Bug 868266. Root the arguments list in nsObjectLoadingContent::LegacyCall. r=terrence
authorBoris Zbarsky <bzbarsky@mit.edu>
Fri, 03 May 2013 19:28:32 -0400
changeset 141753 c2b32320a79f37c6c63e39138713330f9cef3925
parent 141752 692a66d1c8ee9a25cc5cddfb3f15bda263c46b46
child 141754 705880d234376d176071f4e62a23399019e608bb
push id2579
push userakeybl@mozilla.com
push dateMon, 24 Jun 2013 18:52:47 +0000
treeherdermozilla-beta@b69b7de8a05a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersterrence
bugs868266
milestone23.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 868266. Root the arguments list in nsObjectLoadingContent::LegacyCall. r=terrence
content/base/src/nsObjectLoadingContent.cpp
--- a/content/base/src/nsObjectLoadingContent.cpp
+++ b/content/base/src/nsObjectLoadingContent.cpp
@@ -2870,16 +2870,17 @@ nsObjectLoadingContent::LegacyCall(JSCon
     aRv.Throw(NS_ERROR_NOT_AVAILABLE);
     return JS::UndefinedValue();
   }
 
   obj = thisContent->GetWrapper();
   // Now wrap things up into the compartment of "obj"
   JSAutoCompartment ac(aCx, obj);
   nsTArray<JS::Value> args(aArguments);
+  JS::AutoArrayRooter rooter(aCx, args.Length(), args.Elements());
   for (JS::Value *arg = args.Elements(), *arg_end = arg + args.Length();
        arg != arg_end;
        ++arg) {
     if (!JS_WrapValue(aCx, arg)) {
       aRv.Throw(NS_ERROR_UNEXPECTED);
       return JS::UndefinedValue();
     }
   }