Fix memory leak, change uint to unsigned, bug 584917 followup. r=brendan,njn

js/src/jsgcinlines.h

@@ -253,13 +253,13 @@ MarkChildren(JSTracer *trc, JSObject *obj)
     if (JSObject *parent = obj->getParent())
         MarkObject(trc, *parent, "parent");
 
-        if (obj->emptyShapes) {
-            int count = FINALIZE_OBJECT_LAST - FINALIZE_OBJECT0 + 1;
-            for (int i = 0; i < count; i++) {
-                if (obj->emptyShapes[i])
-                    obj->emptyShapes[i]->trace(trc);
-            }
+    if (obj->emptyShapes) {
+        int count = FINALIZE_OBJECT_LAST - FINALIZE_OBJECT0 + 1;
+        for (int i = 0; i < count; i++) {
+            if (obj->emptyShapes[i])
+                obj->emptyShapes[i]->trace(trc);
         }
+    }
 
     /* Delegate to ops or the native marking op. */
     TraceOp op = obj->getOps()->trace;

js/src/jsobj.cpp

@@ -6587,9 +6587,9 @@ js_DumpObject(JSObject *obj)
     fprintf(stderr, "\n");
 
     if (obj->isDenseArray()) {
-        uint slots = JS_MIN(obj->getArrayLength(), obj->getDenseArrayCapacity());
+        unsigned slots = JS_MIN(obj->getArrayLength(), obj->getDenseArrayCapacity());
         fprintf(stderr, "elements\n");
-        for (uint i = 0; i < slots; i++) {
+        for (unsigned i = 0; i < slots; i++) {
             fprintf(stderr, " %3d: ", i);
             dumpValue(obj->getDenseArrayElement(i));
             fprintf(stderr, "\n");
@@ -6619,9 +6619,9 @@ js_DumpObject(JSObject *obj)
         fprintf(stderr, "private %p\n", obj->getPrivate());
 
     fprintf(stderr, "slots:\n");
-    uint reservedEnd = JSCLASS_RESERVED_SLOTS(clasp);
-    uint slots = obj->slotSpan();
-    for (uint i = 0; i < slots; i++) {
+    unsigned reservedEnd = JSCLASS_RESERVED_SLOTS(clasp);
+    unsigned slots = obj->slotSpan();
+    for (unsigned i = 0; i < slots; i++) {
         fprintf(stderr, " %3d ", i);
         if (i < reservedEnd)
             fprintf(stderr, "(reserved) ");

js/src/jsobjinlines.h

@@ -675,6 +675,8 @@ JSObject::finish(JSContext *cx)
 #endif
     if (hasSlotsArray())
         freeSlotsArray(cx);
+    if (emptyShapes)
+        cx->free(emptyShapes);
 #ifdef JS_THREADSAFE
     js_FinishTitle(cx, &title);
 #endif