XHR holds an autoptr to a blob set, which holds a field that is nsTArray<nsRefPtr<FileImpl>>, and FileImpl can sometimes contain fields that need to be cycle collected, so you have to call Traverse() and Unlink() on them, but the FileImpl are not real cycle collected objects.
I'm not sure how that is supposed to work if FileImpl is shared, but maybe that can't happen.
At the moment we have CCed FileImpl just for ArchiveReader (as far as I remember). I don't think this is a really issue at the moment and I hope that soon or late FileImpl will not have IsCCed()/Traverse()/Unlink() methods.
With 'I hope' I mean bug 1083828.