A blob rooted with a number of nsXULTemplateBuilders shows up in the CC graph all the time. In the attached example, there are 47 nodes. It turns out that the builder attaches itself as a listener, and so is being held live by the listener service. In that case, we don't need to traverse it.

Simple patch. I'm just not sure if I should add a debug-mode check to see if the template builder is actually a registered listener or not, or if that's just such a fundamental thing that nobody will ever break it. That would require, in the case where we decide to interrupt traverse, to iterate over all listeners and compare them to ourselves.

Comment on attachment 607794 [details] [diff] [review] if we have an observed document, stop traversal Ben, you are familiar with the cycle collector, and wrote the code I'm relying on here in Bug 416939, back in 2008, so you seem like a good reviewer. Basically, whenever the template builder has an observed document, it is registered with the global observer service, which holds it alive, so we don't need to traverse it in the cycle collector. This passed a try run along with some other patches of mine.

Thanks for the quick review! https://hg.mozilla.org/integration/mozilla-inbound/rev/beb523be92e1