browser_xhr_onchange_leak.js is a test I wrote a while ago for a leak fix in bug 1336811. The idea is that you load a certain page, then navigate away from it and end the test. If there's a leak, then the "leaked window until shutdown" detector will find it.
Right now the test does a cross-origin navigation, which breaks with Fission because we start tearing down the old process, then attempt to use the message manager in the old process. A simple fix for this is to change the navigation to be same-origin.
Amazingly, if you revert the leak fix part of bug 1336811, in non-Fission you can still reproduce a leak. However, with my fix for Fission in the previous paragraph, it no longer actually leaks. This appears to be due to the fact that Fission does not support the dom.ipc.keepProcessesAlive.* preference (bug 1580212) because if I hack that up to affect all processes, then I can reproduce the leak. Presumably what happens is that without that pref when you close the tab that contains the test it just tears everything down.
Probably I should rewrite this test to manually check if the page went away after the navigation. Either that or I think I could hack up dom.ipc.keepProcessesAlive.* to work in Fission, and then set the pref. This also makes me worry about what kind of test coverage we might be losing by dropping that pref.
I should also take a look at the tests I changed in bug 1572781, which are similar-ish leak tests.