fixing stupid bustage from my last checkin r=saari sr=waterson

modules/libpr0n/src/imgRequest.cpp

@@ -634,6 +634,9 @@ NS_IMETHODIMP imgRequest::OnStopRequest(nsIRequest *aRequest, nsISupports *ctxt,
   PRInt32 count = mObservers.Count();
   for (PRInt32 i = 0; i < count; i++) {
     imgRequestProxy *proxy = NS_STATIC_CAST(imgRequestProxy*, mObservers[i]);
+    /* calling OnStopRequest may result in the death of |proxy| so don't use the
+       pointer after this call.
+     */
     if (proxy) proxy->OnStopRequest(aRequest, ctxt, status);
   }
 

modules/libpr0n/src/imgRequestProxy.cpp

@@ -73,10 +73,6 @@ imgRequestProxy::~imgRequestProxy()
 
 nsresult imgRequestProxy::Init(imgRequest *request, nsILoadGroup *aLoadGroup, imgIDecoderObserver *aObserver, nsISupports *cx)
 {
-  NS_PRECONDITION(aLoadGroup, "no loadgroup");
-  if (!aLoadGroup)
-    return NS_ERROR_NULL_POINTER;
-
   NS_PRECONDITION(request, "no request");
   if (!request)
     return NS_ERROR_NULL_POINTER;
@@ -87,8 +83,10 @@ nsresult imgRequestProxy::Init(imgRequest *request, nsILoadGroup *aLoadGroup, im
   mListener = aObserver;
   mContext = cx;
 
-  aLoadGroup->AddRequest(this, cx);
-  mLoadGroup = aLoadGroup;
+  if (aLoadGroup) {
+    aLoadGroup->AddRequest(this, cx);
+    mLoadGroup = aLoadGroup;
+  }
 
   request->AddProxy(this);
 
@@ -367,6 +365,13 @@ NS_IMETHODIMP imgRequestProxy::OnStopRequest(nsIRequest *request, nsISupports *c
   }
 #endif
 
+  /* calling RemoveRequest may cause the document to finish loading,
+     which could result in our death.  We need to make sure that we stay
+     alive long enough to fight another battle... at least until we exit
+     this function.
+   */
+  nsCOMPtr<imgIRequest> kungFuDeathGrip(this);
+
   mLoadGroup->RemoveRequest(this, mContext, statusCode);
   mLoadGroup = nsnull;
   return NS_OK;