From c9ed275af789678e6dc56feb86b1d94a6ad1dcbd Mon Sep 17 00:00:00 2001
From: Cameron Kaiser <classilla@floodgap.com>
Date: Sat, 27 Oct 2018 17:45:28 -0700
Subject: [PATCH] fix an assert M1416774

---
 image/imgLoader.cpp       |  6 ++++++
 image/imgLoader.h         |  1 +
 image/imgRequestProxy.cpp | 14 ++++++++++----
 3 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/image/imgLoader.cpp b/image/imgLoader.cpp
index 2e539b4f1..bfe7c2318 100644
--- a/image/imgLoader.cpp
+++ b/image/imgLoader.cpp
@@ -2757,6 +2757,12 @@ imgCacheValidator::AddProxy(imgRequestProxy* aProxy)
   mProxies.AppendObject(aProxy);
 }
 
+void
+imgCacheValidator::RemoveProxy(imgRequestProxy* aProxy)
+{
+  mProxies.RemoveObject(aProxy);
+}
+
 /** nsIRequestObserver methods **/
 
 NS_IMETHODIMP
diff --git a/image/imgLoader.h b/image/imgLoader.h
index 304484b36..479ee722f 100644
--- a/image/imgLoader.h
+++ b/image/imgLoader.h
@@ -529,6 +529,7 @@ public:
                     bool forcePrincipalCheckForCacheEntry);
 
   void AddProxy(imgRequestProxy* aProxy);
+  void RemoveProxy(imgRequestProxy* aProxy);
 
   NS_DECL_ISUPPORTS
   NS_DECL_NSITHREADRETARGETABLESTREAMLISTENER
diff --git a/image/imgRequestProxy.cpp b/image/imgRequestProxy.cpp
index baa3d16f2..2510cd890 100644
--- a/image/imgRequestProxy.cpp
+++ b/image/imgRequestProxy.cpp
@@ -338,14 +338,20 @@ imgRequestProxy::CancelAndForgetObserver(nsresult aStatus)
 
   mCanceled = true;
 
+  imgRequest* owner = GetOwner();
+  if (owner) {
+    imgCacheValidator* validator = owner->GetValidator();
+    if (validator) {
+      validator->RemoveProxy(this);
+    }
+
+    owner->RemoveProxy(this, aStatus);
+  }
+
   // Now cheat and make sure our removal from loadgroup happens async
   bool oldIsInLoadGroup = mIsInLoadGroup;
   mIsInLoadGroup = false;
 
-  if (GetOwner()) {
-    GetOwner()->RemoveProxy(this, aStatus);
-  }
-
   mIsInLoadGroup = oldIsInLoadGroup;
 
   if (mIsInLoadGroup) {