From 99bd9386cd9888164243debe4b44ce7cd66c76bf Mon Sep 17 00:00:00 2001
From: "bzbarsky%mit.edu"
 <bzbarsky%mit.edu@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Thu, 23 Feb 2006 02:46:38 +0000
Subject: [PATCH] Fix bug 323028 -- don't set our mRequest until after the
 clone is done. r+sr=dbaron, a=dveditz

git-svn-id: svn://10.0.0.236/branches/MOZILLA_1_8_0_BRANCH@190971 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/layout/base/nsImageLoader.cpp | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/mozilla/layout/base/nsImageLoader.cpp b/mozilla/layout/base/nsImageLoader.cpp
index c1f27a1d354..da4c70a987a 100644
--- a/mozilla/layout/base/nsImageLoader.cpp
+++ b/mozilla/layout/base/nsImageLoader.cpp
@@ -123,7 +123,13 @@ nsImageLoader::Load(imgIRequest *aImage)
     mRequest = nsnull;
   }
 
-  return aImage->Clone(this, getter_AddRefs(mRequest));
+  // Make sure to clone into a temporary, then set mRequest, since
+  // cloning may notify and we don't want to trigger paints from this
+  // code.
+  nsCOMPtr<imgIRequest> newRequest;
+  nsresult rv = aImage->Clone(this, getter_AddRefs(newRequest));
+  mRequest.swap(newRequest);
+  return rv;
 }