Plug more leaks

All good now.
diff --git a/src/hb-blob.cc b/src/hb-blob.cc
index cdb7496..17ff339 100644
--- a/src/hb-blob.cc
+++ b/src/hb-blob.cc
@@ -126,7 +126,7 @@
 {
   hb_blob_t *blob;
 
-  if (!length || offset >= parent->length || !(blob = hb_object_create<hb_blob_t> ()))
+  if (!length || offset >= parent->length)
     return &_hb_blob_nil;
 
   hb_blob_make_immutable (parent);
diff --git a/src/hb-open-type-private.hh b/src/hb-open-type-private.hh
index e16eddd..4aa47ec 100644
--- a/src/hb-open-type-private.hh
+++ b/src/hb-open-type-private.hh
@@ -191,8 +191,8 @@
 
   inline void setup (void)
   {
-    this->start = hb_blob_get_data (blob, NULL);
-    this->end = this->start + hb_blob_get_length (blob);
+    this->start = hb_blob_get_data (this->blob, NULL);
+    this->end = this->start + hb_blob_get_length (this->blob);
     this->edit_count = 0;
     this->debug_depth = 0;
 
@@ -321,10 +321,8 @@
 	  sane = false;
 	}
       }
-      c->finish ();
     } else {
       unsigned int edit_count = c->edit_count;
-      c->finish ();
       if (edit_count && !c->writable) {
         c->start = hb_blob_get_data_writable (blob, NULL);
 	c->end = c->start + hb_blob_get_length (blob);
@@ -339,6 +337,8 @@
       }
     }
 
+    c->finish ();
+
     (void) (HB_DEBUG_SANITIZE &&
       fprintf (stderr, "Sanitizer %p %s %s\n", blob, sane ? "passed" : "FAILED", HB_FUNC));
     if (sane)