Fix leaks. r=jag, sr=blake

layout/base/nsCSSFrameConstructor.cpp

@@ -9408,6 +9408,9 @@ nsCSSFrameConstructor::ContentRemoved(nsIPresContext* aPresContext,
         DeletingFrameSubtree(aPresContext, shell, frameManager, placeholderFrame);
         rv = frameManager->RemoveFrame(aPresContext, *shell, parentFrame,
                                        nsnull, placeholderFrame);
+
+        // Destroy the real frame.
+        childFrame->Destroy(aPresContext);
         return NS_OK;
       }
     }

layout/html/style/src/nsCSSFrameConstructor.cpp

@@ -9408,6 +9408,9 @@ nsCSSFrameConstructor::ContentRemoved(nsIPresContext* aPresContext,
         DeletingFrameSubtree(aPresContext, shell, frameManager, placeholderFrame);
         rv = frameManager->RemoveFrame(aPresContext, *shell, parentFrame,
                                        nsnull, placeholderFrame);
+
+        // Destroy the real frame.
+        childFrame->Destroy(aPresContext);
         return NS_OK;
       }
     }

layout/xul/base/src/nsPopupSetFrame.cpp

@@ -156,6 +156,8 @@ nsPopupSetFrame::Destroy(nsIPresContext* aPresContext)
     nsPopupFrameList* curFrame = mPopupList;
     while (curFrame) {
       nsPopupFrameList* temp = curFrame;
+      if (curFrame->mPopupFrame)
+        curFrame->mPopupFrame->Destroy(aPresContext);
       curFrame = curFrame->mNextPopup;
       temp->mNextPopup = nsnull;
       delete temp;