StructureID holds a RefPtr to PropertyNameArrayData, and vice-versa. That's the leak. Sam mentioned that PropertyNameArrayData's pointer could be a weak pointer instead, cleared in the StructureID destructor.
Created attachment 24092 [details] patch
Comment on attachment 24092 [details] patch r=me -- test case?
Fixed in r37300.