Merge 117376

Source/WebCore/loader/cache/CachedImage.cpp

Index: Source/WebCore/loader/cache/CachedImage.cpp
===================================================================
--- Source/WebCore/loader/cache/CachedImage.cpp	(revision 118299)
+++ Source/WebCore/loader/cache/CachedImage.cpp	(working copy)
@@ -75,6 +75,7 @@
 
 CachedImage::~CachedImage()
 {
+    clearImage();
 }
 
 void CachedImage::decodedDataDeletionTimerFired(Timer<CachedImage>*)
@@ -302,7 +303,7 @@
 #if ENABLE(SVG)
     m_svgImageCache.clear();
 #endif
-    m_image = 0;
+    clearImage();
     setEncodedSize(0);
 }
 
@@ -328,6 +329,15 @@
     m_image = BitmapImage::create(this);
 }
 
+inline void CachedImage::clearImage()
+{
+    // If our Image has an observer, it's always us so we need to clear the back pointer
+    // before dropping our reference.
+    if (m_image)
+        m_image->setImageObserver(0);
+    m_image.clear();
+}
+
 size_t CachedImage::maximumDecodedImageSize()
 {
     if (!m_loader || m_loader->reachedTerminalState())