Merge 117376

Source/WebCore/loader/cache/CachedImage.cpp

 /*
     Copyright (C) 1998 Lars Knoll (knoll@mpi-hd.mpg.de)
     Copyright (C) 2001 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2002 Waldo Bastian (bastian@kde.org)
     Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
     Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ skipping 57 matching lines @@
     , m_image(image)
     , m_decodedDataDeletionTimer(this, &CachedImage::decodedDataDeletionTimerFired)
     , m_shouldPaintBrokenImage(true)
 {
     setStatus(Cached);
     setLoading(false);
 }
 
 CachedImage::~CachedImage()
 {
+    clearImage();
 }
 
 void CachedImage::decodedDataDeletionTimerFired(Timer<CachedImage>*)
 {
     ASSERT(!hasClients());
     destroyDecodedData();
 }
 
 void CachedImage::load(CachedResourceLoader* cachedResourceLoader, const ResourceLoaderOptions& options)
 {
@@ skipping 207 matching lines @@
 
     m_shouldPaintBrokenImage = m_loader->frameLoader()->client()->shouldPaintBrokenImage(m_resourceRequest.url());
 }
 
 void CachedImage::clear()
 {
     destroyDecodedData();
 #if ENABLE(SVG)
     m_svgImageCache.clear();
 #endif
-    m_image = 0;
+    clearImage();
     setEncodedSize(0);
 }
 
 inline void CachedImage::createImage()
 {
     // Create the image if it doesn't yet exist.
     if (m_image)
         return;
 #if USE(CG) && !USE(WEBKIT_IMAGE_DECODERS)
     if (m_response.mimeType() == "application/pdf") {
         m_image = PDFDocumentImage::create();
         return;
     }
 #endif
 #if ENABLE(SVG)
     if (m_response.mimeType() == "image/svg+xml") {
         RefPtr<SVGImage> svgImage = SVGImage::create(this);
         m_svgImageCache = SVGImageCache::create(svgImage.get());
         m_image = svgImage.release();
         return;
     }
 #endif
     m_image = BitmapImage::create(this);
 }
 
+inline void CachedImage::clearImage()
+{
+    // If our Image has an observer, it's always us so we need to clear the back pointer
+    // before dropping our reference.
+    if (m_image)
+        m_image->setImageObserver(0);
+    m_image.clear();
+}
+
 size_t CachedImage::maximumDecodedImageSize()
 {
     if (!m_loader || m_loader->reachedTerminalState())
         return 0;
     Settings* settings = m_loader->frameLoader()->frame()->settings();
     return settings ? settings->maximumDecodedImageSize() : 0;
 }
 
 void CachedImage::data(PassRefPtr<SharedBuffer> data, bool allDataReceived)
 {
@@ skipping 119 matching lines @@
     // We have to update the cached ImageBuffers if the underlying content changed.
     if (image->isSVGImage()) {
         m_svgImageCache->imageContentChanged();
         return;
     }
 #endif
     notifyObservers(&rect);
 }
 
 } // namespace WebCore