We ran into more issues regarding this in bug 1353104, and Kris kindly volunteered to take a look at this if I filed a bug.
This is a bit of a tricky case. Normally, docshells are always held alive by the visible window that they're attached to, and are destroyed and detached from their content windows as soon as those windows are closed. That means that we normally don't need to worry about cycles for them, and therefore docshells, document loaders, and content viewers aren't cycle collected. In this case, though, we want to destroy the docshell when the windowless browser becomes unreferenced, and those cycles start to matter. I talked to smaug about this on IRC, and I'm going to try to implement a sort of partial cycle collection for this. Since the only cycles we need to care about pass through the windowless browser <-> its content window, we only need to trace the edges that lead from the browser to the window, via the docshell/docloader/content viewer. So my plan is to implement friend functions to traverse those edges from the windowless browser's traverse callback, and add special purpose leak checks to make sure that everything works as expected.
You need to log in before you can comment on or make changes to this bug.