Currently we call JSPurpleBuffer::Destroy from
nsCycleCollector::PrepareForGarbageCollection. If the CC is shut down after a call to
nsCycleCollector::GetJSPurpleBuffer (which creates a JSPurpleBuffer) but before a GC
happens, we'll release the strong reference in mJSPurpleBuffer from nsCycleCollector's
destructor but we won't call JSPurpleBuffer::Destroy. That leaves a stale pointer to the
JSPurpleBuffer in the JSHolder's hash.
--HG--
extra : rebase_source : b21a0953ae5b3a470dbd22b8285bffb858f87f13
extra : histedit_source : 1959a4480066fc0920830428023ce01e0768c08e
4efe180435