Bug 1568862 - Resolve dangling pointer and faulty error logic in macOS icon loaders. r=spohl

Differential Revision: https://phabricator.services.mozilla.com/D39782

--HG--
extra : moz-landing-system : lando

widget/cocoa/nsIconLoaderService.mm

@@ -143,7 +143,10 @@ nsIconLoaderService::Notify(imgIRequest* aRequest, int32_t aType, const nsIntRec
       return rv;
     }
 
-    rv = mCompletionHandler->OnComplete(mNativeIconImage);
+    NSImage* newImage = mNativeIconImage;
+    mNativeIconImage = nil;
+    rv = mCompletionHandler->OnComplete(newImage);
+
     return rv;
   }
 

widget/cocoa/nsMenuItemIconX.mm

@@ -218,12 +218,18 @@ nsresult nsMenuItemIconX::GetIconURI(nsIURI** aIconURI) {
 //
 
 nsresult nsMenuItemIconX::OnComplete(NSImage* aImage) {
-  if (!(mNativeMenuItem || aImage)) {
-    [aImage release];
-    [mNativeMenuItem setImage:nil];
+  if (!mNativeMenuItem) {
+    if (aImage) {
+      [aImage release];
+    }
     return NS_ERROR_FAILURE;
   }
 
+  if (!aImage) {
+    [mNativeMenuItem setImage:nil];
+    return NS_OK;
+  }
+
   [mNativeMenuItem setImage:aImage];
   if (mMenuObject) {
     mMenuObject->IconUpdated();