On Mac (and maybe elsewhere) we are leaking nsXULDocuments. With a breakpoint in ~nsXULDocument, I see only the docs for sidebar panels being freed, but none for any of the top-level windows.

My suspision is that nsEventStateManager is leaking nsXULDocuments. It seems to be holding owning refs to them via mDocument, and also in gLastFocusedDocument.

nsEventStateMangager did not implement nsISupportsWeakReference, so was being held onto as observers of XPCOM shutdown. Fixing that fixes some ESM leakage. But I'm still leaking nsXULDocuments. nsXULDocument::GetScriptObject() and nsXBLBinding=::GetScriptObject() are now looking suspicious. The JS object that they return seems to be holding a ref to the nsXULDocument, yet I don't see where this ref goes away and neither do any kind of free or release on their mScriptObject. Does this ref go away when JS contexts are destroyed?

This was fixed by the fix for 38869.

Fixed!

Sorry for the spam. New QA Contact for Browser General. Thanks for your help Joseph (good luck with the new job) and welcome aboard Doron Rosenberg

Simon, can you suggest/update the QA contact for this bug. Thanks