Fix nsBoxLayout leaks. r=hyatt a=waterson b=43450

layout/xul/base/src/nsGridLayout.cpp

@@ -55,7 +55,11 @@ nsGridLayout::GetOtherMonumentsAt(nsIBox* aBox, PRInt32 aIndexOfObelisk, nsBoxSi
   nsIBox* templeBox = nsnull;
   GetOtherTemple(aBox, &temple, &templeBox, aRequestor);
   if (temple)
-    return temple->GetMonumentsAt(templeBox, aIndexOfObelisk, aList);
+  {
+    nsresult rv = temple->GetMonumentsAt(templeBox, aIndexOfObelisk, aList);
+    NS_RELEASE(temple);
+    return rv;
+  }
   else
     *aList = nsnull;
 

layout/xul/base/src/nsObeliskLayout.cpp

@@ -140,6 +140,7 @@ nsObeliskLayout::GetMinSize(nsIBox* aBox, nsBoxLayoutState& aState, nsSize& aSiz
    nsTempleLayout* temple = nsnull;
    nsIBox* aTempleBox = nsnull;
    GetOtherTemple(aBox, &temple, &aTempleBox);
+   NS_IF_RELEASE(temple);
 
    nsMonumentIterator it(aTempleBox);
    
@@ -305,6 +306,7 @@ nsObeliskLayout::PopulateBoxSizes(nsIBox* aBox, nsBoxLayoutState& aState, nsBoxS
   }
 
   nsSprocketLayout::PopulateBoxSizes(aBox, aState, aBoxSizes, aComputedBoxSizes, aMinSize, aMaxSize, aFlexes);
+  NS_IF_RELEASE(temple);
 }
 
 void

layout/xul/base/src/nsXULTreeCellFrame.cpp

@@ -32,6 +32,7 @@
 #include "nsIMonument.h"
 #include "nsIBoxLayout.h"
 #include "nsMonumentLayout.h"
+#include "nsTempleLayout.h"
 
 static NS_DEFINE_IID(kIFrameIID, NS_IFRAME_IID);
 
@@ -117,6 +118,7 @@ nsXULTreeCellFrame::GetFrameForPoint(nsIPresContext* aPresContext,
         nsTempleLayout* temple = nsnull;
         nsIBox* templeBox = nsnull;
         mon->GetOtherTemple(box, &temple, &templeBox);
+        NS_IF_RELEASE(temple);
         
         nsMonumentIterator iter(templeBox);
         nsIBox* child = nsnull;