Bug 853774 - nsBulletFrame should handle its requests more safely. r=tn

--HG--
extra : rebase_source : cdbf51bcb02cf7b072881e0bc9425fd64ebe3015
This commit is contained in:
Seth Fowler 2013-04-12 10:05:57 -07:00
parent ec6d7ab6bd
commit edbc6cf420

View File

@ -119,17 +119,25 @@ nsBulletFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
newURI->Equals(oldURI, &same);
if (same) {
needNewRequest = false;
} else {
nsLayoutUtils::DeregisterImageRequest(PresContext(), mImageRequest,
&mRequestRegistered);
mImageRequest->CancelAndForgetObserver(NS_ERROR_FAILURE);
mImageRequest = nullptr;
}
}
}
if (needNewRequest) {
nsRefPtr<imgRequestProxy> oldRequest = mImageRequest;
newRequest->Clone(mListener, getter_AddRefs(mImageRequest));
// Deregister the old request. We wait until after Clone is done in case
// the old request and the new request are the same underlying image
// accessed via different URLs.
if (oldRequest) {
nsLayoutUtils::DeregisterImageRequest(PresContext(), oldRequest,
&mRequestRegistered);
oldRequest->CancelAndForgetObserver(NS_ERROR_FAILURE);
oldRequest = nullptr;
}
// Register the new request.
if (mImageRequest) {
nsLayoutUtils::RegisterImageRequestIfAnimated(PresContext(),
mImageRequest,