1141395 - Make the handling of ImageWrappers in nsImageFrame saner

Status: NEW

(Core :: Layout: Images, Video, and HTML Frames, defect)

Description

[Seth Fowler [:seth] [:s2h]]

Right now nsImageFrame::mImage exists either the nsImageFrame's current request's image, or an image wrapper (OrientedImage) that wraps that image. The image wrapper is used to implement the image-orientation property.

However, this interacts awkwardly with ImageLib's cache validation. We return an imgRequestProxy from LoadImage which may have an image. However, if cache validation fails, we may update the imgRequestProxy to point to a new request which doesn't have an image. When this happens, nsImageFrame::mImage may temporarily point to the old image until the new request sends SIZE_AVAILABLE. That is a bug waiting to happen.

We need to make this design saner. More investigation is needed to determine what that actually means. One possibility is that nsImageLoadingContent should own the image wrapper, not nsImageFrame, and that the wrapper should itself get wrapped in an imgRequestProxy so it can just replace nsImageLoadingContent::mCurrentRequest.