From 199e734a048538eba455780dc8f580f81fc802f4 Mon Sep 17 00:00:00 2001
From: Mark Banner <standard8@mozilla.com>
Date: Wed, 28 Feb 2018 15:59:06 +0000
Subject: [PATCH] Bug 1437476 - Clone annotation objects before passing to
 back-end services to avoid leaks. r=mak

MozReview-Commit-ID: 1ke3FK4gQkL

--HG--
extra : rebase_source : 6f89b803f8c5ea42bf9ec4c65538d9b293aa2d4e
---
 toolkit/components/places/PlacesTransactions.jsm | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/toolkit/components/places/PlacesTransactions.jsm b/toolkit/components/places/PlacesTransactions.jsm
index a52a7d49c236..ceb7f55690e3 100644
--- a/toolkit/components/places/PlacesTransactions.jsm
+++ b/toolkit/components/places/PlacesTransactions.jsm
@@ -737,8 +737,11 @@ DefineTransaction.annotationObjectValidate = function(obj) {
       checkProperty(obj, "value", false, isPrimitive) ) {
     // Nothing else should be set
     let validKeys = ["name", "value", "flags", "expires"];
-    if (Object.keys(obj).every(k => validKeys.includes(k)))
-      return obj;
+    if (Object.keys(obj).every(k => validKeys.includes(k))) {
+      // Annotations objects are passed through to the backend, to avoid memory
+      // leaks, we must clone the object.
+      return {...obj};
+    }
   }
   throw new Error("Invalid annotation object");
 };