I see this with all addons disabled on a trunk debug build: every time I open a new window, 9 nsGlobalWindows are created, and when I close the window, only 7 are destroyed. And this keeps happening as I open and close more windows. The log messages: ++DOMWINDOW == 24 (0xc621130) [serial = 38] [outer = 0x0] ++DOMWINDOW == 25 (0xbae61e0) [serial = 39] [outer = 0xc621100] ++DOCSHELL 0xc6d5e30 == 12 ++DOMWINDOW == 26 (0xc37a940) [serial = 40] [outer = 0x0] ++DOCSHELL 0xc6cecd0 == 13 ++DOMWINDOW == 27 (0xc61fe30) [serial = 41] [outer = 0x0] ++DOCSHELL 0xcc1c5e0 == 14 ++DOMWINDOW == 28 (0xc30d2a0) [serial = 42] [outer = 0x0] ++DOMWINDOW == 29 (0xc33e030) [serial = 43] [outer = 0xc37a910] ++DOMWINDOW == 30 (0xba687f0) [serial = 44] [outer = 0xc61fe00] ++DOMWINDOW == 31 (0xc6ccc60) [serial = 45] [outer = 0xc30d270] --DOMWINDOW == 30 (0xc37a940) [serial = 40] [outer = 0x0] [url = about:blank] --DOMWINDOW == 29 (0xc61fe30) [serial = 41] [outer = 0x0] [url = about:blank] --DOMWINDOW == 28 (0xc30d2a0) [serial = 42] [outer = 0x0] [url = about:blank] --DOCSHELL 0xc6d5e30 == 13 --DOCSHELL 0xc6cecd0 == 12 --DOCSHELL 0xcc1c5e0 == 11 --DOMWINDOW == 27 (0xc33e030) [serial = 43] [outer = 0x0] [url = about:blank] --DOMWINDOW == 26 (0xba687f0) [serial = 44] [outer = 0x0] [url = about:blank] --DOMWINDOW == 25 (0xc6ccc60) [serial = 45] [outer = 0x0] [url = about:blank] We started with 23 windows and ended with 25. It seems to be the first two windows (inner+outer) that are leaked. When I shut down the browser they are destroyed: --DOMWINDOW == 9 (0xbae61e0) [serial = 39] [outer = 0xc621100] [url = about:blank] --DOMWINDOW == 8 (0xc621130) [serial = 38] [outer = 0x0] [url = chrome://browser/content/browser.xul] I guess we leaked the browser chrome window.

I have also reproduced this with a completely fresh profile. Am I the only person seeing this? If not, maybe someone with a build archive can find a regression range.

I can also reproduce in safe mode.

Same here. This is a sneaky one: the DOMWindows do get released when I quit.

DEBUG_CC says: nsCycleCollector: nsXPCWrappedJS (nsIObserver) 0x1d59f098 was not collected due to 1 external references (2 total - 1 known) An object expected to be garbage could be reached from it by the path: nsXPCWrappedJS (nsIObserver) 0x1d59f098 via <unknown edge> JS Object (Object) (global=155a9600) 0x1baf7e20 via __parent__ JS Object (ChromeWindow) (global=155a9600) 0x155a9600 via xpc_GetJSPrivate(obj) XPCWrappedNative (ChromeWindow) 0x1cae2130 via <unknown edge> nsGlobalWindow 0x1cae1400 The 1 known references to it were from: nsXPCWrappedJS (nsIObserver) 0x1d59f098

delayedStartup adds the observers, so better to remove those too.

http://hg.mozilla.org/mozilla-central/rev/4015717dc4ce Thanks smaug! We really need a Tinderbox test that would go red for a bug like this... Still needs landing for 1.9.2.

> We really need a Tinderbox test that would go red for a bug like this... Indeed. Making such an automated test is covered by bug 435915, so I'm removing this bug from the list of bugs that need tests.