Fix for bug 406684 (Memory leaks when content policies set properties of wrapped nodes). r/sr=sicking.

git-svn-id: svn://10.0.0.236/trunk@240467 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/content/base/src/nsDocument.cpp

@@ -5583,6 +5583,13 @@ nsDocument::Destroy()
   mLayoutHistoryState = nsnull;
 
   nsContentList::OnDocumentDestroy(this);
+
+  // XXX We really should let cycle collection do this, but that currently still
+  //     leaks (see https://bugzilla.mozilla.org/show_bug.cgi?id=406684).
+  //     When we start relying on cycle collection again we should remove the
+  //     check for mScriptGlobalObject in AddReference.
+  delete mContentWrapperHash;
+  mContentWrapperHash = nsnull;
 }
 
 already_AddRefed<nsILayoutHistoryState>

mozilla/dom/src/base/nsGlobalWindow.cpp

@@ -988,7 +988,7 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsGlobalWindow)
 
   // Unlink any associated preserved wrapper.
   if (tmp->mDoc) {
-    tmp->mDoc->RemoveReference(tmp->mDoc.get());
+    tmp->mDoc->RemoveReference(tmp);
     NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mDoc)
   }