When style changes, set the LayoutObject as a client for all StyleImage loads.

Source/core/layout/LayoutObject.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 1816 matching lines @@
 
     RefPtr<ComputedStyle> oldStyle = m_style.release();
     setStyleInternal(style);
 
     updateFillImages(oldStyle ? &oldStyle->backgroundLayers() : 0, m_style->backgroundLayers());
     updateFillImages(oldStyle ? &oldStyle->maskLayers() : 0, m_style->maskLayers());
 
     updateImage(oldStyle ? oldStyle->borderImage().image() : 0, m_style->borderImage().image());
     updateImage(oldStyle ? oldStyle->maskBoxImage().image() : 0, m_style->maskBoxImage().image());
 
+    const StyleImage* newContentImage = m_style->contentData() && m_style->contentData()->isImage() ?
+        toImageContentData(m_style->contentData())->image() : nullptr;
+    const StyleImage* oldContentImage = oldStyle && oldStyle->contentData() && oldStyle->contentData()->isImage() ?
+        toImageContentData(oldStyle->contentData())->image() : nullptr;
+    updateImage(const_cast<StyleImage*>(oldContentImage), const_cast<StyleImage*>(newContentImage));
+
+    StyleImage* newBoxReflectMaskImage = m_style->boxReflect() ? m_style->boxReflect()->mask().image() : nullptr;
+    StyleImage* oldBoxReflectMaskImage = oldStyle && oldStyle->boxReflect() ? oldStyle->boxReflect()->mask().image() : nullptr;
+    updateImage(oldBoxReflectMaskImage, newBoxReflectMaskImage);
+
     updateShapeImage(oldStyle ? oldStyle->shapeOutside() : 0, m_style->shapeOutside());
 
     bool doesNotNeedLayoutOrPaintInvalidation = !m_parent;
 
     styleDidChange(diff, oldStyle.get());
 
+    updateImage(oldStyle ? oldStyle->listStyleImage() : nullptr, m_style->listStyleImage());

[Nate Chapin, 2015/09/11 21:35:50]

It appears that this and only this needs to be after styleDidChange() If
updateImage() triggers a memory cache hit for listStyleImage(), we will crash,
because LayoutListMarker::imageChanged() assumes
LayoutListMarker::styleDidChange() has been called first.

[esprehn, 2015/09/17 08:20:48]

That needs a comment, also can we not move them all after or all before? Or fix
LayoutListMarker...

[Nate Chapin, 2015/09/22 20:24:07]

Moved this logic to LayoutListItem, since listStyleImage() is only used in
LayoutListItem and LayoutListMarker, and LayoutListMarker already registers
itself.

+
     // FIXME: |this| might be destroyed here. This can currently happen for a LayoutTextFragment when
     // its first-letter block gets an update in LayoutTextFragment::styleDidChange. For LayoutTextFragment(s),
     // we will safely bail out with the doesNotNeedLayoutOrPaintInvalidation flag. We might want to broaden
     // this condition in the future as we move layoutObject changes out of layout and into style changes.
     if (doesNotNeedLayoutOrPaintInvalidation)
         return;
 
     // Now that the layer (if any) has been updated, we need to adjust the diff again,
     // check whether we should layout now, and decide if we need to invalidate paints.
     StyleDifference updatedDiff = adjustStyleDifference(diff);
@@ skipping 619 matching lines @@
             if (StyleImage* maskImage = maskLayer->image())
                 maskImage->removeClient(this);
         }
 
         if (StyleImage* borderImage = m_style->borderImage().image())
             borderImage->removeClient(this);
 
         if (StyleImage* maskBoxImage = m_style->maskBoxImage().image())
             maskBoxImage->removeClient(this);
 
+        if (m_style->contentData() && m_style->contentData()->isImage())
+            const_cast<StyleImage*>(toImageContentData(m_style->contentData())->image())->removeClient(this);

[esprehn, 2015/09/17 08:20:48]

This const_cast seems sketchy, why is it okay to cast away the const-ness and
mutate from here?  Actually why is the image const at all here?

[Nate Chapin, 2015/09/22 20:24:07]

I was scared to change it. :)

Made ComputedStyle::contentData() non-const, since that seems benign.

+
+        if (m_style->boxReflect() && m_style->boxReflect()->mask().image())
+            m_style->boxReflect()->mask().image()->removeClient(this);
+
+        if (StyleImage* listStyleImage = m_style->listStyleImage())
+            listStyleImage->removeClient(this);
+
         removeShapeImageClient(m_style->shapeOutside());
     }
     ResourceLoadPriorityOptimizer::resourceLoadPriorityOptimizer()->removeLayoutObject(this);
 
     if (frameView())
         setIsSlowRepaintObject(false);
 }
 
 void LayoutObject::insertedIntoTree()
 {
@@ skipping 915 matching lines @@
         const blink::LayoutObject* root = object1;
         while (root->parent())
             root = root->parent();
         root->showLayoutTreeAndMark(object1, "*", object2, "-", 0);
     } else {
         fprintf(stderr, "Cannot showLayoutTree. Root is (nil)\n");
     }
 }
 
 #endif