DESCRIPTION: There are a significant number of form element content nodes leaked loading http://www.city.net/ . The problem seems to be (I think) in SinkContext::DemoteContainer ( see http://lxr.mozilla.org/seamonkey/source/layout/html/document/src/nsHTMLContentSink.cpp#1536 ) at the following lines: 1536 childFormControl->GetForm(&formElem); 1537 // Removing the child will set it's form control to nsnull. 1538 result = container->RemoveChildAt(0, sync); 1539 // Restore the child's form control using the cache'd pointer. 1540 childFormControl->SetForm(formElem); The function itself is doing the refcounting correctly (I clipped that part out). However, the RemoveChildAt() call above sets mForm to nsnull *without releasing it* (I think through nsGenericHTMLElement::SetParentForFormControls), and that reference to the form element leaks. STEPS TO REPRODUCE: * setenv XPCOM_MEM_LEAK_LOG 1 * ./mozilla http://www.excite.com/travel/ ( a.k.a. http://www.city.net/ ) ACTUAL RESULTS: * objects leaked: * 1 nsHTMLFormElement * 23 nsHTMLInputElement * 9 nsHTMLSelectElement DOES NOT WORK CORRECTLY ON: * debug build from 2000-05-18 tree closure ADDITIONAL INFORMATION: Some refcount logs, balance trees, etc., are at (when my computer is on) http://dbaron.student.harvard.edu/u/david/leaks/city.net/

Related to bug 36639? There is an attempt at a fix there, but it causes new leaks for whatever reason...

Kevin, you put some fixes into vidur's code, could you take a look at this?

This is a duplicate of / will be fixed by bug 36639, so I don't think there's much need to worry about it.

*** This bug has been marked as a duplicate of 36639 ***

Updating QA contact.