diff --git a/mozilla/content/base/src/nsGenericDOMDataNode.cpp b/mozilla/content/base/src/nsGenericDOMDataNode.cpp
index 9e3adf8cd04..4b5e4d1ac27 100644
--- a/mozilla/content/base/src/nsGenericDOMDataNode.cpp
+++ b/mozilla/content/base/src/nsGenericDOMDataNode.cpp
@@ -619,6 +619,8 @@ nsGenericDOMDataNode::ConvertContentToXIF(const nsIContent *aOuterContent,
              buffer.Cut(0,startOffset); 
           }
           aConverter.AddContent(buffer);
+
+          NS_RELEASE(range);
         }
       }
     }
diff --git a/mozilla/content/base/src/nsSelection.cpp b/mozilla/content/base/src/nsSelection.cpp
index 06ef39a260b..be0817a2a87 100644
--- a/mozilla/content/base/src/nsSelection.cpp
+++ b/mozilla/content/base/src/nsSelection.cpp
@@ -1760,6 +1760,8 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, nsIFrame
   if (NS_FAILED(result))
     return result;
 
+  nsCOMPtr<nsIContent> theNode = aNode;
+
   if (canContainChildren)
   {
     PRInt32 childIndex  = 0;
@@ -1774,7 +1776,7 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, nsIFrame
     }
     else // HINTRIGHT
     {
-      result = aNode->ChildCount(numChildren);
+      result = theNode->ChildCount(numChildren);
 
       if (NS_FAILED(result))
         return result;
@@ -1790,12 +1792,12 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, nsIFrame
         childIndex = aOffset;
     }
 
-    result = aNode->ChildAt(childIndex, aNode);
+    result = theNode->ChildAt(childIndex, *getter_AddRefs(theNode));
 
     if (NS_FAILED(result))
       return result;
 
-    if (!aNode)
+    if (!theNode)
       return NS_ERROR_FAILURE;
 
 #ifdef DONT_DO_THIS_YET
@@ -1805,7 +1807,7 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, nsIFrame
     // Now that we have the child node, check if it too
     // can contain children. If so, call this method again!
 
-    result = aNode->CanContainChildren(canContainChildren);
+    result = theNode->CanContainChildren(canContainChildren);
 
     if (NS_FAILED(result))
       return result;
@@ -1816,7 +1818,7 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, nsIFrame
 
       if (aOffset > childIndex)
       {
-        result = aNode->ChildCount(numChildren);
+        result = theNode->ChildCount(numChildren);
 
         if (NS_FAILED(result))
           return result;
@@ -1824,15 +1826,15 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, nsIFrame
         newOffset = numChildren;
       }
 
-      return GetFrameForNodeOffset(aNode, newOffset, aReturnFrame,aReturnOffset);
+      return GetFrameForNodeOffset(theNode, newOffset, aReturnFrame,aReturnOffset);
     }
     else
 #endif // DONT_DO_THIS_YET
     {
-      // Check to see if aNode is a text node. If it is, translate
+      // Check to see if theNode is a text node. If it is, translate
       // aOffset into an offset into the text node.
 
-      nsCOMPtr<nsIDOMText> textNode = do_QueryInterface(aNode);
+      nsCOMPtr<nsIDOMText> textNode = do_QueryInterface(theNode);
 
       if (textNode)
       {
@@ -1853,7 +1855,7 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, nsIFrame
     }
   }
   
-  result = mTracker->GetPrimaryFrameFor(aNode, aReturnFrame);
+  result = mTracker->GetPrimaryFrameFor(theNode, aReturnFrame);
   if (NS_FAILED(result))
     return result;
 	
@@ -4585,7 +4587,7 @@ nsDOMSelection::ContainsNode(nsIDOMNode* aNode, PRBool aRecursive, PRBool* aYes)
     return rv;
   for (PRUint32 i=0; i < cnt; ++i)
   {
-    nsISupports* element = mRangeArray->ElementAt(i);
+    nsCOMPtr<nsISupports> element = dont_AddRef(mRangeArray->ElementAt(i));
     nsCOMPtr<nsIDOMRange>	range = do_QueryInterface(element);
     if (!range)
       return NS_ERROR_UNEXPECTED;
diff --git a/mozilla/content/html/document/src/nsHTMLDocument.cpp b/mozilla/content/html/document/src/nsHTMLDocument.cpp
index 8ce7b03a27e..d222b0b04cc 100644
--- a/mozilla/content/html/document/src/nsHTMLDocument.cpp
+++ b/mozilla/content/html/document/src/nsHTMLDocument.cpp
@@ -3083,7 +3083,7 @@ PRBool nsHTMLDocument::NodeIsBlock(nsIDOMNode * aNode, PRBool aPreIsBlock) const
       return PR_FALSE;
 
     // Wish mParserService could be mutable:
-    NS_CONST_CAST(nsHTMLDocument* , this)->mParserService = parserService;
+    NS_CONST_CAST(nsHTMLDocument* , this)->mParserService = dont_AddRef(parserService);
   }
 
   PRInt32 id;
diff --git a/mozilla/content/html/document/src/nsMarkupDocument.cpp b/mozilla/content/html/document/src/nsMarkupDocument.cpp
index ddab3f9bd99..2b6032761cd 100644
--- a/mozilla/content/html/document/src/nsMarkupDocument.cpp
+++ b/mozilla/content/html/document/src/nsMarkupDocument.cpp
@@ -254,6 +254,7 @@ void nsMarkupDocument::FinishConvertToXIF(nsXIFConverter& aConverter, nsIDOMNode
         NS_RELEASE(tag);
       }
     }
+    NS_RELEASE(content);
   }
   nsDocument::FinishConvertToXIF(aConverter,aNode);
 }
diff --git a/mozilla/layout/base/src/nsGenericDOMDataNode.cpp b/mozilla/layout/base/src/nsGenericDOMDataNode.cpp
index 9e3adf8cd04..4b5e4d1ac27 100644
--- a/mozilla/layout/base/src/nsGenericDOMDataNode.cpp
+++ b/mozilla/layout/base/src/nsGenericDOMDataNode.cpp
@@ -619,6 +619,8 @@ nsGenericDOMDataNode::ConvertContentToXIF(const nsIContent *aOuterContent,
              buffer.Cut(0,startOffset); 
           }
           aConverter.AddContent(buffer);
+
+          NS_RELEASE(range);
         }
       }
     }
diff --git a/mozilla/layout/base/src/nsSelection.cpp b/mozilla/layout/base/src/nsSelection.cpp
index 06ef39a260b..be0817a2a87 100644
--- a/mozilla/layout/base/src/nsSelection.cpp
+++ b/mozilla/layout/base/src/nsSelection.cpp
@@ -1760,6 +1760,8 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, nsIFrame
   if (NS_FAILED(result))
     return result;
 
+  nsCOMPtr<nsIContent> theNode = aNode;
+
   if (canContainChildren)
   {
     PRInt32 childIndex  = 0;
@@ -1774,7 +1776,7 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, nsIFrame
     }
     else // HINTRIGHT
     {
-      result = aNode->ChildCount(numChildren);
+      result = theNode->ChildCount(numChildren);
 
       if (NS_FAILED(result))
         return result;
@@ -1790,12 +1792,12 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, nsIFrame
         childIndex = aOffset;
     }
 
-    result = aNode->ChildAt(childIndex, aNode);
+    result = theNode->ChildAt(childIndex, *getter_AddRefs(theNode));
 
     if (NS_FAILED(result))
       return result;
 
-    if (!aNode)
+    if (!theNode)
       return NS_ERROR_FAILURE;
 
 #ifdef DONT_DO_THIS_YET
@@ -1805,7 +1807,7 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, nsIFrame
     // Now that we have the child node, check if it too
     // can contain children. If so, call this method again!
 
-    result = aNode->CanContainChildren(canContainChildren);
+    result = theNode->CanContainChildren(canContainChildren);
 
     if (NS_FAILED(result))
       return result;
@@ -1816,7 +1818,7 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, nsIFrame
 
       if (aOffset > childIndex)
       {
-        result = aNode->ChildCount(numChildren);
+        result = theNode->ChildCount(numChildren);
 
         if (NS_FAILED(result))
           return result;
@@ -1824,15 +1826,15 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, nsIFrame
         newOffset = numChildren;
       }
 
-      return GetFrameForNodeOffset(aNode, newOffset, aReturnFrame,aReturnOffset);
+      return GetFrameForNodeOffset(theNode, newOffset, aReturnFrame,aReturnOffset);
     }
     else
 #endif // DONT_DO_THIS_YET
     {
-      // Check to see if aNode is a text node. If it is, translate
+      // Check to see if theNode is a text node. If it is, translate
       // aOffset into an offset into the text node.
 
-      nsCOMPtr<nsIDOMText> textNode = do_QueryInterface(aNode);
+      nsCOMPtr<nsIDOMText> textNode = do_QueryInterface(theNode);
 
       if (textNode)
       {
@@ -1853,7 +1855,7 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, nsIFrame
     }
   }
   
-  result = mTracker->GetPrimaryFrameFor(aNode, aReturnFrame);
+  result = mTracker->GetPrimaryFrameFor(theNode, aReturnFrame);
   if (NS_FAILED(result))
     return result;
 	
@@ -4585,7 +4587,7 @@ nsDOMSelection::ContainsNode(nsIDOMNode* aNode, PRBool aRecursive, PRBool* aYes)
     return rv;
   for (PRUint32 i=0; i < cnt; ++i)
   {
-    nsISupports* element = mRangeArray->ElementAt(i);
+    nsCOMPtr<nsISupports> element = dont_AddRef(mRangeArray->ElementAt(i));
     nsCOMPtr<nsIDOMRange>	range = do_QueryInterface(element);
     if (!range)
       return NS_ERROR_UNEXPECTED;
diff --git a/mozilla/layout/generic/nsSelection.cpp b/mozilla/layout/generic/nsSelection.cpp
index 06ef39a260b..be0817a2a87 100644
--- a/mozilla/layout/generic/nsSelection.cpp
+++ b/mozilla/layout/generic/nsSelection.cpp
@@ -1760,6 +1760,8 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, nsIFrame
   if (NS_FAILED(result))
     return result;
 
+  nsCOMPtr<nsIContent> theNode = aNode;
+
   if (canContainChildren)
   {
     PRInt32 childIndex  = 0;
@@ -1774,7 +1776,7 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, nsIFrame
     }
     else // HINTRIGHT
     {
-      result = aNode->ChildCount(numChildren);
+      result = theNode->ChildCount(numChildren);
 
       if (NS_FAILED(result))
         return result;
@@ -1790,12 +1792,12 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, nsIFrame
         childIndex = aOffset;
     }
 
-    result = aNode->ChildAt(childIndex, aNode);
+    result = theNode->ChildAt(childIndex, *getter_AddRefs(theNode));
 
     if (NS_FAILED(result))
       return result;
 
-    if (!aNode)
+    if (!theNode)
       return NS_ERROR_FAILURE;
 
 #ifdef DONT_DO_THIS_YET
@@ -1805,7 +1807,7 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, nsIFrame
     // Now that we have the child node, check if it too
     // can contain children. If so, call this method again!
 
-    result = aNode->CanContainChildren(canContainChildren);
+    result = theNode->CanContainChildren(canContainChildren);
 
     if (NS_FAILED(result))
       return result;
@@ -1816,7 +1818,7 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, nsIFrame
 
       if (aOffset > childIndex)
       {
-        result = aNode->ChildCount(numChildren);
+        result = theNode->ChildCount(numChildren);
 
         if (NS_FAILED(result))
           return result;
@@ -1824,15 +1826,15 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, nsIFrame
         newOffset = numChildren;
       }
 
-      return GetFrameForNodeOffset(aNode, newOffset, aReturnFrame,aReturnOffset);
+      return GetFrameForNodeOffset(theNode, newOffset, aReturnFrame,aReturnOffset);
     }
     else
 #endif // DONT_DO_THIS_YET
     {
-      // Check to see if aNode is a text node. If it is, translate
+      // Check to see if theNode is a text node. If it is, translate
       // aOffset into an offset into the text node.
 
-      nsCOMPtr<nsIDOMText> textNode = do_QueryInterface(aNode);
+      nsCOMPtr<nsIDOMText> textNode = do_QueryInterface(theNode);
 
       if (textNode)
       {
@@ -1853,7 +1855,7 @@ nsSelection::GetFrameForNodeOffset(nsIContent *aNode, PRInt32 aOffset, nsIFrame
     }
   }
   
-  result = mTracker->GetPrimaryFrameFor(aNode, aReturnFrame);
+  result = mTracker->GetPrimaryFrameFor(theNode, aReturnFrame);
   if (NS_FAILED(result))
     return result;
 	
@@ -4585,7 +4587,7 @@ nsDOMSelection::ContainsNode(nsIDOMNode* aNode, PRBool aRecursive, PRBool* aYes)
     return rv;
   for (PRUint32 i=0; i < cnt; ++i)
   {
-    nsISupports* element = mRangeArray->ElementAt(i);
+    nsCOMPtr<nsISupports> element = dont_AddRef(mRangeArray->ElementAt(i));
     nsCOMPtr<nsIDOMRange>	range = do_QueryInterface(element);
     if (!range)
       return NS_ERROR_UNEXPECTED;
diff --git a/mozilla/layout/html/document/src/nsHTMLDocument.cpp b/mozilla/layout/html/document/src/nsHTMLDocument.cpp
index 8ce7b03a27e..d222b0b04cc 100644
--- a/mozilla/layout/html/document/src/nsHTMLDocument.cpp
+++ b/mozilla/layout/html/document/src/nsHTMLDocument.cpp
@@ -3083,7 +3083,7 @@ PRBool nsHTMLDocument::NodeIsBlock(nsIDOMNode * aNode, PRBool aPreIsBlock) const
       return PR_FALSE;
 
     // Wish mParserService could be mutable:
-    NS_CONST_CAST(nsHTMLDocument* , this)->mParserService = parserService;
+    NS_CONST_CAST(nsHTMLDocument* , this)->mParserService = dont_AddRef(parserService);
   }
 
   PRInt32 id;
diff --git a/mozilla/layout/html/document/src/nsMarkupDocument.cpp b/mozilla/layout/html/document/src/nsMarkupDocument.cpp
index ddab3f9bd99..2b6032761cd 100644
--- a/mozilla/layout/html/document/src/nsMarkupDocument.cpp
+++ b/mozilla/layout/html/document/src/nsMarkupDocument.cpp
@@ -254,6 +254,7 @@ void nsMarkupDocument::FinishConvertToXIF(nsXIFConverter& aConverter, nsIDOMNode
         NS_RELEASE(tag);
       }
     }
+    NS_RELEASE(content);
   }
   nsDocument::FinishConvertToXIF(aConverter,aNode);
 }
diff --git a/mozilla/layout/html/forms/src/nsGfxTextControlFrame.cpp b/mozilla/layout/html/forms/src/nsGfxTextControlFrame.cpp
index fbed2faee04..5a8af7992d0 100644
--- a/mozilla/layout/html/forms/src/nsGfxTextControlFrame.cpp
+++ b/mozilla/layout/html/forms/src/nsGfxTextControlFrame.cpp
@@ -3044,6 +3044,7 @@ nsGfxTextControlFrame::InstallEditor()
         // XXX DocShell redesign work
         SetFocus();
       }
+      NS_RELEASE(focusContent);
     }
     NS_RELEASE(manager);
   }