Docshell doesn't need to hold a pointer to the scriptcontext; the window does

it.  Bug 282807, r+sr=jst

docshell/base/nsDocShell.cpp

@@ -3405,10 +3405,6 @@ nsDocShell::Destroy()
         mScriptGlobal->SetGlobalObjectOwner(nsnull);
         mScriptGlobal = nsnull;
     }
-    if (mScriptContext) {
-        mScriptContext->SetOwner(nsnull);
-        mScriptContext = nsnull;
-    }
 
     mSessionHistory = nsnull;
     SetTreeOwner(nsnull);
@@ -6959,7 +6955,7 @@ nsDocShell::GetRootScrollableView(nsIScrollableView ** aOutScrollView)
 NS_IMETHODIMP
 nsDocShell::EnsureScriptEnvironment()
 {
-    if (mScriptContext)
+    if (mScriptGlobal)
         return NS_OK;
 
     if (mIsBeingDestroyed) {
@@ -6979,8 +6975,12 @@ nsDocShell::EnsureScriptEnvironment()
         SetGlobalObjectOwner(NS_STATIC_CAST
                              (nsIScriptGlobalObjectOwner *, this));
 
-    factory->NewScriptContext(mScriptGlobal, getter_AddRefs(mScriptContext));
-    NS_ENSURE_TRUE(mScriptContext, NS_ERROR_FAILURE);
+    nsCOMPtr<nsIScriptContext> context;
+    factory->NewScriptContext(mScriptGlobal, getter_AddRefs(context));
+    NS_ENSURE_TRUE(context, NS_ERROR_FAILURE);
+
+    // Note that mScriptGlobal has taken a reference to the script
+    // context, so we don't have to.
 
     return NS_OK;
 }

docshell/base/nsDocShell.h

@@ -435,7 +435,6 @@ protected:
     nsCOMPtr<nsIURI>           mCurrentURI;
     nsCOMPtr<nsIURI>           mReferrerURI;
     nsCOMPtr<nsIScriptGlobalObject> mScriptGlobal;
-    nsCOMPtr<nsIScriptContext> mScriptContext;
     nsCOMPtr<nsISHistory>      mSessionHistory;
     nsCOMPtr<nsIGlobalHistory2> mGlobalHistory;
     nsCOMPtr<nsIWebBrowserFind> mFind;

docshell/base/nsWebShell.cpp

@@ -188,15 +188,6 @@ nsWebShell::~nsWebShell()
   mContentViewer=nsnull;
   mDeviceContext=nsnull;
 
-  if (mScriptGlobal) {
-    mScriptGlobal->SetDocShell(nsnull);
-    mScriptGlobal = nsnull;
-  }
-  if (mScriptContext) {
-    mScriptContext->SetOwner(nsnull);
-    mScriptContext = nsnull;
-  }
-
   InitFrameData();
 
 #ifdef DEBUG

dom/src/base/nsGlobalWindow.cpp

@@ -278,7 +278,10 @@ nsGlobalWindow::CleanUp()
   ClearControllers();
 
   mOpener = nsnull;             // Forces Release
-  mContext = nsnull;            // Forces Release
+  if (mContext) {
+    mContext->SetOwner(nsnull);
+    mContext = nsnull;            // Forces Release
+  }
   mChromeEventHandler = nsnull; // Forces Release
 
   if (IsPopupSpamWindow()) {
@@ -354,6 +357,9 @@ nsGlobalWindow::SetContext(nsIScriptContext* aContext)
     mJSObject = ::JS_GetGlobalObject(cx);
   }
 
+  if (mContext) {
+    mContext->SetOwner(nsnull);
+  }
   mContext = aContext;
 
   if (mContext) {
@@ -718,7 +724,10 @@ nsGlobalWindow::SetDocShell(nsIDocShell* aDocShell)
 
     mContext->GC();
 
-    mContext = nsnull;          // force release now
+    if (mContext) {
+      mContext->SetOwner(nsnull);
+      mContext = nsnull;          // force release now
+    }
     mChromeEventHandler = nsnull; // force release now
   }