nsSocketTransport objects leak entirely. This has some collateral damage as they drag down some buffers and other things. My test case for this is to load http://www.visa.com/ in viewer. Shaver has reproduced it with mozilla loading the same site.
It's somehow related to cache
Fixed. The leak resulted from socketTransports being accessed via nsISupportedArray::ElementAt, which would increment the refcount. Bloat log shows no socket transport leaks at all now.