Added NS_RELEASE's to fix leaking of nsIImage's. bug=19114; r=karnaze@netscape.com

layout/base/nsCSSRendering.cpp

@@ -2184,7 +2184,7 @@ nsCSSRendering::PaintBackground(nsIPresContext* aPresContext,
 
     // Restore clipping
     aRenderingContext.PopState(clipState);
-
+    NS_IF_RELEASE(image);
   } else {
     // See if there's a background color specified. The background color
     // is rendered over the 'border' 'padding' and 'content' areas
@@ -2214,6 +2214,7 @@ nsCSSRendering::PaintBackground(nsIPresContext* aPresContext,
       aRenderingContext.FillRect(aBorderArea);
     }
   }
+
 }
 
 /** ---------------------------------------------------

layout/generic/nsBulletFrame.cpp

@@ -36,6 +36,7 @@
 #include "nsIURL.h"
 #include "nsLayoutAtoms.h"
 #include "prprf.h"
+#include "nsIImage.h"
 
 nsBulletFrame::nsBulletFrame()
 {
@@ -134,6 +135,7 @@ nsBulletFrame::Paint(nsIPresContext*      aCX,
           aRenderingContext.DrawImage(image, innerArea);
           return NS_OK;
         }
+        NS_RELEASE(image);
       }
     }
 

layout/generic/nsImageFrame.cpp

@@ -537,6 +537,8 @@ nsImageFrame::Paint(nsIPresContext* aPresContext,
 #endif
     }
 
+    NS_IF_RELEASE(image);
+
     if (NS_STYLE_OVERFLOW_HIDDEN == disp->mOverflow) {
       PRBool clipState;
       aRenderingContext.PopState(clipState);

layout/html/base/src/nsBulletFrame.cpp

@@ -36,6 +36,7 @@
 #include "nsIURL.h"
 #include "nsLayoutAtoms.h"
 #include "prprf.h"
+#include "nsIImage.h"
 
 nsBulletFrame::nsBulletFrame()
 {
@@ -134,6 +135,7 @@ nsBulletFrame::Paint(nsIPresContext*      aCX,
           aRenderingContext.DrawImage(image, innerArea);
           return NS_OK;
         }
+        NS_RELEASE(image);
       }
     }
 

layout/html/base/src/nsImageFrame.cpp

@@ -537,6 +537,8 @@ nsImageFrame::Paint(nsIPresContext* aPresContext,
 #endif
     }
 
+    NS_IF_RELEASE(image);
+
     if (NS_STYLE_OVERFLOW_HIDDEN == disp->mOverflow) {
       PRBool clipState;
       aRenderingContext.PopState(clipState);

layout/html/style/src/nsCSSRendering.cpp

@@ -2184,7 +2184,7 @@ nsCSSRendering::PaintBackground(nsIPresContext* aPresContext,
 
     // Restore clipping
     aRenderingContext.PopState(clipState);
-
+    NS_IF_RELEASE(image);
   } else {
     // See if there's a background color specified. The background color
     // is rendered over the 'border' 'padding' and 'content' areas
@@ -2214,6 +2214,7 @@ nsCSSRendering::PaintBackground(nsIPresContext* aPresContext,
       aRenderingContext.FillRect(aBorderArea);
     }
   }
+
 }
 
 /** ---------------------------------------------------

layout/xul/base/src/nsTitledButtonFrame.cpp

@@ -910,6 +910,8 @@ nsTitledButtonFrame::PaintImage(nsIPresContext* aPresContext,
       aRenderingContext.DrawImage(image, mImageRect);
     }
 
+    NS_IF_RELEASE(image);
+
    return NS_OK;
 }