Fix leak of nsJSRuntime due to unbalanced calls of HoldScriptObject (with null argument). b=386294 r+sr=jst

content/base/public/nsContentUtils.h

@@ -982,14 +982,18 @@ public:
     ScriptObjectHolder(PRUint32 aLangID) : mLangID(aLangID),
                                            mObject(nsnull)
     {
+      MOZ_COUNT_CTOR(ScriptObjectHolder);
     }
     ~ScriptObjectHolder()
     {
+      MOZ_COUNT_DTOR(ScriptObjectHolder);
       if (mObject)
         DropScriptObject(mLangID, mObject);
     }
     nsresult set(void *aObject)
     {
+      NS_ASSERTION(aObject, "unexpected null object");
+      NS_ASSERTION(!mObject, "already have an object");
       nsresult rv = HoldScriptObject(mLangID, aObject);
       if (NS_SUCCEEDED(rv)) {
         mObject = aObject;

content/base/src/nsContentUtils.cpp

@@ -3495,6 +3495,7 @@ nsContentUtils::GetDOMScriptObjectFactory()
 nsresult
 nsContentUtils::HoldScriptObject(PRUint32 aLangID, void *aObject)
 {
+  NS_ASSERTION(aObject, "unexpected null object");
   nsresult rv;
 
   PRUint32 langIndex = NS_STID_INDEX(aLangID);
@@ -3514,6 +3515,8 @@ nsContentUtils::HoldScriptObject(PRUint32 aLangID, void *aObject)
   NS_ENSURE_SUCCESS(rv, rv);
 
   ++sScriptRootCount[langIndex];
+  NS_LOG_ADDREF(sScriptRuntimes[langIndex], sScriptRootCount[langIndex],
+                "HoldScriptObject", sizeof(void*));
 
   return NS_OK;
 }
@@ -3522,7 +3525,10 @@ nsContentUtils::HoldScriptObject(PRUint32 aLangID, void *aObject)
 nsresult
 nsContentUtils::DropScriptObject(PRUint32 aLangID, void *aObject)
 {
+  NS_ASSERTION(aObject, "unexpected null object");
   PRUint32 langIndex = NS_STID_INDEX(aLangID);
+  NS_LOG_RELEASE(sScriptRuntimes[langIndex], sScriptRootCount[langIndex] - 1,
+                 "HoldScriptObject");
   nsresult rv = sScriptRuntimes[langIndex]->DropScriptObject(aObject);
   if (--sScriptRootCount[langIndex] == 0) {
     NS_RELEASE(sScriptRuntimes[langIndex]);

content/xul/content/src/nsXULElement.cpp

@@ -2830,8 +2830,8 @@ nsXULPrototypeScript::DeserializeOutOfLine(nsIObjectInputStream* aInput,
                         NS_ERROR("XUL cache gave different language?");
                         return NS_ERROR_UNEXPECTED;
                     }
+                    mScriptObject.set(newScriptObject);
                 }
-                mScriptObject.set(newScriptObject);
             }
         }