I noticed that RenderObject registers as a client of all its background images but unregisters only from the first one. This makes it leak, and in the case of an animated image, also crash (since the image tries to notified the deleted object of changes). Test case coming up.
Created attachment 12811 [details] Test case (will crash when closed)
Created attachment 12813 [details] Deref() all background images and the border image
Comment on attachment 12813 [details] Deref() all background images and the border image r=me + if (CachedImage* backgroundImage = bgLayer->backgroundImage()) + backgroundImage->deref(this); Indented wrong -- needs more spaces.
Created attachment 12814 [details] Landable version Fixed wrong directory name and indentation (and braces).
Landed in r19273.