Don't leak nsBoxToBlockAdaptors (bug 177807). r=varga, sr=dbaron.

layout/xul/base/src/nsBoxFrame.cpp

@@ -1093,14 +1093,12 @@ nsBoxFrame::DoLayout(nsBoxLayoutState& aState)
 NS_IMETHODIMP
 nsBoxFrame::Destroy(nsIPresContext* aPresContext)
 {
-// if we are root remove 1 from the debug count.
-  if (mState & NS_STATE_IS_ROOT)
-      GetDebugPref(aPresContext);
-
   // unregister access key
   RegUnregAccessKey(aPresContext, PR_FALSE);
 
-  SetLayoutManager(nsnull);
+  // clean up the container box's layout manager and child boxes
+  nsBoxLayoutState state(aPresContext);
+  nsContainerBox::Destroy(state);
 
   return nsContainerFrame::Destroy(aPresContext);
 } 

layout/xul/base/src/nsContainerBox.cpp

@@ -85,6 +85,13 @@ nsContainerBox::~nsContainerBox()
 {
 }
 
+void
+nsContainerBox::Destroy(nsBoxLayoutState& aState)
+{
+  SetLayoutManager(nsnull);
+  ClearChildren(aState);
+}
+
 #ifdef DEBUG_LAYOUT
 void
 nsContainerBox::GetBoxName(nsAutoString& aName)

layout/xul/base/src/nsContainerBox.h

@@ -53,6 +53,8 @@ public:
   nsContainerBox(nsIPresShell* aShell);
   virtual ~nsContainerBox();
 
+  void Destroy(nsBoxLayoutState& aState);
+
   NS_IMETHOD SetLayoutManager(nsIBoxLayout* aLayout);
   NS_IMETHOD GetLayoutManager(nsIBoxLayout** aLayout);
   NS_IMETHOD GetPrefSize(nsBoxLayoutState& aBoxLayoutState, nsSize& aSize);