Some leaks were introduced after the landing. I'll attach the logs.
I wrote the following in email to hyatt: I think what's happening with the string leaks is that you're not calling the destructors for any of the style data stuff. You're using a |Destroy| method instead of an |operator delete| (or it isn't calling the |delete|, which would need to be modified, or something), so the destructors never get called, which means the nsString destructor is never called and the leak logging doesn't know it's gone away. This would also mean that stuff allocated outside of the arena that would be freed by the destructors (~nsString, etc.) isn't freed. However, if that were the case I'd expect the Boehm GC to show a lot more leaks (since I'd assume the arena was freed, although maybe it wasn't). So I'm not really sure what's going on... but maybe the Boehm GC just isn't finding the right stuff...
I think we know what is causing this. Working on the crasher first, then the leaks. :)
Fixed. I just did this in the crasher bug. See 86313.
Hyatt, which crasher bug are you talking about? bug 86313 doesn't exist (yet)
bug 83613. And marking VERIFIED since the leak stats went down and this bug was filed because they went up..