From 000699ecd866a0116c3c37cadff4a1a0c78b0a18 Mon Sep 17 00:00:00 2001
From: Steve Workman <sworkman@mozilla.com>
Date: Tue, 15 Oct 2013 16:33:11 -0700
Subject: [PATCH] Bug 924967 - Dispatch nsIRequest::Cancel to main thread in
 imgRequest::Cancel r=seth

---
 image/src/imgRequest.cpp | 40 +++++++++++++++++++++++++++++++++++-----
 image/src/imgRequest.h   |  3 +++
 2 files changed, 38 insertions(+), 5 deletions(-)

diff --git a/image/src/imgRequest.cpp b/image/src/imgRequest.cpp
index 71e8a568e31a..67529d330fd1 100644
--- a/image/src/imgRequest.cpp
+++ b/image/src/imgRequest.cpp
@@ -245,6 +245,28 @@ void imgRequest::CancelAndAbort(nsresult aStatus)
   }
 }
 
+class imgRequestMainThreadCancel : public nsRunnable
+{
+public:
+  imgRequestMainThreadCancel(imgRequest *aImgRequest, nsresult aStatus)
+    : mImgRequest(aImgRequest)
+    , mStatus(aStatus)
+  {
+    MOZ_ASSERT(!NS_IsMainThread(), "Create me off main thread only!");
+    MOZ_ASSERT(aImgRequest);
+  }
+
+  NS_IMETHOD Run()
+  {
+    MOZ_ASSERT(NS_IsMainThread(), "I should be running on the main thread!");
+    mImgRequest->ContinueCancel(mStatus);
+    return NS_OK;
+  } 
+private:
+  nsRefPtr<imgRequest> mImgRequest;
+  nsresult mStatus;
+};
+
 void imgRequest::Cancel(nsresult aStatus)
 {
   /* The Cancel() method here should only be called by this class. */
@@ -258,14 +280,22 @@ void imgRequest::Cancel(nsresult aStatus)
   statusTracker->RecordCancel();
 
   if (NS_IsMainThread()) {
-    RemoveFromCache();
+    ContinueCancel(aStatus);
   } else {
-    NS_DispatchToMainThread(
-      NS_NewRunnableMethod(this, &imgRequest::RemoveFromCache));
+    NS_DispatchToMainThread(new imgRequestMainThreadCancel(this, aStatus));
   }
+}
 
-  if (mRequest && statusTracker->IsLoading())
-    mRequest->Cancel(aStatus);
+void imgRequest::ContinueCancel(nsresult aStatus)
+{
+  MOZ_ASSERT(NS_IsMainThread());
+
+  RemoveFromCache();
+
+  nsRefPtr<imgStatusTracker> statusTracker = GetStatusTracker();
+  if (mRequest && statusTracker->IsLoading()) {
+     mRequest->Cancel(aStatus);
+  }
 }
 
 nsresult imgRequest::GetURI(ImageURL **aURI)
diff --git a/image/src/imgRequest.h b/image/src/imgRequest.h
index c66e1ecbf509..e768507162c1 100644
--- a/image/src/imgRequest.h
+++ b/image/src/imgRequest.h
@@ -72,6 +72,9 @@ public:
   // won't be sufficient.
   void CancelAndAbort(nsresult aStatus);
 
+  // Called or dispatched by cancel for main thread only execution.
+  void ContinueCancel(nsresult aStatus);
+
   // Methods that get forwarded to the Image, or deferred until it's
   // instantiated.
   nsresult LockImage();