diff --git a/mozilla/layout/base/nsCSSRendering.cpp b/mozilla/layout/base/nsCSSRendering.cpp
index 16f51a6b161..53e04efb9d1 100644
--- a/mozilla/layout/base/nsCSSRendering.cpp
+++ b/mozilla/layout/base/nsCSSRendering.cpp
@@ -2184,7 +2184,7 @@ nsCSSRendering::PaintBackground(nsIPresContext* aPresContext,
 
     // Restore clipping
     aRenderingContext.PopState(clipState);
-
+    NS_IF_RELEASE(image);
   } else {
     // See if there's a background color specified. The background color
     // is rendered over the 'border' 'padding' and 'content' areas
@@ -2214,6 +2214,7 @@ nsCSSRendering::PaintBackground(nsIPresContext* aPresContext,
       aRenderingContext.FillRect(aBorderArea);
     }
   }
+
 }
 
 /** ---------------------------------------------------
diff --git a/mozilla/layout/generic/nsBulletFrame.cpp b/mozilla/layout/generic/nsBulletFrame.cpp
index a17d8d68cb8..5fd5b016419 100644
--- a/mozilla/layout/generic/nsBulletFrame.cpp
+++ b/mozilla/layout/generic/nsBulletFrame.cpp
@@ -36,6 +36,7 @@
 #include "nsIURL.h"
 #include "nsLayoutAtoms.h"
 #include "prprf.h"
+#include "nsIImage.h"
 
 nsBulletFrame::nsBulletFrame()
 {
@@ -134,6 +135,7 @@ nsBulletFrame::Paint(nsIPresContext*      aCX,
           aRenderingContext.DrawImage(image, innerArea);
           return NS_OK;
         }
+        NS_RELEASE(image);
       }
     }
 
diff --git a/mozilla/layout/generic/nsImageFrame.cpp b/mozilla/layout/generic/nsImageFrame.cpp
index 98a5bede1b1..4553b4fd663 100644
--- a/mozilla/layout/generic/nsImageFrame.cpp
+++ b/mozilla/layout/generic/nsImageFrame.cpp
@@ -537,6 +537,8 @@ nsImageFrame::Paint(nsIPresContext* aPresContext,
 #endif
     }
 
+    NS_IF_RELEASE(image);
+
     if (NS_STYLE_OVERFLOW_HIDDEN == disp->mOverflow) {
       PRBool clipState;
       aRenderingContext.PopState(clipState);
diff --git a/mozilla/layout/html/base/src/nsBulletFrame.cpp b/mozilla/layout/html/base/src/nsBulletFrame.cpp
index a17d8d68cb8..5fd5b016419 100644
--- a/mozilla/layout/html/base/src/nsBulletFrame.cpp
+++ b/mozilla/layout/html/base/src/nsBulletFrame.cpp
@@ -36,6 +36,7 @@
 #include "nsIURL.h"
 #include "nsLayoutAtoms.h"
 #include "prprf.h"
+#include "nsIImage.h"
 
 nsBulletFrame::nsBulletFrame()
 {
@@ -134,6 +135,7 @@ nsBulletFrame::Paint(nsIPresContext*      aCX,
           aRenderingContext.DrawImage(image, innerArea);
           return NS_OK;
         }
+        NS_RELEASE(image);
       }
     }
 
diff --git a/mozilla/layout/html/base/src/nsImageFrame.cpp b/mozilla/layout/html/base/src/nsImageFrame.cpp
index 98a5bede1b1..4553b4fd663 100644
--- a/mozilla/layout/html/base/src/nsImageFrame.cpp
+++ b/mozilla/layout/html/base/src/nsImageFrame.cpp
@@ -537,6 +537,8 @@ nsImageFrame::Paint(nsIPresContext* aPresContext,
 #endif
     }
 
+    NS_IF_RELEASE(image);
+
     if (NS_STYLE_OVERFLOW_HIDDEN == disp->mOverflow) {
       PRBool clipState;
       aRenderingContext.PopState(clipState);
diff --git a/mozilla/layout/html/style/src/nsCSSRendering.cpp b/mozilla/layout/html/style/src/nsCSSRendering.cpp
index 16f51a6b161..53e04efb9d1 100644
--- a/mozilla/layout/html/style/src/nsCSSRendering.cpp
+++ b/mozilla/layout/html/style/src/nsCSSRendering.cpp
@@ -2184,7 +2184,7 @@ nsCSSRendering::PaintBackground(nsIPresContext* aPresContext,
 
     // Restore clipping
     aRenderingContext.PopState(clipState);
-
+    NS_IF_RELEASE(image);
   } else {
     // See if there's a background color specified. The background color
     // is rendered over the 'border' 'padding' and 'content' areas
@@ -2214,6 +2214,7 @@ nsCSSRendering::PaintBackground(nsIPresContext* aPresContext,
       aRenderingContext.FillRect(aBorderArea);
     }
   }
+
 }
 
 /** ---------------------------------------------------
diff --git a/mozilla/layout/xul/base/src/nsTitledButtonFrame.cpp b/mozilla/layout/xul/base/src/nsTitledButtonFrame.cpp
index f7724b100d5..7546c01cdf4 100644
--- a/mozilla/layout/xul/base/src/nsTitledButtonFrame.cpp
+++ b/mozilla/layout/xul/base/src/nsTitledButtonFrame.cpp
@@ -910,6 +910,8 @@ nsTitledButtonFrame::PaintImage(nsIPresContext* aPresContext,
       aRenderingContext.DrawImage(image, mImageRect);
     }
 
+    NS_IF_RELEASE(image);
+
    return NS_OK;
 }