nsHTMLTableElement doesn't unlink mTBodies nor mRows,
and mRows doesn't unlink mOrphanRows.
I haven't figured out whether there can a real leak somewhere, but I've
seen few CC logs where table element keeps a DOM tree alive and table element
has one unknown edge to it.
And to clarify, I haven't seen shutdown leaks, but only suspicious CC logs.
Created attachment 586495 [details] [diff] [review]
There should be null checks for all the unlinked variables.
Comment on attachment 586495 [details] [diff] [review]