, v.address())) {
           error.Throw(NS_ERROR_FAILURE);
           return nullptr;
         }
         return &v.toObject();
       }
     }
   );
   return nullptr;
--- a/content/html/content/src/nsHTMLFormElement.cpp
+++ b/content/html/content/src/nsHTMLFormElement.cpp
@@ -2252,17 +2252,17 @@ NS_IMETHODIMP
 nsFormControlList::NamedItem(const nsAString& aName,
                              nsIDOMNode** aReturn)
 {
   FlushPendingNotifications();
 
   *aReturn = nullptr;
 
   nsCOMPtr<nsISupports> supports;
-  
+
   if (!mNameLookupTable.Get(aName, getter_AddRefs(supports))) {
     // key not found
     return NS_OK;
   }
 
   if (!supports) {
     return NS_OK;
   }
@@ -2548,18 +2548,18 @@ nsFormControlList::NamedItem(JSContext* 
                              mozilla::ErrorResult& error)
 {
   nsISupports *item = NamedItemInternal(name, true);
   if (!item) {
     return nullptr;
   }
   JS::Rooted<JSObject*> wrapper(cx, nsWrapperCache::GetWrapper());
   JSAutoCompartment ac(cx, wrapper);
-  JS::Value v;
-  if (!mozilla::dom::WrapObject(cx, wrapper, item, &v)) {
+  JS::Rooted<JS::Value> v(cx);
+  if (!mozilla::dom::WrapObject(cx, wrapper, item, v.address())) {
     error.Throw(NS_ERROR_FAILURE);
     return nullptr;
   }
   return &v.toObject();
 }
 
 static PLDHashOperator
 CollectNames(const nsAString& aName,
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@@ -2362,23 +2362,23 @@ nsHTMLDocument::NamedGetter(JSContext* c
     aFound = false;
     if (GetCompatibilityMode() == eCompatibility_NavQuirks &&
         aName.EqualsLiteral("all")) {
       rv = nsHTMLDocumentSH::TryResolveAll(cx, this, GetWrapper());
     }
     return nullptr;
   }
 
-  JS::Value val;
+  JS::Rooted<JS::Value> val(cx);
   { // Scope for auto-compartment
     JS::Rooted<JSObject*> wrapper(cx, GetWrapper());
     JSAutoCompartment ac(cx, wrapper);
     // XXXbz Should we call the (slightly misnamed, really) WrapNativeParent
     // here?
-    if (!dom::WrapObject(cx, wrapper, supp, cache, nullptr, &val)) {
+    if (!dom::WrapObject(cx, wrapper, supp, cache, nullptr, val.address())) {
       rv.Throw(NS_ERROR_OUT_OF_MEMORY);
       return nullptr;
     }
   }
   aFound = true;
   return &val.toObject();
 }
 
--- a/content/xul/templates/src/nsXULTemplateBuilder.cpp
+++ b/content/xul/templates/src/nsXULTemplateBuilder.cpp
@@ -1382,19 +1382,19 @@ nsXULTemplateBuilder::InitHTMLTemplateRo
     NS_ASSERTION(context != nullptr, "no jscontext");
     if (! jscontext)
         return NS_ERROR_UNEXPECTED;
 
     JS::Rooted<JSObject*> scope(jscontext, global->GetGlobalJSObject());
 
     JSAutoRequest ar(jscontext);
 
-    JS::Value v;
+    JS::Rooted<JS::Value> v(jscontext);
     nsCOMPtr<nsIXPConnectJSObjectHolder> wrapper;
-    rv = nsContentUtils::WrapNative(jscontext, scope, mRoot, mRoot, &v,
+    rv = nsContentUtils::WrapNative(jscontext, scope, mRoot, mRoot, v.address(),
                                     getter_AddRefs(wrapper));
     NS_ENSURE_SUCCESS(rv, rv);
 
     JS::Rooted<JSObject*> jselement(jscontext, JSVAL_TO_OBJECT(v));
 
     if (mDB) {
         // database
         JS::Value jsdatabase;
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@@ -1513,19 +1513,19 @@ nsJSContext::BindCompiledEventHandler(ns
   NS_PRECONDITION(!aBoundHandler, "Shouldn't already have a bound handler!");
 
   xpc_UnmarkGrayObject(aScope);
   xpc_UnmarkGrayObject(aHandler);
 
   XPCAutoRequest ar(mContext);
 
   // Get the jsobject associated with this target
-  JSObject *target = nullptr;
+  JS::Rooted<JSObject*> target(mContext);
   JS::Rooted<JSObject*> scope(mContext, aScope);
-  nsresult rv = JSObjectFromInterface(aTarget, scope, &target);
+  nsresult rv = JSObjectFromInterface(aTarget, scope, target.address());
   NS_ENSURE_SUCCESS(rv, rv);
 
 #ifdef DEBUG
   {
     JSAutoCompartment ac(mContext, aHandler);
     NS_ASSERTION(JS_TypeOfValue(mContext,
                                 OBJECT_TO_JSVAL(aHandler)) == JSTYPE_FUNCTION,
                  "Event handler object not a function");
--- a/dom/devicestorage/nsDeviceStorage.cpp
+++ b/dom/devicestorage/nsDeviceStorage.cpp
@@ -917,23 +917,23 @@ InterfaceToJsval(nsPIDOMWindow* aWindow,
     return JSVAL_NULL;
   }
 
   AutoPushJSContext cx(scriptContext->GetNativeContext());
   if (!cx) {
     return JSVAL_NULL;
   }
 
-  JS::Value someJsVal;
+  JS::Rooted<JS::Value> someJsVal(cx);
   JS::Rooted<JSObject*> global(cx, JS_GetGlobalObject(cx));
   nsresult rv = nsContentUtils::WrapNative(cx,
                                            global,
                                            aObject,
                                            aIID,
-                                           &someJsVal);
+                                           someJsVal.address());
   if (NS_FAILED(rv)) {
     return JSVAL_NULL;
   }
 
   return someJsVal;
 }
 
 JS::Value
--- a/dom/file/ArchiveRequest.cpp
+++ b/dom/file/ArchiveRequest.cpp
@@ -240,21 +240,22 @@ ArchiveRequest::GetFilesResult(JSContext
   JSObject* array = JS_NewArrayObject(aCx, aFileList.Length(), nullptr);
   if (!array) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
 
   for (uint32_t i = 0; i < aFileList.Length(); ++i) {
     nsCOMPtr<nsIDOMFile> file = aFileList[i];
 
-    JS::Value value;
+    JS::Rooted<JS::Value> value(aCx);
     JS::Rooted<JSObject*> global(aCx, JS_GetGlobalForScopeChain(aCx));
     nsresult rv = nsContentUtils::WrapNative(aCx, global, file,
-                                             &NS_GET_IID(nsIDOMFile), &value);
-    if (NS_FAILED(rv) || !JS_SetElement(aCx, array, i, &value)) {
+                                             &NS_GET_IID(nsIDOMFile),
+                                             value.address());
+    if (NS_FAILED(rv) || !JS_SetElement(aCx, array, i, value.address())) {
       return NS_ERROR_FAILURE;
     }
   }
 
   aValue->setObject(*array);
   return NS_OK;
 }
 
--- a/dom/indexedDB/IDBObjectStore.cpp
+++ b/dom/indexedDB/IDBObjectStore.cpp
@@ -660,23 +660,23 @@ public:
   {
     MOZ_ASSERT(NS_IsMainThread());
 
     nsRefPtr<FileInfo>& fileInfo = aFile.mFileInfo;
 
     nsRefPtr<IDBFileHandle> fileHandle = IDBFileHandle::Create(aDatabase,
       aData.name, aData.type, fileInfo.forget());
 
-    jsval wrappedFileHandle;
+    JS::Rooted<JS::Value> wrappedFileHandle(aCx);
     JS::Rooted<JSObject*> global(aCx, JS_GetGlobalForScopeChain(aCx));
     nsresult rv =
       nsContentUtils::WrapNative(aCx, global,
                                  static_cast<nsIDOMFileHandle*>(fileHandle),
                                  &NS_GET_IID(nsIDOMFileHandle),
-                                 &wrappedFileHandle);
+                                 wrappedFileHandle.address());
     if (NS_FAILED(rv)) {
       NS_WARNING("Failed to wrap native!");
       return nullptr;
     }
 
     return JSVAL_TO_OBJECT(wrappedFileHandle);
   }
 
--- a/dom/ipc/StructuredCloneUtils.cpp
+++ b/dom/ipc/StructuredCloneUtils.cpp
@@ -52,21 +52,21 @@ Read(JSContext* aCx, JSStructuredCloneRe
         MOZ_NOT_REACHED("GetMutable failed!");
       }
       else {
         MOZ_ASSERT(!isMutable);
       }
     }
 #endif
 
-    JS::Value wrappedFile;
+    JS::Rooted<JS::Value> wrappedFile(aCx);
     JS::Rooted<JSObject*> global(aCx, JS_GetGlobalForScopeChain(aCx));
-    nsresult rv =
-      nsContentUtils::WrapNative(aCx, global, file,
-                                  &NS_GET_IID(nsIDOMFile), &wrappedFile);
+    nsresult rv = nsContentUtils::WrapNative(aCx, global, file,
+                                             &NS_GET_IID(nsIDOMFile),
+                                             wrappedFile.address());
     if (NS_FAILED(rv)) {
       Error(aCx, nsIDOMDOMException::DATA_CLONE_ERR);
       return nullptr;
     }
 
     return &wrappedFile.toObject();
   }
 
@@ -85,21 +85,21 @@ Read(JSContext* aCx, JSStructuredCloneRe
         MOZ_NOT_REACHED("GetMutable failed!");
       }
       else {
         MOZ_ASSERT(!isMutable);
       }
     }
 #endif
 
-    JS::Value wrappedBlob;
+    JS::Rooted<JS::Value> wrappedBlob(aCx);
     JS::Rooted<JSObject*> global(aCx, JS_GetGlobalForScopeChain(aCx));
-    nsresult rv =
-      nsContentUtils::WrapNative(aCx, global, blob,
-                                  &NS_GET_IID(nsIDOMBlob), &wrappedBlob);
+    nsresult rv = nsContentUtils::WrapNative(aCx, global, blob,
+                                             &NS_GET_IID(nsIDOMBlob),
+                                             wrappedBlob.address());
     if (NS_FAILED(rv)) {
       Error(aCx, nsIDOMDOMException::DATA_CLONE_ERR);
       return nullptr;
     }
 
     return &wrappedBlob.toObject();
   }
 
--- a/dom/mobilemessage/src/MobileMessageCallback.cpp
+++ b/dom/mobilemessage/src/MobileMessageCallback.cpp
@@ -55,18 +55,19 @@ MobileMessageCallback::NotifySuccess(nsI
   NS_ENSURE_TRUE(cx, NS_ERROR_FAILURE);
 
   JS::Rooted<JSObject*> global(cx, scriptContext->GetNativeGlobal());
   NS_ENSURE_TRUE(global, NS_ERROR_FAILURE);
 
   JSAutoRequest ar(cx);
   JSAutoCompartment ac(cx, global);
 
-  JS::Value wrappedMessage;
-  rv = nsContentUtils::WrapNative(cx, global, aMessage, &wrappedMessage);
+  JS::Rooted<JS::Value> wrappedMessage(cx);
+  rv = nsContentUtils::WrapNative(cx, global, aMessage,
+                                  wrappedMessage.address());
   NS_ENSURE_SUCCESS(rv, rv);
 
   return NotifySuccess(wrappedMessage);
 }
 
 nsresult
 MobileMessageCallback::NotifyError(int32_t aError)
 {
--- a/dom/mobilemessage/src/MobileMessageCursorCallback.cpp
+++ b/dom/mobilemessage/src/MobileMessageCursorCallback.cpp
@@ -68,18 +68,18 @@ MobileMessageCursorCallback::NotifyCurso
   NS_ENSURE_TRUE(cx, NS_ERROR_FAILURE);
 
   JS::Rooted<JSObject*> global(cx, scriptContext->GetNativeGlobal());
   NS_ENSURE_TRUE(global, NS_ERROR_FAILURE);
 
   JSAutoRequest ar(cx);
   JSAutoCompartment ac(cx, global);
 
-  JS::Value wrappedResult;
-  rv = nsContentUtils::WrapNative(cx, global, aResult, &wrappedResult);
+  JS::Rooted<JS::Value> wrappedResult(cx);
+  rv = nsContentUtils::WrapNative(cx, global, aResult, wrappedResult.address());
   NS_ENSURE_SUCCESS(rv, rv);
 
   mDOMCursor->FireSuccess(wrappedResult);
   return NS_OK;
 }
 
 NS_IMETHODIMP
 MobileMessageCursorCallback::NotifyCursorDone()
--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -303,21 +303,21 @@ struct MainThreadWorkerStructuredCloneCa
           NS_ASSERTION(NS_SUCCEEDED(mutableFile->GetMutable(&isMutable)) &&
                        !isMutable,
                        "Only immutable file should be passed to worker");
         }
 #endif
 
         // nsIDOMFiles should be threadsafe, thus we will use the same instance
         // on the main thread.
-        JS::Value wrappedFile;
+        JS::Rooted<JS::Value> wrappedFile(aCx);
         JS::Rooted<JSObject*> global(aCx, JS_GetGlobalForScopeChain(aCx));
-        nsresult rv =
-          nsContentUtils::WrapNative(aCx, global, file,
-                                     &NS_GET_IID(nsIDOMFile), &wrappedFile);
+        nsresult rv = nsContentUtils::WrapNative(aCx, global, file,
+                                                 &NS_GET_IID(nsIDOMFile),
+                                                 wrappedFile.address());
         if (NS_FAILED(rv)) {
           Error(aCx, DATA_CLONE_ERR);
           return nullptr;
         }
 
         return &wrappedFile.toObject();
       }
     }
@@ -337,21 +337,21 @@ struct MainThreadWorkerStructuredCloneCa
           NS_ASSERTION(NS_SUCCEEDED(mutableBlob->GetMutable(&isMutable)) &&
                        !isMutable,
                        "Only immutable blob should be passed to worker");
         }
 #endif
 
         // nsIDOMBlobs should be threadsafe, thus we will use the same instance
         // on the main thread.
-        JS::Value wrappedBlob;
+        JS::Rooted<JS::Value> wrappedBlob(aCx);
         JS::Rooted<JSObject*> global(aCx, JS_GetGlobalForScopeChain(aCx));
-        nsresult rv =
-          nsContentUtils::WrapNative(aCx, global, blob,
-                                     &NS_GET_IID(nsIDOMBlob), &wrappedBlob);
+        nsresult rv = nsContentUtils::WrapNative(aCx, global, blob,
+                                                 &NS_GET_IID(nsIDOMBlob),
+                                                 wrappedBlob.address());
         if (NS_FAILED(rv)) {
           Error(aCx, DATA_CLONE_ERR);
           return nullptr;
         }
 
         return &wrappedBlob.toObject();
       }
     }