GitLab

JS may invoke Image.decode without capturing the Image object. If GC
kicks in, ImageLoader will be destroyed as no one owns it, which leads
to unresolved/unrejected Promise. The callback of
ChromeClient::RequestDecode should take a persistent reference instead
of weak reference to avoid ImageLoader GC.

BUG=881060
TEST=LayoutTest image-decode-promise-when-gc.html

Change-Id: Ief9c7956ddd0df81ea1f1643eb6f6c7bac946a7c
Reviewed-on: https://chromium-review.googlesource.com/1205798Reviewed-by: Nate Chapin <japhet@chromium.org>
Reviewed-by: Hiroshige Hayashizaki <hiroshige@chromium.org>
Reviewed-by: vmpstr <vmpstr@chromium.org>
Commit-Queue: Yuchen Liu <yucliu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#589687}