Fix leak in message compose window (and probably other places) by breaking a global->controllers->controller->global cycle resulting from having implementations of nsIController in JavaScript. b=56703 r=waterson@netscape.com sr=brendan@mozilla.org

dom/src/base/nsGlobalWindow.cpp

@@ -179,6 +179,7 @@ void GlobalWindowImpl::CleanUp()
   NS_IF_RELEASE(mLocation);
   NS_IF_RELEASE(mFrames);
   mOpener = nsnull;             // Forces Release
+  mControllers = nsnull;        // Forces Release
   if (--gRefCnt == 0) {
     NS_IF_RELEASE(gEntropyCollector);
   }
@@ -426,6 +427,7 @@ NS_IMETHODIMP GlobalWindowImpl::SetDocShell(nsIDocShell* aDocShell)
       mContext->RemoveReference(&mScriptObject, mScriptObject);
     }
     mContext = nsnull;          // force release now
+    mControllers = nsnull;      // force release now
   }
   mDocShell = aDocShell;        // Weak Reference
 

dom/src/base/nsGlobalWindow.h

@@ -235,6 +235,12 @@ protected:
   nsresult CheckSecurityLeftAndTop(PRInt32* left, PRInt32* top);
 
 protected:
+  // When adding new member variables, be careful not to create cycles
+  // through JavaScript.  If there is any chance that a member variable
+  // could own objects that are implemented in JavaScript, then those
+  // objects will keep the global object (this object) alive.  To prevent
+  // these cycles, ownership of such members must be released in
+  // |CleanUp| and |SetDocShell|.
   nsCOMPtr<nsIScriptContext>    mContext;
   nsCOMPtr<nsIDOMDocument>      mDocument;
   nsCOMPtr<nsIDOMWindowInternal> mOpener;