Fix for bug 348511. r/sr=bz.

content/xslt/src/xslt/txMozillaXSLTProcessor.cpp

@@ -891,7 +891,8 @@ txMozillaXSLTProcessor::SetParameter(const nsAString & aNamespaceURI,
 
                 if (NS_FAILED(rv)) {
                     while (i < count) {
-                        NS_RELEASE(values[i++]);
+                        NS_RELEASE(values[i]);
+                        ++i;
                     }
                     nsMemory::Free(array);
 
@@ -1435,7 +1436,8 @@ txVariable::Convert(nsIVariant *aValue, txAExprResult** aResult)
                     txXPathNativeNode::createXPathNode(node));
                 if (!xpathNode) {
                     while (i < count) {
-                        NS_RELEASE(values[i++]);
+                        NS_RELEASE(values[i]);
+                        ++i;
                     }
                     nsMemory::Free(array);