r=pollmann, troy. Fix for bug 10564. Added some error checking code to prevent crashes reported on low memory configurations.

gfx/src/nsImageRequest.cpp

@@ -33,11 +33,15 @@ static void ns_observer_proc (XP_Observable aSource,
 {
   ImageRequestImpl *image_request = (ImageRequestImpl *)aClosure;
   IL_MessageData *message_data = (IL_MessageData *)aMsgData;
-  nsVoidArray *observer_list = image_request->GetObservers();
+  nsVoidArray *observer_list = nsnull;
   nsIImage *image = nsnull;
   //  IL_ImageReq *il_image_req = image_request->GetImageRequest();
   IL_ImageReq *il_image_req = (IL_ImageReq *)aSource;
 
+  if (image_request != nsnull) {
+    observer_list = image_request->GetObservers();
+  }
+
   if (il_image_req != nsnull) {
     IL_Pixmap *pixmap = IL_GetImagePixmap(il_image_req);
 

layout/base/src/nsFrameImageLoader.cpp

@@ -24,6 +24,7 @@
 #include "nsIImageGroup.h"
 #include "nsIImageRequest.h"
 #include "nsIStyleContext.h"
+#include "nsCOMPtr.h"
 
 #ifdef DEBUG
 #undef NOISY_IMAGE_LOADING
@@ -548,11 +549,12 @@ nsFrameImageLoader::DamageRepairFrames(const nsRect* aDamageRect)
       bounds.y += offset.y;
     }
 
-    nsIViewManager* vm;
-    view->GetViewManager(vm);
-    vm->UpdateView(view, bounds, NS_VMREFRESH_NO_SYNC);
-    NS_RELEASE(vm);
-
+    nsCOMPtr<nsIViewManager> vm = nsnull;
+    nsresult rv = NS_OK;
+    rv = view->GetViewManager(*getter_AddRefs(vm));
+    if (NS_SUCCEEDED(rv) && nsnull != vm) {
+      vm->UpdateView(view, bounds, NS_VMREFRESH_NO_SYNC);    
+    }
     pfd = pfd->mNext;
   }
 }