The sequence of construction and the partial-initialization states of the JSFunction / JSScript / LazyScript / Scope is pretty inconsistent right now, particularly with OOM. We should try to clean this up to support Bug 1529456 and Bug 1544117.
- Define the partial-initialization states (eg. JSFunction without a script; JSScript without SSD)
- Identify the fields (such as LazyScript::enclosingLazyScriptOrScope_) that form cycles and explicitly document them
- More helper methods for patching scripts into tree into the JSFunction namespace
- Add a script tree verification helper