nsHTMLTableElement doesn't unlink mTBodies nor mRows, and mRows doesn't unlink mOrphanRows. I haven't figured out whether there can a real leak somewhere, but I've seen few CC logs where table element keeps a DOM tree alive and table element has one unknown edge to it.
And to clarify, I haven't seen shutdown leaks, but only suspicious CC logs.
Created attachment 586495 [details] [diff] [review] patch There should be null checks for all the unlinked variables.
Comment on attachment 586495 [details] [diff] [review] patch r=me