We can't always assume that Images returned by StyleImage::image(RenderObject*, const IntSize&) will be kept alive by StyleImage or the CSSValue code. For example, for CSS gradients, we may need to create a new, uncached Image each time (see bug 51845).
For this reason we need to ref-count these Images which are passed back to rendering code.
Created attachment 79392 [details]
Comment on attachment 79392 [details]
Looks sane. It's always saddened me that on most platforms Image is double-refcounted, because the buffer behind the Image itself is often ref-counted.
ap was fixing style-ownership issues recently and might be curious to see this go by.