From c1259eea9d7cd819ca0427217871edf6fd824056 Mon Sep 17 00:00:00 2001
From: Terrence Cole <terrence@mozilla.com>
Date: Tue, 27 Aug 2013 15:16:03 -0700
Subject: [PATCH] Bug 909866 - Fix an exact rooting hazard in
 JSCompartment::wrap; r=sfink

--HG--
extra : rebase_source : 637cea3f6c93a333bfe9000f0837663fd0905853
---
 js/src/jscompartmentinlines.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/js/src/jscompartmentinlines.h b/js/src/jscompartmentinlines.h
index 607868ed051..c371be006c8 100644
--- a/js/src/jscompartmentinlines.h
+++ b/js/src/jscompartmentinlines.h
@@ -54,8 +54,8 @@ JSCompartment::wrap(JSContext *cx, JS::MutableHandleValue vp, JS::HandleObject e
 
     /* Handle strings. */
     if (vp.isString()) {
-        JSString *str = vp.toString();
-        if (!wrap(cx, &str))
+        JS::RootedString str(cx, vp.toString());
+        if (!wrap(cx, str.address()))
             return false;
         vp.setString(str);
         return true;