Bug 795940 - Always hold on to a reference to our image from a ScaleRequest so it can't delete itself while we're outstanding. r=jlebar

image/src/RasterImage.cpp

@@ -234,8 +234,8 @@ RasterImage::RasterImage(imgStatusTracker* aStatusTracker) :
   mInDecoder(false),
   mAnimationFinished(false),
   mFinishing(false),
-  mScaleRequest(this),
+  mInUpdateImageContainer(false),
-  mInUpdateImageContainer(false)
+  mScaleRequest(this)
 {
   // Set up the discard tracker node.
   mDiscardTrackerNode.img = this;
@@ -2714,6 +2714,10 @@ RasterImage::ScaleWorker::RequestScale(RasterImage* aImg)
   if (request->isInList())
     return;
 
+  // While the request is outstanding, we hold a reference to it so it won't be
+  // deleted from under us (and, since it owns us, so we won't be deleted).
+  request->kungFuDeathGrip = request->image;
+
   mScaleRequests.insertBack(request);
 
   if (!sScaleWorkerThread) {
@@ -2758,6 +2762,11 @@ RasterImage::DrawWorker::Run()
       nsIntRect frameRect = request->srcFrame->GetRect();
       observer->FrameChanged(nullptr, request->image, &frameRect);
     }
+    if (request->done) {
+      // We are now done with this image, so we can release our reference.
+      // THIS CAN DELETE THE REQUEST!
+      request->kungFuDeathGrip = nullptr;
+    }
   }
 
   return NS_OK;

image/src/RasterImage.h

@@ -511,6 +511,7 @@ private:
     static void Stop(RasterImage* aImg);
 
     RasterImage* const image;
+    nsRefPtr<RasterImage> kungFuDeathGrip;
     imgFrame *srcFrame;
     nsAutoPtr<imgFrame> dstFrame;
     gfxSize scale;