diff --git a/image/src/imgRequest.cpp b/image/src/imgRequest.cpp index 03122e0966a..bea8db9cb0f 100644 --- a/image/src/imgRequest.cpp +++ b/image/src/imgRequest.cpp @@ -674,6 +674,11 @@ imgRequest::OnDataAvailable(nsIRequest *aRequest, nsISupports *ctxt, mGotData = true; + // Store and reset this for the invariant that it's always false after + // calls to OnDataAvailable (see bug 907575) + bool resniffMimeType = mResniffMimeType; + mResniffMimeType = false; + mimetype_closure closure; nsAutoCString newType; closure.newType = &newType; @@ -718,14 +723,12 @@ imgRequest::OnDataAvailable(nsIRequest *aRequest, nsISupports *ctxt, // If we've resniffed our MIME type and it changed, we need to create a // new status tracker to give to the image, because we don't have one of // our own any more. - if (mResniffMimeType) { + if (resniffMimeType) { NS_ABORT_IF_FALSE(mIsMultiPartChannel, "Resniffing a non-multipart image"); imgStatusTracker* freshTracker = new imgStatusTracker(nullptr); freshTracker->AdoptConsumers(&GetStatusTracker()); mStatusTracker = freshTracker; - - mResniffMimeType = false; } /* set our mimetype as a property */ diff --git a/image/test/mochitest/bug733553.sjs b/image/test/mochitest/bug733553.sjs index 5bf4e4aee94..c5279f3d2d5 100644 --- a/image/test/mochitest/bug733553.sjs +++ b/image/test/mochitest/bug733553.sjs @@ -11,6 +11,9 @@ var bodyParts = [ ["lime100x100.svg", "image/svg+xml"], ["animated-gif2.gif", "image/gif"], ["red.png", "image/png"], + // Mime type intentionally wrong (test for bug 907575) + ["shaver.png", "image/gif"], + ["red.png", "image/png"], ["damon.jpg", "image/jpeg"], ["damon.jpg", "application/octet-stream"], ["damon.jpg", "image/jpeg"], diff --git a/image/test/mochitest/test_bug733553.html b/image/test/mochitest/test_bug733553.html index 6f06c4367d7..aeceb496226 100644 --- a/image/test/mochitest/test_bug733553.html +++ b/image/test/mochitest/test_bug733553.html @@ -26,6 +26,10 @@ var testParts = [ [100, "lime100x100.svg"], [40, "animated-gif2.gif"], [1, "red.png"], + // Note a failure of the next 'red.png' may indicate failure of resniffing on + // this part ('shaver.png'); see bug 907575. + [177, "shaver.png"], + [1, "red.png"], [80, "damon.jpg"], [80, "damon.jpg"], [80, "damon.jpg"],