Merge 131670

Source/WebCore/loader/ImageLoader.cpp

Index: Source/WebCore/loader/ImageLoader.cpp
===================================================================
--- Source/WebCore/loader/ImageLoader.cpp	(revision 132815)
+++ Source/WebCore/loader/ImageLoader.cpp	(working copy)
@@ -129,7 +129,7 @@
 
     // Only consider updating the protection ref-count of the Element immediately before returning
     // from this function as doing so might result in the destruction of this ImageLoader.
-    updatedHasPendingLoadEvent();
+    updatedHasPendingEvent();
 }
 
 void ImageLoader::setImageWithoutConsideringPendingLoadEvent(CachedImage* newImage)
@@ -248,7 +248,7 @@
 
     // Only consider updating the protection ref-count of the Element immediately before returning
     // from this function as doing so might result in the destruction of this ImageLoader.
-    updatedHasPendingLoadEvent();
+    updatedHasPendingEvent();
 }
 
 void ImageLoader::updateFromElementIgnoringPreviousError()
@@ -286,7 +286,7 @@
 
         // Only consider updating the protection ref-count of the Element immediately before returning
         // from this function as doing so might result in the destruction of this ImageLoader.
-        updatedHasPendingLoadEvent();
+        updatedHasPendingEvent();
         return;
     }
 
@@ -294,7 +294,7 @@
         m_hasPendingLoadEvent = false;
         // Only consider updating the protection ref-count of the Element immediately before returning
         // from this function as doing so might result in the destruction of this ImageLoader.
-        updatedHasPendingLoadEvent();
+        updatedHasPendingEvent();
         return;
     }
 
@@ -341,18 +341,17 @@
         imageResource->setCachedImage(m_image.get());
 }
 
-void ImageLoader::updatedHasPendingLoadEvent()
+void ImageLoader::updatedHasPendingEvent()
 {
-    // If an Element that does image loading is removed from the DOM the load event for the image is still observable.
+    // If an Element that does image loading is removed from the DOM the load/error event for the image is still observable.
     // As long as the ImageLoader is actively loading, the Element itself needs to be ref'ed to keep it from being
     // destroyed by DOM manipulation or garbage collection.
     // If such an Element wishes for the load to stop when removed from the DOM it needs to stop the ImageLoader explicitly.
-
-    if (m_hasPendingLoadEvent == m_elementIsProtected)
+    bool wasProtected = m_elementIsProtected;
+    m_elementIsProtected = m_hasPendingLoadEvent || m_hasPendingErrorEvent;
+    if (wasProtected == m_elementIsProtected)
         return;
 
-    m_elementIsProtected = m_hasPendingLoadEvent;
-
     if (m_elementIsProtected)
         client()->refSourceElement();
     else
@@ -397,7 +396,7 @@
 
     // Only consider updating the protection ref-count of the Element immediately before returning
     // from this function as doing so might result in the destruction of this ImageLoader.
-    updatedHasPendingLoadEvent();
+    updatedHasPendingEvent();
 }
 
 void ImageLoader::dispatchPendingLoadEvent()
@@ -413,7 +412,7 @@
 
     // Only consider updating the protection ref-count of the Element immediately before returning
     // from this function as doing so might result in the destruction of this ImageLoader.
-    updatedHasPendingLoadEvent();
+    updatedHasPendingEvent();
 }
 
 void ImageLoader::dispatchPendingErrorEvent()