As of bug 1318238, we iterate over the entire document to drop all ServoNodeData objects attached to elements when the style set is going away. Without this, we get leaks due to the rule tree not being GCed late enough. (GCing before we drop the strong RuleNode references means we end up leaking the refcount=0 RuleNodes.) I guess a problem with the current rule tree currently is that it's easy to leak RuleNodes. You just have to drop the RuleTree object itself before all of the strong rule node references have been dropped. One approach would be to ensure that we drop the ServoStyleSet only once the document is about to be destroyed. By this point, we should have destroyed all the elements in the document. This would mean transferring ownership of the ServoStyleSet from the pres shell to the document (either from the start, or just when the pres shell is being destroyed). A downside of this approach is that if we are pulling down the presentation for a reason other than the document going away -- for example if we make an iframe display:none -- then we will still retain the style data. Another approach would be to make the references from the ServoNodeData be some kind of soft pointer to the rule node, such that from within the Stylist Drop impl we could force the entire rule tree to be destroyed, while avoiding keeping dangling pointers from the ServoNodeData. A third approach would be to somehow make the Servo RuleTree implementation disable its free list once the Stylist has been dropped. Then, when Gecko later releases the strong RuleNode references, they can be deleted immediately rather than left at refcount=0 waiting for a GC. I'm not sure how well deleting RuleNodes immediately works with the current lock free rule tree implementation.

And yet another dupe of bug 1378005.