Bug 829421 - Free ArgumentsData if JSObject allocation fails. r=nbp

js/src/vm/ArgumentsObject.cpp

@@ -161,8 +161,10 @@ ArgumentsObject::create(JSContext *cx, HandleScript script, HandleFunction calle
     ClearAllBitArrayElements(data->deletedBits, numDeletedWords);
 
     RawObject obj = JSObject::create(cx, FINALIZE_KIND, shape, type, NULL);
-    if (!obj)
+    if (!obj) {
+        js_free(data);
         return NULL;
+    }
 
     obj->initFixedSlot(INITIAL_LENGTH_SLOT, Int32Value(numActuals << PACKED_BITS_COUNT));
     obj->initFixedSlot(DATA_SLOT, PrivateValue(data));