Bug 744309 - Don't kick off a new decode from RasterImage::ShutdownDecoder. r=joedrew

image/src/RasterImage.cpp

@@ -170,7 +170,8 @@ RasterImage::RasterImage(imgStatusTracker* aStatusTracker) :
   mDecoded(false),
   mHasBeenDecoded(false),
   mInDecoder(false),
-  mAnimationFinished(false)
+  mAnimationFinished(false),
+  mFinishing(false)
 {
   // Set up the discard tracker node.
   mDiscardTrackerNode.img = this;
@@ -2309,9 +2310,11 @@ RasterImage::ShutdownDecoder(eShutdownIntent aIntent)
   nsRefPtr<Decoder> decoder = mDecoder;
   mDecoder = nullptr;
 
+  mFinishing = true;
   mInDecoder = true;
   decoder->Finish();
   mInDecoder = false;
+  mFinishing = false;
 
   // Kill off our decode request, if it's pending.  (If not, this call is
   // harmless.)
@@ -2428,6 +2431,12 @@ RasterImage::RequestDecode()
   if (mDecoder && !mDecoder->IsSizeDecode())
     return NS_OK;
 
+  // mFinishing protects against the case when we enter RequestDecode from
+  // ShutdownDecoder -- in that case, we're done with the decode, we're just
+  // not quite ready to admit it.  See bug 744309.
+  if (mFinishing)
+    return NS_OK;
+
   // If our callstack goes through a size decoder, we have a problem.
   // We need to shutdown the size decode and replace it with  a full
   // decoder, but can't do that from within the decoder itself. Thus, we post

image/src/RasterImage.h

@@ -651,6 +651,9 @@ private: // data
   // of frames, or no more owning request
   bool                       mAnimationFinished:1;
 
+  // Whether we're calling Decoder::Finish() from ShutdownDecoder.
+  bool                       mFinishing:1;
+
   // Decoding
   nsresult WantDecodedFrames();
   nsresult SyncDecode();