Bug 479502 - Hold on to a reference to the entry when NotifyExpired is called. r=vlad

The expiration tracker doesn't hold on to references to imgCacheEntries, so if
we're deleting it from the cache, that'll bring its refcount to zero. We
always assume that, when we're calling a function, there exists a reference
that lasts as long as the function does. This patch just makes that true for
the NotifyExpired case.

modules/libpr0n/src/imgLoader.cpp

@@ -482,6 +482,10 @@ imgCacheExpirationTracker::imgCacheExpirationTracker()
 
 void imgCacheExpirationTracker::NotifyExpired(imgCacheEntry *entry)
 {
+  // Hold on to a reference to this entry, because the expiration tracker
+  // mechanism doesn't.
+  nsRefPtr<imgCacheEntry> kungFuDeathGrip(entry);
+
 #if defined(PR_LOGGING)
   nsRefPtr<imgRequest> req(entry->GetRequest());
   if (req) {