r=shaver

- Fixed two similar cases where code was missing one level of
pointer dereference in terminating a copied string. Was trashing
data further up the stack.
- Use 'nsAllocator::Free' in two similar cases where 'delete' was
mistakenly used. Error pointed out by Purify.

js/src/xpconnect/src/xpcconvert.cpp

@@ -1338,7 +1338,7 @@ XPCConvert::JSStringWithSize2Native(JSContext* cx, void* d, jsval s,
                     return JS_FALSE;
                 }
                 memcpy(*((char**)d), bytes, count);
-                ((char**)d)[count] = 0;
+                (*((char**)d))[count] = 0;
             }
             else
                 *((char**)d) = bytes;
@@ -1404,7 +1404,7 @@ XPCConvert::JSStringWithSize2Native(JSContext* cx, void* d, jsval s,
                     return JS_FALSE;
                 }
                 memcpy(*((jschar**)d), chars, alloc_len);
-                ((jschar**)d)[count] = 0;
+                (*((jschar**)d))[count] = 0;
             }
             else
                 *((jschar**)d) = chars;

js/src/xpconnect/src/xpcjsid.cpp

@@ -660,7 +660,7 @@ CIDCreateInstance::Call(JSContext *cx, JSObject *obj,
             return NS_OK;
         }
         iid = *piid;
-        delete piid;
+        nsAllocator::Free(piid);
     }
     else
         iid = NS_GET_IID(nsISupports);
@@ -861,7 +861,7 @@ CIDGetService::Call(JSContext *cx, JSObject *obj,
             return NS_OK;
         }
         iid = *piid;
-        delete piid;
+        nsAllocator::Free(piid);
     }
     else
         iid = NS_GET_IID(nsISupports);