Added Rooting to avoid GC Hazards

Based on the GC Hazard analysis I fixed some of the dangerous code paths that was flagged.

Author: leeN

js/src/builtin/Array.cpp

@@ -1376,7 +1376,7 @@ bool js::array_join(JSContext* cx, unsigned argc, Value* vp) {
   }
 
   // Step 8.
-  JSString* str = sb.finishString();
+  JS::Rooted<JSString*> str(cx, sb.finishString());
   if (!str) {
     return false;
   }

js/src/builtin/JSON.cpp

@@ -2358,7 +2358,7 @@ bool json_stringify(JSContext* cx, unsigned argc, Value* vp) {
   // needs to support returning undefined. So this is a little awkward
   // for the API, because we want to support streaming writers.
   if (!sb.empty()) {
-    JSString* str = sb.finishString();
+    JS::Rooted<JSString*> str(cx, sb.finishString());
     if (!str) {
       return false;
     }

js/src/builtin/String.cpp

@@ -526,7 +526,7 @@ static bool str_escape(JSContext* cx, unsigned argc, Value* vp) {
     return true;
   }
 
-  JSString* res = newChars.toString(cx, newLength);
+  JS::Rooted<JSString*> res(cx, newChars.toString(cx, newLength));
   if (!res) {
     return false;
   }
@@ -1969,7 +1969,7 @@ static bool str_normalize(JSContext* cx, unsigned argc, Value* vp) {
     form = NormalizationForm::NFC;
   } else {
     // Step 4.
-    JSLinearString* formStr = ArgToLinearString(cx, args, 0);
+    JS::Rooted<JSLinearString*> formStr(cx, ArgToLinearString(cx, args, 0));
     if (!formStr) {
       return false;
     }
@@ -3312,7 +3312,7 @@ static JSLinearString* TrimString(JSContext* cx, JSString* str, bool trimStart,
                &end);
   }
 
-  JSLinearString* result = NewDependentString(cx, linear, begin, end - begin);
+  JS::Rooted<JSLinearString*> result(cx, NewDependentString(cx, linear, begin, end - begin));
 
   // TaintFox: Add trim operation to current taint flow.
   // the acutal trimming of taint ranges has been done in
@@ -4293,7 +4293,7 @@ static ArrayObject* CharSplitHelper(JSContext* cx, Handle<JSLinearString*> str,
 
   for (size_t i = 0; i < resultlen; ++i) {
     // TaintFox: code modified to avoid atoms.
-    JSString* sub = NewDependentString(cx, str, i, 1);
+    JS::Rooted<JSString*> sub(cx, NewDependentString(cx, str, i, 1));
     // was:
     // JSString* sub = staticStrings.getUnitStringForElement(cx, str, i);
     if (!sub) {

js/src/jit/VMFunctions.cpp

@@ -1357,7 +1357,7 @@ JSString* StringReplace(JSContext* cx, HandleString string,
   MOZ_ASSERT(pattern);
   MOZ_ASSERT(repl);
   // Foxhound: this will propagate the taint but not add the operation
-  JSString* str = str_replace_string_raw(cx, string, pattern, repl);
+  Rooted<JSString*> str(cx, str_replace_string_raw(cx, string, pattern, repl));
   if (str && str->taint().hasTaint()) {
     str->taint().extend(TaintOperationFromContext(cx, "replace", true, pattern, repl));
   }

js/src/jsapi.cpp

@@ -5014,7 +5014,7 @@ JS_ReportTaintSink(JSContext* cx, JS::HandleString str, const char* sink, JS::Ha
   // slot of the current global object.
   RootedFunction report(cx);
 
-  JSObject* global = cx->global();
+  JS::Rooted<JSObject*> global(cx, cx->global());
 
   RootedValue slot(cx, JS::GetReservedSlot(global, TAINT_REPORT_FUNCTION_SLOT));
   if (slot.isUndefined()) {

js/src/jstaint.cpp

@@ -504,7 +504,7 @@ void JS::PrintJsonTaint(JSContext* cx, JSString* str, HandleValue location, js::
 
   // Dump additional information from the taintreport
   if (location.isObject()) {
-    JSObject* obj = ToObject(cx, location);
+    JS::Rooted<JSObject*> obj(cx, ToObject(cx, location));
     PrintJsonObject(cx, obj, json);
   }