fix an assert M1416774

image/imgLoader.cpp

@@ -2757,6 +2757,12 @@ imgCacheValidator::AddProxy(imgRequestProxy* aProxy)
   mProxies.AppendObject(aProxy);
 }
 
+void
+imgCacheValidator::RemoveProxy(imgRequestProxy* aProxy)
+{
+  mProxies.RemoveObject(aProxy);
+}
+
 /** nsIRequestObserver methods **/
 
 NS_IMETHODIMP

image/imgLoader.h

@@ -529,6 +529,7 @@ public:
                     bool forcePrincipalCheckForCacheEntry);
 
   void AddProxy(imgRequestProxy* aProxy);
+  void RemoveProxy(imgRequestProxy* aProxy);
 
   NS_DECL_ISUPPORTS
   NS_DECL_NSITHREADRETARGETABLESTREAMLISTENER

image/imgRequestProxy.cpp

@@ -338,14 +338,20 @@ imgRequestProxy::CancelAndForgetObserver(nsresult aStatus)
 
   mCanceled = true;
 
+  imgRequest* owner = GetOwner();
+  if (owner) {
+    imgCacheValidator* validator = owner->GetValidator();
+    if (validator) {
+      validator->RemoveProxy(this);
+    }
+
+    owner->RemoveProxy(this, aStatus);
+  }
+
   // Now cheat and make sure our removal from loadgroup happens async
   bool oldIsInLoadGroup = mIsInLoadGroup;
   mIsInLoadGroup = false;
 
-  if (GetOwner()) {
-    GetOwner()->RemoveProxy(this, aStatus);
-  }
-
   mIsInLoadGroup = oldIsInLoadGroup;
 
   if (mIsInLoadGroup) {