From c6bc9d5a8cd81d8713222b8eca2e41a500a9fa57 Mon Sep 17 00:00:00 2001
From: mittorn <mittorn@disroot.org>
Date: Fri, 6 Feb 2026 23:14:54 +0000
Subject: [PATCH] Issue #2932 - Ensure that
 imgRequestProxy::CancelAndForgetObserver removes itself from the cache
 validator

https://hg-edge.mozilla.org/releases/mozilla-beta/rev/af82d0c33427
---
 image/imgLoader.cpp       |  6 ++++++
 image/imgLoader.h         |  1 +
 image/imgRequestProxy.cpp | 10 ++++++++--
 3 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/image/imgLoader.cpp b/image/imgLoader.cpp
index 0a893fbe6f..6f708de0fa 100644
--- a/image/imgLoader.cpp
+++ b/image/imgLoader.cpp
@@ -2730,6 +2730,12 @@ imgCacheValidator::AddProxy(imgRequestProxy* aProxy)
   mProxies.AppendObject(aProxy);
 }
 
+void
+imgCacheValidator::RemoveProxy(imgRequestProxy* aProxy)
+{
+  mProxies.RemoveObject(aProxy);
+}
+
 /** nsIRequestObserver methods **/
 
 NS_IMETHODIMP
diff --git a/image/imgLoader.h b/image/imgLoader.h
index 6ac383cdc6..fdf8d684c1 100644
--- a/image/imgLoader.h
+++ b/image/imgLoader.h
@@ -541,6 +541,7 @@ public:
                     bool forcePrincipalCheckForCacheEntry);
 
   void AddProxy(imgRequestProxy* aProxy);
+  void RemoveProxy(imgRequestProxy* aProxy);
 
   NS_DECL_ISUPPORTS
   NS_DECL_NSITHREADRETARGETABLESTREAMLISTENER
diff --git a/image/imgRequestProxy.cpp b/image/imgRequestProxy.cpp
index 4ccf1ff1d2..08e8c61903 100644
--- a/image/imgRequestProxy.cpp
+++ b/image/imgRequestProxy.cpp
@@ -342,8 +342,14 @@ imgRequestProxy::CancelAndForgetObserver(nsresult aStatus)
   bool oldIsInLoadGroup = mIsInLoadGroup;
   mIsInLoadGroup = false;
 
-  if (GetOwner()) {
-    GetOwner()->RemoveProxy(this, aStatus);
+  imgRequest* owner = GetOwner();
+  if (owner) {
+    imgCacheValidator* validator = owner->GetValidator();
+    if (validator) {
+      validator->RemoveProxy(this);
+    }
+
+    owner->RemoveProxy(this, aStatus);
   }
 
   mIsInLoadGroup = oldIsInLoadGroup;