Smaug's added a bunch of places where a Traverse will check if another object must be alive (because it is a currently displayed document for instance), and interrupt the traverse if so, based on an invariant that the other object must strongly hold the current object. We should add some assertions for these ownership relations we depend on, maybe only in the case where we perform the interrupted traverse, so if they change at some later point we won't just silently start leaking. It might also be good to create some macros for the common pattern of checking the generation, as that is pretty boiler-platey. On the other hand, NS_IMPLEMENT_CYCLE_COLLECTOR_INTERRUPT_DOCUMENT(mDocument) or what have you is not all that much better.

This hasn't really been a problem in practice.