If an element with a binding doesn't have a parent, we won't unlink it because we currently rely on a parent to do that by calling Unbind on its children. If an element with a binding doesn't have an owner document anymore, we won't unlink it because we can't get at the binding from the element.

Comment on attachment 386585 [details] [diff] [review] v1 >diff --git a/content/base/src/nsGenericElement.cpp b/content/base/src/nsGenericElement.cpp >--- a/content/base/src/nsGenericElement.cpp >+++ b/content/base/src/nsGenericElement.cpp >@@ -3987,8 +3987,17 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(ns > NS_IF_RELEASE(slots->mControllers); > slots->mChildrenList = nsnull; > } > } >+ >+ { >+ nsIDocument *doc; >+ if (!tmp->GetNodeParent() && (doc = tmp->GetOwnerDoc()) && >+ tmp->HasFlag(NODE_MAY_BE_IN_BINDING_MNGR)) { >+ nsAutoScriptBlocker scriptBlocker; >+ doc->BindingManager()->ChangeDocumentFor(tmp, doc, nsnull); >+ } >+ } > NS_IMPL_CYCLE_COLLECTION_UNLINK_END Scriptblocker in unlink? Very scary. Does ChangeDocumentFor really need it?

Perhaps the scriptblocker could be set before calling cycle collector?

Yeah, I don't think it needs a script blocker.

Comment on attachment 386746 [details] [diff] [review] v1.1 Looks ok. Does this fix those addBinding leaks we were seeing on mochitest, perchance?

http://hg.mozilla.org/mozilla-central/rev/fe1f520ff772 I'll try to make a testcase, but it could be hard (dependent on order of CC or GC).