Bug 1306281 - Defer release during finalization of sandbox principals, r=bholley.

--HG--
extra : rebase_source : 331f8d0f8010dd3d522d00511bb9f89348f7fa03

js/xpconnect/src/Sandbox.cpp

@@ -48,6 +48,7 @@
 #include "mozilla/dom/URLBinding.h"
 #include "mozilla/dom/URLSearchParamsBinding.h"
 #include "mozilla/dom/XMLHttpRequest.h"
+#include "mozilla/DeferredFinalize.h"
 
 using namespace mozilla;
 using namespace JS;
@@ -411,8 +412,8 @@ sandbox_finalize(js::FreeOp* fop, JSObject* obj)
     }
 
     static_cast<SandboxPrivate*>(sop)->ForgetGlobalObject();
-    NS_RELEASE(sop);
     DestroyProtoAndIfaceCache(obj);
+    DeferredFinalize(sop);
 }
 
 static void