Bug 404755 - fixing memory leak resulted from bug 363603 [p=igor@mir2.org (Igor Bukanov) r+a1.9=brendan]

js/src/jsobj.c

@@ -2944,6 +2944,8 @@ js_FreeSlot(JSContext *cx, JSObject *obj, uint32 slot)
     JS_ASSERT(!MAP_IS_NATIVE(map) || ((JSScope *)map)->object == obj);
     LOCKED_OBJ_SET_SLOT(obj, slot, JSVAL_VOID);
     if (map->freeslot == slot + 1) {
+        map->freeslot = slot;
+
         /* When shrinking ReallocSlots always returns true. */
         ReallocSlots(cx, obj, slot, JS_FALSE);
     }