Created attachment 556246 [details] [diff] [review]
nsTreeColumn is a cycle collected class and it's in a linked list, pretty obvious it needs to traverse to the next in the list.
Comment on attachment 556246 [details] [diff] [review]
Ah, sorry, I missed this in Bug 461640.
Oh, that's tricky. I don't have an analysis that will even try to find raw pointer fields that should be ref counted.