fix memory corruption bug 52382. r=mstoltz

caps/src/nsJSPrincipals.cpp

@@ -41,8 +41,13 @@ nsDestroyJSPrincipals(JSContext *cx, struct JSPrincipals *jsprin) {
     nsJSPrincipals *nsjsprin = (nsJSPrincipals *)jsprin;
     // We need to destroy the nsIPrincipal. We'll do this by adding
     // to the refcount and calling release
+
+    // Note that we don't want to use NS_IF_RELEASE because it will try
+    // to set nsjsprin->nsIPrincipalPtr to nsnull *after* nsjsprin has
+    // already been destroyed.
     nsjsprin->refcount++;
-    NS_IF_RELEASE(nsjsprin->nsIPrincipalPtr);
+    if (nsjsprin->nsIPrincipalPtr)
+        nsjsprin->nsIPrincipalPtr->Release();
     // The nsIPrincipal that we release owns the JSPrincipal struct,
     // so we don't need to worry about "codebase"
 }