Make the IconLoad hold a ref to the image listener. Fixes race to a crash.

Bug 199021, r=pavlov, sr=dbaron

layout/generic/nsImageFrame.cpp

@@ -320,8 +320,8 @@ nsImageFrame::Init(nsIPresContext*  aPresContext,
 
     PRBool loadBlocked = PR_FALSE;
     imageLoader->GetImageBlocked(&loadBlocked);
-    rv = loadBlocked ? NS_ERROR_IMAGE_BLOCKED : NS_ERROR_FAILURE;
-    HandleLoadError(rv, presShell);
+    HandleLoadError(loadBlocked ? NS_ERROR_IMAGE_BLOCKED : NS_ERROR_FAILURE,
+                    presShell);
   }
   
   return rv;
@@ -1902,7 +1902,7 @@ nsresult nsImageFrame::LoadIcons(nsIPresContext *aPresContext)
 #ifdef NOISY_ICON_LOADING
       printf( "Allocating IconLoad (%p)\n", this);
 #endif
-    mIconLoad = new IconLoad(aPresContext);
+    mIconLoad = new IconLoad(aPresContext, mListener);
     if (!mIconLoad) 
       return NS_ERROR_OUT_OF_MEMORY;
     doLoad = PR_TRUE;

layout/generic/nsImageFrame.h

@@ -277,8 +277,9 @@ private:
     // private class that wraps the data and logic needed for 
     // broken image and loading image icons
   public:
-    IconLoad(nsIPresContext *aPresContext)
+    IconLoad(nsIPresContext *aPresContext, imgIDecoderObserver* aObserver)
       : mRefCount(0),
+        mLoadObserver(aObserver),
         mIconsLoaded(PR_FALSE)
     {
       GetPrefs(aPresContext);
@@ -306,6 +307,7 @@ private:
 #define NS_ICON_BROKEN_IMAGE  (1)
   public:
     struct SingleIconLoad mIconLoads[2];
+    nsCOMPtr<imgIDecoderObserver> mLoadObserver; // keeps the observer alive
     PRPackedBool     mIconsLoaded;
     PRPackedBool     mPrefForceInlineAltText;
     PRPackedBool     mPrefAllImagesBlocked;

layout/html/base/src/nsImageFrame.cpp

@@ -320,8 +320,8 @@ nsImageFrame::Init(nsIPresContext*  aPresContext,
 
     PRBool loadBlocked = PR_FALSE;
     imageLoader->GetImageBlocked(&loadBlocked);
-    rv = loadBlocked ? NS_ERROR_IMAGE_BLOCKED : NS_ERROR_FAILURE;
-    HandleLoadError(rv, presShell);
+    HandleLoadError(loadBlocked ? NS_ERROR_IMAGE_BLOCKED : NS_ERROR_FAILURE,
+                    presShell);
   }
   
   return rv;
@@ -1902,7 +1902,7 @@ nsresult nsImageFrame::LoadIcons(nsIPresContext *aPresContext)
 #ifdef NOISY_ICON_LOADING
       printf( "Allocating IconLoad (%p)\n", this);
 #endif
-    mIconLoad = new IconLoad(aPresContext);
+    mIconLoad = new IconLoad(aPresContext, mListener);
     if (!mIconLoad) 
       return NS_ERROR_OUT_OF_MEMORY;
     doLoad = PR_TRUE;

layout/html/base/src/nsImageFrame.h

@@ -277,8 +277,9 @@ private:
     // private class that wraps the data and logic needed for 
     // broken image and loading image icons
   public:
-    IconLoad(nsIPresContext *aPresContext)
+    IconLoad(nsIPresContext *aPresContext, imgIDecoderObserver* aObserver)
       : mRefCount(0),
+        mLoadObserver(aObserver),
         mIconsLoaded(PR_FALSE)
     {
       GetPrefs(aPresContext);
@@ -306,6 +307,7 @@ private:
 #define NS_ICON_BROKEN_IMAGE  (1)
   public:
     struct SingleIconLoad mIconLoads[2];
+    nsCOMPtr<imgIDecoderObserver> mLoadObserver; // keeps the observer alive
     PRPackedBool     mIconsLoaded;
     PRPackedBool     mPrefForceInlineAltText;
     PRPackedBool     mPrefAllImagesBlocked;