Bug 488850. Remove imgRequestProxies from the loadgroup asynchronously. r=joedrew, sr=vlad

modules/libpr0n/src/imgRequestProxy.cpp

@@ -262,10 +262,22 @@ NS_IMETHODIMP imgRequestProxy::CancelAndForgetObserver(nsresult aStatus)
 
   mCanceled = PR_TRUE;
 
+  // Now cheat and make sure our removal from loadgroup happens async
+  PRBool oldIsInLoadGroup = mIsInLoadGroup;
+  mIsInLoadGroup = PR_FALSE;
+  
   // Passing false to aNotify means that mListener will still get
   // OnStopRequest, if needed.
   mOwner->RemoveProxy(this, aStatus, PR_FALSE);
 
+  mIsInLoadGroup = oldIsInLoadGroup;
+
+  if (mIsInLoadGroup) {
+    nsCOMPtr<nsIRunnable> ev =
+      NS_NEW_RUNNABLE_METHOD(imgRequestProxy, this, DoRemoveFromLoadGroup);
+    NS_DispatchToCurrentThread(ev);
+  }
+
   NullOutListener();
 
   return NS_OK;

modules/libpr0n/src/imgRequestProxy.h

@@ -134,7 +134,10 @@ protected:
 
   /* Do the proper refcount management to null out mListener */
   void NullOutListener();
-  
+
+  void DoRemoveFromLoadGroup() {
+    RemoveFromLoadGroup(PR_TRUE);
+  }
 private:
   friend class imgCacheValidator;