Bug 907575 - mResniffMimeType not properly reset. r=seth

image/src/imgRequest.cpp

@@ -674,6 +674,11 @@ imgRequest::OnDataAvailable(nsIRequest *aRequest, nsISupports *ctxt,
 
     mGotData = true;
 
+    // Store and reset this for the invariant that it's always false after
+    // calls to OnDataAvailable (see bug 907575)
+    bool resniffMimeType = mResniffMimeType;
+    mResniffMimeType = false;
+
     mimetype_closure closure;
     nsAutoCString newType;
     closure.newType = &newType;
@@ -718,14 +723,12 @@ imgRequest::OnDataAvailable(nsIRequest *aRequest, nsISupports *ctxt,
       // If we've resniffed our MIME type and it changed, we need to create a
       // new status tracker to give to the image, because we don't have one of
       // our own any more.
-      if (mResniffMimeType) {
+      if (resniffMimeType) {
         NS_ABORT_IF_FALSE(mIsMultiPartChannel, "Resniffing a non-multipart image");
 
         imgStatusTracker* freshTracker = new imgStatusTracker(nullptr);
         freshTracker->AdoptConsumers(&GetStatusTracker());
         mStatusTracker = freshTracker;
-
-        mResniffMimeType = false;
       }
 
       /* set our mimetype as a property */

image/test/mochitest/bug733553.sjs

@@ -11,6 +11,9 @@ var bodyParts = [
   ["lime100x100.svg", "image/svg+xml"],
   ["animated-gif2.gif", "image/gif"],
   ["red.png", "image/png"],
+  // Mime type intentionally wrong (test for bug 907575)
+  ["shaver.png", "image/gif"],
+  ["red.png", "image/png"],
   ["damon.jpg", "image/jpeg"],
   ["damon.jpg", "application/octet-stream"],
   ["damon.jpg", "image/jpeg"],

image/test/mochitest/test_bug733553.html

@@ -26,6 +26,10 @@ var testParts = [
   [100, "lime100x100.svg"],
   [40, "animated-gif2.gif"],
   [1, "red.png"],
+  // Note a failure of the next 'red.png' may indicate failure of resniffing on
+  // this part ('shaver.png'); see bug 907575.
+  [177, "shaver.png"],
+  [1, "red.png"],
   [80, "damon.jpg"],
   [80, "damon.jpg"],
   [80, "damon.jpg"],