fix for timer crash with animated images when changing pages bug 73477 r=pinkerton sr=brendan

modules/libpr0n/src/imgContainer.cpp

@@ -65,7 +65,7 @@ NS_IMETHODIMP imgContainer::Init(nscoord aWidth, nscoord aHeight, imgIContainerO
 
   mSize.SizeTo(aWidth, aHeight);
 
-  mObserver = aObserver;
+  mObserver = getter_AddRefs(NS_GetWeakReference(aObserver));
 
   return NS_OK;
 }
@@ -329,7 +329,14 @@ NS_IMETHODIMP_(void) imgContainer::Notify(nsITimer *timer)
 
   if(!mAnimating || !mTimer)
     return;
-  
+
+  nsCOMPtr<imgIContainerObserver> observer(do_QueryReferent(mObserver));
+  if (!observer) {
+    // the imgRequest that owns us is dead, we should die now too.
+    this->StopAnimation();
+    return;
+  }
+
   nsCOMPtr<gfxIImageFrame> nextFrame;
   PRInt32 timeout = 100;
   PRUint32 numFrames;
@@ -381,22 +388,20 @@ NS_IMETHODIMP_(void) imgContainer::Notify(nsITimer *timer)
     
     
   nsRect dirtyRect;
+
   // update the composited frame
   if(mCompositingFrame && (previousAnimationFrameIndex != mCurrentAnimationFrameIndex)) {
     nsCOMPtr<gfxIImageFrame> frameToUse;
     DoComposite(getter_AddRefs(frameToUse), &dirtyRect, previousAnimationFrameIndex, mCurrentAnimationFrameIndex);
 
     // do notification to FE to draw this frame, but hand it the compositing frame
-    if (mObserver) {
-      mObserver->FrameChanged(this, nsnull, mCompositingFrame, &dirtyRect);
-    }
+    observer->FrameChanged(this, nsnull, mCompositingFrame, &dirtyRect);
   } 
   else {
     nextFrame->GetRect(dirtyRect);
 
     // do notification to FE to draw this frame
-    if (mObserver)
-      mObserver->FrameChanged(this, nsnull, nextFrame, &dirtyRect);
+    observer->FrameChanged(this, nsnull, nextFrame, &dirtyRect);
   }
 
 

modules/libpr0n/src/imgContainer.h

@@ -40,6 +40,8 @@
 
 #include "gfxIImageFrame.h"
 
+#include "nsWeakReference.h"
+
 #define NS_IMGCONTAINER_CID \
 { /* 5e04ec5e-1dd2-11b2-8fda-c4db5fb666e0 */         \
      0x5e04ec5e,                                     \
@@ -73,8 +75,7 @@ private:
   PRBool   mDoneDecoding;
   PRBool   mAnimating;
   
-  imgIContainerObserver *mObserver; // WEAK
-
+  nsWeakPtr mObserver;
 
   // GIF specific bits
   nsCOMPtr<nsITimer> mTimer;

modules/libpr0n/src/imgRequest.cpp

@@ -51,9 +51,10 @@
 PRLogModuleInfo *gImgLog = PR_NewLogModule("imgRequest");
 #endif
 
-NS_IMPL_ISUPPORTS6(imgRequest, imgIRequest, nsIRequest,
+NS_IMPL_ISUPPORTS7(imgRequest, imgIRequest, nsIRequest,
                    imgIDecoderObserver, imgIContainerObserver,
-                   nsIStreamListener, nsIStreamObserver)
+                   nsIStreamListener, nsIStreamObserver,
+                   nsISupportsWeakReference)
 
 imgRequest::imgRequest() : 
   mObservers(0), mLoading(PR_FALSE), mProcessing(PR_FALSE), mStatus(imgIRequest::STATUS_NONE), mState(0)

modules/libpr0n/src/imgRequest.h

@@ -37,6 +37,7 @@
 #include "nsCOMPtr.h"
 
 #include "nsVoidArray.h"
+#include "nsWeakReference.h"
 
 #include "nsString.h"
 
@@ -64,7 +65,8 @@ enum {
 
 class imgRequest : public imgIRequest,
                    public imgIDecoderObserver, 
-                   public nsIStreamListener
+                   public nsIStreamListener,
+                   public nsSupportsWeakReference
 {
 public:
   imgRequest();