kernel32: Don't release preferred_locales until we're done with its members.

[Ken Thomases]

This fixes a crash.  With the previous code, user_language_string_ref referred
to an element after the array was released.  Since it wasn't an independent
copy, the element was released with the array.
---
  dlls/kernel32/locale.c |   10 ++++------
  1 files changed, 4 insertions(+), 6 deletions(-)
-------------- next part --------------
diff --git a/dlls/kernel32/locale.c b/dlls/kernel32/locale.c
index fcb8f18..845234d 100644
--- a/dlls/kernel32/locale.c
+++ b/dlls/kernel32/locale.c
@@ -2842,12 +2842,8 @@ #ifdef __APPLE__
     */
     all_locales = CFLocaleCopyAvailableLocaleIdentifiers();
     preferred_locales = CFBundleCopyLocalizationsForPreferences( all_locales, NULL );
-    if (preferred_locales)
-    {
-        if (CFArrayGetCount( preferred_locales ))
-            user_language_string_ref = CFArrayGetValueAtIndex( preferred_locales, 0 );
-        CFRelease( preferred_locales );
-    }
+    if (preferred_locales && CFArrayGetCount( preferred_locales ))
+        user_language_string_ref = CFArrayGetValueAtIndex( preferred_locales, 0 );
     CFRelease( all_locales );
 #endif /* __APPLE__ */
 
@@ -2868,6 +2864,8 @@ #ifdef __APPLE__
         lcid_LC_MESSAGES = locale_name.lcid;
         TRACE( "setting lcid_LC_MESSAGES to '%s'\n", user_locale );
     }
+    if (preferred_locales)
+        CFRelease( preferred_locales );
 #endif
 
     NtSetDefaultUILanguage( LANGIDFROMLCID(lcid_LC_MESSAGES) );