When style changes, set the LayoutObject as a client for all StyleImage loads.

Source/core/layout/LayoutObject.cpp

Index: Source/core/layout/LayoutObject.cpp
diff --git a/Source/core/layout/LayoutObject.cpp b/Source/core/layout/LayoutObject.cpp
index ce0831564cfa852a75a2fa0b43278a58674a5a61..b74ecd9b4a19d5df02f8c0c3e53a06e61fbcff78 100644
--- a/Source/core/layout/LayoutObject.cpp
+++ b/Source/core/layout/LayoutObject.cpp
@@ -1834,12 +1834,24 @@ void LayoutObject::setStyle(PassRefPtr<ComputedStyle> style)
     updateImage(oldStyle ? oldStyle->borderImage().image() : 0, m_style->borderImage().image());
     updateImage(oldStyle ? oldStyle->maskBoxImage().image() : 0, m_style->maskBoxImage().image());
 
+    const StyleImage* newContentImage = m_style->contentData() && m_style->contentData()->isImage() ?
+        toImageContentData(m_style->contentData())->image() : nullptr;
+    const StyleImage* oldContentImage = oldStyle && oldStyle->contentData() && oldStyle->contentData()->isImage() ?
+        toImageContentData(oldStyle->contentData())->image() : nullptr;
+    updateImage(const_cast<StyleImage*>(oldContentImage), const_cast<StyleImage*>(newContentImage));
+
+    StyleImage* newBoxReflectMaskImage = m_style->boxReflect() ? m_style->boxReflect()->mask().image() : nullptr;
+    StyleImage* oldBoxReflectMaskImage = oldStyle && oldStyle->boxReflect() ? oldStyle->boxReflect()->mask().image() : nullptr;
+    updateImage(oldBoxReflectMaskImage, newBoxReflectMaskImage);
+
     updateShapeImage(oldStyle ? oldStyle->shapeOutside() : 0, m_style->shapeOutside());
 
     bool doesNotNeedLayoutOrPaintInvalidation = !m_parent;
 
     styleDidChange(diff, oldStyle.get());
 
+    updateImage(oldStyle ? oldStyle->listStyleImage() : nullptr, m_style->listStyleImage());

[Nate Chapin, 2015/09/11 21:35:50]

It appears that this and only this needs to be after styleDidChange() If
updateImage() triggers a memory cache hit for listStyleImage(), we will crash,
because LayoutListMarker::imageChanged() assumes
LayoutListMarker::styleDidChange() has been called first.

[esprehn, 2015/09/17 08:20:48]

That needs a comment, also can we not move them all after or all before? Or fix
LayoutListMarker...

[Nate Chapin, 2015/09/22 20:24:07]

Moved this logic to LayoutListItem, since listStyleImage() is only used in
LayoutListItem and LayoutListMarker, and LayoutListMarker already registers
itself.

+
     // FIXME: |this| might be destroyed here. This can currently happen for a LayoutTextFragment when
     // its first-letter block gets an update in LayoutTextFragment::styleDidChange. For LayoutTextFragment(s),
     // we will safely bail out with the doesNotNeedLayoutOrPaintInvalidation flag. We might want to broaden
@@ -2479,6 +2491,15 @@ void LayoutObject::willBeDestroyed()
         if (StyleImage* maskBoxImage = m_style->maskBoxImage().image())
             maskBoxImage->removeClient(this);
 
+        if (m_style->contentData() && m_style->contentData()->isImage())
+            const_cast<StyleImage*>(toImageContentData(m_style->contentData())->image())->removeClient(this);

[esprehn, 2015/09/17 08:20:48]

This const_cast seems sketchy, why is it okay to cast away the const-ness and
mutate from here?  Actually why is the image const at all here?

[Nate Chapin, 2015/09/22 20:24:07]

I was scared to change it. :)

Made ComputedStyle::contentData() non-const, since that seems benign.

+
+        if (m_style->boxReflect() && m_style->boxReflect()->mask().image())
+            m_style->boxReflect()->mask().image()->removeClient(this);
+
+        if (StyleImage* listStyleImage = m_style->listStyleImage())
+            listStyleImage->removeClient(this);
+
         removeShapeImageClient(m_style->shapeOutside());
     }
     ResourceLoadPriorityOptimizer::resourceLoadPriorityOptimizer()->removeLayoutObject(this);