Bug 795940 - Always hold on to a reference to our image from a ScaleRequest so it can't delete itself while we're outstanding. r=jlebar

This commit is contained in:
Joe Drew 2012-10-03 14:29:33 -04:00
parent e54e024b3f
commit a8b5aa2d73
2 changed files with 12 additions and 2 deletions

View File

@ -234,8 +234,8 @@ RasterImage::RasterImage(imgStatusTracker* aStatusTracker) :
mInDecoder(false),
mAnimationFinished(false),
mFinishing(false),
mScaleRequest(this),
mInUpdateImageContainer(false)
mInUpdateImageContainer(false),
mScaleRequest(this)
{
// Set up the discard tracker node.
mDiscardTrackerNode.img = this;
@ -2714,6 +2714,10 @@ RasterImage::ScaleWorker::RequestScale(RasterImage* aImg)
if (request->isInList())
return;
// While the request is outstanding, we hold a reference to it so it won't be
// deleted from under us (and, since it owns us, so we won't be deleted).
request->kungFuDeathGrip = request->image;
mScaleRequests.insertBack(request);
if (!sScaleWorkerThread) {
@ -2758,6 +2762,11 @@ RasterImage::DrawWorker::Run()
nsIntRect frameRect = request->srcFrame->GetRect();
observer->FrameChanged(nullptr, request->image, &frameRect);
}
if (request->done) {
// We are now done with this image, so we can release our reference.
// THIS CAN DELETE THE REQUEST!
request->kungFuDeathGrip = nullptr;
}
}
return NS_OK;

View File

@ -511,6 +511,7 @@ private:
static void Stop(RasterImage* aImg);
RasterImage* const image;
nsRefPtr<RasterImage> kungFuDeathGrip;
imgFrame *srcFrame;
nsAutoPtr<imgFrame> dstFrame;
gfxSize scale;