In layout/html/style/src we have, in nsCSSValue and nsHTMLValue, a member variable that we set with nsString::ToNewValue and then try to release with simple delete. This is twice wrong. First, it is a an array we are trying to release (and hence we should use delete []) but even this is not correct. nsString comments say that the call ToNew* must be matched with a call to Recycle (the memory is not allocated with new). I noticed this with Purify. Attaching patch next.

Changing component to Style System and reassigning

Damn, I messed up my patch. I wasn't using the latest source etc. Recycle only works for char* and PRUnichar*. nsString::Recycle takes nsString*, but does nothing. My guess (I am recompiling everything, latest source, to make sure) is to replace the Recycle calls in the patch with calls to nsAllocator::Free. I'll try to run Purify again to see how much memory this saves with launch/shutdown and attach the Purify log. Maybe I'll spot some other places where this occurs as well.

Bad day. I was seeing ghosts. ToNewString allocates the new string with new and thus freeing it with delete is the right way. I was seeing memory leak because of some old code where the parent object was not released and I thought this was the reason. Also confused this a bit with the other ToNew* methods. Sorry. Marking invalid.

Verified invalid per reporter's comments